chamba 0.7.0 → 0.8.0

package/dist/commands/dev.js

@@ -1,612 +1,11 @@
-// =========================================================================================================================================
-// src/commands/dev.ts - Start the dev container and connect via docker exec
-// In-memory Dockerfile build, profile selection, pattern-based shadows, env handling, runtime env injection.
-// =========================================================================================================================================
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { existsSync } from "node:fs";
-import { join, relative } from "node:path";
-import { cancel, confirm, isCancel, log, outro, select } from "@clack/prompts";
-import { buildAgentContextDocs, buildAgentMountArgs, injectAgentContext } from "../lib/agent-context.js";
-import { openInBrowser } from "../lib/browser.js";
-import { readChambaYaml } from "../lib/chamba-yaml.js";
-import { CONTAINER_KEEP_ALIVE, CONTAINER_STARTUP, CONTAINER_WORKSPACE, DEFAULT_PROFILE, GIT_MODE, LABEL_ENV, LABEL_GIT_MODE, LABEL_MANAGED, LABEL_PORTS, LABEL_PROFILE, LABEL_RUNTIME_ENV, LABEL_SHADOWS, RUNTIME_ENV, WEB_CONTAINER_PORT, } from "../lib/constants.js";
-import { buildDockerfile, buildImageWithTempfile, computeBuildHash, isImageStale } from "../lib/dockerfile-builder.js";
-import { envLabel, envRunArgs, envWarnings, validateEnvConfig } from "../lib/env.js";
-import { readWebRange } from "../lib/global-config.js";
-import { buildPnpmStoreMountArgs } from "../lib/pnpm-store.js";
-import { assertHostPortsAvailable, formatPortNotice, formatWebRange, portEnvArgs, portPublishArgs, portsLabel, validatePortsConfig, } from "../lib/ports.js";
-import { containerSessionCount, loginShellExecArgs } from "../lib/sessions.js";
-import { buildShadowMountArgs, ensureShadowsInSync, expandShadowPatterns } from "../lib/shadows.js";
-import { buildWebpaneMountArgs, buildWebtermStateMountArgs, isWebKey, readWebAgent, readWebKey, resolveWebPort, setWebDefaultCwd, startWebtermAndVerify, webInterfaceAnswers, webInterfaceUrl, webPortUsable, webSessionInfo, } from "../lib/webterm.js";
-import { readActiveProfile, readGitMode, writeActiveProfile } from "../lib/workspace-identity.js";
-// --- Working directory resolution ---------------------------------------------------------------------------------------------------------
-// Always open the session where chamba was invoked. The whole workspace root is bind-mounted at
-// CONTAINER_WORKSPACE regardless, so this only sets the shell's opening directory. From a sub-dir,
-// `cd /workspace` reaches the root - nothing is hidden either way. Exported for testing.
-export function resolveWorkdir(workspaceDir, cwd) {
-    if (cwd === workspaceDir)
-        return CONTAINER_WORKSPACE;
-    return `${CONTAINER_WORKSPACE}/${relative(workspaceDir, cwd)}`;
-}
-// --- Profile selection -------------------------------------------------------------------------------------------------------------------
-async function selectProfile(ctx, profiles) {
-    const profileNames = Object.keys(profiles);
-    if (profileNames.length <= 1) {
-        return profileNames[0] ?? DEFAULT_PROFILE;
-    }
-    const currentProfile = readActiveProfile(ctx.workspaceId) ?? DEFAULT_PROFILE;
-    const choice = await select({
-        message: "Profile:",
-        options: profileNames.map((name) => {
-            const description = profiles[name]?.description;
-            const isCurrent = name === currentProfile;
-            const hint = description && isCurrent ? `${description} · current` : (description ?? (isCurrent ? "current" : undefined));
-            const opt = { value: name, label: name };
-            if (hint)
-                opt.hint = hint;
-            return opt;
-        }),
-        initialValue: currentProfile,
-    });
-    if (isCancel(choice)) {
-        cancel("Cancelled.");
-        process.exit(0);
-    }
-    const selected = choice;
-    if (selected !== currentProfile) {
-        writeActiveProfile(ctx.workspaceId, selected);
-    }
-    return selected;
-}
-// Returns null when the container does not exist (docker inspect exits non-zero).
-function inspectContainer(containerName) {
-    const fmt = `{{.State.Status}}|{{index .Config.Labels "${LABEL_SHADOWS}"}}|{{index .Config.Labels "${LABEL_PROFILE}"}}|{{index .Config.Labels "${LABEL_RUNTIME_ENV}"}}|{{index .Config.Labels "${LABEL_GIT_MODE}"}}|{{index .Config.Labels "${LABEL_PORTS}"}}|{{index .Config.Labels "${LABEL_ENV}"}}`;
-    const result = spawnSync("docker", ["inspect", "--format", fmt, containerName], { encoding: "utf8", stdio: "pipe" });
-    if (result.status !== 0)
-        return null;
-    const clean = (s) => (s === "<no value>" ? "" : s);
-    const [status = "", shadows = "", profile = "", runtimeEnv = "", gitMode = "", ports = "", env = ""] = result.stdout.trim().split("|");
-    return {
-        status,
-        shadowLabel: clean(shadows),
-        profileLabel: clean(profile),
-        runtimeEnvLabel: clean(runtimeEnv),
-        gitModeLabel: clean(gitMode),
-        portsLabel: clean(ports),
-        envLabel: clean(env),
-    };
-}
-// --- Shadow label ------------------------------------------------------------------------------------------------------------------------
-function shadowLabel(paths) {
-    if (paths.length === 0)
-        return "";
-    return [...paths].sort().join(",");
-}
-// --- Runtime env fingerprint -------------------------------------------------------------------------------------------------------------
-function runtimeEnvLabel() {
-    const entries = Object.entries(RUNTIME_ENV);
-    if (entries.length === 0)
-        return "";
-    const sorted = entries
-        .map(([k, v]) => `${k}=${v}`)
-        .sort()
-        .join(",");
-    return createHash("sha256").update(sorted).digest("hex").slice(0, 12);
-}
-// --- Stop and remove container -----------------------------------------------------------------------------------------------------------
-function stopAndRemoveContainer(containerName) {
-    spawnSync("docker", ["stop", containerName], { stdio: "pipe" });
-    spawnSync("docker", ["rm", containerName], { stdio: "pipe" });
-}
-// --- Run startup checks (AI CLI update + readiness validation) ---------------------------------------------------------------------------
-function runStartup(containerName, quiet) {
-    // The SPACE-to-skip prompt in startup.mjs needs raw-mode stdin (-i) and a PTY (-t).
-    // Omitted when quiet so test output stays pipe-capturable.
-    const ttyFlags = quiet ? [] : ["-i", "-t"];
-    const result = spawnSync("docker", ["exec", "-u", "root", ...ttyFlags, containerName, "node", CONTAINER_STARTUP, "--summary"], {
-        stdio: quiet ? "pipe" : "inherit",
-    });
-    return result.status === 0;
-}
-export async function startContainer(opts) {
-    const { containerName, workspaceRoot, cacheDir, templatesDir, activeProfile, profileHook, expandedShadows, envConfig, hasGit, gitMode, shadowPatterns, workspaceName, portMappings, webPort, noCache, quiet = false, } = opts;
-    // Used by `docker start` (resume). Echoes the container id/name to stdout on success; drop stdout to keep
-    // that noise out of the session start, but keep stderr so real errors still show.
-    const stdio = quiet ? "pipe" : ["ignore", "ignore", "inherit"];
-    // --- Published ports fingerprint (static config, no host I/O here) ----------------------------------------------------------------------
-    // Ports are declared, not resolved, so the label is a pure function of the config. Host availability is
-    // checked just-in-time on the create path (assertHostPortsAvailable), never on resume/connect.
-    const currentPortsLabel = portsLabel(portMappings);
-    // --- Env fingerprint (inline vars + resolved file contents) -----------------------------------------------------------------------------
-    // Covers inline vars and the contents of every existing env file, so editing either recreates the container.
-    const currentEnvLabel = envLabel(envConfig);
-    // --- Sync shadows and build mount args ------------------------------------------------------------------------------------------------
-    ensureShadowsInSync(cacheDir, expandedShadows, workspaceRoot);
-    const shadowMountArgs = buildShadowMountArgs(cacheDir, expandedShadows);
-    // --- Agent context -------------------------------------------------------------------------------------------------------------------
-    const agentDocs = buildAgentContextDocs(hasGit, shadowPatterns, gitMode);
-    // --- Env args (env files + inline vars) ----------------------------------------------------------------------------------------------
-    const envArgs = envRunArgs(envConfig);
-    // --- Build mount args ----------------------------------------------------------------------------------------------------------------
-    const agentMounts = buildAgentMountArgs(cacheDir);
-    const pnpmStoreMounts = buildPnpmStoreMountArgs(cacheDir);
-    // The web interface's own state (which agent new sessions start with) lives on the host side of a
-    // mount, so `webterm <agent>` in the container still holds after a recreate.
-    const webtermStateMounts = buildWebtermStateMountArgs(cacheDir);
-    // The web pane's pages and their feedback, one directory per conversation - mounted so they outlive
-    // the container and a resumed conversation opens its own history.
-    const webpaneMounts = buildWebpaneMountArgs(cacheDir);
-    // Shadow mounts must come AFTER the workspace mount to overlay correctly
-    const mountArgs = [
-        "-v",
-        `${workspaceRoot}:${CONTAINER_WORKSPACE}`,
-        ...shadowMountArgs,
-        ...agentMounts,
-        ...pnpmStoreMounts,
-        ...webtermStateMounts,
-        ...webpaneMounts,
-    ];
-    // --- Container labels ----------------------------------------------------------------------------------------------------------------
-    const labelArgs = [
-        "--label",
-        `${LABEL_MANAGED}=true`,
-        "--label",
-        `${LABEL_SHADOWS}=${shadowLabel(expandedShadows)}`,
-        "--label",
-        `${LABEL_PROFILE}=${activeProfile}`,
-        "--label",
-        `${LABEL_RUNTIME_ENV}=${runtimeEnvLabel()}`,
-        "--label",
-        `${LABEL_GIT_MODE}=${gitMode}`,
-    ];
-    // --- Runtime env vars -----------------------------------------------------------------------------------------------------------------
-    const runtimeEnvArgs = [
-        ...Object.entries(RUNTIME_ENV).flatMap(([k, v]) => ["-e", `${k}=${v}`]),
-        "-e",
-        `CHAMBA_WORKSPACE=${workspaceName}`,
-        "-e",
-        `CHAMBA_GIT_MODE=${gitMode}`,
-    ];
-    // --- Inspect container state ---------------------------------------------------------------------------------------------------------
-    const info = inspectContainer(containerName);
-    let containerStatus = info?.status ?? null;
-    // --- Recreate if shadow, profile, runtime env, git mode, or ports changed ------------------------------------------------------------
-    if (info !== null) {
-        const expectedShadowLabel = shadowLabel(expandedShadows);
-        const shadowChanged = info.shadowLabel !== expectedShadowLabel;
-        const profileChanged = info.profileLabel !== activeProfile;
-        const runtimeEnvChanged = info.runtimeEnvLabel !== runtimeEnvLabel();
-        const gitModeChanged = info.gitModeLabel !== gitMode;
-        // Both sides are "" when a workspace declares no ports, so a container without published ports never recreates on this label.
-        const portsChanged = info.portsLabel !== currentPortsLabel;
-        // Both sides are "" when a workspace declares no env, so a container without env injection never recreates on this label.
-        const envChanged = info.envLabel !== currentEnvLabel;
-        if (shadowChanged || profileChanged || runtimeEnvChanged || gitModeChanged || portsChanged || envChanged) {
-            // Describe the change once - reused for the confirm prompt and the recreate log line below.
-            let reason;
-            if (profileChanged)
-                reason = `Profile changed (${info.profileLabel} -> ${activeProfile})`;
-            else if (shadowChanged)
-                reason = "Shadow paths changed";
-            else if (gitModeChanged)
-                reason = `Git mode changed (${info.gitModeLabel || "<unset>"} -> ${gitMode})`;
-            else if (portsChanged)
-                reason = "Ports changed";
-            else if (envChanged)
-                reason = "Environment variables changed";
-            else
-                reason = "Runtime environment updated";
-            // A running container is a live session. Recreating it stops and removes the container, so confirm
-            // before killing it - a config change should not surprise the user mid-session. Exited containers
-            // have no live session, so skip the prompt. Non-interactive callers (quiet) keep the auto-recreate.
-            const prompted = !quiet && info.status === "running";
-            if (prompted) {
-                log.warn(`${reason} - applying this needs to recreate the running container, which stops any open sessions.\n` +
-                    "Agent memory, settings, and workspace data are preserved.");
-                const recreate = await confirm({
-                    message: "Recreate the container now?",
-                    initialValue: true,
-                });
-                if (isCancel(recreate) || !recreate) {
-                    cancel("Session cancelled - container left running.");
-                    process.exit(0);
-                }
-            }
-            stopAndRemoveContainer(containerName);
-            containerStatus = null;
-            // Profile change means a different Dockerfile, so drop the image to force a fresh build.
-            if (profileChanged)
-                spawnSync("docker", ["rmi", containerName], { stdio: "pipe" });
-            // The confirm prompt above already stated the reason, so only print the progress line when we
-            // did not prompt (an exited container recreated without confirmation).
-            if (!quiet && !prompted)
-                log.info(`${reason} - ${profileChanged ? "rebuilding" : "recreating container"}...`);
-        }
-    }
-    // Refresh the agent context docs in the cache dir (bind-mounted into the container) once, before any
-    // create / resume / connect path below. Idempotent file writes with no dependency on the image build.
-    injectAgentContext(cacheDir, agentDocs);
-    // What the container ends up publishing for the web interface. Only the create path can change it (by
-    // dropping a mapping whose port was taken), and it is returned so the caller stops using the port it
-    // asked for. Resume and connect reuse a container whose mapping is already fixed, and any change to it
-    // would have recreated the container via the ports label.
-    let publishedWebPort = webPort;
-    // Build the image (if needed) and run a fresh container. Shared by the no-container path and the
-    // resume-recovery path below. Build/run failures are terminal, so they outro and exit here.
-    const createAndRun = async () => {
-        // The interactive build spinner owns the "rebuilding" message (see buildImageWithTempfile), so no log.step here.
-        const dockerfileContent = buildDockerfile(join(templatesDir, "Dockerfile"), profileHook);
-        const buildResult = await buildImageWithTempfile(dockerfileContent, templatesDir, containerName, noCache, quiet);
-        if (buildResult.status !== 0) {
-            if (!quiet)
-                outro("Failed to build container image.");
-            process.exit(buildResult.status);
-        }
-        // Minutes can pass between run() checking the web port and this create path (profile selection, a
-        // recreate confirm, the image build), so re-check it here. A port taken in the meantime drops the
-        // mapping and the session continues without the interface. Only chamba.yaml ports are
-        // allowed to fail a session, which is what assertHostPortsAvailable below is for.
-        let published = portMappings;
-        if (webPort !== undefined && !(await webPortUsable(webPort, containerName))) {
-            if (!quiet) {
-                log.warn(`Web interface: host port ${webPort} was taken before the container could start - continuing without it.`);
-            }
-            published = portMappings.filter((m) => m.host !== webPort);
-            publishedWebPort = undefined;
-        }
-        // Ports are static config, so check host availability up front. The old container was already removed on
-        // every path that reaches here, so we never check our own live port. A taken host port fails clearly and
-        // names the entry, before docker run - so no doomed `created` container is left behind on a clash.
-        try {
-            await assertHostPortsAvailable(published, publishedWebPort);
-        }
-        catch (err) {
-            if (!quiet)
-                outro(err instanceof Error ? err.message : String(err));
-            process.exit(1);
-        }
-        if (!quiet)
-            log.info("Starting dev container...");
-        // Only set when the web port survived the re-check above: this gates the greeting's URL line and the
-        // webterm launcher. Built here rather than with the other runtime env so a dropped mapping cannot
-        // leave a URL behind that nothing is listening on.
-        // Never stale either way: the web mapping is part of the ports label written just below, so a moved or
-        // dropped port recreates the container and rebuilds this. No dedicated label needed for the same reason.
-        const webEnvArgs = publishedWebPort !== undefined ? ["-e", `CHAMBA_WEB_URL=${webInterfaceUrl(publishedWebPort, null)}`] : [];
-        // portEnvArgs come after envArgs/runtimeEnvArgs/webEnvArgs so the published value wins any -e collision.
-        const runArgs = [
-            "run",
-            "-d",
-            "--name",
-            containerName,
-            ...mountArgs,
-            ...envArgs,
-            ...runtimeEnvArgs,
-            ...webEnvArgs,
-            ...portEnvArgs(published),
-            ...portPublishArgs(published),
-            "--security-opt",
-            "no-new-privileges:true",
-            ...labelArgs,
-            "--label",
-            // Labelled with what was actually published, not what was planned, so the next session compares
-            // like for like: a dropped web mapping recreates once when the port comes back, not every start.
-            `${LABEL_PORTS}=${portsLabel(published)}`,
-            "--label",
-            `${LABEL_ENV}=${currentEnvLabel}`,
-            containerName,
-            ...CONTAINER_KEEP_ALIVE,
-        ];
-        // Capture stderr so the real docker error is re-emitted on failure. A single run - the pre-flight check
-        // above already rejected any taken host port, so there is no port-race retry loop.
-        const runStdio = quiet ? "pipe" : ["ignore", "ignore", "pipe"];
-        const runResult = spawnSync("docker", runArgs, { stdio: runStdio });
-        if (runResult.status !== 0) {
-            if (!quiet) {
-                process.stderr.write(runResult.stderr?.toString() ?? "");
-                outro("Failed to start dev container.");
-            }
-            process.exit(runResult.status ?? 1);
-        }
-    };
-    const result = (status) => ({ status, webPort: publishedWebPort ?? null });
-    if (containerStatus === null) {
-        // --- No container - build image and run --------------------------------------------------------------------------------------------
-        await createAndRun();
-        return result("created");
-    }
-    else if (containerStatus === "exited") {
-        // --- Container stopped - resume (recreate on a dangling-mount failure) -------------------------------------------------------------
-        if (!quiet)
-            log.info("Resuming dev container...");
-        const start = spawnSync("docker", ["start", containerName], { stdio });
-        if (start.status !== 0) {
-            // A resume reuses the bind mounts frozen at create time. When one no longer resolves on the host
-            // - a moved or renamed workspace directory, a deleted env file, a relocated cache dir - docker
-            // start fails. stderr is inherited, not captured, so do not parse the daemon error; treat any
-            // resume failure as recreate-worthy. Recreating rebinds every mount against current paths; agent
-            // memory, settings, and workspace data live in host bind mounts and cache dirs outside the
-            // container fs, so they survive. Non-interactive callers keep the hard fail.
-            if (quiet)
-                process.exit(start.status ?? 1); // Non-interactive: preserve the original silent hard fail.
-            log.warn("This container could not start - a host path it was created against has likely moved or been removed\n" +
-                "  (for example the workspace directory was renamed).");
-            const recreate = await confirm({
-                message: "Recreate it now? Your agent memory, settings, and workspace data are preserved.",
-                initialValue: true,
-            });
-            if (isCancel(recreate) || !recreate) {
-                outro("Failed to start dev container.");
-                process.exit(start.status ?? 1);
-            }
-            stopAndRemoveContainer(containerName);
-            await createAndRun();
-            return result("created");
-        }
-        return result("resumed");
-    }
-    else {
-        // --- Container running - connect ---------------------------------------------------------------------------------------------------
-        return result("connected");
-    }
-}
-/**
- * Start the web interface and confirm it really came up. The browser is where the agent runs, so a launch
- * that failed silently would leave the user with an advertised URL that never answers and no agent
- * anywhere. Nothing is started in its place: the message says what to run, and the choice is the user's.
- * `workdir` is where its sessions open - the same directory the terminal session below lands in.
- */
-async function launchWebInterface(containerName, agent, webPort, workdir) {
-    if (await startWebtermAndVerify(containerName, agent, webPort, workdir))
-        return;
-    log.warn(`Web interface: the server did not come up on port ${webPort}, so the URL in the greeting will not answer.\n` +
-        `  Run \`webterm ${agent}\` in the container to see why, or just run \`${agent}\` in the terminal.`);
-}
-export async function run(packageDir, ctx, options) {
-    const mode = options?.mode ?? "web";
-    const cwd = process.cwd();
-    const workspaceDir = ctx.workspaceRoot;
-    const containerName = ctx.containerName;
-    const cacheDir = ctx.workspaceDir;
-    const templatesDir = join(packageDir, "templates");
-    // --- Read chamba.yaml ----------------------------------------------------------------------------------------------------------------
-    const yaml = readChambaYaml(workspaceDir);
-    if (!yaml) {
-        log.error("chamba.yaml not found or invalid.");
-        process.exit(1);
-    }
-    // --- Validate and normalize ports config (rules the schema cannot express) -----------------------------------------------------------
-    let portMappings;
-    try {
-        portMappings = validatePortsConfig(yaml.ports ?? []);
-    }
-    catch (err) {
-        log.error(err instanceof Error ? err.message : String(err));
-        process.exit(1);
-    }
-    // --- Web agent interface port (sticky per-workspace assignment) ----------------------------------------------------------------------
-    // Resolved on every session: the interface has no off switch, it is where the agent runs.
-    // Pushing the mapping into portMappings is the whole wiring: publish args, the availability check,
-    // and the LABEL_PORTS recreate fingerprint all pick it up with no arg-builder changes.
-    // A session still opens without it, so every problem below drops it for this session and says why - it
-    // must never fail a session the way a chamba.yaml port does. The sticky assignment is left alone in all
-    // cases, so the next session picks the same port back up once whatever is in the way is gone.
-    const range = readWebRange();
-    // What disqualifies a candidate port: this workspace already publishes it from chamba.yaml, or
-    // something on the host holds it. Both move the sticky assignment rather than skipping the session -
-    // the port sticks to wherever it was last put, so the workspace settles on one that works instead of
-    // repeating the same conflict at every start. (A chamba.yaml entry can no longer target the
-    // container-side web port at all: validatePortsConfig reserves it.)
-    const declaredHosts = new Set(portMappings.map((m) => m.host));
-    const webPortUsableHere = async (port) => !declaredHosts.has(port) && (await webPortUsable(port, containerName));
-    const resolvedWebPort = await resolveWebPort(ctx.workspaceId, range, webPortUsableHere);
-    let webPort = null;
-    if (resolvedWebPort.ok) {
-        if (resolvedWebPort.movedFrom !== undefined) {
-            log.info(`Web interface: port ${resolvedWebPort.movedFrom} was not available - moved to ${resolvedWebPort.port} and kept there.`);
-        }
-        webPort = resolvedWebPort.port;
-        portMappings.push({ host: webPort, container: WEB_CONTAINER_PORT });
-    }
-    else if (resolvedWebPort.reason === "exhausted") {
-        log.warn(`Web interface: no free port left in ${formatWebRange(range)} - web interface skipped this session.\n` +
-            "  Widen the range in Settings > Ports.");
-    }
-    else {
-        log.warn("Web interface: the port assignment could not be recorded for this workspace - web interface skipped this session.\n" +
-            "  Check that the workspace cache dir is writable.");
-    }
-    // --- Resolve working directory -------------------------------------------------------------------------------------------------------
-    const workdir = resolveWorkdir(workspaceDir, cwd);
-    // --- Profile selection ---------------------------------------------------------------------------------------------------------------
-    const profiles = yaml.profiles ?? {};
-    const activeProfile = await selectProfile(ctx, profiles);
-    const profileConfig = profiles[activeProfile];
-    const profileHook = profileConfig?.dockerfile_hook;
-    // --- Shadow path expansion -----------------------------------------------------------------------------------------------------------
-    const shadowPatterns = yaml.shadow_paths ?? [];
-    const { paths: expandedShadows, skippedTracked } = expandShadowPatterns(shadowPatterns, workspaceDir);
-    if (expandedShadows.length > 0) {
-        log.info(`Shadow paths active: ${expandedShadows.join(", ")}  (Settings > Shadow paths)`);
-    }
-    if (skippedTracked.length > 0) {
-        log.warn(`Skipped ${skippedTracked.length} shadow path(s) tracked by git`);
-    }
-    // --- Env (env files + inline vars) ---------------------------------------------------------------------------------------------------
-    let envConfig;
-    try {
-        envConfig = validateEnvConfig(yaml.env, workspaceDir);
-    }
-    catch (err) {
-        log.error(err instanceof Error ? err.message : String(err));
-        process.exit(1);
-    }
-    for (const warning of envWarnings(envConfig)) {
-        log.warn(warning);
-    }
-    const hasGit = existsSync(join(workspaceDir, ".git"));
-    // --- Git mode (per-workspace, host-side .lock) ---------------------------------------------------------------------------------------
-    const gitMode = readGitMode(ctx.workspaceId) ?? GIT_MODE.local;
-    // --- Start container -----------------------------------------------------------------------------------------------------------------
-    const containerOpts = {
-        containerName,
-        workspaceRoot: workspaceDir,
-        cacheDir,
-        templatesDir,
-        activeProfile,
-        profileHook,
-        expandedShadows,
-        envConfig,
-        hasGit,
-        gitMode,
-        shadowPatterns,
-        workspaceName: ctx.workspaceId,
-        portMappings,
-        ...(webPort !== null && { webPort }),
-        ...(options?.noCache !== undefined && { noCache: options.noCache }),
-    };
-    let startResult = await startContainer(containerOpts);
-    // The create path re-checks the web port and drops it when something took it while the image built, so
-    // from here on the published port is the only one worth talking to.
-    webPort = startResult.webPort;
-    // --- Stale image check - prompt user to rebuild if image is outdated ------------------------------------------------------------------
-    const dockerfileContent = buildDockerfile(join(templatesDir, "Dockerfile"), profileHook);
-    const expectedBuildHash = computeBuildHash(dockerfileContent, templatesDir);
-    let stale = isImageStale(containerName, expectedBuildHash);
-    if (stale) {
-        log.warn("This container's image is out of date.\nPlease rebuild to update - this will not affect agent memory, settings, or your data.");
-        const rebuild = await confirm({
-            message: "Rebuild now? (Recommended)",
-            initialValue: true,
-        });
-        if (isCancel(rebuild)) {
-            cancel("Session cancelled.");
-            process.exit(0);
-        }
-        if (rebuild) {
-            stopAndRemoveContainer(containerName);
-            spawnSync("docker", ["rmi", containerName], { stdio: "pipe" });
-            startResult = await startContainer(containerOpts);
-            webPort = startResult.webPort;
-            stale = false;
-        }
-    }
-    // --- Published ports notice (every session start: created / resumed / connected) -----------------------------------------------------
-    // Ports are static config, so the notice derives straight from the mappings - no .lock lookup needed.
-    // The web mapping is skipped here: its URL is announced by the container greeting, where it is actionable.
-    // Matched on the container port, which validatePortsConfig reserves - so it can only ever be chamba's own
-    // web mapping, and it is skipped whether or not the port survived the create path's re-check.
-    for (const m of portMappings) {
-        if (m.container === WEB_CONTAINER_PORT)
-            continue;
-        log.info(formatPortNotice(m));
-    }
-    // --- Startup checks (AI CLI update + readiness validation) ----------------------------------------------------------------------------
-    if (!runStartup(containerName, stale)) {
-        if (stale) {
-            const connect = await confirm({
-                message: "Startup checks failed (likely due to outdated image). Connect anyway?",
-                initialValue: true,
-            });
-            if (!connect || isCancel(connect)) {
-                cancel("Session cancelled.");
-                process.exit(0);
-            }
-        }
-        else {
-            outro("Startup checks failed.");
-            process.exit(1);
-        }
-    }
-    // --- Once-per-container-start hook (web interface launch) ----------------------------------------------------------------------------
-    // Deliberately after the startup checks above: those update the AI CLIs inside the container, and the
-    // interface spawns its agent the moment it comes up. Started any earlier, the browser would get a session
-    // running the version the image was built with - a claude too old to know the current models - and the only
-    // way out would be to wait for the update and start another session. The terminal never had this problem:
-    // the login shell attaches below, after the update.
-    //
-    // Reopening the last conversation is not decided here. The container's own server does it, for the first
-    // session of a container start, reading the agent stores from the side of the mount that owns them
-    // (templates/webterm/resume.js). Which agent gets the offer is the one this workspace's web sessions start
-    // with, which is also the agent the interface is launched with.
-    const webAgent = readWebAgent(cacheDir);
-    if (startResult.status !== "connected") {
-        if (webPort !== null)
-            await launchWebInterface(containerName, webAgent, webPort, workdir);
-    }
-    else if (webPort !== null) {
-        // Connecting to a container that is already up: the interface it started with should still be
-        // serving. When it is not (crashed, or stopped by hand) the greeting would advertise a URL that
-        // does not answer, so start it again.
-        if (!(await webInterfaceAnswers(webPort))) {
-            await launchWebInterface(containerName, webAgent, webPort, workdir);
-        }
-        else {
-            // The interface has been serving since an earlier session, so the directory it was started with
-            // is that session's, not this one's. Move it, so the browser opens new sessions where this
-            // session was started from - the same promise the terminal below keeps.
-            await setWebDefaultCwd(webPort, readWebKey(containerName), workdir);
-        }
-    }
-    // --- Web mode: open the interface in the host's browser and hand the terminal back -----------------------------------------------------
-    // After the block above on every path, connect included: a healthy interface never reaches the launcher,
-    // and the browser should still open. The key is read back from the container fresh - nothing on the host
-    // stores one - and checked for shape before it becomes part of a URL handed to another program.
-    // Best-effort throughout: a host with no opener (SSH, headless) gets the URL printed instead.
-    // Nothing attaches here. The container and the interface keep running, and this process is done - the
-    // work happens in the browser, which is the whole point of the web door.
-    if (mode === "web") {
-        const key = webPort === null ? null : readWebKey(containerName);
-        if (webPort !== null && isWebKey(key)) {
-            const url = webInterfaceUrl(webPort, key);
-            if (openInBrowser(url))
-                log.info(`Web interface: opened in your browser\n  ${url}`);
-            else
-                log.info(`Web interface: open this in your browser\n  ${url}`);
-            outro("The container and the interface keep running. Run chamba again for the menu.");
-        }
-        else {
-            // No usable key or no port means no interface answered, which the block above has already
-            // reported; there is no URL worth handing out, since one without the key is refused at the door.
-            // Say so plainly rather than exiting silently - this door had one job.
-            log.warn('Web interface: there is nothing to open (see above).\n  Pick "Container shell" from the menu to work in the terminal instead.');
-            outro("The container is running.");
-        }
-        return;
-    }
-    // --- Shell mode: connect -------------------------------------------------------------------------------------------------------------
-    const exec = spawnSync("docker", loginShellExecArgs(workdir, containerName), {
-        stdio: "inherit",
-    });
-    // --- Offer to stop this workspace's container (last shell closed) --------------------------------------------------------------------
-    // The container itself keeps running (CONTAINER_KEEP_ALIVE is PID 1) after the shell exits. When this was the last
-    // shell to it, offer to stop it to free memory. Stop-only (no rm) so the next session resumes fast
-    // via the "exited" -> docker start path; all platforms.
-    // Agent sessions in the web interface are live conversations the shell scan cannot see - they run
-    // inside the container, with no host client process - and they end with the container. So when the
-    // interface reports any, the prompt says how many and defaults to keeping the container; stopping it
-    // is still offered, because those sessions may be finished ones nobody has closed yet.
-    if (containerSessionCount(containerName) === 0) {
-        // The counts are behind the interface's key, so it is read from the container first - fresh, because
-        // a new one is created at every server start and nothing on the host keeps one.
-        const webSessions = (webPort === null ? null : await webSessionInfo(webPort, readWebKey(containerName)))?.sessions ?? 0;
-        if (webSessions > 0) {
-            const count = webSessions === 1 ? "1 agent session is" : `${webSessions} agent sessions are`;
-            const them = webSessions === 1 ? "it" : "them";
-            log.warn(`Web interface: ${count} open in the browser - stopping the container ends ${them}.`);
-        }
-        const stopNow = await confirm({
-            message: "Last session to this container closed. Stop it? (resumes fast)",
-            initialValue: webSessions === 0,
-        });
-        if (!isCancel(stopNow) && stopNow) {
-            log.info("Stopping container...");
-            spawnSync("docker", ["stop", containerName], { stdio: "pipe" });
-            log.info("Container stopped.");
-        }
-    }
-    // Trailing blank line so the last log does not sit flush against the next shell prompt.
-    process.stdout.write("\n");
-    process.exit(exec.status ?? 0);
-}
+import{spawnSync as A}from"node:child_process";import{createHash as ve}from"node:crypto";import{existsSync as Le}from"node:fs";import{join as j,relative as Ce}from"node:path";import{cancel as G,confirm as O,isCancel as W,log as r,outro as E,select as Ee}from"@clack/prompts";import{buildAgentContextDocs as Se,buildAgentMountArgs as ye,injectAgentContext as Pe}from"../lib/agent-context.js";import{openInBrowser as Re}from"../lib/browser.js";import{readChambaYaml as xe}from"../lib/chamba-yaml.js";import{CONTAINER_KEEP_ALIVE as Me,CONTAINER_STARTUP as We,CONTAINER_WORKSPACE as X,DEFAULT_PROFILE as re,GIT_MODE as _e,LABEL_ENV as ie,LABEL_GIT_MODE as se,LABEL_MANAGED as Ie,LABEL_PORTS as ae,LABEL_PROFILE as ce,LABEL_RUNTIME_ENV as le,LABEL_SHADOWS as de,LABEL_TIMEZONE as ue,RUNTIME_ENV as fe,WEB_CONTAINER_PORT as pe}from"../lib/constants.js";import{buildDockerfile as me,buildImageWithTempfile as Te,computeBuildHash as Ne,isImageStale as Oe}from"../lib/dockerfile-builder.js";import{envLabel as De,envRunArgs as Be,envWarnings as He,validateEnvConfig as ze}from"../lib/env.js";import{readWebRange as Fe}from"../lib/global-config.js";import{buildPnpmStoreMountArgs as Ue}from"../lib/pnpm-store.js";import{assertHostPortsAvailable as Ve,formatPortNotice as je,formatWebRange as Ge,portEnvArgs as Ze,portPublishArgs as Ke,portsLabel as he,validatePortsConfig as Ye}from"../lib/ports.js";import{containerSessionCount as qe,loginShellExecArgs as Je}from"../lib/sessions.js";import{buildShadowMountArgs as Qe,ensureShadowsInSync as Xe,expandShadowPatterns as et}from"../lib/shadows.js";import{buildSkillsMountArgs as tt}from"../lib/skills.js";import{buildWebpaneMountArgs as nt,buildWebtermStateMountArgs as ot,isWebKey as rt,readWebAgent as it,readWebKey as ee,resolveWebPort as st,setWebDefaultCwd as at,startWebtermAndVerify as ct,webInterfaceAnswers as lt,webInterfaceUrl as ge,webPortUsable as be,webSessionInfo as dt}from"../lib/webterm.js";import{readActiveProfile as ut,readGitMode as ft,writeActiveProfile as pt}from"../lib/workspace-identity.js";function mt(n,t){return t===n?X:`${X}/${Ce(n,t)}`}async function ht(n,t){const s=Object.keys(t);if(s.length<=1)return s[0]??re;const o=ut(n.workspaceId)??re,$=await Ee({message:"Profile:",options:s.map(i=>{const f=t[i]?.description,g=i===o,m=f&&g?`${f} \xB7 current`:f??(g?"current":void 0),d={value:i,label:i};return m&&(d.hint=m),d}),initialValue:o});W($)&&(G("Cancelled."),process.exit(0));const l=$;return l!==o&&pt(n.workspaceId,l),l}function gt(n){const t=`{{.State.Status}}|{{index .Config.Labels "${de}"}}|{{index .Config.Labels "${ce}"}}|{{index .Config.Labels "${le}"}}|{{index .Config.Labels "${se}"}}|{{index .Config.Labels "${ue}"}}|{{index .Config.Labels "${ae}"}}|{{index .Config.Labels "${ie}"}}`,s=A("docker",["inspect","--format",t,n],{encoding:"utf8",stdio:"pipe"});if(s.status!==0)return null;const o=y=>y==="<no value>"?"":y,[$="",l="",i="",f="",g="",m="",d="",S=""]=s.stdout.trim().split("|");return{status:$,shadowLabel:o(l),profileLabel:o(i),runtimeEnvLabel:o(f),gitModeLabel:o(g),timezoneLabel:o(m),portsLabel:o(d),envLabel:o(S)}}function we(n){return n.length===0?"":[...n].sort().join(",")}const bt=/^[A-Za-z][A-Za-z0-9_+-]*(\/[A-Za-z0-9_+-]+){1,2}$/;function wt(){let n;try{n=Intl.DateTimeFormat().resolvedOptions().timeZone}catch{return null}return typeof n!="string"||!bt.test(n)||n==="UTC"||n==="Etc/UTC"?null:n}function Ae(){const n=Object.entries(fe);if(n.length===0)return"";const t=n.map(([s,o])=>`${s}=${o}`).sort().join(",");return ve("sha256").update(t).digest("hex").slice(0,12)}function te(n){A("docker",["stop",n],{stdio:"pipe"}),A("docker",["rm",n],{stdio:"pipe"})}function At(n,t){return A("docker",["exec","-u","root",...t?[]:["-i","-t"],n,"node",We,"--summary"],{stdio:t?"pipe":"inherit"}).status===0}async function $e(n){const{containerName:t,workspaceRoot:s,cacheDir:o,templatesDir:$,activeProfile:l,profileHook:i,expandedShadows:f,envConfig:g,hasGit:m,gitMode:d,shadowPatterns:S,workspaceName:y,portMappings:_,webPort:h,noCache:a,quiet:c=!1}=n,D=c?"pipe":["ignore","ignore","inherit"],B=he(_),Z=De(g),H=Qe(o,f),z=Se(m,S,d),I=Be(g),F=ye(o),T=tt(o),K=Ue(o),Y=ot(o),U=nt(o),P=["-v",`${s}:${X}`,...H,...F,...T,...K,...Y,...U],C=wt(),q=["--label",`${Ie}=true`,"--label",`${de}=${we(f)}`,"--label",`${ce}=${l}`,"--label",`${le}=${Ae()}`,"--label",`${se}=${d}`,"--label",`${ue}=${C??""}`],R=[...Object.entries(fe).flatMap(([p,b])=>["-e",`${p}=${b}`]),...C===null?[]:["-e",`TZ=${C}`],"-e",`CHAMBA_WORKSPACE=${y}`,"-e",`CHAMBA_GIT_MODE=${d}`],u=gt(t);let N=u?.status??null;if(u!==null){const p=we(f),b=u.shadowLabel!==p,w=u.profileLabel!==l,J=u.runtimeEnvLabel!==Ae(),V=u.gitModeLabel!==d,Q=u.timezoneLabel!==(C??""),M=u.portsLabel!==B,L=u.envLabel!==Z;if(b||w||J||V||Q||M||L){let v;w?v=`Profile changed (${u.profileLabel} -> ${l})`:b?v="Shadow paths changed":V?v=`Git mode changed (${u.gitModeLabel||"<unset>"} -> ${d})`:Q?v=`Timezone changed (${u.timezoneLabel||"<unset>"} -> ${C??"<unset>"})`:M?v="Ports changed":L?v="Environment variables changed":v="Runtime environment updated";const ne=!c&&u.status==="running";if(ne){r.warn(`${v} - applying this needs to recreate the running container, which stops any open sessions.
+Agent memory, settings, and workspace data are preserved.`);const oe=await O({message:"Recreate the container now?",initialValue:!0});(W(oe)||!oe)&&(G("Session cancelled - container left running."),process.exit(0))}te(t),N=null,w&&A("docker",["rmi",t],{stdio:"pipe"}),!c&&!ne&&r.info(`${v} - ${w?"rebuilding":"recreating container"}...`)}}Xe(o,f,s),Pe(o,z);let e=h;const k=async()=>{const p=me(j($,"Dockerfile"),i),b=await Te(p,$,t,a,c);b.status!==0&&(c||E("Failed to build container image."),process.exit(b.status));let w=_;h!==void 0&&!await be(h,t)&&(c||r.warn(`Web interface: host port ${h} was taken before the container could start - continuing without it.`),w=_.filter(L=>L.host!==h),e=void 0);try{await Ve(w,e)}catch(L){c||E(L instanceof Error?L.message:String(L)),process.exit(1)}c||r.info("Starting dev container...");const J=e!==void 0?["-e",`CHAMBA_WEB_URL=${ge(e,null)}`]:[],V=["run","-d","--name",t,...P,...I,...R,...J,...Ze(w),...Ke(w),"--security-opt","no-new-privileges:true",...q,"--label",`${ae}=${he(w)}`,"--label",`${ie}=${Z}`,t,...Me],M=A("docker",V,{stdio:c?"pipe":["ignore","ignore","pipe"]});M.status!==0&&(c||(process.stderr.write(M.stderr?.toString()??""),E("Failed to start dev container.")),process.exit(M.status??1))},x=p=>({status:p,webPort:e??null});if(N===null)return await k(),x("created");if(N==="exited"){c||r.info("Resuming dev container...");const p=A("docker",["start",t],{stdio:D});if(p.status!==0){c&&process.exit(p.status??1),r.warn(`This container could not start - a host path it was created against has likely moved or been removed
+  (for example the workspace directory was renamed).`);const b=await O({message:"Recreate it now? Your agent memory, settings, and workspace data are preserved.",initialValue:!0});return(W(b)||!b)&&(E("Failed to start dev container."),process.exit(p.status??1)),te(t),await k(),x("created")}return x("resumed")}else return x("connected")}async function ke(n,t,s,o){await ct(n,t,s,o)||r.warn(`Web interface: the server did not come up on port ${s}, so the URL in the greeting will not answer.
+  Run \`webterm ${t}\` in the container to see why, or just run \`${t}\` in the terminal.`)}async function Bt(n,t,s){const o=s?.mode??"web",$=process.cwd(),l=t.workspaceRoot,i=t.containerName,f=t.workspaceDir,g=j(n,"templates"),m=xe(l);m||(r.error("chamba.yaml not found or invalid."),process.exit(1));let d;try{d=Ye(m.ports??[])}catch(e){r.error(e instanceof Error?e.message:String(e)),process.exit(1)}const S=Fe(),y=new Set(d.map(e=>e.host)),_=async e=>!y.has(e)&&await be(e,i),h=await st(t.workspaceId,S,_);let a=null;h.ok?(h.movedFrom!==void 0&&r.info(`Web interface: port ${h.movedFrom} was not available - moved to ${h.port} and kept there.`),a=h.port,d.push({host:a,container:pe})):h.reason==="exhausted"?r.warn(`Web interface: no free port left in ${Ge(S)} - web interface skipped this session.
+  Widen the range in Settings > Ports.`):r.warn(`Web interface: the port assignment could not be recorded for this workspace - web interface skipped this session.
+  Check that the workspace cache dir is writable.`);const c=mt(l,$),D=m.profiles??{},B=await ht(t,D),H=D[B]?.dockerfile_hook,z=m.shadow_paths??[],{paths:I,skippedTracked:F}=et(z,l);I.length>0&&r.info(`Shadow paths active: ${I.join(", ")}  (Settings > Shadow paths)`),F.length>0&&r.warn(`Skipped ${F.length} shadow path(s) tracked by git`);let T;try{T=ze(m.env,l)}catch(e){r.error(e instanceof Error?e.message:String(e)),process.exit(1)}for(const e of He(T))r.warn(e);const K=Le(j(l,".git")),Y=ft(t.workspaceId)??_e.local,U={containerName:i,workspaceRoot:l,cacheDir:f,templatesDir:g,activeProfile:B,profileHook:H,expandedShadows:I,envConfig:T,hasGit:K,gitMode:Y,shadowPatterns:z,workspaceName:t.workspaceId,portMappings:d,...a!==null&&{webPort:a},...s?.noCache!==void 0&&{noCache:s.noCache}};let P=await $e(U);a=P.webPort;const C=me(j(g,"Dockerfile"),H),q=Ne(C,g);let R=Oe(i,q);if(R){r.warn(`This container's image is out of date.
+Please rebuild to update - this will not affect agent memory, settings, or your data.`);const e=await O({message:"Rebuild now? (Recommended)",initialValue:!0});W(e)&&(G("Session cancelled."),process.exit(0)),e&&(te(i),A("docker",["rmi",i],{stdio:"pipe"}),P=await $e(U),a=P.webPort,R=!1)}for(const e of d)e.container!==pe&&r.info(je(e));if(!At(i,R))if(R){const e=await O({message:"Startup checks failed (likely due to outdated image). Connect anyway?",initialValue:!0});(!e||W(e))&&(G("Session cancelled."),process.exit(0))}else E("Startup checks failed."),process.exit(1);const u=it(f);if(P.status!=="connected"?a!==null&&await ke(i,u,a,c):a!==null&&(await lt(a)?await at(a,ee(i),c):await ke(i,u,a,c)),o==="web"){const e=a===null?null:ee(i);if(a!==null&&rt(e)){const k=ge(a,e);Re(k)?r.info(`Web interface: opened in your browser
+  ${k}`):r.info(`Web interface: open this in your browser
+  ${k}`),E("The container and the interface keep running. Run chamba again for the menu.")}else r.warn(`Web interface: there is nothing to open (see above).
+  Pick "Container shell" from the menu to work in the terminal instead.`),E("The container is running.");return}const N=A("docker",Je(c,i),{stdio:"inherit"});if(qe(i)===0){const e=(a===null?null:await dt(a,ee(i)))?.sessions??0;if(e>0){const x=e===1?"1 agent session is":`${e} agent sessions are`,p=e===1?"it":"them";r.warn(`Web interface: ${x} open in the browser - stopping the container ends ${p}.`)}const k=await O({message:"Last session to this container closed. Stop it? (resumes fast)",initialValue:e===0});!W(k)&&k&&(r.info("Stopping container..."),A("docker",["stop",i],{stdio:"pipe"}),r.info("Container stopped."))}process.stdout.write(`
+`),process.exit(N.status??0)}export{wt as hostTimezone,mt as resolveWorkdir,Bt as run,$e as startContainer};