@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.1

package/src/adapters/process.js

@@ -0,0 +1,418 @@
+import { execFile, spawn } from "node:child_process";
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { uptime } from "node:os";
+import { join } from "node:path";
+import { CODEFLOW_HOME, timerMs } from "../config.js";
+import { childEnv } from "../env.js";
+import { agentContainerLaunch, isAgentContainerName, stopAgentContainer, stopAgentContainerSync } from "../agent-container.js";
+const DEFAULT_TIMEOUT = 30 * 6e4;
+const DRAIN_MS = 3e3;
+const RESULT_GRACE_MS = 1e4;
+const MAX_LINE_BYTES = 16 * 1024 * 1024;
+const liveGroups = /* @__PURE__ */ new Map();
+const dyingGroups = /* @__PURE__ */ new Map();
+const GROUPS_FILE = join(CODEFLOW_HOME, "processes.json");
+process.once("exit", () => {
+  for (const record of [...liveGroups.values(), ...dyingGroups.values()]) if (record.containerName) stopAgentContainerSync(record.containerName);
+  for (const pid of [...liveGroups.keys(), ...dyingGroups.keys()]) signalGroup(pid, "SIGKILL");
+  liveGroups.clear();
+  dyingGroups.clear();
+  persistGroups();
+});
+function bootTime() {
+  return Date.now() - uptime() * 1e3;
+}
+function persistGroups() {
+  try {
+    mkdirSync(CODEFLOW_HOME, { recursive: true });
+    const groups = [...new Map([...dyingGroups, ...liveGroups]).values()];
+    const tmp = `${GROUPS_FILE}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ server: process.pid, boot: Math.round(bootTime()), groups }));
+    renameSync(tmp, GROUPS_FILE);
+  } catch {
+  }
+}
+function trackGroup(pid, containerName) {
+  if (!pid) return;
+  liveGroups.set(pid, { pid, startedAt: Date.now(), ...containerName ? { containerName } : {} });
+  persistGroups();
+}
+function untrackGroup(pid) {
+  if (!pid || !liveGroups.delete(pid)) return;
+  persistGroups();
+}
+function probe(command, args) {
+  return new Promise((resolve) => {
+    execFile(command, args, { timeout: 1e4, env: { ...process.env, LC_ALL: "C" } }, (err, stdout) => {
+      resolve({ code: err ? typeof err.code === "number" ? err.code : 1 : 0, stdout: String(stdout) });
+    });
+  });
+}
+function exists(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isOurGroup(g) {
+  if (!exists(-g.pid)) return false;
+  if (!exists(g.pid)) return true;
+  const lstart = (await probe("ps", ["-o", "lstart=", "-p", String(g.pid)])).stdout.trim();
+  const started = lstart ? Date.parse(lstart) : NaN;
+  return Number.isFinite(started) && Math.abs(started - g.startedAt) < 5e3;
+}
+async function reapOrphanGroups() {
+  if (process.platform === "win32") return 0;
+  let saved;
+  try {
+    saved = JSON.parse(readFileSync(GROUPS_FILE, "utf8"));
+  } catch {
+    return 0;
+  }
+  let killed = 0;
+  const sameBoot = typeof saved?.boot === "number" && Math.abs(saved.boot - bootTime()) < 12e4;
+  if (sameBoot && Array.isArray(saved?.groups)) {
+    for (const g of saved.groups) {
+      if (!Number.isInteger(g?.pid) || g.pid <= 1 || g.pid === process.pid || liveGroups.has(g.pid)) continue;
+      if (isAgentContainerName(g.containerName)) await stopAgentContainer(g.containerName);
+      if (!await isOurGroup(g)) continue;
+      signalGroup(g.pid, "SIGKILL");
+      killed++;
+    }
+  }
+  persistGroups();
+  return killed;
+}
+function signalGroup(pid, signal) {
+  try {
+    process.kill(-pid, signal);
+  } catch {
+  }
+}
+function killGroup(pid, graceMs = 5e3) {
+  if (!pid) return;
+  signalGroup(pid, "SIGTERM");
+  if (dyingGroups.has(pid)) return;
+  const record = liveGroups.get(pid) ?? { pid, startedAt: Date.now() };
+  dyingGroups.set(pid, record);
+  if (record.containerName) {
+    void stopAgentContainer(record.containerName);
+    setTimeout(() => void stopAgentContainer(record.containerName), 300).unref();
+  }
+  persistGroups();
+  setTimeout(() => {
+    signalGroup(pid, "SIGKILL");
+    dyingGroups.delete(pid);
+    persistGroups();
+  }, graceMs).unref();
+}
+function runJsonlProcess(opts) {
+  return startJsonlProcess(opts).outcome;
+}
+function startJsonlProcess(opts) {
+  const piped = opts.input !== void 0 || !!opts.interactive;
+  const container = opts.agentContainer ? agentContainerLaunch(opts.command, opts.args, opts.cwd, opts.agentContainer.mode, opts.agentContainer.config, opts.agentContainer.readOnly) : void 0;
+  const child = spawn(container?.command ?? opts.command, container?.args ?? opts.args, {
+    cwd: opts.cwd,
+    env: opts.env ?? childEnv(),
+    detached: true,
+    stdio: [piped ? "pipe" : "ignore", "pipe", "pipe"]
+  });
+  trackGroup(child.pid, container?.name);
+  child.stdin?.on("error", () => {
+  });
+  if (opts.input !== void 0 && !opts.interactive) child.stdin?.end(opts.input);
+  let markResult = () => {
+  };
+  let pauseIdle = (_paused) => {
+  };
+  const outcome = new Promise((resolve) => {
+    let stderr = "";
+    let aborted = false;
+    let timedOut = false;
+    let stalled = false;
+    let resultSeen = false;
+    let killedAfterResult = false;
+    let settled = false;
+    const kill = () => killGroup(child.pid);
+    const onAbort = () => {
+      aborted = true;
+      kill();
+    };
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    if (opts.signal?.aborted) onAbort();
+    const timer = setTimeout(() => {
+      timedOut = true;
+      kill();
+    }, timerMs(validMs(opts.timeoutMs) ?? DEFAULT_TIMEOUT));
+    timer.unref();
+    const idleMs = validMs(opts.idleTimeoutMs);
+    let idle;
+    let idlePaused = false;
+    const alive = () => {
+      if (idleMs === void 0 || resultSeen || settled || idlePaused) return;
+      clearTimeout(idle);
+      idle = setTimeout(() => {
+        stalled = true;
+        kill();
+      }, timerMs(idleMs));
+      idle.unref();
+    };
+    pauseIdle = (paused) => {
+      idlePaused = paused;
+      clearTimeout(idle);
+      if (!paused) alive();
+    };
+    alive();
+    let grace;
+    markResult = () => {
+      if (resultSeen || settled) return;
+      resultSeen = true;
+      clearTimeout(timer);
+      clearTimeout(idle);
+      grace = setTimeout(() => {
+        killedAfterResult = true;
+        killGroup(child.pid, 1e3);
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        finish(null);
+      }, timerMs(validMs(opts.resultGraceMs) ?? RESULT_GRACE_MS));
+      grace.unref();
+    };
+    const handleLine = (line) => {
+      const trimmed = line.trim();
+      if (!trimmed) return;
+      let parsed;
+      try {
+        parsed = JSON.parse(trimmed);
+      } catch {
+        opts.onText?.(trimmed);
+        return;
+      }
+      try {
+        opts.onJson(parsed);
+      } catch (err) {
+        opts.onText?.(`[adapter error] ${err.message}`);
+      }
+    };
+    const lines = lineSplitter(
+      MAX_LINE_BYTES,
+      handleLine,
+      (bytes) => opts.onText?.(`[code-flow skipped a ${Math.round(bytes / 1024 / 1024)} MB line of ${opts.command} output: lines over ${MAX_LINE_BYTES / 1024 / 1024} MB aren't read]`)
+    );
+    child.stdout.on("data", (chunk) => {
+      alive();
+      if (!settled) lines.push(chunk);
+    });
+    child.stdout.on("end", () => {
+      if (!settled) lines.end();
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      alive();
+      stderr += chunk;
+      if (stderr.length > 64e3) stderr = stderr.slice(-64e3);
+    });
+    const finish = (exitCode) => {
+      if (settled) return;
+      lines.end();
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(idle);
+      clearTimeout(grace);
+      untrackGroup(child.pid);
+      opts.signal?.removeEventListener("abort", onAbort);
+      const outcome2 = { exitCode, stderr, aborted, timedOut, stalled, idleMs: stalled ? idleMs : void 0, resultSeen, killedAfterResult };
+      if (container) {
+        void (async () => {
+          await stopAgentContainer(container.name);
+          if (aborted || timedOut || stalled || exitCode !== 0) {
+            await new Promise((done) => setTimeout(done, 300));
+            await stopAgentContainer(container.name);
+          }
+          resolve(outcome2);
+        })();
+      } else resolve(outcome2);
+    };
+    child.on("error", (err) => {
+      stderr += `
+${err.message}`;
+      finish(null);
+    });
+    child.on("exit", (code) => {
+      killGroup(child.pid, 2e3);
+      setTimeout(() => {
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        finish(code);
+      }, DRAIN_MS).unref();
+    });
+    child.on("close", (code) => finish(code));
+  });
+  return {
+    send: (message) => {
+      const stdin = child.stdin;
+      if (!stdin || stdin.destroyed || stdin.writableEnded) return false;
+      stdin.write(`${JSON.stringify(message)}
+`);
+      return true;
+    },
+    endInput: () => child.stdin?.end(),
+    kill: () => killGroup(child.pid),
+    resultSeen: () => markResult(),
+    pauseIdle: (paused) => pauseIdle(paused),
+    outcome
+  };
+}
+function validMs(ms) {
+  return typeof ms === "number" && Number.isFinite(ms) && ms > 0 ? ms : void 0;
+}
+function lineSplitter(maxBytes, onLine, onDropped) {
+  let parts = [];
+  let size = 0;
+  let dropped = 0;
+  let ended = false;
+  const emit = () => {
+    if (dropped) onDropped(dropped);
+    else if (size) onLine(Buffer.concat(parts, size).toString("utf8"));
+    parts = [];
+    size = 0;
+    dropped = 0;
+  };
+  return {
+    push(chunk) {
+      if (ended) return;
+      let start = 0;
+      for (; ; ) {
+        const nl = chunk.indexOf(10, start);
+        const piece = chunk.subarray(start, nl === -1 ? chunk.length : nl);
+        if (dropped) dropped += piece.length;
+        else if (size + piece.length > maxBytes) {
+          dropped = size + piece.length;
+          parts = [];
+          size = 0;
+        } else if (piece.length) {
+          parts.push(piece);
+          size += piece.length;
+        }
+        if (nl === -1) return;
+        emit();
+        start = nl + 1;
+      }
+    },
+    /** The stream ended: a last line without a newline still counts. */
+    end() {
+      if (ended) return;
+      ended = true;
+      emit();
+    }
+  };
+}
+function captureOutput(command, args, timeoutMs = 3e4) {
+  if (args.includes("--help")) return captureHelp(command, args, timeoutMs);
+  return new Promise((resolve, reject) => {
+    execFile(command, args, { timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024, env: childEnv() }, (err, stdout, stderr) => {
+      if (err) reject(new Error(`${command} ${args.join(" ")} failed: ${stderr.toString().trim() || err.message}`));
+      else resolve(stdout.toString());
+    });
+  });
+}
+async function captureHelp(command, args, timeoutMs) {
+  const fs = await import("node:fs/promises");
+  const dir = await fs.mkdtemp(join((await import("node:os")).tmpdir(), "codeflow-cli-help-"));
+  const path = join(dir, "help.txt");
+  const file = await fs.open(path, "wx", 384);
+  try {
+    await new Promise((resolve, reject) => {
+      const child = spawn(command, args, { env: childEnv(), stdio: ["ignore", file.fd, file.fd], timeout: timeoutMs, killSignal: "SIGKILL" });
+      child.on("error", reject);
+      child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`${command} help failed: process stopped (${code})`)));
+    });
+    if ((await file.stat()).size > 2e6) throw new Error("CLI help exceeds limit");
+    return await fs.readFile(path, "utf8");
+  } finally {
+    await file.close();
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+}
+async function commandExists(binary) {
+  return new Promise((resolve) => {
+    const child = spawn("which", [binary], { stdio: "ignore", env: childEnv() });
+    child.on("error", () => resolve(false));
+    child.on("close", (code) => resolve(code === 0));
+  });
+}
+function describeFailure(name, outcome) {
+  if (outcome.aborted) return `${name} was cancelled`;
+  if (outcome.timedOut) return `${name} timed out`;
+  if (outcome.stalled) return `${name} printed nothing for ${duration(outcome.idleMs ?? 0)} and was stopped (stalled)`;
+  const tail = stderrTail(outcome);
+  return `${name} exited with code ${outcome.exitCode}${tail ? `: ${tail}` : ""}`;
+}
+function processErrorKind(outcome) {
+  if (outcome.aborted) return "cancelled";
+  if (outcome.timedOut) return "timeout";
+  if (outcome.stalled) return "stalled";
+  return void 0;
+}
+function stderrTail(outcome, lines = 5) {
+  return outcome.stderr.trim().split("\n").slice(-lines).join("\n");
+}
+function unknownEvents(cli) {
+  const counts = /* @__PURE__ */ new Map();
+  let total = 0;
+  return {
+    add(type) {
+      const name = typeof type === "string" && type.trim() ? type.trim().slice(0, 60) : "(no type)";
+      total++;
+      if (counts.has(name) || counts.size < 20) counts.set(name, (counts.get(name) ?? 0) + 1);
+    },
+    get count() {
+      return total;
+    },
+    /** The status line for the turn (once: later calls return undefined). */
+    report() {
+      if (!total) return void 0;
+      const names = [...counts.entries()].map(([name, n]) => n > 1 ? `${name} (${n})` : name).join(", ");
+      const line = `${cli} emitted ${total} event${total === 1 ? "" : "s"} code-flow doesn't know: ${names}. If this turn's output looks incomplete, the CLI's format may have changed: update code-flow.`;
+      total = 0;
+      counts.clear();
+      return line;
+    }
+  };
+}
+function duration(ms) {
+  return ms >= 6e4 ? `${Math.round(ms / 6e4)} min` : `${Math.max(1, Math.round(ms / 1e3))} s`;
+}
+function truncate(text, max = 4e3) {
+  return text.length > max ? `${text.slice(0, max)}
+\u2026 [${text.length - max} more chars]` : text;
+}
+function stringify(value) {
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+export {
+  MAX_LINE_BYTES,
+  captureOutput,
+  commandExists,
+  describeFailure,
+  killGroup,
+  lineSplitter,
+  processErrorKind,
+  reapOrphanGroups,
+  runJsonlProcess,
+  startJsonlProcess,
+  stderrTail,
+  stringify,
+  trackGroup,
+  truncate,
+  unknownEvents,
+  untrackGroup
+};

package/src/adapters/team-tools.js

@@ -0,0 +1,102 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { TEAM_TOOLS } from "../team-tools.js";
+import { captureOutput } from "./process.js";
+import { agyIsolationProblem, AGY_FILE_ONLY_LIMITATION } from "./agy-isolation.js";
+const CACHE_MS = 10 * 6e4;
+const UNKNOWN_CACHE_MS = 2 * 6e4;
+const cache = /* @__PURE__ */ new Map();
+function adapterTeamCapabilities(provider) {
+  const key = `${provider}:${process.env.PATH}:${process.env.FAKE_UNKNOWN_FLAG ?? ""}:${process.env.FAKE_IGNORE_DELEGATION_FLAGS ?? ""}`;
+  const saved = cache.get(key);
+  if (saved && Date.now() - saved.at < saved.ttl) return saved.value;
+  const entry = { at: Date.now(), ttl: CACHE_MS, value: probe(provider) };
+  cache.set(key, entry);
+  void entry.value.then((capabilities) => {
+    if (capabilities.scopedTools === "unknown") entry.ttl = UNKNOWN_CACHE_MS;
+  }, () => cache.delete(key));
+  return entry.value;
+}
+async function probe(provider) {
+  if (provider.startsWith("acp:")) return { provider, structuredOutput: "unsupported", sessionResume: "unknown", liveInput: "unsupported", scopedTools: "unsupported", sandbox: "unsupported", nestedAgentControl: "unknown", nestedUsage: "unknown", evidence: ["Shared ACP v1 adapter; session loading is negotiated per connection. JSON outcomes use prompt instructions and engine validation. Local Full access only; no client filesystem, terminal or scoped team-tool capabilities."] };
+  if (provider.startsWith("plugin:")) return { provider, structuredOutput: "unknown", sessionResume: "unknown", liveInput: "unsupported", scopedTools: "unsupported", sandbox: "unknown", nestedAgentControl: "unknown", nestedUsage: "unknown", evidence: ["Owner-configured provider plugin. Built-in provider protocol fixtures and sandbox probes do not establish compatibility for this extension."] };
+  const [versionResult, helpResult] = await Promise.allSettled([
+    captureOutput(provider, ["--version"], 5e3),
+    captureOutput(provider, ["--help"], 5e3)
+  ]);
+  const version = versionResult.status === "fulfilled" ? versionResult.value.trim().slice(0, 150) : void 0;
+  const help = helpResult.status === "fulfilled" ? helpResult.value : "";
+  const flags = (...values) => values.every((value) => help.includes(value));
+  const supported = (present, observed = !!help) => present ? "tested" : observed ? "unsupported" : "unknown";
+  let structuredOutput = supported(flags("--json-schema"));
+  let sessionResume = supported(flags(provider === "agy" ? "--conversation" : "--resume"));
+  let nestedAgentControl = provider === "claude" ? supported(flags("--disallowedTools")) : "unknown";
+  let scopedTools = "unknown";
+  let isolatedAgy = false;
+  const evidence = ["Adapter protocol and permissions are covered by fake-CLI regression tests; model behavior is evaluated separately."];
+  if (provider === "claude") {
+    scopedTools = flags("--mcp-config", "--strict-mcp-config", "--allowedTools", "--disallowedTools") ? "tested" : help ? "unsupported" : "unknown";
+    evidence.push("Per-turn stdio MCP config and explicit tool allowlist; built-in Agent, Task and team creation are denied for Auto turns.");
+  } else if (provider === "codex") {
+    const [execHelp, features] = await Promise.allSettled([captureOutput("codex", ["exec", "--help"], 5e3), captureOutput("codex", ["features", "list", "-c", "features.multi_agent=false", "-c", "features.multi_agent_v2.enabled=false"], 5e3)]);
+    const execFlags = execHelp.status === "fulfilled" ? execHelp.value : "";
+    structuredOutput = supported(execFlags.includes("--output-schema"), !!execFlags);
+    sessionResume = supported(/\bresume\b/.test(execFlags), !!execFlags);
+    nestedAgentControl = features.status === "fulfilled" && ["multi_agent", "multi_agent_v2"].every((key) => new RegExp(`^${key}\\s+\\S+\\s+false\\s*$`, "m").test(features.value)) ? "tested" : "unknown";
+    try {
+      const found = JSON.parse(await captureOutput("codex", ["mcp", "get", "codeflow_capability_probe", "--json", "-c", 'mcp_servers.codeflow_capability_probe={command="node",args=[],enabled_tools=["read_inbox"],tools={read_inbox={approval_mode="approve"}},startup_timeout_sec=5,tool_timeout_sec=10}'], 5e3));
+      scopedTools = found.transport?.type === "stdio" && found.enabled_tools?.includes("read_inbox") ? "tested" : "unknown";
+    } catch {
+      scopedTools = "unknown";
+    }
+    evidence.push("Per-turn mcp_servers override is checked with codex mcp get; app-server and exec share the same config. Managed turns also set agents.enabled=false, disable hooks and both multi-agent features. Capability probes advertise support; live execution is separate evidence.");
+  } else {
+    scopedTools = help && !help.includes("--mcp-config") ? "unsupported" : "unknown";
+    isolatedAgy = !await agyIsolationProblem();
+    sessionResume = "unsupported";
+    nestedAgentControl = isolatedAgy ? "tested" : "unknown";
+    evidence.push(isolatedAgy ? AGY_FILE_ONLY_LIMITATION + " macos-file-only-v1 / CLI 1.4.4 has bounded real-provider and kernel fixture evidence; current login entitlement is checked only by execution." : "No verified isolated Antigravity runtime is available. A sandbox help flag cannot establish inherited permissions. Legacy execution remains separate.");
+  }
+  evidence.push("Provider token events report parent-turn totals; a separate nested-agent token breakdown is not available.");
+  return {
+    provider,
+    version,
+    structuredOutput,
+    sessionResume,
+    liveInput: provider === "codex" ? supported(/\bapp-server\b/.test(help)) : "unsupported",
+    scopedTools,
+    sandbox: provider === "claude" ? "unsupported" : provider === "agy" ? isolatedAgy ? "tested" : "unknown" : help ? "tested" : "unknown",
+    nestedAgentControl,
+    nestedUsage: "unknown",
+    evidence
+  };
+}
+const TEAM_MCP_NAME = "codeflow_team";
+const TEAM_TOOL_ALLOWLIST = TEAM_TOOLS.map((tool) => `mcp__${TEAM_MCP_NAME}__${tool.name}`);
+const TEAM_NESTED_DENYLIST = ["Agent", "Task", "TeamCreate", "TeamDelete", "SendMessage", "Workflow", "ListAgents", "RemoteTrigger", "CronCreate", "CronDelete", "CronList"];
+async function prepareTeamTools(connection) {
+  const dir = await mkdtemp(join(tmpdir(), "codeflow-member-tools-"));
+  const credentialPath = join(dir, "connection.json");
+  const configPath = join(dir, "mcp.json");
+  const clientPath = fileURLToPath(new URL("../team-tool-client.mjs", import.meta.url));
+  try {
+    await writeFile(credentialPath, JSON.stringify(connection), { mode: 384 });
+    const args = [clientPath, "--connection", credentialPath];
+    await writeFile(configPath, JSON.stringify({ mcpServers: { [TEAM_MCP_NAME]: { type: "stdio", command: process.execPath, args } } }), { mode: 384 });
+    const tools = TEAM_TOOLS.map((tool) => `${tool.name}={approval_mode="approve"}`).join(",");
+    const config = `mcp_servers.${TEAM_MCP_NAME}={command=${JSON.stringify(process.execPath)},args=${JSON.stringify(args)},enabled_tools=${JSON.stringify(TEAM_TOOLS.map((tool) => tool.name))},tools={${tools}},startup_timeout_sec=5,tool_timeout_sec=10}`;
+    return { claudeConfig: configPath, codexConfig: ["-c", config], codexThreadConfig: { [`mcp_servers.${TEAM_MCP_NAME}`]: { command: process.execPath, args, enabled_tools: TEAM_TOOLS.map((tool) => tool.name), tools: Object.fromEntries(TEAM_TOOLS.map((tool) => [tool.name, { approval_mode: "approve" }])), startup_timeout_sec: 5, tool_timeout_sec: 10 } }, cleanup: () => rm(dir, { recursive: true, force: true }) };
+  } catch (error) {
+    await rm(dir, { recursive: true, force: true });
+    throw error;
+  }
+}
+export {
+  TEAM_MCP_NAME,
+  TEAM_NESTED_DENYLIST,
+  TEAM_TOOL_ALLOWLIST,
+  adapterTeamCapabilities,
+  prepareTeamTools
+};

package/src/agent-container.js

@@ -0,0 +1,155 @@
+import { randomUUID } from "node:crypto";
+import { execFile, spawnSync } from "node:child_process";
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { childEnv } from "./env.js";
+const filteredContainers = /* @__PURE__ */ new WeakMap();
+function filteredTaskContainer(raw, id, readOnly = []) {
+  if (raw.authVolume || !/^sha256:[a-f0-9]{64}$/.test(raw.image)) throw new Error("Filtered containers require an immutable image and no authentication volume");
+  if (!/^filtered-[a-f0-9]{24}$/.test(id) || readOnly.length > 500 || readOnly.some((path) => !path || path.startsWith("/") || /[\\\x00-\x1f]/.test(path) || path.split("/").some((part) => !part || part === "." || part === ".." || part === ".git"))) throw new Error("Invalid filtered container receipt");
+  const config = validateAgentContainer(raw);
+  filteredContainers.set(config, { id, readOnly: [...readOnly] });
+  return config;
+}
+function validateAgentContainer(raw) {
+  const value = raw;
+  if (!value || typeof value !== "object" || typeof value.image !== "string" || !/^[a-zA-Z0-9][\w./:@-]{0,199}$/.test(value.image)) throw new Error("Agent isolation needs a valid prebuilt Docker image");
+  if (value.authVolume !== void 0 && (typeof value.authVolume !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(value.authVolume))) throw new Error("Agent authentication must use an explicitly named Docker volume, never a host path");
+  if (value.network !== void 0 && typeof value.network !== "boolean") throw new Error("Agent container network must be enabled or disabled explicitly");
+  if (value.memoryMb !== void 0 && (!Number.isInteger(value.memoryMb) || value.memoryMb < 128 || value.memoryMb > 65536)) throw new Error("Agent container memory must be 128\u201365536 MB");
+  if (value.cpus !== void 0 && (!Number.isFinite(value.cpus) || value.cpus < 0.1 || value.cpus > 64)) throw new Error("Agent container CPUs must be 0.1\u201364");
+  return {
+    image: value.image,
+    ...value.authVolume ? { authVolume: value.authVolume } : {},
+    ...value.network === void 0 ? {} : { network: value.network },
+    ...value.memoryMb === void 0 ? {} : { memoryMb: value.memoryMb },
+    ...value.cpus === void 0 ? {} : { cpus: value.cpus }
+  };
+}
+function agentContainerLaunch(command, args, cwd, mode, raw, extraReadOnly = []) {
+  const filtered = filteredContainers.get(raw);
+  const container = validateAgentContainer(raw);
+  if (!["claude", "codex", "agy"].includes(command)) throw new Error("Only supported official agent CLIs can run in an agent container");
+  const root = realpathSync(cwd);
+  if (!lstatSync(root).isDirectory()) throw new Error("Agent workspace must be a directory");
+  const mounts = /* @__PURE__ */ new Map([[root, mode === "read"]]);
+  for (const path of readOnlyGitMetadata(root)) mounts.set(path, true);
+  for (const path of extraReadOnly) mounts.set(realpathSync(path), true);
+  for (const relative of filtered?.readOnly ?? []) {
+    const target = realpathSync(join(root, relative));
+    if (!target.startsWith(`${root}/`) || !lstatSync(target).isFile()) throw new Error("Filtered read-only mounts must be regular files inside the export");
+    mounts.set(target, true);
+  }
+  for (const path of mounts.keys()) if (!isAbsolute(path) || /[,\n\r\0]/.test(path)) throw new Error("Docker isolation cannot mount paths containing commas or line breaks");
+  const name = `codeflow-agent-${randomUUID().replace(/-/g, "")}`;
+  const user = typeof process.getuid === "function" ? ["--user", `${process.getuid()}:${process.getgid()}`] : ["--user", "65532:65532"];
+  return {
+    command: "docker",
+    name,
+    args: [
+      "run",
+      "--rm",
+      "--init",
+      "--interactive",
+      "--pull=never",
+      "--name",
+      name,
+      "--label",
+      "codeflow.managed-agent=true",
+      "--cap-drop=ALL",
+      "--security-opt=no-new-privileges",
+      ...filtered ? ["--label", `codeflow.filtered-task=${filtered.id}`] : [],
+      ...filtered ? ["--read-only", "--tmpfs", `/home/codeflow:rw,nosuid,nodev,size=134217728,uid=${typeof process.getuid === "function" ? process.getuid() : 65532},gid=${typeof process.getgid === "function" ? process.getgid() : 65532},mode=0700`] : [],
+      "--pids-limit",
+      "256",
+      "--memory",
+      `${container.memoryMb ?? 4096}m`,
+      "--cpus",
+      String(container.cpus ?? 2),
+      ...user,
+      "--workdir",
+      root,
+      ...[...mounts].flatMap(([path, readOnly]) => ["--mount", `type=bind,source=${path},target=${path}${readOnly ? ",readonly" : ""}`]),
+      ...container.authVolume ? ["--mount", `type=volume,source=${container.authVolume},target=/home/codeflow`] : [],
+      "--tmpfs",
+      "/tmp:rw,nosuid,nodev,size=268435456",
+      "--env",
+      "HOME=/home/codeflow",
+      "--env",
+      "CODEX_HOME=/home/codeflow/.codex",
+      "--env",
+      "GIT_TERMINAL_PROMPT=0",
+      "--env",
+      "GIT_OPTIONAL_LOCKS=0",
+      "--env",
+      "NO_COLOR=1",
+      "--env",
+      "GIT_CONFIG_GLOBAL=/dev/null",
+      "--env",
+      "GIT_CONFIG_SYSTEM=/dev/null",
+      "--env",
+      "GIT_CONFIG_COUNT=1",
+      "--env",
+      "GIT_CONFIG_KEY_0=core.excludesFile",
+      "--env",
+      "GIT_CONFIG_VALUE_0=/dev/null",
+      ...container.network === false ? ["--network", "none"] : [],
+      "--entrypoint",
+      command,
+      container.image,
+      ...args
+    ]
+  };
+}
+function readOnlyGitMetadata(root) {
+  const marker = join(root, ".git");
+  let info;
+  try {
+    info = lstatSync(marker);
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  if (info.isSymbolicLink()) throw new Error("Agent isolation refuses a symlinked .git marker");
+  if (info.isDirectory()) return [marker];
+  if (!info.isFile()) throw new Error("Agent workspace has an invalid .git marker");
+  const gitdir = /^gitdir: (.+)\r?\n?$/.exec(readFileSync(marker, "utf8"));
+  if (!gitdir) throw new Error("Agent workspace has an invalid worktree .git marker");
+  const admin = realpathSync(resolve(root, gitdir[1]));
+  const common = realpathSync(resolve(admin, readFileSync(join(admin, "commondir"), "utf8").trim()));
+  const backlink = realpathSync(resolve(admin, readFileSync(join(admin, "gitdir"), "utf8").trim()));
+  if (backlink !== realpathSync(marker) || dirname(admin) !== join(common, "worktrees") || !lstatSync(join(common, "objects")).isDirectory() || !lstatSync(join(common, "HEAD")).isFile()) throw new Error("Agent worktree metadata does not belong to this workspace");
+  return [marker, common];
+}
+const isAgentContainerName = (name) => typeof name === "string" && /^codeflow-agent-[a-f0-9]{32}$/.test(name);
+function stopAgentContainer(name) {
+  if (!isAgentContainerName(name)) return Promise.resolve();
+  return new Promise((resolve2) => {
+    execFile("docker", ["rm", "--force", name], { env: childEnv(), timeout: 5e3 }, () => resolve2());
+  });
+}
+function stopAgentContainerSync(name) {
+  if (isAgentContainerName(name)) spawnSync("docker", ["rm", "--force", name], { env: childEnv(), timeout: 1500, stdio: "ignore" });
+}
+function agentContainerCapabilities(container) {
+  const configured = validateAgentContainer(container);
+  return {
+    runtime: "docker",
+    image: configured.image,
+    network: configured.network !== false,
+    credentialSource: configured.authVolume ? "named-volume" : "image",
+    liveTeamTools: false,
+    nativeCodexApprovals: true,
+    hostHomeMounted: false
+  };
+}
+export {
+  agentContainerCapabilities,
+  agentContainerLaunch,
+  filteredTaskContainer,
+  isAgentContainerName,
+  readOnlyGitMetadata,
+  stopAgentContainer,
+  stopAgentContainerSync,
+  validateAgentContainer
+};