@proletariat/cli 0.3.69 → 0.3.71

package/dist/lib/execution/runners/docker-credentials.js

@@ -0,0 +1,175 @@
+/**
+ * Docker Credential Helpers
+ *
+ * Functions for checking and managing Claude Code credentials
+ * in Docker volumes, host filesystem, and macOS keychain.
+ * Also includes tmux server keychain access management.
+ */
+import { execSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+export const CLAUDE_CREDENTIALS_VOLUME = 'claude-credentials';
+/**
+ * Check if the claude-credentials Docker volume exists.
+ */
+export function credentialsVolumeExists() {
+    try {
+        execSync(`docker volume inspect ${CLAUDE_CREDENTIALS_VOLUME}`, { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check if valid Claude OAuth credentials exist in the Docker volume.
+ * Returns true if OAuth credentials are stored (even if access token is expired,
+ * since Claude Code handles refresh internally using stored refresh tokens).
+ *
+ * NOTE: This intentionally does NOT check for ANTHROPIC_API_KEY. If the user
+ * has an API key but no OAuth credentials, we want to prompt them to set up
+ * OAuth (which uses their Max subscription) rather than silently burning API credits.
+ */
+export function dockerCredentialsExist() {
+    try {
+        const result = execSync(`docker run --rm -v ${CLAUDE_CREDENTIALS_VOLUME}:/data alpine cat /data/.credentials.json 2>/dev/null`, { stdio: 'pipe', encoding: 'utf-8' });
+        const creds = JSON.parse(result);
+        if (creds.claudeAiOauth?.accessToken) {
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Get Docker credential info for display.
+ * Returns expiration date and subscription type if available.
+ */
+export function getDockerCredentialInfo() {
+    try {
+        const result = execSync(`docker run --rm -v ${CLAUDE_CREDENTIALS_VOLUME}:/data alpine cat /data/.credentials.json 2>/dev/null`, { stdio: 'pipe', encoding: 'utf-8' });
+        const creds = JSON.parse(result);
+        if (creds.claudeAiOauth?.expiresAt) {
+            return {
+                expiresAt: new Date(creds.claudeAiOauth.expiresAt),
+                subscriptionType: creds.claudeAiOauth.subscriptionType,
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check if Claude Code authentication is available on the host system.
+ * Returns true if any of:
+ * 1. ANTHROPIC_API_KEY environment variable is set
+ * 2. OAuth credentials exist in ~/.claude/.credentials.json (Claude Code 1.x)
+ * 3. OAuth credentials exist in macOS keychain (Claude Code 2.x)
+ */
+export function hostCredentialsExist() {
+    if (process.env.ANTHROPIC_API_KEY) {
+        return true;
+    }
+    try {
+        const homeDir = process.env.HOME || os.homedir();
+        const credPath = path.join(homeDir, '.claude', '.credentials.json');
+        if (fs.existsSync(credPath)) {
+            const credData = fs.readFileSync(credPath, 'utf-8');
+            const creds = JSON.parse(credData);
+            if (creds.claudeAiOauth?.accessToken) {
+                return true;
+            }
+        }
+    }
+    catch {
+        // Fall through to keychain check
+    }
+    if (process.platform === 'darwin') {
+        try {
+            execSync('security find-generic-password -s "Claude Code-credentials" 2>/dev/null', {
+                stdio: 'pipe',
+                timeout: 5000,
+            });
+            return true;
+        }
+        catch {
+            // Keychain entry not found or keychain is locked
+        }
+    }
+    return false;
+}
+/**
+ * Ensure tmux server has keychain access for Claude Code OAuth.
+ *
+ * On macOS, tmux sessions can lose access to the keychain if the tmux server
+ * was started in a context without keychain access. This function tests and
+ * restarts the tmux server if needed.
+ */
+export async function ensureTmuxServerHasKeychainAccess() {
+    try {
+        const serverRunning = execSync('tmux list-sessions 2>/dev/null || echo ""', {
+            encoding: 'utf-8',
+            stdio: 'pipe'
+        });
+        if (!serverRunning.trim()) {
+            return;
+        }
+    }
+    catch {
+        return;
+    }
+    const testSession = `prlt-keychain-test-${Date.now()}`;
+    try {
+        execSync(`tmux new-session -d -s "${testSession}"`, { stdio: 'pipe' });
+        execSync(`tmux send-keys -t "${testSession}" "unset CLAUDECODE && claude -p 'test' 2>&1 | head -1" Enter`, { stdio: 'pipe' });
+        await new Promise(resolve => setTimeout(resolve, 3000));
+        const output = execSync(`tmux capture-pane -t "${testSession}" -p`, {
+            encoding: 'utf-8',
+            stdio: 'pipe'
+        });
+        execSync(`tmux kill-session -t "${testSession}"`, { stdio: 'pipe' });
+        if (output.includes('Not logged in') || output.includes('Please run /login')) {
+            execSync('tmux kill-server', { stdio: 'pipe' });
+            for (let i = 0; i < 10; i++) {
+                await new Promise(resolve => setTimeout(resolve, 300));
+                try {
+                    execSync('tmux list-sessions 2>/dev/null', { stdio: 'pipe' });
+                }
+                catch {
+                    break;
+                }
+            }
+        }
+    }
+    catch (_error) {
+        try {
+            execSync(`tmux kill-session -t "${testSession}"`, { stdio: 'pipe' });
+        }
+        catch {
+            // Ignore cleanup errors
+        }
+    }
+}
+/**
+ * Copy Claude Code credentials (~/.claude.json) into the agent directory.
+ * This makes the subscription credentials available inside the devcontainer.
+ */
+export function copyClaudeCredentials(agentDir) {
+    const sourceFile = path.join(os.homedir(), '.claude.json');
+    const destFile = path.join(agentDir, '.claude.json');
+    if (fs.existsSync(sourceFile)) {
+        try {
+            fs.copyFileSync(sourceFile, destFile);
+            console.debug('[runners:credentials] Copied .claude.json to workspace');
+        }
+        catch (err) {
+            console.debug('[runners:credentials] Failed to copy .claude.json:', err);
+        }
+    }
+}
+//# sourceMappingURL=docker-credentials.js.map

package/dist/lib/execution/runners/docker-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-credentials.js","sourceRoot":"","sources":["../../../../src/lib/execution/runners/docker-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAA;AAE7D;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC;QACH,QAAQ,CAAC,yBAAyB,yBAAyB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CACrB,sBAAsB,yBAAyB,uDAAuD,EACtG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CACrC,CAAA;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,KAAK,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;YACrC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CACrB,sBAAsB,yBAAyB,uDAAuD,EACtG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CACrC,CAAA;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC;YACnC,OAAO;gBACL,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;gBAClD,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB;aACvD,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAA;QACnE,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,KAAK,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,CAAC,yEAAyE,EAAE;gBAClF,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC;IACrD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,QAAQ,CAAC,2CAA2C,EAAE;YAC1E,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1B,OAAM;QACR,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,sBAAsB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IAEtD,IAAI,CAAC;QACH,QAAQ,CAAC,2BAA2B,WAAW,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,QAAQ,CACN,sBAAsB,WAAW,+DAA+D,EAChG,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,yBAAyB,WAAW,MAAM,EAAE;YAClE,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,QAAQ,CAAC,yBAAyB,WAAW,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAEpE,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC7E,QAAQ,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;gBACtD,IAAI,CAAC;oBACH,QAAQ,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,QAAQ,CAAC,yBAAyB,WAAW,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IAEpD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACrC,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAA;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/execution/runners/docker-management.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Docker Container Management
+ *
+ * Functions for managing Docker containers, images, and setup.
+ * Uses raw Docker commands instead of devcontainer CLI.
+ */
+import { PermissionMode, ExecutorType, ExecutionContext, ExecutionConfig } from '../types.js';
+/**
+ * Get the host's installed prlt CLI version.
+ * Returns the semver version string (e.g., "0.3.35") or null if not available.
+ */
+export declare function getHostPrltVersion(): string | null;
+/**
+ * Get the container name for an agent.
+ * Format: prlt-agent-{agentName}
+ */
+export declare function getAgentContainerName(agentName: string): string;
+export declare const getContainerName: typeof getAgentContainerName;
+export declare function getImageName(agentName: string): string;
+/**
+ * Check if a Docker container exists (running or stopped).
+ */
+export declare function containerExists(containerName: string): boolean;
+/**
+ * Check if a Docker container is running.
+ */
+export declare function isContainerRunning(containerName: string): boolean;
+/**
+ * Get the container ID for a running container.
+ */
+export declare function getContainerId(containerName: string): string | null;
+export declare function buildDockerImage(agentDir: string, imageName: string, buildArgs?: Record<string, string>): boolean;
+export declare function imageExists(imageName: string): boolean;
+/**
+ * Create and start a Docker container for an agent.
+ */
+export declare function createDockerContainer(context: ExecutionContext, containerName: string, imageName: string, config: ExecutionConfig, executor?: ExecutorType, prltInfo?: {
+    registry: string;
+    version: string;
+}): boolean;
+/**
+ * Run the post-start setup commands in a container.
+ */
+export declare function runContainerSetup(containerId: string, permissionMode?: PermissionMode, executor?: ExecutorType): boolean;
+/**
+ * Ensure a Docker container is running for the agent.
+ * Reuses running containers to preserve in-progress work (TKT-1028).
+ */
+export declare function ensureDockerContainer(context: ExecutionContext, config: ExecutionConfig, executor?: ExecutorType): string | null;

package/dist/lib/execution/runners/docker-management.js

@@ -0,0 +1,300 @@
+/**
+ * Docker Container Management
+ *
+ * Functions for managing Docker containers, images, and setup.
+ * Uses raw Docker commands instead of devcontainer CLI.
+ */
+import { execSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { readDevcontainerJson } from '../devcontainer.js';
+import { isClaudeExecutor } from './executor.js';
+/**
+ * Get the host's installed prlt CLI version.
+ * Returns the semver version string (e.g., "0.3.35") or null if not available.
+ */
+export function getHostPrltVersion() {
+    try {
+        const output = execSync('prlt --version', {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        const match = output.match(/(\d+\.\d+\.\d+)/);
+        return match ? match[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Get the container name for an agent.
+ * Format: prlt-agent-{agentName}
+ */
+export function getAgentContainerName(agentName) {
+    const sanitized = agentName.replace(/[^a-zA-Z0-9_-]/g, '-');
+    return `prlt-agent-${sanitized}`;
+}
+export const getContainerName = getAgentContainerName;
+export function getImageName(agentName) {
+    const sanitized = agentName.replace(/[^a-zA-Z0-9_-]/g, '-');
+    return `prlt-agent-${sanitized}:latest`;
+}
+/**
+ * Check if a Docker container exists (running or stopped).
+ */
+export function containerExists(containerName) {
+    try {
+        execSync(`docker container inspect ${containerName}`, { stdio: 'pipe', timeout: 5000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check if a Docker container is running.
+ */
+export function isContainerRunning(containerName) {
+    try {
+        const status = execSync(`docker container inspect -f '{{.State.Running}}' ${containerName}`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 5000 }).trim();
+        return status === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Get the container ID for a running container.
+ */
+export function getContainerId(containerName) {
+    try {
+        const containerId = execSync(`docker container inspect -f '{{.Id}}' ${containerName}`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 5000 }).trim();
+        return containerId ? containerId.substring(0, 12) : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function buildDockerImage(agentDir, imageName, buildArgs = {}) {
+    const dockerfilePath = path.join(agentDir, '.devcontainer', 'Dockerfile');
+    if (!fs.existsSync(dockerfilePath)) {
+        console.debug(`[runners:docker] Dockerfile not found at ${dockerfilePath}`);
+        return false;
+    }
+    try {
+        const buildArgFlags = Object.entries(buildArgs)
+            .map(([key, value]) => `--build-arg ${key}="${value}"`)
+            .join(' ');
+        const buildCmd = `docker build -t ${imageName} -f "${dockerfilePath}" ${buildArgFlags} "${path.join(agentDir, '.devcontainer')}"`;
+        console.debug(`[runners:docker] Building image: ${buildCmd}`);
+        execSync(buildCmd, { stdio: 'pipe' });
+        return true;
+    }
+    catch (error) {
+        console.debug(`[runners:docker] Failed to build image:`, error);
+        return false;
+    }
+}
+export function imageExists(imageName) {
+    try {
+        execSync(`docker image inspect ${imageName}`, { stdio: 'pipe', timeout: 5000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Create and start a Docker container for an agent.
+ */
+export function createDockerContainer(context, containerName, imageName, config, executor = 'claude-code', prltInfo) {
+    const mounts = [
+        `-v "${context.agentDir}:/workspace:cached"`,
+        ...(context.hqPath ? [`-v "${context.hqPath}/.proletariat:/hq/.proletariat:cached"`] : []),
+        ...(context.pmoPath ? [`-v "${context.pmoPath}:/hq/pmo:cached"`] : []),
+        ...(context.repoWorktrees || []).map(repoName => `-v "${context.hqPath}/repos/${repoName}:/hq/repos/${repoName}:cached"`),
+        ...(isClaudeExecutor(executor) ? [`-v "claude-credentials:/home/node/.claude"`] : []),
+    ];
+    const hasWorktrees = context.repoWorktrees && context.repoWorktrees.length > 0;
+    const firewallAllowlistDomains = [...new Set((config.firewall?.allowlistDomains || [])
+            .map(domain => domain.trim().toLowerCase())
+            .filter(domain => /^[a-z0-9.-]+$/.test(domain)))];
+    const envVars = [
+        `-e DEVCONTAINER=true`,
+        `-e PRLT_HQ_PATH=/hq`,
+        `-e PRLT_AGENT_NAME="${context.agentName}"`,
+        `-e PRLT_HOST_PATH="${context.agentDir}"`,
+        ...(context.useApiKey && process.env.ANTHROPIC_API_KEY ? [`-e ANTHROPIC_API_KEY="${process.env.ANTHROPIC_API_KEY}"`] : []),
+        ...(process.env.GITHUB_TOKEN ? [`-e GITHUB_TOKEN="${process.env.GITHUB_TOKEN}"`] : []),
+        ...(process.env.GH_TOKEN ? [`-e GH_TOKEN="${process.env.GH_TOKEN}"`] : []),
+        ...(firewallAllowlistDomains.length > 0 ? [`-e PRLT_EXTRA_ALLOWLIST_DOMAINS="${firewallAllowlistDomains.join(',')}"`] : []),
+        ...(hasWorktrees ? [`-e PRLT_MOUNT_MODE=worktree`] : []),
+        ...(prltInfo ? [
+            `-e PRLT_REGISTRY="${prltInfo.registry}"`,
+            `-e PRLT_VERSION="${prltInfo.version}"`,
+        ] : []),
+    ];
+    const resourceFlags = [
+        `--memory=${config.devcontainer.memory}`,
+        `--cpus=${config.devcontainer.cpus}`,
+    ];
+    const securityFlags = [
+        '--cap-add=NET_ADMIN',
+        '--cap-add=NET_RAW',
+    ];
+    try {
+        const createCmd = [
+            'docker run -d',
+            `--name ${containerName}`,
+            '--user node',
+            '-w /workspace',
+            ...mounts,
+            ...envVars,
+            ...resourceFlags,
+            ...securityFlags,
+            imageName,
+            'sleep infinity',
+        ].join(' ');
+        console.debug(`[runners:docker] Creating container: ${createCmd}`);
+        execSync(createCmd, { stdio: 'pipe' });
+        return true;
+    }
+    catch (error) {
+        console.debug(`[runners:docker] Failed to create container:`, error);
+        return false;
+    }
+}
+/**
+ * Run the post-start setup commands in a container.
+ */
+export function runContainerSetup(containerId, permissionMode = 'safe', executor = 'claude-code') {
+    try {
+        execSync(`docker exec ${containerId} sudo /usr/local/bin/init-firewall.sh`, { stdio: 'pipe' });
+        execSync(`docker exec ${containerId} /usr/local/bin/setup-prlt.sh`, { stdio: 'pipe' });
+    }
+    catch (error) {
+        console.debug(`[runners:docker] Container setup scripts failed:`, error);
+    }
+    try {
+        execSync(`docker exec ${containerId} pnpm config set store-dir /tmp/pnpm-store`, { stdio: 'pipe' });
+        console.debug(`[runners:docker] Configured pnpm store-dir to /tmp/pnpm-store`);
+    }
+    catch (error) {
+        console.debug(`[runners:docker] Failed to configure pnpm store (pnpm may not be installed):`, error);
+    }
+    if (isClaudeExecutor(executor)) {
+        try {
+            const hostClaudeJson = path.join(os.homedir(), '.claude.json');
+            let settings = {};
+            if (fs.existsSync(hostClaudeJson)) {
+                try {
+                    settings = JSON.parse(fs.readFileSync(hostClaudeJson, 'utf-8'));
+                }
+                catch {
+                    console.debug('[runners:docker] Failed to parse host .claude.json, using empty settings');
+                }
+            }
+            if (permissionMode === 'danger') {
+                settings.bypassPermissionsModeAccepted = true;
+            }
+            settings.numStartups = settings.numStartups || 1;
+            settings.hasCompletedOnboarding = true;
+            settings.theme = settings.theme || 'dark';
+            if (!settings.tipsHistory || typeof settings.tipsHistory !== 'object') {
+                settings.tipsHistory = {};
+            }
+            const tips = settings.tipsHistory;
+            tips['new-user-warmup'] = tips['new-user-warmup'] || 1;
+            settings.effortCalloutDismissed = true;
+            if (!settings.projects || typeof settings.projects !== 'object') {
+                settings.projects = {};
+            }
+            const projects = settings.projects;
+            for (const projectPath of ['/workspace', '/']) {
+                if (!projects[projectPath]) {
+                    projects[projectPath] = {};
+                }
+                projects[projectPath].hasTrustDialogAccepted = true;
+                projects[projectPath].hasCompletedProjectOnboarding = true;
+            }
+            const settingsJson = JSON.stringify(settings);
+            execSync(`docker exec -i ${containerId} bash -c 'cat > /home/node/.claude.json'`, { input: settingsJson, stdio: ['pipe', 'pipe', 'pipe'] });
+            console.debug(`[runners:docker] Copied .claude.json settings to container (bypassPermissionsModeAccepted=${permissionMode === 'danger'})`);
+            const claudeSettings = JSON.stringify({ skipDangerousModePermissionPrompt: true });
+            execSync(`docker exec -i ${containerId} bash -c 'mkdir -p /home/node/.claude && cat > /home/node/.claude/settings.json'`, { input: claudeSettings, stdio: ['pipe', 'pipe', 'pipe'] });
+            console.debug(`[runners:docker] Wrote ~/.claude/settings.json to container`);
+        }
+        catch (error) {
+            console.debug('[runners:docker] Failed to copy Claude settings to container:', error);
+        }
+    }
+    else {
+        console.debug(`[runners:docker] Skipping .claude.json settings injection for ${executor} executor`);
+    }
+    return true;
+}
+/**
+ * Ensure a Docker container is running for the agent.
+ * Reuses running containers to preserve in-progress work (TKT-1028).
+ */
+export function ensureDockerContainer(context, config, executor = 'claude-code') {
+    const containerName = getContainerName(context.agentName);
+    const imageName = getImageName(context.agentName);
+    if (containerExists(containerName)) {
+        if (isContainerRunning(containerName)) {
+            const containerId = getContainerId(containerName);
+            if (containerId) {
+                console.debug(`[runners:docker] Reusing running container ${containerName} (${containerId}), skipping setup`);
+                return containerId;
+            }
+        }
+        console.debug(`[runners:docker] Removing stopped container ${containerName} to create fresh one`);
+        try {
+            execSync(`docker rm -f ${containerName}`, { stdio: 'pipe', timeout: 10000 });
+        }
+        catch {
+            // Ignore removal errors
+        }
+    }
+    const devcontainerJson = readDevcontainerJson(context.agentDir);
+    const buildArgs = {
+        TZ: devcontainerJson?.build?.args?.TZ || 'America/Los_Angeles',
+        PRLT_REGISTRY: devcontainerJson?.build?.args?.PRLT_REGISTRY || 'npm',
+    };
+    const configuredVersion = devcontainerJson?.build?.args?.PRLT_VERSION || 'latest';
+    const isTagVersion = ['latest', 'dev', 'next'].includes(configuredVersion);
+    const hostPrltVersion = isTagVersion ? getHostPrltVersion() : null;
+    if (hostPrltVersion) {
+        buildArgs.PRLT_VERSION = hostPrltVersion;
+        console.debug(`[runners:docker] Using host prlt version ${hostPrltVersion} for image build`);
+    }
+    else {
+        buildArgs.PRLT_VERSION = configuredVersion;
+    }
+    console.debug(`[runners:docker] Building image ${imageName} (PRLT_VERSION=${buildArgs.PRLT_VERSION})`);
+    if (!buildDockerImage(context.agentDir, imageName, buildArgs)) {
+        if (!imageExists(imageName)) {
+            return null;
+        }
+        console.debug(`[runners:docker] Build failed but existing image found, continuing with runtime update`);
+    }
+    const prltInfo = {
+        registry: buildArgs.PRLT_REGISTRY,
+        version: buildArgs.PRLT_VERSION,
+    };
+    console.debug(`[runners:docker] Creating container ${containerName}`);
+    if (!createDockerContainer(context, containerName, imageName, config, executor, prltInfo)) {
+        return null;
+    }
+    const containerId = getContainerId(containerName);
+    if (!containerId) {
+        return null;
+    }
+    console.debug(`[runners:docker] Running container setup (permissionMode=${config.permissionMode}, executor=${executor})`);
+    if (!runContainerSetup(containerId, config.permissionMode, executor)) {
+        console.debug(`[runners:docker] Setup failed, but continuing...`);
+    }
+    return containerId;
+}
+//# sourceMappingURL=docker-management.js.map

package/dist/lib/execution/runners/docker-management.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-management.js","sourceRoot":"","sources":["../../../../src/lib/execution/runners/docker-management.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAO7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEhD;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,EAAE;YACxC,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,CAAA;QACT,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IAC3D,OAAO,cAAc,SAAS,EAAE,CAAA;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAErD,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IAC3D,OAAO,cAAc,SAAS,SAAS,CAAA;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,aAAqB;IACnD,IAAI,CAAC;QACH,QAAQ,CAAC,4BAA4B,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CACrB,oDAAoD,aAAa,EAAE,EACnE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CACtE,CAAC,IAAI,EAAE,CAAA;QACR,OAAO,MAAM,KAAK,MAAM,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,QAAQ,CAC1B,yCAAyC,aAAa,EAAE,EACxD,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CACtE,CAAC,IAAI,EAAE,CAAA;QACR,OAAO,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,SAAiB,EAAE,YAAoC,EAAE;IAC1G,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAA;IACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,4CAA4C,cAAc,EAAE,CAAC,CAAA;QAC3E,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,GAAG,KAAK,KAAK,GAAG,CAAC;aACtD,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,MAAM,QAAQ,GAAG,mBAAmB,SAAS,QAAQ,cAAc,KAAK,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAA;QACjI,OAAO,CAAC,KAAK,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAA;QAC7D,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,CAAC;QACH,QAAQ,CAAC,wBAAwB,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/E,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAyB,EACzB,aAAqB,EACrB,SAAiB,EACjB,MAAuB,EACvB,WAAyB,aAAa,EACtC,QAAgD;IAEhD,MAAM,MAAM,GAAa;QACvB,OAAO,OAAO,CAAC,QAAQ,qBAAqB;QAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,wCAAwC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAClC,QAAQ,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,MAAM,UAAU,QAAQ,cAAc,QAAQ,UAAU,CACpF;QACD,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAA;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAA;IAC9E,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC;aACnF,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAC1C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACnD,MAAM,OAAO,GAAa;QACxB,sBAAsB;QACtB,qBAAqB;QACrB,uBAAuB,OAAO,CAAC,SAAS,GAAG;QAC3C,sBAAsB,OAAO,CAAC,QAAQ,GAAG;QACzC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,yBAAyB,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,oBAAoB,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,oCAAoC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YACb,qBAAqB,QAAQ,CAAC,QAAQ,GAAG;YACzC,oBAAoB,QAAQ,CAAC,OAAO,GAAG;SACxC,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,MAAM,aAAa,GAAG;QACpB,YAAY,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;QACxC,UAAU,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;KACrC,CAAA;IAED,MAAM,aAAa,GAAG;QACpB,qBAAqB;QACrB,mBAAmB;KACpB,CAAA;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG;YAChB,eAAe;YACf,UAAU,aAAa,EAAE;YACzB,aAAa;YACb,eAAe;YACf,GAAG,MAAM;YACT,GAAG,OAAO;YACV,GAAG,aAAa;YAChB,GAAG,aAAa;YAChB,SAAS;YACT,gBAAgB;SACjB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,SAAS,EAAE,CAAC,CAAA;QAClE,QAAQ,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,iBAAiC,MAAM,EAAE,WAAyB,aAAa;IACpI,IAAI,CAAC;QACH,QAAQ,CAAC,eAAe,WAAW,uCAAuC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9F,QAAQ,CAAC,eAAe,WAAW,+BAA+B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,CAAC,eAAe,WAAW,4CAA4C,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACnG,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8EAA8E,EAAE,KAAK,CAAC,CAAA;IACtG,CAAC;IAED,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAA;YAC9D,IAAI,QAAQ,GAA4B,EAAE,CAAA;YAC1C,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAA;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAA;gBAC3F,CAAC;YACH,CAAC;YACD,IAAI,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAChC,QAAQ,CAAC,6BAA6B,GAAG,IAAI,CAAA;YAC/C,CAAC;YACD,QAAQ,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAA;YAChD,QAAQ,CAAC,sBAAsB,GAAG,IAAI,CAAA;YACtC,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAA;YACzC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACtE,QAAQ,CAAC,WAAW,GAAG,EAAE,CAAA;YAC3B,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAqC,CAAA;YAC3D,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;YACtD,QAAQ,CAAC,sBAAsB,GAAG,IAAI,CAAA;YACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChE,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAA;YACxB,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAmD,CAAA;YAC7E,KAAK,MAAM,WAAW,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;gBAC5B,CAAC;gBACD,QAAQ,CAAC,WAAW,CAAC,CAAC,sBAAsB,GAAG,IAAI,CAAA;gBACnD,QAAQ,CAAC,WAAW,CAAC,CAAC,6BAA6B,GAAG,IAAI,CAAA;YAC5D,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC7C,QAAQ,CACN,kBAAkB,WAAW,0CAA0C,EACvE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACzD,CAAA;YACD,OAAO,CAAC,KAAK,CAAC,6FAA6F,cAAc,KAAK,QAAQ,GAAG,CAAC,CAAA;YAE1I,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAA;YAClF,QAAQ,CACN,kBAAkB,WAAW,kFAAkF,EAC/G,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAC3D,CAAA;YACD,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAA;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,EAAE,KAAK,CAAC,CAAA;QACvF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,iEAAiE,QAAQ,WAAW,CAAC,CAAA;IACrG,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAyB,EACzB,MAAuB,EACvB,WAAyB,aAAa;IAEtC,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAEjD,IAAI,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;QACnC,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,8CAA8C,aAAa,KAAK,WAAW,mBAAmB,CAAC,CAAA;gBAC7G,OAAO,WAAW,CAAA;YACpB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,+CAA+C,aAAa,sBAAsB,CAAC,CAAA;QACjG,IAAI,CAAC;YACH,QAAQ,CAAC,gBAAgB,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/D,MAAM,SAAS,GAA2B;QACxC,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,qBAAqB;QAC9D,aAAa,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAI,KAAK;KACrE,CAAA;IAED,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,IAAI,QAAQ,CAAA;IACjF,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAC1E,MAAM,eAAe,GAAG,YAAY,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAElE,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,CAAC,YAAY,GAAG,eAAe,CAAA;QACxC,OAAO,CAAC,KAAK,CAAC,4CAA4C,eAAe,kBAAkB,CAAC,CAAA;IAC9F,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,YAAY,GAAG,iBAAiB,CAAA;IAC5C,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,mCAAmC,SAAS,kBAAkB,SAAS,CAAC,YAAY,GAAG,CAAC,CAAA;IACtG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAA;IACzG,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,QAAQ,EAAE,SAAS,CAAC,aAAa;QACjC,OAAO,EAAE,SAAS,CAAC,YAAY;KAChC,CAAA;IAED,OAAO,CAAC,KAAK,CAAC,uCAAuC,aAAa,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;IACjD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,4DAA4D,MAAM,CAAC,cAAc,cAAc,QAAQ,GAAG,CAAC,CAAA;IACzH,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/lib/execution/runners/docker.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Docker Runner
+ *
+ * Runs commands in detached Docker containers.
+ * Uses simple docker run for standalone container execution.
+ */
+import { ExecutorType, ExecutionContext, ExecutionConfig } from './shared.js';
+import { RunnerResult } from './shared.js';
+/**
+ * Run command in a detached Docker container.
+ * Uses simple docker run with -d flag for background execution.
+ */
+export declare function runDocker(context: ExecutionContext, executor: ExecutorType, config: ExecutionConfig): Promise<RunnerResult>;

package/dist/lib/execution/runners/docker.js

@@ -0,0 +1,75 @@
+/**
+ * Docker Runner
+ *
+ * Runs commands in detached Docker containers.
+ * Uses simple docker run for standalone container execution.
+ */
+import { execSync, validateCodexMode, } from './shared.js';
+import { buildPrompt, getExecutorCommand, isClaudeExecutor, checkDockerDaemon, } from './shared.js';
+/**
+ * Run command in a detached Docker container.
+ * Uses simple docker run with -d flag for background execution.
+ */
+export async function runDocker(context, executor, config) {
+    const prompt = buildPrompt(context);
+    const containerName = `work-${context.ticketId}-${Date.now()}`;
+    try {
+        // Check if docker is available and daemon is responsive (TKT-081)
+        const dockerStatus = checkDockerDaemon();
+        if (!dockerStatus.available) {
+            return {
+                success: false,
+                error: `Docker daemon is not available. ${dockerStatus.message}`,
+            };
+        }
+        // Build docker run command
+        let dockerCmd = `docker run -d --name ${containerName}`;
+        dockerCmd += ` -v "${context.worktreePath}:/workspace"`;
+        dockerCmd += ` -w /workspace`;
+        dockerCmd += ` -e TICKET_ID="${context.ticketId}"`;
+        if (config.docker.network) {
+            dockerCmd += ` --network ${config.docker.network}`;
+        }
+        if (config.docker.memory) {
+            dockerCmd += ` --memory ${config.docker.memory}`;
+        }
+        if (config.docker.cpus) {
+            dockerCmd += ` --cpus ${config.docker.cpus}`;
+        }
+        // Validate Codex mode: Docker runner is always non-tty (detached with -d)
+        if (executor === 'codex') {
+            const codexPermission = config.permissionMode;
+            const modeError = validateCodexMode(codexPermission, 'non-tty');
+            if (modeError) {
+                return { success: false, error: modeError.message };
+            }
+        }
+        // Build executor command using getExecutorCommand() for correct invocation
+        const escapedPrompt = prompt.replace(/'/g, "'\\''");
+        const { cmd, args } = getExecutorCommand(executor, escapedPrompt, config.permissionMode === 'danger');
+        // For Claude Code in Docker, use --print for non-interactive output
+        // Non-Claude executors use their native command format from getExecutorCommand()
+        dockerCmd += ` ${config.docker.image}`;
+        if (isClaudeExecutor(executor)) {
+            // TKT-053: Disable plan mode — Docker runner is always detached (no user to approve)
+            // PRLT-950: Use -- to separate flags from positional prompt argument.
+            dockerCmd += ` ${cmd} --print --disallowedTools EnterPlanMode -- '${escapedPrompt}'`;
+        }
+        else {
+            const argsStr = args.map(a => a === escapedPrompt ? `'${escapedPrompt}'` : a).join(' ');
+            dockerCmd += ` ${cmd} ${argsStr}`;
+        }
+        const containerId = execSync(dockerCmd, { encoding: 'utf-8' }).trim();
+        return {
+            success: true,
+            containerId: containerId.substring(0, 12),
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Failed to start docker container',
+        };
+    }
+}
+//# sourceMappingURL=docker.js.map

package/dist/lib/execution/runners/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../../../src/lib/execution/runners/docker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,QAAQ,EAKR,iBAAiB,GAClB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAEL,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAA;AAEpB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAyB,EACzB,QAAsB,EACtB,MAAuB;IAEvB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,aAAa,GAAG,QAAQ,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IAE9D,IAAI,CAAC;QACH,kEAAkE;QAClE,MAAM,YAAY,GAAG,iBAAiB,EAAE,CAAA;QACxC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,mCAAmC,YAAY,CAAC,OAAO,EAAE;aACjE,CAAA;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,SAAS,GAAG,wBAAwB,aAAa,EAAE,CAAA;QACvD,SAAS,IAAI,QAAQ,OAAO,CAAC,YAAY,cAAc,CAAA;QACvD,SAAS,IAAI,gBAAgB,CAAA;QAC7B,SAAS,IAAI,kBAAkB,OAAO,CAAC,QAAQ,GAAG,CAAA;QAElD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,SAAS,IAAI,cAAc,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QACpD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACzB,SAAS,IAAI,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;QAClD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACvB,SAAS,IAAI,WAAW,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC9C,CAAC;QAED,0EAA0E;QAC1E,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,eAAe,GAAmB,MAAM,CAAC,cAAc,CAAA;YAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;YAC/D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,CAAA;YACrD,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACnD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAA;QAErG,oEAAoE;QACpE,iFAAiF;QACjF,SAAS,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACtC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,qFAAqF;YACrF,sEAAsE;YACtE,SAAS,IAAI,IAAI,GAAG,gDAAgD,aAAa,GAAG,CAAA;QACtF,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACvF,SAAS,IAAI,IAAI,GAAG,IAAI,OAAO,EAAE,CAAA;QACnC,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAErE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;SAC1C,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC;SACnF,CAAA;IACH,CAAC;AACH,CAAC"}