@snappedly-tools/shipyard 0.4.4 → 0.5.0

package/dist/chunk-WAXEMZUV.js

@@ -0,0 +1,877 @@
+import { assertProtectedDirectoryIdentities, ACTIVATION_LABEL, CONFIG_DIR, RUNNER_DIR, RUNNER_SANDBOX_MASK_DIR, resolveUserMounts, assertIsolatedWorkspaceMounts, processFileMountParents, defaultImageName, registerShutdown, DockerError, repositoryRunnerEnvironment, formatVolumeMount } from './chunk-FDYOTN55.js';
+import { createIsolatedSandboxProvider } from './chunk-KMGNFXKN.js';
+import { MAX_TAIL_CHARS, collectProcessOutput } from './chunk-ACD46ZM4.js';
+import { execFile, execFileSync, spawn } from 'child_process';
+import { resolve, join, posix } from 'path';
+import { promisify } from 'util';
+import { randomUUID } from 'crypto';
+import { Effect } from 'effect';
+import { constants } from 'fs';
+import { rm, lstat, realpath, mkdir, readFile, access } from 'fs/promises';
+
+var exec = promisify(execFile);
+var copyIntoContainer = async (engine, container, owner, hostPath, sandboxPath) => {
+  try {
+    await exec(engine, [
+      "exec",
+      container,
+      "mkdir",
+      "-p",
+      "--",
+      posix.dirname(sandboxPath)
+    ]);
+    await exec(engine, ["cp", hostPath, `${container}:${sandboxPath}`]);
+    await exec(engine, [
+      "exec",
+      "--user",
+      "0:0",
+      container,
+      "chown",
+      "-hR",
+      "--",
+      owner,
+      sandboxPath
+    ]);
+  } catch (error) {
+    throw new Error(
+      `${engine} cp (in) failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+var dockerExec = (args) => Effect.async((resume) => {
+  execFile(
+    "docker",
+    args,
+    { maxBuffer: 10 * 1024 * 1024 },
+    (error, stdout, stderr) => {
+      if (error) {
+        resume(
+          Effect.fail(
+            new DockerError({
+              message: `docker ${args[0]} failed: ${stderr?.toString() || error.message}`
+            })
+          )
+        );
+      } else {
+        resume(Effect.succeed(stdout.toString()));
+      }
+    }
+  );
+});
+var buildImage = (imageName, dockerfileDir, options) => Effect.gen(function* () {
+  const buildArgFlags = Object.entries(options?.buildArgs ?? {}).flatMap(
+    ([k, v]) => ["--build-arg", `${k}=${v}`]
+  );
+  if (options?.dockerfile) {
+    yield* dockerExec([
+      "build",
+      "-t",
+      imageName,
+      ...buildArgFlags,
+      "-f",
+      resolve(options.dockerfile),
+      process.cwd()
+    ]);
+  } else {
+    yield* dockerExec([
+      "build",
+      "-t",
+      imageName,
+      ...buildArgFlags,
+      resolve(dockerfileDir)
+    ]);
+  }
+});
+var startContainer = (containerName, imageName, env, options) => Effect.gen(function* () {
+  const existing = yield* dockerExec([
+    "ps",
+    "-a",
+    "--filter",
+    `name=^${containerName}$`,
+    "--format",
+    "{{.Names}}"
+  ]);
+  if (existing.trim() === containerName) {
+    yield* Effect.fail(
+      new DockerError({
+        message: `Container '${containerName}' already exists. Run cleanup first.`
+      })
+    );
+  }
+  const envFlags = Object.entries(env).flatMap(([k, v]) => [
+    "-e",
+    `${k}=${v}`
+  ]);
+  const selinuxLabel = options?.selinuxLabel ?? "z";
+  const volumeFlags = (options?.volumeMounts ?? []).flatMap((mount) => [
+    "-v",
+    formatVolumeMount(mount, selinuxLabel)
+  ]);
+  const workdirFlags = options?.workdir ? ["-w", options.workdir] : [];
+  const userFlags = options?.user ? ["--user", options.user] : [];
+  const networks = options?.network ? Array.isArray(options.network) ? options.network : [options.network] : [];
+  const networkFlags = networks.flatMap((n) => ["--network", n]);
+  const groupAddFlags = (options?.groups ?? []).flatMap((g) => [
+    "--group-add",
+    String(g)
+  ]);
+  const deviceFlags = (options?.devices ?? []).flatMap((d) => [
+    "--device",
+    d
+  ]);
+  const cpusFlags = options?.cpus !== void 0 ? ["--cpus", String(options.cpus)] : [];
+  const labelFlags = Object.entries(options?.labels ?? {}).flatMap(
+    ([key, value]) => ["--label", `${key}=${value}`]
+  );
+  yield* dockerExec([
+    "run",
+    "-d",
+    "--init",
+    "--name",
+    containerName,
+    ...labelFlags,
+    ...envFlags,
+    ...volumeFlags,
+    ...workdirFlags,
+    ...userFlags,
+    ...networkFlags,
+    ...groupAddFlags,
+    ...deviceFlags,
+    ...cpusFlags,
+    imageName
+  ]);
+});
+var removeContainer = (containerName) => Effect.gen(function* () {
+  yield* Effect.ignore(dockerExec(["stop", containerName]));
+  yield* Effect.ignore(dockerExec(["rm", containerName]));
+});
+var removeImage = (imageName) => Effect.gen(function* () {
+  yield* dockerExec(["rmi", imageName]);
+});
+var execFileAsync = promisify(execFile);
+var RUNNER_INSTALL_METADATA = ".shipyard-install.json";
+var RUNNER_CONTROLLER_LOCK = ".shipyard-controller.lock";
+var RUNNER_WORK_DIR = "_work";
+var REPOSITORY_RUNNER_OWNER_LABEL = "com.snappedly.shipyard.repository-runner-owner";
+var REPOSITORY_RUNNER_OWNER_ENV = "SHIPYARD_RUNNER_OWNER";
+var REGISTRATION_FILES = [
+  ".credentials",
+  ".credentials_rsaparams",
+  ".runner"
+];
+var RunnerLifecycleError = class extends Error {
+  name = "RunnerLifecycleError";
+};
+var defaultAdapters = {
+  environment: () => process.env,
+  exists: async (path) => {
+    try {
+      await access(path, constants.F_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  readText: (path) => readFile(path, "utf8"),
+  makeDirectory: async (path) => {
+    await mkdir(path, { recursive: true, mode: 448 });
+  },
+  inspectDirectory: async (path) => {
+    const [stat, resolved] = await Promise.all([lstat(path), realpath(path)]);
+    return {
+      realPath: resolved,
+      directory: stat.isDirectory(),
+      symbolicLink: stat.isSymbolicLink()
+    };
+  },
+  remove: (path) => rm(path, { recursive: true, force: true }),
+  run: async (command, args, options) => {
+    const result = await execFileAsync(command, [...args], {
+      cwd: options.cwd,
+      env: options.env,
+      maxBuffer: 10 * 1024 * 1024
+    });
+    return { stdout: result.stdout, stderr: result.stderr };
+  },
+  processIdentity: async (pid) => {
+    try {
+      const result = await execFileAsync("ps", [
+        "-p",
+        String(pid),
+        "-o",
+        "lstart="
+      ]);
+      const identity = result.stdout.trim().replace(/\s+/g, " ");
+      return identity.length > 0 ? identity : void 0;
+    } catch {
+      return void 0;
+    }
+  },
+  isProcessRunning: (pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  signalProcess: (pid, signal) => process.kill(pid, signal),
+  pause: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds))
+};
+var lockOwnsProcess = async (lock, adapters) => lock !== void 0 && Number.isInteger(lock.pid) && typeof lock.processStartedAt === "string" && lock.processStartedAt.length > 0 && adapters.isProcessRunning(lock.pid) && await adapters.processIdentity(lock.pid) === lock.processStartedAt;
+var lifecycleFailure = (purpose, error) => error instanceof RunnerLifecycleError ? error : new RunnerLifecycleError(
+  `${purpose} failed: ${error instanceof Error ? error.message : String(error)}`
+);
+var runCommand = async (adapters, purpose, command, args, options) => {
+  try {
+    return await adapters.run(command, args, options);
+  } catch (error) {
+    throw lifecycleFailure(purpose, error);
+  }
+};
+var readJson = async (path, adapters) => {
+  if (!await adapters.exists(path)) return void 0;
+  try {
+    return JSON.parse(await adapters.readText(path));
+  } catch (error) {
+    throw lifecycleFailure(`Reading repository runner state at ${path}`, error);
+  }
+};
+var requireInstallMetadata = async (runnerDir, adapters) => {
+  const metadata = await readJson(
+    join(runnerDir, RUNNER_INSTALL_METADATA),
+    adapters
+  );
+  if (metadata?.schemaVersion !== 1 || typeof metadata.repository !== "string" || typeof metadata.repositoryUrl !== "string" || typeof metadata.name !== "string" || metadata.label !== ACTIVATION_LABEL || typeof metadata.version !== "string") {
+    throw new RunnerLifecycleError(
+      `The existing directory at ${runnerDir} is not a valid Shipyard repository runner installation. Refusing to replace it.`
+    );
+  }
+  return metadata;
+};
+var parseRemoteRunners = (stdout) => stdout.split(/\r?\n/).filter((line) => line.length > 0).map((line) => {
+  const [name = "", status = "", labels = ""] = line.split("	");
+  return {
+    name,
+    status,
+    labels: new Set(labels.split(",").filter(Boolean))
+  };
+});
+var listRemoteRunners = async (repository, repoDir, environment, adapters) => {
+  const response = await runCommand(
+    adapters,
+    "Checking registered GitHub repository runners",
+    "gh",
+    [
+      "api",
+      "--paginate",
+      `repos/${repository}/actions/runners`,
+      "--jq",
+      '.runners[] | [.name, .status, ([.labels[].name] | join(","))] | @tsv'
+    ],
+    { cwd: repoDir, env: environment }
+  );
+  return parseRemoteRunners(response.stdout);
+};
+var validateExistingRepositoryRunner = async (options, adapters = defaultAdapters) => {
+  if (!await adapters.exists(options.maskDir)) {
+    await adapters.makeDirectory(options.maskDir);
+  }
+  await assertProtectedDirectoryIdentities(
+    options.runnerDir,
+    options.maskDir,
+    adapters.inspectDirectory
+  ).catch((error) => {
+    throw lifecycleFailure("Validating protected runner directories", error);
+  });
+  const metadata = await requireInstallMetadata(options.runnerDir, adapters);
+  if (metadata.repository !== options.repository) {
+    throw new RunnerLifecycleError(
+      `The existing repository runner belongs to ${metadata.repository}, not ${options.repository}. Refusing to replace it.`
+    );
+  }
+  if (metadata.name !== options.runnerName) {
+    throw new RunnerLifecycleError(
+      `The existing installation belongs to runner ${metadata.name}, not ${options.runnerName}. A Mac rename does not rename a registered runner; remove and reinstall it explicitly.`
+    );
+  }
+  for (const required of [".credentials", "run.sh"]) {
+    if (!await adapters.exists(join(options.runnerDir, required))) {
+      throw new RunnerLifecycleError(
+        `The existing repository runner is missing ${required}. Refusing to replace its registration; remove it explicitly first.`
+      );
+    }
+  }
+  const remoteRunners = await listRemoteRunners(
+    options.repository,
+    options.repoDir,
+    adapters.environment(),
+    adapters
+  );
+  const labelled = remoteRunners.filter(
+    ({ labels }) => labels.has(ACTIVATION_LABEL)
+  );
+  if (labelled.length > 1) {
+    throw new RunnerLifecycleError(
+      `Multiple repository runners carry the ${ACTIVATION_LABEL} label (${labelled.map(({ name }) => name).join(", ")}). Remove duplicates before continuing.`
+    );
+  }
+  const matching = remoteRunners.find(({ name }) => name === metadata.name);
+  if (!matching) {
+    throw new RunnerLifecycleError(
+      `Runner ${metadata.name} is installed locally but is no longer registered with GitHub. Run \`shipyard runner start\` to repair it, or remove it explicitly.`
+    );
+  }
+  if (!matching.labels.has(ACTIVATION_LABEL)) {
+    throw new RunnerLifecycleError(
+      `Registered runner ${metadata.name} does not carry the ${ACTIVATION_LABEL} label. Refusing to replace a customized registration.`
+    );
+  }
+  return metadata;
+};
+var removeRegistrationFiles = async (runnerDir, adapters) => {
+  for (const name of REGISTRATION_FILES) {
+    const path = join(runnerDir, name);
+    if (await adapters.exists(path)) await adapters.remove(path);
+  }
+};
+var readOneTimeToken = (stdout, purpose) => {
+  try {
+    const parsed = JSON.parse(stdout);
+    if (typeof parsed.token !== "string" || parsed.token.length === 0) {
+      throw new Error("response did not contain a token");
+    }
+    return parsed.token;
+  } catch (error) {
+    throw lifecycleFailure(purpose, error);
+  }
+};
+var requestRegistrationToken = async (repository, repoDir, environment, adapters) => {
+  await runCommand(
+    adapters,
+    "Checking current administrative GitHub authorization",
+    "gh",
+    ["auth", "status", "--hostname", "github.com"],
+    { cwd: repoDir, env: environment }
+  );
+  const response = await runCommand(
+    adapters,
+    "Requesting a one-time repository runner registration token",
+    "gh",
+    [
+      "api",
+      "--method",
+      "POST",
+      `repos/${repository}/actions/runners/registration-token`
+    ],
+    { cwd: repoDir, env: environment }
+  );
+  return readOneTimeToken(response.stdout, "Reading the registration token");
+};
+var recoverRepositoryRunner = async (options, adapters = defaultAdapters) => {
+  const lockPath = join(options.runnerDir, RUNNER_CONTROLLER_LOCK);
+  const lock = await readJson(lockPath, adapters);
+  if (await lockOwnsProcess(lock, adapters)) {
+    throw new RunnerLifecycleError(
+      `The repository runner is already running with process ${lock.pid}.`
+    );
+  }
+  if (lock) await adapters.remove(lockPath);
+  const workDir = join(options.runnerDir, RUNNER_WORK_DIR);
+  if (await adapters.exists(workDir)) await adapters.remove(workDir);
+  if (await adapters.exists(options.maskDir))
+    await adapters.remove(options.maskDir);
+  await adapters.makeDirectory(options.maskDir);
+  await assertProtectedDirectoryIdentities(
+    options.runnerDir,
+    options.maskDir,
+    adapters.inspectDirectory
+  ).catch((error) => {
+    throw lifecycleFailure("Validating protected runner directories", error);
+  });
+  await removeOwnedRepositoryRunnerContainers(
+    {
+      repoDir: options.repoDir,
+      repository: options.metadata.repository,
+      environment: options.dockerEnvironment ?? options.runnerEnvironment
+    },
+    adapters
+  );
+  const adminEnvironment = adapters.environment();
+  const remoteRunners = await listRemoteRunners(
+    options.metadata.repository,
+    options.repoDir,
+    adminEnvironment,
+    adapters
+  );
+  const labelled = remoteRunners.filter(
+    ({ labels }) => labels.has(ACTIVATION_LABEL)
+  );
+  if (labelled.length > 1) {
+    throw new RunnerLifecycleError(
+      `Multiple repository runners carry the ${ACTIVATION_LABEL} label (${labelled.map(({ name }) => name).join(", ")}). Remove duplicates before continuing.`
+    );
+  }
+  const matching = remoteRunners.find(
+    ({ name }) => name === options.metadata.name
+  );
+  if (matching) {
+    if (!matching.labels.has(ACTIVATION_LABEL)) {
+      throw new RunnerLifecycleError(
+        `Registered runner ${matching.name} does not carry the ${ACTIVATION_LABEL} label. Refusing to replace a customized registration.`
+      );
+    }
+    if (!await adapters.exists(join(options.runnerDir, ".credentials"))) {
+      throw new RunnerLifecycleError(
+        `Registered runner ${matching.name} is missing local credentials. Remove and reinstall it explicitly.`
+      );
+    }
+    return { reRegistered: false };
+  }
+  const collision = labelled[0];
+  if (collision) {
+    throw new RunnerLifecycleError(
+      `Repository runner ${collision.name} already carries the ${ACTIVATION_LABEL} label. Refusing to create a conflicting registration.`
+    );
+  }
+  const registrationToken = await requestRegistrationToken(
+    options.metadata.repository,
+    options.repoDir,
+    adminEnvironment,
+    adapters
+  );
+  await removeRegistrationFiles(options.runnerDir, adapters);
+  try {
+    await adapters.run(
+      "./config.sh",
+      [
+        "--url",
+        options.metadata.repositoryUrl,
+        "--token",
+        registrationToken,
+        "--name",
+        options.metadata.name,
+        "--labels",
+        ACTIVATION_LABEL,
+        "--work",
+        RUNNER_WORK_DIR,
+        "--unattended"
+      ],
+      { cwd: options.runnerDir, env: options.runnerEnvironment }
+    );
+  } catch {
+    await removeRegistrationFiles(options.runnerDir, adapters);
+    throw new RunnerLifecycleError(
+      `Re-registering ${options.metadata.name} failed. Partial local registration files were removed; check GitHub Settings > Actions > Runners for an orphan registration, then retry \`shipyard runner start\`. The one-time token was not stored.`
+    );
+  }
+  return { reRegistered: true };
+};
+var removeOwnedRepositoryRunnerContainers = async (options, adapters = defaultAdapters) => {
+  const ownedContainers = await runCommand(
+    adapters,
+    "Finding stale repository-runner containers",
+    "docker",
+    [
+      "ps",
+      "-aq",
+      "--filter",
+      `label=${REPOSITORY_RUNNER_OWNER_LABEL}=${options.repository}`
+    ],
+    { cwd: options.repoDir, env: options.environment }
+  );
+  const containerIds = ownedContainers.stdout.split(/\s+/).filter(Boolean);
+  if (containerIds.length === 0) return;
+  await runCommand(
+    adapters,
+    "Removing stale repository-runner containers",
+    "docker",
+    ["rm", "-f", ...containerIds],
+    { cwd: options.repoDir, env: options.environment }
+  );
+};
+var waitForProcessToStop = async (pid, adapters) => {
+  adapters.signalProcess(pid, "SIGTERM");
+  for (let attempt = 0; attempt < 50; attempt += 1) {
+    if (!adapters.isProcessRunning(pid)) return;
+    await adapters.pause(100);
+  }
+  throw new RunnerLifecycleError(
+    `Repository runner process ${pid} did not stop within 5 seconds. Local runner files were preserved.`
+  );
+};
+var unregisterRepositoryRunner = async (metadata, repoDir, runnerDir, environment, adapters) => {
+  await runCommand(
+    adapters,
+    "Checking current administrative GitHub authorization",
+    "gh",
+    ["auth", "status", "--hostname", "github.com"],
+    { cwd: repoDir, env: environment }
+  );
+  const response = await runCommand(
+    adapters,
+    "Requesting a one-time repository runner removal token",
+    "gh",
+    [
+      "api",
+      "--method",
+      "POST",
+      `repos/${metadata.repository}/actions/runners/remove-token`
+    ],
+    { cwd: repoDir, env: environment }
+  );
+  const token = readOneTimeToken(response.stdout, "Reading the removal token");
+  try {
+    await adapters.run(
+      "./config.sh",
+      ["remove", "--token", token, "--unattended"],
+      { cwd: runnerDir, env: repositoryRunnerEnvironment(environment) }
+    );
+  } catch {
+    throw new RunnerLifecycleError(
+      `Unregistering ${metadata.name} from GitHub failed. Local runner files were preserved; retry after restoring repository administration access.`
+    );
+  }
+};
+var removeRepositoryRunner = async (options, adapters = defaultAdapters) => {
+  const configDir = join(options.repoDir, CONFIG_DIR);
+  const runnerDir = join(configDir, RUNNER_DIR);
+  const maskDir = join(configDir, RUNNER_SANDBOX_MASK_DIR);
+  if (!await adapters.exists(runnerDir)) {
+    throw new RunnerLifecycleError(
+      `No repository runner is installed at ${runnerDir}.`
+    );
+  }
+  let metadata;
+  try {
+    metadata = await requireInstallMetadata(runnerDir, adapters);
+  } catch (error) {
+    if (!options.force) throw error;
+    await adapters.remove(runnerDir);
+    if (await adapters.exists(maskDir)) await adapters.remove(maskDir);
+    return {
+      removed: true,
+      forced: true,
+      manualCleanup: "Check GitHub Settings > Actions > Runners and manually remove any orphan repository runner registration."
+    };
+  }
+  const lock = await readJson(
+    join(runnerDir, RUNNER_CONTROLLER_LOCK),
+    adapters
+  );
+  if (await lockOwnsProcess(lock, adapters)) {
+    await waitForProcessToStop(lock.pid, adapters);
+  }
+  try {
+    await unregisterRepositoryRunner(
+      metadata,
+      options.repoDir,
+      runnerDir,
+      adapters.environment(),
+      adapters
+    );
+  } catch (error) {
+    if (!options.force) {
+      const failure = lifecycleFailure("Removing the repository runner", error);
+      throw new RunnerLifecycleError(
+        `${failure.message} Local runner files were preserved.`
+      );
+    }
+    await adapters.remove(runnerDir);
+    if (await adapters.exists(maskDir)) await adapters.remove(maskDir);
+    return {
+      removed: true,
+      forced: true,
+      manualCleanup: `Remove runner ${metadata.name} from ${metadata.repository} in GitHub Settings > Actions > Runners.`
+    };
+  }
+  if (await adapters.exists(maskDir)) await adapters.remove(maskDir);
+  await adapters.remove(runnerDir);
+  return { removed: true, forced: false };
+};
+
+// src/sandboxes/docker.ts
+var docker = (options) => {
+  const configuredImageName = options?.imageName;
+  const selinuxLabel = options?.selinuxLabel ?? "z";
+  const maxOutputTailChars = options?.maxOutputTailChars ?? MAX_TAIL_CHARS;
+  const sandboxHomedir = "/home/agent";
+  const userMounts = options?.mounts ? resolveUserMounts(options.mounts, sandboxHomedir) : [];
+  assertIsolatedWorkspaceMounts(userMounts);
+  const parentDirsToCreate = processFileMountParents(
+    userMounts,
+    sandboxHomedir
+  );
+  return createIsolatedSandboxProvider({
+    name: "docker",
+    env: options?.env,
+    create: async (createOptions) => {
+      const containerName = `shipyard-${randomUUID()}`;
+      const worktreePath = "/home/agent/workspace";
+      const allMounts = userMounts;
+      const volumeMounts = allMounts.map((m) => ({
+        hostPath: m.hostPath,
+        sandboxPath: m.sandboxPath,
+        readonly: m.readonly
+      }));
+      const imageName = configuredImageName ?? defaultImageName(createOptions.hostRepoPath ?? process.cwd());
+      const containerUid = options?.containerUid ?? process.getuid?.() ?? 1e3;
+      const containerGid = options?.containerGid ?? process.getgid?.() ?? 1e3;
+      await checkImageUid(imageName, containerUid);
+      await Effect.runPromise(
+        startContainer(
+          containerName,
+          imageName,
+          {
+            ...createOptions.env,
+            HOME: "/home/agent"
+          },
+          {
+            volumeMounts,
+            workdir: worktreePath,
+            user: `${containerUid}:${containerGid}`,
+            network: options?.network,
+            groups: options?.groups,
+            devices: options?.devices,
+            cpus: options?.cpus,
+            selinuxLabel,
+            labels: process.env[REPOSITORY_RUNNER_OWNER_ENV] ? {
+              [REPOSITORY_RUNNER_OWNER_LABEL]: process.env[REPOSITORY_RUNNER_OWNER_ENV]
+            } : void 0
+          }
+        )
+      );
+      for (const dir of parentDirsToCreate) {
+        await new Promise((resolve2, reject) => {
+          execFile(
+            "docker",
+            [
+              "exec",
+              "--user",
+              "0:0",
+              containerName,
+              "sh",
+              "-c",
+              `mkdir -p "$1" && chown "$2" "$1"`,
+              "sh",
+              dir,
+              `${containerUid}:${containerGid}`
+            ],
+            (error) => {
+              if (error) {
+                reject(
+                  new Error(
+                    `Failed to create parent directory '${dir}' in container: ${error.message}`
+                  )
+                );
+              } else {
+                resolve2();
+              }
+            }
+          );
+        });
+      }
+      const removeContainerSync = () => {
+        try {
+          execFileSync("docker", ["rm", "-f", containerName], {
+            stdio: "ignore"
+          });
+        } catch {
+        }
+      };
+      const unregisterShutdown = registerShutdown(removeContainerSync);
+      const handle = {
+        worktreePath,
+        exec: (command, opts) => {
+          const effectiveCommand = opts?.sudo ? `sudo ${command}` : command;
+          const args = ["exec"];
+          if (opts?.stdin !== void 0) args.push("-i");
+          if (opts?.cwd) args.push("-w", opts.cwd);
+          args.push(containerName, "sh", "-c", effectiveCommand);
+          return new Promise((resolve2, reject) => {
+            const proc = spawn("docker", args, {
+              signal: opts?.signal,
+              stdio: [
+                opts?.stdin !== void 0 ? "pipe" : "ignore",
+                "pipe",
+                "pipe"
+              ]
+            });
+            if (opts?.stdin !== void 0) {
+              proc.stdin.write(opts.stdin);
+              proc.stdin.end();
+            }
+            proc.on("error", (error) => {
+              reject(new Error(`docker exec failed: ${error.message}`));
+            });
+            collectProcessOutput(
+              {
+                stdout: proc.stdout,
+                stderr: proc.stderr,
+                kill: () => proc.kill("SIGKILL"),
+                onClose: (listener) => proc.on("close", listener)
+              },
+              { ...opts, maxOutputTailChars },
+              resolve2,
+              reject
+            );
+          });
+        },
+        interactiveExec: (args, opts) => {
+          return new Promise((resolve2, reject) => {
+            opts.signal?.throwIfAborted();
+            const executionId = randomUUID();
+            const pidFile = `/tmp/shipyard-interactive-${executionId}.pid`;
+            const cancelFile = `/tmp/shipyard-interactive-${executionId}.cancel`;
+            const dockerArgs = ["exec"];
+            if ("isTTY" in opts.stdin && opts.stdin.isTTY) {
+              dockerArgs.push("-it");
+            } else {
+              dockerArgs.push("-i");
+            }
+            if (opts.cwd) dockerArgs.push("-w", opts.cwd);
+            dockerArgs.push(
+              containerName,
+              "sh",
+              "-c",
+              'pid_file=$1; cancel_file=$2; shift 2; command -v setsid >/dev/null 2>&1 && command -v ps >/dev/null 2>&1 && command -v awk >/dev/null 2>&1 || { printf "%s\\n" "setsid, ps, and awk are required for cancellable interactive execution" >&2; exit 127; }; if [ -e "$cancel_file" ]; then rm -f "$pid_file" "$cancel_file"; exit 130; fi; setsid "$@" & child=$!; printf "%s\\n" "$child" > "$pid_file"; wait "$child"; status=$?; rm -f "$pid_file" "$cancel_file"; exit "$status"',
+              "shipyard-interactive",
+              pidFile,
+              cancelFile,
+              ...args
+            );
+            const proc = spawn("docker", dockerArgs, {
+              stdio: [opts.stdin, opts.stdout, opts.stderr]
+            });
+            let settled = false;
+            let cancelling = false;
+            const finish = (result) => {
+              if (settled) return;
+              settled = true;
+              opts.signal?.removeEventListener("abort", onAbort);
+              if ("error" in result) reject(result.error);
+              else resolve2(result);
+            };
+            const onAbort = () => {
+              if (cancelling || settled) return;
+              cancelling = true;
+              const cancellationScript = `touch "$1"; attempts=0; while [ ! -s "$2" ] && [ "$attempts" -lt 50 ]; do sleep 0.1; attempts=$((attempts + 1)); done; if [ -s "$2" ]; then pid=$(cat "$2"); group_running() { ps -eo pgid=,stat= | awk -v pg="$pid" '$1 == pg && $2 !~ /^Z/ { found=1 } END { exit found ? 0 : 1 }'; }; kill -TERM "-$pid" 2>/dev/null || true; attempts=0; while group_running && [ "$attempts" -lt 20 ]; do sleep 0.1; attempts=$((attempts + 1)); done; kill -KILL "-$pid" 2>/dev/null || true; attempts=0; while group_running && [ "$attempts" -lt 20 ]; do sleep 0.1; attempts=$((attempts + 1)); done; if group_running; then exit 1; fi; rm -f "$1" "$2"; fi`;
+              execFile(
+                "docker",
+                [
+                  "exec",
+                  containerName,
+                  "sh",
+                  "-c",
+                  cancellationScript,
+                  "shipyard-cancel",
+                  cancelFile,
+                  pidFile
+                ],
+                { timeout: 7e3 },
+                (error) => {
+                  proc.kill("SIGKILL");
+                  if (error) {
+                    finish({
+                      error: new Error(
+                        `Failed to terminate interactive process in Docker sandbox: ${error.message}`
+                      )
+                    });
+                    return;
+                  }
+                  finish({
+                    error: opts.signal?.reason ?? new Error("Interactive execution aborted")
+                  });
+                }
+              );
+            };
+            opts.signal?.addEventListener("abort", onAbort, { once: true });
+            if (opts.signal?.aborted) onAbort();
+            proc.on("error", (error) => {
+              if (!cancelling) {
+                finish({
+                  error: new Error(`docker exec failed: ${error.message}`)
+                });
+              }
+            });
+            proc.on("close", (code) => {
+              if (cancelling) return;
+              execFile(
+                "docker",
+                ["exec", containerName, "rm", "-f", pidFile, cancelFile],
+                () => {
+                }
+              );
+              finish({ exitCode: code ?? 0 });
+            });
+          });
+        },
+        copyIn: (hostPath, sandboxPath) => copyIntoContainer(
+          "docker",
+          containerName,
+          `${containerUid}:${containerGid}`,
+          hostPath,
+          sandboxPath
+        ),
+        copyFileOut: (sandboxPath, hostPath) => new Promise((resolve2, reject) => {
+          execFile(
+            "docker",
+            ["cp", `${containerName}:${sandboxPath}`, hostPath],
+            (error) => {
+              if (error) {
+                reject(new Error(`docker cp (out) failed: ${error.message}`));
+              } else {
+                resolve2();
+              }
+            }
+          );
+        }),
+        close: async () => {
+          unregisterShutdown();
+          await Effect.runPromise(removeContainer(containerName));
+        }
+      };
+      return handle;
+    }
+  });
+};
+var checkImageUid = (imageName, expectedUid) => new Promise((resolve2, reject) => {
+  execFile(
+    "docker",
+    ["image", "inspect", imageName, "--format", "{{.Config.User}}"],
+    (error, stdout) => {
+      if (error) {
+        reject(
+          new Error(
+            `Image '${imageName}' not found locally. Build it first with 'shipyard docker build-image'.`
+          )
+        );
+        return;
+      }
+      const imageUser = (stdout ?? "").toString().trim();
+      if (!imageUser) {
+        resolve2();
+        return;
+      }
+      const uidPart = imageUser.split(":")[0];
+      const imageUid = parseInt(uidPart, 10);
+      if (isNaN(imageUid)) {
+        resolve2();
+        return;
+      }
+      if (imageUid !== expectedUid) {
+        reject(
+          new Error(
+            `UID mismatch: image '${imageName}' was built with UID ${imageUid}, but the expected UID is ${expectedUid}. Rebuild the image with 'shipyard docker build-image', or pass containerUid: ${imageUid} to docker() to match the image.`
+          )
+        );
+      } else {
+        resolve2();
+      }
+    }
+  );
+});
+
+export { REPOSITORY_RUNNER_OWNER_ENV, RUNNER_CONTROLLER_LOCK, RUNNER_INSTALL_METADATA, RUNNER_WORK_DIR, RunnerLifecycleError, buildImage, docker, recoverRepositoryRunner, removeImage, removeOwnedRepositoryRunnerContainers, removeRepositoryRunner, validateExistingRepositoryRunner };
+//# sourceMappingURL=chunk-WAXEMZUV.js.map
+//# sourceMappingURL=chunk-WAXEMZUV.js.map