@su-record/vibe 2.7.11 → 2.7.12

package/dist/pc/sandbox/ContainerConfig.d.ts

@@ -1,24 +0,0 @@
-/**
- * Container Security Config — Phase 5-1
- *
- * Rootless, read-only FS, dropped capabilities, seccomp, resource limits.
- */
-import type { SecurityConfig, SeccompProfile } from './types.js';
-export declare function getDefaultSeccompProfile(): SeccompProfile;
-export declare function getDefaultSecurityConfig(): SecurityConfig;
-export interface DockerHostConfig {
-    ReadonlyRootfs: boolean;
-    SecurityOpt: string[];
-    CapDrop: string[];
-    CapAdd: string[];
-    Tmpfs: Record<string, string>;
-    NanoCpus: number;
-    Memory: number;
-    PidsLimit: number;
-    NetworkMode: string;
-    Devices: never[];
-    UsernsMode: string;
-}
-export declare function buildHostConfig(security: SecurityConfig, cpuLimit: number, memoryMb: number, pidLimit: number, networkMode: string): DockerHostConfig;
-export declare function filterEnvVars(env: Record<string, string>): string[];
-//# sourceMappingURL=ContainerConfig.d.ts.map

package/dist/pc/sandbox/ContainerConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ContainerConfig.d.ts","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjE,wBAAgB,wBAAwB,IAAI,cAAc,CAqCzD;AAMD,wBAAgB,wBAAwB,IAAI,cAAc,CAczD;AAMD,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,gBAAgB,CAsBlB;AAeD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAInE"}

package/dist/pc/sandbox/ContainerConfig.js

@@ -1,103 +0,0 @@
-/**
- * Container Security Config — Phase 5-1
- *
- * Rootless, read-only FS, dropped capabilities, seccomp, resource limits.
- */
-// ============================================================================
-// Default Seccomp Profile (deny io_uring, allow common syscalls)
-// ============================================================================
-export function getDefaultSeccompProfile() {
-    return {
-        defaultAction: 'SCMP_ACT_ERRNO',
-        syscalls: [
-            {
-                names: [
-                    'read', 'write', 'open', 'close', 'stat', 'fstat', 'lstat',
-                    'poll', 'lseek', 'mmap', 'mprotect', 'munmap', 'brk',
-                    'ioctl', 'access', 'pipe', 'select', 'sched_yield',
-                    'dup', 'dup2', 'pause', 'nanosleep', 'getpid', 'socket',
-                    'connect', 'accept', 'sendto', 'recvfrom', 'bind', 'listen',
-                    'clone', 'fork', 'vfork', 'execve', 'exit', 'wait4',
-                    'kill', 'uname', 'fcntl', 'flock', 'fsync', 'fdatasync',
-                    'truncate', 'ftruncate', 'getdents', 'getcwd', 'chdir',
-                    'rename', 'mkdir', 'rmdir', 'link', 'unlink', 'symlink',
-                    'readlink', 'chmod', 'chown', 'umask', 'gettimeofday',
-                    'getuid', 'getgid', 'setuid', 'setgid', 'geteuid', 'getegid',
-                    'epoll_create', 'epoll_ctl', 'epoll_wait', 'epoll_create1',
-                    'eventfd', 'eventfd2', 'signalfd', 'timerfd_create',
-                    'futex', 'set_robust_list', 'get_robust_list',
-                    'clock_gettime', 'clock_getres', 'clock_nanosleep',
-                    'exit_group', 'set_tid_address', 'openat', 'mkdirat',
-                    'newfstatat', 'unlinkat', 'renameat', 'readlinkat',
-                    'pipe2', 'getrandom', 'memfd_create', 'statx',
-                    'pread64', 'pwrite64', 'writev', 'readv',
-                    'getdents64', 'prlimit64', 'arch_prctl',
-                    'setsockopt', 'getsockopt', 'getpeername', 'getsockname',
-                ],
-                action: 'SCMP_ACT_ALLOW',
-            },
-            {
-                // Explicitly deny io_uring (CVE-2025-9002)
-                names: ['io_uring_setup', 'io_uring_enter', 'io_uring_register'],
-                action: 'SCMP_ACT_ERRNO',
-            },
-        ],
-    };
-}
-// ============================================================================
-// Default Security Config
-// ============================================================================
-export function getDefaultSecurityConfig() {
-    return {
-        readonlyRootfs: true,
-        noNewPrivileges: true,
-        dropCapabilities: ['ALL'],
-        addCapabilities: ['CHOWN', 'SETUID', 'SETGID', 'DAC_OVERRIDE', 'NET_BIND_SERVICE'],
-        seccompProfile: getDefaultSeccompProfile(),
-        tmpfsMounts: [
-            { destination: '/tmp', size: '256m' },
-            { destination: '/workspace', size: '512m' },
-        ],
-        userNamespaceRemap: true,
-        deviceAccess: false,
-    };
-}
-export function buildHostConfig(security, cpuLimit, memoryMb, pidLimit, networkMode) {
-    const tmpfs = {};
-    for (const mount of security.tmpfsMounts) {
-        tmpfs[mount.destination] = `size=${mount.size},noexec,nosuid`;
-    }
-    return {
-        ReadonlyRootfs: security.readonlyRootfs,
-        SecurityOpt: [
-            'no-new-privileges:true',
-            `seccomp=${JSON.stringify(security.seccompProfile)}`,
-        ],
-        CapDrop: security.dropCapabilities,
-        CapAdd: security.addCapabilities,
-        Tmpfs: tmpfs,
-        NanoCpus: cpuLimit * 1e9,
-        Memory: memoryMb * 1024 * 1024,
-        PidsLimit: pidLimit,
-        NetworkMode: networkMode,
-        Devices: [],
-        UsernsMode: security.userNamespaceRemap ? 'host' : '',
-    };
-}
-// ============================================================================
-// Env variable filter (block dangerous vars)
-// ============================================================================
-const BLOCKED_ENV_PREFIXES = [
-    'NODE_OPTIONS',
-    'DYLD_',
-    'LD_PRELOAD',
-    'LD_LIBRARY_PATH',
-    'DOCKER_HOST',
-    'PYTHONPATH',
-];
-export function filterEnvVars(env) {
-    return Object.entries(env)
-        .filter(([key]) => !BLOCKED_ENV_PREFIXES.some(prefix => key.startsWith(prefix)))
-        .map(([key, value]) => `${key}=${value}`);
-}
-//# sourceMappingURL=ContainerConfig.js.map

package/dist/pc/sandbox/ContainerConfig.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ContainerConfig.js","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,+EAA+E;AAC/E,iEAAiE;AACjE,+EAA+E;AAE/E,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,aAAa,EAAE,gBAAgB;QAC/B,QAAQ,EAAE;YACR;gBACE,KAAK,EAAE;oBACL,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;oBAC1D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK;oBACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;oBAClD,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ;oBACvD,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ;oBAC3D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO;oBACnD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW;oBACvD,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO;oBACtD,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;oBACvD,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc;oBACrD,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;oBAC5D,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe;oBAC1D,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB;oBACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB;oBAC7C,eAAe,EAAE,cAAc,EAAE,iBAAiB;oBAClD,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS;oBACpD,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY;oBAClD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO;oBAC7C,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO;oBACxC,YAAY,EAAE,WAAW,EAAE,YAAY;oBACvC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa;iBACzD;gBACD,MAAM,EAAE,gBAAgB;aACzB;YACD;gBACE,2CAA2C;gBAC3C,KAAK,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,CAAC;gBAChE,MAAM,EAAE,gBAAgB;aACzB;SACF;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,CAAC,KAAK,CAAC;QACzB,eAAe,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,CAAC;QAClF,cAAc,EAAE,wBAAwB,EAAE;QAC1C,WAAW,EAAE;YACX,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;YACrC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;SAC5C;QACD,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,KAAK;KACpB,CAAC;AACJ,CAAC;AAoBD,MAAM,UAAU,eAAe,CAC7B,QAAwB,EACxB,QAAgB,EAChB,QAAgB,EAChB,QAAgB,EAChB,WAAmB;IAEnB,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,QAAQ,KAAK,CAAC,IAAI,gBAAgB,CAAC;IAChE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,WAAW,EAAE;YACX,wBAAwB;YACxB,WAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE;SACrD;QACD,OAAO,EAAE,QAAQ,CAAC,gBAAgB;QAClC,MAAM,EAAE,QAAQ,CAAC,eAAe;QAChC,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,QAAQ,GAAG,GAAG;QACxB,MAAM,EAAE,QAAQ,GAAG,IAAI,GAAG,IAAI;QAC9B,SAAS,EAAE,QAAQ;QACnB,WAAW,EAAE,WAAW;QACxB,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KACtD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,6CAA6C;AAC7C,+EAA+E;AAE/E,MAAM,oBAAoB,GAAG;IAC3B,cAAc;IACd,OAAO;IACP,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,YAAY;CACb,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,GAA2B;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SAC/E,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC"}

package/dist/pc/sandbox/ContainerManager.d.ts

@@ -1,31 +0,0 @@
-/**
- * Container Manager — Phase 5-1
- *
- * Docker container lifecycle: create, start, stop, remove, exec.
- * Warm pool for fast provisioning. Auto-cleanup for inactive containers.
- */
-import type { ContainerInfo, ContainerCreateOptions, ExecResult, SandboxLogger } from './types.js';
-export declare class ContainerManager {
-    private docker;
-    private containers;
-    private logger;
-    private cleanupTimer;
-    constructor(logger: SandboxLogger);
-    init(): Promise<void>;
-    create(userId: string, options?: Partial<ContainerCreateOptions>): Promise<ContainerInfo>;
-    start(containerId: string): Promise<void>;
-    stop(containerId: string): Promise<void>;
-    remove(containerId: string): Promise<void>;
-    exec(containerId: string, command: string[]): Promise<ExecResult>;
-    getContainers(): ContainerInfo[];
-    getUserContainers(userId: string): ContainerInfo[];
-    cleanup(): Promise<number>;
-    shutdown(): Promise<void>;
-    private loadDockerode;
-    private ping;
-    private ensureDocker;
-    private getContainerInfo;
-    private enforceContainerLimits;
-    private startCleanupTimer;
-}
-//# sourceMappingURL=ContainerManager.d.ts.map

package/dist/pc/sandbox/ContainerManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ContainerManager.d.ts","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,sBAAsB,EAEtB,UAAU,EACV,aAAa,EACd,MAAM,YAAY,CAAC;AAiCpB,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,YAAY,CAA+B;gBAEvC,MAAM,EAAE,aAAa;IAI3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAkEzF,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxC,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1C,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IA4DvE,aAAa,IAAI,aAAa,EAAE;IAIhC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAI5C,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAkB1B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;YAiBjB,aAAa;YAWb,IAAI;IASlB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/pc/sandbox/ContainerManager.js

@@ -1,245 +0,0 @@
-/**
- * Container Manager — Phase 5-1
- *
- * Docker container lifecycle: create, start, stop, remove, exec.
- * Warm pool for fast provisioning. Auto-cleanup for inactive containers.
- */
-import { DEFAULT_CONTAINER_CONFIG, createSandboxError } from './types.js';
-import { getDefaultSecurityConfig, buildHostConfig } from './ContainerConfig.js';
-// ============================================================================
-// Container Manager
-// ============================================================================
-export class ContainerManager {
-    docker = null;
-    containers = new Map();
-    logger;
-    cleanupTimer = null;
-    constructor(logger) {
-        this.logger = logger;
-    }
-    async init() {
-        this.docker = await this.loadDockerode();
-        await this.ping();
-        this.startCleanupTimer();
-    }
-    async create(userId, options) {
-        this.ensureDocker();
-        this.enforceContainerLimits(userId);
-        const config = {
-            image: options?.image ?? DEFAULT_CONTAINER_CONFIG.image,
-            cpuLimit: options?.cpuLimit ?? DEFAULT_CONTAINER_CONFIG.cpuLimit,
-            memoryLimitMb: options?.memoryLimitMb ?? DEFAULT_CONTAINER_CONFIG.memoryLimitMb,
-            pidLimit: options?.pidLimit ?? DEFAULT_CONTAINER_CONFIG.pidLimit,
-            networkMode: options?.networkMode ?? 'none',
-            scope: options?.scope ?? 'user',
-        };
-        const security = getDefaultSecurityConfig();
-        const hostConfig = buildHostConfig(security, config.cpuLimit, config.memoryLimitMb, config.pidLimit, config.networkMode);
-        const labels = {
-            'vibe-user-id': userId,
-            'vibe-scope': config.scope,
-            'vibe-session-id': `session-${Date.now()}`,
-            ...options?.labels,
-        };
-        let container;
-        let retries = DEFAULT_CONTAINER_CONFIG.createRetries;
-        while (true) {
-            try {
-                container = await this.docker.createContainer({
-                    Image: config.image,
-                    Labels: labels,
-                    HostConfig: hostConfig,
-                    User: '1000:1000',
-                    WorkingDir: '/workspace',
-                    Cmd: ['sleep', 'infinity'],
-                });
-                break;
-            }
-            catch (err) {
-                if (retries <= 0) {
-                    throw createSandboxError('CONTAINER_CREATE_FAILED', `컨테이너 생성 실패: ${err instanceof Error ? err.message : String(err)}`);
-                }
-                retries--;
-                this.logger('warn', `Container create retry (${retries} left)`);
-            }
-        }
-        const info = {
-            containerId: container.id,
-            userId,
-            scope: config.scope,
-            state: 'creating',
-            createdAt: new Date().toISOString(),
-            lastActivityAt: new Date().toISOString(),
-            cpuLimit: config.cpuLimit,
-            memoryLimitMb: config.memoryLimitMb,
-            pidLimit: config.pidLimit,
-            labels,
-        };
-        this.containers.set(container.id, info);
-        return info;
-    }
-    async start(containerId) {
-        this.ensureDocker();
-        const info = this.getContainerInfo(containerId);
-        const container = this.docker.getContainer(containerId);
-        await container.start();
-        info.state = 'running';
-        info.lastActivityAt = new Date().toISOString();
-    }
-    async stop(containerId) {
-        this.ensureDocker();
-        const info = this.getContainerInfo(containerId);
-        const container = this.docker.getContainer(containerId);
-        await container.stop({ t: 5 });
-        info.state = 'stopped';
-    }
-    async remove(containerId) {
-        this.ensureDocker();
-        const container = this.docker.getContainer(containerId);
-        await container.remove({ force: true });
-        this.containers.delete(containerId);
-    }
-    async exec(containerId, command) {
-        this.ensureDocker();
-        const info = this.getContainerInfo(containerId);
-        if (info.state !== 'running') {
-            throw createSandboxError('EXEC_FAILED', '컨테이너가 실행 중이 아닙니다.');
-        }
-        const container = this.docker.getContainer(containerId);
-        const start = Date.now();
-        const execInstance = await container.exec({
-            Cmd: command,
-            AttachStdout: true,
-            AttachStderr: true,
-            User: '1000:1000',
-        });
-        return new Promise((resolve) => {
-            let resolved = false;
-            const safeResolve = (result) => {
-                if (resolved)
-                    return;
-                resolved = true;
-                clearTimeout(timeout);
-                resolve(result);
-            };
-            const timeout = setTimeout(() => {
-                safeResolve({
-                    exitCode: -1,
-                    stdout: '',
-                    stderr: '명령 실행 시간이 30초를 초과했습니다.',
-                    durationMs: Date.now() - start,
-                    timedOut: true,
-                });
-            }, DEFAULT_CONTAINER_CONFIG.execTimeoutMs);
-            execInstance.start({ Detach: false }).then((stream) => {
-                let stdout = '';
-                let stderr = '';
-                stream.on('data', (chunk) => {
-                    stdout += String(chunk);
-                });
-                stream.on('end', () => {
-                    info.lastActivityAt = new Date().toISOString();
-                    safeResolve({ exitCode: 0, stdout, stderr, durationMs: Date.now() - start, timedOut: false });
-                });
-                stream.on('error', (err) => {
-                    stderr = err instanceof Error ? err.message : String(err);
-                    safeResolve({ exitCode: 1, stdout, stderr, durationMs: Date.now() - start, timedOut: false });
-                });
-            }).catch((err) => {
-                safeResolve({
-                    exitCode: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err),
-                    durationMs: Date.now() - start, timedOut: false,
-                });
-            });
-        });
-    }
-    getContainers() {
-        return Array.from(this.containers.values());
-    }
-    getUserContainers(userId) {
-        return this.getContainers().filter(c => c.userId === userId);
-    }
-    async cleanup() {
-        const now = Date.now();
-        let removed = 0;
-        for (const [id, info] of this.containers) {
-            const idle = now - new Date(info.lastActivityAt).getTime();
-            if (idle > DEFAULT_CONTAINER_CONFIG.inactivityTimeoutMs && info.state === 'running') {
-                try {
-                    await this.stop(id);
-                    await this.remove(id);
-                    removed++;
-                }
-                catch (err) {
-                    this.logger('warn', `Cleanup failed for ${id}: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-        return removed;
-    }
-    async shutdown() {
-        if (this.cleanupTimer) {
-            clearInterval(this.cleanupTimer);
-            this.cleanupTimer = null;
-        }
-        for (const [id] of this.containers) {
-            try {
-                await this.remove(id);
-            }
-            catch { /* best effort */ }
-        }
-        this.containers.clear();
-    }
-    // ============================================================================
-    // Private
-    // ============================================================================
-    async loadDockerode() {
-        try {
-            const mod = 'dockerode';
-            const imported = (await import(mod));
-            return new imported.default();
-        }
-        catch {
-            throw createSandboxError('DOCKER_NOT_RUNNING', 'dockerode 패키지가 설치되지 않았습니다. npm install dockerode');
-        }
-    }
-    async ping() {
-        try {
-            await this.docker.ping();
-        }
-        catch {
-            throw createSandboxError('DOCKER_NOT_RUNNING', "Docker 데몬이 실행되지 않습니다. 'docker start' 또는 Docker Desktop을 실행해주세요.");
-        }
-    }
-    ensureDocker() {
-        if (!this.docker) {
-            throw createSandboxError('DOCKER_NOT_RUNNING', 'ContainerManager가 초기화되지 않았습니다. init()을 먼저 호출하세요.');
-        }
-    }
-    getContainerInfo(containerId) {
-        const info = this.containers.get(containerId);
-        if (!info) {
-            throw createSandboxError('CONTAINER_NOT_FOUND', `컨테이너를 찾을 수 없습니다: ${containerId}`);
-        }
-        return info;
-    }
-    enforceContainerLimits(userId) {
-        const total = this.containers.size;
-        if (total >= DEFAULT_CONTAINER_CONFIG.maxContainersTotal) {
-            throw createSandboxError('MAX_CONTAINERS_REACHED', `최대 컨테이너 수(${DEFAULT_CONTAINER_CONFIG.maxContainersTotal})에 도달했습니다.`);
-        }
-        const userCount = this.getUserContainers(userId).length;
-        if (userCount >= DEFAULT_CONTAINER_CONFIG.maxContainersPerUser) {
-            throw createSandboxError('MAX_CONTAINERS_REACHED', `사용자당 최대 컨테이너 수(${DEFAULT_CONTAINER_CONFIG.maxContainersPerUser})에 도달했습니다.`);
-        }
-    }
-    startCleanupTimer() {
-        // Check every 5 minutes
-        this.cleanupTimer = setInterval(() => {
-            this.cleanup().catch((err) => {
-                this.logger('error', `Auto-cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
-            });
-        }, 5 * 60 * 1000);
-    }
-}
-//# sourceMappingURL=ContainerManager.js.map

package/dist/pc/sandbox/ContainerManager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ContainerManager.js","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AA2BjF,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,OAAO,gBAAgB;IACnB,MAAM,GAA6B,IAAI,CAAC;IACxC,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,CAAgB;IACtB,YAAY,GAA0B,IAAI,CAAC;IAEnD,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAAyC;QACpE,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,wBAAwB,CAAC,KAAK;YACvD,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,wBAAwB,CAAC,QAAQ;YAChE,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,wBAAwB,CAAC,aAAa;YAC/E,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,wBAAwB,CAAC,QAAQ;YAChE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,MAAM;YAC3C,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,MAAM;SAChC,CAAC;QAEF,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,eAAe,CAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CACrF,CAAC;QAEF,MAAM,MAAM,GAAG;YACb,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,iBAAiB,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;YAC1C,GAAG,OAAO,EAAE,MAAM;SACnB,CAAC;QAEF,IAAI,SAA6B,CAAC;QAClC,IAAI,OAAO,GAAG,wBAAwB,CAAC,aAAa,CAAC;QAErD,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,IAAI,CAAC,MAAO,CAAC,eAAe,CAAC;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,UAAU;oBACtB,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,YAAY;oBACxB,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;iBAC3B,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;oBACjB,MAAM,kBAAkB,CAAC,yBAAyB,EAChD,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,OAAO,QAAQ,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAkB;YAC1B,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;SACP,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,OAAiB;QAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,kBAAkB,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,OAAO;YACZ,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,WAAW,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC/C,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,WAAW,CAAC;oBACV,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,wBAAwB;oBAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAC;YAE3C,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACpD,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAEhB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAc,EAAE,EAAE;oBACnC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACpB,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAC/C,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChG,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE;oBAClC,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1D,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChG,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxB,WAAW,CAAC;oBACV,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACjF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK;iBAChD,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,IAAI,IAAI,GAAG,wBAAwB,CAAC,mBAAmB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACpF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACpB,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACtB,OAAO,EAAE,CAAC;gBACZ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,EAAE,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,UAAU;IACV,+EAA+E;IAEvE,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,WAAW,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAA6C,CAAC;YACjF,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,kBAAkB,CAAC,oBAAoB,EAC3C,kDAAkD,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,kBAAkB,CAAC,oBAAoB,EAC3C,iEAAiE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,oBAAoB,EAAE,kDAAkD,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,WAAmB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,kBAAkB,CAAC,qBAAqB,EAAE,oBAAoB,WAAW,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACnC,IAAI,KAAK,IAAI,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;YACzD,MAAM,kBAAkB,CAAC,wBAAwB,EAAE,aAAa,wBAAwB,CAAC,kBAAkB,YAAY,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACxD,IAAI,SAAS,IAAI,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,wBAAwB,EAAE,kBAAkB,wBAAwB,CAAC,oBAAoB,YAAY,CAAC,CAAC;QAClI,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,wBAAwB;QACxB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpB,CAAC;CACF"}

package/dist/pc/sandbox/ContainerManager.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ContainerManager.test.d.ts.map

package/dist/pc/sandbox/ContainerManager.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ContainerManager.test.d.ts","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerManager.test.ts"],"names":[],"mappings":""}