@knpkv/codecommit-core 0.11.0 → 0.14.0

package/dist/SandboxService/DockerService.d.ts

@@ -5,20 +5,23 @@
  *
  * @module
  */
-import { Context, Effect, Layer, Schema } from "effect";
+import { Context, Effect, Layer } from "effect";
 import type { Success } from "effect/Effect";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { DockerError } from "../Errors.js";
 export interface ContainerConfig {
     readonly Image: string;
     readonly Cmd: ReadonlyArray<string>;
+    readonly User?: string;
     readonly ExposedPorts: Record<string, Record<string, never>>;
     readonly HostConfig: {
         readonly Binds: ReadonlyArray<string>;
         readonly PortBindings: Record<string, ReadonlyArray<{
+            HostIp: string;
             HostPort: string;
         }>>;
         readonly NetworkMode?: string;
+        readonly CapDrop?: ReadonlyArray<string>;
     };
     readonly Env?: ReadonlyArray<string>;
     readonly Labels?: Record<string, string>;
@@ -40,6 +43,10 @@ interface DockerPsContainer {
     readonly State: string;
     readonly Labels: Record<string, string>;
 }
+export declare const renderDockerPortBinding: (containerPort: string, binding: {
+    readonly HostIp: string;
+    readonly HostPort: string;
+}) => string;
 declare const makeDockerService: Effect.Effect<{
     isAvailable: () => Effect.Effect<boolean, import("effect/PlatformError").PlatformError, never>;
     pullImage: (image: string) => Effect.Effect<void, DockerError, never>;
@@ -47,18 +54,20 @@ declare const makeDockerService: Effect.Effect<{
     startContainer: (containerId: string) => Effect.Effect<void, DockerError, never>;
     stopContainer: (containerId: string, timeout?: number) => Effect.Effect<void, DockerError, never>;
     removeContainer: (containerId: string) => Effect.Effect<void, DockerError, never>;
-    inspectContainer: (containerId: string) => Effect.Effect<Schema.Struct.ReadonlySide<{
-        readonly Id: Schema.String;
-        readonly State: Schema.Struct<{
-            readonly Status: Schema.String;
-            readonly Running: Schema.Boolean;
-        }>;
-        readonly NetworkSettings: Schema.Struct<{
-            readonly Ports: Schema.$Record<Schema.String, Schema.NullOr<Schema.$Array<Schema.Struct<{
-                readonly HostPort: Schema.String;
-            }>>>>;
-        }>;
-    }, "Type">, DockerError, never>;
+    inspectContainer: (containerId: string) => Effect.Effect<{
+        readonly Id: string;
+        readonly State: {
+            readonly Status: string;
+            readonly Running: boolean;
+        };
+        readonly NetworkSettings: {
+            readonly Ports: {
+                readonly [x: string]: readonly {
+                    readonly HostPort: string;
+                }[] | null;
+            };
+        };
+    }, DockerError, never>;
     exec: (containerId: string, cmd: ReadonlyArray<string>) => Effect.Effect<string, DockerError, never>;
     listContainersByLabel: (label: string, value: string) => Effect.Effect<DockerPsContainer[] | {
         Id: string;
@@ -66,9 +75,9 @@ declare const makeDockerService: Effect.Effect<{
         Labels: any;
     }[], DockerError, never>;
 }, never, ChildProcessSpawner.ChildProcessSpawner>;
-export interface DockerServiceShape extends Success<typeof makeDockerService> {
+export interface DockerServiceContract extends Success<typeof makeDockerService> {
 }
-declare const DockerService_base: Context.ServiceClass<DockerService, "DockerService", DockerServiceShape>;
+declare const DockerService_base: Context.ServiceClass<DockerService, "DockerService", DockerServiceContract>;
 export declare class DockerService extends DockerService_base {
     static readonly Default: Layer.Layer<DockerService, never, ChildProcessSpawner.ChildProcessSpawner>;
 }

package/dist/SandboxService/DockerService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DockerService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/DockerService.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAA;QAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAC1B,CAAA;IACD,QAAQ,CAAC,eAAe,EAAE;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,CAAA;KAC3E,CAAA;CACF;AAsBD,UAAU,iBAAiB;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACxC;AAcD,QAAA,MAAM,iBAAiB;;uBAYA,MAAM;8BAEC,eAAe;kCAqCX,MAAM;iCAGP,MAAM;mCAGJ,MAAM;oCAGL,MAAM;;;;;;;;;;;;wBAoBlB,MAAM,OAAO,aAAa,CAAC,MAAM,CAAC;mCAGvB,MAAM,SAAS,MAAM;;;;;kDAsBtD,CAAA;AAEF,MAAM,WAAW,kBAAmB,SAAQ,OAAO,CAAC,OAAO,iBAAiB,CAAC;CAAG;;AAEhF,qBAAa,aAAc,SAAQ,kBAGf;IAClB,MAAM,CAAC,QAAQ,CAAC,OAAO,6EAAiD;CACzE"}
+{"version":3,"file":"DockerService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/DockerService.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAA;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAA;QAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KACzC,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAC1B,CAAA;IACD,QAAQ,CAAC,eAAe,EAAE;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,CAAA;KAC3E,CAAA;CACF;AAsBD,UAAU,iBAAiB;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACxC;AAcD,eAAO,MAAM,uBAAuB,kBACnB,MAAM,WACZ;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC9D,MAAsF,CAAA;AAEzF,QAAA,MAAM,iBAAiB;;uBAqBA,MAAM;8BAEC,eAAe;kCA+CX,MAAM;iCAGP,MAAM;mCAGJ,MAAM;oCAGL,MAAM;;;;;;;;;;;;;;wBAoBlB,MAAM,OAAO,aAAa,CAAC,MAAM,CAAC;mCAGvB,MAAM,SAAS,MAAM;;;;;kDAsBtD,CAAA;AAEF,MAAM,WAAW,qBAAsB,SAAQ,OAAO,CAAC,OAAO,iBAAiB,CAAC;CAAG;;AAEnF,qBAAa,aAAc,SAAQ,kBAGf;IAClB,MAAM,CAAC,QAAQ,CAAC,OAAO,6EAAiD;CACzE"}

package/dist/SandboxService/DockerService.js

@@ -5,7 +5,7 @@
  *
  * @module
  */
-import { Context, Effect, Layer, Schema } from "effect";
+import { Context, Effect, Layer, Schema, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { DockerError } from "../Errors.js";
 const ContainerInfoSchema = Schema.Struct({
@@ -28,9 +28,16 @@ const decodeDockerPsRow = Schema.decodeUnknownSync(DockerPsRow);
 const emptyDockerPsContainers = () => [];
 const dockerError = (operation) => (effect) => effect.pipe(Effect.mapError((cause) => new DockerError({ operation, cause })), Effect.withSpan(`DockerService.${operation}`));
 const shellEscape = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+export const renderDockerPortBinding = (containerPort, binding) => `${binding.HostIp}:${binding.HostPort}:${containerPort.replace("/tcp", "")}`;
 const makeDockerService = Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     const docker = (...args) => spawner.string(ChildProcess.make("sh", ["-c", `docker ${args.map(shellEscape).join(" ")} 2>&1`]));
+    const dockerWithInput = (input, ...args) => spawner.string(ChildProcess.make("sh", ["-c", `docker ${args.map(shellEscape).join(" ")} 2>&1`], {
+        stdin: {
+            stream: Stream.make(input).pipe(Stream.encodeText),
+            endOnDone: true
+        }
+    }));
     const service = {
         isAvailable: () => docker("info").pipe(Effect.map(() => true), Effect.catchIf(() => true, () => Effect.succeed(false))),
         pullImage: (image) => docker("pull", image).pipe(Effect.asVoid, dockerError("pullImage")),
@@ -39,7 +46,7 @@ const makeDockerService = Effect.gen(function* () {
             // Port bindings
             for (const [containerPort, bindings] of Object.entries(config.HostConfig.PortBindings)) {
                 for (const b of bindings) {
-                    args.push("-p", `${b.HostPort}:${containerPort.replace("/tcp", "")}`);
+                    args.push("-p", renderDockerPortBinding(containerPort, b));
                 }
             }
             // Volume binds
@@ -50,10 +57,17 @@ const makeDockerService = Effect.gen(function* () {
             if (config.HostConfig.NetworkMode) {
                 args.push("--network", config.HostConfig.NetworkMode);
             }
-            // Env vars
-            for (const env of config.Env ?? []) {
-                args.push("-e", env);
+            for (const capability of config.HostConfig.CapDrop ?? []) {
+                args.push("--cap-drop", capability);
             }
+            if (config.User) {
+                args.push("--user", config.User);
+            }
+            // Keep environment values, including the generated access password, out
+            // of process arguments. Docker reads the protected parent-child pipe.
+            const environment = config.Env ?? [];
+            if (environment.length > 0)
+                args.push("--env-file", "/dev/stdin");
             // Labels
             for (const [k, v] of Object.entries(config.Labels ?? {})) {
                 args.push("-l", `${k}=${v}`);
@@ -62,7 +76,9 @@ const makeDockerService = Effect.gen(function* () {
             args.push(config.Image);
             for (const c of config.Cmd)
                 args.push(c);
-            return docker(...args).pipe(dockerError("createContainer"));
+            return (environment.length > 0
+                ? dockerWithInput(`${environment.join("\n")}\n`, ...args)
+                : docker(...args)).pipe(dockerError("createContainer"));
         },
         startContainer: (containerId) => docker("start", containerId).pipe(Effect.asVoid, dockerError("startContainer")),
         stopContainer: (containerId, timeout = 10) => docker("stop", "-t", String(timeout), containerId).pipe(Effect.asVoid, dockerError("stopContainer")),

package/dist/SandboxService/DockerService.js.map

@@ -1 +1 @@
-{"version":3,"file":"DockerService.js","sourceRoot":"","sources":["../../src/SandboxService/DockerService.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA0B1C,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;IACF,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CACxE;KACF,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC,CAAA;AAQF,MAAM,wBAAwB,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAC5F,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;AAC/D,MAAM,uBAAuB,GAAG,GAA6B,EAAE,CAAC,EAAE,CAAA;AAElE,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAU,MAA8B,EAAE,EAAE,CACrF,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,EACjE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAC9C,CAAA;AAEH,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AAElE,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAA;IAC9D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAmB,EAAE,EAAE,CACxC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAEnG,MAAM,OAAO,GAAG;QACd,WAAW,EAAE,GAAG,EAAE,CAChB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EACtB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxD;QAEH,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;QAEjG,eAAe,EAAE,CAAC,MAAuB,EAAE,EAAE;YAC3C,MAAM,IAAI,GAAkB,CAAC,QAAQ,CAAC,CAAA;YAEtC,gBAAgB;YAChB,KAAK,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;gBACvE,CAAC;YACH,CAAC;YAED,eAAe;YACf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACvB,CAAC;YAED,eAAe;YACf,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YACvD,CAAC;YAED,WAAW;YACX,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YACtB,CAAC;YAED,SAAS;YACT,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACvB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAExC,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAC7D,CAAC;QAED,cAAc,EAAE,CAAC,WAAmB,EAAE,EAAE,CACtC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAEjF,aAAa,EAAE,CAAC,WAAmB,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CACnD,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;QAEtG,eAAe,EAAE,CAAC,WAAmB,EAAE,EAAE,CACvC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAErF,gBAAgB,EAAE,CAAC,WAAmB,EAAE,EAAE,CACxC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,CACjC,WAAW,CAAC,kBAAkB,CAAC,EAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC;YACT,GAAG,EAAE,GAAG,EAAE;gBACR,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBACxD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAA;gBACtC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;YACf,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;SAC5E,CAAC,CACH,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CAC/B,aAAa,KAAK,SAAS;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAChG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAClC,CACF;QAEH,IAAI,EAAE,CAAC,WAAmB,EAAE,GAA0B,EAAE,EAAE,CACxD,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE/D,qBAAqB,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CACtD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,KAAK,IAAI,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,IAAI,CACtF,WAAW,CAAC,uBAAuB,CAAC,EACpC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC;YACT,GAAG,EAAE,GAAG,EAAE;gBACR,IAAI,CAAC,MAAM;oBAAE,OAAO,uBAAuB,EAAE,CAAA;gBAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACrC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC/C,OAAO;wBACL,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;qBAC3E,CAAA;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;SACjF,CAAC,CACH,CACF;KACJ,CAAA;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAC,CAAA;AAIF,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAG/C,CAAC,eAAe,CAAC;IAClB,MAAM,CAAU,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;CACzE"}
+{"version":3,"file":"DockerService.js","sourceRoot":"","sources":["../../src/SandboxService/DockerService.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA4B1C,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;IACF,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CACxE;KACF,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC,CAAA;AAQF,MAAM,wBAAwB,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAC5F,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;AAC/D,MAAM,uBAAuB,GAAG,GAA6B,EAAE,CAAC,EAAE,CAAA;AAElE,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAU,MAA8B,EAAE,EAAE,CACrF,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,EACjE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAC9C,CAAA;AAEH,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AAElE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,aAAqB,EACrB,OAA+D,EACvD,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAA;AAEzF,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAA;IAC9D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAmB,EAAE,EAAE,CACxC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACnG,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,GAAG,IAAmB,EAAE,EAAE,CAChE,OAAO,CAAC,MAAM,CACZ,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAChF,KAAK,EAAE;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YAClD,SAAS,EAAE,IAAI;SAChB;KACF,CAAC,CACH,CAAA;IAEH,MAAM,OAAO,GAAG;QACd,WAAW,EAAE,GAAG,EAAE,CAChB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EACtB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxD;QAEH,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;QAEjG,eAAe,EAAE,CAAC,MAAuB,EAAE,EAAE;YAC3C,MAAM,IAAI,GAAkB,CAAC,QAAQ,CAAC,CAAA;YAEtC,gBAAgB;YAChB,KAAK,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC5D,CAAC;YACH,CAAC;YAED,eAAe;YACf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACvB,CAAC;YAED,eAAe;YACf,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YACvD,CAAC;YAED,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;YACrC,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YAClC,CAAC;YAED,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;YACpC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;YAEjE,SAAS;YACT,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACvB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAExC,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBAC5B,CAAC,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;gBACzD,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,CAAC,WAAmB,EAAE,EAAE,CACtC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAEjF,aAAa,EAAE,CAAC,WAAmB,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CACnD,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;QAEtG,eAAe,EAAE,CAAC,WAAmB,EAAE,EAAE,CACvC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAErF,gBAAgB,EAAE,CAAC,WAAmB,EAAE,EAAE,CACxC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,CACjC,WAAW,CAAC,kBAAkB,CAAC,EAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC;YACT,GAAG,EAAE,GAAG,EAAE;gBACR,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBACxD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAA;gBACtC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;YACf,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;SAC5E,CAAC,CACH,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CAC/B,aAAa,KAAK,SAAS;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAChG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAClC,CACF;QAEH,IAAI,EAAE,CAAC,WAAmB,EAAE,GAA0B,EAAE,EAAE,CACxD,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE/D,qBAAqB,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CACtD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,KAAK,IAAI,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,IAAI,CACtF,WAAW,CAAC,uBAAuB,CAAC,EACpC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC;YACT,GAAG,EAAE,GAAG,EAAE;gBACR,IAAI,CAAC,MAAM;oBAAE,OAAO,uBAAuB,EAAE,CAAA;gBAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACrC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC/C,OAAO;wBACL,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;qBAC3E,CAAA;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;SACjF,CAAC,CACH,CACF;KACJ,CAAA;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAC,CAAA;AAIF,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,OAAO,EAG/C,CAAC,eAAe,CAAC;IAClB,MAAM,CAAU,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;CACzE"}

package/dist/SandboxService/PluginService.d.ts

@@ -31,9 +31,9 @@ declare const makePluginService: Effect.Effect<{
     executeHook: (hook: "onSandboxCreate" | "onSandboxReady" | "onSandboxDestroy", ctx: SandboxContext) => Effect.Effect<void, never, never>;
     listPlugins: () => Effect.Effect<string[], never, never>;
 }, never, never>;
-export interface PluginServiceShape extends Success<typeof makePluginService> {
+export interface PluginServiceContract extends Success<typeof makePluginService> {
 }
-declare const PluginService_base: Context.ServiceClass<PluginService, "PluginService", PluginServiceShape>;
+declare const PluginService_base: Context.ServiceClass<PluginService, "PluginService", PluginServiceContract>;
 export declare class PluginService extends PluginService_base {
     static readonly Default: Layer.Layer<PluginService, never, never>;
 }

package/dist/SandboxService/PluginService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PluginService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/PluginService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAS,OAAO,EAAE,MAAM,EAAE,KAAK,EAAO,MAAM,QAAQ,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE;QACX,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;QACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAC9B,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CACzE;AAED,QAAA,MAAM,iBAAiB;uBAIA,aAAa;wBAKZ,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,OAAO,cAAc;;gBAoBpG,CAAA;AAEF,MAAM,WAAW,kBAAmB,SAAQ,OAAO,CAAC,OAAO,iBAAiB,CAAC;CAAG;;AAEhF,qBAAa,aAAc,SAAQ,kBAGf;IAClB,MAAM,CAAC,QAAQ,CAAC,OAAO,2CAAiD;CACzE"}
+{"version":3,"file":"PluginService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/PluginService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAS,OAAO,EAAE,MAAM,EAAE,KAAK,EAAO,MAAM,QAAQ,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE;QACX,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;QACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAC9B,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CACzE;AAED,QAAA,MAAM,iBAAiB;uBAIA,aAAa;wBAKZ,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,OAAO,cAAc;;gBAoBpG,CAAA;AAEF,MAAM,WAAW,qBAAsB,SAAQ,OAAO,CAAC,OAAO,iBAAiB,CAAC;CAAG;;AAEnF,qBAAa,aAAc,SAAQ,kBAGf;IAClB,MAAM,CAAC,QAAQ,CAAC,OAAO,2CAAiD;CACzE"}

package/dist/SandboxService/SandboxService.d.ts

@@ -6,14 +6,15 @@
  *
  * @module
  */
-import { Config, Context, Duration, Effect, Layer } from "effect";
+import { Config, Context, Crypto, Duration, Effect, Layer } from "effect";
 import type { Success } from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import { SandboxRepo } from "../CacheService/repos/SandboxRepo.js";
-import { ConfigService } from "../ConfigService/index.js";
+import * as ChildEnv from "../ChildEnv.js";
+import { ConfigService, type SandboxConfig } from "../ConfigService/index.js";
 import { SandboxId } from "../Domain.js";
 import { SandboxError } from "../Errors.js";
-import { DockerService } from "./DockerService.js";
+import { type ContainerConfig, DockerService } from "./DockerService.js";
 import { PluginService } from "./PluginService.js";
 import { SandboxWorkerScope } from "./SandboxWorkerScope.js";
 export interface CreateSandboxParams {
@@ -24,84 +25,98 @@ export interface CreateSandboxParams {
     readonly profile: string;
     readonly region: string;
 }
+export interface SandboxContainerIdentity {
+    readonly repairRootOwnedWorkspace: boolean;
+    readonly user: string;
+}
+/** Keep the container non-root while matching the bind-mounted workspace owner when available. */
+export declare const sandboxContainerIdentityForWorkspaceOwner: (uid: number | undefined, gid: number | undefined) => SandboxContainerIdentity;
+export declare const sandboxRuntimeHome = "/tmp";
+export declare const sandboxRuntimeXdgDataHome = "/tmp/.local/share";
+export declare const makeContainerConfig: (workspacePath: string, port: number, sandboxId: string, pullRequestId: string, sandboxConfig: SandboxConfig, homePath: string, containerUser: string, accessPassword: string) => ContainerConfig;
 declare const makeSandboxService: Effect.Effect<{
-    create: (params: CreateSandboxParams) => Effect.Effect<import("effect/Schema").Struct.ReadonlySide<{
-        readonly id: import("effect/Schema").String;
-        readonly pullRequestId: import("effect/Schema").String;
-        readonly awsAccountId: import("effect/Schema").String;
-        readonly repositoryName: import("effect/Schema").String;
-        readonly sourceBranch: import("effect/Schema").String;
-        readonly containerId: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly port: import("effect/Schema").NullOr<import("effect/Schema").Number>;
-        readonly workspacePath: import("effect/Schema").String;
-        readonly status: import("effect/Schema").String;
-        readonly statusDetail: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly logs: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly error: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly createdAt: import("effect/Schema").String;
-        readonly lastActivityAt: import("effect/Schema").String;
-    }, "Type">, SandboxError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | FileSystem.FileSystem>;
-    get: (id: SandboxId) => Effect.Effect<import("effect/Schema").Struct.ReadonlySide<{
-        readonly id: import("effect/Schema").String;
-        readonly pullRequestId: import("effect/Schema").String;
-        readonly awsAccountId: import("effect/Schema").String;
-        readonly repositoryName: import("effect/Schema").String;
-        readonly sourceBranch: import("effect/Schema").String;
-        readonly containerId: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly port: import("effect/Schema").NullOr<import("effect/Schema").Number>;
-        readonly workspacePath: import("effect/Schema").String;
-        readonly status: import("effect/Schema").String;
-        readonly statusDetail: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly logs: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly error: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly createdAt: import("effect/Schema").String;
-        readonly lastActivityAt: import("effect/Schema").String;
-    }, "Type">, SandboxError, never>;
-    list: () => Effect.Effect<import("effect/Schema").Struct.ReadonlySide<{
-        readonly id: import("effect/Schema").String;
-        readonly pullRequestId: import("effect/Schema").String;
-        readonly awsAccountId: import("effect/Schema").String;
-        readonly repositoryName: import("effect/Schema").String;
-        readonly sourceBranch: import("effect/Schema").String;
-        readonly containerId: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly port: import("effect/Schema").NullOr<import("effect/Schema").Number>;
-        readonly workspacePath: import("effect/Schema").String;
-        readonly status: import("effect/Schema").String;
-        readonly statusDetail: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly logs: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly error: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly createdAt: import("effect/Schema").String;
-        readonly lastActivityAt: import("effect/Schema").String;
-    }, "Type">[], import("../CacheService/CacheError.ts").CacheError, never>;
-    listAll: () => Effect.Effect<import("effect/Schema").Struct.ReadonlySide<{
-        readonly id: import("effect/Schema").String;
-        readonly pullRequestId: import("effect/Schema").String;
-        readonly awsAccountId: import("effect/Schema").String;
-        readonly repositoryName: import("effect/Schema").String;
-        readonly sourceBranch: import("effect/Schema").String;
-        readonly containerId: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly port: import("effect/Schema").NullOr<import("effect/Schema").Number>;
-        readonly workspacePath: import("effect/Schema").String;
-        readonly status: import("effect/Schema").String;
-        readonly statusDetail: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly logs: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly error: import("effect/Schema").NullOr<import("effect/Schema").String>;
-        readonly createdAt: import("effect/Schema").String;
-        readonly lastActivityAt: import("effect/Schema").String;
-    }, "Type">[], import("../CacheService/CacheError.ts").CacheError, never>;
+    create: (params: CreateSandboxParams) => Effect.Effect<{
+        readonly id: string;
+        readonly pullRequestId: string;
+        readonly awsAccountId: string;
+        readonly repositoryName: string;
+        readonly sourceBranch: string;
+        readonly accessPassword: string | null;
+        readonly containerId: string | null;
+        readonly port: number | null;
+        readonly workspacePath: string;
+        readonly status: string;
+        readonly statusDetail: string | null;
+        readonly logs: string | null;
+        readonly error: string | null;
+        readonly createdAt: string;
+        readonly lastActivityAt: string;
+    }, SandboxError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | FileSystem.FileSystem | ChildEnv.HostEnvironment | import("effect/Path").Path>;
+    get: (id: SandboxId) => Effect.Effect<{
+        readonly id: string;
+        readonly pullRequestId: string;
+        readonly awsAccountId: string;
+        readonly repositoryName: string;
+        readonly sourceBranch: string;
+        readonly accessPassword: string | null;
+        readonly containerId: string | null;
+        readonly port: number | null;
+        readonly workspacePath: string;
+        readonly status: string;
+        readonly statusDetail: string | null;
+        readonly logs: string | null;
+        readonly error: string | null;
+        readonly createdAt: string;
+        readonly lastActivityAt: string;
+    }, SandboxError, never>;
+    list: () => Effect.Effect<{
+        readonly id: string;
+        readonly pullRequestId: string;
+        readonly awsAccountId: string;
+        readonly repositoryName: string;
+        readonly sourceBranch: string;
+        readonly accessPassword: string | null;
+        readonly containerId: string | null;
+        readonly port: number | null;
+        readonly workspacePath: string;
+        readonly status: string;
+        readonly statusDetail: string | null;
+        readonly logs: string | null;
+        readonly error: string | null;
+        readonly createdAt: string;
+        readonly lastActivityAt: string;
+    }[], import("../CacheService/CacheError.ts").CacheError, never>;
+    listAll: () => Effect.Effect<{
+        readonly id: string;
+        readonly pullRequestId: string;
+        readonly awsAccountId: string;
+        readonly repositoryName: string;
+        readonly sourceBranch: string;
+        readonly accessPassword: string | null;
+        readonly containerId: string | null;
+        readonly port: number | null;
+        readonly workspacePath: string;
+        readonly status: string;
+        readonly statusDetail: string | null;
+        readonly logs: string | null;
+        readonly error: string | null;
+        readonly createdAt: string;
+        readonly lastActivityAt: string;
+    }[], import("../CacheService/CacheError.ts").CacheError, never>;
     stop: (id: SandboxId) => Effect.Effect<void, SandboxError, never>;
     restart: (id: SandboxId) => Effect.Effect<undefined, SandboxError, never>;
     cleanup: (id: SandboxId) => Effect.Effect<void, SandboxError, FileSystem.FileSystem>;
-    reconcile: () => Effect.Effect<void, never, never>;
+    reconcile: () => Effect.Effect<boolean, never, never>;
+    hasLegacyUnauthenticated: () => Effect.Effect<boolean, import("../CacheService/CacheError.ts").CacheError, never>;
     gcIdle: (idleTimeout?: Duration.Duration, cleanupDelay?: Duration.Duration) => Effect.Effect<void, never, FileSystem.FileSystem>;
-}, never, ConfigService | DockerService | PluginService | SandboxRepo | SandboxWorkerScope>;
-export interface SandboxServiceShape extends Success<typeof makeSandboxService> {
+}, never, ConfigService | Crypto.Crypto | DockerService | PluginService | SandboxRepo | SandboxWorkerScope>;
+export interface SandboxServiceContract extends Success<typeof makeSandboxService> {
 }
-declare const SandboxService_base: Context.ServiceClass<SandboxService, "SandboxService", SandboxServiceShape>;
+declare const SandboxService_base: Context.ServiceClass<SandboxService, "SandboxService", SandboxServiceContract>;
 export declare class SandboxService extends SandboxService_base {
     /** Dependency-requiring layer used by composition tests and custom runtimes. @internal */
-    static readonly layer: Layer.Layer<SandboxService, never, ConfigService | DockerService | PluginService | SandboxRepo | SandboxWorkerScope>;
-    static readonly Default: Layer.Layer<SandboxService, Config.ConfigError | import("@effect/sql-libsql/LibsqlMigrator").MigrationError | import("effect/PlatformError").PlatformError | import("effect/unstable/sql/SqlError").SqlError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | ConfigService | FileSystem.FileSystem>;
+    static readonly layer: Layer.Layer<SandboxService, never, ConfigService | Crypto.Crypto | DockerService | PluginService | SandboxRepo | SandboxWorkerScope>;
+    static readonly Default: Layer.Layer<SandboxService, import("../CacheService/CacheError.ts").CacheError | Config.ConfigError | import("@effect/sql-libsql/LibsqlMigrator").MigrationError | import("effect/unstable/sql/SqlError").SqlError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | ConfigService | Crypto.Crypto>;
 }
 export {};
 //# sourceMappingURL=SandboxService.d.ts.map

package/dist/SandboxService/SandboxService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SandboxService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/SandboxService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAEL,MAAM,EACN,OAAO,EACP,QAAQ,EACR,MAAM,EACN,KAAK,EAON,MAAM,QAAQ,CAAA;AACf,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,WAAW,EAAmB,MAAM,sCAAsC,CAAA;AAEnF,OAAO,EAAE,aAAa,EAA4C,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAiC,SAAS,EAAsB,MAAM,cAAc,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAwB,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA2CD,QAAA,MAAM,kBAAkB;qBA4DH,mBAAmB;;;;;;;;;;;;;;;;cAuL1B,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eASR,SAAS;kBAiBN,SAAS;kBA+BT,SAAS;;;2FAoFzB,CAAA;AAEF,MAAM,WAAW,mBAAoB,SAAQ,OAAO,CAAC,OAAO,kBAAkB,CAAC;CAAG;;AAElF,qBAAa,cAAe,SAAQ,mBAGf;IACnB,0FAA0F;IAC1F,MAAM,CAAC,QAAQ,CAAC,KAAK,uHAAmD;IAExE,MAAM,CAAC,QAAQ,CAAC,OAAO,mUAItB;CACF"}
+{"version":3,"file":"SandboxService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/SandboxService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAEL,MAAM,EACN,OAAO,EACP,MAAM,EACN,QAAQ,EACR,MAAM,EACN,KAAK,EAON,MAAM,QAAQ,CAAA;AACf,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,WAAW,EAAmB,MAAM,sCAAsC,CAAA;AACnF,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EACL,aAAa,EAEb,KAAK,aAAa,EAEnB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAiC,SAAS,EAAsB,MAAM,cAAc,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,KAAK,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,kGAAkG;AAClG,eAAO,MAAM,yCAAyC,QAC/C,MAAM,GAAG,SAAS,OAClB,MAAM,GAAG,SAAS,KACtB,wBAKyD,CAAA;AAG5D,eAAO,MAAM,kBAAkB,SAAS,CAAA;AACxC,eAAO,MAAM,yBAAyB,sBAAuC,CAAA;AAY7E,eAAO,MAAM,mBAAmB,kBACf,MAAM,QACf,MAAM,aACD,MAAM,iBACF,MAAM,iBACN,aAAa,YAClB,MAAM,iBACD,MAAM,kBACL,MAAM,KACrB,eA2BD,CAAA;AAEF,QAAA,MAAM,kBAAkB;qBA6DH,mBAAmB;;;;;;;;;;;;;;;;;cAyM1B,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eASR,SAAS;kBAiBN,SAAS;kBAuCT,SAAS;;;;2GAiHzB,CAAA;AAEF,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CAAC,OAAO,kBAAkB,CAAC;CAAG;;AAErF,qBAAa,cAAe,SAAQ,mBAGf;IACnB,0FAA0F;IAC1F,MAAM,CAAC,QAAQ,CAAC,KAAK,uIAAmD;IAExE,MAAM,CAAC,QAAQ,CAAC,OAAO,iUAItB;CACF"}

package/dist/SandboxService/SandboxService.js

@@ -6,34 +6,49 @@
  *
  * @module
  */
-import { Clock, Config, Context, Duration, Effect, Layer, Option, Predicate, Random, Result, Schedule, Stream } from "effect";
+import { Clock, Config, Context, Crypto, Duration, Effect, Layer, Option, Predicate, Random, Result, Schedule, Stream } from "effect";
 import * as FileSystem from "effect/FileSystem";
 import { ChildProcess } from "effect/unstable/process";
 import { SandboxRepo } from "../CacheService/repos/SandboxRepo.js";
 import * as ChildEnv from "../ChildEnv.js";
-import { ConfigService, defaultSandboxConfig } from "../ConfigService/index.js";
+import { ConfigService, defaultSandboxConfig, validateSandboxConfig } from "../ConfigService/index.js";
 import { PullRequestId, RepositoryName, SandboxId } from "../Domain.js";
 import { SandboxError } from "../Errors.js";
 import { DockerService } from "./DockerService.js";
 import { PluginService } from "./PluginService.js";
 import { SandboxWorkerScope } from "./SandboxWorkerScope.js";
+/** Keep the container non-root while matching the bind-mounted workspace owner when available. */
+export const sandboxContainerIdentityForWorkspaceOwner = (uid, gid) => uid === 0
+    ? { user: "1000:1000", repairRootOwnedWorkspace: true }
+    : uid !== undefined
+        ? { user: `${uid}:${gid ?? uid}`, repairRootOwnedWorkspace: false }
+        : { user: "1000:1000", repairRootOwnedWorkspace: false };
 const SANDBOX_BASE_PORT = 18080;
+export const sandboxRuntimeHome = "/tmp";
+export const sandboxRuntimeXdgDataHome = `${sandboxRuntimeHome}/.local/share`;
 const homeDir = Config.string("HOME").pipe(Config.orElse(() => Config.string("USERPROFILE")));
 const sandboxesDir = homeDir.pipe(Config.map((h) => `${h}/.codecommit/sandboxes`));
 const expandHome = (p, home) => p.startsWith("~/") ? `${home}${p.slice(1)}` : p;
-const makeContainerConfig = (workspacePath, port, sandboxId, pullRequestId, sandboxConfig, homePath) => ({
+export const makeContainerConfig = (workspacePath, port, sandboxId, pullRequestId, sandboxConfig, homePath, containerUser, accessPassword) => ({
     Image: sandboxConfig.image,
-    Cmd: ["--bind-addr", "0.0.0.0:8080", "--auth", "none", "/workspace"],
+    User: containerUser,
+    Cmd: ["--bind-addr", "0.0.0.0:8080", "--auth", "password", "/workspace"],
     ExposedPorts: { "8080/tcp": {} },
     HostConfig: {
         Binds: [
             `${workspacePath}:/workspace`,
             ...sandboxConfig.volumeMounts.map((m) => `${expandHome(m.hostPath, homePath)}:${m.containerPath}${m.readonly ? ":ro" : ""}`)
         ],
-        PortBindings: { "8080/tcp": [{ HostPort: String(port) }] }
+        PortBindings: { "8080/tcp": [{ HostIp: "127.0.0.1", HostPort: String(port) }] },
+        CapDrop: ["ALL"]
     },
     Env: [
-        ...Object.entries(sandboxConfig.env).map(([k, v]) => `${k}=${v}`)
+        ...Object.entries(sandboxConfig.env).map(([k, v]) => `${k}=${v}`),
+        `HOME=${sandboxRuntimeHome}`,
+        `XDG_CACHE_HOME=${sandboxRuntimeHome}/.cache`,
+        `XDG_CONFIG_HOME=${sandboxRuntimeHome}/.config`,
+        `XDG_DATA_HOME=${sandboxRuntimeXdgDataHome}`,
+        `PASSWORD=${accessPassword}`
     ],
     Labels: {
         "codecommit.sandbox.id": sandboxId,
@@ -46,6 +61,7 @@ const makeSandboxService = Effect.gen(function* () {
     const docker = yield* DockerService;
     const plugins = yield* PluginService;
     const configService = yield* ConfigService;
+    const cryptoService = yield* Crypto.Crypto;
     const homePath = yield* homeDir.pipe(Effect.orDie);
     const basePath = yield* sandboxesDir.pipe(Effect.orDie);
     const loadSandboxConfig = configService.load.pipe(Effect.map((config) => config.sandbox), Effect.catch(() => Effect.succeed(defaultSandboxConfig)));
@@ -78,10 +94,13 @@ const makeSandboxService = Effect.gen(function* () {
             if (Option.isSome(existing)) {
                 return existing.value;
             }
+            const sandboxCfg = yield* loadSandboxConfig;
+            yield* validateSandboxConfig(sandboxCfg, homePath);
             const nowMs = yield* Clock.currentTimeMillis;
             const rand = yield* Random.nextIntBetween(0, 2176782336);
             const id = SandboxId.make(`sbx-${nowMs}-${rand.toString(36).padStart(6, "0")}`);
             const port = yield* allocatePort();
+            const accessPassword = yield* cryptoService.randomUUIDv4;
             const workspacePath = `${basePath}/${id}`;
             const now = new Date(nowMs).toISOString();
             yield* repo.insert({
@@ -90,6 +109,7 @@ const makeSandboxService = Effect.gen(function* () {
                 awsAccountId: params.awsAccountId,
                 repositoryName: params.repositoryName,
                 sourceBranch: params.sourceBranch,
+                accessPassword,
                 workspacePath,
                 status: "creating",
                 createdAt: now,
@@ -98,10 +118,9 @@ const makeSandboxService = Effect.gen(function* () {
             // Fork daemon for async lifecycle
             yield* ownerScope.fork(Effect.gen(function* () {
                 const fs = yield* FileSystem.FileSystem;
+                const host = yield* ChildEnv.HostEnvironment;
                 const log = (detail) => progress(id, detail);
-                // Load config at creation time
-                yield* log("Loading sandbox config");
-                const sandboxCfg = yield* loadSandboxConfig;
+                yield* log("Sandbox config validated");
                 // Clone via HTTPS + AWS credential helper
                 yield* updateStatus(id, "cloning");
                 yield* fs.makeDirectory(workspacePath, { recursive: true });
@@ -128,7 +147,7 @@ const makeSandboxService = Effect.gen(function* () {
                         // `git` and the `aws` credential helper both resolve from PATH, so the
                         // profile overrides must extend the inherited environment. Ambient AWS
                         // credentials would outrank them, so profileScopedEnv drops those.
-                        env: ChildEnv.profileScopedEnv({
+                        env: ChildEnv.profileScopedEnv(host.variables, {
                             AWS_PROFILE: params.profile,
                             AWS_DEFAULT_REGION: params.region,
                             AWS_REGION: params.region
@@ -150,27 +169,32 @@ const makeSandboxService = Effect.gen(function* () {
                     return;
                 }
                 yield* log("Clone complete");
+                const workspaceInfo = yield* fs.stat(workspacePath);
+                const containerIdentity = sandboxContainerIdentityForWorkspaceOwner(Option.getOrUndefined(workspaceInfo.uid), Option.getOrUndefined(workspaceInfo.gid));
+                if (containerIdentity.repairRootOwnedWorkspace) {
+                    yield* log("Preparing root-owned workspace for the non-root sandbox user");
+                    const chownExitCode = yield* Effect.scoped(ChildProcess.make("chown", ["-R", "1000:1000", "--", workspacePath]).pipe(Effect.flatMap((handle) => handle.exitCode)));
+                    if (chownExitCode !== 0) {
+                        return yield* new SandboxError({
+                            sandboxId: id,
+                            message: "Failed to prepare root-owned workspace for the non-root sandbox user"
+                        });
+                    }
+                }
                 // Pull image
                 yield* updateStatus(id, "starting");
                 yield* log(`Pulling image ${sandboxCfg.image}`);
                 yield* docker.pullImage(sandboxCfg.image).pipe(Effect.tap(() => log("Image ready")), Effect.catchIf(() => true, () => log("Image pull skipped (using cached)")));
                 // Create + start container
                 yield* log("Creating container");
-                const containerConfig = makeContainerConfig(workspacePath, port, id, params.pullRequestId, sandboxCfg, homePath);
+                yield* validateSandboxConfig(sandboxCfg, homePath);
+                const containerConfig = makeContainerConfig(workspacePath, port, id, params.pullRequestId, sandboxCfg, homePath, containerIdentity.user, accessPassword);
                 const containerId = yield* docker.createContainer(containerConfig);
                 const cid = containerId.trim();
                 yield* log(`Container ${cid.slice(0, 12)} created, starting`);
                 yield* docker.startContainer(cid);
                 yield* updateStatus(id, "starting", { containerId: cid, port });
                 yield* log(`Container started on port ${port}`);
-                // Fix ownership of dirs that Docker may have created as root (from volume mounts)
-                yield* docker.exec(cid, [
-                    "sudo",
-                    "chown",
-                    "-R",
-                    "coder:coder",
-                    "/home/coder/.local"
-                ]).pipe(Effect.catchIf(() => true, () => Effect.void));
                 // Wait for code-server to be ready (poll health)
                 yield* log("Waiting for code-server health check");
                 yield* docker.exec(cid, ["curl", "-sf", "http://localhost:8080/healthz"]).pipe(Effect.retry(Schedule.max([Schedule.recurs(30), Schedule.spaced(Duration.seconds(1))])), Effect.tap(() => log("code-server ready")), Effect.tapError((e) => log(`Health check failed: ${String(e)}`)), Effect.catchIf(() => true, () => Effect.void));
@@ -214,6 +238,12 @@ const makeSandboxService = Effect.gen(function* () {
         }).pipe(Effect.mapError((cause) => new SandboxError({ sandboxId: id, message: "Failed to stop sandbox", cause }))),
         restart: (id) => Effect.gen(function* () {
             const row = yield* repo.findById(id);
+            if (row.accessPassword === null) {
+                return yield* Effect.fail(new SandboxError({
+                    sandboxId: id,
+                    message: "Legacy sandbox has no authenticated access credential; delete and recreate it"
+                }));
+            }
             if (!row.containerId) {
                 return yield* Effect.fail(new SandboxError({ sandboxId: id, message: "No container to restart" }));
             }
@@ -241,7 +271,24 @@ const makeSandboxService = Effect.gen(function* () {
         }).pipe(Effect.mapError((cause) => new SandboxError({ sandboxId: id, message: "Failed to cleanup sandbox", cause }))),
         reconcile: () => Effect.gen(function* () {
             const active = yield* repo.findActive();
-            yield* Effect.forEach(active, (row) => Effect.gen(function* () {
+            const all = yield* repo.findAll();
+            const activeIds = new Set(active.map((row) => row.id));
+            const rows = all.filter((row) => row.accessPassword === null || activeIds.has(row.id));
+            yield* Effect.forEach(rows, (row) => Effect.gen(function* () {
+                if (row.accessPassword === null) {
+                    const discovered = yield* docker.listContainersByLabel("codecommit.sandbox.id", row.id);
+                    const containerIds = new Set([
+                        ...(row.containerId === null ? [] : [row.containerId]),
+                        ...discovered.map((container) => container.Id)
+                    ]);
+                    // Do not consider any legacy row reconciled until every persisted
+                    // or labeled passwordless container has confirmed shutdown.
+                    yield* Effect.forEach(containerIds, (containerId) => docker.stopContainer(containerId), { discard: true });
+                    yield* updateStatus(SandboxId.make(row.id), "error", {
+                        error: "Legacy unauthenticated sandbox stopped; delete and recreate it"
+                    });
+                    return;
+                }
                 if (!row.containerId) {
                     yield* updateStatus(SandboxId.make(row.id), "error", { error: "Orphaned (no container)" });
                     return;
@@ -252,7 +299,8 @@ const makeSandboxService = Effect.gen(function* () {
                     yield* Effect.logInfo(`Reconciled orphaned sandbox ${row.id}`);
                 }
             }), { discard: true });
-        }).pipe(Effect.catch((cause) => Effect.logWarning("Sandbox reconcile failed", cause))),
+        }).pipe(Effect.as(true), Effect.catch((cause) => Effect.logWarning("Sandbox reconcile failed", cause).pipe(Effect.as(false)))),
+        hasLegacyUnauthenticated: () => repo.findAll().pipe(Effect.map((rows) => rows.some((row) => row.accessPassword === null))),
         gcIdle: (idleTimeout = Duration.minutes(30), cleanupDelay = Duration.hours(24)) => Effect.gen(function* () {
             const all = yield* repo.findAll();
             const now = yield* Clock.currentTimeMillis;