@snappedly-tools/shipyard 0.7.0 → 0.8.0

package/README.md

@@ -23,78 +23,71 @@ a commit or pull request you can inspect.
 
 ## Try it on one task
 
-You need **Node.js 20.18.1+**, **Git**, **Docker running**, and **Codex or Claude
-Code** with a login or API key. Start with a clean Git repository you want
-Shipyard to change. If it is on GitHub, sign in with the
-[GitHub CLI](https://cli.github.com/) (`gh auth login`) before `init`; Shipyard
-creates its issue labels there.
+You need **Node.js 20.18.1+**, **Git**, **Docker running**, and **Codex or Claude Code**
+with a subscription login or API key.
 
 Run:
 
 ```sh
-git switch -c try-shipyard
 npx skills add snappedly/skills
-npm install --save-dev @snappedly-tools/shipyard
-npx shipyard init
 ```
 
-Ask your coding agent to run `setup-snappedly-skills` in that repository. During
-`shipyard init`, choose your agent, **Docker**, and the **blank** template. Follow
-the authentication prompts. You can skip the optional repository runner for
-this first task.
+Ask your coding agent to run `setup-snappedly-skills` in that repository.
 
-Open `.shipyard/prompt.md` and describe a small change. For example:
-
-```md
-# Task
+```sh
+npm install --save-dev @snappedly-tools/shipyard
+npx shipyard init
+```
 
-Document how to run this project locally using commands already in the repo.
-Run the relevant checks and commit the change.
+During `shipyard init`, choose your agent, **Docker**, the template you want, and install the optional
+[repository runner](docs/content/docs/repository-runner.mdx). Follow
+the authentication prompts.
 
-# Done
+On a local Mac, the repository runner automatically wakes Shipyard when you label an issue.
+It runs as long as its terminal stays open.
 
-Output <promise>COMPLETE</promise> when finished.
-```
+See the [getting started guide](docs/content/docs/index.mdx) for authentication and
+branch options.
 
-Fill in any credentials requested in `.shipyard/.env`. Commit the setup and
-prompt so the sandbox can read them. The generated Git ignore file keeps
+Fill in any credentials required in `.shipyard/.env`.
+`GH_TOKEN` in `.shipyard/.env` to a GH token with Contents, Issues, and Pull
+Requests read/write access and Metadata read access.
+Set `SHIPYARD_ROUTINE_MODEL` and `SHIPYARD_STRONG_MODEL` in `.shipyard/.env`
+for the roles your template uses. `simple-loop` uses routine for triage and
+implementation. `sequential-reviewer` also uses strong for issue reviews.
+Parallel planner templates use routine for ticket work and strong for planning,
+conflict resolution, and integration. The review-enabled planner also uses
+strong for ticket and final specification reviews. See
+[agent setup](docs/content/docs/agents.mdx).
+
+Commit the setup and prompt so the sandbox can read them. Make sure the Git ignore file keeps
 `.shipyard/.env` out of the commit.
 
 ```sh
-git add .
-git commit -m "Set up Shipyard"
 npx shipyard run
-git show --stat HEAD
 ```
 
-Shipyard builds the Docker image, runs the agent, and returns its commit to your
-current branch. `git show` lets you inspect what changed. See the
-[getting started guide](docs/content/docs/index.mdx) for authentication and
-branch options.
+Or for the automated runner:
+
+```sh
+npx shipyard runner start
+```
 
 ## Turn GitHub issues into pull requests
 
-For a repository you want to automate from GitHub Issues, choose
-**sequential-reviewer** instead of **blank** during `shipyard init`. Set
-`GH_TOKEN` in `.shipyard/.env` to a token with Contents, Issues, and Pull
-requests read/write access and Metadata read access. Then:
+Then:
 
 1. Write an issue with a clear goal and add the `shipyard` and
    `ready-for-agent` labels.
-2. Run `npx shipyard run`. Shipyard checks the issue, implements it in Docker,
+2. Make sure the runner is running, or start `npx shipyard run`. Shipyard checks the issue, implements it in Docker,
    reviews the work, and opens a pull request.
 3. Inspect the pull request and merge it when you are happy with the result.
 
-On an Apple Silicon Mac, the optional [repository runner](docs/content/docs/repository-runner.mdx)
-can wake Shipyard when you label an issue. It runs while its terminal stays open.
-The guide covers installation, retries, and issue status labels.
-
 ## Choose a workflow
 
 | Template                       | What it does                                       |
 | ------------------------------ | -------------------------------------------------- |
-| `blank`                        | Runs your own task and prompt.                     |
-| `simple-loop`                  | Works through labelled issues one at a time.       |
+| `simple-loop`                  | Works through labeled issues one at a time.        |
 | `sequential-reviewer`          | Implements and reviews issues before PR handoff.   |
 | `parallel-planner`             | Plans and works on independent issues in parallel. |
 | `parallel-planner-with-review` | Adds review to the parallel workflow.              |

package/dist/MountConfig-BHnKnA4h.d.ts

@@ -0,0 +1,145 @@
+/** Result of executing a command inside a sandbox. */
+interface ExecResult {
+    /** Collected standard output. */
+    readonly stdout: string;
+    /** Collected standard error. */
+    readonly stderr: string;
+    /** Process exit status. */
+    readonly exitCode: number;
+}
+/** Streams supplied when launching an interactive agent process. */
+interface InteractiveExecOptions {
+    /** Input stream forwarded to the agent process. */
+    readonly stdin: NodeJS.ReadableStream;
+    /** Output stream receiving agent standard output. */
+    readonly stdout: NodeJS.WritableStream;
+    /** Output stream receiving agent standard error. */
+    readonly stderr: NodeJS.WritableStream;
+    /** Working directory inside Docker. */
+    readonly cwd?: string;
+    /** Abort signal that terminates the interactive process. */
+    readonly signal?: AbortSignal;
+}
+/** Handle to a running isolated sandbox. Docker implements this contract. */
+interface IsolatedSandboxHandle {
+    /** Absolute Git workspace path inside Docker. */
+    readonly worktreePath: string;
+    /**
+     * Execute a command in Docker. Deliver `onLine` as output arrives so idle
+     * timeouts and live feedback work; buffered delivery does not satisfy this
+     * contract. Pipe `stdin` to the child rather than passing it as an argument.
+     */
+    exec(command: string, options?: {
+        /** Live output callback. */
+        onLine?: (line: string) => void;
+        /** Working directory inside Docker. */
+        cwd?: string;
+        /** Execute as root when supported. */
+        sudo?: boolean;
+        /** Input piped to the child process. */
+        stdin?: string;
+        /** Abort signal that terminates the command. */
+        signal?: AbortSignal;
+        /** Maximum combined output bytes before termination. */
+        maxOutputBytes?: number;
+    }): Promise<ExecResult>;
+    /** Launch an interactive process and terminate it when `signal` aborts. */
+    interactiveExec?(args: string[], options: InteractiveExecOptions): Promise<{
+        exitCode: number;
+    }>;
+    /** Copy a file or directory from the host into Docker. */
+    copyIn(hostPath: string, sandboxPath: string): Promise<void>;
+    /** Copy a file from Docker to the host. */
+    copyFileOut(sandboxPath: string, hostPath: string): Promise<void>;
+    /** Tear down the container. */
+    close(): Promise<void>;
+}
+/** File transfer shape used by agent session storage. */
+interface SessionTransferHandle {
+    /** Absolute Git workspace path inside Docker. */
+    readonly worktreePath: string;
+    /** Run a command in the sandbox. */
+    exec: IsolatedSandboxHandle["exec"];
+    /** Launch an interactive command when available. */
+    interactiveExec?: IsolatedSandboxHandle["interactiveExec"];
+    /** Copy one host file into the sandbox. */
+    copyFileIn(hostPath: string, sandboxPath: string): Promise<void>;
+    /** Copy one sandbox file to the host. */
+    copyFileOut(sandboxPath: string, hostPath: string): Promise<void>;
+    /** Tear down the sandbox. */
+    close(): Promise<void>;
+}
+/** Inputs to Docker sandbox creation. */
+interface IsolatedCreateOptions {
+    /** Original repository path used to derive the image name; never mounted. */
+    readonly hostRepoPath?: string;
+    /** Environment injected into the Docker container. */
+    readonly env: Record<string, string>;
+}
+/** Configuration for the isolated Docker provider contract. */
+interface IsolatedSandboxProviderConfig {
+    /** Human-readable provider name. */
+    readonly name: string;
+    /** Provider environment merged into sandbox startup. */
+    readonly env?: Record<string, string>;
+    /** Start a sandbox and return its command and file-transfer handle. */
+    readonly create: (options: IsolatedCreateOptions) => Promise<IsolatedSandboxHandle>;
+}
+/** Docker's isolated filesystem provider contract. */
+interface IsolatedSandboxProvider {
+    /** Isolated filesystem discriminator. */
+    readonly tag: "isolated";
+    /** Human-readable provider name. */
+    readonly name: string;
+    /** Environment variables injected into Docker. */
+    readonly env: Record<string, string>;
+    /** Start a sandbox. */
+    readonly create: (options: IsolatedCreateOptions) => Promise<IsolatedSandboxHandle>;
+}
+/** Provider accepted by Shipyard's Docker execution path. */
+type SandboxProvider = IsolatedSandboxProvider;
+/** Create a temporary branch and merge its commits back to host HEAD. */
+interface MergeToHeadBranchStrategy {
+    /** Branch strategy discriminator. */
+    readonly type: "merge-to-head";
+}
+/** Run on a caller-named branch. */
+interface NamedBranchStrategy {
+    /** Branch strategy discriminator. */
+    readonly type: "branch";
+    /** Branch to create or reuse. */
+    readonly branch: string;
+    /** Starting ref for a new branch. */
+    readonly baseBranch?: string;
+}
+/** Supported Docker branch strategies. */
+type BranchStrategy = MergeToHeadBranchStrategy | NamedBranchStrategy;
+/** Construct the isolated provider contract used by Docker. */
+declare const createIsolatedSandboxProvider: (config: IsolatedSandboxProviderConfig) => IsolatedSandboxProvider;
+
+/**
+ * User-facing mount configuration for Docker.
+ *
+ * Each entry describes a host directory to mount into the sandbox container.
+ */
+/** A single bind-mount descriptor for the Docker provider. */
+interface MountConfig {
+    /**
+     * Path on the host. Supports:
+     * - Absolute paths (`/data/cache`)
+     * - Tilde-expanded paths (`~/data` → `<home>/data`)
+     * - Relative paths (`data` or `./data`) — resolved from `process.cwd()`
+     */
+    readonly hostPath: string;
+    /**
+     * Path inside the sandbox container. Supports:
+     * - Absolute paths (`/mnt/data`)
+     * - Tilde-expanded paths (`~/.npm` → `/home/agent/.npm`) — expanded using the provider's sandbox home directory
+     * - Relative paths (`data` or `./data`) — resolved from the worktree directory (`/home/agent/workspace`)
+     */
+    readonly sandboxPath: string;
+    /** Mount as read-only. Defaults to `false`. */
+    readonly readonly?: boolean;
+}
+
+export { type BranchStrategy as B, type ExecResult as E, type IsolatedSandboxProvider as I, type MountConfig as M, type NamedBranchStrategy as N, type SessionTransferHandle as S, type SandboxProvider as a, type MergeToHeadBranchStrategy as b, type InteractiveExecOptions as c, type IsolatedCreateOptions as d, type IsolatedSandboxHandle as e, type IsolatedSandboxProviderConfig as f, createIsolatedSandboxProvider as g };

package/dist/{chunk-WAXEMZUV.js → chunk-44I2BL6E.js}

@@ -1,12 +1,12 @@
-import { assertProtectedDirectoryIdentities, ACTIVATION_LABEL, CONFIG_DIR, RUNNER_DIR, RUNNER_SANDBOX_MASK_DIR, resolveUserMounts, assertIsolatedWorkspaceMounts, processFileMountParents, defaultImageName, registerShutdown, DockerError, repositoryRunnerEnvironment, formatVolumeMount } from './chunk-FDYOTN55.js';
-import { createIsolatedSandboxProvider } from './chunk-KMGNFXKN.js';
-import { MAX_TAIL_CHARS, collectProcessOutput } from './chunk-ACD46ZM4.js';
+import { RUNTIME_NAMESPACE, assertProtectedDirectoryIdentities, ACTIVATION_LABEL, CONFIG_DIR, RUNNER_DIR, createIsolatedSandboxProvider, registerShutdown, DockerError, repositoryRunnerEnvironment, SANDBOX_REPO_DIR } from './chunk-L6PX5QTU.js';
 import { execFile, execFileSync, spawn } from 'child_process';
-import { resolve, join, posix } from 'path';
+import { resolve, join, posix, dirname, relative, isAbsolute } from 'path';
 import { promisify } from 'util';
 import { randomUUID } from 'crypto';
 import { Effect } from 'effect';
-import { constants } from 'fs';
+import { constants, existsSync, statSync } from 'fs';
+import { homedir } from 'os';
+import { createInterface } from 'readline';
 import { rm, lstat, realpath, mkdir, readFile, access } from 'fs/promises';
 
 var exec = promisify(execFile);
@@ -38,6 +38,79 @@ var copyIntoContainer = async (engine, container, owner, hostPath, sandboxPath)
     );
   }
 };
+var defaultImageName = (repoDir) => {
+  const dirName = repoDir.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? "local";
+  const sanitized = dirName.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
+  return `${RUNTIME_NAMESPACE}:${sanitized || "local"}`;
+};
+var expandTilde = (p, homeDirPath) => {
+  const home = homeDirPath ?? homedir();
+  if (p === "~") return home;
+  if (p.startsWith("~/") || p.startsWith("~\\")) return home + "/" + p.slice(2);
+  return p;
+};
+var resolveHostPath = (hostPath) => {
+  const expanded = expandTilde(hostPath);
+  return isAbsolute(expanded) ? expanded : resolve(process.cwd(), expanded);
+};
+var resolveSandboxPath = (sandboxPath, sandboxHomedir) => {
+  const hasTilde = sandboxPath === "~" || sandboxPath.startsWith("~/") || sandboxPath.startsWith("~\\");
+  const expanded = hasTilde ? expandTilde(sandboxPath, sandboxHomedir) : sandboxPath;
+  return isAbsolute(expanded) ? resolve(expanded) : resolve(SANDBOX_REPO_DIR, expanded);
+};
+var resolveUserMounts = (mounts, sandboxHomedir) => mounts.map((m) => {
+  const resolvedHostPath = resolveHostPath(m.hostPath);
+  if (!existsSync(resolvedHostPath)) {
+    throw new Error(
+      `Mount hostPath does not exist: ${m.hostPath}` + (m.hostPath !== resolvedHostPath ? ` (resolved to ${resolvedHostPath})` : "")
+    );
+  }
+  return {
+    hostPath: resolvedHostPath,
+    sandboxPath: resolveSandboxPath(m.sandboxPath, sandboxHomedir),
+    ...m.readonly ? { readonly: true } : {}
+  };
+});
+var formatVolumeMount = (mount, selinuxLabel) => {
+  const base = `${mount.hostPath}:${mount.sandboxPath}`;
+  const options = [mount.readonly ? "ro" : void 0, selinuxLabel || void 0].filter((option) => option !== void 0).join(",");
+  return options ? `${base}:${options}` : base;
+};
+var processFileMountParents = (mounts, sandboxHomedir, statFn = statSync) => {
+  const parentDirs = /* @__PURE__ */ new Set();
+  for (const mount of mounts) {
+    let isFile;
+    try {
+      isFile = statFn(mount.hostPath).isFile();
+    } catch {
+      continue;
+    }
+    if (!isFile) continue;
+    const parentDir = resolve(dirname(mount.sandboxPath));
+    const homeDir = resolve(sandboxHomedir);
+    if (parentDir === homeDir) continue;
+    const fromHome = relative(homeDir, parentDir);
+    if (fromHome === ".." || fromHome.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(fromHome)) {
+      throw new Error(
+        `Cannot mount file to '${mount.sandboxPath}': parent directory '${parentDir}' is outside the sandbox home directory ('${homeDir}'). Mount the parent directory instead, or rebuild the image with '${parentDir}' pre-created.`
+      );
+    }
+    parentDirs.add(parentDir);
+  }
+  return [...parentDirs];
+};
+var assertIsolatedWorkspaceMounts = (mounts) => {
+  for (const mount of mounts) {
+    const path = posix.resolve(mount.sandboxPath);
+    if (path === "/" || path === SANDBOX_REPO_DIR || path.startsWith(`${SANDBOX_REPO_DIR}/`) || SANDBOX_REPO_DIR.startsWith(`${path}/`)) {
+      throw new Error(
+        `Mount overlaps the isolated workspace: ${mount.sandboxPath}. Mount outside ${SANDBOX_REPO_DIR} or use copyToWorktree.`
+      );
+    }
+  }
+};
+
+// src/DockerLifecycle.ts
 var dockerExec = (args) => Effect.async((resume) => {
   execFile(
     "docker",
@@ -148,6 +221,137 @@ var removeContainer = (containerName) => Effect.gen(function* () {
 var removeImage = (imageName) => Effect.gen(function* () {
   yield* dockerExec(["rmi", imageName]);
 });
+
+// src/boundedTail.ts
+var MAX_TAIL_CHARS = 64 * 1024;
+var OutputByteCounter = class {
+  constructor(maxBytes) {
+    this.maxBytes = maxBytes;
+  }
+  totalBytes = 0;
+  limitExceeded = false;
+  add(chunk) {
+    this.totalBytes += typeof chunk === "string" ? Buffer.byteLength(chunk) : chunk.byteLength;
+    if (this.totalBytes > this.maxBytes) this.limitExceeded = true;
+  }
+  get exceeded() {
+    return this.limitExceeded;
+  }
+};
+var BoundedTail = class {
+  items = [];
+  totalChars = 0;
+  maxChars;
+  separator;
+  /**
+   * @param maxChars Maximum length of the joined tail. Defaults to {@link MAX_TAIL_CHARS}.
+   * @param separator String placed between items by {@link toString}. Must match
+   *   how the caller would otherwise have joined the accumulated chunks (e.g.
+   *   `"\n"` for line streams, `""` for raw chunk streams).
+   */
+  constructor(maxChars = MAX_TAIL_CHARS, separator = "") {
+    this.maxChars = maxChars;
+    this.separator = separator;
+  }
+  /** Append one item to the tail, evicting oldest items to stay within budget. */
+  push(item) {
+    const bounded = item.length > this.maxChars ? item.slice(item.length - this.maxChars) : item;
+    this.totalChars += bounded.length + (this.items.length > 0 ? this.separator.length : 0);
+    this.items.push(bounded);
+    while (this.totalChars > this.maxChars && this.items.length > 1) {
+      const dropped = this.items.shift();
+      this.totalChars -= dropped.length + this.separator.length;
+    }
+  }
+  /** Join the retained tail into a single string (length ≤ `maxChars`). */
+  toString() {
+    return this.items.join(this.separator);
+  }
+};
+var StreamedProcessOutput = class {
+  maxOutputBytes;
+  byteCounter;
+  stdoutTail;
+  stderrTail;
+  onLine;
+  outputLimitError;
+  constructor(options) {
+    this.maxOutputBytes = options.maxOutputBytes;
+    this.byteCounter = options.maxOutputBytes === void 0 ? void 0 : new OutputByteCounter(options.maxOutputBytes);
+    const tailChars = options.maxOutputBytes ?? options.maxOutputTailChars ?? MAX_TAIL_CHARS;
+    this.stdoutTail = new BoundedTail(tailChars, "\n");
+    this.stderrTail = new BoundedTail(tailChars, "");
+    this.onLine = options.onLine ?? (() => {
+    });
+  }
+  checkLimit(chunk) {
+    if (this.byteCounter === void 0 || this.outputLimitError !== void 0) {
+      return this.outputLimitError;
+    }
+    this.byteCounter.add(chunk);
+    if (this.byteCounter.exceeded) {
+      this.outputLimitError = new Error(
+        `Sandbox command output exceeded ${this.maxOutputBytes} bytes`
+      );
+    }
+    return this.outputLimitError;
+  }
+  addStdoutLine(line) {
+    this.stdoutTail.push(line);
+    this.onLine(line);
+  }
+  addStderr(chunk) {
+    this.stderrTail.push(chunk);
+  }
+  get error() {
+    return this.outputLimitError;
+  }
+  result(exitCode) {
+    return {
+      stdout: this.stdoutTail.toString(),
+      stderr: this.stderrTail.toString(),
+      exitCode
+    };
+  }
+};
+var collectProcessOutput = (process2, options, resolve3, reject) => {
+  if (options.onLine || options.maxOutputBytes !== void 0) {
+    const output = new StreamedProcessOutput(options);
+    const checkLimit = (chunk) => {
+      if (output.checkLimit(chunk) !== void 0) process2.kill();
+    };
+    process2.stdout.on("data", checkLimit);
+    process2.stderr.on("data", checkLimit);
+    const lines = createInterface({ input: process2.stdout });
+    lines.on("line", (line) => output.addStdoutLine(line));
+    process2.stderr.on("data", (chunk) => {
+      output.addStderr(chunk.toString());
+    });
+    process2.onClose((code) => {
+      if (output.error !== void 0) {
+        reject(output.error);
+        return;
+      }
+      resolve3(output.result(code ?? 0));
+    });
+    return;
+  }
+  const stdoutChunks = [];
+  const stderrChunks = [];
+  process2.stdout.on("data", (chunk) => {
+    stdoutChunks.push(chunk.toString());
+  });
+  process2.stderr.on("data", (chunk) => {
+    stderrChunks.push(chunk.toString());
+  });
+  process2.onClose((code) => {
+    resolve3({
+      stdout: stdoutChunks.join(""),
+      stderr: stderrChunks.join(""),
+      exitCode: code ?? 0
+    });
+  });
+};
 var execFileAsync = promisify(execFile);
 var RUNNER_INSTALL_METADATA = ".shipyard-install.json";
 var RUNNER_CONTROLLER_LOCK = ".shipyard-controller.lock";
@@ -216,7 +420,7 @@ var defaultAdapters = {
     }
   },
   signalProcess: (pid, signal) => process.kill(pid, signal),
-  pause: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds))
+  pause: (milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds))
 };
 var lockOwnsProcess = async (lock, adapters) => lock !== void 0 && Number.isInteger(lock.pid) && typeof lock.processStartedAt === "string" && lock.processStartedAt.length > 0 && adapters.isProcessRunning(lock.pid) && await adapters.processIdentity(lock.pid) === lock.processStartedAt;
 var lifecycleFailure = (purpose, error) => error instanceof RunnerLifecycleError ? error : new RunnerLifecycleError(
@@ -274,12 +478,8 @@ var listRemoteRunners = async (repository, repoDir, environment, adapters) => {
   return parseRemoteRunners(response.stdout);
 };
 var validateExistingRepositoryRunner = async (options, adapters = defaultAdapters) => {
-  if (!await adapters.exists(options.maskDir)) {
-    await adapters.makeDirectory(options.maskDir);
-  }
   await assertProtectedDirectoryIdentities(
     options.runnerDir,
-    options.maskDir,
     adapters.inspectDirectory
   ).catch((error) => {
     throw lifecycleFailure("Validating protected runner directories", error);
@@ -379,12 +579,8 @@ var recoverRepositoryRunner = async (options, adapters = defaultAdapters) => {
   if (lock) await adapters.remove(lockPath);
   const workDir = join(options.runnerDir, RUNNER_WORK_DIR);
   if (await adapters.exists(workDir)) await adapters.remove(workDir);
-  if (await adapters.exists(options.maskDir))
-    await adapters.remove(options.maskDir);
-  await adapters.makeDirectory(options.maskDir);
   await assertProtectedDirectoryIdentities(
     options.runnerDir,
-    options.maskDir,
     adapters.inspectDirectory
   ).catch((error) => {
     throw lifecycleFailure("Validating protected runner directories", error);
@@ -536,7 +732,6 @@ var unregisterRepositoryRunner = async (metadata, repoDir, runnerDir, environmen
 var removeRepositoryRunner = async (options, adapters = defaultAdapters) => {
   const configDir = join(options.repoDir, CONFIG_DIR);
   const runnerDir = join(configDir, RUNNER_DIR);
-  const maskDir = join(configDir, RUNNER_SANDBOX_MASK_DIR);
   if (!await adapters.exists(runnerDir)) {
     throw new RunnerLifecycleError(
       `No repository runner is installed at ${runnerDir}.`
@@ -548,7 +743,6 @@ var removeRepositoryRunner = async (options, adapters = defaultAdapters) => {
   } catch (error) {
     if (!options.force) throw error;
     await adapters.remove(runnerDir);
-    if (await adapters.exists(maskDir)) await adapters.remove(maskDir);
     return {
       removed: true,
       forced: true,
@@ -578,14 +772,12 @@ var removeRepositoryRunner = async (options, adapters = defaultAdapters) => {
       );
     }
     await adapters.remove(runnerDir);
-    if (await adapters.exists(maskDir)) await adapters.remove(maskDir);
     return {
       removed: true,
       forced: true,
       manualCleanup: `Remove runner ${metadata.name} from ${metadata.repository} in GitHub Settings > Actions > Runners.`
     };
   }
-  if (await adapters.exists(maskDir)) await adapters.remove(maskDir);
   await adapters.remove(runnerDir);
   return { removed: true, forced: false };
 };
@@ -642,7 +834,7 @@ var docker = (options) => {
         )
       );
       for (const dir of parentDirsToCreate) {
-        await new Promise((resolve2, reject) => {
+        await new Promise((resolve3, reject) => {
           execFile(
             "docker",
             [
@@ -665,7 +857,7 @@ var docker = (options) => {
                   )
                 );
               } else {
-                resolve2();
+                resolve3();
               }
             }
           );
@@ -688,7 +880,7 @@ var docker = (options) => {
           if (opts?.stdin !== void 0) args.push("-i");
           if (opts?.cwd) args.push("-w", opts.cwd);
           args.push(containerName, "sh", "-c", effectiveCommand);
-          return new Promise((resolve2, reject) => {
+          return new Promise((resolve3, reject) => {
             const proc = spawn("docker", args, {
               signal: opts?.signal,
               stdio: [
@@ -712,13 +904,13 @@ var docker = (options) => {
                 onClose: (listener) => proc.on("close", listener)
               },
               { ...opts, maxOutputTailChars },
-              resolve2,
+              resolve3,
               reject
             );
           });
         },
         interactiveExec: (args, opts) => {
-          return new Promise((resolve2, reject) => {
+          return new Promise((resolve3, reject) => {
             opts.signal?.throwIfAborted();
             const executionId = randomUUID();
             const pidFile = `/tmp/shipyard-interactive-${executionId}.pid`;
@@ -750,7 +942,7 @@ var docker = (options) => {
               settled = true;
               opts.signal?.removeEventListener("abort", onAbort);
               if ("error" in result) reject(result.error);
-              else resolve2(result);
+              else resolve3(result);
             };
             const onAbort = () => {
               if (cancelling || settled) return;
@@ -813,7 +1005,7 @@ var docker = (options) => {
           hostPath,
           sandboxPath
         ),
-        copyFileOut: (sandboxPath, hostPath) => new Promise((resolve2, reject) => {
+        copyFileOut: (sandboxPath, hostPath) => new Promise((resolve3, reject) => {
           execFile(
             "docker",
             ["cp", `${containerName}:${sandboxPath}`, hostPath],
@@ -821,7 +1013,7 @@ var docker = (options) => {
               if (error) {
                 reject(new Error(`docker cp (out) failed: ${error.message}`));
               } else {
-                resolve2();
+                resolve3();
               }
             }
           );
@@ -835,7 +1027,7 @@ var docker = (options) => {
     }
   });
 };
-var checkImageUid = (imageName, expectedUid) => new Promise((resolve2, reject) => {
+var checkImageUid = (imageName, expectedUid) => new Promise((resolve3, reject) => {
   execFile(
     "docker",
     ["image", "inspect", imageName, "--format", "{{.Config.User}}"],
@@ -850,13 +1042,13 @@ var checkImageUid = (imageName, expectedUid) => new Promise((resolve2, reject) =
       }
       const imageUser = (stdout ?? "").toString().trim();
       if (!imageUser) {
-        resolve2();
+        resolve3();
         return;
       }
       const uidPart = imageUser.split(":")[0];
       const imageUid = parseInt(uidPart, 10);
       if (isNaN(imageUid)) {
-        resolve2();
+        resolve3();
         return;
       }
       if (imageUid !== expectedUid) {
@@ -866,12 +1058,12 @@ var checkImageUid = (imageName, expectedUid) => new Promise((resolve2, reject) =
           )
         );
       } else {
-        resolve2();
+        resolve3();
       }
     }
   );
 });
 
-export { REPOSITORY_RUNNER_OWNER_ENV, RUNNER_CONTROLLER_LOCK, RUNNER_INSTALL_METADATA, RUNNER_WORK_DIR, RunnerLifecycleError, buildImage, docker, recoverRepositoryRunner, removeImage, removeOwnedRepositoryRunnerContainers, removeRepositoryRunner, validateExistingRepositoryRunner };
-//# sourceMappingURL=chunk-WAXEMZUV.js.map
-//# sourceMappingURL=chunk-WAXEMZUV.js.map
+export { REPOSITORY_RUNNER_OWNER_ENV, RUNNER_CONTROLLER_LOCK, RUNNER_INSTALL_METADATA, RUNNER_WORK_DIR, RunnerLifecycleError, buildImage, defaultImageName, docker, recoverRepositoryRunner, removeImage, removeOwnedRepositoryRunnerContainers, removeRepositoryRunner, validateExistingRepositoryRunner };
+//# sourceMappingURL=chunk-44I2BL6E.js.map
+//# sourceMappingURL=chunk-44I2BL6E.js.map