@loucompanion/forge-bridge 0.1.3-dev.9bc5014a2270 → 0.1.3-dev.a58d7cd1092f

package/dist/sandbox/lease-watchdog.js

@@ -0,0 +1,67 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export function createLeaseUpdate(dispatchAttemptId, fencingToken, expiresAt, controlKey) {
+    return {
+        schemaVersion: 1,
+        dispatchAttemptId,
+        fencingToken,
+        expiresAt,
+        mac: leaseMac(dispatchAttemptId, fencingToken, expiresAt, controlKey)
+    };
+}
+export class MonotonicLeaseDeadline {
+    dispatchAttemptId;
+    fencingToken;
+    controlKey;
+    expiresAtMs;
+    deadlineMs;
+    constructor(dispatchAttemptId, fencingToken, initialExpiresAt, controlKey, wallNowMs = Date.now(), monotonicNowMs = performance.now()) {
+        this.dispatchAttemptId = dispatchAttemptId;
+        this.fencingToken = fencingToken;
+        this.controlKey = controlKey;
+        this.expiresAtMs = parsedExpiry(initialExpiresAt);
+        this.deadlineMs = monotonicNowMs + Math.max(0, this.expiresAtMs - wallNowMs);
+    }
+    apply(update, wallNowMs = Date.now(), monotonicNowMs = performance.now()) {
+        if (!isSignedLeaseUpdate(update)
+            || update.dispatchAttemptId !== this.dispatchAttemptId
+            || update.fencingToken !== this.fencingToken
+            || parsedExpiry(update.expiresAt) <= this.expiresAtMs)
+            return false;
+        const expected = leaseMac(update.dispatchAttemptId, update.fencingToken, update.expiresAt, this.controlKey);
+        if (!safeEqual(expected, update.mac))
+            return false;
+        this.expiresAtMs = parsedExpiry(update.expiresAt);
+        this.deadlineMs = monotonicNowMs + Math.max(0, this.expiresAtMs - wallNowMs);
+        return true;
+    }
+    expired(monotonicNowMs = performance.now()) {
+        return monotonicNowMs >= this.deadlineMs;
+    }
+}
+function leaseMac(dispatchAttemptId, fencingToken, expiresAt, controlKey) {
+    return createHmac("sha256", controlKey)
+        .update(`${dispatchAttemptId}\n${fencingToken}\n${expiresAt}`, "utf8")
+        .digest("base64url");
+}
+function safeEqual(left, right) {
+    const leftBytes = Buffer.from(left, "utf8");
+    const rightBytes = Buffer.from(right, "utf8");
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function parsedExpiry(value) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new Error("Lease expiry is invalid.");
+    return parsed;
+}
+function isSignedLeaseUpdate(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const update = value;
+    return update.schemaVersion === 1
+        && typeof update.dispatchAttemptId === "string"
+        && typeof update.fencingToken === "string"
+        && typeof update.expiresAt === "string"
+        && Number.isFinite(Date.parse(update.expiresAt))
+        && typeof update.mac === "string";
+}

package/dist/sandbox/preflight.d.ts

@@ -0,0 +1,84 @@
+import type { CommandRunner, SandboxPreflightResult } from "./sandbox.types.js";
+export interface DockerPreflightOptions {
+    readonly dockerExecutable?: string;
+    readonly dockerContext?: string;
+    readonly stateRoot?: string;
+    readonly runnerInstanceId?: string;
+    readonly maxConcurrentSandboxes?: number;
+    readonly diskHighWatermarkPercent?: number;
+    readonly diskLowWatermarkPercent?: number;
+    readonly minimumWorkspaceBytes?: number;
+    readonly hostMemoryReserveBytes?: number;
+    readonly defaultWorkerMemoryLimitBytes?: number;
+    readonly defaultServiceMemoryLimitBytes?: number;
+    readonly runtimeOverheadBytes?: number;
+    readonly requireRootless?: boolean;
+}
+export declare class DockerPreflight {
+    private readonly commands;
+    private readonly cacheMs;
+    private generation;
+    private cached;
+    private fullPreflightAt;
+    private staticPreflight;
+    private inspectionInFlight;
+    private lastCapacitySample;
+    private readonly options;
+    private readonly docker;
+    private readonly ownership;
+    private diskPressureLatched;
+    private readonly memoryAvailability;
+    constructor(options?: DockerPreflightOptions | string, commands?: CommandRunner, cacheMs?: number);
+    private unavailable;
+    private memoryReserveBytes;
+    private defaultAdmissionMemoryBytes;
+    current(): SandboxPreflightResult | null;
+    refresh(): Promise<SandboxPreflightResult>;
+    release(): Promise<void>;
+    run(force?: boolean): Promise<SandboxPreflightResult>;
+    /**
+     * Refreshes only the admission inputs that change while the daemon's static
+     * capability snapshot remains valid. Heartbeats use this path so periodic
+     * liveness reporting does not wake Docker/WSL to rerun feature probes.
+     */
+    refreshCapacity(): Promise<SandboxPreflightResult>;
+    /**
+     * When the cached static preflight remains usable, produces a capacity sample
+     * that began after this admission request. An older inspection is awaited,
+     * not preempted or reused. Later admission callers may share the next sample
+     * only when it began after they entered this method. Without a usable static
+     * snapshot, the existing fail-closed result is returned without probing.
+     */
+    refreshCapacityForAdmission(): Promise<SandboxPreflightResult>;
+    private startInspection;
+    private inspect;
+    private inspectCapacity;
+}
+/**
+ * Uses the same reviewed reserve vector as host-runtime admission. The input
+ * is always the physical host total; Docker Desktop's VM total is tracked as
+ * a separate daemon commitment domain.
+ */
+export declare function resolveSandboxHostMemoryReserveBytes(totalMemoryBytes: number, explicitBytes?: number, environment?: NodeJS.ProcessEnv): number;
+export declare function canRunDockerMaintenance(preflight: {
+    readonly healthy: boolean;
+    readonly unavailableCode?: string | null;
+}): boolean;
+export declare function evaluateDiskPressure(availableBytes: number, totalBytes: number, minimumAvailableBytes: number, highWatermarkPercent: number, lowWatermarkPercent: number, pressureLatched: boolean): boolean;
+export declare function requiredAvailableBytesToClearDiskPressure(totalBytes: number, minimumAvailableBytes: number, lowWatermarkPercent: number): number;
+export declare function storagePolicyAvailable(storageQuota: boolean, environment?: NodeJS.ProcessEnv): boolean;
+export declare class DockerContextOwnershipLock {
+    private lockPath;
+    private lockToken;
+    acquire(contextName?: string): Promise<void>;
+    release(): Promise<void>;
+}
+export declare function parseDockerMemoryUsage(value: string): number;
+interface DockerContextLockOwner {
+    readonly token?: string;
+    readonly pid?: number;
+    readonly processIdentity?: string | null;
+    readonly acquiredAt?: string;
+}
+export declare function dockerContextOwnerIsActive(owner: DockerContextLockOwner | null): boolean;
+export {};

package/dist/sandbox/preflight.js

@@ -0,0 +1,521 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { formatBytes } from "../shared/format/format-bytes.js";
+import { captureHostProcessIdentity } from "../shared/process/host-process-supervisor.js";
+import { RecoveryStabilizedMemory, resolveAdaptiveMemoryReserveBytes } from "../runtime/memory-capacity.js";
+import { BoundedCommandRunner } from "./command-runner.js";
+const minimumWorkspaceBytes = 10 * 1024 * 1024 * 1024;
+export class DockerPreflight {
+    commands;
+    cacheMs;
+    generation = 0;
+    cached = null;
+    fullPreflightAt = 0;
+    staticPreflight = null;
+    inspectionInFlight = null;
+    lastCapacitySample = null;
+    options;
+    docker;
+    ownership = new DockerContextOwnershipLock();
+    diskPressureLatched = false;
+    memoryAvailability = new RecoveryStabilizedMemory();
+    constructor(options = {}, commands = new BoundedCommandRunner(), cacheMs = 30_000) {
+        this.commands = commands;
+        this.cacheMs = cacheMs;
+        this.options = typeof options === "string" ? { dockerExecutable: options } : options;
+        this.docker = this.options.dockerExecutable ?? process.env.FORGE_DOCKER_EXECUTABLE ?? "docker";
+    }
+    unavailable(code, reason, features) {
+        const totalMemoryBytes = os.totalmem();
+        this.memoryAvailability.observe(0);
+        return unavailable(this.generation, code, reason, this.memoryReserveBytes(totalMemoryBytes), this.defaultAdmissionMemoryBytes(), totalMemoryBytes, features);
+    }
+    memoryReserveBytes(totalMemoryBytes) {
+        return resolveSandboxHostMemoryReserveBytes(totalMemoryBytes, this.options.hostMemoryReserveBytes);
+    }
+    defaultAdmissionMemoryBytes() {
+        const workerMemoryLimitBytes = positiveInteger(this.options.defaultWorkerMemoryLimitBytes, 2 * 1024 ** 3);
+        const serviceMemoryLimitBytes = nonNegativeInteger(this.options.defaultServiceMemoryLimitBytes, 0);
+        const runtimeOverheadBytes = Math.max(128 * 1024 ** 2, nonNegativeInteger(this.options.runtimeOverheadBytes, 128 * 1024 ** 2));
+        return workerMemoryLimitBytes + serviceMemoryLimitBytes + runtimeOverheadBytes;
+    }
+    current() {
+        return this.cached;
+    }
+    async refresh() {
+        await fs.mkdir(this.options.stateRoot ?? path.join(os.homedir(), ".forge", "bridge", "sandboxes"), { recursive: true, mode: 0o700 });
+        const result = await this.run(true);
+        if (canRunDockerMaintenance(result)) {
+            await this.ownership.acquire(this.options.dockerContext);
+        }
+        return result;
+    }
+    async release() {
+        await this.ownership.release();
+    }
+    async run(force = false) {
+        const inFlight = this.inspectionInFlight;
+        if (inFlight) {
+            const result = await inFlight.promise;
+            if (inFlight.kind === "full" || (!force && Date.now() - this.fullPreflightAt < this.cacheMs)) {
+                return result;
+            }
+            return await this.run(force);
+        }
+        if (!force && this.cached && Date.now() - this.fullPreflightAt < this.cacheMs)
+            return this.cached;
+        return await this.startInspection("full", () => this.inspect().catch((error) => this.unavailable("docker_unreachable", error instanceof Error ? error.message : String(error))), true);
+    }
+    /**
+     * Refreshes only the admission inputs that change while the daemon's static
+     * capability snapshot remains valid. Heartbeats use this path so periodic
+     * liveness reporting does not wake Docker/WSL to rerun feature probes.
+     */
+    async refreshCapacity() {
+        if (this.inspectionInFlight) {
+            return await this.inspectionInFlight.promise;
+        }
+        const staticPreflight = this.staticPreflight;
+        if (!staticPreflight || !this.cached || !canRunDockerMaintenance(this.cached)) {
+            return this.cached ?? this.unavailable("docker_preflight_required", "Docker capability preflight has not completed.");
+        }
+        return await this.startInspection("capacity", () => this.inspectCapacity(staticPreflight).catch((error) => this.unavailable("docker_capacity_unavailable", error instanceof Error ? error.message : String(error), staticPreflight.features)), false);
+    }
+    /**
+     * When the cached static preflight remains usable, produces a capacity sample
+     * that began after this admission request. An older inspection is awaited,
+     * not preempted or reused. Later admission callers may share the next sample
+     * only when it began after they entered this method. Without a usable static
+     * snapshot, the existing fail-closed result is returned without probing.
+     */
+    async refreshCapacityForAdmission() {
+        const generationAtRequest = this.generation;
+        while (true) {
+            const inFlight = this.inspectionInFlight;
+            if (inFlight) {
+                if (inFlight.kind === "capacity" && inFlight.generation > generationAtRequest) {
+                    return await inFlight.promise;
+                }
+                await inFlight.promise;
+                continue;
+            }
+            const lastCapacitySample = this.lastCapacitySample;
+            if (lastCapacitySample
+                && lastCapacitySample.generation > generationAtRequest
+                && lastCapacitySample.generation === this.generation
+                && lastCapacitySample.result === this.cached) {
+                return lastCapacitySample.result;
+            }
+            const staticPreflight = this.staticPreflight;
+            if (!staticPreflight || !this.cached || !canRunDockerMaintenance(this.cached)) {
+                return this.cached ?? this.unavailable("docker_preflight_required", "Docker capability preflight has not completed.");
+            }
+            return await this.startInspection("capacity", () => this.inspectCapacity(staticPreflight).catch((error) => this.unavailable("docker_capacity_unavailable", error instanceof Error ? error.message : String(error), staticPreflight.features)), false);
+        }
+    }
+    startInspection(kind, inspect, full) {
+        this.generation += 1;
+        const generation = this.generation;
+        const operation = Promise.resolve()
+            .then(inspect)
+            .then((result) => {
+            this.cached = result;
+            if (kind === "capacity")
+                this.lastCapacitySample = { generation, result };
+            if (full)
+                this.fullPreflightAt = Date.now();
+            return result;
+        })
+            .finally(() => {
+            if (this.inspectionInFlight?.promise === operation) {
+                this.inspectionInFlight = null;
+            }
+        });
+        this.inspectionInFlight = { kind, generation, promise: operation };
+        return operation;
+    }
+    async inspect() {
+        if (!new Set(["linux", "darwin", "win32"]).has(process.platform)) {
+            return this.unavailable("platform_unsupported", `Docker sandboxes are not supported on ${process.platform}.`);
+        }
+        const dockerArgs = this.options.dockerContext ? ["--context", this.options.dockerContext] : [];
+        const infoResult = await this.commands.run(this.docker, [...dockerArgs, "info", "--format", "{{json .}}"], { timeoutMs: 10_000, maxOutputBytes: 512 * 1024 });
+        if (infoResult.exitCode !== 0)
+            return this.unavailable("docker_unreachable", singleLine(infoResult.stderr || infoResult.stdout || "Docker daemon is unreachable."));
+        const info = parseInfo(infoResult.stdout);
+        if (String(info.OSType ?? "").toLowerCase() !== "linux")
+            return this.unavailable("docker_linux_required", "Forge sandbox images require a Linux Docker daemon.");
+        const securityOptions = strings(info.SecurityOptions).map((value) => value.toLowerCase());
+        const rootless = securityOptions.some((value) => value.includes("rootless"));
+        const userNamespaces = rootless || securityOptions.some((value) => value.includes("userns"));
+        const cgroupV2 = String(info.CgroupVersion ?? "") === "2";
+        const seccomp = securityOptions.some((value) => value.includes("seccomp"));
+        const lsm = securityOptions.some((value) => value.includes("apparmor") || value.includes("selinux"));
+        const storageDriver = String(info.Driver ?? "").toLowerCase();
+        const storageQuota = storageDriver === "overlay2" && Boolean(info.DriverStatus?.some?.((entry) => JSON.stringify(entry).toLowerCase().includes("project quota")));
+        const desktopDeveloperMode = process.platform !== "linux" && process.env.FORGE_ALLOW_DOCKER_DESKTOP_SANDBOX === "true";
+        const requireRootless = this.options.requireRootless ?? process.env.FORGE_SANDBOX_REQUIRE_ROOTLESS !== "false";
+        if (!rootless && !desktopDeveloperMode && requireRootless) {
+            return this.unavailable("docker_rootless_required", "Docker daemon is reachable but is not running rootless.", {
+                rootless, userNamespaces, cgroupV2, seccomp, lsm, storageQuota, storagePolicy: false, compose: false, internalNetwork: true, buildkit: false, imagePolicy: false, securityProfile: false, egressProxy: false
+            });
+        }
+        const composeResult = await this.commands.run(this.docker, [...dockerArgs, "compose", "version", "--short"], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => null);
+        const compose = composeResult?.exitCode === 0;
+        const buildxResult = await this.commands.run(this.docker, [...dockerArgs, "buildx", "version"], { timeoutMs: 5_000, maxOutputBytes: 16 * 1024 }).catch(() => null);
+        const buildxHelp = await this.commands.run(this.docker, [...dockerArgs, "buildx", "build", "--help"], { timeoutMs: 5_000, maxOutputBytes: 256 * 1024 }).catch(() => null);
+        const buildxPruneHelp = await this.commands.run(this.docker, [...dockerArgs, "buildx", "prune", "--help"], { timeoutMs: 5_000, maxOutputBytes: 256 * 1024 }).catch(() => null);
+        const containerUpdateHelp = await this.commands.run(this.docker, [...dockerArgs, "container", "update", "--help"], { timeoutMs: 5_000, maxOutputBytes: 256 * 1024 }).catch(() => null);
+        const buildkit = buildxResult?.exitCode === 0
+            && buildxHelp?.exitCode === 0
+            && ["--ulimit", "--shm-size"].every(flag => buildxHelp.stdout.includes(flag))
+            && buildxPruneHelp?.exitCode === 0
+            && ["--max-used-space", "--min-free-space", "--reserved-space"].every(flag => buildxPruneHelp.stdout.includes(flag))
+            && containerUpdateHelp?.exitCode === 0
+            && ["--pids-limit", "--memory", "--memory-swap"].every(flag => containerUpdateHelp.stdout.includes(flag));
+        const imagePolicy = process.env.FORGE_SANDBOX_IMAGE_POLICY_ENFORCED === "true"
+            && Boolean(process.env.FORGE_SANDBOX_SBOM_EXECUTABLE?.trim())
+            && Boolean(process.env.FORGE_SANDBOX_VULNERABILITY_EXECUTABLE?.trim())
+            && Boolean(process.env.FORGE_SANDBOX_PROVENANCE_SIGNING_KEY?.trim())
+            && Boolean(process.env.FORGE_SANDBOX_SIGNATURE_EXECUTABLE?.trim())
+            && Boolean(process.env.FORGE_SANDBOX_SIGNATURE_PUBLIC_KEY?.trim())
+            && process.env.FORGE_SANDBOX_BUILD_EGRESS_ENFORCED === "true";
+        const securityProfile = Boolean(process.env.FORGE_SANDBOX_SECCOMP_PROFILE?.trim())
+            && Boolean(process.env.FORGE_SANDBOX_LSM_SECURITY_OPT?.trim())
+            && seccomp && lsm;
+        const egressProxy = process.env.FORGE_SANDBOX_EGRESS_ENFORCED === "true"
+            && /@sha256:[0-9a-f]{64}$/iu.test(process.env.FORGE_SANDBOX_EGRESS_PROXY_IMAGE?.trim() ?? "");
+        const storagePolicy = storagePolicyAvailable(storageQuota);
+        const configuredStateRoot = this.options.stateRoot ?? path.join(os.homedir(), ".forge", "bridge", "sandboxes");
+        const dockerRoot = process.platform === "linux" && typeof info.DockerRootDir === "string" && path.isAbsolute(info.DockerRootDir)
+            ? info.DockerRootDir
+            : configuredStateRoot;
+        const dockerDesktop = process.platform !== "linux"
+            && String(info.OperatingSystem ?? "").toLowerCase().includes("docker desktop");
+        const reportedDockerMemoryBytes = Number(info.MemTotal);
+        const features = { rootless, userNamespaces, cgroupV2, seccomp, lsm, storageQuota, storagePolicy, compose, internalNetwork: true, buildkit, imagePolicy, securityProfile, egressProxy };
+        const staticPreflight = {
+            dockerArgs,
+            dockerRoot,
+            dockerDesktop,
+            dockerMemoryBytes: Number.isFinite(reportedDockerMemoryBytes) && reportedDockerMemoryBytes > 0
+                ? reportedDockerMemoryBytes
+                : null,
+            runtimeVersion: `docker/${String(info.ServerVersion ?? "unknown")}${rootless ? "-rootless" : "-desktop"}`,
+            features,
+        };
+        this.staticPreflight = staticPreflight;
+        return await this.inspectCapacity(staticPreflight);
+    }
+    async inspectCapacity(staticPreflight) {
+        const disk = await diskSpace(staticPreflight.dockerRoot);
+        const requiredWorkspaceBytes = this.options.minimumWorkspaceBytes ?? minimumWorkspaceBytes;
+        const highWatermark = Math.min(99, Math.max(1, this.options.diskHighWatermarkPercent ?? 90));
+        const lowWatermark = Math.min(highWatermark - 1, Math.max(0, this.options.diskLowWatermarkPercent ?? highWatermark - 10));
+        const diskLow = evaluateDiskPressure(disk.available, disk.total, requiredWorkspaceBytes, highWatermark, lowWatermark, this.diskPressureLatched);
+        this.diskPressureLatched = diskLow;
+        const requiredAvailableBytes = requiredAvailableBytesToClearDiskPressure(disk.total, requiredWorkspaceBytes, lowWatermark);
+        const rawHostAvailableMemoryBytesBefore = Math.max(0, os.freemem());
+        const hostTotalMemoryBytes = os.totalmem();
+        let totalMemoryBytes = hostTotalMemoryBytes;
+        // Native Docker shares the host capacity domain. Docker Desktop has a
+        // second VM/daemon domain, so neither domain may be treated as a substitute
+        // for the other when deciding whether new committed memory is safe.
+        let rawDaemonAvailableMemoryBytes = rawHostAvailableMemoryBytesBefore;
+        let daemonMemorySampleFailure = null;
+        if (staticPreflight.dockerDesktop) {
+            rawDaemonAvailableMemoryBytes = null;
+            if (staticPreflight.dockerMemoryBytes) {
+                totalMemoryBytes = staticPreflight.dockerMemoryBytes;
+                const stats = await this.commands.run(this.docker, [...staticPreflight.dockerArgs, "stats", "--no-stream", "--format", "{{.MemUsage}}"], { timeoutMs: 10_000, maxOutputBytes: 512 * 1024 }).catch(() => null);
+                if (stats?.exitCode === 0) {
+                    let dockerUsedMemoryBytes = 0;
+                    for (const line of stats.stdout.split(/\r?\n/gu).map(value => value.trim()).filter(Boolean)) {
+                        const usage = tryParseDockerMemoryUsage(line);
+                        if (usage === null) {
+                            daemonMemorySampleFailure = "Docker returned an invalid memory-usage sample.";
+                            break;
+                        }
+                        dockerUsedMemoryBytes += usage;
+                    }
+                    if (daemonMemorySampleFailure === null) {
+                        rawDaemonAvailableMemoryBytes = Math.max(0, staticPreflight.dockerMemoryBytes - dockerUsedMemoryBytes);
+                    }
+                }
+                else {
+                    daemonMemorySampleFailure = singleLine(stats?.stderr || stats?.stdout || "Docker Desktop memory capacity could not be sampled.");
+                }
+            }
+            else {
+                daemonMemorySampleFailure = "Docker Desktop did not report a valid memory-capacity limit.";
+            }
+        }
+        const rawHostAvailableMemoryBytesAfter = Math.max(0, os.freemem());
+        const rawHostAvailableMemoryBytes = Math.min(rawHostAvailableMemoryBytesBefore, rawHostAvailableMemoryBytesAfter);
+        if (!staticPreflight.dockerDesktop) {
+            rawDaemonAvailableMemoryBytes = rawHostAvailableMemoryBytes;
+        }
+        const sampledAt = new Date().toISOString();
+        const rawAvailableMemoryBytes = rawDaemonAvailableMemoryBytes === null
+            ? 0
+            : Math.min(rawHostAvailableMemoryBytes, rawDaemonAvailableMemoryBytes);
+        const availableMemoryBytes = this.memoryAvailability.observe(rawAvailableMemoryBytes);
+        const cpuCount = Math.max(1, os.availableParallelism?.() ?? os.cpus().length);
+        const availableCpuMillis = Math.max(0, (cpuCount - 1) * 1000);
+        // The reserve protects the physical host and its control plane. Docker
+        // Desktop's VM total remains the independent daemon commitment ceiling,
+        // but must not shrink the reserve derived from the Windows host.
+        const memoryReserveBytes = this.memoryReserveBytes(hostTotalMemoryBytes);
+        const workerMemoryLimitBytes = positiveInteger(this.options.defaultWorkerMemoryLimitBytes, 2 * 1024 ** 3);
+        const serviceMemoryLimitBytes = nonNegativeInteger(this.options.defaultServiceMemoryLimitBytes, 0);
+        const runtimeOverheadBytes = Math.max(128 * 1024 ** 2, nonNegativeInteger(this.options.runtimeOverheadBytes, 128 * 1024 ** 2));
+        const sandboxMemoryBytes = workerMemoryLimitBytes + serviceMemoryLimitBytes + runtimeOverheadBytes;
+        const minimumAdmissionMemoryBytes = 128 * 1024 ** 2 + Math.max(128 * 1024 ** 2, runtimeOverheadBytes);
+        const sandboxCpuMillis = 2_000;
+        const cpuSlots = Math.max(0, Math.floor(availableCpuMillis / sandboxCpuMillis));
+        const configuredMax = positiveInteger(this.options.maxConcurrentSandboxes, positiveInteger(process.env.FORGE_MAX_CONCURRENT_SANDBOXES, 3));
+        const availableForAdmissionBytes = Math.max(0, availableMemoryBytes - memoryReserveBytes);
+        const capacityLowCode = !diskLow && rawDaemonAvailableMemoryBytes === null
+            ? "docker_memory_sample_unavailable"
+            : !diskLow && availableForAdmissionBytes < minimumAdmissionMemoryBytes
+                ? "docker_memory_low"
+                : !diskLow && cpuSlots <= 0
+                    ? "docker_cpu_low"
+                    : null;
+        const maxConcurrentSandboxes = diskLow || capacityLowCode ? 0 : Math.min(3, configuredMax, cpuSlots);
+        const unavailableCode = diskLow ? "docker_disk_low" : capacityLowCode;
+        const unavailableReason = diskLow
+            ? `Docker workspace has ${formatBytes(disk.available)} available · ${formatBytes(requiredAvailableBytes)} required to clear disk pressure.`
+            : unavailableCode === "docker_memory_sample_unavailable"
+                ? `Docker Desktop memory capacity is unavailable (${daemonMemorySampleFailure ?? "unknown sampler failure"}); the host reports ${formatBytes(rawHostAvailableMemoryBytes)} free, but Forge will not admit a sandbox until both memory domains are known.`
+                : unavailableCode === "docker_memory_low"
+                    ? `${staticPreflight.dockerDesktop
+                        ? `The host reports ${formatBytes(rawHostAvailableMemoryBytes)} free and the Docker domain reports ${formatBytes(rawDaemonAvailableMemoryBytes ?? 0)} free; Forge uses the conservative ${formatBytes(rawAvailableMemoryBytes)} bound`
+                        : `Docker reports ${formatBytes(rawAvailableMemoryBytes)} free`} and reserves ${formatBytes(memoryReserveBytes)} for the host, leaving ${formatBytes(availableForAdmissionBytes)} for admission; the smallest supported sandbox requires ${formatBytes(minimumAdmissionMemoryBytes)}. Exact attempt memory is calculated dynamically from its worker profile, sidecars, and runtime helpers.`
+                    : unavailableCode === "docker_cpu_low"
+                        ? `Docker host has ${availableCpuMillis} available CPU millis; at least ${sandboxCpuMillis} are needed for one sandbox.`
+                        : null;
+        const capacityAvailable = unavailableCode === null;
+        return {
+            available: capacityAvailable,
+            healthy: capacityAvailable,
+            generation: this.generation,
+            sampledAt,
+            runtimeVersion: staticPreflight.runtimeVersion,
+            maxConcurrentSandboxes,
+            totalMemoryBytes,
+            rawHostAvailableMemoryBytes,
+            rawDaemonAvailableMemoryBytes,
+            rawAvailableMemoryBytes,
+            availableMemoryBytes,
+            hostReserveBytes: memoryReserveBytes,
+            admissionMemoryBytes: sandboxMemoryBytes,
+            availableCpuMillis,
+            availableWorkspaceBytes: disk.available,
+            diskLow,
+            unavailableCode,
+            unavailableReason,
+            features: staticPreflight.features,
+        };
+    }
+}
+/**
+ * Uses the same reviewed reserve vector as host-runtime admission. The input
+ * is always the physical host total; Docker Desktop's VM total is tracked as
+ * a separate daemon commitment domain.
+ */
+export function resolveSandboxHostMemoryReserveBytes(totalMemoryBytes, explicitBytes, environment = process.env) {
+    return resolveAdaptiveMemoryReserveBytes(totalMemoryBytes, {
+        explicitBytes,
+        floorBytes: positiveInteger(environment.FORGE_SANDBOX_HOST_MEMORY_RESERVE_FLOOR_BYTES, 1024 ** 3),
+        ceilingBytes: positiveInteger(environment.FORGE_SANDBOX_HOST_MEMORY_RESERVE_CEILING_BYTES, 4 * 1024 ** 3),
+        percent: positiveNumber(environment.FORGE_SANDBOX_HOST_MEMORY_RESERVE_PERCENT, 12.5),
+    });
+}
+const dockerMaintenanceUnavailableCodes = new Set([
+    "docker_disk_low",
+    "docker_memory_low",
+    "docker_memory_sample_unavailable",
+    "docker_cpu_low",
+]);
+export function canRunDockerMaintenance(preflight) {
+    return preflight.healthy || dockerMaintenanceUnavailableCodes.has(preflight.unavailableCode ?? "");
+}
+export function evaluateDiskPressure(availableBytes, totalBytes, minimumAvailableBytes, highWatermarkPercent, lowWatermarkPercent, pressureLatched) {
+    if (availableBytes < minimumAvailableBytes)
+        return true;
+    if (!(totalBytes > 0))
+        return true;
+    const usedPercent = (1 - availableBytes / totalBytes) * 100;
+    if (usedPercent >= highWatermarkPercent)
+        return true;
+    return pressureLatched && usedPercent > lowWatermarkPercent;
+}
+export function requiredAvailableBytesToClearDiskPressure(totalBytes, minimumAvailableBytes, lowWatermarkPercent) {
+    const watermarkBytes = totalBytes > 0
+        ? Math.ceil(totalBytes * (1 - Math.min(100, Math.max(0, lowWatermarkPercent)) / 100))
+        : 0;
+    return Math.max(0, minimumAvailableBytes, watermarkBytes);
+}
+export function storagePolicyAvailable(storageQuota, environment = process.env) {
+    return storageQuota || environment.FORGE_SANDBOX_DEDICATED_DISK === "true";
+}
+export class DockerContextOwnershipLock {
+    lockPath = null;
+    lockToken = null;
+    async acquire(contextName) {
+        if (this.lockPath)
+            return;
+        contextName = contextName?.trim() || process.env.DOCKER_CONTEXT?.trim() || process.env.DOCKER_HOST?.trim() || "default";
+        const key = createHash("sha256").update(contextName).digest("hex").slice(0, 24);
+        const lockPath = path.join(os.tmpdir(), `forge-docker-context-${key}.lock`);
+        const token = randomUUID();
+        await fs.mkdir(path.dirname(lockPath), { recursive: true });
+        try {
+            const handle = await fs.open(lockPath, "wx", 0o600);
+            await handle.writeFile(JSON.stringify({
+                schemaVersion: 2,
+                token,
+                pid: process.pid,
+                processIdentity: captureHostProcessIdentity(process.pid),
+                contextName,
+                acquiredAt: new Date().toISOString(),
+            }));
+            await handle.sync();
+            await handle.close();
+        }
+        catch (error) {
+            const owner = await readLock(lockPath);
+            if (!dockerContextOwnerIsActive(owner)) {
+                await fs.rm(lockPath, { force: true });
+                return await this.acquire(contextName);
+            }
+            throw new Error(`docker_context_owned: Docker context '${contextName}' is already owned by Forge runner pid ${owner?.pid ?? "unknown"}.`, { cause: error });
+        }
+        this.lockPath = lockPath;
+        this.lockToken = token;
+    }
+    async release() {
+        if (!this.lockPath)
+            return;
+        const owner = await readLock(this.lockPath);
+        if (owner?.token === this.lockToken) {
+            await fs.rm(this.lockPath, { force: true });
+        }
+        this.lockPath = null;
+        this.lockToken = null;
+    }
+}
+function parseInfo(stdout) {
+    try {
+        const value = JSON.parse(stdout.trim());
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("not an object");
+        return value;
+    }
+    catch (error) {
+        throw new Error("Docker returned an invalid info document.", { cause: error });
+    }
+}
+function unavailable(generation, code, reason, hostReserveBytes, admissionMemoryBytes, totalMemoryBytes, features = {
+    rootless: false, userNamespaces: false, cgroupV2: false, seccomp: false, lsm: false, storageQuota: false, storagePolicy: false, compose: false, internalNetwork: false, buildkit: false, imagePolicy: false, securityProfile: false, egressProxy: false
+}) {
+    const rawHostAvailableMemoryBytes = Math.max(0, os.freemem());
+    return {
+        available: false,
+        healthy: false,
+        generation,
+        sampledAt: new Date().toISOString(),
+        runtimeVersion: null,
+        maxConcurrentSandboxes: 0,
+        totalMemoryBytes,
+        rawHostAvailableMemoryBytes,
+        rawDaemonAvailableMemoryBytes: null,
+        rawAvailableMemoryBytes: rawHostAvailableMemoryBytes,
+        availableMemoryBytes: rawHostAvailableMemoryBytes,
+        hostReserveBytes,
+        admissionMemoryBytes,
+        availableCpuMillis: Math.max(0, (os.availableParallelism?.() ?? os.cpus().length) * 1000),
+        availableWorkspaceBytes: 0,
+        diskLow: code === "docker_disk_low",
+        unavailableCode: code,
+        unavailableReason: singleLine(reason),
+        features,
+    };
+}
+async function diskSpace(inputPath) {
+    const stats = await fs.statfs(inputPath, { bigint: true }).catch(() => null);
+    if (!stats)
+        return { available: 0, total: 0 };
+    return {
+        available: safeNumber(stats.bavail * stats.bsize),
+        total: safeNumber(stats.blocks * stats.bsize),
+    };
+}
+function safeNumber(value) {
+    return Number(value > BigInt(Number.MAX_SAFE_INTEGER) ? BigInt(Number.MAX_SAFE_INTEGER) : value);
+}
+function strings(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+function positiveInteger(value, fallback) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function singleLine(value) {
+    return value.replace(/[\r\n\t]+/gu, " ").trim().slice(0, 1000);
+}
+function nonNegativeInteger(value, fallback) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+function positiveNumber(value, fallback) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function tryParseDockerMemoryUsage(value) {
+    const usage = value.split("/", 1)[0]?.trim().replaceAll(" ", "") ?? "";
+    const match = /^(\d+(?:\.\d+)?)(b|kib|mib|gib|tib)$/iu.exec(usage);
+    if (!match)
+        return null;
+    const amount = Number(match[1]);
+    const multiplier = { b: 1, kib: 1024, mib: 1024 ** 2, gib: 1024 ** 3, tib: 1024 ** 4 }[match[2].toLowerCase()];
+    return Number.isFinite(amount) ? Math.round(amount * multiplier) : null;
+}
+export function parseDockerMemoryUsage(value) {
+    return tryParseDockerMemoryUsage(value) ?? 0;
+}
+async function readLock(lockPath) {
+    return await fs.readFile(lockPath, "utf8").then((value) => JSON.parse(value)).catch(() => null);
+}
+export function dockerContextOwnerIsActive(owner) {
+    if (!owner || !Number.isSafeInteger(owner.pid) || (owner.pid ?? 0) <= 0 || !processExists(owner.pid)) {
+        return false;
+    }
+    const liveIdentity = captureHostProcessIdentity(owner.pid);
+    if (owner.processIdentity) {
+        // A live but unverifiable process must remain protected. Windows and Linux
+        // normally provide a birth marker, so a mismatch is positive PID-reuse proof.
+        return !liveIdentity || liveIdentity === owner.processIdentity;
+    }
+    if (process.platform === "win32" && liveIdentity?.startsWith("win32:") && owner.acquiredAt) {
+        const ticks = Number(liveIdentity.slice("win32:".length));
+        const acquiredAt = Date.parse(owner.acquiredAt);
+        const processStartedAt = ticks / 10_000 - 62_135_596_800_000;
+        if (Number.isFinite(processStartedAt) && Number.isFinite(acquiredAt) && processStartedAt > acquiredAt) {
+            return false;
+        }
+    }
+    return true;
+}
+function processExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}