@h-rig/isolation-plugin 0.0.6-alpha.157 → 0.0.6-alpha.158

package/dist/src/task-run-snapshot.js

@@ -0,0 +1,713 @@
+// @bun
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// packages/isolation-plugin/src/sandbox/utils.ts
+import { resolveMonorepoRoot as resolveMonorepoRoot2 } from "@rig/core/layout";
+var init_utils = () => {};
+
+// packages/isolation-plugin/src/isolation/index.ts
+import { BROWSER_CONTRACT_SERVICE_CAPABILITY, MEMORY } from "@rig/contracts";
+import { safePathSegment as safePathSegment3 } from "@rig/core/safe-identifiers";
+
+// packages/isolation-plugin/src/isolation/git-native.ts
+import { tmpdir as tmpdir2 } from "os";
+import { dirname, isAbsolute, resolve as resolve2 } from "path";
+
+// packages/isolation-plugin/src/native-extract.ts
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { resolve } from "path";
+
+// packages/isolation-plugin/src/embedded-native-assets.ts
+var embeddedNatives = null;
+
+// packages/isolation-plugin/src/native-extract.ts
+var sharedNativeOutputDir = resolve(tmpdir(), "rig-native");
+var extractionCache = {};
+function hasEmbeddedNatives() {
+  return embeddedNatives != null;
+}
+function extractEmbeddedNative(name) {
+  if (name in extractionCache) {
+    return extractionCache[name] ?? null;
+  }
+  const entry = embeddedNatives?.[name];
+  if (!entry) {
+    extractionCache[name] = null;
+    return null;
+  }
+  try {
+    const targetPath = resolve(sharedNativeOutputDir, entry.fileName);
+    mkdirSync(sharedNativeOutputDir, { recursive: true });
+    const upToDate = existsSync(targetPath) && statSync(targetPath).size === entry.size;
+    if (!upToDate) {
+      const bytes = readFileSync(entry.filePath);
+      const tempPath = `${targetPath}.${process.pid}.${Date.now()}.tmp`;
+      writeFileSync(tempPath, bytes, { mode: 493 });
+      renameSync(tempPath, targetPath);
+    }
+    extractionCache[name] = targetPath;
+  } catch {
+    extractionCache[name] = null;
+  }
+  return extractionCache[name] ?? null;
+}
+
+// packages/isolation-plugin/src/isolation/git-native.ts
+var sharedGitNativeOutputDir = resolve2(tmpdir2(), "rig-native");
+var sharedGitNativeOutputPath = resolve2(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+
+// packages/isolation-plugin/src/isolation/index.ts
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { loadCapabilityForRoot, requireCapabilityForRoot, requireInstalledCapability as requireInstalledCapability2 } from "@rig/core/capability-loaders";
+import { buildPluginHostContext } from "@rig/core/plugin-host-context";
+import { TASK_DATA_SERVICE_CAPABILITY } from "@rig/contracts";
+import { resolveRuntimeWorkspaceLayout as resolveRuntimeWorkspaceLayout3 } from "@rig/core/layout";
+import { ensureRuntimeOverlay } from "@rig/core/runtime-overlay";
+import {
+  DEFAULT_RUNTIME_MEMORY_RETRIEVAL,
+  writeRuntimeContext
+} from "@rig/core/runtime-context";
+import { secretDefinesFromEnv } from "@rig/core/baked-secrets";
+
+// packages/isolation-plugin/src/isolation/home.ts
+import { resolveBunBinaryPath, resolveBunInstallDir, resolveClaudeBinaryPath, resolveClaudeInstallDir, resolveNodeInstallDir } from "@rig/core/runtime-paths";
+import { resolveRuntimeSecrets } from "@rig/core/baked-secrets";
+
+// packages/isolation-plugin/src/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, renameSync as renameSync2, rmSync, statSync as statSync2 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+
+// packages/isolation-plugin/src/sidecar-arg.ts
+var RIG_NATIVE_RUNTIME_SIDECAR_ARG = "__rig_native_runtime_sidecar";
+
+// packages/isolation-plugin/src/runtime-native.ts
+var sharedNativeRuntimeOutputDir = resolve3(tmpdir3(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve3(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+function runtimeScanWorktreesNative(worktreesRoot) {
+  const response = runNativeRuntimeSidecar({
+    op: "scan-worktrees",
+    input: { worktreesRoot }
+  });
+  if (!response.ok) {
+    throw new Error(response.error);
+  }
+  return response.entries ?? [];
+}
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  const explicitLib = process.env.RIG_NATIVE_RUNTIME_LIB?.trim();
+  if (explicitLib && existsSync2(explicitLib)) {
+    return explicitLib;
+  }
+  const embeddedPath = extractEmbeddedNative("snapshot");
+  if (embeddedPath) {
+    return embeddedPath;
+  }
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync2(outputPath) ? outputPath : null;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  const explicitLib = process.env.RIG_NATIVE_RUNTIME_LIB?.trim();
+  if (explicitLib && existsSync2(explicitLib)) {
+    const loaded = tryDlopenNativeRuntimeLibrary(explicitLib);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const embeddedPath = extractEmbeddedNative("snapshot");
+  if (embeddedPath) {
+    const loaded = tryDlopenNativeRuntimeLibrary(embeddedPath);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync2(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve3(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve3(cursor, "native", `${process.platform}-${process.arch}`, name), resolve3(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve3(cursor, "native", name), resolve3(cursor, "native", "lib", name));
+    }
+    const parent = dirname2(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname2(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve3(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve3(execDir, platformSpecific) : "",
+    execDir ? resolve3(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve3(execDir, "..", platformSpecific) : "",
+    execDir ? resolve3(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve3(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync2(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve3(import.meta.dir, "../native/snapshot.zig");
+  return existsSync2(bundled) ? bundled : null;
+}
+function resolveNativeRuntimeSidecarSourcePath() {
+  const envRoots = [
+    process.cwd()?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter(Boolean);
+  for (const root of envRoots) {
+    for (const relative of [
+      "packages/isolation-plugin/src/runtime-native-sidecar.ts",
+      "packages/isolation-plugin/dist/src/runtime-native-sidecar.js"
+    ]) {
+      const candidate = resolve3(root, relative);
+      if (existsSync2(candidate)) {
+        return candidate;
+      }
+    }
+  }
+  for (const localCandidate of [
+    resolve3(import.meta.dir, "runtime-native-sidecar.js"),
+    resolve3(import.meta.dir, "runtime-native-sidecar.ts")
+  ]) {
+    if (existsSync2(localCandidate))
+      return localCandidate;
+  }
+  return null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync2(dirname2(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync2(outputPath) || statSync2(sourcePath).mtimeMs > statSync2(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync2(tempOutputPath)) {
+      rmSync(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync2(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+function resolveNativeRuntimeSidecarCommand(request) {
+  if (hasEmbeddedNatives()) {
+    return {
+      argv: [process.execPath, RIG_NATIVE_RUNTIME_SIDECAR_ARG, JSON.stringify(request)],
+      env: {}
+    };
+  }
+  const hostBinary = process.env.RIG_NATIVE_HOST_BINARY?.trim();
+  if (hostBinary) {
+    return {
+      argv: [hostBinary, RIG_NATIVE_RUNTIME_SIDECAR_ARG, JSON.stringify(request)],
+      env: {}
+    };
+  }
+  const sidecarSourcePath = resolveNativeRuntimeSidecarSourcePath();
+  if (!sidecarSourcePath) {
+    throw new Error("runtime-native-sidecar.ts source file not found.");
+  }
+  const bunCli = resolveNativeRuntimeSidecarInvocation();
+  return {
+    argv: [bunCli.command, sidecarSourcePath, JSON.stringify(request)],
+    env: bunCli.env
+  };
+}
+function runNativeRuntimeSidecar(request) {
+  const { argv, env } = resolveNativeRuntimeSidecarCommand(request);
+  const proc = Bun.spawnSync(argv, {
+    cwd: process.env.RIG_HOST_PROJECT_ROOT?.trim() || process.cwd(),
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...env,
+      RIG_NATIVE_RUNTIME_SIDECAR: "1"
+    }
+  });
+  if (proc.exitCode !== 0) {
+    throw new Error(proc.stderr.toString() || proc.stdout.toString() || `runtime native sidecar exited ${proc.exitCode}`);
+  }
+  const stdout = proc.stdout.toString().trim();
+  if (!stdout) {
+    throw new Error("runtime native sidecar returned empty output.");
+  }
+  const responseLine = stdout.split(`
+`).map((line) => line.trim()).filter((line) => line.startsWith("{")).at(-1);
+  if (!responseLine) {
+    throw new Error(`runtime native sidecar returned no JSON response: ${stdout}`);
+  }
+  return JSON.parse(responseLine);
+}
+function resolveNativeRuntimeSidecarInvocation() {
+  const bunPath = Bun.which("bun");
+  if (bunPath) {
+    return { command: bunPath, env: {} };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  throw new Error("bun is required to run the runtime native sidecar.");
+}
+
+// packages/isolation-plugin/src/isolation/home.ts
+import { browserEnvFromContext, loadRuntimeContext, runtimeMemoryEnvFromContext, RUNTIME_CONTEXT_ENV } from "@rig/core/runtime-context";
+
+// packages/isolation-plugin/src/isolation/shared.ts
+import { agentId, safeGitRefComponent, taskRuntimeId } from "@rig/core/safe-identifiers";
+import { resolveCheckoutRoot } from "@rig/core/checkout-root";
+var generatedCredentialFiles = new Set;
+function resolveMonorepoRoot(projectRoot) {
+  return resolveCheckoutRoot(projectRoot);
+}
+function sanitizeRuntimeRefSegment(value) {
+  return safeGitRefComponent(value, { fallback: "runtime", maxLength: 64 });
+}
+
+// packages/isolation-plugin/src/isolation/home.ts
+var GITHUB_KNOWN_HOSTS = [
+  "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl",
+  "github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=",
+  "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
+].join(`
+`);
+
+// packages/isolation-plugin/src/isolation/discovery.ts
+import { existsSync as existsSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+import { resolveRuntimeWorkspaceLayout } from "@rig/core/layout";
+import { loadRuntimeContext as loadRuntimeContext2 } from "@rig/core/runtime-context";
+
+// packages/isolation-plugin/src/isolation/worktree.ts
+import { assertPathInsideRoot, safeGitRefComponent as safeGitRefComponent2, safePathSegment } from "@rig/core/safe-identifiers";
+
+// packages/isolation-plugin/src/isolation/toolchain.ts
+import { assertPathInsideRoot as assertPathInsideRoot2, safePathSegment as safePathSegment2 } from "@rig/core/safe-identifiers";
+
+// packages/isolation-plugin/src/isolation/runtime-binary-build.ts
+import { resolveRigLayout } from "@rig/core/layout";
+import { runtimeProvisioningEnv } from "@rig/core/runtime-provisioning-env";
+var runtimeBinaryBuildQueue = Promise.resolve();
+
+// packages/isolation-plugin/src/isolation/toolchain.ts
+import {
+  GUARD_TOOLCHAIN_SOURCES,
+  LIFECYCLE_TOOLCHAIN_SOURCES,
+  TOOL_MATERIALIZER
+} from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { buildProjectPluginHost, requireInstalledCapability } from "@rig/core/capability-loaders";
+import { resolveBunBinaryPath as resolveBunBinaryPath2 } from "@rig/core/runtime-paths";
+var ToolMaterializerCap = defineCapability(TOOL_MATERIALIZER);
+var GuardToolchainSourcesCap = defineCapability(GUARD_TOOLCHAIN_SOURCES);
+var LifecycleToolchainSourcesCap = defineCapability(LIFECYCLE_TOOLCHAIN_SOURCES);
+var SNAPSHOT_SIDECAR_SOURCE = ["packages", "isolation-plugin", "src", "snapshot-sidecar.ts"].join("/");
+function runtimeWorktreeId(workspaceDir) {
+  return workspaceDir.split("/").at(-1) || "runtime";
+}
+
+// packages/isolation-plugin/src/isolation/discovery.ts
+async function readRuntimeMetadata(metadataPath) {
+  if (!existsSync3(metadataPath)) {
+    return null;
+  }
+  try {
+    return await Bun.file(metadataPath).json();
+  } catch {
+    return null;
+  }
+}
+async function listAgentRuntimes(projectRoot) {
+  const runtimes = [];
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const worktreesRoot = resolve4(monorepoRoot, ".worktrees");
+  if (!existsSync3(worktreesRoot)) {
+    return [];
+  }
+  const workspaces = runtimeScanWorktreesNative(worktreesRoot);
+  for (let scan of workspaces) {
+    let workspacePath = scan.workspaceDir;
+    const workspaceLayout = resolveRuntimeWorkspaceLayout(workspacePath);
+    const rootDir = scan.runtimeDir || workspaceLayout.runtimeDir;
+    const metadataPath = scan.metadataPath || resolve4(rootDir, "runtime.json");
+    const contextFile = scan.contextPath || workspaceLayout.contextPath;
+    let mode = "worktree";
+    let createdAt = new Date().toISOString();
+    let taskId = "";
+    let runtimeId = "";
+    let binDir = workspaceLayout.binDir;
+    let logsDir = workspaceLayout.logsDir;
+    let stateDir = workspaceLayout.stateDir;
+    let sessionDir = workspaceLayout.sessionDir;
+    const metadata = await readRuntimeMetadata(metadataPath);
+    if (metadata) {
+      runtimeId = metadata.id;
+      mode = metadata.mode;
+      createdAt = metadata.createdAt;
+    }
+    if (existsSync3(contextFile)) {
+      try {
+        const ctx = loadRuntimeContext2(contextFile);
+        taskId = ctx.taskId;
+        workspacePath = ctx.workspaceDir;
+        binDir = ctx.binDir;
+        logsDir = ctx.logsDir;
+        stateDir = ctx.stateDir;
+        sessionDir = ctx.sessionDir;
+      } catch {}
+    }
+    if (!runtimeId) {
+      runtimeId = taskRuntimeId(taskId || runtimeWorktreeId(workspacePath));
+    }
+    runtimes.push({
+      id: runtimeId,
+      taskId,
+      mode,
+      rootDir,
+      workspaceDir: workspacePath,
+      homeDir: resolve4(rootDir, "home"),
+      tmpDir: resolve4(rootDir, "tmp"),
+      cacheDir: resolve4(rootDir, "cache"),
+      logsDir,
+      stateDir,
+      sessionDir,
+      claudeHomeDir: resolve4(rootDir, "home", ".claude"),
+      contextFile,
+      binDir,
+      createdAt
+    });
+  }
+  return runtimes;
+}
+
+// packages/isolation-plugin/src/isolation/runner.ts
+import { existsSync as existsSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename, resolve as resolve5 } from "path";
+
+// packages/isolation-plugin/src/runtime-config.ts
+import {
+  POLICY_VERSION
+} from "@rig/contracts";
+
+// packages/isolation-plugin/src/sandbox/backend.ts
+init_utils();
+import {
+  resolveBunInstallDir as resolveBunInstallDir2,
+  resolveClaudeInstallDir as resolveClaudeInstallDir2,
+  resolveNodeInstallDir as resolveNodeInstallDir2,
+  resolveRuntimeDependencyRoots
+} from "@rig/core/runtime-paths";
+
+// packages/isolation-plugin/src/isolation/runner.ts
+import { resolveRuntimeWorkspaceLayout as resolveRuntimeWorkspaceLayout2 } from "@rig/core/layout";
+import { resolveBunBinaryPath as resolveBunBinaryPath3 } from "@rig/core/runtime-paths";
+var SNAPSHOT_SIDECAR_READY_TIMEOUT_MS = 1e4;
+async function startRuntimeSnapshotSidecar(runtime, options = {}) {
+  const instanceId = sanitizeRuntimeRefSegment(options.instanceId?.trim() || runtime.id);
+  const readyFile = resolve5(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.ready`);
+  const requestFile = resolve5(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.request.json`);
+  rmSync2(readyFile, { force: true });
+  rmSync2(requestFile, { force: true });
+  const sidecarBinary = resolveSnapshotSidecarBinaryPath(runtime.binDir);
+  const useCompiledSidecar = shouldUseCompiledSnapshotSidecar(sidecarBinary);
+  const bunCli = useCompiledSidecar ? null : resolveBunCliInvocation();
+  const command = useCompiledSidecar ? [sidecarBinary] : [bunCli.command, resolveSnapshotSidecarScriptPath()];
+  const proc = Bun.spawn([
+    ...command,
+    "--workspace",
+    runtime.workspaceDir,
+    "--task",
+    runtime.taskId,
+    "--runtime-id",
+    runtime.id,
+    "--instance-id",
+    instanceId,
+    "--ready-file",
+    readyFile,
+    "--request-file",
+    requestFile
+  ], {
+    cwd: runtime.workspaceDir,
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...bunCli?.env ?? {}
+    }
+  });
+  const stdoutTextPromise = drainStream(proc.stdout);
+  const stderrTextPromise = drainStream(proc.stderr);
+  await waitForSnapshotSidecarReady(readyFile, proc, stdoutTextPromise, stderrTextPromise);
+  return {
+    cancel: async () => {
+      try {
+        proc.kill("SIGTERM");
+      } catch {}
+      await proc.exited;
+      rmSync2(readyFile, { force: true });
+      rmSync2(requestFile, { force: true });
+    },
+    finalize: async (commandParts, exitCode) => {
+      writeFileSync2(requestFile, `${JSON.stringify({ command: commandParts, exitCode })}
+`, "utf-8");
+      const [sidecarExitCode, stdout, stderr] = await Promise.all([
+        proc.exited,
+        stdoutTextPromise,
+        stderrTextPromise
+      ]);
+      rmSync2(readyFile, { force: true });
+      rmSync2(requestFile, { force: true });
+      if (sidecarExitCode !== 0) {
+        throw new Error(`snapshot sidecar failed (${sidecarExitCode}): ${stderr || stdout}`);
+      }
+    }
+  };
+}
+async function drainStream(stream) {
+  if (!stream)
+    return "";
+  try {
+    return await new Response(stream).text();
+  } catch {
+    return "";
+  }
+}
+function resolveSnapshotSidecarScriptPath() {
+  return resolveRuntimeSourceScriptPath("snapshot-sidecar.ts");
+}
+function resolveSnapshotSidecarBinaryPath(binDir) {
+  return resolve5(binDir, "snapshot-sidecar");
+}
+function shouldUseCompiledSnapshotSidecar(binaryPath) {
+  if (!existsSync4(binaryPath)) {
+    return false;
+  }
+  const preference = process.env.RIG_USE_COMPILED_SNAPSHOT_SIDECAR?.trim().toLowerCase();
+  if (!preference) {
+    return false;
+  }
+  return preference === "1" || preference === "true" || preference === "yes";
+}
+function resolveRuntimeSourceScriptPath(fileName) {
+  const hostRoots = [
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter((value) => Boolean(value));
+  for (const root of hostRoots) {
+    const candidate = resolve5(root, "packages/isolation-plugin/src", fileName);
+    if (existsSync4(candidate)) {
+      return candidate;
+    }
+  }
+  return resolve5(import.meta.dir, "..", fileName);
+}
+function resolveBunCliInvocation() {
+  if (process.env.RIG_BUN_PATH?.trim()) {
+    return {
+      command: process.env.RIG_BUN_PATH.trim(),
+      env: {}
+    };
+  }
+  const systemBun = Bun.which("bun")?.trim();
+  if (systemBun) {
+    return {
+      command: systemBun,
+      env: {}
+    };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  return { command: "bun", env: {} };
+}
+async function waitForSnapshotSidecarReady(readyFile, proc, stdoutTextPromise, stderrTextPromise) {
+  const deadline = Date.now() + SNAPSHOT_SIDECAR_READY_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    if (existsSync4(readyFile)) {
+      return;
+    }
+    const exitCode = proc.exitCode;
+    if (exitCode !== null) {
+      const [stderr, stdout] = await Promise.all([stderrTextPromise, stdoutTextPromise]);
+      throw new Error(`snapshot sidecar exited before ready (${exitCode}): ${stderr || stdout}`);
+    }
+    await Bun.sleep(25);
+  }
+  throw new Error(`snapshot sidecar did not become ready within ${SNAPSHOT_SIDECAR_READY_TIMEOUT_MS}ms`);
+}
+
+// packages/isolation-plugin/src/isolation/index.ts
+var TaskDataCap = defineCapability2(TASK_DATA_SERVICE_CAPABILITY);
+
+// packages/isolation-plugin/src/task-run-snapshot.ts
+async function resolveTaskRunSnapshotSidecar(input) {
+  const listRuntimes = input.listRuntimes ?? listAgentRuntimes;
+  const startSidecar = input.startSidecar ?? startRuntimeSnapshotSidecar;
+  const runtimes = await listRuntimes(input.projectRoot);
+  const runtime = runtimes.find((candidate) => candidate.id === input.runtimeId) ?? (input.workspaceDir ? runtimes.find((candidate) => candidate.workspaceDir === input.workspaceDir) : undefined);
+  if (!runtime) {
+    return {
+      sidecar: null,
+      error: `Could not locate runtime metadata for ${input.runtimeId}.`
+    };
+  }
+  try {
+    return {
+      sidecar: await startSidecar(runtime),
+      error: null
+    };
+  } catch (error) {
+    return {
+      sidecar: null,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function finalizeTaskRunSnapshot(input) {
+  const snapshotSidecar = await (input.snapshotSidecarPromise ?? Promise.resolve(null));
+  if (!snapshotSidecar) {
+    return "unavailable";
+  }
+  if (input.exit.error) {
+    await snapshotSidecar.cancel();
+    return "cancelled";
+  }
+  const exitCode = typeof input.exit.code === "number" ? input.exit.code : 1;
+  try {
+    await snapshotSidecar.finalize(input.latestProviderCommand ?? input.hostAgentCommand, exitCode);
+    return "finalized";
+  } catch (error) {
+    if (exitCode !== 0) {
+      throw error;
+    }
+    return "unavailable";
+  }
+}
+export {
+  resolveTaskRunSnapshotSidecar,
+  finalizeTaskRunSnapshot
+};