@rallycry/conveyor-agent 10.13.14 → 10.13.16

package/dist/boot-NMXFM4GK.js

@@ -0,0 +1,1268 @@
+import {
+  TOMBSTONE_MESSAGE,
+  isLegacyEntrypointLaunch
+} from "./chunk-6GS5ADIY.js";
+import {
+  GitPrepJob,
+  defaultGit,
+  ensureDir,
+  readAgentVersion,
+  redactToken
+} from "./chunk-UZTJJD7Y.js";
+import {
+  workbenchPort
+} from "./chunk-4VUQ2NPF.js";
+import {
+  startWorkbenchServer
+} from "./chunk-5UYMDSAE.js";
+import "./chunk-JG54UJ6V.js";
+import {
+  DEFAULT_WORKBENCH_PORT
+} from "./chunk-JIGG755T.js";
+
+// src/boot/index.ts
+import { spawn } from "child_process";
+import { statSync as statSync3 } from "fs";
+import { hostname as osHostname } from "os";
+
+// src/boot/bundle.ts
+function requireString(source, field) {
+  const value = source[field];
+  if (typeof value !== "string") {
+    throw new Error(`bundle missing field: ${field}`);
+  }
+  return value;
+}
+function parseGitPlan(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error("bundle missing field: gitPlan");
+  }
+  const obj = raw;
+  const plan = {
+    repoOwner: requireString(obj, "repoOwner"),
+    repoName: requireString(obj, "repoName"),
+    branch: requireString(obj, "branch"),
+    baseBranch: requireString(obj, "baseBranch")
+  };
+  if (typeof obj.checkoutRef === "string") {
+    plan.checkoutRef = obj.checkoutRef;
+  }
+  return plan;
+}
+function parseBundle(text) {
+  const raw = JSON.parse(text);
+  const envVarsRaw = raw.envVars;
+  const envVars = envVarsRaw !== null && envVarsRaw !== void 0 && typeof envVarsRaw === "object" ? envVarsRaw : {};
+  const typed = {
+    sessionJwt: requireString(raw, "sessionJwt"),
+    githubToken: requireString(raw, "githubToken"),
+    anthropicKey: requireString(raw, "anthropicKey"),
+    gcpToken: requireString(raw, "gcpToken"),
+    envVars,
+    gitPlan: parseGitPlan(raw.gitPlan)
+  };
+  return { ...raw, ...typed };
+}
+function decodeJwtClaims(jwt) {
+  try {
+    const segment = jwt.split(".")[1] ?? "";
+    const normalized = segment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+    const json = Buffer.from(padded, "base64").toString("utf8");
+    const parsed = JSON.parse(json);
+    if (typeof parsed !== "object" || parsed === null) {
+      return {};
+    }
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function resolveModeEnv(claims) {
+  if (claims.mode === "review") return { CONVEYOR_MODE: "code-review" };
+  if (claims.mode === "pack") return { CONVEYOR_MODE: "pack" };
+  if (claims.mode === "adhoc") return { CONVEYOR_MODE: "adhoc" };
+  if (!claims.taskId && claims.projectId) return { CONVEYOR_MODE: "pm" };
+  return {};
+}
+var ENV_KEY_DENYLIST = /* @__PURE__ */ new Set([
+  "PATH",
+  "HOME",
+  "LD_PRELOAD",
+  "SHELL"
+]);
+var IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function buildChildEnv(opts) {
+  const { base, bundle, claims, hostname, log } = opts;
+  const child = {};
+  for (const [k, v] of Object.entries(base)) {
+    if (typeof v === "string") child[k] = v;
+  }
+  for (const [key, value] of Object.entries(bundle.envVars ?? {})) {
+    if (!IDENTIFIER_RE.test(key)) {
+      log.warn(`[boot] WARN skipping invalid env key from bundle: '${key}'`);
+      continue;
+    }
+    if (ENV_KEY_DENYLIST.has(key)) {
+      log.warn(`[boot] WARN skipping denylisted env key from bundle: '${key}'`);
+      continue;
+    }
+    child[key] = value;
+  }
+  const setIf = (k, v) => {
+    if (v) child[k] = v;
+  };
+  setIf("CONVEYOR_TASK_TOKEN", bundle.sessionJwt);
+  setIf("CONVEYOR_GITHUB_TOKEN", bundle.githubToken);
+  setIf("GH_TOKEN", bundle.githubToken);
+  setIf("ANTHROPIC_API_KEY", bundle.anthropicKey);
+  setIf("CLOUDSDK_AUTH_ACCESS_TOKEN", bundle.gcpToken);
+  setIf("REPO_OWNER", bundle.gitPlan.repoOwner);
+  setIf("REPO_NAME", bundle.gitPlan.repoName);
+  setIf("BRANCH", bundle.gitPlan.branch);
+  setIf("CONVEYOR_TASK_ID", claims.taskId);
+  setIf("CONVEYOR_PROJECT_ID", claims.projectId);
+  setIf("CONVEYOR_SESSION_ID", claims.sessionId);
+  setIf("CONVEYOR_WORKSPACE_ID", claims.workspaceId);
+  Object.assign(child, resolveModeEnv(claims));
+  child.CLAUDESPACE_NAME = hostname;
+  child.CONVEYOR_WORKSPACE = opts.workspaceDir ?? "/workspaces/repo";
+  child.CONVEYOR_BOOT_VNEXT = "1";
+  return child;
+}
+
+// src/boot/graphify.ts
+var USER_HOME_MOUNT = "/mnt/conveyor-users";
+function computeGraphifyEnv(env, repoName, dirExists) {
+  if (env.CONVEYOR_GRAPHIFY_DISABLE === "1") {
+    return {};
+  }
+  const slug = env.CONVEYOR_GRAPHIFY_SLUG || repoName;
+  if (!slug) {
+    return {};
+  }
+  const primaryRoot = `${USER_HOME_MOUNT}/users/_shared/graphify`;
+  const legacyRoot = `${USER_HOME_MOUNT}/_shared/graphify`;
+  let sharedRoot = env.CONVEYOR_GRAPHIFY_SHARED_ROOT;
+  if (!sharedRoot) {
+    sharedRoot = dirExists(primaryRoot) || !dirExists(legacyRoot) ? primaryRoot : legacyRoot;
+  }
+  const dir = env.CONVEYOR_GRAPHIFY_DIR || `${sharedRoot}/${slug}/latest`;
+  const graph = env.CONVEYOR_GRAPHIFY_GRAPH || `${dir}/graph.json`;
+  return {
+    CONVEYOR_GRAPHIFY_SLUG: slug,
+    CONVEYOR_GRAPHIFY_SHARED_ROOT: sharedRoot,
+    CONVEYOR_GRAPHIFY_DIR: dir,
+    CONVEYOR_GRAPHIFY_GRAPH: graph
+  };
+}
+
+// src/boot/logger.ts
+import { appendFileSync } from "fs";
+var BOOTSTRAP_LOG_PATH = "/tmp/claudespace-bootstrap.log";
+function createBootLogger(filePath = BOOTSTRAP_LOG_PATH) {
+  const emit = (line) => {
+    process.stdout.write(`${line}
+`);
+    if (filePath) {
+      try {
+        appendFileSync(filePath, `${line}
+`);
+      } catch {
+      }
+    }
+  };
+  return { info: emit, warn: emit, error: emit };
+}
+
+// src/boot/types.ts
+var BootFatalError = class extends Error {
+  constructor(step, message, options) {
+    super(`[boot] FATAL step=${step}: ${message}`, options);
+    this.step = step;
+    this.name = "BootFatalError";
+  }
+  step;
+};
+
+// src/boot/pipeline.ts
+async function runPipeline(steps, ctx) {
+  const t0 = Date.now();
+  const timings = [];
+  for (const step of steps) {
+    const s0 = Date.now();
+    try {
+      await step.run(ctx);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (step.critical) {
+        ctx.log.error(`[boot] FATAL step=${step.name}: ${msg}`);
+        throw err instanceof BootFatalError ? err : new BootFatalError(step.name, msg, { cause: err });
+      }
+      ctx.log.warn(`[boot] WARN step=${step.name} degraded: ${msg}`);
+    }
+    const ms = Date.now() - s0;
+    timings.push(`${step.name}:${ms}`);
+    ctx.log.info(`[boot] step=${step.name} ms=${ms}`);
+  }
+  ctx.log.info(
+    `[boot] timeline role=${ctx.role} total=${Date.now() - t0} steps=${timings.join(",")}`
+  );
+}
+
+// src/boot/poll.ts
+var BootstrapUnauthorizedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BootstrapUnauthorizedError";
+  }
+};
+var PROGRESS_LOG_EVERY = 30;
+var DEFAULT_POLL_INTERVAL_MS = 2e3;
+function sleepUnlessAborted(sleepFn, ms, signal) {
+  if (!signal) return sleepFn(ms);
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const onAbort = () => {
+      resolve();
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    void sleepFn(ms).then(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    });
+  });
+}
+async function pollBootstrapBundle(apiUrl, token, deps) {
+  const interval = deps.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  let pollCount = 0;
+  while (true) {
+    if (deps.signal?.aborted) return null;
+    let res;
+    try {
+      res = await deps.fetchFn(`${apiUrl}/api/v3/pods/bootstrap`, {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: deps.signal
+      });
+    } catch {
+      if (deps.signal?.aborted) return null;
+      res = void 0;
+    }
+    if (res?.status === 200) {
+      return parseBundle(await res.text());
+    }
+    if (res?.status === 401) {
+      throw new BootstrapUnauthorizedError("bootstrap token rejected (401) \u2014 pod identity invalid");
+    }
+    pollCount++;
+    if (pollCount % PROGRESS_LOG_EVERY === 0) {
+      deps.log.info(`[boot] Still waiting for bind (poll #${pollCount})...`);
+    }
+    await sleepUnlessAborted(deps.sleepFn, interval, deps.signal);
+  }
+}
+
+// src/boot/self-update.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var AGENT_PACKAGE = "@rallycry/conveyor-agent";
+var NPM_VIEW_TIMEOUT_MS = 3e3;
+var NPM_INSTALL_TIMEOUT_MS = 12e4;
+var NPM_CACHE_DIR = "/tmp/npm-cache";
+var NPM_REGISTRY_ARG = "--@rallycry:registry=https://registry.npmjs.org/";
+var SEMVER_RE = /^\d+\.\d+\.\d+([-+][A-Za-z0-9.-]+)?$/;
+function isValidSemver(value) {
+  return SEMVER_RE.test(value);
+}
+function isStrictlyNewer(candidate, installed) {
+  const num = (v) => (v.split(/[-+]/)[0] ?? "").split(".").map((p) => Number(p));
+  const [a, b] = [num(candidate), num(installed)];
+  for (let i = 0; i < 3; i++) {
+    const av = a[i] ?? 0;
+    const bv = b[i] ?? 0;
+    if (av !== bv) return av > bv;
+  }
+  return false;
+}
+var execFileAsync = promisify(execFile);
+function defaultExec(cmd, args, opts) {
+  return execFileAsync(cmd, args, { timeout: opts.timeoutMs });
+}
+async function runPreflightUpdate(deps) {
+  let latest = "";
+  try {
+    const { stdout } = await deps.exec(
+      "npm",
+      ["view", "--cache", NPM_CACHE_DIR, NPM_REGISTRY_ARG, AGENT_PACKAGE, "version"],
+      { timeoutMs: NPM_VIEW_TIMEOUT_MS }
+    );
+    latest = stdout.replace(/\s+/g, "");
+  } catch (err) {
+    deps.log.warn(
+      `[boot] WARN preflight npm view failed (${err instanceof Error ? err.message : err}); keeping baked version`
+    );
+    return "skipped";
+  }
+  if (!isValidSemver(latest)) {
+    deps.log.warn(
+      `[boot] WARN preflight got non-semver '${latest}' from npm; keeping baked version`
+    );
+    return "skipped";
+  }
+  let installed = "";
+  try {
+    installed = (await deps.installedVersion()).trim();
+  } catch (err) {
+    deps.log.warn(
+      `[boot] WARN preflight installed-version lookup failed (${err instanceof Error ? err.message : err}); keeping baked version`
+    );
+    return "skipped";
+  }
+  if (!isValidSemver(installed) || isStrictlyNewer(latest, installed)) {
+    deps.log.info(
+      `[boot] preflight updating ${AGENT_PACKAGE} ${installed || "unknown"} -> ${latest}`
+    );
+    try {
+      await deps.exec(
+        "sudo",
+        [
+          "npm",
+          "install",
+          "-g",
+          "--cache",
+          NPM_CACHE_DIR,
+          "--silent",
+          `${AGENT_PACKAGE}@${latest}`
+        ],
+        { timeoutMs: NPM_INSTALL_TIMEOUT_MS }
+      );
+      return "updated";
+    } catch (err) {
+      deps.log.warn(
+        `[boot] WARN preflight install failed (${err instanceof Error ? err.message : err}); keeping baked version`
+      );
+      return "skipped";
+    }
+  }
+  deps.log.info(`[boot] preflight agent ${installed} is current (registry ${latest})`);
+  return "current";
+}
+
+// src/boot/supervisor.ts
+import { spawn as spawnChildProcess } from "child_process";
+import { appendFileSync as appendFileSync2, writeFileSync } from "fs";
+import { join } from "path";
+
+// src/boot/crash-report.ts
+var CRASH_REPORT_TIMEOUT_MS = 1e4;
+async function reportAgentCrash(apiUrl, bootstrapToken, report, fetchFn = fetch) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CRASH_REPORT_TIMEOUT_MS);
+  try {
+    await fetchFn(`${apiUrl}/api/v3/pods/agent-crash`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${bootstrapToken}`
+      },
+      body: JSON.stringify(report),
+      signal: controller.signal
+    });
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/boot/supervisor.ts
+var AGENT_CRASH_MAX = 3;
+var AGENT_LOG_PATH = "/tmp/claudespace-agent.log";
+var LAUNCH_MARKER_NAME = "conveyor-agent-launching";
+var RESTARTING_MARKER_NAME = "conveyor-agent-restarting";
+var LAUNCH_MARKER = `/tmp/${LAUNCH_MARKER_NAME}`;
+var RESTARTING_MARKER = `/tmp/${RESTARTING_MARKER_NAME}`;
+var DEFAULT_CRASH_BACKOFF_MS = 1e4;
+var DEFAULT_DRAIN_TIMEOUT_MS = 45e3;
+var DEFAULT_MARKER_DIR = "/tmp";
+function touchMarker(path, log) {
+  try {
+    writeFileSync(path, "");
+  } catch (err) {
+    log.warn(
+      `[boot] WARN failed to write liveness marker ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function teeChildOutput(child) {
+  const onData = (chunk) => {
+    process.stdout.write(chunk);
+    try {
+      appendFileSync2(AGENT_LOG_PATH, chunk);
+    } catch {
+    }
+  };
+  child.stdout?.on("data", onData);
+  child.stderr?.on("data", onData);
+}
+function spawnAgent(spawnFn, opts) {
+  return spawnFn("conveyor-agent", [], {
+    cwd: opts.cwd,
+    env: opts.childEnv,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function waitForExit(child) {
+  return new Promise((resolve) => {
+    child.once("exit", (code, signal) => {
+      resolve(code ?? (signal ? 1 : 0));
+    });
+    child.once("error", () => resolve(1));
+  });
+}
+function whenAborted(signal) {
+  return new Promise((resolve) => {
+    if (!signal) return;
+    if (signal.aborted) {
+      resolve();
+      return;
+    }
+    signal.addEventListener("abort", () => resolve(), { once: true });
+  });
+}
+function sleepUnlessAborted2(ms, signal) {
+  if (!signal) {
+    return new Promise((resolve) => {
+      setTimeout(resolve, ms);
+    });
+  }
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function drainChild(child, exitPromise, drainTimeoutMs, log) {
+  log.info("[boot] SIGTERM received, draining agent...");
+  child.kill("SIGTERM");
+  const TIMED_OUT = /* @__PURE__ */ Symbol("drain-timeout");
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(TIMED_OUT), drainTimeoutMs);
+  });
+  const winner = await Promise.race([exitPromise, timeout]);
+  if (timer) clearTimeout(timer);
+  if (winner === TIMED_OUT) {
+    log.warn(`[boot] agent did not exit within drainTimeoutMs=${drainTimeoutMs}ms \u2014 SIGKILL`);
+    child.kill("SIGKILL");
+    await exitPromise;
+  }
+  return 0;
+}
+async function superviseRunner(opts) {
+  const spawnFn = opts.spawnFn ?? spawnChildProcess;
+  const reportFn = opts.reportFn ?? reportAgentCrash;
+  const crashBackoffMs = opts.crashBackoffMs ?? DEFAULT_CRASH_BACKOFF_MS;
+  const drainTimeoutMs = opts.drainTimeoutMs ?? DEFAULT_DRAIN_TIMEOUT_MS;
+  const markerDir = opts.markerDir ?? DEFAULT_MARKER_DIR;
+  const launchMarkerPath = join(markerDir, LAUNCH_MARKER_NAME);
+  const restartingMarkerPath = join(markerDir, RESTARTING_MARKER_NAME);
+  touchMarker(launchMarkerPath, opts.log);
+  let attempt = 0;
+  while (true) {
+    attempt++;
+    opts.log.info("[boot] Launching agent...");
+    const child = spawnAgent(spawnFn, opts);
+    teeChildOutput(child);
+    const exitPromise = waitForExit(child);
+    const winner = await Promise.race([
+      exitPromise.then((code) => ({ type: "exit", code })),
+      whenAborted(opts.signal).then(() => ({ type: "abort" }))
+    ]);
+    if (winner.type === "abort") {
+      return await drainChild(child, exitPromise, drainTimeoutMs, opts.log);
+    }
+    const exitCode = winner.code;
+    if (exitCode === 0) {
+      opts.log.info("[boot] agent exited cleanly (code 0), shutting down pod.");
+      return 0;
+    }
+    if (attempt >= AGENT_CRASH_MAX) {
+      opts.log.error(
+        `[boot] agent crashed (code ${exitCode}) \u2014 attempt cap ${AGENT_CRASH_MAX} reached, giving up.`
+      );
+      await reportFn(opts.apiUrl, opts.bootstrapToken, { exitCode, attempt, final: true });
+      return 1;
+    }
+    touchMarker(restartingMarkerPath, opts.log);
+    await reportFn(opts.apiUrl, opts.bootstrapToken, { exitCode, attempt, final: false });
+    opts.log.warn(
+      `[boot] agent crashed (code ${exitCode}), retrying in ${crashBackoffMs}ms (attempt ${attempt}/${AGENT_CRASH_MAX})...`
+    );
+    await sleepUnlessAborted2(crashBackoffMs, opts.signal);
+    if (opts.signal?.aborted) {
+      return 0;
+    }
+  }
+}
+
+// src/boot/user-home.ts
+import {
+  chmodSync,
+  copyFileSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname, join as join2 } from "path";
+var SEED_GATES = {
+  hasCompletedOnboarding: true,
+  bypassPermissionsModeAccepted: true,
+  projects: {
+    "/workspaces/repo": { hasTrustDialogAccepted: true }
+  }
+};
+var SEED_FABLE_OPTION = {
+  value: "claude-fable-5[1m]",
+  label: "Fable",
+  description: "Fable 5 - most capable for your hardest and longest-running tasks"
+};
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepMerge(target, patch) {
+  const out = { ...target };
+  for (const [k, v] of Object.entries(patch)) {
+    const cur = out[k];
+    out[k] = isPlainObject(cur) && isPlainObject(v) ? deepMerge(cur, v) : v;
+  }
+  return out;
+}
+function hasFableEntry(cache) {
+  return cache.some((entry) => {
+    if (!isPlainObject(entry)) return false;
+    const value = entry.value;
+    return typeof value === "string" && value.toLowerCase().includes("fable");
+  });
+}
+function seedClaudeJson(targetPath) {
+  try {
+    let config = null;
+    try {
+      const parsed = JSON.parse(readFileSync(targetPath, "utf8"));
+      if (isPlainObject(parsed)) config = parsed;
+    } catch {
+    }
+    let merged = config ? deepMerge(config, SEED_GATES) : { ...SEED_GATES, theme: "dark" };
+    const cache = Array.isArray(merged.additionalModelOptionsCache) ? merged.additionalModelOptionsCache : [];
+    if (!hasFableEntry(cache)) {
+      merged = { ...merged, additionalModelOptionsCache: [...cache, SEED_FABLE_OPTION] };
+    }
+    writeFileSync2(targetPath, JSON.stringify(merged));
+  } catch {
+  }
+}
+function isDir(path) {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isRegularFile(path) {
+  try {
+    return lstatSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function safely(log, label, fn) {
+  try {
+    fn();
+  } catch (err) {
+    log.warn(`[boot] WARN ${label} failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function relink(target, link) {
+  mkdirSync(dirname(link), { recursive: true });
+  rmSync(link, { recursive: true, force: true });
+  symlinkSync(target, link);
+}
+function wireCredentials(opts) {
+  const { home, root, sharedDir, log } = opts;
+  const shared = join2(root, ".claude", ".credentials.json");
+  const podLocal = sharedDir ? join2(sharedDir, "claude-credentials.pod.json") : join2(home, ".claude-credentials.pod.json");
+  safely(log, "carry legacy shared credentials", () => {
+    if (isRegularFile(shared)) copyFileSync(shared, podLocal);
+  });
+  safely(log, "repoint credentials symlink", () => relink(podLocal, shared));
+  safely(log, "chmod pod-local credentials", () => chmodSync(podLocal, 384));
+}
+function wireMountedUserHome(opts) {
+  const { home, userHomeMount, userId, projectId, sharedDir, log } = opts;
+  const root = join2(userHomeMount, "users", userId, projectId);
+  safely(log, "mkdir user-home root", () => {
+    mkdirSync(join2(root, ".claude"), { recursive: true });
+    mkdirSync(join2(root, ".config", "claude"), { recursive: true });
+  });
+  safely(log, "wire ~/.claude symlink", () => relink(join2(root, ".claude"), join2(home, ".claude")));
+  safely(
+    log,
+    "wire ~/.config/claude symlink",
+    () => relink(join2(root, ".config", "claude"), join2(home, ".config", "claude"))
+  );
+  safely(log, "seed pod-local ~/.claude.json", () => {
+    rmSync(join2(home, ".claude.json"), { recursive: true, force: true });
+    seedClaudeJson(join2(home, ".claude.json"));
+  });
+  wireCredentials({ home, root, sharedDir, log });
+  safely(log, "mkdir opencode root", () => {
+    mkdirSync(join2(root, ".local", "share", "opencode"), { recursive: true });
+    mkdirSync(join2(root, ".config", "opencode"), { recursive: true });
+  });
+  safely(
+    log,
+    "wire opencode data symlink",
+    () => relink(join2(root, ".local", "share", "opencode"), join2(home, ".local", "share", "opencode"))
+  );
+  safely(
+    log,
+    "wire opencode config symlink",
+    () => relink(join2(root, ".config", "opencode"), join2(home, ".config", "opencode"))
+  );
+}
+function wireNoMountUserHome(opts) {
+  const { home, sharedDir, log } = opts;
+  safely(
+    log,
+    "seed pod-local ~/.claude.json (no mount)",
+    () => seedClaudeJson(join2(home, ".claude.json"))
+  );
+  if (sharedDir) {
+    safely(log, "wire ~/.claude to shared emptyDir", () => {
+      const target = join2(sharedDir, "claude-home", ".claude");
+      mkdirSync(target, { recursive: true });
+      relink(target, join2(home, ".claude"));
+    });
+  }
+}
+function wireUserHome(opts) {
+  const { home, userHomeMount, userId, projectId, sharedDir, log } = opts;
+  if (userId && projectId && isDir(userHomeMount)) {
+    wireMountedUserHome({ home, userHomeMount, userId, projectId, sharedDir, log });
+  } else {
+    wireNoMountUserHome({ home, sharedDir, log });
+  }
+}
+var RECLAIM_FIND_TIMEOUT_MS = 1e4;
+async function reclaimHomeOwnership(home, exec, log) {
+  for (const dir of [join2(home, ".config"), join2(home, ".local")]) {
+    if (!isDir(dir)) continue;
+    try {
+      await exec(
+        "sudo",
+        [
+          "-n",
+          "find",
+          dir,
+          "!",
+          "-user",
+          "conveyor",
+          "-exec",
+          "chown",
+          "conveyor:conveyor",
+          "{}",
+          "+"
+        ],
+        { timeoutMs: RECLAIM_FIND_TIMEOUT_MS }
+      );
+    } catch (err) {
+      log.warn(
+        `[boot] WARN reclaim_home_ownership failed for ${dir}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+}
+
+// src/boot/sshd.ts
+import { chmodSync as chmodSync2, closeSync, existsSync, mkdirSync as mkdirSync2, openSync } from "fs";
+import { join as join3 } from "path";
+async function startWorkspaceSshd(exec, log, port = process.env.CONVEYOR_WORKSPACE_SSH_PORT || "2222", home = "/home/conveyor") {
+  try {
+    const sshDir = join3(home, ".ssh");
+    mkdirSync2(sshDir, { recursive: true });
+    chmodSync2(sshDir, 448);
+    const authorizedKeys = join3(sshDir, "authorized_keys");
+    if (!existsSync(authorizedKeys)) closeSync(openSync(authorizedKeys, "a"));
+    chmodSync2(authorizedKeys, 384);
+  } catch (err) {
+    log.warn(
+      `[boot] WARN: workspace SSHD key setup failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return;
+  }
+  if (!existsSync("/usr/sbin/sshd")) {
+    log.warn("[boot] WARN: workspace SSHD unavailable");
+    return;
+  }
+  try {
+    await exec("sudo", ["mkdir", "-p", "/run/sshd"], { timeoutMs: 1e4 });
+    await exec("sudo", ["/usr/sbin/sshd", "-o", "ListenAddress=0.0.0.0", "-o", `Port=${port}`], {
+      timeoutMs: 1e4
+    });
+    log.info(`[boot] Workspace SSHD listening on 0.0.0.0:${port}`);
+  } catch {
+    log.warn("[boot] WARN: workspace SSHD failed to start");
+  }
+}
+
+// src/boot/workspace-extras.ts
+import {
+  existsSync as existsSync2,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync3,
+  readdirSync,
+  rmSync as rmSync2,
+  statSync as statSync2,
+  symlinkSync as symlinkSync2
+} from "fs";
+import { join as join4 } from "path";
+function errText(err) {
+  return redactToken(err instanceof Error ? err.message : String(err));
+}
+function isDir2(path) {
+  try {
+    return statSync2(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isSymlink(path) {
+  try {
+    return lstatSync2(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+var GRAPHIFY_BUNDLE_FILES = [
+  "graph.json",
+  "GRAPH_REPORT.md",
+  "manifest.json",
+  ".graphify_analysis.json",
+  ".graphify_labels.json",
+  "publish-manifest.json",
+  "cost.json"
+];
+function bindGraphifyBundle(workspace, graphifyEnv, log) {
+  const slug = graphifyEnv.CONVEYOR_GRAPHIFY_SLUG;
+  const sourceDir = graphifyEnv.CONVEYOR_GRAPHIFY_DIR;
+  const graphFile = graphifyEnv.CONVEYOR_GRAPHIFY_GRAPH;
+  if (!slug || !sourceDir || !graphFile) return;
+  if (!existsSync2(graphFile)) {
+    log.info(`[boot] Graphify bundle not found for '${slug}' at ${sourceDir}`);
+    return;
+  }
+  const targetDir = join4(workspace, "graphify-out");
+  try {
+    mkdirSync3(targetDir, { recursive: true });
+  } catch {
+    log.warn(`[boot] WARN: unable to create graphify-out at ${targetDir}`);
+    return;
+  }
+  for (const rel of GRAPHIFY_BUNDLE_FILES) {
+    const source = join4(sourceDir, rel);
+    const target = join4(targetDir, rel);
+    if (!existsSync2(source)) continue;
+    if (existsSync2(target) || isSymlink(target)) continue;
+    try {
+      symlinkSync2(source, target);
+    } catch {
+    }
+  }
+  log.info(`[boot] Bound graphify bundle '${slug}' into ${targetDir}`);
+}
+async function ensureGrimoireSubmodule(workspace, githubToken, git, log) {
+  try {
+    if (!existsSync2(join4(workspace, ".gitmodules"))) return;
+    let paths = "";
+    try {
+      ({ stdout: paths } = await git(
+        ["config", "--file", ".gitmodules", "--get-regexp", String.raw`submodule\..*\.path`],
+        { cwd: workspace, timeoutMs: 1e4 }
+      ));
+    } catch {
+      return;
+    }
+    if (!paths.split("\n").some((line) => line.trim().endsWith(".claude/grimoire"))) return;
+    if (isDir2(join4(workspace, ".claude", "grimoire", "skills"))) return;
+    if (!githubToken) {
+      log.warn("[boot] WARN: grimoire submodule absent and no token to fetch it");
+      return;
+    }
+    try {
+      await git(
+        [
+          "-c",
+          `url.https://x-access-token:${githubToken}@github.com/.insteadOf=https://github.com/`,
+          "submodule",
+          "update",
+          "--init",
+          ".claude/grimoire"
+        ],
+        { cwd: workspace, timeoutMs: 3e5 }
+      );
+      log.info("[boot] Initialized grimoire submodule");
+    } catch (err) {
+      log.warn(
+        `[boot] WARN: grimoire submodule init failed (baked pods may lack rc-* skills): ${errText(err)}`
+      );
+    }
+  } catch (err) {
+    log.warn(`[boot] WARN: grimoire submodule check failed: ${errText(err)}`);
+  }
+}
+function linkGrimoireSkills(workspace, log) {
+  const sourceDir = join4(workspace, ".claude", "grimoire", "skills");
+  const targetDir = join4(workspace, ".claude", "skills");
+  if (!isDir2(sourceDir)) return;
+  try {
+    mkdirSync3(targetDir, { recursive: true });
+  } catch {
+    log.warn(`[boot] WARN: unable to create ${targetDir}; skipping grimoire skill links`);
+    return;
+  }
+  let linked = 0;
+  let names = [];
+  try {
+    names = readdirSync(sourceDir);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (!isDir2(join4(sourceDir, name))) continue;
+    const target = join4(targetDir, name);
+    if (existsSync2(target) && !isSymlink(target)) {
+      log.warn(`[boot] WARN: ${target} exists and is not a symlink; skipping`);
+      continue;
+    }
+    try {
+      rmSync2(target, { force: true });
+      symlinkSync2(join4("..", "grimoire", "skills", name), target);
+      linked++;
+    } catch {
+    }
+  }
+  log.info(`[boot] Linked ${linked} grimoire skills into ${targetDir}`);
+}
+function parseReferenceRepos(refsJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(refsJson);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  const refs = [];
+  for (const entry of parsed) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const raw = entry;
+    const str = (key) => typeof raw[key] === "string" ? raw[key] : "";
+    const ref = {
+      slug: str("slug"),
+      owner: str("owner"),
+      name: str("name"),
+      branch: str("branch") || "main",
+      token: str("token")
+    };
+    if (ref.token && ref.slug && ref.owner && ref.name) refs.push(ref);
+  }
+  return refs;
+}
+async function runPreReadyBinds(workspace, bundle, git, log) {
+  const graphifyEnv = computeGraphifyEnv(process.env, bundle.gitPlan.repoName, isDir2);
+  bindGraphifyBundle(workspace, graphifyEnv, log);
+  await ensureGrimoireSubmodule(workspace, bundle.githubToken, git, log);
+  linkGrimoireSkills(workspace, log);
+}
+async function cloneReferenceRepos(refsJson, git, log, referencesDir = "/workspaces/references") {
+  if (!refsJson) return;
+  const refs = parseReferenceRepos(refsJson);
+  if (refs.length === 0) return;
+  try {
+    mkdirSync3(referencesDir, { recursive: true });
+  } catch {
+    return;
+  }
+  for (const ref of refs) {
+    const dest = join4(referencesDir, ref.slug);
+    if (existsSync2(join4(dest, ".git"))) continue;
+    try {
+      await git(
+        [
+          "clone",
+          "--depth",
+          "1",
+          "--single-branch",
+          "--branch",
+          ref.branch,
+          `https://x-access-token:${ref.token}@github.com/${ref.owner}/${ref.name}.git`,
+          dest
+        ],
+        { timeoutMs: 6e5 }
+      );
+      try {
+        await git(
+          ["remote", "set-url", "origin", `https://github.com/${ref.owner}/${ref.name}.git`],
+          { cwd: dest, timeoutMs: 1e4 }
+        );
+      } catch {
+      }
+      log.info(`[boot] cloned reference ${ref.slug} (${ref.owner}/${ref.name}@${ref.branch})`);
+    } catch {
+      log.warn(`[boot] WARN: reference clone failed: ${ref.slug}`);
+    }
+  }
+}
+
+// src/boot/workbench-boot-deps.ts
+var WORKSPACE_DIR = "/workspaces/repo";
+var HOME_DIR = "/home/conveyor";
+var USER_HOME_MOUNT2 = "/mnt/conveyor-users";
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+function defaultWorkbenchBootDeps() {
+  return {
+    pollBundle: (ctx) => pollBootstrapBundle(ctx.apiUrl, ctx.bootstrapToken, {
+      fetchFn: fetch,
+      sleepFn: sleep,
+      log: ctx.log
+    }),
+    unpack: (ctx, bundle) => {
+      const claims = decodeJwtClaims(bundle.sessionJwt);
+      ctx.claims = claims;
+      return buildChildEnv({
+        base: process.env,
+        bundle,
+        claims,
+        hostname: ctx.hostname,
+        log: ctx.log
+      });
+    },
+    startDaemon: (opts) => startWorkbenchServer(opts),
+    gitPrepDeps: (ctx, bundle) => ({
+      git: defaultGit,
+      bundle,
+      podImage: process.env.CONVEYOR_POD_IMAGE === "1",
+      log: ctx.log
+    }),
+    bindsBeforeReady: (ctx, bundle) => runPreReadyBinds(WORKSPACE_DIR, bundle, defaultGit, ctx.log),
+    cloneReferences: (ctx, bundle) => cloneReferenceRepos(bundle.envVars?.REFERENCE_REPOS_JSON, defaultGit, ctx.log),
+    ensureWorkspaceDir: (ctx) => {
+      ensureDir(WORKSPACE_DIR);
+      ctx.log.info(`[boot] ensured workspace dir ${WORKSPACE_DIR}`);
+    },
+    wireHome: (ctx) => {
+      wireUserHome({
+        home: HOME_DIR,
+        userHomeMount: USER_HOME_MOUNT2,
+        userId: ctx.childEnv?.CONVEYOR_USER_ID,
+        projectId: ctx.childEnv?.CONVEYOR_PROJECT_ID ?? ctx.childEnv?.PROJECT_ID,
+        sharedDir: process.env.CONVEYOR_SHARED_DIR,
+        log: ctx.log
+      });
+    },
+    startSshd: (ctx) => startWorkspaceSshd(defaultExec, ctx.log),
+    reclaimOwnership: (ctx) => reclaimHomeOwnership(HOME_DIR, defaultExec, ctx.log),
+    park: () => new Promise(() => {
+    })
+  };
+}
+
+// src/boot/workbench-boot.ts
+function toGitStatusFrame(state) {
+  return state.state === "failed" ? { t: "gitStatus", state: "failed", reason: state.reason } : { t: "gitStatus", state: state.state };
+}
+function warnErr(ctx, label) {
+  return (err) => {
+    ctx.log.warn(
+      `[boot] WARN ${label} failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  };
+}
+async function runWorkbenchBoot(ctx, overrides = {}) {
+  const deps = { ...defaultWorkbenchBootDeps(), ...overrides };
+  const bundle = await deps.pollBundle(ctx);
+  if (!bundle) {
+    ctx.log.info("[boot] standby poll aborted \u2014 parking for shutdown");
+    return deps.park(ctx);
+  }
+  ctx.bundle = bundle;
+  ctx.childEnv = deps.unpack(ctx, bundle);
+  const job = new GitPrepJob(deps.gitPrepDeps(ctx, bundle), {
+    // Order pinned by the old entrypoint-grimoire test: binds BEFORE the
+    // ready flip (Claude must not spawn before skills exist), references after.
+    onReady: () => deps.bindsBeforeReady(ctx, bundle),
+    afterReady: () => deps.cloneReferences(ctx, bundle)
+  });
+  await deps.startDaemon({
+    port: workbenchPort() ?? DEFAULT_WORKBENCH_PORT,
+    token: ctx.bootstrapToken,
+    version: readAgentVersion() ?? "unknown",
+    getGitStatus: () => toGitStatusFrame(job.status)
+  });
+  ctx.log.info("[boot] step=startDaemon listen socket up (startupProbe gate open)");
+  try {
+    deps.ensureWorkspaceDir(ctx);
+  } catch (err) {
+    warnErr(ctx, "ensureWorkspaceDir")(err);
+  }
+  job.start();
+  try {
+    deps.wireHome(ctx);
+  } catch (err) {
+    warnErr(ctx, "wireUserHome")(err);
+  }
+  void deps.startSshd(ctx).catch(warnErr(ctx, "startWorkspaceSshd"));
+  void deps.reclaimOwnership(ctx).catch(warnErr(ctx, "reclaimHomeOwnership"));
+  return deps.park(ctx);
+}
+
+// src/boot/index.ts
+var HOME_DIR2 = "/home/conveyor";
+var USER_HOME_MOUNT3 = "/mnt/conveyor-users";
+function defaultBootDeps() {
+  return {
+    fetchFn: fetch,
+    sleepFn: (ms) => new Promise((resolve) => {
+      setTimeout(resolve, ms);
+    }),
+    spawnFn: spawn,
+    exec: defaultExec,
+    installedVersion: () => {
+      const version = readAgentVersion();
+      return version ? Promise.resolve(version) : Promise.reject(new Error("could not read installed agent version"));
+    },
+    dirExists: (path) => {
+      try {
+        return statSync3(path).isDirectory();
+      } catch {
+        return false;
+      }
+    },
+    hostname: osHostname(),
+    log: createBootLogger()
+  };
+}
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function whenAborted2(signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted) {
+      resolve();
+      return;
+    }
+    signal.addEventListener("abort", () => resolve(), { once: true });
+  });
+}
+function agentBootSteps(deps = defaultBootDeps(), signal = new AbortController().signal) {
+  return [
+    {
+      name: "pollBootstrap",
+      critical: true,
+      run: async (ctx) => {
+        const bundle = await pollBootstrapBundle(ctx.apiUrl, ctx.bootstrapToken, {
+          fetchFn: deps.fetchFn,
+          sleepFn: deps.sleepFn,
+          log: ctx.log,
+          signal
+        });
+        if (bundle) ctx.bundle = bundle;
+      }
+    },
+    {
+      name: "unpackBundle",
+      critical: true,
+      run: (ctx) => {
+        if (ctx.bundle) {
+          const claims = decodeJwtClaims(ctx.bundle.sessionJwt);
+          ctx.claims = claims;
+          const childEnv = buildChildEnv({
+            base: process.env,
+            bundle: ctx.bundle,
+            claims,
+            hostname: ctx.hostname,
+            log: ctx.log
+          });
+          const graphifyEnv = computeGraphifyEnv(
+            process.env,
+            ctx.bundle.gitPlan.repoName,
+            deps.dirExists
+          );
+          ctx.childEnv = { ...childEnv, ...graphifyEnv };
+        }
+        return Promise.resolve();
+      }
+    },
+    {
+      name: "reclaimHome",
+      critical: false,
+      run: async (ctx) => {
+        if (!ctx.bundle) return;
+        await reclaimHomeOwnership(HOME_DIR2, deps.exec, ctx.log);
+      }
+    },
+    {
+      name: "wireUserHome",
+      critical: true,
+      run: (ctx) => {
+        if (ctx.bundle) {
+          wireUserHome({
+            home: HOME_DIR2,
+            userHomeMount: USER_HOME_MOUNT3,
+            userId: ctx.childEnv?.CONVEYOR_USER_ID,
+            projectId: ctx.childEnv?.CONVEYOR_PROJECT_ID ?? ctx.childEnv?.PROJECT_ID,
+            sharedDir: process.env.CONVEYOR_SHARED_DIR,
+            log: ctx.log
+          });
+        }
+        return Promise.resolve();
+      }
+    }
+  ];
+}
+function workbenchBootSteps(deps = defaultWorkbenchBootDeps()) {
+  return [
+    {
+      name: "pollBootstrap",
+      critical: true,
+      run: async (ctx) => {
+        const bundle = await deps.pollBundle(ctx);
+        if (bundle) ctx.bundle = bundle;
+      }
+    },
+    {
+      name: "unpackBundle",
+      critical: true,
+      run: (ctx) => {
+        if (ctx.bundle) ctx.childEnv = deps.unpack(ctx, ctx.bundle);
+        return Promise.resolve();
+      }
+    },
+    {
+      name: "startDaemon",
+      critical: true,
+      run: async (ctx) => {
+        await deps.startDaemon({
+          port: workbenchPort() ?? DEFAULT_WORKBENCH_PORT,
+          token: ctx.bootstrapToken,
+          version: readAgentVersion() ?? "unknown",
+          // The manifest has no GitPrepJob, so it must never claim readiness —
+          // "pending" is the safe answer if anyone ever executes these steps
+          // directly instead of via runWorkbenchBoot (which serves live state).
+          getGitStatus: () => ({ t: "gitStatus", state: "pending" })
+        });
+      }
+    }
+  ];
+}
+async function runAgentRole(ctx, deps, signal) {
+  try {
+    await runPipeline(agentBootSteps(deps, signal), ctx);
+  } catch (err) {
+    ctx.log.error(`[boot] agent boot failed: ${errMsg(err)}`);
+    return 1;
+  }
+  if (signal.aborted || !ctx.bundle) {
+    ctx.log.info("[boot] SIGTERM during standby \u2014 exiting.");
+    return 0;
+  }
+  process.chdir(HOME_DIR2);
+  return superviseRunner({
+    childEnv: ctx.childEnv ?? {},
+    cwd: HOME_DIR2,
+    apiUrl: ctx.apiUrl,
+    bootstrapToken: ctx.bootstrapToken,
+    log: ctx.log,
+    spawnFn: deps.spawnFn,
+    signal
+  });
+}
+async function runWorkbenchRole(ctx, deps, signal) {
+  try {
+    await Promise.race([
+      runWorkbenchBoot(ctx, {
+        pollBundle: (workbenchCtx) => pollBootstrapBundle(workbenchCtx.apiUrl, workbenchCtx.bootstrapToken, {
+          fetchFn: deps.fetchFn,
+          sleepFn: deps.sleepFn,
+          log: workbenchCtx.log,
+          signal
+        })
+      }),
+      whenAborted2(signal)
+    ]);
+  } catch (err) {
+    ctx.log.error(`[boot] workbench boot failed: ${errMsg(err)}`);
+    return 1;
+  }
+  ctx.log.info(
+    ctx.bundle ? "[boot] SIGTERM \u2014 workbench shutting down." : "[boot] SIGTERM during standby \u2014 exiting."
+  );
+  return 0;
+}
+async function runBoot(argv, deps = defaultBootDeps()) {
+  const { log } = deps;
+  if (argv.includes("--preflight-update")) {
+    await runPreflightUpdate({
+      exec: deps.exec,
+      installedVersion: deps.installedVersion,
+      log
+    });
+    return 0;
+  }
+  const role = process.env.CONVEYOR_CONTAINER_ROLE;
+  if (role !== "agent" && role !== "workbench") {
+    log.error("[boot] FATAL missing/invalid CONVEYOR_CONTAINER_ROLE \u2014 vnext pods are split-only");
+    return 1;
+  }
+  const apiUrl = process.env.CONVEYOR_API_URL;
+  const bootstrapToken = process.env.POD_BOOTSTRAP_TOKEN;
+  if (!apiUrl || !bootstrapToken) {
+    log.error("[boot] FATAL missing required env: CONVEYOR_API_URL + POD_BOOTSTRAP_TOKEN");
+    return 1;
+  }
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  process.on("SIGTERM", abort);
+  process.on("SIGINT", abort);
+  const ctx = {
+    role,
+    apiUrl,
+    bootstrapToken,
+    hostname: deps.hostname,
+    log
+  };
+  return role === "workbench" ? runWorkbenchRole(ctx, deps, controller.signal) : runAgentRole(ctx, deps, controller.signal);
+}
+export {
+  TOMBSTONE_MESSAGE,
+  agentBootSteps,
+  defaultBootDeps,
+  isLegacyEntrypointLaunch,
+  runBoot,
+  workbenchBootSteps
+};
+//# sourceMappingURL=boot-NMXFM4GK.js.map