chamba 0.7.0 → 0.8.0

package/dist/lib/ports.js

@@ -1,210 +1 @@
-// =========================================================================================================================================
-// src/lib/ports.ts - Publish static, loopback-only host ports into the container
-// A `ports` entry is either a bare integer (identity map, 127.0.0.1:N:N) or a "HOST:CONTAINER" string. Config is the
-// source of truth: a host port already in use is a clear, hard failure that names the offending entry.
-// =========================================================================================================================================
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { createServer } from "node:net";
-import { WEB_CONTAINER_PORT } from "./constants.js";
-// --- Constants ---------------------------------------------------------------------------------------------------------------------------
-// The CLI runs as a non-root user, so the availability check (net bind) cannot bind ports below 1024.
-export const PORT_MIN = 1024;
-export const PORT_MAX = 65535;
-// Publish and check on loopback only - never 0.0.0.0. Nothing on the LAN may reach these sessions.
-export const PORT_LOOPBACK_HOST = "127.0.0.1";
-// --- Config validation and normalization -------------------------------------------------------------------------------------------------
-/** A single port number is a usable, unprivileged host/container port. */
-export function inRange(port) {
-    return Number.isInteger(port) && port >= PORT_MIN && port <= PORT_MAX;
-}
-/** Human-readable label for an entry, used in error and notice messages. */
-function describe(m) {
-    return m.host === m.container ? `port ${m.host}` : `mapping "${m.host}:${m.container}"`;
-}
-/**
- * Validate and normalize the raw `ports` entries into host->container mappings. This is the single source of
- * truth for ports semantics (unit-testable without the JSON Schema). Throws on the first problem with a clear,
- * actionable message. The JSON Schema enforces coarse structure (types, the env pattern, no unknown keys); the
- * range and cross-entry rules live here.
- */
-export function validatePortsConfig(entries) {
-    const mappings = [];
-    const seenHosts = new Set();
-    const seenEnvs = new Set();
-    for (const entry of entries) {
-        let host;
-        let container;
-        if (typeof entry.port === "number") {
-            // Bare integer -> identity map (host === container).
-            if (!inRange(entry.port)) {
-                throw new Error(`ports: port ${entry.port} must be between ${PORT_MIN} and ${PORT_MAX}. ` +
-                    'Did you mean a "HOST:CONTAINER" mapping? Quote it, e.g. "8080:3000".');
-            }
-            host = entry.port;
-            container = entry.port;
-        }
-        else {
-            // "HOST:CONTAINER" string -> explicit map, same order as docker (host first).
-            const match = /^(\d+):(\d+)$/.exec(entry.port);
-            if (!match) {
-                throw new Error(`ports: invalid port "${entry.port}". Use a bare integer (e.g. 4820) or a "HOST:CONTAINER" mapping (e.g. "8080:3000").`);
-            }
-            host = Number(match[1]);
-            container = Number(match[2]);
-            if (!inRange(host) || !inRange(container)) {
-                throw new Error(`ports: mapping "${entry.port}" is out of range - host and container ports must both be between ${PORT_MIN} and ${PORT_MAX}.`);
-            }
-        }
-        // The web agent interface always binds this port inside the container, so a second publisher would
-        // make whichever bound first win and the web URL could front the user's service. Reserved on every
-        // host: the interface comes up with every container, and nothing in chamba.yaml may take its port.
-        if (container === WEB_CONTAINER_PORT) {
-            throw new Error(`ports: container port ${WEB_CONTAINER_PORT} is reserved for the chamba web agent interface. ` +
-                "Publish your service on a different container port.");
-        }
-        if (seenHosts.has(host)) {
-            throw new Error(`ports: duplicate host port ${host}. Each entry must publish a distinct host port.`);
-        }
-        seenHosts.add(host);
-        const mapping = { host, container };
-        if (entry.env !== undefined) {
-            if (host !== container) {
-                throw new Error(`ports: ${describe(mapping)} declares env "${entry.env}", but env is only allowed on identity entries (a bare port number).`);
-            }
-            if (seenEnvs.has(entry.env)) {
-                throw new Error(`ports: duplicate env "${entry.env}". Each entry must inject a distinct env var.`);
-            }
-            seenEnvs.add(entry.env);
-            mapping.env = entry.env;
-        }
-        mappings.push(mapping);
-    }
-    return mappings;
-}
-/**
- * Parse a "START-END" range string. Returns null when the shape is wrong, either bound is out of the
- * usable port range, or start is not strictly below end. The settings menu turns each null into a
- * specific validation message; readWebRange falls back to the default.
- */
-export function parseWebRange(value) {
-    const match = /^(\d+)-(\d+)$/.exec(value.trim());
-    if (!match)
-        return null;
-    const start = Number(match[1]);
-    const end = Number(match[2]);
-    if (!inRange(start) || !inRange(end))
-        return null;
-    if (start >= end)
-        return null;
-    return { start, end };
-}
-/** Format a range back to its stored "START-END" form. */
-export function formatWebRange(range) {
-    return `${range.start}-${range.end}`;
-}
-// --- Availability probing (host I/O) -----------------------------------------------------------------------------------------------------
-/** True if nothing on the host holds a loopback socket for this port (docker-proxy / userland-proxy=true, or a plain squatter). */
-export function canBind(port) {
-    return new Promise((resolve) => {
-        const server = createServer();
-        server.once("error", () => resolve(false));
-        server.once("listening", () => server.close(() => resolve(true)));
-        server.listen(port, PORT_LOOPBACK_HOST);
-    });
-}
-/** Host ports in a `docker ps` {{.Ports}} column: "127.0.0.1:4820->4820/tcp", "[::]:5432->5432/tcp". */
-export function parsePublishedPorts(psOutput) {
-    const ports = new Set();
-    // The host port precedes "->".
-    for (const match of psOutput.matchAll(/:(\d+)->/g)) {
-        const n = Number(match[1]);
-        if (Number.isInteger(n))
-            ports.add(n);
-    }
-    return ports;
-}
-/**
- * Host ports currently published by any running container. On native Linux with userland-proxy=false no host
- * socket exists (DNAT), so canBind alone would wrongly report a published port as free - this covers that case.
- * Returns an empty set when docker is unavailable (the bind check still applies).
- */
-export function dockerPublishedPorts() {
-    const result = spawnSync("docker", ["ps", "--format", "{{.Ports}}"], { encoding: "utf8", stdio: "pipe" });
-    if (result.status !== 0 || !result.stdout)
-        return new Set();
-    return parsePublishedPorts(result.stdout);
-}
-/**
- * Host ports published by one named container, and only while it is running - a stopped container holds no
- * port even though its config still declares one. Lets a caller tell "this port is taken by my own live
- * container" (fine) from "taken by something else" (not fine). Empty when docker is unavailable.
- */
-export function containerPublishedPorts(containerName) {
-    const result = spawnSync("docker", ["ps", "--filter", `name=^${containerName}$`, "--format", "{{.Ports}}"], {
-        encoding: "utf8",
-        stdio: "pipe",
-    });
-    if (result.status !== 0 || !result.stdout)
-        return new Set();
-    return parsePublishedPorts(result.stdout);
-}
-/**
- * Check that every mapped host port is free before we create the container. Called only on the create path - the
- * old container has already been removed, so we never check our own live port. Throws a clear error naming the taken
- * host port and its entry on the first collision. Doing this here, rather than letting `docker run` fail, buys two
- * things: the error names the offending entry (docker's raw message does not), and no doomed `created` container is
- * left behind on a clash.
- *
- * `webPort` names the chamba-assigned web interface mapping, which is skipped: chamba picked that port itself, so the
- * caller drops the mapping and runs the session without the interface rather than failing a session over it. Only chamba.yaml
- * ports - config the user wrote and expects to be honoured - are hard failures here.
- */
-export async function assertHostPortsAvailable(mappings, webPort) {
-    if (mappings.length === 0)
-        return;
-    const dockerPorts = dockerPublishedPorts();
-    for (const m of mappings) {
-        // Matched on both sides, so only chamba's own mapping is skipped - never a user entry that happens
-        // to sit on the same host port.
-        if (webPort !== undefined && m.host === webPort && m.container === WEB_CONTAINER_PORT)
-            continue;
-        const free = !dockerPorts.has(m.host) && (await canBind(m.host));
-        if (!free) {
-            const via = m.host === m.container ? "" : ` (from the "${m.host}:${m.container}" mapping)`;
-            throw new Error(`ports: host port ${m.host}${via} is already in use on the host. ` +
-                "Free it, or pick a different host port in chamba.yaml.");
-        }
-    }
-}
-// --- Docker argument builders (pure) -----------------------------------------------------------------------------------------------------
-/** Loopback-only publish flags: 127.0.0.1:HOST:CONTAINER per mapping. */
-export function portPublishArgs(mappings) {
-    return mappings.flatMap((m) => ["-p", `${PORT_LOOPBACK_HOST}:${m.host}:${m.container}`]);
-}
-/** Env injection flags carrying the host port number, only for identity entries that declare an env var. */
-export function portEnvArgs(mappings) {
-    return mappings.flatMap((m) => (m.env ? ["-e", `${m.env}=${m.host}`] : []));
-}
-// --- Fingerprint -------------------------------------------------------------------------------------------------------------------------
-/**
- * Deterministic fingerprint over the normalized mappings (host, container, env), used as the container LABEL_PORTS.
- * Editing a port, mapping, or env recreates the container; a workspace with no ports fingerprints to "" so a
- * container without published ports never recreates on account of this label.
- */
-export function portsLabel(mappings) {
-    if (mappings.length === 0)
-        return "";
-    const parts = mappings.map((m) => `${m.host}:${m.container}:${m.env ?? ""}`).sort();
-    return createHash("sha256").update(parts.join(",")).digest("hex").slice(0, 12);
-}
-// --- Session notice ----------------------------------------------------------------------------------------------------------------------
-/**
- * One-line startup notice per mapping. Identity: `port 4820 open` (plus ` (ENV)` when an env is injected).
- * Mapping: `port 8080 -> 3000 open` (ASCII arrow - a UI string literal, no Unicode).
- */
-export function formatPortNotice(m) {
-    if (m.host === m.container)
-        return `port ${m.host} open${m.env ? ` (${m.env})` : ""}`;
-    return `port ${m.host} -> ${m.container} open`;
-}
+import{spawnSync as d}from"node:child_process";import{createHash as b}from"node:crypto";import{createServer as m}from"node:net";import{WEB_CONTAINER_PORT as u}from"./constants.js";const f=1024,h=65535,l="127.0.0.1";function a(t){return Number.isInteger(t)&&t>=f&&t<=h}function w(t){return t.host===t.container?`port ${t.host}`:`mapping "${t.host}:${t.container}"`}function y(t){const e=[],r=new Set,n=new Set;for(const o of t){let s,i;if(typeof o.port=="number"){if(!a(o.port))throw new Error(`ports: port ${o.port} must be between ${f} and ${h}. Did you mean a "HOST:CONTAINER" mapping? Quote it, e.g. "8080:3000".`);s=o.port,i=o.port}else{const p=/^(\d+):(\d+)$/.exec(o.port);if(!p)throw new Error(`ports: invalid port "${o.port}". Use a bare integer (e.g. 4820) or a "HOST:CONTAINER" mapping (e.g. "8080:3000").`);if(s=Number(p[1]),i=Number(p[2]),!a(s)||!a(i))throw new Error(`ports: mapping "${o.port}" is out of range - host and container ports must both be between ${f} and ${h}.`)}if(i===u)throw new Error(`ports: container port ${u} is reserved for the chamba web agent interface. Publish your service on a different container port.`);if(r.has(s))throw new Error(`ports: duplicate host port ${s}. Each entry must publish a distinct host port.`);r.add(s);const c={host:s,container:i};if(o.env!==void 0){if(s!==i)throw new Error(`ports: ${w(c)} declares env "${o.env}", but env is only allowed on identity entries (a bare port number).`);if(n.has(o.env))throw new Error(`ports: duplicate env "${o.env}". Each entry must inject a distinct env var.`);n.add(o.env),c.env=o.env}e.push(c)}return e}function O(t){const e=/^(\d+)-(\d+)$/.exec(t.trim());if(!e)return null;const r=Number(e[1]),n=Number(e[2]);return!a(r)||!a(n)||r>=n?null:{start:r,end:n}}function R(t){return`${t.start}-${t.end}`}function v(t){return new Promise(e=>{const r=m();r.once("error",()=>e(!1)),r.once("listening",()=>r.close(()=>e(!0))),r.listen(t,l)})}function $(t){const e=new Set;for(const r of t.matchAll(/:(\d+)->/g)){const n=Number(r[1]);Number.isInteger(n)&&e.add(n)}return e}function g(){const t=d("docker",["ps","--format","{{.Ports}}"],{encoding:"utf8",stdio:"pipe"});return t.status!==0||!t.stdout?new Set:$(t.stdout)}function S(t){const e=d("docker",["ps","--filter",`name=^${t}$`,"--format","{{.Ports}}"],{encoding:"utf8",stdio:"pipe"});return e.status!==0||!e.stdout?new Set:$(e.stdout)}async function T(t,e){if(t.length===0)return;const r=g();for(const n of t){if(e!==void 0&&n.host===e&&n.container===u)continue;if(!(!r.has(n.host)&&await v(n.host))){const s=n.host===n.container?"":` (from the "${n.host}:${n.container}" mapping)`;throw new Error(`ports: host port ${n.host}${s} is already in use on the host. Free it, or pick a different host port in chamba.yaml.`)}}}function A(t){return t.flatMap(e=>["-p",`${l}:${e.host}:${e.container}`])}function H(t){return t.flatMap(e=>e.env?["-e",`${e.env}=${e.host}`]:[])}function I(t){if(t.length===0)return"";const e=t.map(r=>`${r.host}:${r.container}:${r.env??""}`).sort();return b("sha256").update(e.join(",")).digest("hex").slice(0,12)}function _(t){return t.host===t.container?`port ${t.host} open${t.env?` (${t.env})`:""}`:`port ${t.host} -> ${t.container} open`}export{l as PORT_LOOPBACK_HOST,h as PORT_MAX,f as PORT_MIN,T as assertHostPortsAvailable,v as canBind,S as containerPublishedPorts,g as dockerPublishedPorts,_ as formatPortNotice,R as formatWebRange,a as inRange,$ as parsePublishedPorts,O as parseWebRange,H as portEnvArgs,A as portPublishArgs,I as portsLabel,y as validatePortsConfig};

package/dist/lib/safe-rm.js

@@ -1,36 +1 @@
-// =========================================================================================================================================
-// src/lib/safe-rm.ts - Safe wrapper around rmSync
-// All deletions in chamba go through safeRmSync. A biome lint rule (noRestrictedImports) bans
-// importing rmSync from node:fs everywhere else, enforcing this as the single deletion point.
-// =========================================================================================================================================
-// biome-ignore lint/style/noRestrictedImports: safeRmSync is the only approved user of rmSync
-import { rmSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import { basename, join, resolve, sep } from "node:path";
-import { CHAMBA_DIR, CHAMBA_YAML, CONTAINER_NAME_PREFIX, PACKAGE_ROOT } from "./constants.js";
-const CHAMBA_HOME = resolve(join(homedir(), CHAMBA_DIR));
-const TEST_TMP_PREFIX = join(tmpdir(), `${CONTAINER_NAME_PREFIX}test-`);
-// chamba's own build outputs, inside the package itself. The build stages the pane apps into the
-// templates tree, and it clears the previous staging before it copies: every asset in that dist is
-// named by its own content hash, so merging would keep every past build's files for ever, and the
-// image build hash covers each of them.
-const BUILD_OUTPUTS = [resolve(join(PACKAGE_ROOT, "dist")), resolve(join(PACKAGE_ROOT, "templates", "pane-apps"))];
-/**
- * Safe wrapper around rmSync. Throws if the path is outside a chamba-owned location:
- *   - ~/.chamba/            (workspace caches, agents, shadows, global config)
- *   - A file named chamba.yaml  (workspace config file in any user workspace root)
- *   - <tmpdir>/chamba-test-*   (test temp directories)
- *   - chamba's own build outputs inside the package (dist/, templates/pane-apps/)
- */
-export function safeRmSync(path, options) {
-    const r = resolve(path);
-    const ok = r === CHAMBA_HOME ||
-        r.startsWith(CHAMBA_HOME + sep) ||
-        basename(r) === CHAMBA_YAML ||
-        r.startsWith(TEST_TMP_PREFIX) ||
-        BUILD_OUTPUTS.some((output) => r === output || r.startsWith(output + sep));
-    if (!ok) {
-        throw new Error(`safeRmSync: refusing to delete '${r}' - must be under ~/.chamba/, named chamba.yaml, a test temp dir, or a build output of this package`);
-    }
-    rmSync(r, options);
-}
+import{rmSync as p}from"node:fs";import{homedir as c,tmpdir as A}from"node:os";import{basename as f,join as o,resolve as e,sep as s}from"node:path";import{CHAMBA_DIR as _,CHAMBA_YAML as d,CONTAINER_NAME_PREFIX as h,PACKAGE_ROOT as m}from"./constants.js";const a=e(o(c(),_)),E=o(A(),`${h}test-`),M=[e(o(m,"dist")),e(o(m,"templates","pane-apps"))];function C(i,n){const t=e(i);if(!(t===a||t.startsWith(a+s)||f(t)===d||t.startsWith(E)||M.some(r=>t===r||t.startsWith(r+s))))throw new Error(`safeRmSync: refusing to delete '${t}' - must be under ~/.chamba/, named chamba.yaml, a test temp dir, or a build output of this package`);p(t,n)}export{C as safeRmSync};

package/dist/lib/sessions.js

@@ -1,34 +1,2 @@
-// =========================================================================================================================================
-// src/lib/sessions.ts - Host-side detection of live interactive container sessions.
-// dev.ts connects each session with `docker exec -it ... <container> bash --login`. The host-side exec
-// client process is the proxy for one live session: it dies on clean exit, closed terminal, or kill, but
-// survives a sleep-freeze. Orphaned in-container shells (host side gone, PTY left open by dockerd) have no
-// host client and are correctly ignored - which is why counting on the host, not inside the container, is
-// the reliable signal for "last session closed".
-// =========================================================================================================================================
-import { spawnSync } from "node:child_process";
-// The interactive session shell, as argv. Single source of truth: both the connect command and the
-// detector's match needle derive from this, so they cannot drift apart.
-export const CONTAINER_LOGIN_SHELL = ["bash", "--login"];
-// --- Connect -----------------------------------------------------------------------------------------------------------------------------
-// Build the `docker exec` argv that opens an interactive session in `containerName` at `workdir`.
-// dev.ts spawns exactly this; sessionMatchNeedle matches against it, so detection stays in lockstep.
-export function loginShellExecArgs(workdir, containerName) {
-    return ["exec", "-it", "-w", workdir, containerName, ...CONTAINER_LOGIN_SHELL];
-}
-// --- Detection ---------------------------------------------------------------------------------------------------------------------------
-// The substring identifying one container's session client in a host `pgrep -f` scan: the container name
-// followed by the login shell args (e.g. "chamba-orot-io bash --login"). Specific enough to exclude other
-// `docker exec <c> ...` shapes. Container ids are kebab-case (schema-constrained), so there are no regex
-// metacharacters to escape.
-export function sessionMatchNeedle(containerName) {
-    return `${containerName} ${CONTAINER_LOGIN_SHELL.join(" ")}`;
-}
-// Count live interactive sessions to a single container by scanning HOST processes for the exec client.
-// `pgrep -f` (portable across macOS/BSD and Linux; `-c` is Linux-only) excludes its own PID. A missing or
-// errored pgrep yields no stdout -> 0, preserving the old "errored -> 0" safety. At a clean exit the just-
-// left client is already reaped before this runs, so the last exit reaches 0.
-export function containerSessionCount(containerName) {
-    const r = spawnSync("pgrep", ["-f", sessionMatchNeedle(containerName)], { encoding: "utf8", stdio: "pipe" });
-    return (r.stdout ?? "").split("\n").filter(Boolean).length;
-}
+import{spawnSync as o}from"node:child_process";const e=["bash","--login"];function s(n,t){return["exec","-it","-w",n,t,...e]}function r(n){return`${n} ${e.join(" ")}`}function c(n){return(o("pgrep",["-f",r(n)],{encoding:"utf8",stdio:"pipe"}).stdout??"").split(`
+`).filter(Boolean).length}export{e as CONTAINER_LOGIN_SHELL,c as containerSessionCount,s as loginShellExecArgs,r as sessionMatchNeedle};

package/dist/lib/shadows.js

@@ -1,176 +1 @@
-// =========================================================================================================================================
-// src/lib/shadows.ts - Gitignore-style shadow path expansion and sync
-// Expands patterns like "node_modules", ".env*" into concrete paths, then syncs shadow directories.
-// =========================================================================================================================================
-import { spawnSync } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
-import { dirname, join, relative } from "node:path";
-import fg from "fast-glob";
-import { CONTAINER_WORKSPACE, SHADOWS_DIR } from "./constants.js";
-import { gitEnv } from "./git-env.js";
-import { safeRmSync } from "./safe-rm.js";
-/**
- * Expand gitignore-style patterns into concrete relative paths.
- *
- * Patterns without a directory separator are treated as recursive (prepended with **/)
- * following gitignore convention. Patterns with a / are matched relative to the workspace root.
- * Matched directories are not recursed into (e.g. node_modules matches once, not its children).
- *
- * Paths that git tracks (or whose descendants git tracks) are dropped from the result and
- * reported in skippedTracked. Shadowing tracked content is a no-op (agents can `git show` it)
- * and breaks `git stash`/`pop` workflows.
- */
-export function expandShadowPatterns(patterns, workspaceRoot) {
-    if (patterns.length === 0)
-        return { paths: [], skippedTracked: [] };
-    // Convert gitignore-style patterns to fast-glob patterns
-    const globPatterns = patterns.map((p) => (p.includes("/") ? p : `**/${p}`));
-    // Build ignore list: skip .git and contents of any matched directory
-    const ignorePatterns = ["**/.git", ...globPatterns.map((p) => `${p}/**/*`)];
-    const results = fg.sync(globPatterns, {
-        cwd: workspaceRoot,
-        onlyFiles: false,
-        dot: true,
-        ignore: ignorePatterns,
-    });
-    const expanded = removeNestedPaths(results.sort());
-    const { kept, dropped } = filterGitTrackedPaths(expanded, workspaceRoot);
-    return { paths: kept, skippedTracked: dropped };
-}
-// --- Hit counting (for menu UX) ----------------------------------------------------------------------------------------------------------
-/** Count how many paths a pattern would match in the workspace (post git-tracked filter). */
-export function countPatternHits(pattern, workspaceRoot) {
-    return expandShadowPatterns([pattern], workspaceRoot).paths.length;
-}
-// --- Git-tracked filtering ---------------------------------------------------------------------------------------------------------------
-/**
- * Partition expanded shadow paths into those safe to shadow and those tracked by git.
- * A path is dropped if it equals a tracked file, or (for directories) any tracked file
- * lives anywhere beneath it. Returns the input unchanged when no .git is present.
- */
-function filterGitTrackedPaths(paths, workspaceRoot) {
-    if (paths.length === 0)
-        return { kept: [], dropped: [] };
-    // .git may be a file (worktrees) or a directory; existsSync handles both
-    if (!existsSync(join(workspaceRoot, ".git")))
-        return { kept: paths, dropped: [] };
-    // Pass shadow paths as pathspecs so git enumerates only tracked files within them.
-    // Output then scales with shadow scope (typically tiny), not the size of the repo index.
-    const result = spawnSync("git", ["-C", workspaceRoot, "ls-files", "-z", "--", ...paths], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"],
-        env: gitEnv(),
-    });
-    if (result.status !== 0)
-        return { kept: paths, dropped: [] };
-    const matched = result.stdout.split("\0").filter((s) => s.length > 0);
-    if (matched.length === 0)
-        return { kept: paths, dropped: [] };
-    const matchedSet = new Set(matched);
-    const kept = [];
-    const dropped = [];
-    for (const p of paths) {
-        const prefix = `${p}/`;
-        if (matchedSet.has(p) || matched.some((f) => f.startsWith(prefix))) {
-            dropped.push(p);
-        }
-        else {
-            kept.push(p);
-        }
-    }
-    return { kept, dropped };
-}
-// --- Shadow sync -------------------------------------------------------------------------------------------------------------------------
-/**
- * Ensures the shadows/ directory matches the given expanded paths.
- * - Creates missing shadow entries (empty dir or empty file, matching source path type)
- * - If `freshPaths` is provided, those entries are deleted and recreated (clean slate)
- * - Removes shadow entries not in the expanded set
- * - Cleans up empty parent directories
- */
-export function ensureShadowsInSync(workspaceDir, expandedPaths, workspaceRoot, freshPaths) {
-    const expected = new Set(expandedPaths);
-    const shadowsDir = join(workspaceDir, SHADOWS_DIR);
-    // Create shadows/ root if needed
-    mkdirSync(shadowsDir, { recursive: true });
-    // Remove stale entries
-    removeStaleEntries(shadowsDir, shadowsDir, expected);
-    // Create or refresh expected entries
-    for (const relPath of expected) {
-        const sourcePath = join(workspaceRoot, relPath);
-        const shadowPath = join(shadowsDir, relPath);
-        if (freshPaths?.has(relPath) && existsSync(shadowPath)) {
-            safeRmSync(shadowPath, { recursive: true, force: true });
-        }
-        if (!existsSync(shadowPath)) {
-            createShadowEntry(sourcePath, shadowPath);
-        }
-    }
-}
-// --- Mount args --------------------------------------------------------------------------------------------------------------------------
-/** Build -v args for shadow mounts from expanded paths. */
-export function buildShadowMountArgs(workspaceDir, expandedPaths) {
-    const args = [];
-    for (const relPath of expandedPaths) {
-        args.push("-v", `${join(workspaceDir, SHADOWS_DIR, relPath)}:${CONTAINER_WORKSPACE}/${relPath}`);
-    }
-    return args;
-}
-// --- Helpers -----------------------------------------------------------------------------------------------------------------------------
-function createShadowEntry(sourcePath, shadowPath) {
-    if (existsSync(sourcePath) && !lstatSync(sourcePath).isDirectory()) {
-        mkdirSync(dirname(shadowPath), { recursive: true });
-        writeFileSync(shadowPath, "");
-    }
-    else {
-        mkdirSync(shadowPath, { recursive: true });
-    }
-}
-/**
- * Walk the shadows/ tree and remove any entry whose relative path is not in the expected set.
- * After removing leaf entries, prunes empty parent directories.
- */
-function removeStaleEntries(baseDir, currentDir, expected) {
-    if (!existsSync(currentDir))
-        return;
-    for (const entry of readdirSync(currentDir, { withFileTypes: true })) {
-        const fullPath = join(currentDir, entry.name);
-        const rel = relative(baseDir, fullPath);
-        if (expected.has(rel)) {
-            // This path is expected - keep it
-            continue;
-        }
-        if (entry.isDirectory()) {
-            // Check if any expected path is nested under this directory
-            const hasExpectedChild = [...expected].some((p) => isDescendantOf(p, rel));
-            if (hasExpectedChild) {
-                // Recurse into the directory to clean stale children
-                removeStaleEntries(baseDir, fullPath, expected);
-            }
-            else {
-                // No expected paths under here - remove entirely
-                safeRmSync(fullPath, { recursive: true, force: true });
-            }
-        }
-        else {
-            // Stale file - remove
-            safeRmSync(fullPath, { force: true });
-        }
-    }
-    // Prune if this directory is now empty (and is not the shadows root)
-    if (currentDir !== baseDir && readdirSync(currentDir).length === 0) {
-        safeRmSync(currentDir, { recursive: true, force: true });
-    }
-}
-/**
- * Drop paths that descend from another path in the input (keeps only the outermost path per subtree),
- * so nested matches (e.g. node_modules inside a shadowed .next dir) don't become redundant bind mounts.
- */
-function removeNestedPaths(paths) {
-    const unique = [...new Set(paths)];
-    return unique.filter((p) => !unique.some((a) => a !== p && isDescendantOf(p, a)));
-}
-// Expects forward-slash paths (fast-glob output and shadows/ relative paths on POSIX).
-function isDescendantOf(child, ancestor) {
-    return child.startsWith(`${ancestor}/`);
-}
+import{spawnSync as y}from"node:child_process";import{existsSync as d,lstatSync as v,mkdirSync as p,readdirSync as a,writeFileSync as k}from"node:fs";import{dirname as w,join as u,relative as x}from"node:path";import P from"fast-glob";import{CONTAINER_WORKSPACE as E,SHADOWS_DIR as m}from"./constants.js";import{gitEnv as $}from"./git-env.js";import{safeRmSync as l}from"./safe-rm.js";function C(t,e){if(t.length===0)return{paths:[],skippedTracked:[]};const n=t.map(f=>f.includes("/")?f:`**/${f}`),r=["**/.git",...n.map(f=>`${f}/**/*`)],o=P.sync(n,{cwd:e,onlyFiles:!1,dot:!0,ignore:r}),s=O(o.sort()),{kept:c,dropped:i}=T(s,e);return{paths:c,skippedTracked:i}}function j(t,e){return C([t],e).paths.length}function T(t,e){if(t.length===0)return{kept:[],dropped:[]};if(!d(u(e,".git")))return{kept:t,dropped:[]};const n=y("git",["-C",e,"ls-files","-z","--",...t],{encoding:"utf8",stdio:["ignore","pipe","pipe"],env:$()});if(n.status!==0)return{kept:t,dropped:[]};const r=n.stdout.split("\0").filter(i=>i.length>0);if(r.length===0)return{kept:t,dropped:[]};const o=new Set(r),s=[],c=[];for(const i of t){const f=`${i}/`;o.has(i)||r.some(g=>g.startsWith(f))?c.push(i):s.push(i)}return{kept:s,dropped:c}}function q(t,e,n){const r=new Set(e),o=u(t,m);p(o,{recursive:!0}),h(o,o,r);for(const s of r){const c=u(o,s);d(c)||A(u(n,s),c)}}function z(t,e){const n=[];for(const r of e)n.push("-v",`${u(t,m,r)}:${E}/${r}`);return n}function A(t,e){d(t)&&!v(t).isDirectory()?(p(w(e),{recursive:!0}),k(e,"")):p(e,{recursive:!0})}function h(t,e,n){if(d(e)){for(const r of a(e,{withFileTypes:!0})){const o=u(e,r.name),s=x(t,o);n.has(s)||(r.isDirectory()?[...n].some(i=>S(i,s))?h(t,o,n):l(o,{recursive:!0,force:!0}):l(o,{force:!0}))}e!==t&&a(e).length===0&&l(e,{recursive:!0,force:!0})}}function O(t){const e=[...new Set(t)];return e.filter(n=>!e.some(r=>r!==n&&S(n,r)))}function S(t,e){return t.startsWith(`${e}/`)}export{z as buildShadowMountArgs,j as countPatternHits,q as ensureShadowsInSync,C as expandShadowPatterns};

package/dist/lib/skills.js

@@ -0,0 +1,2 @@
+import{copyFileSync as b,existsSync as f,mkdirSync as d,readdirSync as h,readFileSync as m,renameSync as w,statSync as k,writeFileSync as M}from"node:fs";import{dirname as y,join as s}from"node:path";import{load as T}from"js-yaml";import{AGENTS_DIR as p,CONTAINER_HOME as g,PACKAGE_ROOT as O,WEB_AGENTS as $}from"./constants.js";import{safeRmSync as I}from"./safe-rm.js";import{renderTemplate as L,writeFileEnsuringDir as N}from"./templates.js";const A=[{audience:["claude"],hostSubpath:s("claude","skills"),container:`${g}/.claude/skills`,insideAgentMount:!0},{audience:["codex","opencode"],hostSubpath:s("shared","skills"),container:`${g}/.agents/skills`,insideAgentMount:!1}],F="skills-manifest.json",_=/^---\r?\n([\s\S]*?)\r?\n---/;function S(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function j(e){const r=_.exec(m(e,"utf8"));if(!r)return null;const t=T(r[1]??""),o=S(t)?t.metadata:void 0,n=S(o)?o.audience:void 0;if(n==null)return null;const c=typeof n=="string"?n.split(","):n;if(!Array.isArray(c)||c.some(a=>typeof a!="string"))throw new Error(`${e}: metadata.audience is neither a name nor a list of names`);const i=c.map(a=>String(a).trim()).filter(a=>a.length>0),l=i.filter(a=>!$.includes(a));if(l.length>0)throw new Error(`${e}: metadata.audience names ${l.join(", ")}, which chamba does not run`);return i.length>0?i:null}function x(e,r){return e===null||r.audience.some(t=>e.includes(t))}function B(e){return A.flatMap(r=>{const t=s(e,p,r.hostSubpath);return d(t,{recursive:!0}),["-v",`${t}:${r.container}:ro`]})}function Y(e,r){const t=s(O,"templates","skills");if(!f(t))return;const o=h(t,{withFileTypes:!0}).filter(i=>i.isDirectory()&&f(s(t,i.name,"SKILL.md"))).map(i=>({name:i.name,audience:j(s(t,i.name,"SKILL.md"))})),n=s(e,p,F),c=K(n);for(const i of A){const l=s(e,p,i.hostSubpath),a=o.filter(u=>x(u.audience,i)).map(u=>u.name);R(l,c[i.hostSubpath]??[],a);for(const u of a)E(s(t,u),s(l,u),r);c[i.hostSubpath]=[...a].sort()}G(n,c)}function E(e,r,t){for(const o of h(e,{withFileTypes:!0})){const n=s(e,o.name),c=s(r,o.name),i=k(n);i.isDirectory()?E(n,c,t):i.isFile()&&(o.name.endsWith(".md")?N(c,L(m(n,"utf8"),t)):(d(y(c),{recursive:!0}),b(n,c)))}}function R(e,r,t){for(const o of r){if(t.includes(o))continue;const n=s(e,o);f(n)&&I(n,{recursive:!0,force:!0})}}const D=/^[A-Za-z0-9._-]+$/;function K(e){try{const r=JSON.parse(m(e,"utf8"));if(S(r))return Object.fromEntries(Object.entries(r).map(([t,o])=>[t,(Array.isArray(o)?o:[]).filter(n=>typeof n=="string"&&D.test(n))]))}catch{}return{}}function G(e,r){d(y(e),{recursive:!0});const t=`${e}.writing`;M(t,`${JSON.stringify(r,null,2)}
+`),w(t,e)}export{A as SKILL_HOMES,B as buildSkillsMountArgs,Y as injectSkills,j as readSkillAudience};

package/dist/lib/templates.js

@@ -0,0 +1 @@
+import{mkdirSync as n,readFileSync as i,writeFileSync as o}from"node:fs";import{dirname as m,join as p}from"node:path";import{PACKAGE_ROOT as c}from"./constants.js";function f(r){return i(p(c,"templates","context",`${r}.md`),"utf8").trimEnd()}function x(r,e){return r.replace(/\{\{(\w+)\}\}/g,(u,t)=>e[t]??`{{${t}}}`)}function s(r,e){n(m(r),{recursive:!0}),o(r,e)}export{f as loadTemplate,x as renderTemplate,s as writeFileEnsuringDir};