chamba 0.7.0 → 0.8.0

package/dist/lib/dockerfile-builder.js

@@ -1,268 +1,48 @@
-// =========================================================================================================================================
-// src/lib/dockerfile-builder.ts - In-memory Dockerfile assembly and temp-file build
-// Combines base template + profile hook + USER instruction at build time
-// =========================================================================================================================================
-import { spawn, spawnSync } from "node:child_process";
-import { createHash, randomBytes } from "node:crypto";
-import { existsSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { spinner } from "@clack/prompts";
-import { CONTAINER_HOME, CONTAINER_NAME_PREFIX, CONTAINER_STARTUP, CONTAINER_USER, LABEL_BUILD_HASH, LABEL_MANAGED, WEB_KEY_FILE_PATH, } from "./constants.js";
-// --- User shell config appended after USER instruction -----------------------------------------------------------------------------------
-const USER_SHELL_CONFIG = `
+import{spawn as k,spawnSync as w}from"node:child_process";import{createHash as B,randomBytes as M}from"node:crypto";import{existsSync as N,readdirSync as C,readFileSync as d,unlinkSync as I,writeFileSync as P}from"node:fs";import{tmpdir as x}from"node:os";import{join as u}from"node:path";import{spinner as U}from"@clack/prompts";import{CONTAINER_HOME as s,CONTAINER_NAME_PREFIX as H,CONTAINER_STARTUP as O,CONTAINER_USER as D,LABEL_BUILD_HASH as g,LABEL_MANAGED as W,WEB_KEY_FILE_PATH as E}from"./constants.js";const F=`
 # ---------------------------------------------------------------------------
 # User shell config (PATH, prompt, welcome message, status alias)
 # ---------------------------------------------------------------------------
-ENV PATH="${CONTAINER_HOME}/.cargo/bin:${CONTAINER_HOME}/.bun/bin:${CONTAINER_HOME}/.local/bin:/usr/local/go/bin:\${PATH}"
+ENV PATH="${s}/.cargo/bin:${s}/.bun/bin:${s}/.local/bin:/usr/local/go/bin:\${PATH}"
 # Prompt helper: print the working directory relative to the workspace root, so /workspace shows as
 # "/" and /workspace/src shows as "/src". Paths outside the workspace fall back to their full path.
-RUN echo '__chamba_pwd() { local p="\${PWD#/workspace}"; printf "/%s" "\${p#/}"; }' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '# The web interface URL, key and all. The key is minted by the webterm server at every start and' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '# published to the key file, so the greeting reads it back instead of holding a URL that goes stale.' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '__chamba_web_url() { if [ -r ${WEB_KEY_FILE_PATH} ]; then echo "\${CHAMBA_WEB_URL}/?k=$(head -n 1 ${WEB_KEY_FILE_PATH})"; else echo "\${CHAMBA_WEB_URL}"; fi; }' \\
-        >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'export PS1="\\[\\033[01;32m\\][chamba@\${CHAMBA_WORKSPACE}]\\[\\033[00m\\] \\[\\033[01;34m\\]\\$(__chamba_pwd)\\[\\033[00m\\] \\[\\033[01;32m\\]❯\\[\\033[00m\\] "' \\
-        >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'echo ""' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'echo -e "\\033[32m●\\033[0m  \\033[1mYou'"'"'re now in a chamba sandbox\\033[0m \\033[90m·\\033[0m \\033[1m\${CHAMBA_WORKSPACE}\\033[0m"' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'echo ""' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'echo -e "   \\033[90m▸ Run \\033[38;5;208mclaude\\033[90m, \\033[38;5;208mopencode\\033[90m, or \\033[38;5;208mcodex\\033[90m to start an agent.\\033[0m"' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'echo -e "   \\033[90m▸ Run \\033[97mstatus\\033[90m to see container details & installed versions.\\033[0m"' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'echo -e "   \\033[90m▸ Run \\033[97mexit\\033[90m to end the session and return to the host.\\033[0m"' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'echo ""' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '# The web interface, where the agents usually run. CHAMBA_WEB_URL is injected by docker run whenever' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '# a host port could be published for it, so its absence means this session has no web address.' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '# The URL gets its own line: on a host that could not open a browser, this banner is how it is found.' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'if [ -n "$CHAMBA_WEB_URL" ]; then' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '    echo -e "\\033[32m●\\033[0m  \\033[90mThe web interface for this workspace:\\033[0m"' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '    echo ""' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '    echo -e "   \\033[97m$(__chamba_web_url)\\033[0m"' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo '    echo ""' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'fi' >> ${CONTAINER_HOME}/.bashrc && \\
-    echo 'alias status="node ${CONTAINER_STARTUP}"' >> ${CONTAINER_HOME}/.bashrc
+RUN echo '__chamba_pwd() { local p="\${PWD#/workspace}"; printf "/%s" "\${p#/}"; }' >> ${s}/.bashrc && \\
+    echo '# The web interface URL, key and all. The key is minted by the webterm server at every start and' >> ${s}/.bashrc && \\
+    echo '# published to the key file, so the greeting reads it back instead of holding a URL that goes stale.' >> ${s}/.bashrc && \\
+    echo '__chamba_web_url() { if [ -r ${E} ]; then echo "\${CHAMBA_WEB_URL}/?k=$(head -n 1 ${E})"; else echo "\${CHAMBA_WEB_URL}"; fi; }' \\
+        >> ${s}/.bashrc && \\
+    echo 'export PS1="\\[\\033[01;32m\\][chamba@\${CHAMBA_WORKSPACE}]\\[\\033[00m\\] \\[\\033[01;34m\\]\\$(__chamba_pwd)\\[\\033[00m\\] \\[\\033[01;32m\\]\u276F\\[\\033[00m\\] "' \\
+        >> ${s}/.bashrc && \\
+    echo 'echo ""' >> ${s}/.bashrc && \\
+    echo 'echo -e "\\033[32m\u25CF\\033[0m  \\033[1mYou'"'"'re now in a chamba sandbox\\033[0m \\033[90m\xB7\\033[0m \\033[1m\${CHAMBA_WORKSPACE}\\033[0m"' >> ${s}/.bashrc && \\
+    echo 'echo ""' >> ${s}/.bashrc && \\
+    echo 'echo -e "   \\033[90m\u25B8 Run \\033[38;5;208mclaude\\033[90m, \\033[38;5;208mopencode\\033[90m, or \\033[38;5;208mcodex\\033[90m to start an agent.\\033[0m"' >> ${s}/.bashrc && \\
+    echo 'echo -e "   \\033[90m\u25B8 Run \\033[97mstatus\\033[90m to see container details & installed versions.\\033[0m"' >> ${s}/.bashrc && \\
+    echo 'echo -e "   \\033[90m\u25B8 Run \\033[97mexit\\033[90m to end the session and return to the host.\\033[0m"' >> ${s}/.bashrc && \\
+    echo 'echo ""' >> ${s}/.bashrc && \\
+    echo '# The web interface, where the agents usually run. CHAMBA_WEB_URL is injected by docker run whenever' >> ${s}/.bashrc && \\
+    echo '# a host port could be published for it, so its absence means this session has no web address.' >> ${s}/.bashrc && \\
+    echo '# The URL gets its own line: on a host that could not open a browser, this banner is how it is found.' >> ${s}/.bashrc && \\
+    echo 'if [ -n "$CHAMBA_WEB_URL" ]; then' >> ${s}/.bashrc && \\
+    echo '    echo -e "\\033[32m\u25CF\\033[0m  \\033[90mThe web interface for this workspace:\\033[0m"' >> ${s}/.bashrc && \\
+    echo '    echo ""' >> ${s}/.bashrc && \\
+    echo '    echo -e "   \\033[97m$(__chamba_web_url)\\033[0m"' >> ${s}/.bashrc && \\
+    echo '    echo ""' >> ${s}/.bashrc && \\
+    echo 'fi' >> ${s}/.bashrc && \\
+    echo 'alias status="node ${O}"' >> ${s}/.bashrc
 
 CMD ["/bin/bash"]
-`;
-// --- Build Dockerfile content ------------------------------------------------------------------------------------------------------------
-/**
- * Assemble a Dockerfile from the base template, optional profile hook, and USER instruction.
- * The resulting Dockerfile is never persisted - it's written to a temp file at build time.
- */
-export function buildDockerfile(baseTemplatePath, profileHook) {
-    let content = readFileSync(baseTemplatePath, "utf8");
-    // Append profile hook if provided
-    if (profileHook?.trim()) {
-        content += `\n# ---------------------------------------------------------------------------\n`;
-        content += `# Profile hook (from chamba.yaml)\n`;
-        content += `# ---------------------------------------------------------------------------\n`;
-        content += profileHook.endsWith("\n") ? profileHook : `${profileHook}\n`;
-    }
-    // USER must come after profile hook and before shell config
-    content += `\nUSER ${CONTAINER_USER}\n`;
-    content += USER_SHELL_CONFIG;
-    return content;
-}
-// --- Build hash for image staleness detection --------------------------------------------------------------------------------------------
-// Filenames (relative to the templates dir) of every artifact that the Dockerfile bakes into the image
-// via COPY. Edits to any of these change the build hash and trigger a rebuild prompt at session start.
-// Kept in sync with templates/Dockerfile by the bidirectional test in tests/dockerfile-builder.test.ts.
-export const BAKED_TEMPLATE_FILES = [
-    "claude-statusline.sh",
-    "context-usage.sh",
-    "git-readonly-wrapper.mjs",
-    "npmrc",
-    "pnpm-config.yaml",
-    "runtime-constants.mjs",
-    "specs.sh",
-    "startup-git-mode.mjs",
-    "startup.mjs",
-    "webpane.sh",
-    "webterm.sh",
-];
-// Directories (relative to the templates dir) baked into the image via a directory COPY. Hashed
-// recursively by computeBuildHash so editing any file inside triggers a rebuild prompt, with
-// node_modules skipped - a local install there must never flip the hash (it is .dockerignore'd too).
-export const BAKED_TEMPLATE_DIRS = ["pane-apps", "webterm"];
-// Relative paths of every regular file under dir (sorted, node_modules subtrees skipped). Missing
-// dirs yield [] for the same reason computeBuildHash tolerates missing files: minimal test contexts.
-function walkTemplateDir(root, prefix = "") {
-    const files = [];
-    let entries;
-    try {
-        entries = readdirSync(root, { withFileTypes: true });
-    }
-    catch {
-        return files;
-    }
-    for (const entry of entries) {
-        if (entry.name === "node_modules")
-            continue;
-        const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-        if (entry.isDirectory())
-            files.push(...walkTemplateDir(join(root, entry.name), rel));
-        else if (entry.isFile())
-            files.push(rel);
-    }
-    return files.sort();
-}
-/**
- * Fingerprint everything the package contributes to the image: the assembled Dockerfile content
- * plus every file in BAKED_TEMPLATE_FILES, hashed in deterministic order.
- *
- * Tolerates missing files in buildContextDir. In production (real package install) all baked files
- * exist, so the existsSync branch never fires. In tests that build minimal images from a temp
- * contextDir, missing files naturally produce a different hash than production - exactly the
- * contract the staleness tests rely on.
- */
-export function computeBuildHash(dockerfileContent, buildContextDir) {
-    const h = createHash("sha256");
-    h.update("dockerfile:\n");
-    h.update(dockerfileContent);
-    for (const name of [...BAKED_TEMPLATE_FILES].sort()) {
-        h.update(`\nfile:${name}\n`);
-        const path = join(buildContextDir, name);
-        if (existsSync(path)) {
-            h.update(readFileSync(path));
-        }
-    }
-    for (const dir of [...BAKED_TEMPLATE_DIRS].sort()) {
-        for (const rel of walkTemplateDir(join(buildContextDir, dir))) {
-            h.update(`\nfile:${dir}/${rel}\n`);
-            h.update(readFileSync(join(buildContextDir, dir, rel)));
-        }
-    }
-    return h.digest("hex");
-}
-// --- Image staleness detection -----------------------------------------------------------------------------------------------------------
-//
-// Called at session start; returns true if the running container's image is older than the current
-// package and needs a rebuild prompt.
-//
-// Mechanism: at build time, buildImageWithTempfile below stamps every image with a chamba.build-hash
-// label carrying computeBuildHash's fingerprint of the assembled Dockerfile + every baked template
-// file. At session start we recompute the expected hash from current package sources and compare.
-// Any change to templates/Dockerfile, the active profile hook, or any baked template file produces a
-// different hash -> rebuild prompt fires.
-//
-// When shipping a new bake-time artifact:
-//   - Editing an existing template file or the Dockerfile -> auto-detected. No action.
-//   - Adding a NEW templated COPY -> add the filename to BAKED_TEMPLATE_FILES above. The unit test in
-//     tests/dockerfile-builder.test.ts will fail until you do.
-//
-// Cosmetic Dockerfile edits (comment-only, whitespace) DO trigger a rebuild for users on prior
-// images. This is intentional: the Dockerfile and template files are rarely edited, so any change
-// is treated as meaningful. A cosmetic edit here costs every user a rebuild, so it is worth asking
-// whether the change is worth making at all.
-/** Returns true if the container's stamped chamba.build-hash label does not match the expected hash. */
-export function isImageStale(containerName, expectedBuildHash) {
-    const result = spawnSync("docker", ["inspect", "--format", `{{ index .Config.Labels "${LABEL_BUILD_HASH}" }}`, containerName], {
-        encoding: "utf8",
-        stdio: "pipe",
-    });
-    if (result.status !== 0)
-        return true;
-    return result.stdout.trim() !== expectedBuildHash;
-}
-// --- Build image with temp file ----------------------------------------------------------------------------------------------------------
-// Grey ANSI for the inline build percentage on the spinner line.
-const grey = (s) => `\x1b[90m${s}\x1b[0m`;
-/**
- * Run docker build behind a single clack spinner for interactive sessions.
- * All raw buildx output is captured, never streamed. BuildKit "[ n/N ]" step markers (from
- * --progress=plain) are parsed into a grey percentage on the spinner line when available; if nothing
- * parses, the spinner just keeps animating with the plain text. The captured log is written to stderr
- * only on failure, so a broken build stays diagnosable.
- */
-function runBuildWithSpinner(buildArgs) {
-    return new Promise((resolve) => {
-        const s = spinner();
-        const baseMessage = "Docker rebuilding container..";
-        s.start(baseMessage);
-        let captured = "";
-        let lastStep = 0;
-        let totalSteps = 0;
-        const onData = (chunk) => {
-            const text = chunk.toString();
-            captured += text;
-            try {
-                for (const m of text.matchAll(/\[\s*(\d+)\/(\d+)\]/g)) {
-                    const cur = Number(m[1]);
-                    const total = Number(m[2]);
-                    if (total > 0)
-                        totalSteps = total;
-                    if (cur > lastStep)
-                        lastStep = cur;
-                }
-                if (totalSteps > 0) {
-                    const pct = Math.min(100, Math.round((lastStep / totalSteps) * 100));
-                    s.message(`${baseMessage}  ${grey(`${pct}%`)}`);
-                }
-            }
-            catch {
-                // Parsing must never affect the build; fall back to the plain animated spinner.
-            }
-        };
-        const child = spawn("docker", buildArgs, { stdio: ["ignore", "pipe", "pipe"] });
-        child.stdout?.on("data", onData);
-        child.stderr?.on("data", onData);
-        child.on("error", (err) => {
-            s.stop("Docker build failed");
-            process.stderr.write(`${err.message}\n`);
-            resolve({ status: 1 });
-        });
-        child.on("close", (code) => {
-            const status = code ?? 1;
-            if (status === 0) {
-                s.stop("Container image ready");
-            }
-            else {
-                s.stop("Docker build failed");
-                process.stderr.write(captured);
-            }
-            resolve({ status });
-        });
-    });
-}
-/**
- * Write Dockerfile content to a temp file, run docker build, then clean up.
- * Build context is always the templates directory so COPY instructions resolve correctly.
- * Quiet mode (tests) runs synchronously with captured output; interactive mode shows a spinner.
- */
-export async function buildImageWithTempfile(dockerfileContent, buildContextDir, imageName, noCache = false, quiet = false) {
-    const tmpFile = join(tmpdir(), `${CONTAINER_NAME_PREFIX}Dockerfile-${randomBytes(8).toString("hex")}`);
-    try {
-        writeFileSync(tmpFile, dockerfileContent);
-        const buildHash = computeBuildHash(dockerfileContent, buildContextDir);
-        const buildArgs = [
-            "build",
-            "--label",
-            `${LABEL_MANAGED}=true`,
-            "--label",
-            `${LABEL_BUILD_HASH}=${buildHash}`,
-            "-f",
-            tmpFile,
-            "-t",
-            imageName,
-        ];
-        if (noCache)
-            buildArgs.push("--no-cache");
-        // Quiet mode (tests): synchronous, output captured, no spinner.
-        if (quiet) {
-            buildArgs.push(buildContextDir);
-            const result = spawnSync("docker", buildArgs, { stdio: "pipe" });
-            return { status: result.status ?? 1 };
-        }
-        // Interactive mode: line-oriented progress so step markers are parseable, hidden behind a spinner.
-        buildArgs.push("--progress=plain", buildContextDir);
-        return await runBuildWithSpinner(buildArgs);
-    }
-    finally {
-        try {
-            unlinkSync(tmpFile);
-        }
-        catch {
-            // temp file cleanup is best-effort
-        }
-    }
-}
+`;function ne(o,t){let e=d(o,"utf8");return t?.trim()&&(e+=`
+# ---------------------------------------------------------------------------
+`,e+=`# Profile hook (from chamba.yaml)
+`,e+=`# ---------------------------------------------------------------------------
+`,e+=t.endsWith(`
+`)?t:`${t}
+`),e+=`
+USER ${D}
+`,e+=F,e}const j=["claude-statusline.sh","git-readonly-wrapper.mjs","npmrc","pnpm-config.yaml","runtime-constants.mjs","startup-git-mode.mjs","startup.mjs","tool-helper.sh","webpane.sh","webterm.sh"],K=["pane-apps","webterm"];function y(o,t=""){const e=[];let r;try{r=C(o,{withFileTypes:!0})}catch{return e}for(const n of r){if(n.name==="node_modules")continue;const a=t?`${t}/${n.name}`:n.name;n.isDirectory()?e.push(...y(u(o,n.name),a)):n.isFile()&&e.push(a)}return e.sort()}function v(o,t){const e=B("sha256");e.update(`dockerfile:
+`),e.update(o);for(const r of[...j].sort()){e.update(`
+file:${r}
+`);const n=u(t,r);N(n)&&e.update(d(n))}for(const r of[...K].sort())for(const n of y(u(t,r)))e.update(`
+file:${r}/${n}
+`),e.update(d(u(t,r,n)));return e.digest("hex")}function re(o,t){const e=w("docker",["inspect","--format",`{{ index .Config.Labels "${g}" }}`,o],{encoding:"utf8",stdio:"pipe"});return e.status!==0?!0:e.stdout.trim()!==t}const G=new RegExp("\x1B\\[[0-9;]*m","g"),R=o=>`\x1B[90m${o}\x1B[0m`,T=60,X=8,Y=14;function L(o,t){return t<3?"":o.length>t?`${o.slice(0,t-2)}..`:o}function V(o,t){const e=o.replace(G,"").split(/[\r\n]/).map(r=>r.replace(/^#\d+\s+(\d+\.\d+\s+)?/,"").replace(/[^\x20-\x7e]+/g," ").replace(/\s+/g," ").trim()).filter(Boolean);return L(e.at(-1)??"",t)}function q(o,t,e,r){const n=r-1-Y;let a=o,i=o.length;t!==""&&i+2+t.length<=n&&(a+=`  ${R(t)}`,i+=2+t.length);const c=Math.min(n-i-2,T);if(e!==""&&c>=X){const h=L(e,c);h!==""&&(a+=`  ${R(h)}`)}return a}function z(o){return new Promise(t=>{const e=U({indicator:"timer"}),r="Docker rebuilding container",n=process.stdout.columns??80;e.start(r);let a="",i=0,c=0,h="";const f=m=>{const l=m.toString();a+=l;try{for(const $ of l.matchAll(/\[\s*(\d+)\/(\d+)\]/g)){const _=Number($[1]),A=Number($[2]);A>0&&(c=A),_>i&&(i=_)}const b=c>0?`${Math.min(100,Math.round(i/c*100))}%`:"";if(h=V(l,T)||h,b===""&&h==="")return;const S=Math.min(n,process.stdout.columns??80);e.message(q(r,b,h,S))}catch{}},p=k("docker",o,{stdio:["ignore","pipe","pipe"]});p.stdout?.on("data",f),p.stderr?.on("data",f),p.on("error",m=>{e.stop("Docker build failed"),process.stderr.write(`${m.message}
+`),t({status:1})}),p.on("close",m=>{const l=m??1;l===0?e.stop("Container image ready"):(e.stop("Docker build failed"),process.stderr.write(a)),t({status:l})})})}async function ae(o,t,e,r=!1,n=!1){const a=u(x(),`${H}Dockerfile-${M(8).toString("hex")}`);try{P(a,o);const i=v(o,t),c=["build","--label",`${W}=true`,"--label",`${g}=${i}`,"-f",a,"-t",e];return r&&c.push("--no-cache"),n?(c.push(t),{status:w("docker",c,{stdio:"pipe"}).status??1}):(c.push("--progress=plain",t),await z(c))}finally{try{I(a)}catch{}}}export{K as BAKED_TEMPLATE_DIRS,j as BAKED_TEMPLATE_FILES,ne as buildDockerfile,ae as buildImageWithTempfile,V as buildTailLine,v as computeBuildHash,re as isImageStale,q as spinnerLine};

package/dist/lib/env.js

@@ -1,78 +1,2 @@
-// =========================================================================================================================================
-// src/lib/env.ts - Resolve the `env` field into container environment injection (files + inline vars)
-// An `env` entry is either an env-file path (no '=') loaded via --env-file, or an inline KEY=VALUE injected via -e.
-// Config is the source of truth: a hashed label over inline vars + resolved file contents recreates the container on change.
-// =========================================================================================================================================
-import { createHash } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-// --- Constants ---------------------------------------------------------------------------------------------------------------------------
-// Inline var keys must be valid shell env identifiers - the same pattern the `ports` env field uses.
-const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-// --- Config validation and normalization -------------------------------------------------------------------------------------------------
-/**
- * Validate and normalize the raw `env` field into inline vars and file entries. This is the single source of
- * truth for env semantics (unit-testable without the JSON Schema). A scalar or undefined is normalized to an
- * array; entries are trimmed and empties dropped. Classification is by presence of '=': an entry with '=' is
- * an inline KEY=VALUE var; an entry without '=' is an env-file path resolved relative to the workspace dir.
- * Throws on the first malformed inline entry with a clear message. Missing files never throw - they are
- * flagged exists:false and warned about at startup rather than failing the session.
- */
-export function validateEnvConfig(raw, workspaceDir) {
-    const entries = (Array.isArray(raw) ? raw : raw === undefined ? [] : [raw]).map((e) => e.trim()).filter((e) => e.length > 0);
-    const inlineVars = [];
-    const files = [];
-    for (const entry of entries) {
-        const eq = entry.indexOf("=");
-        if (eq === -1) {
-            // No '=' -> file path, resolved relative to the workspace dir.
-            const path = join(workspaceDir, entry);
-            files.push({ path, exists: existsSync(path) });
-        }
-        else {
-            // Has '=' -> inline KEY=VALUE. The key must be a valid env identifier; the value may be empty or contain further '='.
-            const key = entry.slice(0, eq);
-            if (!ENV_KEY_PATTERN.test(key)) {
-                throw new Error(`env: invalid variable "${entry}" - the key must match ${ENV_KEY_PATTERN.source} (e.g. FOO=bar).`);
-            }
-            inlineVars.push(entry);
-        }
-    }
-    return { inlineVars, files };
-}
-// --- Docker argument builders (pure) -----------------------------------------------------------------------------------------------------
-/**
- * Docker run args for env injection: --env-file for each existing file (missing files omitted), then
- * -e KEY=VALUE per inline var. Files come first so an inline var wins a duplicate key - docker applies later
- * -e over an earlier --env-file - which lets a chamba.yaml inline var override a value from an env file.
- */
-export function envRunArgs(cfg) {
-    const fileArgs = cfg.files.filter((f) => f.exists).flatMap((f) => ["--env-file", f.path]);
-    const inlineArgs = cfg.inlineVars.flatMap((v) => ["-e", v]);
-    return [...fileArgs, ...inlineArgs];
-}
-/** One warning line per missing env file. A missing file is skipped, never fatal. */
-export function envWarnings(cfg) {
-    return cfg.files.filter((f) => !f.exists).map((f) => `env "${f.path}" not found - skipping`);
-}
-// --- Fingerprint -------------------------------------------------------------------------------------------------------------------------
-/**
- * Deterministic fingerprint over the resolved env config, used as the container LABEL_ENV. Covers each inline
- * KEY=VALUE and, for each existing file, its path plus contents - so editing an inline var, editing a file's
- * contents, or repointing at a different file recreates the container on the next session. An empty config
- * (no inline vars and no existing files) fingerprints to "" so an env-less workspace never recreates on
- * account of this label. Hashed so no secret values leak into docker labels (which are visible via inspect).
- */
-export function envLabel(cfg) {
-    if (cfg.inlineVars.length === 0 && cfg.files.every((f) => !f.exists))
-        return "";
-    const parts = [];
-    for (const v of cfg.inlineVars)
-        parts.push(`e:${v}`);
-    for (const f of cfg.files) {
-        if (!f.exists)
-            continue;
-        parts.push(`f:${f.path}\n${readFileSync(f.path, "utf8")}`);
-    }
-    return createHash("sha256").update(parts.join("\0")).digest("hex").slice(0, 12);
-}
+import{createHash as l}from"node:crypto";import{existsSync as p,readFileSync as c}from"node:fs";import{join as u}from"node:path";const a=/^[A-Za-z_][A-Za-z0-9_]*$/;function m(e,n){const t=(Array.isArray(e)?e:e===void 0?[]:[e]).map(i=>i.trim()).filter(i=>i.length>0),s=[],o=[];for(const i of t){const f=i.indexOf("=");if(f===-1){const r=u(n,i);o.push({path:r,exists:p(r)})}else{const r=i.slice(0,f);if(!a.test(r))throw new Error(`env: invalid variable "${i}" - the key must match ${a.source} (e.g. FOO=bar).`);s.push(i)}}return{inlineVars:s,files:o}}function d(e){const n=e.files.filter(s=>s.exists).flatMap(s=>["--env-file",s.path]),t=e.inlineVars.flatMap(s=>["-e",s]);return[...n,...t]}function y(e){return e.files.filter(n=>!n.exists).map(n=>`env "${n.path}" not found - skipping`)}function A(e){if(e.inlineVars.length===0&&e.files.every(t=>!t.exists))return"";const n=[];for(const t of e.inlineVars)n.push(`e:${t}`);for(const t of e.files)t.exists&&n.push(`f:${t.path}
+${c(t.path,"utf8")}`);return l("sha256").update(n.join("\0")).digest("hex").slice(0,12)}export{A as envLabel,d as envRunArgs,y as envWarnings,m as validateEnvConfig};

package/dist/lib/git-env.js

@@ -1,21 +1 @@
-// =========================================================================================================================================
-// src/lib/git-env.ts - The environment every git call in chamba runs in
-// git takes its repo from GIT_DIR, GIT_WORK_TREE and GIT_INDEX_FILE before it takes it from -C or the working
-// directory, so a call made from inside a git hook would answer about that hook's repo instead of this one.
-// =========================================================================================================================================
-/**
- * The environment to run git in when the repo is chosen by path.
- *
- * git takes its repo from the environment as well as from the command line, and GIT_DIR, GIT_WORK_TREE and
- * GIT_INDEX_FILE win over `-C` and over the working directory. Anything chamba starts inherits whatever the
- * caller had set - a git hook sets all three - so a question asked about the workspace could be answered about
- * another repo entirely. Every git call here names its repo by path, so none of those variables is ever wanted.
- */
-export function gitEnv() {
-    const env = { ...process.env };
-    for (const key of Object.keys(env)) {
-        if (key.startsWith("GIT_"))
-            delete env[key];
-    }
-    return env;
-}
+function n(){const e={...process.env};for(const t of Object.keys(e))t.startsWith("GIT_")&&delete e[t];return e}export{n as gitEnv};

package/dist/lib/global-config.js

@@ -1,66 +1,4 @@
-// =========================================================================================================================================
-// src/lib/global-config.ts - Host-global settings store (not tied to any workspace)
-// Lives at ~/.chamba/global/config as key=value lines, mirroring the per-workspace .lock idiom.
-// Settings live here when they are host-wide rather than per-workspace.
-// =========================================================================================================================================
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { CHAMBA_DIR, GLOBAL_CONFIG_FILE, GLOBAL_DIR, WEB_RANGE_DEFAULT } from "./constants.js";
-import { formatWebRange, parseWebRange } from "./ports.js";
-// --- Keys --------------------------------------------------------------------------------------------------------------------------------
-/** Field names mapped to the keys written in the global config file. */
-export const GLOBAL_CONFIG_KEYS = {
-    webRange: "web_range",
-};
-// --- Path --------------------------------------------------------------------------------------------------------------------------------
-/** Absolute path to the global config file - ~/.chamba/global/config */
-export function globalConfigPath() {
-    return join(homedir(), CHAMBA_DIR, GLOBAL_DIR, GLOBAL_CONFIG_FILE);
-}
-// --- Parse / write -----------------------------------------------------------------------------------------------------------------------
-// Parse the config into an ordered map of raw key=value pairs. Returns an empty map when the file is
-// missing or unreadable - absence is not an error, it just means defaults apply. Unknown keys are kept
-// so a newer chamba's settings survive a write by an older one.
-function parseGlobalConfig() {
-    const config = new Map();
-    try {
-        const lines = readFileSync(globalConfigPath(), "utf8")
-            .trimEnd()
-            .split("\n")
-            .map((l) => l.trim())
-            .filter(Boolean);
-        for (const line of lines) {
-            const eq = line.indexOf("=");
-            if (eq === -1)
-                continue;
-            config.set(line.slice(0, eq), line.slice(eq + 1));
-        }
-    }
-    catch {
-        // Missing or unreadable - treat as empty.
-    }
-    return config;
-}
-// Write the raw key=value map back to ~/.chamba/global/config, creating ~/.chamba/global/ on demand.
-// Unlike the per-workspace lock (which no-ops when missing), the global config has no init step, so it
-// is created lazily on the first write.
-function writeGlobalConfig(config) {
-    mkdirSync(join(homedir(), CHAMBA_DIR, GLOBAL_DIR), { recursive: true });
-    const content = `${[...config].map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
-    writeFileSync(globalConfigPath(), content);
-}
-// --- Web agent interface -----------------------------------------------------------------------------------------------------------------
-/** Read the web interface host-port range. Falls back to the default when unset, missing, or invalid. */
-export function readWebRange() {
-    const value = parseGlobalConfig().get(GLOBAL_CONFIG_KEYS.webRange);
-    const parsed = value !== undefined ? parseWebRange(value) : null;
-    // The default is a constant that always parses; the assertion just narrows the type.
-    return parsed ?? parseWebRange(WEB_RANGE_DEFAULT);
-}
-/** Write the web interface host-port range. Creates the config file on demand and preserves all other keys. */
-export function writeWebRange(range) {
-    const config = parseGlobalConfig();
-    config.set(GLOBAL_CONFIG_KEYS.webRange, formatWebRange(range));
-    writeGlobalConfig(config);
-}
+import{mkdirSync as p,readFileSync as g,writeFileSync as u}from"node:fs";import{homedir as r}from"node:os";import{join as i}from"node:path";import{CHAMBA_DIR as c,GLOBAL_CONFIG_FILE as b,GLOBAL_DIR as a,WEB_RANGE_DEFAULT as d}from"./constants.js";import{formatWebRange as R,parseWebRange as f}from"./ports.js";const s={webRange:"web_range"};function l(){return i(r(),c,a,b)}function m(){const n=new Map;try{const e=g(l(),"utf8").trimEnd().split(`
+`).map(o=>o.trim()).filter(Boolean);for(const o of e){const t=o.indexOf("=");t!==-1&&n.set(o.slice(0,t),o.slice(t+1))}}catch{}return n}function _(n){p(i(r(),c,a),{recursive:!0});const e=`${[...n].map(([o,t])=>`${o}=${t}`).join(`
+`)}
+`;u(l(),e)}function C(){const n=m().get(s.webRange);return(n!==void 0?f(n):null)??f(d)}function E(n){const e=m();e.set(s.webRange,R(n)),_(e)}export{s as GLOBAL_CONFIG_KEYS,l as globalConfigPath,C as readWebRange,E as writeWebRange};

package/dist/lib/pnpm-store.js

@@ -1,19 +1 @@
-// =========================================================================================================================================
-// src/lib/pnpm-store.ts - Per-workspace pnpm global store mount
-// pnpm hardlinks from its global store into node_modules. Hardlinks cannot cross filesystems, so when the global store sits on the
-// container overlay FS while /workspace is a host bind mount, pnpm falls back to creating a per-project .pnpm-store inside the project -
-// which then ends up on the host repo. Mounting a host-side cache dir onto pnpm's default global store path puts the store on the same
-// device as the workspace and node_modules shadow, eliminating the fallback.
-// =========================================================================================================================================
-import { mkdirSync } from "node:fs";
-import { join } from "node:path";
-import { CONTAINER_PNPM_STORE, PNPM_STORE_DIR } from "./constants.js";
-/**
- * Lazily creates the host-side pnpm store directory under the workspace cache dir
- * and returns -v args mounting it onto pnpm's default global store path in the container.
- */
-export function buildPnpmStoreMountArgs(workspaceCacheDir) {
-    const hostStore = join(workspaceCacheDir, PNPM_STORE_DIR);
-    mkdirSync(hostStore, { recursive: true });
-    return ["-v", `${hostStore}:${CONTAINER_PNPM_STORE}`];
-}
+import{mkdirSync as t}from"node:fs";import{join as i}from"node:path";import{CONTAINER_PNPM_STORE as m,PNPM_STORE_DIR as n}from"./constants.js";function P(o){const r=i(o,n);return t(r,{recursive:!0}),["-v",`${r}:${m}`]}export{P as buildPnpmStoreMountArgs};