@madarco/agentbox 0.5.0 → 0.7.0

package/dist/chunk-PXUBE5KS.js

@@ -1,2346 +0,0 @@
-#!/usr/bin/env node
-import {
-  containerExists,
-  detectEngine,
-  ensureVolume,
-  execInBox,
-  orbstackVolumePath,
-  removeContainer,
-  sanitizeMnemonic,
-  volumeExists
-} from "./chunk-RFC5F5HR.js";
-
-// ../../packages/sandbox-docker/dist/chunk-LGNJND37.js
-import { mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from "fs/promises";
-import { homedir, tmpdir } from "os";
-import { join, relative } from "path";
-import { execa } from "execa";
-import { randomBytes } from "crypto";
-import { execa as execa2 } from "execa";
-import { readdir as readdir2, stat as stat2 } from "fs/promises";
-import { join as join2 } from "path";
-import { execa as execa3 } from "execa";
-import { execa as execa4 } from "execa";
-import { mkdir as mkdir2, readdir as readdir3, rm as rm2, stat as stat3 } from "fs/promises";
-import { homedir as homedir2, platform } from "os";
-import { join as join3, resolve } from "path";
-import { stat as stat4 } from "fs/promises";
-import { spawn } from "child_process";
-import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync, openSync } from "fs";
-import { mkdir as mkdir3, readFile as readFile2, unlink, writeFile as writeFile2 } from "fs/promises";
-import { request as httpRequest } from "http";
-import { homedir as homedir3 } from "os";
-import { dirname, join as join4, resolve as resolve2 } from "path";
-import { setTimeout as delay } from "timers/promises";
-import { fileURLToPath } from "url";
-
-// ../../packages/relay/dist/index.js
-var DEFAULT_RELAY_PORT = 8787;
-var RELAY_CONTAINER_NAME = "agentbox-relay";
-var RELAY_NETWORK_NAME = "agentbox-net";
-var RELAY_IMAGE_REF = "agentbox/relay:dev";
-var MAX_BODY_BYTES = 1024 * 1024;
-
-// ../../packages/sandbox-docker/dist/chunk-LGNJND37.js
-function isHostPathHookCommand(command, hostHome) {
-  if (typeof command !== "string" || command.length === 0) return false;
-  if (hostHome.length === 0) return false;
-  return command.includes(hostHome + "/");
-}
-function filterHostHooks(data, hostHome) {
-  const clone = structuredClone(data);
-  const removedCommands = [];
-  if (clone === null || typeof clone !== "object" || Array.isArray(clone)) {
-    return { data: clone, removedCommands };
-  }
-  const top = clone;
-  const hooksRoot = top.hooks;
-  if (hooksRoot === null || typeof hooksRoot !== "object" || Array.isArray(hooksRoot)) {
-    return { data: clone, removedCommands };
-  }
-  for (const triggerName of Object.keys(hooksRoot)) {
-    const triggerValue = hooksRoot[triggerName];
-    if (!Array.isArray(triggerValue)) continue;
-    for (const entry of triggerValue) {
-      if (entry === null || typeof entry !== "object") continue;
-      const matcher = entry;
-      const inner = matcher.hooks;
-      if (!Array.isArray(inner)) continue;
-      for (let i = inner.length - 1; i >= 0; i--) {
-        const leaf = inner[i];
-        if (leaf === null || typeof leaf !== "object") continue;
-        if (leaf.type === "command" && typeof leaf.command === "string" && isHostPathHookCommand(leaf.command, hostHome)) {
-          removedCommands.push(leaf.command);
-          inner.splice(i, 1);
-        }
-      }
-    }
-  }
-  return { data: clone, removedCommands };
-}
-function addProjectAlias(data, fromPath, toPath) {
-  const clone = structuredClone(data);
-  if (clone === null || typeof clone !== "object" || Array.isArray(clone)) {
-    return { data: clone, aliased: false };
-  }
-  if (fromPath === toPath || fromPath.length === 0 || toPath.length === 0) {
-    return { data: clone, aliased: false };
-  }
-  const obj = clone;
-  const projects = obj.projects;
-  if (projects === null || typeof projects !== "object" || Array.isArray(projects)) {
-    return { data: clone, aliased: false };
-  }
-  const projectsMap = projects;
-  const src = projectsMap[fromPath];
-  if (src === null || typeof src !== "object" || Array.isArray(src)) {
-    return { data: clone, aliased: false };
-  }
-  const existing = projectsMap[toPath];
-  if (existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-    projectsMap[toPath] = { ...existing, ...src };
-  } else {
-    projectsMap[toPath] = structuredClone(src);
-  }
-  return { data: clone, aliased: true };
-}
-function clearInstallMethod(data) {
-  const clone = structuredClone(data);
-  if (clone === null || typeof clone !== "object" || Array.isArray(clone)) {
-    return { data: clone, cleared: false };
-  }
-  const obj = clone;
-  if (Object.prototype.hasOwnProperty.call(obj, "installMethod")) {
-    delete obj.installMethod;
-    return { data: clone, cleared: true };
-  }
-  return { data: clone, cleared: false };
-}
-var SKILL_EXCLUDE_PREFIXES = ["agentbox-"];
-var CONTAINER_PLUGINS_PREFIX = "/home/vscode/.claude/plugins/";
-function pickNewItems(boxNames, hostNames, excludePrefixes = []) {
-  const host = new Set(hostNames);
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const name of boxNames) {
-    if (name.length === 0 || host.has(name) || seen.has(name)) continue;
-    if (excludePrefixes.some((p) => name.startsWith(p))) continue;
-    seen.add(name);
-    out.push(name);
-  }
-  return out.sort();
-}
-function rewritePluginPaths(value, hostPluginsPrefix) {
-  if (typeof value === "string") {
-    return value.split(CONTAINER_PLUGINS_PREFIX).join(hostPluginsPrefix);
-  }
-  if (Array.isArray(value)) {
-    return value.map((v) => rewritePluginPaths(v, hostPluginsPrefix));
-  }
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = rewritePluginPaths(v, hostPluginsPrefix);
-    }
-    return out;
-  }
-  return value;
-}
-function isPlainObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function additiveMerge(hostRoot, boxRoot, hostPluginsPrefix, selectMap, withMap) {
-  const hostMap = selectMap(hostRoot);
-  const boxMap = selectMap(boxRoot);
-  if (!isPlainObject(boxMap)) {
-    return { data: hostRoot, changed: false, addedKeys: [] };
-  }
-  const base = isPlainObject(hostMap) ? { ...hostMap } : {};
-  const addedKeys = [];
-  for (const [key, value] of Object.entries(boxMap)) {
-    if (Object.prototype.hasOwnProperty.call(base, key)) continue;
-    base[key] = rewritePluginPaths(value, hostPluginsPrefix);
-    addedKeys.push(key);
-  }
-  if (addedKeys.length === 0) {
-    return { data: hostRoot, changed: false, addedKeys: [] };
-  }
-  return { data: withMap(hostRoot, base), changed: true, addedKeys: addedKeys.sort() };
-}
-function mergeKnownMarketplaces(hostJson, boxJson, opts) {
-  const prefix = `${opts.hostHome}/.claude/plugins/`;
-  return additiveMerge(
-    isPlainObject(hostJson) ? hostJson : {},
-    boxJson,
-    prefix,
-    (root) => root,
-    (_host, merged) => merged
-  );
-}
-function mergeInstalledPlugins(hostJson, boxJson, opts) {
-  const prefix = `${opts.hostHome}/.claude/plugins/`;
-  const hostRoot = isPlainObject(hostJson) ? hostJson : { plugins: {} };
-  return additiveMerge(
-    hostRoot,
-    boxJson,
-    prefix,
-    (root) => isPlainObject(root) ? root["plugins"] : void 0,
-    (host, merged) => ({ ...host, plugins: merged })
-  );
-}
-var SHARED_CLAUDE_VOLUME = "agentbox-claude-config";
-var DEFAULT_CLAUDE_SESSION = "claude";
-var CONTAINER_CLAUDE_DIR = "/home/vscode/.claude";
-var CONTAINER_USER = "vscode";
-var CONTAINER_WORKSPACE = "/workspace";
-var IN_BOX_SETUP_GUIDE_PATH = "/usr/local/share/agentbox/setup-guide.md";
-var SETUP_SKILL_DST = "/dst/skills/agentbox-setup/SKILL.md";
-function resolveClaudeVolume(opts) {
-  if (opts.isolate) {
-    return { volume: `${SHARED_CLAUDE_VOLUME}-${opts.boxId}` };
-  }
-  return { volume: SHARED_CLAUDE_VOLUME };
-}
-async function pathExists(p) {
-  try {
-    await stat(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function findBrokenSymlinks(root) {
-  const broken = [];
-  async function walk(dir) {
-    let entries;
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const ent of entries) {
-      const full = join(dir, ent.name);
-      if (ent.isSymbolicLink()) {
-        try {
-          await stat(full);
-        } catch {
-          broken.push(relative(root, full));
-        }
-      } else if (ent.isDirectory()) {
-        await walk(full);
-      }
-    }
-  }
-  await walk(root);
-  return broken;
-}
-async function ensureClaudeVolume(spec, opts) {
-  const existed = await volumeExists(spec.volume);
-  await ensureVolume(spec.volume);
-  const created = !existed;
-  if (!opts.syncFromHost) return { created, synced: false };
-  const hostClaude = join(homedir(), ".claude");
-  if (!await pathExists(hostClaude)) return { created, synced: false };
-  const hostClaudeJson = join(homedir(), ".claude.json");
-  const hasJson = await pathExists(hostClaudeJson);
-  const hostHome = homedir();
-  const hostAgents = join(homedir(), ".agents");
-  const hasAgents = await pathExists(hostAgents);
-  const args = [
-    "run",
-    "--rm",
-    "--user",
-    "0",
-    // HOST_HOME used inside the shell script to rewrite host-absolute
-    // installPath values in plugins/installed_plugins.json.
-    "-e",
-    `HOST_HOME=${hostHome}`,
-    "-v",
-    `${spec.volume}:/dst`,
-    "-v",
-    `${hostClaude}:/src-claude:ro`
-  ];
-  if (hasJson) args.push("-v", `${hostClaudeJson}:/src-claude-json:ro`);
-  if (hasAgents) args.push("-v", `${hostAgents}:/.agents:ro`);
-  const filterDir = await mkdtemp(join(tmpdir(), "agentbox-claude-filter-"));
-  let filteredHookCount = 0;
-  let clearedInstallMethod = false;
-  let aliasedProjectKey = false;
-  try {
-    const settingsResult = await maybeFilterTo(
-      join(hostClaude, "settings.json"),
-      join(filterDir, "settings.json"),
-      hostHome
-    );
-    filteredHookCount += settingsResult.removedHooks;
-    if (hasJson) {
-      const jsonResult = await maybeFilterTo(
-        hostClaudeJson,
-        join(filterDir, "_claude.json"),
-        hostHome,
-        {
-          clearInstallMethod: true,
-          aliasProject: opts.hostWorkspace ? { from: opts.hostWorkspace, to: CONTAINER_WORKSPACE } : void 0
-        }
-      );
-      filteredHookCount += jsonResult.removedHooks;
-      clearedInstallMethod = jsonResult.clearedInstallMethod;
-      aliasedProjectKey = jsonResult.aliasedProjectKey;
-    }
-    if (filteredHookCount > 0 || clearedInstallMethod || aliasedProjectKey) {
-      args.push("-v", `${filterDir}:/src-filter:ro`);
-    }
-    const brokenSymlinks = await findBrokenSymlinks(hostClaude);
-    const rsyncExcludes = ["--exclude=node_modules"];
-    for (const rel of brokenSymlinks) rsyncExcludes.push(`--exclude=/${rel}`);
-    const rsyncFlags = `-a --copy-unsafe-links ${rsyncExcludes.join(" ")}`;
-    args.push(
-      opts.image,
-      "sh",
-      "-c",
-      // Each step in its own brace group so a missing optional file (no
-      // .claude.json on host, no filtered overlays) doesn't short-circuit the
-      // final chown.
-      //
-      // --copy-unsafe-links: dereference symlinks pointing OUTSIDE
-      //   /src-claude (e.g. ~/.claude/skills/* -> ../../.agents/skills/*),
-      //   so user skills materialize as real directories inside the volume
-      //   without needing to also bind-mount ~/.agents.
-      // --exclude=node_modules: skip every node_modules directory anywhere
-      //   in the tree. Plugin caches (plugins/cache/<m>/<p>/<v>/node_modules)
-      //   ship host-platform-specific binaries (darwin-arm64 fsevents,
-      //   esbuild, rollup, sharp) that are useless on linux/amd64. The
-      //   plugin source still lands; node_modules is rebuilt lazily inside
-      //   the box on first claude session (see rebuildPluginNativeDeps).
-      //
-      // The top-level plugin registry JSONs (installed_plugins.json,
-      // known_marketplaces.json) carry host-absolute `installPath` /
-      // `installLocation` values; without rewriting, claude resolves them
-      // to `/Users/<you>/...` (or, when claude detects the missing path,
-      // falls back to a slug derived from `source.repo` like
-      // `microsoft-playwright-cli` — neither exists in the box, and the
-      // marketplace fails to load, which masquerades as "plugin not
-      // found in marketplace"). One sweep over every JSON directly under
-      // /dst/plugins/ catches both files (and any future registry).
-      // One-shot migration for volumes that were populated before
-      // --exclude=node_modules existed. Without it, the volume keeps
-      // host-darwin node_modules forever (rsync without --delete won't
-      // remove them). The `.agentbox-cleaned-nm-v1` sentinel makes the wipe
-      // a no-op after the first run; rebuildPluginNativeDeps repopulates
-      // linux/amd64 node_modules on the next `agentbox claude`.
-      `{ [ ! -f /dst/.agentbox-cleaned-nm-v1 ] && find /dst -name node_modules -type d -prune -exec rm -rf {} + && touch /dst/.agentbox-cleaned-nm-v1; true; } && rsync ${rsyncFlags} /src-claude/ /dst/ && { [ -f /src-claude-json ] && cp -a /src-claude-json /dst/_claude.json; true; } && { [ -f /src-filter/settings.json ] && cp -a /src-filter/settings.json /dst/settings.json; true; } && { [ -f /src-filter/_claude.json ] && cp -a /src-filter/_claude.json /dst/_claude.json; true; } && { [ -d /dst/plugins ] && [ -n "$HOST_HOME" ] && find /dst/plugins -maxdepth 1 -type f -name "*.json" -exec sed -i "s|$HOST_HOME/.claude/plugins/|/home/vscode/.claude/plugins/|g" {} +; true; } && chown -R 1000:1000 /dst`
-    );
-    await execa("docker", args);
-  } finally {
-    await rm(filterDir, { recursive: true, force: true });
-  }
-  return { created, synced: true, filteredHookCount, clearedInstallMethod, aliasedProjectKey };
-}
-async function seedSetupSkillIntoVolume(volume, image) {
-  try {
-    const { stdout } = await execa("docker", [
-      "run",
-      "--rm",
-      "--user",
-      "0",
-      "-v",
-      `${volume}:/dst`,
-      image,
-      "sh",
-      "-c",
-      // Prints SEEDED only when it actually copies, so the caller can log
-      // accurately. The whole thing is `|| true` so an already-present skill
-      // (or missing image asset) is a clean no-op, never a non-zero exit.
-      `{ [ ! -e /dst/skills/agentbox-setup ] && [ -f ${IN_BOX_SETUP_GUIDE_PATH} ] && mkdir -p /dst/skills/agentbox-setup && cp -a ${IN_BOX_SETUP_GUIDE_PATH} ${SETUP_SKILL_DST} && chown -R 1000:1000 /dst/skills/agentbox-setup && echo SEEDED; } || true`
-    ]);
-    return { seeded: stdout.includes("SEEDED") };
-  } catch {
-    return { seeded: false };
-  }
-}
-async function maybeFilterTo(src, dest, hostHome, opts = {}) {
-  let parsed;
-  try {
-    parsed = JSON.parse(await readFile(src, "utf8"));
-  } catch {
-    return { removedHooks: 0, clearedInstallMethod: false, aliasedProjectKey: false };
-  }
-  const filtered = filterHostHooks(parsed, hostHome);
-  let working = filtered.data;
-  let cleared = false;
-  if (opts.clearInstallMethod) {
-    const r = clearInstallMethod(working);
-    working = r.data;
-    cleared = r.cleared;
-  }
-  let aliased = false;
-  if (opts.aliasProject) {
-    const r = addProjectAlias(working, opts.aliasProject.from, opts.aliasProject.to);
-    working = r.data;
-    aliased = r.aliased;
-  }
-  if (filtered.removedCommands.length === 0 && !cleared && !aliased) {
-    return { removedHooks: 0, clearedInstallMethod: false, aliasedProjectKey: false };
-  }
-  await writeFile(dest, JSON.stringify(working, null, 2));
-  return {
-    removedHooks: filtered.removedCommands.length,
-    clearedInstallMethod: cleared,
-    aliasedProjectKey: aliased
-  };
-}
-var FORWARDED_ENV_KEYS = [
-  "ANTHROPIC_API_KEY",
-  "CLAUDE_CODE_OAUTH_TOKEN",
-  "CLAUDE_EFFORT",
-  "ANTHROPIC_MODEL"
-];
-function buildClaudeMounts(spec, hostEnv) {
-  const env = {};
-  for (const k of FORWARDED_ENV_KEYS) {
-    const v = hostEnv[k];
-    if (typeof v === "string" && v.length > 0) env[k] = v;
-  }
-  return {
-    extraVolumes: [`${spec.volume}:${CONTAINER_CLAUDE_DIR}`],
-    env,
-    volumeName: spec.volume
-  };
-}
-var PLUGIN_INSTALLED_MARKER = ".agentbox-installed";
-var PLUGIN_FAILED_MARKER = ".agentbox-install-failed";
-var PLUGIN_INSTALL_BACKOFF_MS = 6 * 60 * 60 * 1e3;
-var PLUGIN_INSTALL_BACKOFF_MIN = Math.round(PLUGIN_INSTALL_BACKOFF_MS / 6e4);
-var NPM_CACHE_DIR = "/home/vscode/.claude/.agentbox-npm-cache";
-async function isFile(p) {
-  try {
-    return (await stat(p)).isFile();
-  } catch {
-    return false;
-  }
-}
-async function isRecentFailMarker(p) {
-  try {
-    const st = await stat(p);
-    return Date.now() - st.mtimeMs < PLUGIN_INSTALL_BACKOFF_MS;
-  } catch {
-    return false;
-  }
-}
-async function isDir(p) {
-  try {
-    return (await stat(p)).isDirectory();
-  } catch {
-    return false;
-  }
-}
-async function scanPluginCacheForRebuild(cacheRoot) {
-  let marketplaces;
-  try {
-    marketplaces = await readdir(cacheRoot, { withFileTypes: true });
-  } catch {
-    return false;
-  }
-  for (const m of marketplaces) {
-    if (!m.isDirectory()) continue;
-    const mPath = join(cacheRoot, m.name);
-    let plugins;
-    try {
-      plugins = await readdir(mPath, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const p of plugins) {
-      if (!p.isDirectory()) continue;
-      const pPath = join(mPath, p.name);
-      let versions;
-      try {
-        versions = await readdir(pPath, { withFileTypes: true });
-      } catch {
-        continue;
-      }
-      for (const v of versions) {
-        if (!v.isDirectory()) continue;
-        const vPath = join(pPath, v.name);
-        if (!await isFile(join(vPath, "package.json"))) continue;
-        if (await isFile(join(vPath, PLUGIN_INSTALLED_MARKER))) continue;
-        if (await isRecentFailMarker(join(vPath, PLUGIN_FAILED_MARKER))) continue;
-        return true;
-      }
-    }
-  }
-  return false;
-}
-async function resolveClaudeCacheLiveOnHost(volume) {
-  if (await detectEngine() !== "orbstack") return null;
-  if (!await isDir(orbstackVolumePath(volume))) return null;
-  return orbstackVolumePath(volume, "plugins", "cache");
-}
-async function rebuildPluginNativeDeps(container, opts = {}) {
-  if (opts.volume) {
-    const cacheRoot = await resolveClaudeCacheLiveOnHost(opts.volume);
-    if (cacheRoot && !await scanPluginCacheForRebuild(cacheRoot)) {
-      return { rebuilt: [], failed: [], skipped: true };
-    }
-  }
-  const script = `set -u
-PLUGINS_DIR=/home/vscode/.claude/plugins/cache
-MARKER=${PLUGIN_INSTALLED_MARKER}
-FAILMARKER=${PLUGIN_FAILED_MARKER}
-NPM_CACHE=${NPM_CACHE_DIR}
-BACKOFF_MIN=${PLUGIN_INSTALL_BACKOFF_MIN}
-MAX=4
-[ -d "$PLUGINS_DIR" ] || exit 0
-mkdir -p "$NPM_CACHE"
-WORK=$(mktemp -d)
-relkey() { printf '%s' "\${1#$PLUGINS_DIR/}" | tr '/' '_'; }
-# Run one plugin's install. $1 is frozen by value at call time, so it's safe
-# to read from the backgrounded subshell; the rest are set-once constants.
-do_one() {
-  d=$1
-  key=$(relkey "$d")
-  if (cd "$d" && \\
-      if [ -f package-lock.json ]; then \\
-        npm ci --no-audit --no-fund --silent --prefer-offline --cache "$NPM_CACHE"; \\
-      else \\
-        npm install --no-audit --no-fund --silent --no-package-lock --prefer-offline --cache "$NPM_CACHE"; \\
-      fi) >"$WORK/$key.out" 2>"$WORK/$key.err"; then
-    touch "$d/$MARKER"
-    rm -f "$d/$FAILMARKER"
-    printf 'OK\\n' > "$WORK/$key.res"
-  else
-    : > "$d/$FAILMARKER"
-    printf 'FAIL\\n' > "$WORK/$key.res"
-  fi
-}
-n=0
-for dir in "$PLUGINS_DIR"/*/*/*/; do
-  [ -d "$dir" ] || continue
-  [ -f "$dir/package.json" ] || continue
-  [ -f "$dir/$MARKER" ] && continue
-  [ -n "$(find "$dir" -maxdepth 1 -name "$FAILMARKER" -mmin -$BACKOFF_MIN 2>/dev/null)" ] && continue
-  echo "REBUILD_START \${dir#$PLUGINS_DIR/}"
-  n=$((n+1))
-  printf '%s\\n' "$dir" >> "$WORK/dirs"
-done
-if [ "$n" -eq 0 ]; then rm -rf "$WORK"; exit 0; fi
-running=0
-while IFS= read -r dir; do
-  do_one "$dir" &
-  running=$((running+1))
-  if [ "$running" -ge "$MAX" ]; then wait; running=0; fi
-done < "$WORK/dirs"
-wait
-while IFS= read -r dir; do
-  key=$(relkey "$dir")
-  rel=\${dir#$PLUGINS_DIR/}
-  [ -f "$WORK/$key.res" ] || continue
-  read -r st < "$WORK/$key.res"
-  if [ "$st" = OK ]; then
-    echo "REBUILD_OK $rel"
-  else
-    echo "REBUILD_FAIL $rel"
-    sed 's/^/  /' "$WORK/$key.err"
-    echo "REBUILD_FAIL_END"
-  fi
-done < "$WORK/dirs"
-rm -rf "$WORK"
-`;
-  const result = await execa(
-    "docker",
-    ["exec", "--user", CONTAINER_USER, container, "sh", "-c", script],
-    { reject: false }
-  );
-  const rebuilt = [];
-  const failed = [];
-  const lines = (result.stdout ?? "").split("\n");
-  let collectingFail = null;
-  for (const line of lines) {
-    if (collectingFail) {
-      if (line === "REBUILD_FAIL_END") {
-        failed.push({ dir: collectingFail.dir, stderr: collectingFail.stderr.join("\n") });
-        collectingFail = null;
-      } else {
-        collectingFail.stderr.push(line);
-      }
-      continue;
-    }
-    if (line.startsWith("REBUILD_START ")) {
-      opts.onProgress?.(`rebuilding ${line.slice("REBUILD_START ".length)}`);
-    } else if (line.startsWith("REBUILD_OK ")) {
-      rebuilt.push(line.slice("REBUILD_OK ".length));
-    } else if (line.startsWith("REBUILD_FAIL ")) {
-      collectingFail = { dir: line.slice("REBUILD_FAIL ".length), stderr: [] };
-    }
-  }
-  return { rebuilt, failed, skipped: false };
-}
-var ClaudeSessionError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ClaudeSessionError";
-  }
-};
-function shQuote(arg) {
-  if (arg.length === 0) return `''`;
-  if (/^[A-Za-z0-9_\-./=:@%+,]+$/.test(arg)) return arg;
-  return `'${arg.replace(/'/g, `'\\''`)}'`;
-}
-async function startClaudeSession(opts) {
-  const sessionName = opts.sessionName ?? DEFAULT_CLAUDE_SESSION;
-  const cmd = ["claude", ...opts.claudeArgs].map(shQuote).join(" ");
-  const term = process.env["TERM"] ?? "xterm-256color";
-  const envFlags = ["-e", `TERM=${term}`];
-  for (const k of FORWARDED_ENV_KEYS) {
-    const v = process.env[k];
-    if (typeof v === "string" && v.length > 0) envFlags.push("-e", `${k}=${v}`);
-  }
-  const result = await execa(
-    "docker",
-    [
-      "exec",
-      ...envFlags,
-      "--user",
-      CONTAINER_USER,
-      opts.container,
-      "tmux",
-      "new-session",
-      "-d",
-      "-s",
-      sessionName,
-      cmd,
-      ...buildClaudeStatusBarArgs(sessionName)
-    ],
-    { reject: false }
-  );
-  if (result.exitCode === 0) return;
-  const stderr = (result.stderr ?? "").toString();
-  if (result.exitCode === 127 || /command not found|tmux: not found/i.test(stderr)) {
-    throw new ClaudeSessionError(
-      `tmux is missing from the box image. Rebuild with: docker rmi agentbox/box:dev && retry.`
-    );
-  }
-  if (/claude.*not found|exec: "claude"/i.test(stderr)) {
-    throw new ClaudeSessionError(
-      `claude is missing from the box image. Rebuild with: docker rmi agentbox/box:dev && retry.`
-    );
-  }
-  if (/duplicate session/i.test(stderr)) {
-    throw new ClaudeSessionError(
-      `a tmux session "${sessionName}" already exists in ${opts.container}; use \`agentbox claude attach\` to reattach.`
-    );
-  }
-  throw new ClaudeSessionError(
-    `failed to start claude session in ${opts.container}: ${stderr.trim() || `exit ${String(result.exitCode)}`}`
-  );
-}
-function buildClaudeAttachArgv(container, sessionName) {
-  const name = sessionName ?? DEFAULT_CLAUDE_SESSION;
-  const term = process.env["TERM"] ?? "xterm-256color";
-  return [
-    "exec",
-    "-it",
-    "-e",
-    `TERM=${term}`,
-    "--user",
-    CONTAINER_USER,
-    container,
-    "tmux",
-    "attach",
-    "-t",
-    name
-  ];
-}
-function buildClaudeDashboardAttachArgv(container, sessionName) {
-  const name = sessionName ?? DEFAULT_CLAUDE_SESSION;
-  const dash = `${name}-dash`;
-  const term = process.env["TERM"] ?? "xterm-256color";
-  return [
-    "exec",
-    "-it",
-    "-e",
-    `TERM=${term}`,
-    "--user",
-    CONTAINER_USER,
-    container,
-    "tmux",
-    "new-session",
-    "-A",
-    "-d",
-    "-s",
-    dash,
-    "-t",
-    name,
-    ";",
-    "set",
-    "-t",
-    dash,
-    "status",
-    "off",
-    ";",
-    "attach",
-    "-t",
-    dash
-  ];
-}
-function buildClaudeStatusBarArgs(sessionName) {
-  const s = sessionName;
-  return [
-    // Server-global (no -t): primary prefix Ctrl+a (dashboard parity), keep
-    // tmux's default Ctrl+b as a secondary prefix so users with existing
-    // muscle memory / integrations aren't broken. `q` is the same key under
-    // both prefixes (single key table) -> Ctrl+a q AND Ctrl+b q both detach.
-    // `send-prefix` / `send-prefix -2` let a double-tap of either prefix
-    // reach Claude as that literal key.
-    ";",
-    "set",
-    "-g",
-    "prefix",
-    "C-a",
-    ";",
-    "set",
-    "-g",
-    "prefix2",
-    "C-b",
-    ";",
-    "bind-key",
-    "C-a",
-    "send-prefix",
-    ";",
-    "bind-key",
-    "C-b",
-    "send-prefix",
-    "-2",
-    ";",
-    "bind-key",
-    "q",
-    "detach-client",
-    // Hide the inner tmux status bar — the wrapped-pty footer (for
-    // `agentbox claude` / `agentbox shell`) and the dashboard's own status
-    // row already show the box name + detach hint; without `status off`
-    // they double up.
-    ";",
-    "set",
-    "-t",
-    s,
-    "status",
-    "off"
-  ];
-}
-function buildShellArgv(container) {
-  const term = process.env["TERM"] ?? "xterm-256color";
-  return ["exec", "-it", "-e", `TERM=${term}`, "--user", CONTAINER_USER, container, "bash", "-l"];
-}
-function formatDetachNotice(ref) {
-  return `Session detached. Reattach with: agentbox claude attach ${ref}`;
-}
-async function claudeSessionInfo(container, sessionName) {
-  const name = sessionName ?? DEFAULT_CLAUDE_SESSION;
-  const has = await execa(
-    "docker",
-    ["exec", "--user", CONTAINER_USER, container, "tmux", "has-session", "-t", name],
-    { reject: false }
-  );
-  if (has.exitCode !== 0) {
-    return { running: false, sessionName: name, startedAt: null };
-  }
-  const ts = await execa(
-    "docker",
-    [
-      "exec",
-      "--user",
-      CONTAINER_USER,
-      container,
-      "tmux",
-      "display-message",
-      "-p",
-      "-t",
-      name,
-      "#{session_created}"
-    ],
-    { reject: false }
-  );
-  let startedAt = null;
-  if (ts.exitCode === 0) {
-    const secs = Number.parseInt((ts.stdout ?? "").trim(), 10);
-    if (Number.isFinite(secs) && secs > 0) startedAt = new Date(secs * 1e3).toISOString();
-  }
-  return { running: true, sessionName: name, startedAt };
-}
-var PULL_DIR_CATEGORIES = ["skills", "agents", "commands"];
-async function listChildDirs(dir) {
-  try {
-    const entries = await readdir(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => e.name);
-  } catch {
-    return [];
-  }
-}
-async function readJsonFile(path) {
-  try {
-    return JSON.parse(await readFile(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-async function pullClaudeExtras(spec, opts) {
-  const hostHome = homedir();
-  const hostClaude = join(hostHome, ".claude");
-  const inventoryScript = [
-    "for cat in skills agents commands; do",
-    '  [ -d "/src/$cat" ] || continue;',
-    '  for d in "/src/$cat"/*/; do',
-    '    [ -d "$d" ] || continue;',
-    '    printf "DIR %s %s\\n" "$cat" "$(basename "$d")";',
-    "  done;",
-    "done;",
-    "if [ -d /src/plugins/cache ]; then",
-    "  for m in /src/plugins/cache/*/; do",
-    '    [ -d "$m" ] || continue;',
-    '    for p in "$m"*/; do',
-    '      [ -d "$p" ] || continue;',
-    '      printf "PLUGIN %s/%s\\n" "$(basename "$m")" "$(basename "$p")";',
-    "    done;",
-    "  done;",
-    "fi;",
-    "for f in installed_plugins known_marketplaces; do",
-    '  [ -f "/src/plugins/$f.json" ] || continue;',
-    '  printf "JSON %s " "$f";',
-    '  base64 -w0 "/src/plugins/$f.json";',
-    '  printf "\\n";',
-    "done"
-  ].join(" ");
-  const inv = await execa(
-    "docker",
-    ["run", "--rm", "--user", "0", "-v", `${spec.volume}:/src:ro`, opts.image, "sh", "-c", inventoryScript],
-    { reject: false }
-  );
-  if (inv.exitCode !== 0) {
-    throw new ClaudeSessionError(
-      `failed to read claude-config volume ${spec.volume}: ${(inv.stderr ?? "").toString().trim() || `exit ${String(inv.exitCode)}`}`
-    );
-  }
-  const boxDirs = { skills: [], agents: [], commands: [] };
-  const boxPlugins = [];
-  const boxJson = {};
-  for (const line of (inv.stdout ?? "").split("\n")) {
-    if (line.startsWith("DIR ")) {
-      const rest = line.slice(4);
-      const sp = rest.indexOf(" ");
-      if (sp === -1) continue;
-      const cat = rest.slice(0, sp);
-      const name = rest.slice(sp + 1);
-      if (cat in boxDirs) boxDirs[cat].push(name);
-    } else if (line.startsWith("PLUGIN ")) {
-      boxPlugins.push(line.slice(7));
-    } else if (line.startsWith("JSON ")) {
-      const rest = line.slice(5);
-      const sp = rest.indexOf(" ");
-      if (sp === -1) continue;
-      const which = rest.slice(0, sp);
-      try {
-        boxJson[which] = JSON.parse(Buffer.from(rest.slice(sp + 1), "base64").toString("utf8"));
-      } catch {
-      }
-    }
-  }
-  const newItems = [];
-  const applyPaths = [];
-  for (const cat of PULL_DIR_CATEGORIES) {
-    const hostNames = await listChildDirs(join(hostClaude, cat));
-    const excludes = cat === "skills" ? SKILL_EXCLUDE_PREFIXES : [];
-    for (const name of pickNewItems(boxDirs[cat] ?? [], hostNames, excludes)) {
-      newItems.push({ category: cat, name });
-      applyPaths.push({ src: `/src/${cat}/${name}`, dest: `/dst/${cat}/${name}` });
-    }
-  }
-  const hostPluginKeys = [];
-  for (const m of await listChildDirs(join(hostClaude, "plugins", "cache"))) {
-    for (const p of await listChildDirs(join(hostClaude, "plugins", "cache", m))) {
-      hostPluginKeys.push(`${m}/${p}`);
-    }
-  }
-  for (const key of pickNewItems(boxPlugins, hostPluginKeys)) {
-    newItems.push({ category: "plugins", name: key });
-    applyPaths.push({ src: `/src/plugins/cache/${key}`, dest: `/dst/plugins/cache/${key}` });
-  }
-  const hostInstalled = await readJsonFile(join(hostClaude, "plugins", "installed_plugins.json"));
-  const hostMarkets = await readJsonFile(join(hostClaude, "plugins", "known_marketplaces.json"));
-  const mergedInstalled = mergeInstalledPlugins(hostInstalled, boxJson["installed_plugins"], {
-    hostHome
-  });
-  const mergedMarkets = mergeKnownMarketplaces(hostMarkets, boxJson["known_marketplaces"], {
-    hostHome
-  });
-  const mergedRegistries = [];
-  if (mergedInstalled.changed) mergedRegistries.push("installed_plugins.json");
-  if (mergedMarkets.changed) mergedRegistries.push("known_marketplaces.json");
-  if (opts.dryRun || newItems.length === 0 && mergedRegistries.length === 0) {
-    return { newItems, mergedRegistries };
-  }
-  if (applyPaths.length > 0) {
-    const cmds = applyPaths.map(({ src, dest }) => {
-      const parent = dest.slice(0, dest.lastIndexOf("/"));
-      return `mkdir -p '${parent}' && rsync -a --ignore-existing --exclude=node_modules '${src}/' '${dest}/'`;
-    });
-    const apply = await execa(
-      "docker",
-      [
-        "run",
-        "--rm",
-        "--user",
-        "0",
-        "-v",
-        `${spec.volume}:/src:ro`,
-        "-v",
-        `${hostClaude}:/dst`,
-        opts.image,
-        "sh",
-        "-c",
-        cmds.join(" && ")
-      ],
-      { reject: false }
-    );
-    if (apply.exitCode !== 0) {
-      throw new ClaudeSessionError(
-        `failed to copy extensions from ${spec.volume}: ${(apply.stderr ?? "").toString().trim() || `exit ${String(apply.exitCode)}`}`
-      );
-    }
-  }
-  if (mergedMarkets.changed || mergedInstalled.changed) {
-    await mkdir(join(hostClaude, "plugins"), { recursive: true });
-    if (mergedMarkets.changed) {
-      await writeFile(
-        join(hostClaude, "plugins", "known_marketplaces.json"),
-        `${JSON.stringify(mergedMarkets.data, null, 2)}
-`
-      );
-    }
-    if (mergedInstalled.changed) {
-      await writeFile(
-        join(hostClaude, "plugins", "installed_plugins.json"),
-        `${JSON.stringify(mergedInstalled.data, null, 2)}
-`
-      );
-    }
-  }
-  return { newItems, mergedRegistries };
-}
-var SHARED_DOCKER_CACHE_VOLUME = "agentbox-docker-cache";
-function dockerVolumeName(boxId, shared) {
-  return shared ? SHARED_DOCKER_CACHE_VOLUME : `agentbox-docker-${boxId}`;
-}
-async function launchDockerdDaemon(container, timeoutMs = 3e4) {
-  const result = await execInBox(container, ["/usr/local/bin/agentbox-dockerd-start"], {
-    user: "root",
-    detach: true
-  });
-  if (result.exitCode !== 0) {
-    return { up: false, reason: `docker exec failed: ${result.stderr || result.stdout}` };
-  }
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const probe = await execInBox(
-      container,
-      [
-        "bash",
-        "-lc",
-        "[ -S /var/run/docker.sock ] && docker -H unix:///var/run/docker.sock info >/dev/null 2>&1"
-      ],
-      { user: "root" }
-    );
-    if (probe.exitCode === 0) return { up: true };
-    await new Promise((r) => setTimeout(r, 200));
-  }
-  return { up: false, reason: `dockerd did not become ready within ${String(timeoutMs)}ms` };
-}
-async function launchVncDaemon(container, timeoutMs = 5e3) {
-  const result = await execInBox(container, ["/usr/local/bin/agentbox-vnc-start"], {
-    user: "vscode",
-    detach: true
-  });
-  if (result.exitCode !== 0) {
-    return { up: false, reason: `docker exec failed: ${result.stderr || result.stdout}` };
-  }
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const probe = await execInBox(
-      container,
-      ["bash", "-lc", "(echo > /dev/tcp/127.0.0.1/6080) 2>/dev/null"],
-      { user: "vscode" }
-    );
-    if (probe.exitCode === 0) return { up: true };
-    await new Promise((r) => setTimeout(r, 150));
-  }
-  return { up: false, reason: `websockify did not bind 6080 within ${String(timeoutMs)}ms` };
-}
-var VNC_PASSWORD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-function generateVncPassword() {
-  const bytes = randomBytes(8);
-  let out = "";
-  for (let i = 0; i < 8; i++) {
-    out += VNC_PASSWORD_ALPHABET[bytes[i] % VNC_PASSWORD_ALPHABET.length];
-  }
-  return out;
-}
-var VNC_CONTAINER_PORT = 6080;
-function buildVncUrls(record, engine) {
-  if (!record.vncEnabled || !record.vncPassword) return {};
-  const containerPort = record.vncContainerPort ?? VNC_CONTAINER_PORT;
-  const qs = `autoconnect=1&password=${encodeURIComponent(record.vncPassword)}`;
-  const urls = {};
-  if (engine === "orbstack") {
-    urls.orbUrl = `http://${record.container}.orb.local:${String(containerPort)}/vnc.html?${qs}`;
-  }
-  if (record.vncHostPort) {
-    urls.loopbackUrl = `http://127.0.0.1:${String(record.vncHostPort)}/vnc.html?${qs}`;
-  }
-  return urls;
-}
-var WEB_CONTAINER_PORT = 80;
-async function detectGitRepos(workspace) {
-  const out = [];
-  if (await isGitDir(join2(workspace, ".git"))) {
-    out.push({ kind: "root", hostMainRepo: workspace, relPathFromWorkspace: "" });
-  }
-  let entries;
-  try {
-    entries = await readdir2(workspace, { withFileTypes: true });
-  } catch {
-    return out;
-  }
-  for (const e of entries) {
-    if (!e.isDirectory() || e.name.startsWith(".")) continue;
-    const sub = join2(workspace, e.name);
-    if (await isGitDir(join2(sub, ".git"))) {
-      out.push({ kind: "nested", hostMainRepo: sub, relPathFromWorkspace: e.name });
-    }
-  }
-  return out;
-}
-async function isGitDir(path) {
-  try {
-    const s = await stat2(path);
-    return s.isDirectory();
-  } catch {
-    return false;
-  }
-}
-async function pickFreshBranch(hostMainRepo, base) {
-  let candidate = base;
-  let suffix = 2;
-  while (await branchExists(hostMainRepo, candidate)) {
-    candidate = `${base}-${String(suffix++)}`;
-    if (suffix > 100) throw new GitWorktreeError(`could not find a free branch name near ${base}`);
-  }
-  return candidate;
-}
-async function branchExists(hostMainRepo, name) {
-  const result = await execa2(
-    "git",
-    ["-C", hostMainRepo, "show-ref", "--verify", "--quiet", `refs/heads/${name}`],
-    { reject: false }
-  );
-  return result.exitCode === 0;
-}
-var GitWorktreeError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GitWorktreeError";
-  }
-};
-var WORKTREE_ROOT = "/home/vscode/.agentbox-worktrees";
-function fsSafeBranch(branch) {
-  return branch.replace(/[^A-Za-z0-9._-]+/g, "_");
-}
-function gitWorktreePathFor(branch) {
-  return `${WORKTREE_ROOT}/${fsSafeBranch(branch)}`;
-}
-async function collectRepoCarryOver(repo, branch, containerPath, gitWorktreePath) {
-  const stash = await execa3("git", ["-C", repo.hostMainRepo, "stash", "create"], { reject: false });
-  const stashSha = stash.exitCode === 0 ? stash.stdout.trim() || null : null;
-  const untracked = await execa3(
-    "git",
-    ["-C", repo.hostMainRepo, "ls-files", "--others", "--exclude-standard", "-z"],
-    { reject: false }
-  );
-  const untrackedNul = untracked.exitCode === 0 ? untracked.stdout : "";
-  return {
-    repo,
-    containerPath,
-    gitWorktreePath,
-    branch,
-    stashSha,
-    untrackedNul,
-    hostSource: repo.hostMainRepo
-  };
-}
-async function dexec(container, argv, user = "vscode", cwd = "/") {
-  const r = await execa3(
-    "docker",
-    ["exec", "-w", cwd, "--user", user, container, ...argv],
-    { reject: false }
-  );
-  if (r.exitCode !== 0) {
-    throw new GitWorktreeError(`${argv.join(" ")} failed: ${r.stderr || r.stdout}`);
-  }
-}
-async function chownGitBindParents(args) {
-  const log = args.onLog ?? (() => {
-  });
-  const repos = Array.from(new Set(args.hostMainRepos));
-  for (const repo of repos) {
-    const result = await execInBox(args.container, ["chown", "vscode:vscode", repo], {
-      user: "root"
-    });
-    if (result.exitCode === 0) {
-      log(`chowned ${repo} to vscode:vscode (parent of bind-mounted .git)`);
-    } else {
-      const msg = (result.stderr || result.stdout || `exit ${result.exitCode}`).trim();
-      log(`chown ${repo} failed (best-effort, ignoring): ${msg}`);
-    }
-  }
-}
-async function bindWorktrees(container, binds, onLog) {
-  const log = onLog ?? (() => {
-  });
-  const ordered = [...binds].sort(
-    (a, b) => a.kind === "root" && b.kind !== "root" ? -1 : a.kind !== "root" && b.kind === "root" ? 1 : 0
-  );
-  for (const b of ordered) {
-    await execa3(
-      "docker",
-      ["exec", "-w", "/", "--user", "root", container, "sh", "-c", `mountpoint -q ${b.containerPath} && umount ${b.containerPath} || true`],
-      { reject: false }
-    );
-    if (b.kind === "nested") {
-      await dexec(container, ["mkdir", "-p", ctParent(b.containerPath)], "root");
-      await dexec(container, ["mkdir", "-p", b.containerPath], "root");
-    }
-    await dexec(container, ["mount", "--bind", b.gitWorktreePath, b.containerPath], "root");
-    log(`bind-mounted ${b.containerPath} <- ${b.gitWorktreePath}`);
-  }
-}
-async function seedWorkspace(opts) {
-  const log = opts.onLog ?? (() => {
-  });
-  await dexec(opts.container, ["mkdir", "-p", WORKTREE_ROOT]);
-  for (const r of opts.repos) {
-    const main = r.repo.hostMainRepo;
-    const wt = r.gitWorktreePath;
-    const add = await execa3(
-      "docker",
-      [
-        "exec",
-        "--user",
-        "vscode",
-        opts.container,
-        "git",
-        "-C",
-        main,
-        "worktree",
-        "add",
-        "-b",
-        r.branch,
-        wt,
-        "HEAD"
-      ],
-      { reject: false }
-    );
-    if (add.exitCode !== 0) {
-      throw new GitWorktreeError(
-        `git worktree add ${wt} (branch ${r.branch}) failed: ${add.stderr || add.stdout}`
-      );
-    }
-    log(`worktree ${wt} on branch ${r.branch} (host main ${main})`);
-    await execa3(
-      "docker",
-      [
-        "exec",
-        "--user",
-        "vscode",
-        opts.container,
-        "git",
-        "-C",
-        main,
-        "config",
-        "extensions.worktreeConfig",
-        "true"
-      ],
-      { reject: false }
-    );
-    await execa3(
-      "docker",
-      [
-        "exec",
-        "--user",
-        "vscode",
-        opts.container,
-        "git",
-        "-C",
-        wt,
-        "config",
-        "--worktree",
-        "commit.gpgsign",
-        "false"
-      ],
-      { reject: false }
-    );
-  }
-  await bindWorktrees(
-    opts.container,
-    opts.repos.map((r) => ({
-      kind: r.repo.kind,
-      containerPath: r.containerPath,
-      gitWorktreePath: r.gitWorktreePath
-    })),
-    log
-  );
-  for (const r of opts.repos) {
-    const ct = r.containerPath;
-    if (r.stashSha) {
-      const withIndex = await execa3(
-        "docker",
-        [
-          "exec",
-          "--user",
-          "vscode",
-          opts.container,
-          "git",
-          "-C",
-          ct,
-          "stash",
-          "apply",
-          "--index",
-          r.stashSha
-        ],
-        { reject: false }
-      );
-      if (withIndex.exitCode !== 0) {
-        const noIndex = await execa3(
-          "docker",
-          [
-            "exec",
-            "--user",
-            "vscode",
-            opts.container,
-            "git",
-            "-C",
-            ct,
-            "stash",
-            "apply",
-            r.stashSha
-          ],
-          { reject: false }
-        );
-        if (noIndex.exitCode !== 0) {
-          log(
-            `warning: stash apply failed in ${ct} (${withIndex.stderr || withIndex.stdout || "no message"})`
-          );
-        } else {
-          log(`applied tracked changes (without index \u2014 staged state lost) in ${ct}`);
-        }
-      } else {
-        log(`applied tracked changes from host main into ${ct}`);
-      }
-    }
-    if (r.untrackedNul.length > 0) {
-      const tarOut = await execa3("tar", ["-C", r.hostSource, "--null", "-T", "-", "-cf", "-"], {
-        input: r.untrackedNul.replace(/\0$/, ""),
-        encoding: "buffer",
-        reject: false
-      });
-      if (tarOut.exitCode !== 0) {
-        log(`warning: tar of untracked files for ${r.repo.hostMainRepo} failed: ${tarOut.stderr}`);
-        continue;
-      }
-      const tarIn = await execa3(
-        "docker",
-        ["exec", "-i", "--user", "vscode", opts.container, "tar", "-C", ct, "-xf", "-"],
-        { input: tarOut.stdout, reject: false }
-      );
-      if (tarIn.exitCode !== 0) {
-        log(`warning: untracked-file copy into ${ct} failed: ${tarIn.stderr}`);
-      } else {
-        const count = r.untrackedNul.split("\0").filter((s) => s.length > 0).length;
-        log(`copied ${String(count)} untracked file(s) into ${ct}`);
-      }
-    }
-  }
-}
-async function seedWorkspaceFromDir(opts) {
-  const log = opts.onLog ?? (() => {
-  });
-  const tarOut = await execa3("tar", ["-C", opts.hostSource, "-cf", "-", "."], {
-    encoding: "buffer",
-    reject: false
-  });
-  if (tarOut.exitCode !== 0) {
-    throw new GitWorktreeError(`tar of ${opts.hostSource} failed: ${tarOut.stderr}`);
-  }
-  const tarIn = await execa3(
-    "docker",
-    ["exec", "-i", "--user", "1000:1000", opts.container, "tar", "-C", "/workspace", "-xf", "-"],
-    { input: tarOut.stdout, reject: false }
-  );
-  if (tarIn.exitCode !== 0) {
-    throw new GitWorktreeError(`tar extract into /workspace failed: ${tarIn.stderr}`);
-  }
-  log(`seeded /workspace from ${opts.hostSource}`);
-}
-async function removeInBoxWorktree(args) {
-  const remove = await execa3(
-    "git",
-    ["-C", args.hostMainRepo, "worktree", "remove", "--force", args.gitWorktreePath],
-    { reject: false }
-  );
-  if (remove.exitCode === 0) return;
-  await execa3("git", ["-C", args.hostMainRepo, "worktree", "prune"], { reject: false });
-}
-function ctParent(p) {
-  const i = p.lastIndexOf("/");
-  return i <= 0 ? "/" : p.slice(0, i);
-}
-var EXCLUDE_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".next",
-  ".nuxt",
-  ".turbo",
-  ".svelte-kit",
-  "dist",
-  "build",
-  "out",
-  "target",
-  ".venv",
-  "__pycache__",
-  ".cache",
-  ".parcel-cache"
-]);
-var SNAPSHOTS_ROOT = join3(homedir2(), ".agentbox", "snapshots");
-function snapshotPathFor(box) {
-  const mnemonic = sanitizeMnemonic(box.name);
-  const n = box.projectIndex;
-  const segment = typeof n === "number" && Number.isFinite(n) && n > 0 ? `${box.id}-${String(n)}-${mnemonic}` : `${box.id}-${mnemonic}`;
-  return join3(SNAPSHOTS_ROOT, segment);
-}
-async function findExcludedDirs(root, excluded = EXCLUDE_DIRS) {
-  const matches = [];
-  const walk = async (dir) => {
-    let entries;
-    try {
-      entries = await readdir3(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const abs = join3(dir, entry.name);
-      if (excluded.has(entry.name)) {
-        matches.push(abs);
-        continue;
-      }
-      await walk(abs);
-    }
-  };
-  await walk(root);
-  return matches;
-}
-async function createSnapshot(opts) {
-  const source = resolve(opts.source);
-  const destination = resolve(opts.destination);
-  const excluded = opts.excluded ?? EXCLUDE_DIRS;
-  await mkdir2(SNAPSHOTS_ROOT, { recursive: true });
-  const cpArgs = platform() === "darwin" ? ["-cR"] : ["-R"];
-  await execa4("cp", [...cpArgs, `${source}/`, destination]);
-  const toPrune = await findExcludedDirs(destination, excluded);
-  await Promise.all(toPrune.map((p) => rm2(p, { recursive: true, force: true })));
-  return { destination, prunedPaths: toPrune };
-}
-async function launchCtlDaemon(container, hostSocketPath, timeoutMs = 3e3) {
-  const result = await execInBox(container, ["agentbox-ctl", "daemon"], {
-    user: "vscode",
-    detach: true
-  });
-  if (result.exitCode !== 0) {
-    return { up: false, reason: `docker exec failed: ${result.stderr || result.stdout}` };
-  }
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (await pathExists2(hostSocketPath)) return { up: true };
-    await new Promise((r) => setTimeout(r, 100));
-  }
-  return {
-    up: false,
-    reason: `socket ${hostSocketPath} did not appear within ${String(timeoutMs)}ms`
-  };
-}
-async function pathExists2(p) {
-  try {
-    await stat4(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-var STATE_DIR = join4(homedir3(), ".agentbox");
-var PID_FILE = join4(STATE_DIR, "relay.pid");
-var LOG_FILE = join4(STATE_DIR, "relay.log");
-var PORT = DEFAULT_RELAY_PORT;
-var ENDPOINT = {
-  // host.docker.internal is the Docker Desktop / OrbStack-supplied alias for
-  // the host's loopback as seen from inside a container. The corresponding
-  // `--add-host=host.docker.internal:host-gateway` flag in runBox makes the
-  // resolution work on Linux native Docker too.
-  url: `http://host.docker.internal:${String(PORT)}`,
-  hostUrl: `http://127.0.0.1:${String(PORT)}`,
-  port: PORT
-};
-async function ensureRelay(opts = {}) {
-  const log = opts.onLog ?? (() => {
-  });
-  await mkdir3(STATE_DIR, { recursive: true });
-  if (await containerExists(RELAY_CONTAINER_NAME)) {
-    await removeContainer(RELAY_CONTAINER_NAME);
-    log(`removed legacy relay container ${RELAY_CONTAINER_NAME}`);
-  }
-  if (await pingHealthz(500)) {
-    return ENDPOINT;
-  }
-  const existingPid = await readPidFile();
-  if (existingPid !== null && await processAlive(existingPid)) {
-    for (let i = 0; i < 10; i++) {
-      if (await pingHealthz(300)) return ENDPOINT;
-      await delay(200);
-    }
-    log(`relay pid ${String(existingPid)} alive but /healthz unresponsive \u2014 proceeding anyway`);
-    return ENDPOINT;
-  }
-  if (existingPid !== null) {
-    await unlink(PID_FILE).catch(() => {
-    });
-  }
-  const relayBin = resolveRelayBin();
-  const logFd = openSync(LOG_FILE, "a");
-  const cliEntry = resolveCliEntry();
-  const child = spawn(
-    process.execPath,
-    [relayBin, "serve", "--port", String(PORT), "--host", "0.0.0.0"],
-    {
-      detached: true,
-      stdio: ["ignore", logFd, logFd],
-      env: {
-        ...process.env,
-        ...cliEntry ? { AGENTBOX_CLI_ENTRY: cliEntry } : {}
-      }
-    }
-  );
-  child.unref();
-  if (typeof child.pid === "number") {
-    await writeFile2(PID_FILE, String(child.pid), "utf8");
-    log(`spawned relay host process (pid ${String(child.pid)}, port ${String(PORT)})`);
-  }
-  for (let i = 0; i < 25; i++) {
-    if (await pingHealthz(300)) {
-      log(`relay reachable on ${ENDPOINT.hostUrl}`);
-      return ENDPOINT;
-    }
-    await delay(200);
-  }
-  throw new Error(
-    `relay did not become reachable on ${ENDPOINT.hostUrl} within 5s; see ${LOG_FILE}`
-  );
-}
-function resolveRelayBin() {
-  const override = process.env.AGENTBOX_RELAY_BIN;
-  if (override && existsSync(override)) return override;
-  const here = dirname(fileURLToPath(import.meta.url));
-  const candidates = [
-    resolve2(here, "..", "runtime", "relay", "bin.cjs"),
-    resolve2(here, "..", "..", "relay", "dist", "bin.cjs"),
-    resolve2(here, "..", "..", "..", "@agentbox", "relay", "dist", "bin.cjs"),
-    resolve2(here, "..", "..", "node_modules", "@agentbox", "relay", "dist", "bin.cjs")
-  ];
-  for (const c of candidates) {
-    if (existsSync(c)) return c;
-  }
-  throw new Error(
-    `could not locate @agentbox/relay bin; tried:
-  ${candidates.join("\n  ")}`
-  );
-}
-function resolveCliEntry() {
-  const override = process.env.AGENTBOX_CLI_ENTRY;
-  if (override && existsSync(override)) return override;
-  const here = dirname(fileURLToPath(import.meta.url));
-  const candidates = [
-    // Bundled CLI (dev + published): this module IS bundled into the CLI
-    // entry, so the entry is index.js next to this file.
-    resolve2(here, "index.js"),
-    resolve2(here, "..", "..", "..", "apps", "cli", "dist", "index.js"),
-    resolve2(here, "..", "..", "..", "..", "dist", "index.js")
-  ];
-  for (const c of candidates) {
-    if (existsSync(c)) return c;
-  }
-  return null;
-}
-async function stopRelay() {
-  const pid = await readPidFile();
-  if (pid === null) {
-    return { stopped: false, pid: null };
-  }
-  if (!await processAlive(pid)) {
-    await unlink(PID_FILE).catch(() => {
-    });
-    return { stopped: false, pid };
-  }
-  try {
-    process.kill(pid, "SIGTERM");
-  } catch {
-  }
-  for (let i = 0; i < 20; i++) {
-    if (!await processAlive(pid)) break;
-    await delay(100);
-  }
-  if (await processAlive(pid)) {
-    try {
-      process.kill(pid, "SIGKILL");
-    } catch {
-    }
-  }
-  await unlink(PID_FILE).catch(() => {
-  });
-  return { stopped: true, pid };
-}
-async function getRelayStatus() {
-  const pid = await readPidFile();
-  const pidAlive = pid !== null && await processAlive(pid);
-  const health = await fetchHealthz(300);
-  return {
-    running: health !== null,
-    pid,
-    pidAlive,
-    port: PORT,
-    endpoint: ENDPOINT,
-    health: health === null ? null : { boxes: health.boxes, events: health.events },
-    pidFile: PID_FILE,
-    logFile: LOG_FILE
-  };
-}
-function pingHealthz(timeoutMs) {
-  return new Promise((resolveP) => {
-    const req = httpRequest(
-      { host: "127.0.0.1", port: PORT, method: "GET", path: "/healthz", timeout: timeoutMs },
-      (res) => {
-        res.resume();
-        const status = res.statusCode ?? 0;
-        resolveP(status >= 200 && status < 300);
-      }
-    );
-    req.on("error", () => resolveP(false));
-    req.on("timeout", () => {
-      req.destroy();
-      resolveP(false);
-    });
-    req.end();
-  });
-}
-function fetchHealthz(timeoutMs) {
-  return new Promise((resolveP) => {
-    const req = httpRequest(
-      { host: "127.0.0.1", port: PORT, method: "GET", path: "/healthz", timeout: timeoutMs },
-      (res) => {
-        const status = res.statusCode ?? 0;
-        if (status < 200 || status >= 300) {
-          res.resume();
-          resolveP(null);
-          return;
-        }
-        const chunks = [];
-        res.on("data", (c) => chunks.push(c));
-        res.on("end", () => {
-          try {
-            const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-            if (typeof parsed.ok === "boolean" && typeof parsed.boxes === "number" && typeof parsed.events === "number") {
-              resolveP({ ok: parsed.ok, boxes: parsed.boxes, events: parsed.events });
-            } else {
-              resolveP(null);
-            }
-          } catch {
-            resolveP(null);
-          }
-        });
-        res.on("error", () => resolveP(null));
-      }
-    );
-    req.on("error", () => resolveP(null));
-    req.on("timeout", () => {
-      req.destroy();
-      resolveP(null);
-    });
-    req.end();
-  });
-}
-async function readPidFile() {
-  try {
-    const text = await readFile2(PID_FILE, "utf8");
-    const pid = Number.parseInt(text.trim(), 10);
-    return Number.isFinite(pid) && pid > 0 ? pid : null;
-  } catch {
-    return null;
-  }
-}
-async function processAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function generateRelayToken() {
-  return randomBytes2(32).toString("hex");
-}
-async function registerBoxWithRelay(args) {
-  const worktrees = (args.worktrees ?? []).map((w) => ({
-    containerPath: w.containerPath,
-    hostMainRepo: w.hostMainRepo,
-    branch: w.branch
-  }));
-  await adminPost("/admin/register-box", {
-    boxId: args.boxId,
-    token: args.token,
-    name: args.name,
-    containerName: args.containerName,
-    createdAt: args.createdAt,
-    projectIndex: args.projectIndex,
-    worktrees
-  });
-}
-async function forgetBoxFromRelay(boxId) {
-  try {
-    await adminPost("/admin/forget-box", { boxId });
-  } catch {
-  }
-}
-async function adminPost(path, body) {
-  const json = JSON.stringify(body);
-  await new Promise((resolveP, rejectP) => {
-    const req = httpRequest(
-      {
-        host: "127.0.0.1",
-        port: PORT,
-        method: "POST",
-        path,
-        headers: {
-          "Content-Type": "application/json",
-          "Content-Length": Buffer.byteLength(json).toString()
-        },
-        timeout: 3e3
-      },
-      (res) => {
-        const chunks = [];
-        res.on("data", (c) => chunks.push(c));
-        res.on("end", () => {
-          const status = res.statusCode ?? 0;
-          if (status >= 200 && status < 300) {
-            resolveP();
-          } else {
-            const text = Buffer.concat(chunks).toString("utf8");
-            rejectP(new Error(`relay ${path} \u2192 ${String(status)}: ${text}`));
-          }
-        });
-      }
-    );
-    req.on("error", rejectP);
-    req.on("timeout", () => {
-      req.destroy();
-      rejectP(new Error(`relay ${path} timeout`));
-    });
-    req.write(json);
-    req.end();
-  });
-}
-async function rehydrateRelayRegistry(boxes) {
-  for (const b of boxes) {
-    if (!b.relayToken) continue;
-    try {
-      await registerBoxWithRelay({
-        boxId: b.id,
-        token: b.relayToken,
-        name: b.name,
-        containerName: b.container,
-        createdAt: b.createdAt,
-        projectIndex: b.projectIndex,
-        worktrees: b.gitWorktrees
-      });
-    } catch {
-    }
-  }
-}
-var PROFILES = {
-  vscode: {
-    serverDir: "/home/vscode/.vscode-server",
-    extensionsDir: "/home/vscode/.vscode-server/extensions",
-    perBoxVolumePrefix: "agentbox-vscode-server-",
-    sharedExtensionsVolume: "agentbox-vscode-extensions",
-    cli: "code",
-    displayName: "VS Code",
-    protocolScheme: "vscode"
-  },
-  cursor: {
-    serverDir: "/home/vscode/.cursor-server",
-    extensionsDir: "/home/vscode/.cursor-server/extensions",
-    perBoxVolumePrefix: "agentbox-cursor-server-",
-    sharedExtensionsVolume: "agentbox-cursor-extensions",
-    cli: "cursor",
-    displayName: "Cursor",
-    protocolScheme: "cursor"
-  }
-};
-var IDE_FLAVORS = ["vscode", "cursor"];
-function ideProfile(flavor) {
-  return PROFILES[flavor];
-}
-var SHARED_VSCODE_EXTENSIONS_VOLUME = PROFILES.vscode.sharedExtensionsVolume;
-var SHARED_CURSOR_EXTENSIONS_VOLUME = PROFILES.cursor.sharedExtensionsVolume;
-function vscodeServerVolumeName(boxId) {
-  return ideServerVolumeName("vscode", boxId);
-}
-function cursorServerVolumeName(boxId) {
-  return ideServerVolumeName("cursor", boxId);
-}
-function ideServerVolumeName(flavor, boxId) {
-  return `${PROFILES[flavor].perBoxVolumePrefix}${boxId}`;
-}
-function buildFlavorMounts(flavor, boxId) {
-  const profile = PROFILES[flavor];
-  const perBox = ideServerVolumeName(flavor, boxId);
-  return {
-    volumes: [perBox, profile.sharedExtensionsVolume],
-    extraVolumes: [
-      `${perBox}:${profile.serverDir}`,
-      `${profile.sharedExtensionsVolume}:${profile.extensionsDir}`
-    ]
-  };
-}
-function buildIdeMounts(boxId) {
-  const merged = { volumes: [], extraVolumes: [] };
-  for (const f of IDE_FLAVORS) {
-    const m = buildFlavorMounts(f, boxId);
-    merged.volumes.push(...m.volumes);
-    merged.extraVolumes.push(...m.extraVolumes);
-  }
-  return merged;
-}
-async function ensureIdeVolumes(boxId) {
-  for (const v of buildIdeMounts(boxId).volumes) await ensureVolume(v);
-}
-async function repairIdeOwnership(container) {
-  for (const flavor of IDE_FLAVORS) {
-    await execInBox(container, ["chown", "-R", "vscode:vscode", PROFILES[flavor].serverDir], {
-      user: "root"
-    });
-  }
-}
-function containerHex(containerName) {
-  return Buffer.from(containerName, "utf8").toString("hex");
-}
-var SENTINEL = "// agentbox-managed: regenerated on `agentbox code`; remove this header to take ownership";
-async function ensureAgentboxTasksFile(container, services, opts = {}) {
-  if (services.length === 0) return { status: "skipped-no-services" };
-  const existing = await execInBox(container, ["cat", "/workspace/.vscode/tasks.json"], {
-    user: "vscode"
-  });
-  if (existing.exitCode === 0 && !opts.regen && !existing.stdout.includes(SENTINEL)) {
-    return { status: "skipped-user-owned" };
-  }
-  const tasks = services.map((s) => ({
-    label: `agentbox: ${s.name}`,
-    type: "shell",
-    command: `tail -F /var/log/agentbox/${s.name}.log`,
-    isBackground: true,
-    presentation: { panel: "dedicated", reveal: "always", echo: false },
-    runOptions: { runOn: "folderOpen" },
-    problemMatcher: []
-  }));
-  const body = `${SENTINEL}
-` + JSON.stringify(
-    {
-      version: "2.0.0",
-      tasks
-    },
-    null,
-    2
-  ) + "\n";
-  await execInBox(container, ["mkdir", "-p", "/workspace/.vscode"], { user: "vscode" });
-  const write = await writeFileInBox(container, "/workspace/.vscode/tasks.json", body);
-  if (write.exitCode !== 0) {
-    throw new Error(`failed to write tasks.json in ${container}: ${write.stderr || write.stdout}`);
-  }
-  return { status: "wrote" };
-}
-async function writeFileInBox(container, path, content) {
-  const { execa: execa5 } = await import("execa");
-  const result = await execa5(
-    "docker",
-    ["exec", "-i", "--user", "vscode", container, "sh", "-c", `cat > ${shellQuote(path)}`],
-    { input: content, reject: false }
-  );
-  return {
-    exitCode: result.exitCode ?? -1,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? ""
-  };
-}
-function shellQuote(s) {
-  return `'${s.replace(/'/g, `'\\''`)}'`;
-}
-
-// ../../packages/ctl/dist/index.js
-import { readFile as readFile3 } from "fs/promises";
-import { parse as parseYaml } from "yaml";
-function renderStatusTable(rows) {
-  if (rows.length === 0) return "(no services configured)";
-  const headers = ["NAME", "STATE", "PID", "RESTARTS", "LAST EXIT", "BLOCKED ON", "COMMAND"];
-  const data = rows.map((r) => [
-    r.name,
-    r.state,
-    r.pid === null ? "-" : String(r.pid),
-    String(r.restarts),
-    r.lastExitCode === null ? "-" : String(r.lastExitCode),
-    r.blockedOn.length === 0 ? "-" : r.blockedOn.join(","),
-    truncate(r.command, 40)
-  ]);
-  return renderTable(headers, data);
-}
-function renderTaskTable(rows) {
-  if (rows.length === 0) return "(no tasks configured)";
-  const headers = ["NAME", "STATE", "EXIT", "STARTED", "FINISHED", "COMMAND"];
-  const data = rows.map((r) => [
-    r.name,
-    r.state,
-    r.lastExitCode === null ? "-" : String(r.lastExitCode),
-    r.startedAt ?? "-",
-    r.finishedAt ?? "-",
-    truncate(r.command, 40)
-  ]);
-  return renderTable(headers, data);
-}
-function renderPortsTable(rows) {
-  if (rows.length === 0) return "(no ports listening)";
-  const named = rows.filter((r) => r.service);
-  const other = rows.filter((r) => !r.service).map((r) => r.port).sort((a, b) => a - b);
-  const lines = [];
-  if (named.length > 0) {
-    lines.push(
-      renderTable(
-        ["PORT", "SERVICE"],
-        named.map((r) => [`:${String(r.port)}`, r.service ?? "-"])
-      )
-    );
-  }
-  if (other.length > 0) {
-    lines.push(`other (${other.length}): ${other.join(", ")}`);
-  }
-  return lines.join("\n");
-}
-function renderTable(headers, data) {
-  const widths = headers.map(
-    (h, i) => Math.max(h.length, ...data.map((row) => (row[i] ?? "").length))
-  );
-  const fmt = (row) => row.map((cell, i) => cell.padEnd(widths[i] ?? cell.length)).join("  ");
-  return [fmt(headers), ...data.map(fmt)].join("\n");
-}
-function truncate(s, n) {
-  if (s.length <= n) return s;
-  return s.slice(0, n - 1) + "\u2026";
-}
-var DEFAULT_BACKOFF = {
-  initialMs: 500,
-  maxMs: 3e4,
-  factor: 2
-};
-var DEFAULT_PROBE_INTERVAL_MS = 500;
-var DEFAULT_PROBE_INITIAL_DELAY_MS = 0;
-var DEFAULT_PROBE_TIMEOUT_MS = 6e4;
-var DEFAULT_PROBE_HOST = "127.0.0.1";
-var DEFAULT_PROBE_ON_TIMEOUT = "kill";
-var ConfigError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ConfigError";
-  }
-};
-function isPlainObject2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function parseEnv(raw, where) {
-  if (raw === void 0 || raw === null) return void 0;
-  if (!isPlainObject2(raw)) {
-    throw new ConfigError(`${where}.env must be a mapping of string \u2192 string`);
-  }
-  const out = {};
-  for (const [k, v] of Object.entries(raw)) {
-    if (typeof v !== "string" && typeof v !== "number" && typeof v !== "boolean") {
-      throw new ConfigError(`${where}.env.${k} must be a scalar`);
-    }
-    out[k] = String(v);
-  }
-  return out;
-}
-function parseCommand(raw, where) {
-  if (typeof raw === "string") {
-    if (raw.trim().length === 0) {
-      throw new ConfigError(`${where}.command must not be empty`);
-    }
-    return raw;
-  }
-  if (Array.isArray(raw)) {
-    if (raw.length === 0) {
-      throw new ConfigError(`${where}.command array must not be empty`);
-    }
-    const argv = [];
-    for (const [i, item] of raw.entries()) {
-      if (typeof item !== "string") {
-        throw new ConfigError(`${where}.command[${String(i)}] must be a string`);
-      }
-      argv.push(item);
-    }
-    return argv;
-  }
-  throw new ConfigError(`${where}.command must be a string or array of strings`);
-}
-function parseRestart(raw, where) {
-  if (raw === void 0) return "on-failure";
-  if (raw === "always" || raw === "on-failure" || raw === "never") return raw;
-  throw new ConfigError(`${where}.restart must be one of: always, on-failure, never`);
-}
-var BACKOFF_KEYS = /* @__PURE__ */ new Set(["initial_ms", "max_ms", "factor"]);
-function parseBackoff(raw, where) {
-  if (raw === void 0) return { ...DEFAULT_BACKOFF };
-  if (!isPlainObject2(raw)) {
-    throw new ConfigError(`${where}.backoff must be a mapping`);
-  }
-  rejectUnknownKeys(raw, BACKOFF_KEYS, `${where}.backoff`);
-  const initialMs = parseNonNegativeInt(
-    raw.initial_ms,
-    `${where}.backoff.initial_ms`,
-    DEFAULT_BACKOFF.initialMs
-  );
-  const maxMs = parseNonNegativeInt(raw.max_ms, `${where}.backoff.max_ms`, DEFAULT_BACKOFF.maxMs);
-  const factor = parseFactor(raw.factor, `${where}.backoff.factor`, DEFAULT_BACKOFF.factor);
-  if (maxMs < initialMs) {
-    throw new ConfigError(`${where}.backoff.max_ms must be >= initial_ms`);
-  }
-  return { initialMs, maxMs, factor };
-}
-function rejectUnknownKeys(obj, allowed, where) {
-  for (const key of Object.keys(obj)) {
-    if (!allowed.has(key)) {
-      throw new ConfigError(`${where} has unknown key "${key}"`);
-    }
-  }
-}
-function parseNonNegativeInt(raw, where, fallback) {
-  if (raw === void 0) return fallback;
-  if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 0) {
-    throw new ConfigError(`${where} must be a non-negative number`);
-  }
-  return Math.floor(raw);
-}
-function parsePositiveInt(raw, where, fallback) {
-  if (raw === void 0) return fallback;
-  if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 1) {
-    throw new ConfigError(`${where} must be a positive integer`);
-  }
-  return Math.floor(raw);
-}
-function parseFactor(raw, where, fallback) {
-  if (raw === void 0) return fallback;
-  if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 1) {
-    throw new ConfigError(`${where} must be a number >= 1`);
-  }
-  return raw;
-}
-function parseOnTimeout(raw, where) {
-  if (raw === void 0) return DEFAULT_PROBE_ON_TIMEOUT;
-  if (raw === "kill" || raw === "mark_unhealthy") return raw;
-  throw new ConfigError(`${where} must be one of: kill, mark_unhealthy`);
-}
-function parseNeeds(raw, where) {
-  if (raw === void 0 || raw === null) return [];
-  if (!Array.isArray(raw)) {
-    throw new ConfigError(`${where} must be an array of unit names`);
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const [i, item] of raw.entries()) {
-    if (typeof item !== "string") {
-      throw new ConfigError(`${where}[${String(i)}] must be a string`);
-    }
-    if (!/^[A-Za-z0-9_-]+$/.test(item)) {
-      throw new ConfigError(`${where}[${String(i)}] "${item}" must match [A-Za-z0-9_-]+`);
-    }
-    if (seen.has(item)) continue;
-    seen.add(item);
-    out.push(item);
-  }
-  return out;
-}
-var PROBE_KEYS = /* @__PURE__ */ new Set([
-  "port",
-  "host",
-  "log_match",
-  "http",
-  "expect_status",
-  "interval_ms",
-  "initial_delay_ms",
-  "timeout_ms",
-  "on_timeout"
-]);
-function parseReadyWhen(raw, where) {
-  if (raw === void 0 || raw === null) return void 0;
-  if (!isPlainObject2(raw)) {
-    throw new ConfigError(`${where}.ready_when must be a mapping`);
-  }
-  rejectUnknownKeys(raw, PROBE_KEYS, `${where}.ready_when`);
-  const kinds = [];
-  if (raw.port !== void 0) kinds.push("port");
-  if (raw.log_match !== void 0) kinds.push("log_match");
-  if (raw.http !== void 0) kinds.push("http");
-  if (kinds.length === 0) {
-    throw new ConfigError(
-      `${where}.ready_when must declare exactly one of: port, log_match, http`
-    );
-  }
-  if (kinds.length > 1) {
-    throw new ConfigError(
-      `${where}.ready_when may declare only one of: port, log_match, http (got ${kinds.join(", ")})`
-    );
-  }
-  const timeoutMs = parsePositiveInt(
-    raw.timeout_ms,
-    `${where}.ready_when.timeout_ms`,
-    DEFAULT_PROBE_TIMEOUT_MS
-  );
-  const onTimeout = parseOnTimeout(raw.on_timeout, `${where}.ready_when.on_timeout`);
-  const kind = kinds[0];
-  if (kind === "log_match") {
-    if (raw.host !== void 0 || raw.expect_status !== void 0 || raw.interval_ms !== void 0 || raw.initial_delay_ms !== void 0) {
-      throw new ConfigError(
-        `${where}.ready_when.log_match cannot be combined with host/expect_status/interval_ms/initial_delay_ms`
-      );
-    }
-    const pat = assertString(raw.log_match, `${where}.ready_when.log_match`);
-    let pattern;
-    try {
-      pattern = new RegExp(pat);
-    } catch (err) {
-      throw new ConfigError(
-        `${where}.ready_when.log_match is not a valid regex: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-    return { kind: "log_match", pattern, timeoutMs, onTimeout };
-  }
-  const intervalMs = parsePositiveInt(
-    raw.interval_ms,
-    `${where}.ready_when.interval_ms`,
-    DEFAULT_PROBE_INTERVAL_MS
-  );
-  const initialDelayMs = parseNonNegativeInt(
-    raw.initial_delay_ms,
-    `${where}.ready_when.initial_delay_ms`,
-    DEFAULT_PROBE_INITIAL_DELAY_MS
-  );
-  if (kind === "port") {
-    if (raw.expect_status !== void 0) {
-      throw new ConfigError(`${where}.ready_when.expect_status only applies to http probes`);
-    }
-    const port = parsePositiveInt(raw.port, `${where}.ready_when.port`, 0);
-    if (port < 1 || port > 65535) {
-      throw new ConfigError(`${where}.ready_when.port must be between 1 and 65535`);
-    }
-    const host = raw.host === void 0 ? DEFAULT_PROBE_HOST : assertString(raw.host, `${where}.ready_when.host`);
-    return { kind: "port", port, host, intervalMs, initialDelayMs, timeoutMs, onTimeout };
-  }
-  if (raw.host !== void 0) {
-    throw new ConfigError(`${where}.ready_when.host only applies to port probes`);
-  }
-  const url = assertString(raw.http, `${where}.ready_when.http`);
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new ConfigError(`${where}.ready_when.http must be a valid URL`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new ConfigError(`${where}.ready_when.http must use http(s):// (got ${parsed.protocol})`);
-  }
-  let expectStatus;
-  if (raw.expect_status !== void 0) {
-    expectStatus = parsePositiveInt(raw.expect_status, `${where}.ready_when.expect_status`, 0);
-    if (expectStatus < 100 || expectStatus > 599) {
-      throw new ConfigError(`${where}.ready_when.expect_status must be between 100 and 599`);
-    }
-  }
-  return { kind: "http", url, expectStatus, intervalMs, initialDelayMs, timeoutMs, onTimeout };
-}
-var RESERVED_WEB_PORT = 80;
-var SERVICE_KEYS = /* @__PURE__ */ new Set([
-  "command",
-  "cwd",
-  "env",
-  "autostart",
-  "restart",
-  "backoff",
-  "needs",
-  "ready_when",
-  "expose",
-  "ide"
-]);
-var EXPOSE_KEYS = /* @__PURE__ */ new Set(["port", "as"]);
-function parseExpose(raw, where) {
-  if (raw === void 0 || raw === null) return void 0;
-  if (!isPlainObject2(raw)) {
-    throw new ConfigError(`${where}.expose must be a mapping`);
-  }
-  rejectUnknownKeys(raw, EXPOSE_KEYS, `${where}.expose`);
-  if (raw.port === void 0) {
-    throw new ConfigError(`${where}.expose.port is required`);
-  }
-  const port = parsePortNumber(raw.port, `${where}.expose.port`);
-  const as = raw.as === void 0 ? RESERVED_WEB_PORT : parsePortNumber(raw.as, `${where}.expose.as`);
-  if (as !== RESERVED_WEB_PORT) {
-    throw new ConfigError(
-      `${where}.expose.as must be ${String(RESERVED_WEB_PORT)} (the only container port AgentBox publishes)`
-    );
-  }
-  return { port, as };
-}
-function parsePortNumber(raw, where) {
-  if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 1 || raw > 65535) {
-    throw new ConfigError(`${where} must be an integer between 1 and 65535`);
-  }
-  return raw;
-}
-function parseService(name, raw) {
-  const where = `services.${name}`;
-  if (!isPlainObject2(raw)) {
-    throw new ConfigError(`${where} must be a mapping`);
-  }
-  rejectUnknownKeys(raw, SERVICE_KEYS, where);
-  const command = parseCommand(raw.command, where);
-  const cwd = raw.cwd === void 0 ? void 0 : assertString(raw.cwd, `${where}.cwd`);
-  const env = parseEnv(raw.env, where);
-  const autostart = raw.autostart === void 0 ? true : assertBool(raw.autostart, `${where}.autostart`);
-  const restart2 = parseRestart(raw.restart, where);
-  const backoff = parseBackoff(raw.backoff, where);
-  const needs = parseNeeds(raw.needs, `${where}.needs`);
-  const readyWhen = parseReadyWhen(raw.ready_when, where);
-  const expose = parseExpose(raw.expose, where);
-  return { name, command, cwd, env, autostart, restart: restart2, backoff, needs, readyWhen, expose };
-}
-var TASK_KEYS = /* @__PURE__ */ new Set(["command", "cwd", "env", "needs"]);
-function parseTask(name, raw) {
-  const where = `tasks.${name}`;
-  if (!isPlainObject2(raw)) {
-    throw new ConfigError(`${where} must be a mapping`);
-  }
-  rejectUnknownKeys(raw, TASK_KEYS, where);
-  const command = parseCommand(raw.command, where);
-  const cwd = raw.cwd === void 0 ? void 0 : assertString(raw.cwd, `${where}.cwd`);
-  const env = parseEnv(raw.env, where);
-  const needs = parseNeeds(raw.needs, `${where}.needs`);
-  return { name, command, cwd, env, needs };
-}
-function assertString(raw, where) {
-  if (typeof raw !== "string") throw new ConfigError(`${where} must be a string`);
-  return raw;
-}
-function assertBool(raw, where) {
-  if (typeof raw !== "boolean") throw new ConfigError(`${where} must be a boolean`);
-  return raw;
-}
-var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["services", "tasks", "ide", "defaults"]);
-function validateUnitGraph(tasks, services) {
-  const names = /* @__PURE__ */ new Set();
-  for (const t of tasks) {
-    if (names.has(t.name)) {
-      throw new ConfigError(`unit name "${t.name}" declared more than once (task vs service collision)`);
-    }
-    names.add(t.name);
-  }
-  for (const s of services) {
-    if (names.has(s.name)) {
-      throw new ConfigError(`unit name "${s.name}" declared more than once (task vs service collision)`);
-    }
-    names.add(s.name);
-  }
-  const deps = /* @__PURE__ */ new Map();
-  for (const t of tasks) deps.set(t.name, t.needs);
-  for (const s of services) deps.set(s.name, s.needs);
-  for (const [unit, list] of deps) {
-    for (const dep of list) {
-      if (!names.has(dep)) {
-        throw new ConfigError(`unit "${unit}" needs unknown unit "${dep}"`);
-      }
-      if (dep === unit) {
-        throw new ConfigError(`unit "${unit}" cannot depend on itself`);
-      }
-    }
-  }
-  const WHITE = 0, GRAY = 1, BLACK = 2;
-  const color = /* @__PURE__ */ new Map();
-  for (const name of deps.keys()) color.set(name, WHITE);
-  const stack = [];
-  function visit(name) {
-    color.set(name, GRAY);
-    stack.push(name);
-    for (const dep of deps.get(name)) {
-      const c = color.get(dep) ?? WHITE;
-      if (c === GRAY) {
-        const startIdx = stack.indexOf(dep);
-        const cycle = stack.slice(startIdx).concat(dep).join(" \u2192 ");
-        throw new ConfigError(`cyclic dependency: ${cycle}`);
-      }
-      if (c === WHITE) visit(dep);
-    }
-    stack.pop();
-    color.set(name, BLACK);
-  }
-  for (const name of deps.keys()) {
-    if (color.get(name) === WHITE) visit(name);
-  }
-}
-function parseConfig(text) {
-  let doc;
-  try {
-    doc = parseYaml(text);
-  } catch (err) {
-    throw new ConfigError(`yaml parse error: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  if (doc === null || doc === void 0) return { services: [], tasks: [] };
-  if (!isPlainObject2(doc)) {
-    throw new ConfigError("top-level config must be a mapping");
-  }
-  rejectUnknownKeys(doc, TOP_LEVEL_KEYS, "(root)");
-  const services = [];
-  const servicesRaw = doc.services;
-  if (servicesRaw !== void 0 && servicesRaw !== null) {
-    if (!isPlainObject2(servicesRaw)) {
-      throw new ConfigError("services must be a mapping of name \u2192 service");
-    }
-    for (const [name, raw] of Object.entries(servicesRaw)) {
-      if (!/^[A-Za-z0-9_-]+$/.test(name)) {
-        throw new ConfigError(`service name "${name}" must match [A-Za-z0-9_-]+`);
-      }
-      services.push(parseService(name, raw));
-    }
-  }
-  const tasks = [];
-  const tasksRaw = doc.tasks;
-  if (tasksRaw !== void 0 && tasksRaw !== null) {
-    if (!isPlainObject2(tasksRaw)) {
-      throw new ConfigError("tasks must be a mapping of name \u2192 task");
-    }
-    for (const [name, raw] of Object.entries(tasksRaw)) {
-      if (!/^[A-Za-z0-9_-]+$/.test(name)) {
-        throw new ConfigError(`task name "${name}" must match [A-Za-z0-9_-]+`);
-      }
-      tasks.push(parseTask(name, raw));
-    }
-  }
-  if (doc.ide !== void 0 && doc.ide !== null && !isPlainObject2(doc.ide)) {
-    throw new ConfigError("ide must be a mapping");
-  }
-  if (doc.defaults !== void 0 && doc.defaults !== null && !isPlainObject2(doc.defaults)) {
-    throw new ConfigError("defaults must be a mapping");
-  }
-  validateUnitGraph(tasks, services);
-  const exposed = services.filter((s) => s.expose);
-  if (exposed.length > 1) {
-    throw new ConfigError(
-      `at most one service may set expose: (got: ${exposed.map((s) => s.name).join(", ")})`
-    );
-  }
-  return { services, tasks };
-}
-async function loadConfig(path) {
-  let text;
-  try {
-    text = await readFile3(path, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return { services: [], tasks: [] };
-    }
-    throw err;
-  }
-  return parseConfig(text);
-}
-
-export {
-  DEFAULT_RELAY_PORT,
-  RELAY_CONTAINER_NAME,
-  RELAY_NETWORK_NAME,
-  RELAY_IMAGE_REF,
-  SHARED_CLAUDE_VOLUME,
-  resolveClaudeVolume,
-  ensureClaudeVolume,
-  seedSetupSkillIntoVolume,
-  buildClaudeMounts,
-  rebuildPluginNativeDeps,
-  ClaudeSessionError,
-  startClaudeSession,
-  buildClaudeAttachArgv,
-  buildClaudeDashboardAttachArgv,
-  buildShellArgv,
-  formatDetachNotice,
-  claudeSessionInfo,
-  pullClaudeExtras,
-  SHARED_DOCKER_CACHE_VOLUME,
-  dockerVolumeName,
-  launchDockerdDaemon,
-  launchVncDaemon,
-  generateVncPassword,
-  VNC_CONTAINER_PORT,
-  buildVncUrls,
-  WEB_CONTAINER_PORT,
-  detectGitRepos,
-  pickFreshBranch,
-  gitWorktreePathFor,
-  collectRepoCarryOver,
-  chownGitBindParents,
-  bindWorktrees,
-  seedWorkspace,
-  seedWorkspaceFromDir,
-  removeInBoxWorktree,
-  SNAPSHOTS_ROOT,
-  snapshotPathFor,
-  createSnapshot,
-  launchCtlDaemon,
-  ensureRelay,
-  stopRelay,
-  getRelayStatus,
-  generateRelayToken,
-  registerBoxWithRelay,
-  forgetBoxFromRelay,
-  rehydrateRelayRegistry,
-  ideProfile,
-  SHARED_VSCODE_EXTENSIONS_VOLUME,
-  SHARED_CURSOR_EXTENSIONS_VOLUME,
-  vscodeServerVolumeName,
-  cursorServerVolumeName,
-  buildIdeMounts,
-  ensureIdeVolumes,
-  repairIdeOwnership,
-  containerHex,
-  ensureAgentboxTasksFile,
-  renderStatusTable,
-  renderTaskTable,
-  renderPortsTable,
-  ConfigError,
-  loadConfig
-};
-//# sourceMappingURL=chunk-PXUBE5KS.js.map