@snappedly-tools/shipyard 0.7.0-staging.36081473933 → 0.7.0

package/dist/{chunk-L6PX5QTU.js → chunk-FDYOTN55.js}

@@ -1,15 +1,15 @@
-import { existsSync, constants } from 'fs';
-import { writeFile, chmod, mkdir, stat, copyFile, rm, readdir, mkdtemp, lstat, readFile, open } from 'fs/promises';
+import { toSessionTransferHandle, shellQuote } from './chunk-KMGNFXKN.js';
+import { existsSync, constants, lstatSync, realpathSync, statSync } from 'fs';
+import { mkdtemp, writeFile, chmod, mkdir, stat, copyFile, rm, readdir, lstat, readFile, open } from 'fs/promises';
 import * as clack from '@clack/prompts';
 import { FileSystem } from '@effect/platform';
-import { posix, join, basename, dirname, resolve, relative, sep, isAbsolute, normalize } from 'path';
+import { join, basename, posix, dirname, resolve, normalize, relative, sep, isAbsolute } from 'path';
 import { Context, Layer, Effect, Data, Exit, Duration, Option, Ref, Deferred, Schedule } from 'effect';
 import { styleText, promisify } from 'util';
+import { tmpdir, homedir } from 'os';
 import { randomBytes } from 'crypto';
 import { exec, execFile } from 'child_process';
-import { tmpdir } from 'os';
 
-// src/Display.ts
 var Display = class extends Context.Tag("Display")() {
 };
 var SilentDisplay = {
@@ -259,67 +259,6 @@ var ClackDisplay = {
     )
   })
 };
-
-// src/SandboxProvider.ts
-var createIsolatedSandboxProvider = (config) => ({
-  tag: "isolated",
-  name: config.name,
-  env: config.env ?? {},
-  create: config.create
-});
-var toSessionTransferHandle = (handle) => handle === void 0 ? void 0 : "copyFileIn" in handle ? handle : {
-  worktreePath: handle.worktreePath,
-  exec: (command, options) => handle.exec(command, options),
-  interactiveExec: handle.interactiveExec?.bind(handle),
-  copyFileIn: (source, destination) => handle.copyIn(source, destination),
-  copyFileOut: (source, destination) => handle.copyFileOut(source, destination),
-  close: () => handle.close()
-};
-
-// src/shutdownRegistry.ts
-var teardownCallbacks = /* @__PURE__ */ new Set();
-var listenersInstalled = false;
-var runTeardowns = () => {
-  for (const teardown of teardownCallbacks) {
-    try {
-      teardown();
-    } catch {
-    }
-  }
-};
-var handleExit = () => {
-  runTeardowns();
-};
-var handleSignal = () => {
-  detachListeners();
-  runTeardowns();
-  process.exit(1);
-};
-var attachListeners = () => {
-  if (listenersInstalled) return;
-  listenersInstalled = true;
-  process.on("exit", handleExit);
-  process.on("SIGINT", handleSignal);
-  process.on("SIGTERM", handleSignal);
-};
-var detachListeners = () => {
-  if (!listenersInstalled) return;
-  listenersInstalled = false;
-  process.removeListener("exit", handleExit);
-  process.removeListener("SIGINT", handleSignal);
-  process.removeListener("SIGTERM", handleSignal);
-};
-var registerShutdown = (teardown) => {
-  teardownCallbacks.add(teardown);
-  attachListeners();
-  let active = true;
-  return () => {
-    if (!active) return;
-    active = false;
-    teardownCallbacks.delete(teardown);
-    if (teardownCallbacks.size === 0) detachListeners();
-  };
-};
 var CwdError = class extends Data.TaggedError("CwdError") {
 };
 var resolveCwd = (cwd) => Effect.gen(function* () {
@@ -341,6 +280,8 @@ var resolveCwd = (cwd) => Effect.gen(function* () {
   }
   return resolved;
 });
+
+// src/errors.ts
 var ExecError = class extends Data.TaggedError("ExecError") {
 };
 var ExecHostError = class extends Data.TaggedError("ExecHostError") {
@@ -423,7 +364,10 @@ var WORKTREES_DIR = "worktrees";
 var PATCHES_DIR = "patches";
 var LOCKS_DIR = "locks";
 var RUNNER_DIR = "runner";
+var RUNNER_SANDBOX_MASK_DIR = "runner-sandbox-mask";
+var PARENT_GIT_SANDBOX_DIR = "/.shipyard-parent-git";
 var SYNC_BASE_REF = "refs/shipyard/sync-base";
+var CONTAINER_NAME_PREFIX = "shipyard-";
 var WINDOWS_DRIVE_PATH = /^[A-Za-z]:/;
 var assertSafeRelativePath = (relativePath, label = "relative path") => {
   if (relativePath.length === 0 || relativePath.includes("\0") || isAbsolute(relativePath) || WINDOWS_DRIVE_PATH.test(relativePath) || relativePath.startsWith("\\\\") || relativePath.split(/[\\/]/).some((part) => part === "..")) {
@@ -496,7 +440,7 @@ var SAFE_CONFIG = [
   ["checkout.recurseSubmodules", "false"]
 ];
 var COMMAND_CONFIG_PATTERN = "^(filter\\..*\\.(clean|smudge|process|required)|merge\\..*\\.driver|diff\\..*\\.(command|textconv)|difftool\\..*\\.cmd|mergetool\\..*\\.cmd)$";
-var runGit = (args, cwd, options = {}) => new Promise((resolve4, reject) => {
+var runGit = (args, cwd, options = {}) => new Promise((resolve6, reject) => {
   execFile(
     "git",
     [...args],
@@ -514,11 +458,11 @@ var runGit = (args, cwd, options = {}) => new Promise((resolve4, reject) => {
     },
     (error, stdout, stderr) => {
       if (!error) {
-        resolve4({ stdout, stderr, exitCode: 0 });
+        resolve6({ stdout, stderr, exitCode: 0 });
         return;
       }
       if (typeof error.code === "number") {
-        resolve4({ stdout, stderr, exitCode: error.code });
+        resolve6({ stdout, stderr, exitCode: error.code });
         return;
       }
       reject(error);
@@ -925,14 +869,6 @@ var pruneStale = (repoDir) => Effect.gen(function* () {
     })
   )
 );
-
-// src/shellQuote.ts
-var shellQuote = (value) => {
-  if (value.includes("\0")) {
-    throw new Error("Cannot quote a string containing a NUL byte");
-  }
-  return `'${value.replaceAll("'", "'\\''")}'`;
-};
 var PROTECTED_RUNNER_PATH = `${CONFIG_DIR}/${RUNNER_DIR}`;
 var pathKey = (value) => value.normalize("NFC").toLocaleLowerCase("en-US");
 var SAFE_RUNNER_ENV_KEYS = /* @__PURE__ */ new Set([
@@ -964,14 +900,121 @@ var assertExcludesRepositoryRunner = (relativePath) => {
     );
   }
 };
-var assertProtectedDirectoryIdentities = async (runnerDir, inspect) => {
+var assertSafeRepositoryRunnerDirectories = (repoDir) => {
+  const runnerDir = join(repoDir, CONFIG_DIR, RUNNER_DIR);
+  const maskDir = join(repoDir, CONFIG_DIR, RUNNER_SANDBOX_MASK_DIR);
+  for (const [name, path] of [
+    ["repository runner", runnerDir],
+    ["repository runner sandbox mask", maskDir]
+  ]) {
+    const stat2 = lstatSync(path);
+    if (stat2.isSymbolicLink() || !stat2.isDirectory()) {
+      throw new Error(
+        `The protected ${name} path must be a real directory: ${path}`
+      );
+    }
+  }
+  if (pathKey(realpathSync(runnerDir)) === pathKey(realpathSync(maskDir))) {
+    throw new Error(
+      "The protected repository runner and sandbox mask paths must be distinct directories."
+    );
+  }
+};
+var assertProtectedDirectoryIdentities = async (runnerDir, maskDir, inspect) => {
   if (!inspect) return;
   const runner = await inspect(runnerDir);
+  const mask = await inspect(maskDir);
   if (!runner.directory || runner.symbolicLink) {
     throw new Error(
       `The protected repository runner path must be a real directory: ${runnerDir}`
     );
   }
+  if (!mask.directory || mask.symbolicLink) {
+    throw new Error(
+      `The protected repository runner sandbox mask path must be a real directory: ${maskDir}`
+    );
+  }
+  if (pathKey(runner.realPath) === pathKey(mask.realPath)) {
+    throw new Error(
+      "The protected repository runner and sandbox mask paths must be distinct directories."
+    );
+  }
+};
+
+// src/CopyToWorktree.ts
+var COPY_TO_WORKTREE_TIMEOUT_MS = 6e4;
+var getCopyOnWriteFlags = (platform) => platform === "darwin" ? ["-cR"] : ["-R", "--reflink=auto"];
+var copyToWorktree = (paths, hostRepoDir, worktreePath, timeoutMs) => {
+  const effectiveTimeout = timeoutMs ?? COPY_TO_WORKTREE_TIMEOUT_MS;
+  return Effect.gen(function* () {
+    const cowFlags = getCopyOnWriteFlags(process.platform);
+    for (const relativePath of paths) {
+      let src;
+      let dest;
+      try {
+        assertExcludesRepositoryRunner(relativePath);
+        src = resolveSafeRelativePath(hostRepoDir, relativePath, "copy path");
+        dest = resolveSafeRelativePath(worktreePath, relativePath, "copy path");
+      } catch (error) {
+        return yield* Effect.fail(
+          new CopyToWorktreeError({
+            message: `Refusing unsafe copy path ${relativePath}: ${error instanceof Error ? error.message : String(error)}`,
+            path: relativePath,
+            stderr: error instanceof Error ? error.message : String(error),
+            exitCode: null
+          })
+        );
+      }
+      if (!existsSync(src)) {
+        continue;
+      }
+      yield* Effect.tryPromise({
+        try: async () => {
+          await assertNoSymlinkComponents(hostRepoDir, src, "copy source");
+          await assertNoSymlinkComponents(worktreePath, dest, "copy target");
+        },
+        catch: (error) => new CopyToWorktreeError({
+          message: `Refusing symlinked copy path ${relativePath}: ${error instanceof Error ? error.message : String(error)}`,
+          path: relativePath,
+          stderr: error instanceof Error ? error.message : String(error),
+          exitCode: null
+        })
+      });
+      yield* Effect.async((resume) => {
+        execFile("cp", [...cowFlags, src, dest], (error) => {
+          if (error) {
+            execFile("cp", ["-R", src, dest], (fallbackError, _, stderr) => {
+              if (fallbackError) {
+                resume(
+                  Effect.fail(
+                    new CopyToWorktreeError({
+                      message: `Failed to copy ${relativePath} to worktree: ${stderr || fallbackError.message}`,
+                      path: relativePath,
+                      stderr: stderr || fallbackError.message,
+                      exitCode: typeof fallbackError.code === "number" ? fallbackError.code : null
+                    })
+                  )
+                );
+              } else {
+                resume(Effect.succeed(void 0));
+              }
+            });
+          } else {
+            resume(Effect.succeed(void 0));
+          }
+        });
+      });
+    }
+  }).pipe(
+    withTimeout(
+      effectiveTimeout,
+      () => new CopyToWorktreeTimeoutError({
+        message: `Copying files to worktree timed out after ${effectiveTimeout}ms`,
+        timeoutMs: effectiveTimeout,
+        paths
+      })
+    )
+  );
 };
 
 // src/RecoveryMessage.ts
@@ -1481,6 +1524,8 @@ ${msg}`);
     });
   }
 });
+
+// src/SandboxLifecycle.ts
 var GIT_SETUP_TIMEOUT_MS = 1e4;
 var HOOK_TIMEOUT_MS = 6e4;
 var COMMIT_COLLECTION_TIMEOUT_MS = 3e4;
@@ -1814,169 +1859,6 @@ ${err instanceof Error ? err.message : String(err)}`
   }
   return { result, branch: finalBranch, commits };
 });
-var makeSandboxFromHandle = (handle) => ({
-  exec: (command, options) => Effect.tryPromise({
-    try: () => handle.exec(command, options),
-    catch: (e) => new ExecError({
-      command,
-      message: `exec failed: ${e instanceof Error ? e.message : String(e)}`
-    })
-  }),
-  copyIn: (hostPath, sandboxPath) => Effect.tryPromise({
-    try: () => handle.copyIn(hostPath, sandboxPath),
-    catch: (e) => new CopyError({
-      message: `copyIn failed: ${e instanceof Error ? e.message : String(e)}`
-    })
-  }),
-  copyFileOut: (sandboxPath, hostPath) => Effect.tryPromise({
-    try: () => handle.copyFileOut(sandboxPath, hostPath),
-    catch: (e) => new CopyError({
-      message: `copyFileOut failed: ${e instanceof Error ? e.message : String(e)}`
-    })
-  })
-});
-var SANDBOX_REPO_DIR = "/home/agent/workspace";
-var SandboxFactory = class extends Context.Tag("SandboxFactory")() {
-};
-var SandboxConfig = class extends Context.Tag("SandboxConfig")() {
-};
-var printWorktreePreservedMessage = (worktreePath, reason) => {
-  console.error(`
-${reason}`);
-  console.error(`  To review: cd ${worktreePath}`);
-  console.error(`  To clean up: git worktree remove --force ${worktreePath}`);
-};
-var cleanupWorktree = (worktreePath, exit) => hasUncommittedChanges(worktreePath).pipe(
-  Effect.catchAll(() => Effect.succeed(false)),
-  Effect.flatMap((isDirty) => {
-    if (isDirty) {
-      printWorktreePreservedMessage(
-        worktreePath,
-        Exit.isSuccess(exit) ? `Run succeeded but worktree has uncommitted changes at ${worktreePath}` : `Worktree preserved at ${worktreePath}`
-      );
-      return Effect.succeed(worktreePath);
-    }
-    if (!Exit.isSuccess(exit)) {
-      console.error(`
-Worktree removed (no uncommitted changes)`);
-    }
-    return remove(worktreePath).pipe(
-      Effect.map(() => void 0)
-    );
-  })
-);
-var attachPreservedPath = (path, e) => {
-  if (path !== void 0) {
-    if (e instanceof AgentIdleTimeoutError) {
-      return new AgentIdleTimeoutError({
-        message: e.message,
-        timeoutMs: e.timeoutMs,
-        preservedWorktreePath: path
-      });
-    }
-    if (e instanceof AgentError) {
-      return new AgentError({
-        message: e.message,
-        preservedWorktreePath: path
-      });
-    }
-  }
-  return e;
-};
-var WorktreeDockerSandboxFactory = {
-  layer: Layer.effect(
-    SandboxFactory,
-    Effect.gen(function* () {
-      const {
-        env,
-        hostRepoDir,
-        copyToWorktree: copyPaths,
-        name,
-        sandboxProvider,
-        branchStrategy,
-        hooks,
-        signal,
-        timeouts
-      } = yield* SandboxConfig;
-      const branch = branchStrategy.type === "branch" ? branchStrategy.branch : void 0;
-      const baseBranch = branchStrategy.type === "branch" ? branchStrategy.baseBranch : void 0;
-      const fileSystem = yield* FileSystem.FileSystem;
-      const pruneAndCreate = () => pruneStale(hostRepoDir).pipe(
-        Effect.catchAll(
-          (e) => Effect.sync(() => {
-            console.error(
-              "[shipyard] Warning: failed to prune stale worktrees:",
-              e.message
-            );
-          })
-        ),
-        Effect.andThen(
-          branch ? create(hostRepoDir, { branch, baseBranch }) : create(hostRepoDir, { name })
-        ),
-        Effect.provideService(FileSystem.FileSystem, fileSystem)
-      );
-      return {
-        withSandbox: (makeEffect) => {
-          {
-            let preservedPath;
-            return Effect.acquireUseRelease(
-              pruneAndCreate(),
-              (worktreeInfo) => (hooks?.host?.onWorktreeReady?.length ? runHostHooks(
-                hooks.host.onWorktreeReady,
-                worktreeInfo.path,
-                signal
-              ) : Effect.void).pipe(
-                Effect.andThen(
-                  Effect.acquireUseRelease(
-                    startSandbox({
-                      provider: sandboxProvider,
-                      hostRepoDir: worktreeInfo.path,
-                      sourceRepoDir: hostRepoDir,
-                      env,
-                      copyPaths,
-                      copyTimeoutMs: timeouts?.copyToWorktreeMs
-                    }),
-                    ({ sandbox, worktreePath, handle }) => makeEffect(
-                      {
-                        hostWorktreePath: worktreeInfo.path,
-                        sandboxRepoPath: worktreePath,
-                        sessionTransferHandle: toSessionTransferHandle(handle),
-                        applyToHost: () => syncOut(
-                          worktreeInfo.path,
-                          handle
-                        )
-                      },
-                      sandbox
-                    ),
-                    ({ handle }) => Effect.tryPromise({
-                      try: () => handle.close(),
-                      catch: () => void 0
-                    }).pipe(Effect.orDie)
-                  )
-                )
-              ),
-              (worktreeInfo, exit) => cleanupWorktree(worktreeInfo.path, exit).pipe(
-                Effect.tap((p) => {
-                  preservedPath = p;
-                }),
-                Effect.asVoid,
-                Effect.orDie
-              )
-            ).pipe(
-              Effect.map((value) => ({
-                value,
-                preservedWorktreePath: preservedPath
-              })),
-              Effect.mapError(
-                (e) => attachPreservedPath(preservedPath, e)
-              )
-            );
-          }
-        }
-      };
-    })
-  )
-};
 var execHostGit3 = (args, cwd) => Effect.tryPromise({
   try: () => execHostGit(args, cwd),
   catch: (e) => new SyncError({
@@ -2082,17 +1964,101 @@ var syncIn = (hostRepoDir, handle) => Effect.gen(function* () {
 // src/startSandbox.ts
 var CONTAINER_START_TIMEOUT_MS = 12e4;
 var SYNC_IN_TIMEOUT_MS = 12e4;
-var COPY_PATHS_TIMEOUT_MS = 6e4;
-var startSandbox = (options) => Effect.gen(function* () {
-  const handle = yield* Effect.tryPromise({
-    try: () => options.provider.create({
-      env: options.env,
-      hostRepoPath: options.sourceRepoDir ?? options.hostRepoDir
-    }),
-    catch: (e) => new WorktreeError({
-      message: `Isolated provider '${options.provider.name}' setup failed: ${e instanceof Error ? e.message : String(e)}`
-    })
-  }).pipe(
+var COPY_PATHS_TIMEOUT_MS = 12e4;
+var startSandbox = (options) => {
+  if (options.provider.tag === "bind-mount") {
+    return startBindMountSandbox(options);
+  }
+  if (options.provider.tag === "none") {
+    return startNoSandbox(options);
+  }
+  return startIsolatedSandbox(options);
+};
+var startNoSandbox = (options) => Effect.tryPromise({
+  try: () => options.provider.create({
+    worktreePath: options.worktreeOrRepoPath,
+    env: options.env
+  }),
+  catch: (e) => new WorktreeError({
+    message: `Provider '${options.provider.name}' create failed: ${e instanceof Error ? e.message : String(e)}`
+  })
+}).pipe(
+  Effect.map((handle) => ({
+    handle,
+    sandbox: makeSandboxFromHandle(handle),
+    worktreePath: handle.worktreePath
+  }))
+);
+var startBindMountSandbox = (options) => Effect.tryPromise({
+  try: () => {
+    const usesRunnerMask = options.worktreeOrRepoPath === options.hostRepoDir && existsSync(join(options.hostRepoDir, CONFIG_DIR, RUNNER_DIR)) && existsSync(
+      join(options.hostRepoDir, CONFIG_DIR, RUNNER_SANDBOX_MASK_DIR)
+    );
+    if (usesRunnerMask) {
+      assertSafeRepositoryRunnerDirectories(options.hostRepoDir);
+    }
+    const rawMounts = [
+      {
+        hostPath: options.worktreeOrRepoPath,
+        sandboxPath: options.repoDir
+      },
+      ...options.gitMounts,
+      ...usesRunnerMask ? [
+        {
+          hostPath: join(
+            options.hostRepoDir,
+            CONFIG_DIR,
+            RUNNER_SANDBOX_MASK_DIR
+          ),
+          sandboxPath: posix.join(
+            options.repoDir,
+            CONFIG_DIR,
+            RUNNER_DIR
+          ),
+          readonly: true
+        }
+      ] : []
+    ];
+    const mounts = normalizeMounts(
+      rawMounts,
+      options.worktreeOrRepoPath,
+      SANDBOX_REPO_DIR
+    );
+    const worktreePath = process.platform === "win32" ? options.worktreeOrRepoPath.replace(/\\/g, "/") : options.worktreeOrRepoPath;
+    return options.provider.create({
+      worktreePath,
+      hostRepoPath: options.hostRepoDir,
+      mounts,
+      env: options.env
+    });
+  },
+  catch: (e) => new WorktreeError({
+    message: `Provider '${options.provider.name}' create failed: ${e instanceof Error ? e.message : String(e)}`
+  })
+}).pipe(
+  Effect.map((handle) => ({
+    handle,
+    sandbox: makeSandboxFromHandle(handle),
+    worktreePath: handle.worktreePath
+  })),
+  withTimeout(
+    CONTAINER_START_TIMEOUT_MS,
+    () => new ContainerStartTimeoutError({
+      message: `Sandbox container start timed out after ${CONTAINER_START_TIMEOUT_MS}ms`,
+      timeoutMs: CONTAINER_START_TIMEOUT_MS
+    })
+  )
+);
+var startIsolatedSandbox = (options) => Effect.gen(function* () {
+  const handle = yield* Effect.tryPromise({
+    try: () => options.provider.create({
+      env: options.env,
+      hostRepoPath: options.sourceRepoDir ?? options.hostRepoDir
+    }),
+    catch: (e) => new WorktreeError({
+      message: `Isolated provider '${options.provider.name}' setup failed: ${e instanceof Error ? e.message : String(e)}`
+    })
+  }).pipe(
     withTimeout(
       CONTAINER_START_TIMEOUT_MS,
       () => new ContainerStartTimeoutError({
@@ -2113,8 +2079,6 @@ var startSandbox = (options) => Effect.gen(function* () {
     );
     if (options.copyPaths && options.copyPaths.length > 0) {
       const pathsToCopy = options.copyPaths;
-      const copySourceDir = options.copySourceDir ?? options.sourceRepoDir ?? options.hostRepoDir;
-      const copyTimeoutMs = options.copyTimeoutMs ?? COPY_PATHS_TIMEOUT_MS;
       yield* Effect.gen(function* () {
         for (const relativePath of pathsToCopy) {
           let hostPath;
@@ -2122,7 +2086,7 @@ var startSandbox = (options) => Effect.gen(function* () {
           try {
             assertExcludesRepositoryRunner(relativePath);
             hostPath = resolveSafeRelativePath(
-              copySourceDir,
+              options.sourceRepoDir ?? options.hostRepoDir,
               relativePath,
               "copy path"
             );
@@ -2145,7 +2109,7 @@ var startSandbox = (options) => Effect.gen(function* () {
           yield* Effect.tryPromise({
             try: async () => {
               await assertNoSymlinkComponents(
-                copySourceDir,
+                options.sourceRepoDir ?? options.hostRepoDir,
                 hostPath,
                 "copy source"
               );
@@ -2163,10 +2127,10 @@ var startSandbox = (options) => Effect.gen(function* () {
         }
       }).pipe(
         withTimeout(
-          copyTimeoutMs,
+          COPY_PATHS_TIMEOUT_MS,
           () => new CopyToWorktreeTimeoutError({
-            message: `Copying paths to sandbox timed out after ${copyTimeoutMs}ms`,
-            timeoutMs: copyTimeoutMs,
+            message: `Copying paths to worktree timed out after ${COPY_PATHS_TIMEOUT_MS}ms`,
+            timeoutMs: COPY_PATHS_TIMEOUT_MS,
             paths: pathsToCopy
           })
         )
@@ -2180,6 +2144,667 @@ var startSandbox = (options) => Effect.gen(function* () {
   }).pipe(Effect.onError(() => Effect.promise(() => handle.close())));
 });
 
-export { ACTIVATION_LABEL, AgentError, AgentIdleTimeoutError, CLI_NAME, CONFIG_DIR, ClackDisplay, ConfigDirError, CopyToWorktreeError, CopyToWorktreeTimeoutError, CwdError, Display, DockerError, ExecHostError, FileDisplay, InitError, LOCKS_DIR, LOGS_DIR, PRODUCT_NAME, PromptError, PromptExpansionTimeoutError, RUNNER_DIR, RUNTIME_NAMESPACE, SANDBOX_REPO_DIR, SandboxConfig, SandboxFactory, SessionCaptureError, SilentDisplay, WorktreeDockerSandboxFactory, assertExcludesRepositoryRunner, assertNoSymlinkComponents, assertProtectedDirectoryIdentities, create, createIsolatedSandboxProvider, generateTempBranchName, getCurrentBranch, hasUncommittedChanges, makeSandboxFromHandle, pruneStale, registerShutdown, remove, repositoryRunnerEnvironment, resolveCwd, resolveSafeRelativePath, runHostHooks, shellQuote, startSandbox, syncOut, toSessionTransferHandle, withSandboxLifecycle, withTimeout };
-//# sourceMappingURL=chunk-L6PX5QTU.js.map
-//# sourceMappingURL=chunk-L6PX5QTU.js.map
+// src/SandboxFactory.ts
+var getCopyIn = (handle) => {
+  if ("copyIn" in handle) {
+    return (hostPath, sandboxPath) => Effect.tryPromise({
+      try: () => handle.copyIn(hostPath, sandboxPath),
+      catch: (e) => new CopyError({
+        message: `copyIn failed: ${e instanceof Error ? e.message : String(e)}`
+      })
+    });
+  }
+  if ("copyFileIn" in handle) {
+    return (hostPath, sandboxPath) => Effect.tryPromise({
+      try: () => handle.copyFileIn(hostPath, sandboxPath),
+      catch: (e) => new CopyError({
+        message: `copyFileIn failed: ${e instanceof Error ? e.message : String(e)}`
+      })
+    });
+  }
+  return () => Effect.fail(
+    new CopyError({
+      message: "copyIn is not supported for this sandbox provider"
+    })
+  );
+};
+var makeSandboxFromHandle = (handle) => ({
+  exec: (command, options) => Effect.tryPromise({
+    try: () => handle.exec(command, options),
+    catch: (e) => new ExecError({
+      command,
+      message: `exec failed: ${e instanceof Error ? e.message : String(e)}`
+    })
+  }),
+  copyIn: getCopyIn(handle),
+  copyFileOut: "copyFileOut" in handle ? (sandboxPath, hostPath) => Effect.tryPromise({
+    try: () => handle.copyFileOut(sandboxPath, hostPath),
+    catch: (e) => new CopyError({
+      message: `copyFileOut failed: ${e instanceof Error ? e.message : String(e)}`
+    })
+  }) : () => Effect.fail(
+    new CopyError({
+      message: "copyFileOut is not supported for this sandbox provider"
+    })
+  )
+});
+var SANDBOX_REPO_DIR = "/home/agent/workspace";
+var SandboxFactory = class extends Context.Tag("SandboxFactory")() {
+};
+var SandboxConfig = class extends Context.Tag("SandboxConfig")() {
+};
+var printWorktreePreservedMessage = (worktreePath, reason) => {
+  console.error(`
+${reason}`);
+  console.error(`  To review: cd ${worktreePath}`);
+  console.error(`  To clean up: git worktree remove --force ${worktreePath}`);
+};
+var cleanupWorktree = (worktreePath, exit) => hasUncommittedChanges(worktreePath).pipe(
+  Effect.catchAll(() => Effect.succeed(false)),
+  Effect.flatMap((isDirty) => {
+    if (isDirty) {
+      printWorktreePreservedMessage(
+        worktreePath,
+        Exit.isSuccess(exit) ? `Run succeeded but worktree has uncommitted changes at ${worktreePath}` : `Worktree preserved at ${worktreePath}`
+      );
+      return Effect.succeed(worktreePath);
+    }
+    if (!Exit.isSuccess(exit)) {
+      console.error(`
+Worktree removed (no uncommitted changes)`);
+    }
+    return remove(worktreePath).pipe(
+      Effect.map(() => void 0)
+    );
+  })
+);
+var attachPreservedPath = (path, e) => {
+  if (path !== void 0) {
+    if (e instanceof AgentIdleTimeoutError) {
+      return new AgentIdleTimeoutError({
+        message: e.message,
+        timeoutMs: e.timeoutMs,
+        preservedWorktreePath: path
+      });
+    }
+    if (e instanceof AgentError) {
+      return new AgentError({
+        message: e.message,
+        preservedWorktreePath: path
+      });
+    }
+  }
+  return e;
+};
+var resolveGitMounts = (gitPath) => Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const stat2 = yield* fs.stat(gitPath);
+  if (stat2.type === "Directory") {
+    return [{ hostPath: gitPath, sandboxPath: gitPath }];
+  }
+  const content = (yield* fs.readFileString(gitPath)).trim();
+  const match = content.match(/^gitdir:\s*(.+)$/);
+  if (!match) {
+    return [{ hostPath: gitPath, sandboxPath: gitPath }];
+  }
+  const gitdirPath = match[1];
+  const parentGitDir = resolve(gitdirPath, "..", "..");
+  return [
+    { hostPath: gitPath, sandboxPath: gitPath },
+    { hostPath: parentGitDir, sandboxPath: parentGitDir }
+  ];
+});
+var WorktreeDockerSandboxFactory = {
+  layer: Layer.effect(
+    SandboxFactory,
+    Effect.gen(function* () {
+      const {
+        env,
+        hostRepoDir,
+        copyToWorktree: copyPaths,
+        name,
+        sandboxProvider,
+        branchStrategy,
+        hooks,
+        signal,
+        timeouts
+      } = yield* SandboxConfig;
+      const isHeadMode = branchStrategy.type === "head";
+      const branch = branchStrategy.type === "branch" ? branchStrategy.branch : void 0;
+      const baseBranch = branchStrategy.type === "branch" ? branchStrategy.baseBranch : void 0;
+      const fileSystem = yield* FileSystem.FileSystem;
+      const display = yield* Display;
+      const pruneAndCreate = () => pruneStale(hostRepoDir).pipe(
+        Effect.catchAll(
+          (e) => Effect.sync(() => {
+            console.error(
+              "[shipyard] Warning: failed to prune stale worktrees:",
+              e.message
+            );
+          })
+        ),
+        Effect.andThen(
+          branch ? create(hostRepoDir, { branch, baseBranch }) : create(hostRepoDir, { name })
+        ),
+        Effect.provideService(FileSystem.FileSystem, fileSystem)
+      );
+      return {
+        withSandbox: (makeEffect) => {
+          if (sandboxProvider.tag === "none") {
+            let preservedPath;
+            if (isHeadMode) {
+              return (hooks?.host?.onWorktreeReady?.length ? runHostHooks(
+                hooks.host.onWorktreeReady,
+                hostRepoDir,
+                signal
+              ) : Effect.void).pipe(
+                Effect.andThen(
+                  Effect.acquireUseRelease(
+                    startSandbox({
+                      provider: sandboxProvider,
+                      hostRepoDir,
+                      env,
+                      worktreeOrRepoPath: hostRepoDir
+                    }),
+                    ({ sandbox, worktreePath }) => makeEffect(
+                      {
+                        hostWorktreePath: hostRepoDir,
+                        sandboxRepoPath: worktreePath
+                      },
+                      sandbox
+                    ),
+                    ({ handle }) => Effect.tryPromise({
+                      try: () => handle.close(),
+                      catch: () => void 0
+                    }).pipe(Effect.orDie)
+                  ).pipe(
+                    Effect.map((value) => ({
+                      value,
+                      preservedWorktreePath: void 0
+                    }))
+                  )
+                )
+              );
+            }
+            return Effect.acquireUseRelease(
+              pruneAndCreate(),
+              (worktreeInfo) => (copyPaths && copyPaths.length > 0 ? display.spinner(
+                "Copying to worktree",
+                copyToWorktree(
+                  copyPaths,
+                  hostRepoDir,
+                  worktreeInfo.path,
+                  timeouts?.copyToWorktreeMs
+                )
+              ) : Effect.succeed(void 0)).pipe(
+                Effect.andThen(
+                  hooks?.host?.onWorktreeReady?.length ? runHostHooks(
+                    hooks.host.onWorktreeReady,
+                    worktreeInfo.path,
+                    signal
+                  ) : Effect.void
+                ),
+                Effect.andThen(
+                  Effect.acquireUseRelease(
+                    startSandbox({
+                      provider: sandboxProvider,
+                      hostRepoDir,
+                      env,
+                      worktreeOrRepoPath: worktreeInfo.path
+                    }),
+                    ({ sandbox, worktreePath }) => makeEffect(
+                      {
+                        hostWorktreePath: worktreeInfo.path,
+                        sandboxRepoPath: worktreePath
+                      },
+                      sandbox
+                    ),
+                    ({ handle }) => Effect.tryPromise({
+                      try: () => handle.close(),
+                      catch: () => void 0
+                    }).pipe(Effect.orDie)
+                  )
+                )
+              ),
+              (worktreeInfo, exit) => cleanupWorktree(worktreeInfo.path, exit).pipe(
+                Effect.tap((p) => {
+                  preservedPath = p;
+                }),
+                Effect.asVoid,
+                Effect.orDie
+              )
+            ).pipe(
+              Effect.map((value) => ({
+                value,
+                preservedWorktreePath: preservedPath
+              })),
+              Effect.mapError(
+                (e) => attachPreservedPath(preservedPath, e)
+              )
+            );
+          }
+          if (sandboxProvider.tag === "isolated") {
+            let preservedPath;
+            return Effect.acquireUseRelease(
+              pruneAndCreate(),
+              (worktreeInfo) => (hooks?.host?.onWorktreeReady?.length ? runHostHooks(
+                hooks.host.onWorktreeReady,
+                worktreeInfo.path,
+                signal
+              ) : Effect.void).pipe(
+                Effect.andThen(
+                  Effect.acquireUseRelease(
+                    startSandbox({
+                      provider: sandboxProvider,
+                      hostRepoDir: worktreeInfo.path,
+                      sourceRepoDir: hostRepoDir,
+                      env,
+                      copyPaths
+                    }),
+                    ({ sandbox, worktreePath, handle }) => makeEffect(
+                      {
+                        hostWorktreePath: worktreeInfo.path,
+                        sandboxRepoPath: worktreePath,
+                        bindMountHandle: toSessionTransferHandle(handle),
+                        applyToHost: () => syncOut(
+                          worktreeInfo.path,
+                          handle
+                        )
+                      },
+                      sandbox
+                    ),
+                    ({ handle }) => Effect.tryPromise({
+                      try: () => handle.close(),
+                      catch: () => void 0
+                    }).pipe(Effect.orDie)
+                  )
+                )
+              ),
+              (worktreeInfo, exit) => cleanupWorktree(worktreeInfo.path, exit).pipe(
+                Effect.tap((p) => {
+                  preservedPath = p;
+                }),
+                Effect.asVoid,
+                Effect.orDie
+              )
+            ).pipe(
+              Effect.map((value) => ({
+                value,
+                preservedWorktreePath: preservedPath
+              })),
+              Effect.mapError(
+                (e) => attachPreservedPath(preservedPath, e)
+              )
+            );
+          }
+          if (isHeadMode) {
+            const gitPath = join(hostRepoDir, ".git");
+            return (hooks?.host?.onWorktreeReady?.length ? runHostHooks(hooks.host.onWorktreeReady, hostRepoDir, signal) : Effect.void).pipe(
+              Effect.andThen(resolveGitMounts(gitPath)),
+              Effect.provideService(FileSystem.FileSystem, fileSystem),
+              Effect.mapError(
+                (e) => new WorktreeError({
+                  message: `Failed to resolve git mounts: ${e}`
+                })
+              ),
+              Effect.flatMap(
+                (gitMounts) => (
+                  // Patch git mounts for Windows worktree compatibility (ADR-0006)
+                  patchGitMountsForWindows(
+                    gitMounts,
+                    hostRepoDir,
+                    SANDBOX_REPO_DIR
+                  )
+                )
+              ),
+              Effect.flatMap(
+                (gitMounts) => Effect.acquireUseRelease(
+                  startSandbox({
+                    provider: sandboxProvider,
+                    hostRepoDir,
+                    env,
+                    worktreeOrRepoPath: hostRepoDir,
+                    gitMounts,
+                    repoDir: SANDBOX_REPO_DIR
+                  }),
+                  // Use
+                  ({ sandbox, worktreePath, handle }) => makeEffect(
+                    {
+                      hostWorktreePath: hostRepoDir,
+                      sandboxRepoPath: worktreePath,
+                      bindMountHandle: handle
+                    },
+                    sandbox
+                  ),
+                  // Release
+                  ({ handle }) => Effect.tryPromise({
+                    try: () => handle.close(),
+                    catch: () => void 0
+                  }).pipe(Effect.orDie)
+                ).pipe(
+                  Effect.map((value) => ({
+                    value,
+                    preservedWorktreePath: void 0
+                  }))
+                )
+              )
+            );
+          }
+          let preservedWorktreePath;
+          return Effect.acquireUseRelease(
+            // Acquire: prune stale worktrees (best-effort), then create the worktree.
+            pruneAndCreate(),
+            // Use: copy files, run host hooks, resolve+patch git mounts, then start
+            // the sandbox under a nested acquireUseRelease.
+            (worktreeInfo) => (copyPaths && copyPaths.length > 0 ? display.spinner(
+              "Copying to worktree",
+              copyToWorktree(
+                copyPaths,
+                hostRepoDir,
+                worktreeInfo.path,
+                timeouts?.copyToWorktreeMs
+              )
+            ) : Effect.succeed(void 0)).pipe(
+              Effect.andThen(
+                hooks?.host?.onWorktreeReady?.length ? runHostHooks(
+                  hooks.host.onWorktreeReady,
+                  worktreeInfo.path,
+                  signal
+                ) : Effect.void
+              ),
+              Effect.andThen(
+                resolveGitMounts(join(hostRepoDir, ".git")).pipe(
+                  Effect.provideService(FileSystem.FileSystem, fileSystem),
+                  Effect.mapError(
+                    (e) => new WorktreeError({
+                      message: `Failed to resolve git mounts: ${e}`
+                    })
+                  )
+                )
+              ),
+              // Patch git mounts for Windows worktree compatibility (ADR-0006)
+              Effect.flatMap(
+                (gitMounts) => patchGitMountsForWindows(
+                  gitMounts,
+                  worktreeInfo.path,
+                  SANDBOX_REPO_DIR
+                )
+              ),
+              Effect.flatMap(
+                (gitMounts) => Effect.acquireUseRelease(
+                  // sandboxProvider is guaranteed bind-mount here
+                  // (isolated providers return early above)
+                  startSandbox({
+                    provider: sandboxProvider,
+                    hostRepoDir,
+                    env,
+                    worktreeOrRepoPath: worktreeInfo.path,
+                    gitMounts,
+                    repoDir: SANDBOX_REPO_DIR
+                  }),
+                  ({ sandbox, worktreePath, handle }) => makeEffect(
+                    {
+                      hostWorktreePath: worktreeInfo.path,
+                      sandboxRepoPath: worktreePath,
+                      bindMountHandle: handle
+                    },
+                    sandbox
+                  ),
+                  ({ handle }) => Effect.tryPromise({
+                    try: () => handle.close(),
+                    catch: () => void 0
+                  }).pipe(Effect.orDie)
+                )
+              )
+            ),
+            // Release: remove or preserve the worktree based on dirty state.
+            (worktreeInfo, exit) => cleanupWorktree(worktreeInfo.path, exit).pipe(
+              Effect.tap((p) => {
+                preservedWorktreePath = p;
+              }),
+              Effect.asVoid,
+              Effect.orDie
+            )
+          ).pipe(
+            Effect.map((value) => ({
+              value,
+              preservedWorktreePath
+            })),
+            Effect.mapError(
+              (e) => attachPreservedPath(preservedWorktreePath, e)
+            )
+          );
+        }
+      };
+    })
+  )
+};
+
+// src/mountUtils.ts
+var defaultImageName = (repoDir) => {
+  const dirName = repoDir.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? "local";
+  const sanitized = dirName.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
+  return `${RUNTIME_NAMESPACE}:${sanitized || "local"}`;
+};
+var expandTilde = (p, homeDirPath) => {
+  const home = homeDirPath ?? homedir();
+  if (p === "~") return home;
+  if (p.startsWith("~/") || p.startsWith("~\\")) return home + "/" + p.slice(2);
+  return p;
+};
+var resolveHostPath = (hostPath) => {
+  const expanded = expandTilde(hostPath);
+  return isAbsolute(expanded) ? expanded : resolve(process.cwd(), expanded);
+};
+var resolveSandboxPath = (sandboxPath, sandboxHomedir) => {
+  const hasTilde = sandboxPath === "~" || sandboxPath.startsWith("~/") || sandboxPath.startsWith("~\\");
+  if (hasTilde && sandboxHomedir === void 0) {
+    throw new Error(
+      `sandboxPath "${sandboxPath}" contains a tilde but the provider has no sandboxHomedir set`
+    );
+  }
+  const expanded = hasTilde ? expandTilde(sandboxPath, sandboxHomedir) : sandboxPath;
+  return isAbsolute(expanded) ? resolve(expanded) : resolve(SANDBOX_REPO_DIR, expanded);
+};
+var resolveUserMounts = (mounts, sandboxHomedir) => mounts.map((m) => {
+  const resolvedHostPath = resolveHostPath(m.hostPath);
+  if (!existsSync(resolvedHostPath)) {
+    throw new Error(
+      `Mount hostPath does not exist: ${m.hostPath}` + (m.hostPath !== resolvedHostPath ? ` (resolved to ${resolvedHostPath})` : "")
+    );
+  }
+  return {
+    hostPath: resolvedHostPath,
+    sandboxPath: resolveSandboxPath(m.sandboxPath, sandboxHomedir),
+    ...m.readonly ? { readonly: true } : {}
+  };
+});
+var normalizeMounts = (mounts, worktreeHostPath, sandboxRepoDir, platform = process.platform) => {
+  if (platform !== "win32") return mounts;
+  const normalizedWorktree = worktreeHostPath.replace(/\\/g, "/");
+  return mounts.map((m) => {
+    const hostPath = m.hostPath.replace(/\\/g, "/");
+    let sandboxPath = m.sandboxPath;
+    if (/^[A-Za-z]:[/\\]/.test(sandboxPath) || sandboxPath.includes("\\")) {
+      const normalizedSandboxPath = sandboxPath.replace(/\\/g, "/");
+      if (normalizedSandboxPath.startsWith(normalizedWorktree + "/")) {
+        const relativeSuffix = normalizedSandboxPath.slice(
+          normalizedWorktree.length
+        );
+        sandboxPath = sandboxRepoDir + relativeSuffix;
+      } else if (normalizedSandboxPath === normalizedWorktree) {
+        sandboxPath = sandboxRepoDir;
+      } else {
+        sandboxPath = normalizedSandboxPath;
+      }
+    }
+    return { ...m, hostPath, sandboxPath };
+  });
+};
+var parseGitdirPath = (gitdirPath) => {
+  const normalized = gitdirPath.replace(/\\/g, "/").replace(/\/+$/, "");
+  const segments = normalized.split("/");
+  const worktreeName = segments.pop();
+  segments.pop();
+  const parentGitDir = segments.join("/");
+  return { worktreeName, parentGitDir };
+};
+var patchGitMountsForWindows = (gitMounts, worktreeHostPath, sandboxRepoDir, readFile2, statFile, platform = process.platform) => Effect.gen(function* () {
+  if (platform !== "win32") return gitMounts;
+  const _readFile = readFile2 ?? (async (p) => {
+    const { readFile: rf } = await import('fs/promises');
+    return rf(p, "utf-8");
+  });
+  const _statFile = statFile ?? (async (p) => {
+    const { stat: stat2 } = await import('fs/promises');
+    const s = await stat2(p);
+    return s.isDirectory() ? "directory" : "file";
+  });
+  const gitEntryPath = join(worktreeHostPath, ".git");
+  const gitEntryType = yield* Effect.tryPromise({
+    try: () => _statFile(gitEntryPath),
+    catch: () => null
+  }).pipe(Effect.catchAll(() => Effect.succeed(null)));
+  if (gitEntryType === null) return gitMounts;
+  if (gitEntryType === "directory") return gitMounts;
+  const content = yield* Effect.tryPromise({
+    try: () => _readFile(gitEntryPath),
+    catch: () => null
+  }).pipe(
+    Effect.map((s) => s.trim()),
+    Effect.catchAll(() => Effect.succeed(null))
+  );
+  if (content === null) return gitMounts;
+  const match = content.match(/^gitdir:\s*(.+)$/);
+  if (!match) return gitMounts;
+  const gitdirPath = match[1];
+  const { parentGitDir, worktreeName } = parseGitdirPath(gitdirPath);
+  const correctedGitdir = `${PARENT_GIT_SANDBOX_DIR}/worktrees/${worktreeName}`;
+  const tempDir = yield* Effect.tryPromise({
+    try: () => mkdtemp(join(tmpdir(), `${CONTAINER_NAME_PREFIX}git-`)),
+    catch: (e) => new WorktreeError({
+      message: `Failed to create temp dir for git override: ${e instanceof Error ? e.message : String(e)}`
+    })
+  });
+  const tempGitFile = join(tempDir, "git-override");
+  yield* Effect.tryPromise({
+    try: () => writeFile(tempGitFile, `gitdir: ${correctedGitdir}
+`),
+    catch: (e) => new WorktreeError({
+      message: `Failed to write git override file: ${e instanceof Error ? e.message : String(e)}`
+    })
+  });
+  const normalizedParentGitDir = parentGitDir.replace(/\\/g, "/");
+  const gitFileHostPath = gitEntryPath.replace(/\\/g, "/");
+  const correctedMounts = [];
+  let replacedGitFile = false;
+  for (const m of gitMounts) {
+    const normalizedHostPath = m.hostPath.replace(/\\/g, "/");
+    if (normalizedHostPath === normalizedParentGitDir) {
+      correctedMounts.push({ ...m, sandboxPath: PARENT_GIT_SANDBOX_DIR });
+    } else if (normalizedHostPath === gitFileHostPath) {
+      correctedMounts.push({
+        ...m,
+        hostPath: tempGitFile,
+        sandboxPath: `${sandboxRepoDir}/.git`
+      });
+      replacedGitFile = true;
+    } else {
+      correctedMounts.push(m);
+    }
+  }
+  if (!replacedGitFile) {
+    correctedMounts.push({
+      hostPath: tempGitFile,
+      sandboxPath: `${sandboxRepoDir}/.git`
+    });
+  }
+  return correctedMounts;
+});
+var formatVolumeMount = (mount, selinuxLabel) => {
+  const base = `${mount.hostPath}:${mount.sandboxPath}`;
+  const options = [mount.readonly ? "ro" : void 0, selinuxLabel || void 0].filter((option) => option !== void 0).join(",");
+  return options ? `${base}:${options}` : base;
+};
+var processFileMountParents = (mounts, sandboxHomedir, statFn = statSync) => {
+  const parentDirs = /* @__PURE__ */ new Set();
+  for (const mount of mounts) {
+    let isFile;
+    try {
+      isFile = statFn(mount.hostPath).isFile();
+    } catch {
+      continue;
+    }
+    if (!isFile) continue;
+    const parentDir = resolve(dirname(mount.sandboxPath));
+    const homeDir = resolve(sandboxHomedir);
+    if (parentDir === homeDir) continue;
+    const fromHome = relative(homeDir, parentDir);
+    if (fromHome === ".." || fromHome.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(fromHome)) {
+      throw new Error(
+        `Cannot mount file to '${mount.sandboxPath}': parent directory '${parentDir}' is outside the sandbox home directory ('${homeDir}'). Mount the parent directory instead, or rebuild the image with '${parentDir}' pre-created.`
+      );
+    }
+    parentDirs.add(parentDir);
+  }
+  return [...parentDirs];
+};
+var assertIsolatedWorkspaceMounts = (mounts) => {
+  for (const mount of mounts) {
+    const path = posix.resolve(mount.sandboxPath);
+    if (path === "/" || path === SANDBOX_REPO_DIR || path.startsWith(`${SANDBOX_REPO_DIR}/`) || SANDBOX_REPO_DIR.startsWith(`${path}/`)) {
+      throw new Error(
+        `Mount overlaps the isolated workspace: ${mount.sandboxPath}. Mount outside ${SANDBOX_REPO_DIR} or use copyToWorktree.`
+      );
+    }
+  }
+};
+
+// src/shutdownRegistry.ts
+var teardownCallbacks = /* @__PURE__ */ new Set();
+var listenersInstalled = false;
+var runTeardowns = () => {
+  for (const teardown of teardownCallbacks) {
+    try {
+      teardown();
+    } catch {
+    }
+  }
+};
+var handleExit = () => {
+  runTeardowns();
+};
+var handleSignal = () => {
+  detachListeners();
+  runTeardowns();
+  process.exit(1);
+};
+var attachListeners = () => {
+  if (listenersInstalled) return;
+  listenersInstalled = true;
+  process.on("exit", handleExit);
+  process.on("SIGINT", handleSignal);
+  process.on("SIGTERM", handleSignal);
+};
+var detachListeners = () => {
+  if (!listenersInstalled) return;
+  listenersInstalled = false;
+  process.removeListener("exit", handleExit);
+  process.removeListener("SIGINT", handleSignal);
+  process.removeListener("SIGTERM", handleSignal);
+};
+var registerShutdown = (teardown) => {
+  teardownCallbacks.add(teardown);
+  attachListeners();
+  let active = true;
+  return () => {
+    if (!active) return;
+    active = false;
+    teardownCallbacks.delete(teardown);
+    if (teardownCallbacks.size === 0) detachListeners();
+  };
+};
+
+export { ACTIVATION_LABEL, AgentError, AgentIdleTimeoutError, CLI_NAME, CONFIG_DIR, ClackDisplay, ConfigDirError, CwdError, Display, DockerError, ExecHostError, FileDisplay, InitError, LOCKS_DIR, LOGS_DIR, PRODUCT_NAME, PromptError, PromptExpansionTimeoutError, RUNNER_DIR, RUNNER_SANDBOX_MASK_DIR, SANDBOX_REPO_DIR, SandboxConfig, SandboxFactory, SessionCaptureError, SilentDisplay, WorktreeDockerSandboxFactory, assertIsolatedWorkspaceMounts, assertNoSymlinkComponents, assertProtectedDirectoryIdentities, copyToWorktree, create, defaultImageName, formatVolumeMount, generateTempBranchName, getCurrentBranch, hasUncommittedChanges, makeSandboxFromHandle, patchGitMountsForWindows, processFileMountParents, pruneStale, registerShutdown, remove, repositoryRunnerEnvironment, resolveCwd, resolveGitMounts, resolveUserMounts, runHostHooks, startSandbox, syncOut, withSandboxLifecycle };
+//# sourceMappingURL=chunk-FDYOTN55.js.map
+//# sourceMappingURL=chunk-FDYOTN55.js.map