agent-dev-env 0.1.0

package/dist/runners/windows-summary.js

@@ -0,0 +1,104 @@
+// runners/windows-summary.ts — the Windows VMware "Sandbox is ready" block
+// (port of the shell's print_summary in run-windows-vmware-sandbox.sh:
+// same labels, same wording, same color scheme — with the CLI's 12-char
+// label column, like the other summaries).
+import { existsSync } from 'node:fs';
+import { logger } from '../lib/logger.js';
+import { imageRootDir, workingVmxPath } from '../lib/paths.js';
+import { PLATFORM_DEFAULTS } from '../lib/platform.js';
+import { resolveGuestCredentials } from './windows-guest.js';
+/** Prints the Windows summary block (image/VM/IP/SSH/RDP/WinRM/shared
+ *  dir/bridges/OpenChamber/state/stop hints).
+ *
+ * @param context - The run context.
+ * @param state - The accumulated run state.
+ */
+export async function printWindowsSummary(context, state) {
+    const workVmx = workingVmxPath(context.platform, context.image);
+    const stateDir = imageRootDir(context.platform, context.image);
+    const defs = PLATFORM_DEFAULTS['windows-vmware'];
+    const creds = state.vmIp
+        ? resolveGuestCredentials(context.image, context.options.env, state.vmIp)
+        : undefined;
+    logger.step('Sandbox is ready');
+    summaryLine('Image:', state.imageArchive ?? 'not available');
+    summaryLine('VM:', workVmx);
+    summaryLine('Guest IP:', state.vmIp ? `${state.vmIp} (Fusion NAT, vmnet8)` : 'unavailable');
+    summaryLine('SSH:', `ssh ${creds?.username ?? 'Administrator'}@${state.vmIp ?? '?'} (password: ${creds?.password ?? 'sandbox1'})`);
+    summaryLine('RDP:', `${state.vmIp ?? '?'}:${defs.rdpPort ?? 3389} (${creds?.username ?? 'Administrator'} / ${creds?.password ?? 'sandbox1'})`);
+    summaryLine('WinRM:', `${state.vmIp ?? '?'}:${defs.winrmPort ?? 5985} (advanced use)`);
+    printSharedLine(context, state);
+    printBridgeLines(context, state);
+    printOpenchamberLine(context, state);
+    summaryLine('State:', `${stateDir} (extracted base + working clone; --reset re-clones)`);
+    printStopLines(context, state, workVmx);
+}
+/** One `    LABEL........  VALUE` line. */
+function summaryLine(label, value) {
+    logger.out(`    ${label.padEnd(12)}${value}`);
+}
+function printSharedLine(context, state) {
+    if (state.sharedFolderSkipped) {
+        summaryLine('Shared:', loggerWarn('not supported (Windows 11 ARM guest on Apple silicon — no HGFS driver in VMware Tools)'));
+        return;
+    }
+    if (context.workDir && existsSync(context.workDir)) {
+        summaryLine('Shared:', `\\\\vmware-host\\Shared Folders\\work -> ${context.workDir}`);
+    }
+    else {
+        summaryLine('Shared:', 'not shared');
+    }
+}
+function printBridgeLines(context, state) {
+    const agent = state.bridges.agent;
+    if (agent.bridged) {
+        const value = agent.guestUp
+            ? `host agent -> TCP ${context.agentPort} -> guest \\\\.\\pipe\\openssh-ssh-agent`
+            : `host bridge up (TCP ${context.agentPort}), guest pipe not running`;
+        summaryLine('SSH agent:', agent.guestUp ? loggerOk(value) : loggerWarn(value));
+    }
+    else {
+        summaryLine('SSH agent:', 'not bridged');
+    }
+    const docker = state.bridges.docker;
+    if (docker.bridged) {
+        if (docker.engineUp) {
+            summaryLine('Docker:', loggerOk(`host engine (v${docker.serverVersion}) -> TCP ${context.dockerPort} -> guest (context 'host')`));
+        }
+        else if (docker.guestUp) {
+            summaryLine('Docker:', loggerWarn('bridge up, engine not reachable in the guest — is Docker running on the host?'));
+        }
+        else {
+            summaryLine('Docker:', loggerWarn(`host bridge up (TCP ${context.dockerPort}), guest pipe not running`));
+        }
+    }
+    else {
+        summaryLine('Docker:', 'not bridged');
+    }
+}
+function printOpenchamberLine(context, state) {
+    if (state.openchamberUp && state.openchamberUrl) {
+        summaryLine('OpenChamber:', loggerOk(`${state.openchamberUrl} (password: sandbox)`));
+    }
+    else {
+        summaryLine('OpenChamber:', loggerWarn(`not responding on http://${state.vmIp ?? '?'}:${context.openchamberPort}`));
+    }
+}
+function printStopLines(context, state, workVmx) {
+    summaryLine('Stop:', `run "agent-dev-env stop windows-vmware" (or: vmrun -T fusion stop '${workVmx}')`);
+    if (!context.options.foreground) {
+        if (state.bridges.agent.bridged) {
+            summaryLine('Bridge:', `host listener on TCP ${context.agentPort} stays up — stop it with: agent-dev-env stop windows-vmware`);
+        }
+        if (state.bridges.docker.bridged) {
+            summaryLine('Bridge:', `host Docker listener on TCP ${context.dockerPort} stays up — stop it with: agent-dev-env stop windows-vmware`);
+        }
+    }
+}
+// color helpers — the shell's ${c_green}/${c_yellow} inline.
+function loggerOk(text) {
+    return logger.color('green') + text + logger.reset();
+}
+function loggerWarn(text) {
+    return logger.color('yellow') + text + logger.reset();
+}

package/dist/runners/windows.js

@@ -0,0 +1,96 @@
+// runners/windows.ts — the Windows 11 (ARM64) VMware backend (Phase 5 of
+// the port): vmrun-driven image/base/clone (windows-image.ts), boot with
+// the guest-IP + sshd waits and the one-time auto-logon
+// (windows-autologon.ts), the HGFS-share step (windows-shared.ts — skipped
+// for ARM guests), the NAT-segment bridges + guest agent over the
+// PowerShell transport (windows-bridges.ts / windows-guest.ts), and the
+// summary. Port of run-windows-vmware-sandbox.sh §steps 0-6.
+import { rmSync } from 'node:fs';
+import { logger } from '../lib/logger.js';
+import { imageRootDir } from '../lib/paths.js';
+import { waitForSshd } from '../lib/ssh.js';
+import { startVm } from '../lib/vmrun.js';
+import { ensureBridgeDir } from './bridges.js';
+import { offerOpenInBrowser, waitForOpenchamber } from './openchamber.js';
+import { ensureAutologon } from './windows-autologon.js';
+import { windowsBridges } from './windows-bridges.js';
+import { resolveGuestCredentials } from './windows-guest.js';
+import { ensureWindowsImage, windowsWorkingVmx } from './windows-image.js';
+import { setupWindowsSharedFolder } from './windows-shared.js';
+import { printWindowsSummary } from './windows-summary.js';
+import { cleanupRunBridge, requireVmrun, stopRunningVm, waitForForegroundVmStop, waitGuestIp, } from './vmware-common.js';
+const PLATFORM = 'windows-vmware';
+/** The Windows VMware backend — vmrun + ssh2 (PowerShell in the guest;
+ *  the state lives under the CLI's data dir).
+ */
+export const windowsBackend = {
+    preflight: (context) => preflight(context),
+    ensureImageAndVm: (context, state) => ensureWindowsImage(context, state),
+    boot: boot,
+    setupBridges: (context, state) => windowsBridges(context, state),
+    setupSettings: (context, state) => setupSettings(context, state),
+    verifyOpenchamber: (context, state) => verifyOpenchamber(context, state),
+    summarize: (context, state) => printWindowsSummary(context, state),
+    finish: finish,
+};
+async function preflight(context) {
+    requireVmrun();
+    ensureBridgeDir();
+    if (context.options.reset) {
+        const root = imageRootDir(PLATFORM, context.image);
+        logger.info(`Resetting the working VM (--reset) — deleting the extracted base and the working clone.`);
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+// --- step 2: boot -----------------------------------------------------------
+async function boot(context, state) {
+    const workVmx = windowsWorkingVmx(context.image);
+    await stopRunningVm(context, workVmx, PLATFORM);
+    logger.cmd(`vmrun -T fusion start ${workVmx} ${context.options.headless ? 'nogui' : 'gui'}`);
+    const start = await startVm(workVmx, context.options.headless ? 'nogui' : 'gui');
+    if (start.code !== 0) {
+        throw new Error(`vmrun start failed:\n${start.stderr.trim()}`);
+    }
+    logger.ok('VM started.');
+    state.vmIp = await waitGuestIp(workVmx);
+    logger.ok(`Guest IP: ${state.vmIp}`);
+    const creds = resolveGuestCredentials(context.image, context.options.env, state.vmIp);
+    process.stdout.write('    Waiting for the guest to boot (up to 10 min)');
+    if (await waitForSshd(creds)) {
+        process.stdout.write(` ${logger.color('green')}done${logger.reset()}\n`);
+        logger.ok(`VM is up: ssh ${creds.username}@${state.vmIp}`);
+    }
+    else {
+        process.stdout.write(` ${logger.color('yellow')}failed${logger.reset()}\n`);
+        logger.die(`timed out waiting for the guest to boot (no SSH on ${state.vmIp}:22).`);
+    }
+    await ensureAutologon(context, state, workVmx, creds);
+    await setupWindowsSharedFolder(context, state, workVmx);
+}
+// --- step 4/5 hooks ---------------------------------------------------------
+async function setupSettings(context, state) {
+    logger.info('Windows guests have no user settings copy — skipping.');
+    state.settings = 'skipped';
+}
+async function verifyOpenchamber(context, state) {
+    if (!state.vmIp) {
+        logger.warn('OpenChamber: guest IP unavailable — cannot probe.');
+        return;
+    }
+    state.openchamberUrl = `http://${state.vmIp}:${context.openchamberPort}`;
+    state.openchamberUp = await waitForOpenchamber(state.openchamberUrl);
+    if (state.openchamberUp) {
+        await offerOpenInBrowser(state.openchamberUrl, context.options.yes);
+    }
+}
+// --- finish: foreground wait + bridge cleanup --------------------------------
+async function finish(context, state) {
+    if (!context.options.foreground) {
+        return;
+    }
+    await waitForForegroundVmStop(windowsWorkingVmx(context.image));
+    // The VM stopped (or Cmd+C was pressed) — kill the bridges this run
+    // started; in background mode they stay up, outliving the CLI by design.
+    await cleanupRunBridge(state.bridges.agent.pid, 'agent bridge');
+    await cleanupRunBridge(state.bridges.docker.pid, 'Docker bridge');
+}

package/dist/settings/common.js

@@ -0,0 +1,107 @@
+// settings/common.ts — the parts of the user-settings copy shared by the
+// macOS and Ubuntu backends: the outcome enum, the guest marker paths
+// (green-field ~/.config/agent-dev-env/), the host candidate file set
+// (identical on both — the host is always macOS), the .gitconfig
+// sanitization and the guest-side marker scripts. The per-platform bits
+// live in settings/macos.ts (version 9, /Users/admin, tart transport)
+// and settings/ubuntu.ts (version 3, /home/admin, ssh2 transport).
+import { existsSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** @internal — Marker path inside the guest (relative to its home),
+ *  embedded in the marker scripts. Exported for the co-located tests.
+ */
+export const SETTINGS_MARKER = '.config/agent-dev-env/settings-copied';
+/** The marker's directory (relative to the guest home). */
+const SETTINGS_MARKER_DIR = SETTINGS_MARKER.split('/').slice(0, -1).join('/');
+/** The candidate settings paths, relative to $HOME — the same list as
+ *  the shell's collect_settings_files (directories are copied whole). */
+const SETTINGS_CANDIDATES = [
+    '.config/opencode/opencode.json',
+    '.config/opencode/opencode.jsonc',
+    '.config/opencode/tui.json',
+    '.config/opencode/tui.jsonc',
+    '.config/opencode/agents',
+    '.config/opencode/commands',
+    '.config/opencode/modes',
+    '.config/opencode/plugins',
+    '.config/opencode/skills',
+    '.config/opencode/tools',
+    '.config/opencode/themes',
+    '.config/opencode/package.json',
+    '.config/opencode/package-lock.json',
+    '.config/opencode/bun.lock',
+    '.local/share/opencode/auth.json',
+    '.opencodereview/config.json',
+    '.copilot/config.json',
+    '.copilot/skills',
+    '.vscode/extensions',
+    'Library/Application Support/Code/User/settings.json',
+    'Library/Application Support/Code/User/keybindings.json',
+    'Library/Application Support/Code/User/snippets',
+    'Library/Application Support/mcp-compress-router',
+    '.ssh/allowed_signers',
+    '.ssh/known_hosts',
+    '.gitconfig',
+];
+/** The host's user settings files, relative to $HOME — only existing
+ *  entries, fixed list first, then the `~/.ssh/*.sh` helpers (sorted for
+ *  deterministic output).
+ *
+ * @param home - The host home directory.
+ * @returns The list of settings paths (tarable with `-C` home).
+ */
+export function collectSettingsFiles(home = homedir()) {
+    const files = SETTINGS_CANDIDATES.filter((path) => existsSync(join(home, path)));
+    try {
+        const sshScripts = readdirSync(join(home, '.ssh'), { withFileTypes: true })
+            .filter((entry) => entry.isFile() && entry.name.endsWith('.sh'))
+            .map((entry) => `.ssh/${entry.name}`)
+            .sort();
+        files.push(...sshScripts);
+    }
+    catch {
+        // no ~/.ssh — nothing to add
+    }
+    return files;
+}
+/** Rewrites host home paths to the guest home (the .gitconfig
+ *  sanitization: `s|$HOME|$guest_home|g` parity, including `program`
+ *  values git execs verbatim).
+ *
+ * @param content - The .gitconfig text.
+ * @param hostHome - The host home directory (e.g. /Users/ameshkov).
+ * @param guestHome - The guest home directory (/Users/admin or /home/admin).
+ * @returns The sanitized content.
+ */
+export function sanitizeGitconfig(content, hostHome, guestHome) {
+    return content.split(hostHome).join(guestHome);
+}
+/** The guest-side marker check (exit 0 when the guest's settings version
+ *  marker is >= the version passed as `$1`) — `sh -s <version>` stdin.
+ *
+ * @returns The script text.
+ */
+export function guestSettingsCheckScript() {
+    return [
+        'version=$1',
+        `marker="$HOME/${SETTINGS_MARKER}"`,
+        'if [ -f "$marker" ] && [ "$(cat "$marker" 2>/dev/null)" -ge "$version" ] 2>/dev/null; then',
+        '    exit 0',
+        'fi',
+        'exit 1',
+        '',
+    ].join('\n');
+}
+/** The guest-side marker write — `sh -s <version>` stdin script.
+ *
+ * @returns The script text.
+ */
+export function guestSettingsMarkerScript() {
+    return [
+        'version=$1',
+        `mkdir -p "$HOME/${SETTINGS_MARKER_DIR}"`,
+        `printf '%s\\n' "$version" > "$HOME/${SETTINGS_MARKER}"`,
+        '',
+    ].join('\n');
+}

package/dist/settings/macos-copy.js

@@ -0,0 +1,223 @@
+// settings/macos-copy.ts — the IO half of the macOS user-settings copy:
+// tar streams over `tart exec -i` (binary-safe pipe — tar may contain
+// arbitrary content, so the text-oriented run() helpers cannot carry
+// it), the marker check/write, the OpenChamber restart, and the two
+// flows: `ensure` (run step, marker-gated) and `sync` (on demand).
+import { spawn } from 'node:child_process';
+import { cpSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { execVm } from '../lib/tart.js';
+import { logger } from '../lib/logger.js';
+import { confirm } from '../lib/prompt.js';
+import { collectSettingsFiles, guestSettingsCheckScript, guestSettingsMarkerScript, guestUnpackCommand, GUEST_HOME, openchamberRestartScript, sanitizeGitconfig, SETTINGS_VERSION, } from './macos.js';
+/** Streams a tar archive (built from `includes` under `cwd`) into the
+ *  guest and unpacks it there. Binary-safe: the producer's stdout pipes
+ *  straight into `tart exec`'s stdin.
+ *
+ * @param vm - The running VM name.
+ * @param cwd - The directory to archive from.
+ * @param includes - The paths (relative to cwd) to include.
+ * @param unpackCommand - The guest-side unpack command.
+ * @returns Resolves on success; rejects with the guest's stderr on fail.
+ */
+function streamTarIntoGuest(vm, cwd, includes, unpackCommand) {
+    const tar = spawn('tar', ['-C', cwd, '-cf', '-', ...includes]);
+    const guest = spawn('tart', ['exec', '-i', vm, 'sh', '-c', unpackCommand]);
+    return new Promise((resolve, reject) => {
+        const codes = { tar: null, guest: null };
+        let guestError = '';
+        let settled = false;
+        guest.stderr.setEncoding('utf8');
+        guest.stderr.on('data', (chunk) => {
+            guestError += chunk;
+        });
+        const finish = () => {
+            if (settled || codes.tar === null || codes.guest === null) {
+                return;
+            }
+            settled = true;
+            if (codes.tar === 0 && codes.guest === 0) {
+                resolve();
+            }
+            else {
+                reject(new Error(`settings copy failed (tar ${codes.tar}, tart exec ${codes.guest})` +
+                    (guestError ? `\n${guestError.trim()}` : '')));
+            }
+        };
+        registerExit(tar, 'tar', codes, finish);
+        registerExit(guest, 'guest', codes, finish);
+        tar.stdout.pipe(guest.stdin);
+    });
+}
+/** @internal — tracks one side's exit code and re-checks the pair. */
+function registerExit(proc, name, codes, finish) {
+    const setCode = (code) => {
+        codes[name] = code;
+        finish();
+    };
+    proc.on('close', (code) => setCode(code ?? -1));
+    proc.on('error', () => setCode(-1));
+}
+/** @internal — true when the guest already has settings of the current
+ *  version (numeric marker compare, like the shell's `-ge`). */
+export async function guestSettingsUpToDate(vm) {
+    const res = await execVm(vm, ['sh', '-s', String(SETTINGS_VERSION)], {
+        input: guestSettingsCheckScript(),
+    });
+    return res.code === 0;
+}
+/** Copies the settings into the guest: archive 1 = everything except
+ *  .gitconfig, archive 2 = the sanitized .gitconfig, then the version
+ *  marker (the legacy two-archive dance — bsdtar stops at the first
+ *  end-of-archive marker).
+ *
+ * @param vm - The running VM name.
+ * @param files - The settings paths (relative to the host home).
+ * @param home - The host home directory.
+ * @throws Error when the copy or the marker write fails.
+ */
+async function copySettingsToGuest(vm, files, home) {
+    const staging = mkdtempSync(join(tmpdir(), 'agent-dev-env-settings.'));
+    try {
+        const gitconfig = files.includes('.gitconfig');
+        const hasGitconfig = gitconfig && stageSanitizedGitconfig(home, staging);
+        const rest = files.filter((file) => file !== '.gitconfig');
+        if (rest.length > 0) {
+            await streamTarIntoGuest(vm, home, rest, guestUnpackCommand());
+        }
+        if (hasGitconfig) {
+            await streamTarIntoGuest(vm, staging, ['.gitconfig'], 'tar -C "$HOME" -xf -');
+        }
+        const marker = await execVm(vm, ['sh', '-s', String(SETTINGS_VERSION)], {
+            input: guestSettingsMarkerScript(),
+        });
+        if (marker.code !== 0) {
+            throw new Error('settings were copied, but the version marker could not be written — ' +
+                'they will be offered again on the next run.');
+        }
+    }
+    finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}
+/** @internal — sanitized .gitconfig in the staging dir; false when the
+ *  host has no .gitconfig (or it could not be staged — the sanitized
+ *  copy is preferred, the raw file is shipped as-is as a fallback, like
+ *  the Ubuntu flow). Exported for the co-located tests.
+ *
+ * @param home - The host home directory.
+ * @param staging - The staging dir to write into.
+ * @returns True when a .gitconfig was staged.
+ */
+export function stageSanitizedGitconfig(home, staging) {
+    const source = join(home, '.gitconfig');
+    try {
+        const content = readFileSync(source, 'utf8');
+        const sanitized = sanitizeGitconfig(content, home, GUEST_HOME);
+        writeFileSync(join(staging, '.gitconfig'), sanitized);
+        // Preserve the source's permissions (git may exec helper scripts).
+        try {
+            const { mode } = statSync(source);
+            writeFileSync(join(staging, '.gitconfig'), sanitized, { mode: mode & 0o777 });
+        }
+        catch {
+            // best-effort mode preserve
+        }
+        return true;
+    }
+    catch {
+        logger.warn('could not sanitize .gitconfig — shipping it as-is.');
+        try {
+            cpSync(source, join(staging, '.gitconfig'), { preserveTimestamps: true });
+            return true;
+        }
+        catch {
+            logger.warn('could not stage .gitconfig — skipping it.');
+            return false;
+        }
+    }
+}
+/** Restarts OpenChamber so a fresh settings copy takes effect. Returns
+ *  true when the restart succeeded (warns otherwise, like the shell).
+ *
+ * @param vm - The running VM name.
+ * @returns True when restarted.
+ */
+export async function restartOpenchamber(vm) {
+    const res = await execVm(vm, ['sh', '-s'], { input: openchamberRestartScript() });
+    if (res.code !== 0) {
+        logger.warn('could not restart OpenChamber — it will pick up the new settings on its next start.');
+        return false;
+    }
+    logger.ok('Restarted OpenChamber so it picks up the new user settings.');
+    return true;
+}
+/** Prints the file list and asks the standard confirmation.
+ *
+ * @param home - The host home directory (display paths).
+ * @param files - The settings paths.
+ * @param yes - Skip the confirmation.
+ * @returns True when the user confirmed.
+ */
+async function confirmSettingsCopy(home, files, yes) {
+    logger.info("Found on the host — will copy into the guest's home directory:");
+    for (const file of files) {
+        logger.info(`  ${join(home, file)}`);
+    }
+    if (yes) {
+        return true;
+    }
+    return confirm('Copy these user settings into the guest?', { default: 'y' });
+}
+/** The run step: marker-gated copy (offered once per settings version).
+ *
+ * @param vm - The running VM name.
+ * @param home - The host home directory.
+ * @param yes - Skip confirmations.
+ * @returns The step outcome (see SettingsState).
+ */
+export async function ensureUserSettings(vm, home, yes) {
+    if (await guestSettingsUpToDate(vm)) {
+        logger.ok(`User settings are already in the guest (version ${SETTINGS_VERSION}) — skipping.`);
+        return 'uptodate';
+    }
+    const files = collectSettingsFiles(home);
+    if (files.length === 0) {
+        logger.info('No user settings found on the host (opencode config and auth, ' +
+            'OpenCodeReview config, Copilot config, VS Code config and extensions, ' +
+            '~/.ssh, ~/.gitconfig) — nothing to copy.');
+        return 'none';
+    }
+    if (!(await confirmSettingsCopy(home, files, yes))) {
+        logger.info('Skipped — re-run `agent-dev-env run` to copy them later.');
+        return 'declined';
+    }
+    await copySettingsToGuest(vm, files, home);
+    logger.ok(`Copied ${files.length} item(s) into the guest.`);
+    return 'copied';
+}
+/** The `sync` flow: always copies (no marker gate) + restarts OpenChamber.
+ *
+ * @param vm - The running VM name.
+ * @param home - The host home directory.
+ * @param yes - Skip confirmations.
+ * @returns The outcome (copied | none | declined | failed).
+ */
+export async function syncUserSettings(vm, home, yes) {
+    const files = collectSettingsFiles(home);
+    if (files.length === 0) {
+        logger.info('No user settings found on the host (opencode config and auth, ' +
+            'OpenCodeReview config, Copilot config, VS Code config and extensions, ' +
+            '~/.ssh, ~/.gitconfig) — nothing to copy.');
+        return 'none';
+    }
+    if (!(await confirmSettingsCopy(home, files, yes))) {
+        logger.info('Skipped — re-run `agent-dev-env sync` to copy them later.');
+        return 'declined';
+    }
+    await copySettingsToGuest(vm, files, home);
+    logger.ok(`Copied ${files.length} item(s) into the guest (version ${SETTINGS_VERSION}).`);
+    await restartOpenchamber(vm);
+    return 'copied';
+}

package/dist/settings/macos.js

@@ -0,0 +1,41 @@
+// settings/macos.ts — the macOS user-settings copy: pure builders
+// (collection, .gitconfig sanitization, guest-side marker scripts) —
+// port of scripts/lib/macos-settings.sh, with the marker moved to the
+// green-field `~/.config/agent-dev-env/` path (AGENTS.md conventions).
+//
+// The IO half (tar streams over `tart exec`) lives in macos-copy.ts; this
+// module stays free of process spawning so the logic is unit-testable.
+// The macOS-specific bits are the version, the guest home and the guest
+// unpack/restart scripts — the shared set (markers, candidate files,
+// sanitization) lives in settings/common.ts.
+export { collectSettingsFiles, guestSettingsCheckScript, guestSettingsMarkerScript, sanitizeGitconfig, } from './common.js';
+/** Version of the settings copy. Bump when the file set or the copy logic
+ *  changes: guests whose marker is older are offered the copy again.
+ */
+export const SETTINGS_VERSION = 9;
+/** The sandbox user in the macOS base image — fixed, so host home paths
+ *  are rewritten to it when the settings are copied (see sanitize).
+ */
+export const GUEST_HOME = '/Users/admin';
+/** The guest-side tar unpack — `sh -c` command: extract + tighten ~/.ssh.
+ *
+ * @returns The command text.
+ */
+export function guestUnpackCommand() {
+    return 'tar -C "$HOME" -xf - || exit 1; chmod 700 "$HOME/.ssh" 2>/dev/null || true';
+}
+/** The guest-side OpenChamber restart — `sh -s` stdin script (sources
+ *  ~/.zprofile first: openchamber is npm-global via nvm, login-shell
+ *  PATH only).
+ *
+ * @returns The script text.
+ */
+export function openchamberRestartScript() {
+    return [
+        'if [ -f "$HOME/.zprofile" ]; then',
+        '    . "$HOME/.zprofile" 2>/dev/null || true',
+        'fi',
+        'exec openchamber restart',
+        '',
+    ].join('\n');
+}