@knpkv/codecommit-core 0.4.0 → 0.5.1

package/dist/SandboxService/DockerService.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Docker interaction via `docker` CLI.
+ *
+ * Shells out to the docker binary — avoids unix socket HTTP complexity.
+ *
+ * @module
+ */
+import { CommandExecutor } from "@effect/platform";
+import { Effect } from "effect";
+import { DockerError } from "../Errors.js";
+export interface ContainerConfig {
+    readonly Image: string;
+    readonly Cmd: ReadonlyArray<string>;
+    readonly ExposedPorts: Record<string, Record<string, never>>;
+    readonly HostConfig: {
+        readonly Binds: ReadonlyArray<string>;
+        readonly PortBindings: Record<string, ReadonlyArray<{
+            HostPort: string;
+        }>>;
+        readonly NetworkMode?: string;
+    };
+    readonly Env?: ReadonlyArray<string>;
+    readonly Labels?: Record<string, string>;
+}
+export interface ContainerInfo {
+    readonly Id: string;
+    readonly State: {
+        readonly Status: string;
+        readonly Running: boolean;
+    };
+    readonly NetworkSettings: {
+        readonly Ports: Record<string, ReadonlyArray<{
+            HostPort: string;
+        }> | null>;
+    };
+}
+declare const DockerService_base: Effect.Service.Class<DockerService, "DockerService", {
+    readonly effect: Effect.Effect<{
+        readonly isAvailable: () => Effect.Effect<boolean, never, never>;
+        readonly pullImage: (image: string) => Effect.Effect<void, DockerError, never>;
+        readonly createContainer: (config: ContainerConfig) => Effect.Effect<string, DockerError, never>;
+        readonly startContainer: (containerId: string) => Effect.Effect<void, DockerError, never>;
+        readonly stopContainer: (containerId: string, timeout?: number) => Effect.Effect<void, DockerError, never>;
+        readonly removeContainer: (containerId: string) => Effect.Effect<void, DockerError, never>;
+        readonly inspectContainer: (containerId: string) => Effect.Effect<ContainerInfo, DockerError, never>;
+        readonly exec: (containerId: string, cmd: ReadonlyArray<string>) => Effect.Effect<string, DockerError, never>;
+        readonly listContainersByLabel: (label: string, value: string) => Effect.Effect<{
+            Id: string;
+            State: string;
+            Labels: any;
+        }[], DockerError, never>;
+    }, never, CommandExecutor.CommandExecutor>;
+}>;
+export declare class DockerService extends DockerService_base {
+}
+export {};
+//# sourceMappingURL=DockerService.d.ts.map

package/dist/SandboxService/DockerService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DockerService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/DockerService.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAW,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAA;QAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAC1B,CAAA;IACD,QAAQ,CAAC,eAAe,EAAE;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,CAAA;KAC3E,CAAA;CACF;;;;oCA4BwB,MAAM;2CAEC,eAAe;+CAqCX,MAAM;8CAGP,MAAM;gDAGJ,MAAM;iDAGL,MAAM;qCAelB,MAAM,OAAO,aAAa,CAAC,MAAM,CAAC;gDAGvB,MAAM,SAAS,MAAM;;;;;;;AA/E1D,qBAAa,aAAc,SAAQ,kBAqGjC;CAAG"}

package/dist/SandboxService/DockerService.js

@@ -0,0 +1,83 @@
+/**
+ * Docker interaction via `docker` CLI.
+ *
+ * Shells out to the docker binary — avoids unix socket HTTP complexity.
+ *
+ * @module
+ */
+import { Command, CommandExecutor } from "@effect/platform";
+import { Effect } from "effect";
+import { DockerError } from "../Errors.js";
+const dockerError = (operation) => (effect) => effect.pipe(Effect.mapError((cause) => new DockerError({ operation, cause })), Effect.withSpan(`DockerService.${operation}`, { captureStackTrace: false }));
+const shellEscape = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+const run = (...args) => Command.make("sh", "-c", `docker ${args.map(shellEscape).join(" ")} 2>&1`).pipe(Command.string);
+export class DockerService extends Effect.Service()("DockerService", {
+    effect: Effect.gen(function* () {
+        const executor = yield* CommandExecutor.CommandExecutor;
+        const docker = (...args) => run(...args).pipe(Effect.provideService(CommandExecutor.CommandExecutor, executor));
+        return {
+            isAvailable: () => docker("info").pipe(Effect.map(() => true), Effect.catchAll(() => Effect.succeed(false))),
+            pullImage: (image) => docker("pull", image).pipe(Effect.asVoid, dockerError("pullImage")),
+            createContainer: (config) => {
+                const args = ["create"];
+                // Port bindings
+                for (const [containerPort, bindings] of Object.entries(config.HostConfig.PortBindings)) {
+                    for (const b of bindings) {
+                        args.push("-p", `${b.HostPort}:${containerPort.replace("/tcp", "")}`);
+                    }
+                }
+                // Volume binds
+                for (const bind of config.HostConfig.Binds) {
+                    args.push("-v", bind);
+                }
+                // Network mode
+                if (config.HostConfig.NetworkMode) {
+                    args.push("--network", config.HostConfig.NetworkMode);
+                }
+                // Env vars
+                for (const env of config.Env ?? []) {
+                    args.push("-e", env);
+                }
+                // Labels
+                for (const [k, v] of Object.entries(config.Labels ?? {})) {
+                    args.push("-l", `${k}=${v}`);
+                }
+                // Image + command
+                args.push(config.Image);
+                for (const c of config.Cmd)
+                    args.push(c);
+                return docker(...args).pipe(dockerError("createContainer"));
+            },
+            startContainer: (containerId) => docker("start", containerId).pipe(Effect.asVoid, dockerError("startContainer")),
+            stopContainer: (containerId, timeout = 10) => docker("stop", "-t", String(timeout), containerId).pipe(Effect.asVoid, dockerError("stopContainer")),
+            removeContainer: (containerId) => docker("rm", "-f", containerId).pipe(Effect.asVoid, dockerError("removeContainer")),
+            inspectContainer: (containerId) => docker("inspect", containerId).pipe(Effect.flatMap((output) => Effect.try({
+                try: () => {
+                    const arr = JSON.parse(output);
+                    if (arr.length === 0)
+                        throw new Error("Empty inspect result");
+                    return arr[0];
+                },
+                catch: (e) => e
+            })), dockerError("inspectContainer")),
+            exec: (containerId, cmd) => docker("exec", containerId, ...cmd).pipe(dockerError("exec")),
+            listContainersByLabel: (label, value) => docker("ps", "-a", "--filter", `label=${label}=${value}`, "--format", "{{json .}}").pipe(Effect.flatMap((output) => Effect.try({
+                try: () => {
+                    if (!output)
+                        return [];
+                    return output.split("\n").map((line) => {
+                        const obj = JSON.parse(line);
+                        return {
+                            Id: obj.ID,
+                            State: obj.State,
+                            Labels: Object.fromEntries(obj.Labels.split(",").map((l) => l.split("=")))
+                        };
+                    });
+                },
+                catch: (e) => e
+            })), dockerError("listContainersByLabel"))
+        };
+    })
+}) {
+}
+//# sourceMappingURL=DockerService.js.map

package/dist/SandboxService/DockerService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DockerService.js","sourceRoot":"","sources":["../../src/SandboxService/DockerService.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA0B1C,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAU,MAA8B,EAAE,EAAE,CACrF,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,EACjE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAC5E,CAAA;AAEH,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AAElE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAmB,EAAE,EAAE,CACrC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAC7E,OAAO,CAAC,MAAM,CACf,CAAA;AAEH,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,OAAO,EAAiB,CAAC,eAAe,EAAE;IAClF,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,eAAe,CAAA;QACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAmB,EAAE,EAAE,CACxC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAA;QAErF,OAAO;YACL,WAAW,EAAE,GAAG,EAAE,CAChB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAC7C;YAEH,SAAS,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;YAEjG,eAAe,EAAE,CAAC,MAAuB,EAAE,EAAE;gBAC3C,MAAM,IAAI,GAAkB,CAAC,QAAQ,CAAC,CAAA;gBAEtC,gBAAgB;gBAChB,KAAK,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACvF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;wBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;oBACvE,CAAC;gBACH,CAAC;gBAED,eAAe;gBACf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;oBAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBACvB,CAAC;gBAED,eAAe;gBACf,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;oBAClC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;gBACvD,CAAC;gBAED,WAAW;gBACX,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBACtB,CAAC;gBAED,SAAS;gBACT,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;oBACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC9B,CAAC;gBAED,kBAAkB;gBAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACvB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAExC,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAA;YAC7D,CAAC;YAED,cAAc,EAAE,CAAC,WAAmB,EAAE,EAAE,CACtC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAEjF,aAAa,EAAE,CAAC,WAAmB,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CACnD,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;YAEtG,eAAe,EAAE,CAAC,WAAmB,EAAE,EAAE,CACvC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;YAErF,gBAAgB,EAAE,CAAC,WAAmB,EAAE,EAAE,CACxC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC;gBACT,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAyB,CAAA;oBACtD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;oBAC7D,OAAO,GAAG,CAAC,CAAC,CAAE,CAAA;gBAChB,CAAC;gBACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aAChB,CAAC,CACH,EACD,WAAW,CAAC,kBAAkB,CAAC,CAChC;YAEH,IAAI,EAAE,CAAC,WAAmB,EAAE,GAA0B,EAAE,EAAE,CACxD,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/D,qBAAqB,EAAE,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CACtD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,KAAK,IAAI,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,IAAI,CACtF,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,GAAG,CAAC;gBACT,GAAG,EAAE,GAAG,EAAE;oBACR,IAAI,CAAC,MAAM;wBAAE,OAAO,EAA0E,CAAA;oBAC9F,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkD,CAAA;wBAC7E,OAAO;4BACL,EAAE,EAAE,GAAG,CAAC,EAAE;4BACV,KAAK,EAAE,GAAG,CAAC,KAAK;4BAChB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;yBAC3E,CAAA;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aAChB,CAAC,CACH,EACD,WAAW,CAAC,uBAAuB,CAAC,CACrC;SACK,CAAA;IACZ,CAAC,CAAC;CACH,CAAC;CAAG"}

package/dist/SandboxService/PluginService.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Sandbox plugin system — extensible lifecycle hooks.
+ *
+ * Plugins execute sequentially in registration order.
+ * Plugin failures are non-fatal (logged, sandbox continues).
+ *
+ * @module
+ */
+import { Effect } from "effect";
+import type { PullRequestId, RepositoryName, SandboxId } from "../Domain.js";
+export interface SandboxContext {
+    readonly sandboxId: SandboxId;
+    readonly containerId: string;
+    readonly workspacePath: string;
+    readonly port: number;
+    readonly pr: {
+        readonly id: PullRequestId;
+        readonly repositoryName: RepositoryName;
+        readonly sourceBranch: string;
+    };
+}
+export interface SandboxPlugin {
+    readonly name: string;
+    readonly onSandboxCreate?: (ctx: SandboxContext) => Effect.Effect<void>;
+    readonly onSandboxReady?: (ctx: SandboxContext) => Effect.Effect<void>;
+    readonly onSandboxDestroy?: (ctx: SandboxContext) => Effect.Effect<void>;
+}
+declare const PluginService_base: Effect.Service.Class<PluginService, "PluginService", {
+    readonly effect: Effect.Effect<{
+        readonly register: (plugin: SandboxPlugin) => Effect.Effect<void, never, never>;
+        readonly executeHook: (hook: "onSandboxCreate" | "onSandboxReady" | "onSandboxDestroy", ctx: SandboxContext) => Effect.Effect<void, never, never>;
+        readonly listPlugins: () => Effect.Effect<string[], never, never>;
+    }, never, never>;
+}>;
+export declare class PluginService extends PluginService_base {
+}
+export {};
+//# sourceMappingURL=PluginService.d.ts.map

package/dist/SandboxService/PluginService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/PluginService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAO,MAAM,QAAQ,CAAA;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE;QACX,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;QACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAC9B,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CACzE;;;oCAOwB,aAAa;qCAKZ,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,OAAO,cAAc;;;;AAVxG,qBAAa,aAAc,SAAQ,kBA2BjC;CAAG"}

package/dist/SandboxService/PluginService.js

@@ -0,0 +1,26 @@
+/**
+ * Sandbox plugin system — extensible lifecycle hooks.
+ *
+ * Plugins execute sequentially in registration order.
+ * Plugin failures are non-fatal (logged, sandbox continues).
+ *
+ * @module
+ */
+import { Effect, Ref } from "effect";
+export class PluginService extends Effect.Service()("PluginService", {
+    effect: Effect.gen(function* () {
+        const plugins = yield* Ref.make([]);
+        return {
+            register: (plugin) => Ref.update(plugins, (ps) => [...ps, plugin]).pipe(Effect.tap(() => Effect.logInfo(`Plugin registered: ${plugin.name}`))),
+            executeHook: (hook, ctx) => Ref.get(plugins).pipe(Effect.flatMap((ps) => Effect.forEach(ps, (p) => {
+                const fn = p[hook];
+                if (!fn)
+                    return Effect.void;
+                return fn(ctx).pipe(Effect.catchAllCause((cause) => Effect.logWarning(`Plugin ${p.name} ${hook} failed`, cause)));
+            }, { discard: true })), Effect.withSpan(`PluginService.${hook}`, { captureStackTrace: false })),
+            listPlugins: () => Ref.get(plugins).pipe(Effect.map((ps) => ps.map((p) => p.name)))
+        };
+    })
+}) {
+}
+//# sourceMappingURL=PluginService.js.map

package/dist/SandboxService/PluginService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PluginService.js","sourceRoot":"","sources":["../../src/SandboxService/PluginService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAsBpC,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,OAAO,EAAiB,CAAC,eAAe,EAAE;IAClF,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAA+B,EAAE,CAAC,CAAA;QAEjE,OAAO;YACL,QAAQ,EAAE,CAAC,MAAqB,EAAE,EAAE,CAClC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CACtE;YAEH,WAAW,EAAE,CAAC,IAA+D,EAAE,GAAmB,EAAE,EAAE,CACpG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CACnB,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;gBACvB,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;gBAClB,IAAI,CAAC,EAAE;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAA;gBAC3B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CACjB,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC,CAC7F,CAAA;YACH,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACtB,EACD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CACvE;YAEH,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;SAC3E,CAAA;IACZ,CAAC,CAAC;CACH,CAAC;CAAG"}

package/dist/SandboxService/SandboxService.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Sandbox orchestration service.
+ *
+ * Ties together DockerService, PluginService, SandboxRepo
+ * to manage sandbox lifecycle: create → run → stop → cleanup.
+ *
+ * @module
+ */
+import { FileSystem } from "@effect/platform";
+import { Duration, Effect } from "effect";
+import { SandboxRepo } from "../CacheService/repos/SandboxRepo.js";
+import { ConfigService } from "../ConfigService/index.js";
+import { SandboxId } from "../Domain.js";
+import { SandboxError } from "../Errors.js";
+import { DockerService } from "./DockerService.js";
+import { PluginService } from "./PluginService.js";
+export interface CreateSandboxParams {
+    readonly pullRequestId: string;
+    readonly awsAccountId: string;
+    readonly repositoryName: string;
+    readonly sourceBranch: string;
+    readonly profile: string;
+    readonly region: string;
+}
+declare const SandboxService_base: Effect.Service.Class<SandboxService, "SandboxService", {
+    readonly dependencies: readonly [import("effect/Layer").Layer<SandboxRepo, import("@effect/sql/SqlError").SqlError | import("effect/ConfigError").ConfigError | import("@effect/sql/Migrator").MigrationError, FileSystem.FileSystem>, import("effect/Layer").Layer<DockerService, never, import("@effect/platform/CommandExecutor").CommandExecutor>, import("effect/Layer").Layer<PluginService, never, never>];
+    readonly effect: Effect.Effect<{
+        readonly create: (params: CreateSandboxParams) => Effect.Effect<{
+            readonly error: string | null;
+            readonly awsAccountId: string;
+            readonly id: string;
+            readonly repositoryName: string;
+            readonly status: string;
+            readonly sourceBranch: string;
+            readonly pullRequestId: string;
+            readonly workspacePath: string;
+            readonly createdAt: string;
+            readonly lastActivityAt: string;
+            readonly containerId: string | null;
+            readonly port: number | null;
+            readonly statusDetail: string | null;
+            readonly logs: string | null;
+        }, SandboxError, FileSystem.FileSystem | import("effect/Scope").Scope | import("@effect/platform/CommandExecutor").CommandExecutor>;
+        readonly get: (id: SandboxId) => Effect.Effect<{
+            readonly error: string | null;
+            readonly awsAccountId: string;
+            readonly id: string;
+            readonly repositoryName: string;
+            readonly status: string;
+            readonly sourceBranch: string;
+            readonly pullRequestId: string;
+            readonly workspacePath: string;
+            readonly createdAt: string;
+            readonly lastActivityAt: string;
+            readonly containerId: string | null;
+            readonly port: number | null;
+            readonly statusDetail: string | null;
+            readonly logs: string | null;
+        }, SandboxError, never>;
+        readonly list: () => Effect.Effect<readonly {
+            readonly error: string | null;
+            readonly awsAccountId: string;
+            readonly id: string;
+            readonly repositoryName: string;
+            readonly status: string;
+            readonly sourceBranch: string;
+            readonly pullRequestId: string;
+            readonly workspacePath: string;
+            readonly createdAt: string;
+            readonly lastActivityAt: string;
+            readonly containerId: string | null;
+            readonly port: number | null;
+            readonly statusDetail: string | null;
+            readonly logs: string | null;
+        }[], import("../CacheService/CacheError.ts").CacheError, never>;
+        readonly listAll: () => Effect.Effect<readonly {
+            readonly error: string | null;
+            readonly awsAccountId: string;
+            readonly id: string;
+            readonly repositoryName: string;
+            readonly status: string;
+            readonly sourceBranch: string;
+            readonly pullRequestId: string;
+            readonly workspacePath: string;
+            readonly createdAt: string;
+            readonly lastActivityAt: string;
+            readonly containerId: string | null;
+            readonly port: number | null;
+            readonly statusDetail: string | null;
+            readonly logs: string | null;
+        }[], import("../CacheService/CacheError.ts").CacheError, never>;
+        readonly stop: (id: SandboxId) => Effect.Effect<void, SandboxError, never>;
+        readonly restart: (id: SandboxId) => Effect.Effect<undefined, SandboxError, never>;
+        readonly cleanup: (id: SandboxId) => Effect.Effect<void, SandboxError, FileSystem.FileSystem>;
+        readonly reconcile: () => Effect.Effect<void, never, never>;
+        readonly gcIdle: (idleTimeout?: Duration.Duration, cleanupDelay?: Duration.Duration) => Effect.Effect<void, never, FileSystem.FileSystem>;
+    }, never, SandboxRepo | ConfigService | DockerService | PluginService>;
+}>;
+export declare class SandboxService extends SandboxService_base {
+}
+export {};
+//# sourceMappingURL=SandboxService.d.ts.map

package/dist/SandboxService/SandboxService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxService.d.ts","sourceRoot":"","sources":["../../src/SandboxService/SandboxService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAW,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAwB,QAAQ,EAAE,MAAM,EAAoC,MAAM,QAAQ,CAAA;AACjG,OAAO,EAAE,WAAW,EAAmB,MAAM,sCAAsC,CAAA;AACnF,OAAO,EAAE,aAAa,EAA4C,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAiC,SAAS,EAAsB,MAAM,cAAc,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAwB,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAExE,OAAO,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAA;AAEvE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;;;;kCA6GsB,mBAAmB;;;;;;;;;;;;;;;;2BAgL1B,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BASR,SAAS;+BAiBN,SAAS;+BAiCT,SAAS;;;;;AAvS7B,qBAAa,cAAe,SAAQ,mBAyXlC;CAAG"}

package/dist/SandboxService/SandboxService.js

@@ -0,0 +1,272 @@
+/**
+ * Sandbox orchestration service.
+ *
+ * Ties together DockerService, PluginService, SandboxRepo
+ * to manage sandbox lifecycle: create → run → stop → cleanup.
+ *
+ * @module
+ */
+import { Command, FileSystem } from "@effect/platform";
+import { Cause, Clock, Config, Duration, Effect, Option, Random, Schedule, Stream } from "effect";
+import { SandboxRepo } from "../CacheService/repos/SandboxRepo.js";
+import { ConfigService, defaultSandboxConfig } from "../ConfigService/index.js";
+import { PullRequestId, RepositoryName, SandboxId } from "../Domain.js";
+import { SandboxError } from "../Errors.js";
+import { DockerService } from "./DockerService.js";
+import { makeClaudeCodePlugin } from "./plugins/ClaudeCodePlugin.js";
+import { PluginService } from "./PluginService.js";
+const SANDBOX_BASE_PORT = 18080;
+const homeDir = Config.string("HOME").pipe(Config.orElse(() => Config.string("USERPROFILE")));
+const sandboxesDir = homeDir.pipe(Config.map((h) => `${h}/.codecommit/sandboxes`));
+const anthropicApiKey = Config.string("ANTHROPIC_API_KEY").pipe(Config.option);
+const expandHome = (p, home) => p.startsWith("~/") ? `${home}${p.slice(1)}` : p;
+const makeContainerConfig = (workspacePath, port, sandboxId, pullRequestId, apiKey, sandboxConfig, homePath) => ({
+    Image: sandboxConfig.image,
+    Cmd: ["--bind-addr", "0.0.0.0:8080", "--auth", "none", "/workspace"],
+    ExposedPorts: { "8080/tcp": {} },
+    HostConfig: {
+        Binds: [
+            `${workspacePath}:/workspace`,
+            ...sandboxConfig.volumeMounts.map((m) => `${expandHome(m.hostPath, homePath)}:${m.containerPath}${m.readonly ? ":ro" : ""}`)
+        ],
+        PortBindings: { "8080/tcp": [{ HostPort: String(port) }] }
+    },
+    Env: [
+        ...(Option.isSome(apiKey) ? [`ANTHROPIC_API_KEY=${apiKey.value}`] : []),
+        ...Object.entries(sandboxConfig.env).map(([k, v]) => `${k}=${v}`)
+    ],
+    Labels: {
+        "codecommit.sandbox.id": sandboxId,
+        "codecommit.sandbox.pr": pullRequestId
+    }
+});
+export class SandboxService extends Effect.Service()("SandboxService", {
+    dependencies: [SandboxRepo.Default, DockerService.Default, PluginService.Default],
+    effect: Effect.gen(function* () {
+        const repo = yield* SandboxRepo;
+        const docker = yield* DockerService;
+        const plugins = yield* PluginService;
+        const configService = yield* ConfigService;
+        const homePath = yield* homeDir.pipe(Effect.orDie);
+        const basePath = yield* sandboxesDir.pipe(Effect.orDie);
+        const apiKey = yield* anthropicApiKey.pipe(Effect.orDie);
+        const loadSandboxConfig = configService.load.pipe(Effect.map((c) => c.sandbox), Effect.catchAll(() => Effect.succeed(defaultSandboxConfig)));
+        // Register built-in plugins conditionally based on config
+        yield* Effect.gen(function* () {
+            const sandboxCfg = yield* loadSandboxConfig;
+            if (sandboxCfg.enableClaudeCode) {
+                yield* plugins.register(makeClaudeCodePlugin((containerId, cmd) => docker.exec(containerId, cmd).pipe(Effect.catchAll(() => Effect.void))));
+            }
+        });
+        const updateStatus = (id, status, extra) => repo.updateStatus(id, status, extra);
+        const progress = (id, detail) => Clock.currentTimeMillis.pipe(Effect.flatMap((ms) => {
+            const ts = new Date(ms).toISOString();
+            return repo.updateDetail(id, detail).pipe(Effect.tap(() => repo.appendLog(id, `[${ts}] ${detail}`)), Effect.tap(() => Effect.logInfo(`Sandbox ${id}: ${detail}`)));
+        }));
+        const allocatePort = () => Random.nextIntBetween(SANDBOX_BASE_PORT, SANDBOX_BASE_PORT + 1000);
+        const makeSandboxContext = (row) => ({
+            sandboxId: SandboxId.make(row.id),
+            containerId: row.containerId ?? "",
+            workspacePath: row.workspacePath,
+            port: row.port ?? 0,
+            pr: {
+                id: PullRequestId.make(row.pullRequestId),
+                repositoryName: RepositoryName.make(row.repositoryName),
+                sourceBranch: row.sourceBranch
+            }
+        });
+        return {
+            create: (params) => Effect.gen(function* () {
+                // Singleton check — one active sandbox per PR
+                const existing = yield* repo.findByPr(params.awsAccountId, params.pullRequestId);
+                if (Option.isSome(existing)) {
+                    return existing.value;
+                }
+                const nowMs = yield* Clock.currentTimeMillis;
+                const rand = yield* Random.nextIntBetween(0, 2176782336);
+                const id = SandboxId.make(`sbx-${nowMs}-${rand.toString(36).padStart(6, "0")}`);
+                const port = yield* allocatePort();
+                const workspacePath = `${basePath}/${id}`;
+                const now = new Date(nowMs).toISOString();
+                yield* repo.insert({
+                    id,
+                    pullRequestId: params.pullRequestId,
+                    awsAccountId: params.awsAccountId,
+                    repositoryName: params.repositoryName,
+                    sourceBranch: params.sourceBranch,
+                    workspacePath,
+                    status: "creating",
+                    createdAt: now,
+                    lastActivityAt: now
+                });
+                // Fork daemon for async lifecycle
+                yield* Effect.forkDaemon(Effect.gen(function* () {
+                    const fs = yield* FileSystem.FileSystem;
+                    const log = (detail) => progress(id, detail);
+                    // Load config at creation time
+                    yield* log("Loading sandbox config");
+                    const sandboxCfg = yield* loadSandboxConfig;
+                    // Clone via HTTPS + AWS credential helper
+                    yield* updateStatus(id, "cloning");
+                    yield* fs.makeDirectory(workspacePath, { recursive: true });
+                    const cloneUrl = `https://git-codecommit.${params.region}.amazonaws.com/v1/repos/${params.repositoryName}`;
+                    const branch = params.sourceBranch.replace(/^refs\/heads\//, "");
+                    const depthLabel = sandboxCfg.cloneDepth > 0 ? ` (depth ${sandboxCfg.cloneDepth})` : "";
+                    yield* log(`Cloning ${params.repositoryName}/${branch}${depthLabel}`);
+                    const depthArgs = sandboxCfg.cloneDepth > 0
+                        ? ["--depth", String(sandboxCfg.cloneDepth)]
+                        : [];
+                    const cloneProc = yield* Command.make("git", "-c", "credential.helper=!aws codecommit credential-helper $@", "-c", "credential.UseHttpPath=true", "clone", ...depthArgs, "-b", branch, cloneUrl, workspacePath).pipe(Command.env({ AWS_PROFILE: params.profile, AWS_DEFAULT_REGION: params.region }), Command.stderr("pipe"), Command.start);
+                    const exitCode = yield* cloneProc.exitCode;
+                    if (exitCode !== 0) {
+                        const stderrChunks = yield* Stream.runCollect(cloneProc.stderr);
+                        const stderrText = Array.from(stderrChunks).map((c) => new TextDecoder().decode(c)).join("").trim();
+                        yield* log(`Clone failed: ${stderrText}`);
+                        yield* updateStatus(id, "error", { error: stderrText || `git clone failed (exit ${exitCode})` });
+                        return;
+                    }
+                    yield* log("Clone complete");
+                    // Pull image
+                    yield* updateStatus(id, "starting");
+                    yield* log(`Pulling image ${sandboxCfg.image}`);
+                    yield* docker.pullImage(sandboxCfg.image).pipe(Effect.tap(() => log("Image ready")), Effect.catchAll(() => log("Image pull skipped (using cached)")));
+                    // Create + start container
+                    yield* log("Creating container");
+                    const containerConfig = makeContainerConfig(workspacePath, port, id, params.pullRequestId, apiKey, sandboxCfg, homePath);
+                    const containerId = yield* docker.createContainer(containerConfig);
+                    const cid = containerId.trim();
+                    yield* log(`Container ${cid.slice(0, 12)} created, starting`);
+                    yield* docker.startContainer(cid);
+                    yield* updateStatus(id, "starting", { containerId: cid, port });
+                    yield* log(`Container started on port ${port}`);
+                    // Fix ownership of dirs that Docker may have created as root (from volume mounts)
+                    yield* docker.exec(cid, [
+                        "sudo",
+                        "chown",
+                        "-R",
+                        "coder:coder",
+                        "/home/coder/.local"
+                    ]).pipe(Effect.catchAll(() => Effect.void));
+                    // Wait for code-server to be ready (poll health)
+                    yield* log("Waiting for code-server health check");
+                    yield* docker.exec(cid, ["curl", "-sf", "http://localhost:8080/healthz"]).pipe(Effect.retry(Schedule.recurs(30).pipe(Schedule.intersect(Schedule.spaced(Duration.seconds(1))))), Effect.tap(() => log("code-server ready")), Effect.tapError((e) => log(`Health check failed: ${String(e)}`)), Effect.catchAll(() => Effect.void));
+                    // Run plugin hooks
+                    const row = yield* repo.findById(id);
+                    const ctx = makeSandboxContext(row);
+                    yield* log("Running plugin hooks");
+                    yield* plugins.executeHook("onSandboxCreate", ctx);
+                    yield* plugins.executeHook("onSandboxReady", ctx);
+                    // Install configured extensions
+                    if (sandboxCfg.extensions.length > 0) {
+                        yield* log(`Installing ${sandboxCfg.extensions.length} extension(s)`);
+                        yield* Effect.forEach(sandboxCfg.extensions, (ext) => log(`Installing extension: ${ext}`).pipe(Effect.zipRight(docker.exec(cid, ["code-server", "--install-extension", ext])), Effect.tap((output) => log(`Extension installed: ${ext}${output ? `\n${output.trim()}` : ""}`)), Effect.tapError((e) => log(`Extension failed: ${ext} — ${String(e)}`)), Effect.catchAll(() => Effect.void)), { discard: true });
+                    }
+                    // Run configured setup commands
+                    if (sandboxCfg.setupCommands.length > 0) {
+                        yield* log(`Running ${sandboxCfg.setupCommands.length} setup command(s)`);
+                        yield* Effect.forEach(sandboxCfg.setupCommands, (cmd, i) => log(`[${i + 1}/${sandboxCfg.setupCommands.length}] ${cmd}`).pipe(Effect.zipRight(docker.exec(cid, ["sh", "-c", cmd])), Effect.tap((output) => log(`Command done: ${cmd.slice(0, 60)}${output ? `\n${output.trim()}` : ""}`)), Effect.tapError((e) => log(`Command failed: ${cmd.slice(0, 60)} — ${String(e)}`)), Effect.catchAll(() => Effect.void)), { discard: true });
+                    }
+                    yield* updateStatus(id, "running");
+                    yield* log("Sandbox ready");
+                }).pipe(Effect.catchAllCause((cause) => Effect.gen(function* () {
+                    yield* Effect.logError(`Sandbox ${id} creation failed`, cause);
+                    const squashed = Cause.squash(cause);
+                    const errorDetail = squashed instanceof Error ? squashed.message : String(squashed);
+                    yield* updateStatus(id, "error", { error: errorDetail.slice(0, 500) }).pipe(Effect.catchAll((statusErr) => Effect.logError("Failed to update sandbox error status", statusErr)));
+                }))));
+                return yield* repo.findById(id);
+            }).pipe(Effect.mapError((cause) => new SandboxError({ message: "Failed to create sandbox", cause }))),
+            get: (id) => repo.findById(id).pipe(Effect.mapError((cause) => new SandboxError({ sandboxId: id, message: "Sandbox not found", cause }))),
+            list: () => repo.findActive(),
+            listAll: () => repo.findAll(),
+            stop: (id) => Effect.gen(function* () {
+                const row = yield* repo.findById(id);
+                yield* updateStatus(id, "stopping");
+                if (row.containerId) {
+                    const ctx = makeSandboxContext(row);
+                    yield* plugins.executeHook("onSandboxDestroy", ctx);
+                    yield* docker.stopContainer(row.containerId).pipe(Effect.catchAll(() => Effect.void));
+                }
+                yield* updateStatus(id, "stopped");
+                yield* Effect.logInfo(`Sandbox ${id} stopped`);
+            }).pipe(Effect.mapError((cause) => new SandboxError({ sandboxId: id, message: "Failed to stop sandbox", cause }))),
+            restart: (id) => Effect.gen(function* () {
+                const row = yield* repo.findById(id);
+                if (!row.containerId) {
+                    return yield* Effect.fail(new SandboxError({ sandboxId: id, message: "No container to restart" }));
+                }
+                yield* updateStatus(id, "starting");
+                yield* progress(id, "Restarting container");
+                yield* docker.startContainer(row.containerId);
+                yield* updateStatus(id, "starting", row.port ? { port: row.port } : {});
+                yield* progress(id, "Waiting for code-server health check");
+                yield* docker.exec(row.containerId, ["curl", "-sf", "http://localhost:8080/healthz"]).pipe(Effect.retry(Schedule.recurs(30).pipe(Schedule.intersect(Schedule.spaced(Duration.seconds(1))))), Effect.tap(() => progress(id, "code-server ready")), Effect.catchAll(() => Effect.void));
+                const ctx = makeSandboxContext(yield* repo.findById(id));
+                yield* plugins.executeHook("onSandboxReady", ctx);
+                yield* updateStatus(id, "running");
+                yield* progress(id, "Sandbox restarted");
+                yield* Effect.logInfo(`Sandbox ${id} restarted`);
+            }).pipe(Effect.mapError((cause) => new SandboxError({ sandboxId: id, message: "Failed to restart sandbox", cause }))),
+            cleanup: (id) => Effect.gen(function* () {
+                const row = yield* repo.findById(id);
+                const fs = yield* FileSystem.FileSystem;
+                if (row.containerId) {
+                    yield* docker.removeContainer(row.containerId).pipe(Effect.catchAll(() => Effect.void));
+                }
+                yield* fs.remove(row.workspacePath, { recursive: true }).pipe(Effect.catchAll(() => Effect.void));
+                yield* repo.delete(id);
+                yield* Effect.logInfo(`Sandbox ${id} cleaned up`);
+            }).pipe(Effect.mapError((cause) => new SandboxError({ sandboxId: id, message: "Failed to cleanup sandbox", cause }))),
+            reconcile: () => Effect.gen(function* () {
+                const active = yield* repo.findActive();
+                yield* Effect.forEach(active, (row) => Effect.gen(function* () {
+                    if (!row.containerId) {
+                        yield* updateStatus(SandboxId.make(row.id), "error", { error: "Orphaned (no container)" });
+                        return;
+                    }
+                    const info = yield* docker.inspectContainer(row.containerId).pipe(Effect.catchAll(() => Effect.succeed(null)));
+                    if (!info || !info.State.Running) {
+                        yield* updateStatus(SandboxId.make(row.id), "stopped");
+                        yield* Effect.logInfo(`Reconciled orphaned sandbox ${row.id}`);
+                    }
+                }), { discard: true });
+            }).pipe(Effect.catchAllCause((cause) => Effect.logWarning("Sandbox reconcile failed", cause))),
+            gcIdle: (idleTimeout = Duration.minutes(30), cleanupDelay = Duration.hours(24)) => Effect.gen(function* () {
+                const all = yield* repo.findAll();
+                const now = yield* Clock.currentTimeMillis;
+                // Stop idle running sandboxes
+                yield* Effect.forEach(all.filter((r) => r.status === "running"), (row) => {
+                    const lastActivity = new Date(row.lastActivityAt).getTime();
+                    if (now - lastActivity > Duration.toMillis(idleTimeout)) {
+                        return Effect.gen(function* () {
+                            yield* Effect.logInfo(`GC: stopping idle sandbox ${row.id}`);
+                            if (row.containerId) {
+                                yield* docker.stopContainer(row.containerId).pipe(Effect.catchAll(() => Effect.void));
+                            }
+                            yield* updateStatus(SandboxId.make(row.id), "stopped");
+                        });
+                    }
+                    return Effect.void;
+                }, { discard: true });
+                // Cleanup stopped sandboxes past delay
+                const fs = yield* FileSystem.FileSystem;
+                yield* Effect.forEach(all.filter((r) => r.status === "stopped" || r.status === "error"), (row) => {
+                    const lastActivity = new Date(row.lastActivityAt).getTime();
+                    if (now - lastActivity > Duration.toMillis(cleanupDelay)) {
+                        return Effect.gen(function* () {
+                            yield* Effect.logInfo(`GC: cleaning up sandbox ${row.id}`);
+                            if (row.containerId) {
+                                yield* docker.removeContainer(row.containerId).pipe(Effect.catchAll(() => Effect.void));
+                            }
+                            yield* fs.remove(row.workspacePath, { recursive: true }).pipe(Effect.catchAll(() => Effect.void));
+                            yield* repo.delete(SandboxId.make(row.id));
+                        });
+                    }
+                    return Effect.void;
+                }, { discard: true });
+            }).pipe(Effect.catchAllCause((cause) => Effect.logWarning("Sandbox GC failed", cause)))
+        };
+    })
+}) {
+}
+//# sourceMappingURL=SandboxService.js.map