claude-code-runner 0.1.0

package/dist/container.js

@@ -0,0 +1,971 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContainerManager = void 0;
+const node_buffer_1 = require("node:buffer");
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_process_1 = __importDefault(require("node:process"));
+const chalk_1 = __importDefault(require("chalk"));
+const tar_stream_1 = __importDefault(require("tar-stream"));
+class ContainerManager {
+    docker;
+    config;
+    containers = new Map();
+    constructor(docker, config) {
+        this.docker = docker;
+        this.config = config;
+    }
+    async start(containerConfig) {
+        // Build or pull image
+        await this.ensureImage();
+        // Create container
+        const container = await this.createContainer(containerConfig);
+        this.containers.set(container.id, container);
+        // Start container
+        await container.start();
+        console.log(chalk_1.default.green('✓ Container started'));
+        // Copy working directory into container
+        console.log(chalk_1.default.blue('• Copying files into container...'));
+        try {
+            await this._copyWorkingDirectory(container, containerConfig.workDir);
+            console.log(chalk_1.default.green('✓ Files copied'));
+            // Copy Claude configuration if it exists
+            await this._copyClaudeConfig(container);
+            // Copy git configuration if it exists
+            await this._copyGitConfig(container);
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('✗ File copy failed:'), error);
+            // Clean up container on failure
+            await container.stop().catch(() => { });
+            await container.remove().catch(() => { });
+            this.containers.delete(container.id);
+            throw error;
+        }
+        // Give the container a moment to initialize
+        await new Promise(resolve => setTimeout(resolve, 500));
+        console.log(chalk_1.default.green('✓ Container ready'));
+        // Set up git branch and startup script
+        await this.setupGitAndStartupScript(container, containerConfig.branchName, containerConfig.prFetchRef, containerConfig.remoteFetchRef);
+        // Run setup commands
+        await this.runSetupCommands(container);
+        return container.id;
+    }
+    async ensureImage() {
+        const imageName = this.config.dockerImage || 'claude-code-runner:latest';
+        // Check if image already exists
+        try {
+            await this.docker.getImage(imageName).inspect();
+            console.log(chalk_1.default.green(`✓ Using existing image: ${imageName}`));
+            return;
+        }
+        catch (error) {
+            // Image doesn't exist, decide whether to build or pull
+        }
+        // Determine if we should build (default) or pull
+        const shouldBuild = this.config.buildImage !== false; // default to true
+        const hasLocalDockerfile = this.config.dockerfile || fs.existsSync(node_path_1.default.join(__dirname, '..', 'docker', 'Dockerfile'));
+        if (shouldBuild && hasLocalDockerfile) {
+            console.log(chalk_1.default.blue(`• Building image: ${imageName}...`));
+            // Check if we need to build from custom Dockerfile
+            if (this.config.dockerfile) {
+                await this.buildImage(this.config.dockerfile, imageName);
+            }
+            else {
+                // Use default Dockerfile from docker/ directory
+                const defaultDockerfilePath = node_path_1.default.join(__dirname, '..', 'docker', 'Dockerfile');
+                console.log(chalk_1.default.blue(`• Using default Dockerfile: ${defaultDockerfilePath}`));
+                await this.buildImage(defaultDockerfilePath, imageName);
+            }
+        }
+        else if (!shouldBuild) {
+            // Pull image from registry
+            console.log(chalk_1.default.blue(`• Pulling image from registry: ${imageName}...`));
+            await this.pullImage(imageName);
+        }
+        else {
+            // No Dockerfile and shouldBuild is false, try to pull
+            console.log(chalk_1.default.blue(`• Pulling image from registry: ${imageName}...`));
+            try {
+                await this.pullImage(imageName);
+            }
+            catch (error) {
+                console.log(chalk_1.default.yellow('⚠ Failed to pull image, using inline Dockerfile'));
+                await this.buildDefaultImage(imageName);
+            }
+        }
+    }
+    async pullImage(imageName) {
+        // Parse image name to get registry info
+        const stream = await this.docker.pull(imageName);
+        return new Promise((resolve, reject) => {
+            this.docker.modem.followProgress(stream, (err, res) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            }, (event) => {
+                if (event.status) {
+                    node_process_1.default.stdout.write(`${event.status}`);
+                    if (event.progress)
+                        node_process_1.default.stdout.write(` ${event.progress}`);
+                    node_process_1.default.stdout.write('\n');
+                }
+            });
+        });
+    }
+    async buildDefaultImage(imageName) {
+        const dockerfile = `
+FROM docker.io/library/almalinux:10
+
+# Install system dependencies
+RUN dnf install -y epel-release && dnf install -y \
+    curl \\
+    git \\
+    openssh-clients \\
+    python3 \\
+    python3-pip \\
+    gcc \\
+    gcc-c++ \\
+    make \\
+    sudo \\
+    vim \\
+    jq \\
+    ca-certificates \\
+    gnupg2 \\
+    inotify-tools \\
+    rsync \\
+    && dnf clean all
+
+# Install Node.js 24.x
+RUN curl -fsSL https://rpm.nodesource.com/setup_24.x | bash - \\
+    && dnf install -y nodejs
+
+# Install GitHub CLI
+RUN dnf install -y 'dnf-command(config-manager)' \\
+    && dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo \\
+    && dnf install -y gh
+
+# Install Claude Code
+RUN npm install -g @anthropic-ai/claude-code@latest
+
+# Create a non-root user with sudo privileges
+RUN useradd -m -s /bin/bash claude && \\
+    echo 'claude ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers && \\
+    usermod -aG wheel claude
+
+# Create workspace directory and set ownership
+RUN mkdir -p /workspace && \\
+    chown -R claude:claude /workspace
+
+# Switch to non-root user
+USER claude
+WORKDIR /workspace
+
+# Set up entrypoint
+ENTRYPOINT ["/bin/bash", "-c"]
+`;
+        /*
+RUN echo '#!/bin/bash\\n\\
+# Allow the initial branch creation\\n\\
+if [ ! -f /tmp/.branch-created ]; then\\n\\
+    /usr/bin/git "$@"\\n\\
+    if [[ "$1" == "checkout" ]] && [[ "$2" == "-b" ]]; then\\n\\
+        touch /tmp/.branch-created\\n\\
+    fi\\n\\
+else\\n\\
+    # After initial branch creation, prevent switching\\n\\
+    if [[ "$1" == "checkout" ]] && [[ "$2" != "-b" ]]; then\\n\\
+        echo "Branch switching is disabled in claude-code-runner"\\n\\
+        exit 1\\n\\
+    fi\\n\\
+    if [[ "$1" == "switch" ]]; then\\n\\
+        echo "Branch switching is disabled in claude-code-runner"\\n\\
+        exit 1\\n\\
+    fi\\n\\
+    /usr/bin/git "$@"\\n\\
+fi' > /usr/local/bin/git && \\
+    chmod +x /usr/local/bin/git
+# Create startup script
+RUN echo '#!/bin/bash\\n\\
+echo "Waiting for attachment..."\\n\\
+sleep 2\\n\\
+cd /workspace\\n\\
+git checkout -b "$1"\\n\\
+echo "Starting Claude Code on branch $1..."\\n\\
+exec claude --dangerously-skip-permissions' > /start-claude.sh && \\
+    chmod +x /start-claude.sh */
+        // Build image from string
+        const pack = tar_stream_1.default.pack();
+        // Add Dockerfile to tar
+        pack.entry({ name: 'Dockerfile' }, dockerfile, (err) => {
+            if (err)
+                throw err;
+            pack.finalize();
+        });
+        // Convert to buffer for docker
+        const chunks = [];
+        pack.on('data', (chunk) => chunks.push(chunk));
+        await new Promise((resolve) => {
+            pack.on('end', resolve);
+        });
+        const tarBuffer = node_buffer_1.Buffer.concat(chunks);
+        const buildStream = await this.docker.buildImage(tarBuffer, {
+            t: imageName,
+        });
+        // Wait for build to complete
+        await new Promise((resolve, reject) => {
+            this.docker.modem.followProgress(buildStream, (err, res) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(res);
+            }, (event) => {
+                if (event.stream) {
+                    node_process_1.default.stdout.write(event.stream);
+                }
+            });
+        });
+    }
+    async buildImage(dockerfilePath, imageName) {
+        const buildContext = node_path_1.default.dirname(dockerfilePath);
+        const buildStream = await this.docker.buildImage({
+            context: buildContext,
+            src: [node_path_1.default.basename(dockerfilePath)],
+        }, {
+            dockerfile: node_path_1.default.basename(dockerfilePath),
+            t: imageName,
+        });
+        await new Promise((resolve, reject) => {
+            this.docker.modem.followProgress(buildStream, (err, res) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(res);
+            }, (event) => {
+                if (event.stream) {
+                    node_process_1.default.stdout.write(event.stream);
+                }
+            });
+        });
+    }
+    async createContainer(containerConfig) {
+        const { credentials, workDir } = containerConfig;
+        // Prepare environment variables
+        const env = this.prepareEnvironment(credentials);
+        // Prepare volumes
+        const volumes = this.prepareVolumes(workDir, credentials);
+        // Create container
+        const container = await this.docker.createContainer({
+            Image: this.config.dockerImage || 'claude-code-runner:latest',
+            name: `${this.config.containerPrefix || 'claude-code-runner'}-${Date.now()}`,
+            Env: env,
+            HostConfig: {
+                Binds: volumes,
+                AutoRemove: false,
+                NetworkMode: 'bridge',
+            },
+            WorkingDir: '/workspace',
+            Cmd: ['/bin/bash', '-l'],
+            AttachStdin: true,
+            AttachStdout: true,
+            AttachStderr: true,
+            Tty: true,
+            OpenStdin: true,
+            StdinOnce: false,
+        });
+        return container;
+    }
+    prepareEnvironment(credentials) {
+        const env = [];
+        // Load environment variables from .env file if specified
+        if (this.config.envFile) {
+            try {
+                const envFilePath = node_path_1.default.resolve(this.config.envFile);
+                if (fs.existsSync(envFilePath)) {
+                    console.log(chalk_1.default.blue(`• Loading environment from ${this.config.envFile}...`));
+                    const envContent = fs.readFileSync(envFilePath, 'utf-8');
+                    const lines = envContent.split('\n');
+                    for (const line of lines) {
+                        const trimmedLine = line.trim();
+                        // Skip empty lines and comments
+                        if (!trimmedLine || trimmedLine.startsWith('#')) {
+                            continue;
+                        }
+                        // Skip lines without = sign
+                        if (!trimmedLine.includes('=')) {
+                            continue;
+                        }
+                        // Parse key=value, handling values with = signs
+                        const firstEqualIndex = trimmedLine.indexOf('=');
+                        const key = trimmedLine.substring(0, firstEqualIndex).trim();
+                        let value = trimmedLine.substring(firstEqualIndex + 1).trim();
+                        // Remove surrounding quotes if present
+                        if ((value.startsWith('"') && value.endsWith('"'))
+                            || (value.startsWith('\'') && value.endsWith('\''))) {
+                            value = value.slice(1, -1);
+                        }
+                        if (key) {
+                            env.push(`${key}=${value}`);
+                        }
+                    }
+                    console.log(chalk_1.default.green(`✓ Loaded ${env.length} environment variables from ${this.config.envFile}`));
+                }
+                else {
+                    console.log(chalk_1.default.yellow(`⚠ Environment file ${this.config.envFile} not found`));
+                }
+            }
+            catch (error) {
+                console.error(chalk_1.default.yellow(`⚠ Failed to load environment file ${this.config.envFile}:`), error);
+            }
+        }
+        // Claude credentials from discovery
+        if (credentials.claude) {
+            switch (credentials.claude.type) {
+                case 'api_key':
+                    env.push(`ANTHROPIC_API_KEY=${credentials.claude.value}`);
+                    break;
+                case 'bedrock':
+                    env.push('CLAUDE_CODE_USE_BEDROCK=1');
+                    if (credentials.claude.region) {
+                        env.push(`AWS_REGION=${credentials.claude.region}`);
+                    }
+                    break;
+                case 'vertex':
+                    env.push('CLAUDE_CODE_USE_VERTEX=1');
+                    if (credentials.claude.project) {
+                        env.push(`GOOGLE_CLOUD_PROJECT=${credentials.claude.project}`);
+                    }
+                    break;
+            }
+        }
+        else if (node_process_1.default.env.ANTHROPIC_API_KEY) {
+            // If no Claude credentials were discovered but ANTHROPIC_API_KEY is in environment, pass it through
+            env.push(`ANTHROPIC_API_KEY=${node_process_1.default.env.ANTHROPIC_API_KEY}`);
+        }
+        // GitHub token - check multiple sources
+        if (credentials.github?.token) {
+            env.push(`GITHUB_TOKEN=${credentials.github.token}`);
+        }
+        else if (node_process_1.default.env.GITHUB_TOKEN) {
+            // Pass through from environment
+            env.push(`GITHUB_TOKEN=${node_process_1.default.env.GITHUB_TOKEN}`);
+        }
+        else if (node_process_1.default.env.GH_TOKEN) {
+            // GitHub CLI uses GH_TOKEN
+            env.push(`GITHUB_TOKEN=${node_process_1.default.env.GH_TOKEN}`);
+            env.push(`GH_TOKEN=${node_process_1.default.env.GH_TOKEN}`);
+        }
+        // Pass through git author info if available
+        if (node_process_1.default.env.GIT_AUTHOR_NAME) {
+            env.push(`GIT_AUTHOR_NAME=${node_process_1.default.env.GIT_AUTHOR_NAME}`);
+        }
+        if (node_process_1.default.env.GIT_AUTHOR_EMAIL) {
+            env.push(`GIT_AUTHOR_EMAIL=${node_process_1.default.env.GIT_AUTHOR_EMAIL}`);
+        }
+        if (node_process_1.default.env.GIT_COMMITTER_NAME) {
+            env.push(`GIT_COMMITTER_NAME=${node_process_1.default.env.GIT_COMMITTER_NAME}`);
+        }
+        if (node_process_1.default.env.GIT_COMMITTER_EMAIL) {
+            env.push(`GIT_COMMITTER_EMAIL=${node_process_1.default.env.GIT_COMMITTER_EMAIL}`);
+        }
+        // Additional config
+        env.push('CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1');
+        if (this.config.maxThinkingTokens) {
+            env.push(`MAX_THINKING_TOKENS=${this.config.maxThinkingTokens}`);
+        }
+        if (this.config.bashTimeout) {
+            env.push(`BASH_MAX_TIMEOUT_MS=${this.config.bashTimeout}`);
+        }
+        // Add custom environment variables
+        if (this.config.environment) {
+            Object.entries(this.config.environment).forEach(([key, value]) => {
+                env.push(`${key}=${value}`);
+            });
+        }
+        return env;
+    }
+    prepareVolumes(_workDir, _credentials) {
+        // NO MOUNTING workspace - we'll copy files instead
+        const volumes = [];
+        // NO SSH mounting - we'll use GitHub tokens instead
+        // Add custom volumes (legacy format)
+        if (this.config.volumes) {
+            volumes.push(...this.config.volumes);
+        }
+        // Add mount configurations (new format)
+        if (this.config.mounts) {
+            for (const mount of this.config.mounts) {
+                try {
+                    // Expand environment variables in source path
+                    let expandedSource = mount.source.replace(/\$HOME/g, os.homedir());
+                    expandedSource = expandedSource.replace(/\$(\w+)/g, (match, varName) => {
+                        return node_process_1.default.env[varName] || match;
+                    });
+                    // Resolve the source path
+                    const sourcePath = node_path_1.default.isAbsolute(expandedSource)
+                        ? expandedSource
+                        : node_path_1.default.resolve(node_process_1.default.cwd(), expandedSource);
+                    // Check if source exists
+                    if (!fs.existsSync(sourcePath)) {
+                        console.log(chalk_1.default.yellow(`⚠ Mount source does not exist: ${mount.source} (resolved to ${sourcePath})`));
+                        continue;
+                    }
+                    // Expand environment variables in target path
+                    let expandedTarget = mount.target.replace(/\$HOME/g, '/home/claude');
+                    expandedTarget = expandedTarget.replace(/\$(\w+)/g, (match, varName) => {
+                        // For container paths, we need to use container's environment
+                        if (varName === 'HOME')
+                            return '/home/claude';
+                        return match; // Keep other variables as-is
+                    });
+                    // Ensure target path is absolute
+                    const targetPath = node_path_1.default.isAbsolute(expandedTarget)
+                        ? expandedTarget
+                        : node_path_1.default.join('/workspace', expandedTarget);
+                    // Create mount string
+                    const mountString = mount.readonly
+                        ? `${sourcePath}:${targetPath}:ro`
+                        : `${sourcePath}:${targetPath}`;
+                    volumes.push(mountString);
+                    console.log(chalk_1.default.blue(`✓ Mounting ${mount.source} → ${targetPath}${mount.readonly ? ' (read-only)' : ''}`));
+                }
+                catch (error) {
+                    console.error(chalk_1.default.yellow(`⚠ Failed to process mount ${mount.source}:`), error);
+                }
+            }
+        }
+        return volumes;
+    }
+    async _copyWorkingDirectory(container, workDir) {
+        // Helper function to get tar flags safely
+        const getTarFlags = () => {
+            try {
+                // Test if --no-xattrs is supported by checking tar help
+                (0, node_child_process_1.execSync)('tar --help 2>&1 | grep -q no-xattrs', { stdio: 'pipe' });
+                return '--no-xattrs';
+            }
+            catch {
+                // --no-xattrs not supported, use standard tar
+                return '';
+            }
+        };
+        try {
+            // Get list of git-tracked files (including uncommitted changes)
+            const trackedFiles = (0, node_child_process_1.execSync)('git ls-files', {
+                cwd: workDir,
+                encoding: 'utf-8',
+            })
+                .trim()
+                .split('\n')
+                .filter((f) => f);
+            // Get list of untracked files that aren't ignored (only if includeUntracked is true)
+            let untrackedFiles = [];
+            if (this.config.includeUntracked) {
+                untrackedFiles = (0, node_child_process_1.execSync)('git ls-files --others --exclude-standard', {
+                    cwd: workDir,
+                    encoding: 'utf-8',
+                })
+                    .trim()
+                    .split('\n')
+                    .filter((f) => f);
+            }
+            // Combine all files
+            const allFiles = [...trackedFiles, ...untrackedFiles];
+            console.log(chalk_1.default.blue(`• Copying ${allFiles.length} files...`));
+            // Create tar archive using git archive for tracked files + untracked files
+            const tarFile = `/tmp/claude-runner-${Date.now()}.tar`;
+            // First create archive of tracked files using git archive
+            (0, node_child_process_1.execSync)(`git archive --format=tar -o "${tarFile}" HEAD`, {
+                cwd: workDir,
+                stdio: 'pipe',
+            });
+            // Add untracked files if any
+            if (untrackedFiles.length > 0) {
+                // Create a file list for tar
+                const fileListPath = `/tmp/claude-runner-files-${Date.now()}.txt`;
+                fs.writeFileSync(fileListPath, untrackedFiles.join('\n'));
+                // Append untracked files to the tar
+                (0, node_child_process_1.execSync)(`tar -rf "${tarFile}" --files-from="${fileListPath}"`, {
+                    cwd: workDir,
+                    stdio: 'pipe',
+                });
+                fs.unlinkSync(fileListPath);
+            }
+            // Read and copy the tar file in chunks to avoid memory issues
+            const stream = fs.createReadStream(tarFile);
+            // Add timeout for putArchive
+            const uploadPromise = container.putArchive(stream, {
+                path: '/workspace',
+            });
+            // Wait for both upload and stream to complete
+            await Promise.all([
+                uploadPromise,
+                new Promise((resolve, reject) => {
+                    stream.on('end', () => {
+                        resolve();
+                    });
+                    stream.on('error', reject);
+                }),
+            ]);
+            // Clean up
+            fs.unlinkSync(tarFile);
+            // Also copy .git directory to preserve git history
+            console.log(chalk_1.default.blue('• Copying git history...'));
+            const gitTarFile = `/tmp/claude-runner-git-${Date.now()}.tar`;
+            // Exclude macOS resource fork files and .DS_Store when creating git archive
+            // Also strip extended attributes to prevent macOS xattr issues in Docker
+            const tarFlags = getTarFlags();
+            // On macOS, also exclude extended attributes that cause Docker issues
+            const additionalFlags = node_process_1.default.platform === 'darwin' ? '--no-xattrs --no-fflags' : '';
+            const combinedFlags = `${tarFlags} ${additionalFlags}`.trim();
+            (0, node_child_process_1.execSync)(`tar -cf "${gitTarFile}" --exclude="._*" --exclude=".DS_Store" ${combinedFlags} .git`, {
+                cwd: workDir,
+                stdio: 'pipe',
+            });
+            try {
+                const gitStream = fs.createReadStream(gitTarFile);
+                // Upload git archive
+                await container.putArchive(gitStream, {
+                    path: '/workspace',
+                });
+                // Clean up
+                fs.unlinkSync(gitTarFile);
+            }
+            catch (error) {
+                console.error(chalk_1.default.red('✗ Git history copy failed:'), error);
+                // Clean up the tar file even if upload failed
+                try {
+                    fs.unlinkSync(gitTarFile);
+                }
+                catch (e) {
+                    // Ignore cleanup errors
+                }
+                throw error;
+            }
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('✗ Failed to copy files:'), error);
+            throw error;
+        }
+    }
+    async _copyClaudeConfig(container) {
+        // Helper function to get tar flags safely
+        const getTarFlags = () => {
+            try {
+                // Test if --no-xattrs is supported by checking tar help
+                (0, node_child_process_1.execSync)('tar --help 2>&1 | grep -q no-xattrs', { stdio: 'pipe' });
+                return '--no-xattrs';
+            }
+            catch {
+                // --no-xattrs not supported, use standard tar
+                return '';
+            }
+        };
+        try {
+            // First, try to get credentials from macOS Keychain if on Mac
+            if (node_process_1.default.platform === 'darwin') {
+                try {
+                    console.log(chalk_1.default.blue('• Checking macOS Keychain for Claude credentials...'));
+                    const keychainCreds = (0, node_child_process_1.execSync)('security find-generic-password -s "Claude Code-credentials" -w', {
+                        encoding: 'utf-8',
+                        stdio: ['pipe', 'pipe', 'pipe'], // Suppress stderr
+                    }).trim();
+                    if (keychainCreds) {
+                        console.log(chalk_1.default.green('✓ Found Claude credentials in macOS Keychain'));
+                        // Create .claude directory structure
+                        const claudeDirTar = `/tmp/claude-keychain-${Date.now()}.tar`;
+                        const pack = tar_stream_1.default.pack();
+                        // Add .credentials.json to the tar
+                        pack.entry({ name: '.claude/.credentials.json', mode: 0o600 }, keychainCreds, (err) => {
+                            if (err)
+                                throw err;
+                            pack.finalize();
+                        });
+                        const chunks = [];
+                        pack.on('data', (chunk) => chunks.push(chunk));
+                        await new Promise((resolve, reject) => {
+                            pack.on('end', () => {
+                                fs.writeFileSync(claudeDirTar, node_buffer_1.Buffer.concat(chunks));
+                                resolve();
+                            });
+                            pack.on('error', reject);
+                        });
+                        const stream = fs.createReadStream(claudeDirTar);
+                        await container.putArchive(stream, {
+                            path: '/home/claude',
+                        });
+                        fs.unlinkSync(claudeDirTar);
+                        // Fix permissions
+                        await container
+                            .exec({
+                            Cmd: [
+                                '/bin/bash',
+                                '-c',
+                                'sudo mkdir -p /home/claude/.claude && sudo chown -R claude:claude /home/claude/.claude && sudo chmod 700 /home/claude/.claude && sudo chmod 600 /home/claude/.claude/.credentials.json',
+                            ],
+                            AttachStdout: false,
+                            AttachStderr: false,
+                        })
+                            .then(exec => exec.start({}));
+                        console.log(chalk_1.default.green('✓ Claude Keychain credentials copied to container'));
+                    }
+                }
+                catch (error) {
+                    // Keychain access failed or credentials not found - not critical
+                    console.log(chalk_1.default.yellow('• No Claude credentials found in macOS Keychain'));
+                }
+            }
+            // Copy .claude.json if it exists
+            const claudeJsonPath = node_path_1.default.join(os.homedir(), '.claude.json');
+            if (fs.existsSync(claudeJsonPath)) {
+                console.log(chalk_1.default.blue('• Copying .claude.json...'));
+                const configContent = fs.readFileSync(claudeJsonPath, 'utf-8');
+                const tarFile = `/tmp/claude-json-${Date.now()}.tar`;
+                const pack = tar_stream_1.default.pack();
+                pack.entry({ name: '.claude.json', mode: 0o644 }, configContent, (err) => {
+                    if (err)
+                        throw err;
+                    pack.finalize();
+                });
+                const chunks = [];
+                pack.on('data', (chunk) => chunks.push(chunk));
+                await new Promise((resolve, reject) => {
+                    pack.on('end', () => {
+                        fs.writeFileSync(tarFile, node_buffer_1.Buffer.concat(chunks));
+                        resolve();
+                    });
+                    pack.on('error', reject);
+                });
+                const stream = fs.createReadStream(tarFile);
+                await container.putArchive(stream, {
+                    path: '/home/claude',
+                });
+                fs.unlinkSync(tarFile);
+                // Fix permissions
+                await container
+                    .exec({
+                    Cmd: [
+                        '/bin/bash',
+                        '-c',
+                        'sudo chown claude:claude /home/claude/.claude.json && chmod 644 /home/claude/.claude.json',
+                    ],
+                    AttachStdout: false,
+                    AttachStderr: false,
+                })
+                    .then(exec => exec.start({}));
+            }
+            // Copy .claude directory if it exists (but skip if we already copied from Keychain)
+            const claudeDir = node_path_1.default.join(os.homedir(), '.claude');
+            if (fs.existsSync(claudeDir)
+                && fs.statSync(claudeDir).isDirectory()
+                && node_process_1.default.platform !== 'darwin') {
+                console.log(chalk_1.default.blue('• Copying .claude directory...'));
+                const tarFile = `/tmp/claude-dir-${Date.now()}.tar`;
+                const tarFlags = getTarFlags();
+                // On macOS, also exclude extended attributes that cause Docker issues
+                const additionalFlags = node_process_1.default.platform === 'darwin' ? '--no-xattrs --no-fflags' : '';
+                const combinedFlags = `${tarFlags} ${additionalFlags}`.trim();
+                (0, node_child_process_1.execSync)(`tar -cf "${tarFile}" ${combinedFlags} -C "${os.homedir()}" .claude`, {
+                    stdio: 'pipe',
+                });
+                const stream = fs.createReadStream(tarFile);
+                await container.putArchive(stream, {
+                    path: '/home/claude',
+                });
+                fs.unlinkSync(tarFile);
+                // Fix permissions recursively
+                await container
+                    .exec({
+                    Cmd: [
+                        '/bin/bash',
+                        '-c',
+                        'sudo chown -R claude:claude /home/claude/.claude && chmod -R 755 /home/claude/.claude',
+                    ],
+                    AttachStdout: false,
+                    AttachStderr: false,
+                })
+                    .then(exec => exec.start({}));
+            }
+            console.log(chalk_1.default.green('✓ Claude configuration copied successfully'));
+        }
+        catch (error) {
+            console.error(chalk_1.default.yellow('⚠ Failed to copy Claude configuration:'), error);
+            // Don't throw - this is not critical for container operation
+        }
+    }
+    async _copyGitConfig(container) {
+        const gitConfigPath = node_path_1.default.join(os.homedir(), '.gitconfig');
+        try {
+            // Check if the git config file exists
+            if (!fs.existsSync(gitConfigPath)) {
+                return; // No git config to copy
+            }
+            console.log(chalk_1.default.blue('• Copying git configuration...'));
+            // Read the git config file
+            const configContent = fs.readFileSync(gitConfigPath, 'utf-8');
+            // Create a temporary tar file with the git config
+            const tarFile = `/tmp/git-config-${Date.now()}.tar`;
+            const pack = tar_stream_1.default.pack();
+            // Add the .gitconfig file to the tar
+            pack.entry({ name: '.gitconfig', mode: 0o644 }, configContent, (err) => {
+                if (err)
+                    throw err;
+                pack.finalize();
+            });
+            // Write the tar to a file
+            const chunks = [];
+            pack.on('data', (chunk) => chunks.push(chunk));
+            await new Promise((resolve, reject) => {
+                pack.on('end', () => {
+                    fs.writeFileSync(tarFile, node_buffer_1.Buffer.concat(chunks));
+                    resolve();
+                });
+                pack.on('error', reject);
+            });
+            // Copy the tar file to the container's claude user home directory
+            const stream = fs.createReadStream(tarFile);
+            await container.putArchive(stream, {
+                path: '/home/claude', // Copy to claude user's home directory
+            });
+            // Clean up
+            fs.unlinkSync(tarFile);
+            // Fix permissions on the copied file
+            const fixPermsExec = await container.exec({
+                Cmd: [
+                    '/bin/bash',
+                    '-c',
+                    'sudo chown claude:claude /home/claude/.gitconfig',
+                ],
+                AttachStdout: true,
+                AttachStderr: true,
+            });
+            const permStream = await fixPermsExec.start({});
+            // Consume the stream to allow it to complete
+            await new Promise((resolve, reject) => {
+                permStream.on('data', () => { }); // Consume data
+                permStream.on('end', resolve);
+                permStream.on('error', reject);
+            });
+            console.log(chalk_1.default.green('✓ Git configuration copied successfully'));
+        }
+        catch (error) {
+            console.error(chalk_1.default.yellow('⚠ Failed to copy git configuration:'), error);
+            // Don't throw - this is not critical for container operation
+        }
+    }
+    async setupGitAndStartupScript(container, branchName, prFetchRef, remoteFetchRef) {
+        console.log(chalk_1.default.blue('• Setting up git branch and startup script...'));
+        // Determine what to show in the web UI
+        const defaultShell = this.config.defaultShell || 'claude';
+        // Startup script that keeps session alive
+        const startupScript = defaultShell === 'claude'
+            ? `#!/bin/bash
+echo "🚀 Starting Claude Code..."
+echo "Press Ctrl+C to drop to bash shell"
+echo ""
+
+# Run Claude but don't replace the shell process
+claude --dangerously-skip-permissions
+
+# After Claude exits, drop to bash
+echo ""
+echo "Claude exited. You're now in bash shell."
+echo "Type 'claude --dangerously-skip-permissions' to restart Claude"
+echo "Type 'exit' to end the session"
+echo ""
+exec /bin/bash`
+            : `#!/bin/bash
+echo "Welcome to Claude Code Sandbox!"
+echo "Type 'claude --dangerously-skip-permissions' to start Claude Code"
+echo "Type 'exit' to end the session"
+echo ""
+exec /bin/bash`;
+        const setupExec = await container.exec({
+            Cmd: [
+                '/bin/bash',
+                '-c',
+                `
+        cd /workspace &&
+        sudo chown -R claude:claude /workspace &&
+        git config --global --add safe.directory /workspace &&
+        # Clean up macOS resource fork files in git pack directory
+        find .git/objects/pack -name "._pack-*.idx" -type f -delete 2>/dev/null || true &&
+        # Configure git to use GitHub token if available
+        if [ -n "$GITHUB_TOKEN" ]; then
+          git config --global url."https://\${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global url."https://\${GITHUB_TOKEN}@github.com/".insteadOf "git@github.com:"
+          echo "✓ Configured git to use GitHub token"
+        fi &&
+        # Handle different branch setup scenarios
+        if [ -n "${prFetchRef || ''}" ]; then
+          echo "• Fetching PR branch..." &&
+          git fetch origin ${prFetchRef} &&
+          if git show-ref --verify --quiet refs/heads/"${branchName}"; then
+            git checkout "${branchName}" &&
+            echo "✓ Switched to existing PR branch: ${branchName}"
+          else
+            git checkout "${branchName}" &&
+            echo "✓ Checked out PR branch: ${branchName}"
+          fi
+        elif [ -n "${remoteFetchRef || ''}" ]; then
+          echo "• Fetching remote branch..." &&
+          git fetch origin &&
+          if git show-ref --verify --quiet refs/heads/"${branchName}"; then
+            git checkout "${branchName}" &&
+            git pull origin "${branchName}" &&
+            echo "✓ Switched to existing remote branch: ${branchName}"
+          else
+            git checkout -b "${branchName}" "${remoteFetchRef}" &&
+            echo "✓ Created local branch from remote: ${branchName}"
+          fi
+        else
+          # Regular branch creation
+          if git show-ref --verify --quiet refs/heads/"${branchName}"; then
+            git checkout "${branchName}" &&
+            echo "✓ Switched to existing branch: ${branchName}"
+          else
+            git checkout -b "${branchName}" &&
+            echo "✓ Created new branch: ${branchName}"
+          fi
+        fi &&
+        cat > /home/claude/start-session.sh << 'EOF'
+${startupScript}
+EOF
+        chmod +x /home/claude/start-session.sh &&
+        echo "✓ Startup script created"
+      `,
+            ],
+            AttachStdout: true,
+            AttachStderr: true,
+        });
+        const setupStream = await setupExec.start({});
+        // Wait for setup to complete
+        await new Promise((resolve, reject) => {
+            let output = '';
+            setupStream.on('data', (chunk) => {
+                output += chunk.toString();
+                node_process_1.default.stdout.write(chunk);
+            });
+            setupStream.on('end', () => {
+                if ((output.includes('✓ Created new branch')
+                    || output.includes('✓ Switched to existing branch')
+                    || output.includes('✓ Switched to existing remote branch')
+                    || output.includes('✓ Switched to existing PR branch')
+                    || output.includes('✓ Checked out PR branch')
+                    || output.includes('✓ Created local branch from remote'))
+                    && output.includes('✓ Startup script created')) {
+                    resolve();
+                }
+                else {
+                    reject(new Error('Setup failed'));
+                }
+            });
+            setupStream.on('error', reject);
+        });
+        console.log(chalk_1.default.green('✓ Git and startup script setup completed'));
+    }
+    async runSetupCommands(container) {
+        // Execute custom setup commands if provided
+        if (this.config.setupCommands && this.config.setupCommands.length > 0) {
+            console.log(chalk_1.default.blue('• Running custom setup commands...'));
+            console.log(chalk_1.default.blue(`  Total commands to run: ${this.config.setupCommands.length}`));
+            for (let i = 0; i < this.config.setupCommands.length; i++) {
+                const command = this.config.setupCommands[i];
+                console.log(chalk_1.default.yellow(`\n[${i + 1}/${this.config.setupCommands.length}] Running command:`));
+                console.log(chalk_1.default.white(`  ${command}`));
+                const cmdExec = await container.exec({
+                    Cmd: ['/bin/bash', '-c', command],
+                    AttachStdout: true,
+                    AttachStderr: true,
+                    WorkingDir: '/workspace',
+                    User: 'claude',
+                });
+                const cmdStream = await cmdExec.start({});
+                // Wait for command to complete
+                await new Promise((resolve, reject) => {
+                    let hasError = false;
+                    cmdStream.on('data', (chunk) => {
+                        node_process_1.default.stdout.write(`  > ${chunk.toString()}`);
+                    });
+                    cmdStream.on('end', async () => {
+                        // Check exit code
+                        try {
+                            const info = await cmdExec.inspect();
+                            if (info.ExitCode !== 0) {
+                                console.error(chalk_1.default.red(`✗ Command failed with exit code ${info.ExitCode}`));
+                                hasError = true;
+                            }
+                            else {
+                                console.log(chalk_1.default.green(`✓ Command completed successfully`));
+                            }
+                        }
+                        catch (e) {
+                            // Ignore inspection errors
+                        }
+                        if (hasError && this.config.setupCommands?.includes('set -e')) {
+                            reject(new Error(`Setup command failed: ${command}`));
+                        }
+                        else {
+                            resolve();
+                        }
+                    });
+                    cmdStream.on('error', reject);
+                });
+            }
+            console.log(chalk_1.default.green('✓ All setup commands completed'));
+        }
+    }
+    async cleanup() {
+        for (const [, container] of this.containers) {
+            try {
+                await container.stop();
+                await container.remove();
+            }
+            catch (error) {
+                // Container might already be stopped
+            }
+        }
+        this.containers.clear();
+    }
+}
+exports.ContainerManager = ContainerManager;
+//# sourceMappingURL=container.js.map