devchain-cli 0.24.1 → 0.25.0

package/dist/server/modules/remotes/docker/docker-plan-source.service.js

@@ -5,29 +5,85 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DockerAvailabilityError = exports.DockerPlanSourceService = exports.DOCKER_PLAN_REUSE_MS = void 0;
+exports.DockerAvailabilityError = exports.DockerPlanSourceService = exports.DOCKER_PLAN_REUSE_MS = exports.unknownSize = void 0;
+exports.containerProjectLinks = containerProjectLinks;
+exports.composeLabelSet = composeLabelSet;
 exports.reusable = reusable;
 const common_1 = require("@nestjs/common");
 const node_child_process_1 = require("node:child_process");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const process_executor_port_1 = require("../../terminal/services/process-executor/process-executor.port");
 const docker_engine_client_1 = require("../../core/controllers/docker-engine.client");
 const docker_settings_1 = require("../../core/controllers/docker-settings");
 const host_docker_dto_1 = require("../host/host-docker.dto");
+const docker_ownership_1 = require("./docker-ownership");
 const docker_plan_files_1 = require("./docker-plan-files");
+const docker_project_compose_1 = require("./docker-project-compose");
 const docker_plan_dto_1 = require("./docker-plan.dto");
+const AGGREGATE_OWNERSHIP_CLASSES = [
+    'needs-user-fix',
+    'follows-user',
+    'image-user-hint',
+];
+function containerProjectLinks(root, inspect) {
+    return (0, docker_project_compose_1.composeRootLinks)((inspect.Config.Labels ?? {}), root);
+}
+function composeLabelSet(root, container) {
+    const labels = (container.Config.Labels ?? {});
+    const encoded = labels[`${host_docker_dto_1.COMPOSE_PROJECT_LABEL}.config_files`];
+    if (!encoded)
+        return null;
+    const directory = (0, node_path_1.resolve)(labels[`${host_docker_dto_1.COMPOSE_PROJECT_LABEL}.working_dir`] || root);
+    const files = encoded
+        .split(',')
+        .filter(Boolean)
+        .map((file) => (0, node_path_1.resolve)(directory, file));
+    if (!files.length)
+        return null;
+    return { directory, files, service: labels[host_docker_dto_1.COMPOSE_SERVICE_LABEL] || null };
+}
+function buildsInProject(root, service) {
+    if (!service || Object.hasOwn(service, 'image'))
+        return false;
+    const build = service.build;
+    return (typeof build === 'object' &&
+        build !== null &&
+        'context' in build &&
+        typeof build.context === 'string' &&
+        (0, node_path_1.isAbsolute)(build.context) &&
+        (0, docker_plan_files_1.within)(root, build.context));
+}
+async function hasRootCompose(root) {
+    for (const name of docker_project_compose_1.DEFAULT_COMPOSE_FILES) {
+        if (await (0, promises_1.access)((0, node_path_1.join)(root, name)).then(() => true, () => false))
+            return true;
+    }
+    return false;
+}
 const unknownSize = () => ({ bytes: 0, unknown: true });
+exports.unknownSize = unknownSize;
 const size = (value) => typeof value === 'number' && value >= 0 && Number.isFinite(value)
     ? { bytes: value, unknown: false }
-    : unknownSize();
+    : (0, exports.unknownSize)();
 exports.DOCKER_PLAN_REUSE_MS = 120_000;
 function reusable(at) {
     return Date.now() - at < exports.DOCKER_PLAN_REUSE_MS;
 }
 let DockerPlanSourceService = class DockerPlanSourceService {
+    executor;
+    constructor(executor) {
+        this.executor = executor;
+    }
     recent = null;
+    invalidate() {
+        this.recent = null;
+    }
     async connect(signal) {
         let socket;
         try {
@@ -56,6 +112,63 @@ let DockerPlanSourceService = class DockerPlanSourceService {
         }
         return client;
     }
+    async presence(root, signal) {
+        signal?.throwIfAborted();
+        if (await hasRootCompose(root)) {
+            signal?.throwIfAborted();
+            return { state: 'present' };
+        }
+        const deadline = AbortSignal.timeout(5000);
+        const scanSignal = signal ? AbortSignal.any([signal, deadline]) : deadline;
+        let onAbort;
+        try {
+            let socket;
+            try {
+                socket = await Promise.race([
+                    this.socket(),
+                    new Promise((_resolve, reject) => {
+                        onAbort = () => reject(scanSignal.reason);
+                        scanSignal.addEventListener('abort', onAbort, { once: true });
+                        if (scanSignal.aborted)
+                            onAbort();
+                    }),
+                ]);
+            }
+            catch (error) {
+                if (scanSignal.aborted)
+                    throw error;
+                return { state: 'absent' };
+            }
+            try {
+                const containers = await new docker_engine_client_1.DockerEngineClient(socket).json('GET', '/containers/json?all=true', undefined, { signal: scanSignal });
+                return {
+                    state: containers.some((container) => (0, docker_project_compose_1.containerLinksProject)(container.Labels, container.Mounts, root))
+                        ? 'present'
+                        : 'absent',
+                };
+            }
+            catch (error) {
+                if (scanSignal.aborted)
+                    throw error;
+                const failure = await socketAvailability(socket, error);
+                return {
+                    state: failure instanceof DockerAvailabilityError &&
+                        (failure.reason === 'no-socket' || failure.reason === 'no-socket-access')
+                        ? 'absent'
+                        : 'unknown',
+                };
+            }
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            return { state: 'unknown' };
+        }
+        finally {
+            if (onAbort)
+                scanSignal.removeEventListener('abort', onAbort);
+        }
+    }
     socket() {
         return (0, docker_engine_client_1.resolveDockerSocket)();
     }
@@ -65,26 +178,34 @@ let DockerPlanSourceService = class DockerPlanSourceService {
     uid() {
         return process.getuid?.() ?? null;
     }
+    gid() {
+        return process.getgid?.() ?? null;
+    }
     measure(path, signal) {
         return (0, docker_plan_files_1.measureDockerBind)(path, undefined, signal);
     }
-    async compose(root) {
-        let file;
-        for (const name of [
-            'compose.yaml',
-            'compose.yml',
-            'docker-compose.yml',
-            'docker-compose.yaml',
-        ]) {
-            if (await (0, promises_1.access)((0, node_path_1.join)(root, name)).then(() => true, () => false)) {
-                file = name;
-                break;
-            }
+    async compose(root, options = {}) {
+        if (!options.files?.length) {
+            if (!(await hasRootCompose(root)))
+                return null;
         }
-        if (!file)
-            return null;
         return new Promise((resolveConfig, reject) => {
-            (0, node_child_process_1.execFile)('docker', ['compose', '--project-directory', root, 'config', '--format', 'json'], { cwd: root, timeout: 30_000, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => {
+            (0, node_child_process_1.execFile)('docker', [
+                'compose',
+                '--project-directory',
+                root,
+                ...(options.files?.flatMap((path) => ['-f', path]) ?? []),
+                ...(options.allProfiles ? ['--profile', '*'] : []),
+                'config',
+                '--format',
+                'json',
+            ], {
+                cwd: root,
+                timeout: 30_000,
+                maxBuffer: 16 * 1024 * 1024,
+                signal: options.signal,
+                env: options.env ? { ...process.env, ...options.env } : undefined,
+            }, (error, stdout) => {
                 if (error)
                     return reject(new docker_engine_client_1.DockerEngineError('unavailable', 'Cannot read project Docker Compose configuration'));
                 try {
@@ -97,10 +218,66 @@ let DockerPlanSourceService = class DockerPlanSourceService {
                     reject(new docker_engine_client_1.DockerEngineError('invalid-response', 'Invalid Docker Compose configuration'));
                 }
             });
+        }).catch((error) => {
+            if (options.allProfiles &&
+                !options.signal?.aborted &&
+                error instanceof docker_engine_client_1.DockerEngineError &&
+                error.code === 'unavailable')
+                return this.compose(root, { ...options, allProfiles: false });
+            throw error;
         });
     }
-    async scan(client, root, signal, { reuse = false } = {}) {
+    async scan(client, root, signal, { reuse = false, previousBindPaths = [], dataBindPaths = [], ownership, } = {}) {
         const recent = reuse && this.recent && reusable(this.recent.at) ? this.recent : null;
+        const composeCache = new Map(recent?.compose);
+        const readCompose = async (directory, files, ids) => {
+            const key = JSON.stringify([(0, node_path_1.resolve)(directory), files, ids]);
+            if (!composeCache.has(key)) {
+                const config = await this.compose(directory, {
+                    files,
+                    signal,
+                    ...(ids
+                        ? {
+                            allProfiles: true,
+                            env: {
+                                ...process.env,
+                                DEVCHAIN_UID: String(ids.uid),
+                                DEVCHAIN_GID: String(ids.gid),
+                            },
+                        }
+                        : {}),
+                }).catch((error) => (error instanceof Error ? error : new Error(String(error))));
+                signal?.throwIfAborted();
+                composeCache.set(key, config);
+            }
+            return composeCache.get(key);
+        };
+        const composeOwnershipSets = new Map();
+        const readOwnershipCompose = async (directory, files) => {
+            if (!ownership)
+                return undefined;
+            const key = JSON.stringify([(0, node_path_1.resolve)(directory), files]);
+            if (!composeOwnershipSets.has(key)) {
+                const [home, vm] = await Promise.all([
+                    readCompose(directory, files, ownership.home),
+                    readCompose(directory, files, ownership.vm),
+                ]);
+                composeOwnershipSets.set(key, home && vm && !(home instanceof Error) && !(vm instanceof Error)
+                    ? { state: 'resolved', directory, files, home, vm }
+                    : {
+                        state: 'unresolved',
+                        directory,
+                        files,
+                        home: home instanceof Error ? null : home,
+                        vm: vm instanceof Error ? null : vm,
+                        issue: {
+                            code: 'compose-ownership-unreadable',
+                            message: 'Cannot resolve Docker Compose ownership with both home and VM user ids. Fix the Compose configuration and verify again.',
+                        },
+                    });
+            }
+            return composeOwnershipSets.get(key);
+        };
         const [listed, usage, volumes, composeAttempt] = await Promise.all([
             client.json('GET', '/containers/json?all=true', undefined, { signal }),
             recent?.usage ?? client.diskUsage(signal),
@@ -108,7 +285,10 @@ let DockerPlanSourceService = class DockerPlanSourceService {
             this.compose(root).catch((error) => (error instanceof Error ? error : new Error(String(error)))),
         ]);
         const items = [];
+        const ownershipConsumers = [];
+        const ownershipInputs = new Map();
         const imageCache = new Map();
+        const imageUsers = new Map();
         const bindCache = new Map(recent?.folders);
         const image = async (ref) => {
             let result = imageCache.get(ref);
@@ -122,6 +302,7 @@ let DockerPlanSourceService = class DockerPlanSourceService {
                     size: size(usage.Images?.find((entry) => entry.Id === info.Id)?.Size),
                 };
                 imageCache.set(ref, result);
+                imageUsers.set(ref, info.Config?.User);
             }
             return result;
         };
@@ -133,22 +314,44 @@ let DockerPlanSourceService = class DockerPlanSourceService {
             driver: volumes.Volumes?.find((v) => v.Name === name)?.Driver ?? 'unknown',
             size: size(usage.Volumes?.find((v) => v.Name === name)?.UsageData?.Size),
         });
-        const inspects = await Promise.all(listed.map((entry) => client.json('GET', `/containers/${encodeURIComponent(entry.Id)}/json`, undefined, { signal })));
+        const linked = new Set(listed
+            .filter((entry) => (0, docker_project_compose_1.containerLinksProject)(entry.Labels, entry.Mounts, root))
+            .map((entry) => entry.Id));
+        const writableLayers = new Map(recent?.writableLayers);
+        const inspects = await Promise.all(listed.map(async (entry) => {
+            const measureLayer = linked.has(entry.Id) && !writableLayers.has(entry.Id);
+            const inspect = await client.json('GET', `/containers/${encodeURIComponent(entry.Id)}/json${measureLayer ? '?size=true' : ''}`, undefined, { signal });
+            if (measureLayer)
+                writableLayers.set(entry.Id, size(inspect.SizeRw));
+            return inspect;
+        }));
+        const networkNames = [
+            ...new Set(inspects.flatMap((inspect) => Object.keys(inspect.NetworkSettings?.Networks ?? {}).filter((name) => !docker_settings_1.DEFAULT_NETWORKS.has(name)))),
+        ];
+        const networkSubnets = new Map(await Promise.all(networkNames.map(async (name) => {
+            const network = await client.json('GET', `/networks/${encodeURIComponent(name)}`, undefined, { signal });
+            return [name, (0, docker_settings_1.ipv4Ranges)(network.IPAM?.Config).map((range) => range.Subnet)];
+        })));
         for (const inspect of inspects) {
             const item = baseItem(inspect.Id, inspect.Name.replace(/^\//, ''), 'container');
+            for (const [name, endpoint] of Object.entries(inspect.NetworkSettings?.Networks ?? {})) {
+                if (docker_settings_1.DEFAULT_NETWORKS.has(name))
+                    continue;
+                const address = (0, docker_settings_1.fixedIPv4Address)(endpoint);
+                const subnets = networkSubnets.get(name) ?? [];
+                (item.networks ??= []).push({ name, subnets });
+                if (address)
+                    (item.fixedIPv4 ??= []).push({ network: name, address, subnets });
+            }
             const labels = (inspect.Config.Labels ?? {});
             item.composeProject = labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL] ?? null;
             item.temporary = inspect.HostConfig.AutoRemove === true;
+            if (inspect.HostConfig.Privileged === true)
+                item.privileged = true;
             if (item.temporary)
                 item.notes.push(docker_plan_dto_1.DOCKER_TEMPORARY_NOTE);
             item.notes.push(docker_plan_dto_1.DOCKER_WRITABLE_LAYER_NOTE);
-            for (const key of [
-                `${host_docker_dto_1.COMPOSE_PROJECT_LABEL}.working_dir`,
-                `${host_docker_dto_1.COMPOSE_PROJECT_LABEL}.config_files`,
-            ]) {
-                if (labels[key]?.split(',').some((path) => path.startsWith('/') && (0, docker_plan_files_1.within)(root, path)))
-                    item.linkedReasons.push(key);
-            }
+            item.linkedReasons.push(...containerProjectLinks(root, inspect));
             try {
                 (0, docker_settings_1.projectDockerCreate)(inspect, client.socketPath);
             }
@@ -167,33 +370,49 @@ let DockerPlanSourceService = class DockerPlanSourceService {
                 }
             }
             item.images = [await image(inspect.Image)];
-            item.writableLayer = size(usage.Containers?.find((c) => c.Id === inspect.Id)?.SizeRw);
-            const user = String(inspect.Config.User ?? '').split(':')[0];
-            if (this.uid() !== null && user === String(this.uid()))
-                item.warnings.push({ code: 'home-uid', message: 'Container runs as the home user uid.' });
+            item.writableLayer = linked.has(inspect.Id)
+                ? (writableLayers.get(inspect.Id) ?? (0, exports.unknownSize)())
+                : (0, exports.unknownSize)();
             for (const mount of inspect.Mounts ?? []) {
                 if (mount.Type === 'volume') {
                     const named = explicitlyNamed(inspect, mount) ||
-                        Boolean(volumes.Volumes?.find((v) => v.Name === mount.Name)?.Labels?.['com.docker.compose.volume']);
+                        Boolean(volumes.Volumes?.find((v) => v.Name === mount.Name)?.Labels?.[host_docker_dto_1.COMPOSE_VOLUME_LABEL]);
                     item.mounts.push(volumeMount(mount.Name ?? mount.Source, mount.Destination, named, !mount.RW));
                 }
                 else if (mount.Type === 'bind') {
                     const source = (0, node_path_1.resolve)(mount.Source);
-                    const kind = this.bindKind(root, source, !mount.RW);
-                    if (kind === 'project-bind')
+                    const kind = await this.bindKind(root, source, !mount.RW, dataBindPaths, signal);
+                    if (kind === 'project-bind' || kind === 'project-code')
                         item.linkedReasons.push(`bind:${source}`);
-                    const copyable = docker_plan_dto_1.COPYABLE_MOUNT_KINDS.includes(kind);
-                    if (copyable && !bindCache.has(source))
-                        bindCache.set(source, await this.measure(source, signal));
                     item.mounts.push({
                         kind,
                         source,
                         destination: mount.Destination,
                         readOnly: !mount.RW,
-                        size: copyable ? (bindCache.get(source) ?? unknownSize()) : unknownSize(),
+                        size: (0, exports.unknownSize)(),
                     });
                 }
             }
+            const composeSet = item.linkedReasons.length ? composeLabelSet(root, inspect) : null;
+            if (composeSet?.service) {
+                const configs = await readOwnershipCompose(composeSet.directory, composeSet.files);
+                if (configs?.state === 'unresolved')
+                    item.blockers.push(configs.issue);
+                ownershipInputs.set(item.id, {
+                    inspect,
+                    compose: { ...composeSet, service: composeSet.service },
+                    configs,
+                });
+                const config = configs?.home ?? (await readCompose(composeSet.directory, composeSet.files));
+                if (configs?.state === 'unresolved' && config && !(config instanceof Error))
+                    configs.fallback = config;
+                if (!(config instanceof Error) &&
+                    buildsInProject(root, config?.services?.[composeSet.service]))
+                    item.buildsFromProject = true;
+            }
+            if (!ownershipInputs.has(item.id))
+                ownershipInputs.set(item.id, { inspect });
+            item.runtimeUser = inspect.Config.User;
             items.push(item);
         }
         if (composeAttempt instanceof Error) {
@@ -201,6 +420,8 @@ let DockerPlanSourceService = class DockerPlanSourceService {
             const item = baseItem(`compose:${name}`, name, 'compose-project');
             item.composeProject = name;
             item.linkedReasons.push('compose-file-at-project-root');
+            if (ownership)
+                item.ownership = { ...ownership, class: 'exact' };
             item.blockers.push({
                 code: 'compose-unreadable',
                 message: `${name}: ${composeAttempt.message}`,
@@ -210,9 +431,15 @@ let DockerPlanSourceService = class DockerPlanSourceService {
         else if (composeAttempt &&
             !items.some((item) => item.composeProject === composeAttempt.name)) {
             const compose = composeAttempt;
+            const configs = await readOwnershipCompose(root, []);
             const item = baseItem(`compose:${compose.name}`, compose.name, 'compose-project');
             item.composeProject = compose.name;
             item.linkedReasons.push('compose-file-at-project-root');
+            if (configs?.state === 'unresolved') {
+                configs.fallback = compose;
+                item.blockers.push(configs.issue);
+                item.ownership = { ...ownership, class: 'exact', refusalReasons: [configs.issue] };
+            }
             item.notes.push('compose up recreates the containers on the VM. Only existing volumes and present images are copied.');
             for (const [service, config] of Object.entries(compose.services ?? {})) {
                 try {
@@ -231,8 +458,169 @@ let DockerPlanSourceService = class DockerPlanSourceService {
                 if (volumes.Volumes?.some((v) => v.Name === name))
                     item.mounts.push(volumeMount(name, '', true, false));
             }
+            for (const config of Object.values(compose.services ?? {}))
+                for (const mount of config.volumes ?? []) {
+                    if (mount.type !== 'bind' || !mount.source)
+                        continue;
+                    const source = (0, node_path_1.resolve)(root, mount.source);
+                    if (!(0, docker_plan_files_1.strictlyWithin)(root, source) ||
+                        !previousBindPaths.some((path) => (0, docker_plan_files_1.within)(path, source) || (0, docker_plan_files_1.within)(source, path)))
+                        continue;
+                    item.mounts.push({
+                        kind: await this.bindKind(root, source, mount.read_only ?? false, dataBindPaths, signal),
+                        source,
+                        destination: mount.target ?? '',
+                        readOnly: mount.read_only ?? false,
+                        size: (0, exports.unknownSize)(),
+                    });
+                }
             items.push(item);
         }
+        const previous = await Promise.all([...new Set(previousBindPaths)]
+            .filter((path) => (0, docker_plan_files_1.within)(root, path))
+            .map(async (path) => ({
+            source: path,
+            kind: await this.bindKind(root, path, false, dataBindPaths, signal),
+        })));
+        const projectMounts = items
+            .flatMap((item) => item.mounts)
+            .filter((mount) => mount.kind === 'project-bind' || mount.kind === 'project-code');
+        const dataPaths = [
+            ...projectMounts
+                .filter((mount) => mount.kind === 'project-bind')
+                .map((mount) => mount.source),
+            ...previous.filter((mount) => mount.kind === 'project-bind').map((mount) => mount.source),
+            ...dataBindPaths.filter((path) => (0, docker_plan_files_1.strictlyWithin)(root, path)),
+        ];
+        const classified = [...projectMounts, ...previous];
+        for (const mount of classified)
+            if (mount.kind === 'project-code' && dataPaths.some((path) => (0, docker_plan_files_1.within)(path, mount.source)))
+                mount.kind = 'project-bind';
+        const codePaths = [
+            ...new Set(classified.filter((mount) => mount.kind === 'project-code').map((mount) => mount.source)),
+        ];
+        if (ownership) {
+            for (const item of items) {
+                const input = ownershipInputs.get(item.id);
+                if (!input)
+                    continue;
+                const { inspect, compose, configs } = input;
+                const imageUser = imageUsers.get(inspect.Image);
+                const homeService = compose ? configs?.home?.services?.[compose.service] : undefined;
+                const vmService = compose ? configs?.vm?.services?.[compose.service] : undefined;
+                item.ownership = item.linkedReasons.length
+                    ? (0, docker_ownership_1.classifyDockerOwnership)(ownership, item.runtimeUser, imageUser, item.mounts.some((mount) => mount.kind === 'project-code'), compose && configs?.state === 'resolved'
+                        ? {
+                            source: compose,
+                            homeUser: homeService?.user,
+                            vmUser: vmService?.user,
+                            vmGroupAdd: vmService?.group_add,
+                        }
+                        : undefined, item.composeProject !== null, (inspect.HostConfig.GroupAdd ?? []).map(String))
+                    : { ...ownership, class: 'exact' };
+                if (configs?.state === 'unresolved') {
+                    item.ownership.compose = compose;
+                    item.ownership.refusalReasons = [configs.issue];
+                }
+                ownershipConsumers.push({
+                    name: item.name,
+                    itemId: item.id,
+                    ownership: item.ownership,
+                    user: homeService?.user ?? item.runtimeUser,
+                    imageUser,
+                    literalHomeUser: Boolean(configs?.state === 'resolved' &&
+                        (0, docker_ownership_1.literalHomeComposeUser)(ownership, homeService?.user, vmService?.user)),
+                    volumes: item.mounts
+                        .filter((mount) => (0, docker_plan_dto_1.isVolumeMount)(mount.kind))
+                        .map((mount) => mount.source),
+                    bindPaths: item.mounts
+                        .filter((mount) => !(0, docker_plan_dto_1.isVolumeMount)(mount.kind))
+                        .map((mount) => mount.source),
+                });
+            }
+            for (const set of composeOwnershipSets.values()) {
+                const config = set.home ?? set.vm ?? (set.state === 'unresolved' ? set.fallback : null);
+                if (!config)
+                    continue;
+                const aggregate = items.find((item) => item.kind === 'compose-project' && item.composeProject === config.name);
+                for (const [service, serviceConfig] of Object.entries(config.services ?? {})) {
+                    const inspected = [...ownershipInputs.values()].find((input) => input.configs === set && input.compose?.service === service);
+                    const ref = inspected?.inspect.Image ?? serviceConfig.image ?? `${config.name}-${service}`;
+                    let imageUser = imageUsers.get(ref);
+                    if (!imageCache.has(ref)) {
+                        try {
+                            await image(ref);
+                            imageUser = imageUsers.get(ref);
+                        }
+                        catch (error) {
+                            if (!(0, docker_engine_client_1.isDockerNotFound)(error))
+                                throw error;
+                        }
+                    }
+                    const mounts = await Promise.all((serviceConfig.volumes ?? []).map(async (mount) => ({
+                        ...mount,
+                        kind: mount.type === 'bind' && mount.source
+                            ? await this.bindKind(root, (0, node_path_1.resolve)(set.directory, mount.source), mount.read_only ?? false, dataBindPaths, signal)
+                            : undefined,
+                    })));
+                    const vmConfig = set.vm?.services?.[service];
+                    const decision = set.state === 'resolved'
+                        ? (0, docker_ownership_1.classifyDockerOwnership)(ownership, serviceConfig.user ?? imageUser, imageUser, mounts.some((mount) => mount.kind === 'project-code'), {
+                            source: { directory: set.directory, files: set.files, service },
+                            homeUser: serviceConfig.user,
+                            vmUser: vmConfig?.user,
+                            vmGroupAdd: vmConfig?.group_add,
+                        }, true)
+                        : {
+                            ...ownership,
+                            class: 'exact',
+                            compose: { directory: set.directory, files: set.files, service },
+                            refusalReasons: [set.issue],
+                        };
+                    if (aggregate)
+                        (aggregate.serviceOwnership ??= []).push({ service, ownership: decision });
+                    ownershipConsumers.push({
+                        name: `${config.name}/${service}`,
+                        itemId: aggregate?.id,
+                        user: serviceConfig.user ?? imageUser,
+                        imageUser,
+                        ownership: decision,
+                        literalHomeUser: set.state === 'resolved' &&
+                            (0, docker_ownership_1.literalHomeComposeUser)(ownership, serviceConfig.user, vmConfig?.user),
+                        volumes: mounts
+                            .filter((mount) => mount.type === 'volume' && mount.source)
+                            .map((mount) => {
+                            const volume = config.volumes?.[mount.source];
+                            return (volume?.name ??
+                                (volume?.external ? mount.source : `${config.name}_${mount.source}`));
+                        }),
+                        bindPaths: mounts
+                            .filter((mount) => mount.type === 'bind' && mount.source)
+                            .map((mount) => (0, node_path_1.resolve)(set.directory, mount.source)),
+                    });
+                }
+                if (aggregate) {
+                    const classes = aggregate.serviceOwnership?.map((entry) => entry.ownership.class) ?? [];
+                    aggregate.ownership = {
+                        ...ownership,
+                        ...(set.state === 'unresolved' ? { refusalReasons: [set.issue] } : {}),
+                        class: AGGREGATE_OWNERSHIP_CLASSES.find((cls) => classes.includes(cls)) ?? 'exact',
+                    };
+                }
+            }
+        }
+        for (const mount of items.flatMap((item) => item.mounts)) {
+            if ((0, docker_plan_dto_1.isVolumeMount)(mount.kind))
+                continue;
+            if (docker_plan_dto_1.COPYABLE_MOUNT_KINDS.includes(mount.kind)) {
+                if (!bindCache.has(mount.source))
+                    bindCache.set(mount.source, await this.measure(mount.source, signal));
+                mount.size = bindCache.get(mount.source) ?? (0, exports.unknownSize)();
+            }
+            else if (mount.kind === 'project-code') {
+                mount.size = { bytes: 0, unknown: false };
+            }
+        }
         for (const item of items) {
             const group = [item];
             for (const member of group)
@@ -242,11 +630,18 @@ let DockerPlanSourceService = class DockerPlanSourceService {
             item.writerGroup = group.map((member) => member.id).sort();
         }
         const folders = new Map([...bindCache].filter(([, size]) => !size.unknown));
-        this.recent = { at: recent?.at ?? Date.now(), usage, folders };
+        this.recent = {
+            at: recent?.at ?? Date.now(),
+            usage,
+            writableLayers: new Map([...writableLayers].filter(([, size]) => !size.unknown)),
+            folders,
+            compose: composeCache,
+        };
         return {
             items,
             homePath: this.homePath(),
-            uid: this.uid(),
+            codePaths,
+            ...(ownership ? { ownershipConsumers } : {}),
             holders: inspects.map((c) => ({
                 volumes: (c.Mounts ?? []).filter((m) => m.Type === 'volume').map((m) => m.Name ?? m.Source),
                 bindPaths: (c.Mounts ?? []).filter((m) => m.Type === 'bind').map((m) => m.Source),
@@ -254,9 +649,35 @@ let DockerPlanSourceService = class DockerPlanSourceService {
             })),
         };
     }
-    bindKind(root, source, readOnly) {
-        if ((0, docker_plan_files_1.within)(root, source))
-            return 'project-bind';
+    async bindKind(root, source, readOnly, dataBindPaths, signal) {
+        signal?.throwIfAborted();
+        if ((0, node_path_1.resolve)(root) === (0, node_path_1.resolve)(source))
+            return 'project-code';
+        if ((0, docker_plan_files_1.within)(root, source)) {
+            if (dataBindPaths.some((path) => (0, node_path_1.resolve)(path) === (0, node_path_1.resolve)(source)))
+                return 'project-bind';
+            try {
+                const result = await this.executor.run({
+                    argv: ['git', 'ls-files', '-z', '--', `:(literal)${(0, node_path_1.relative)(root, source)}`],
+                    mode: 'pipe',
+                    cwd: root,
+                    timeout: 10_000,
+                    outputLimits: { maxBytes: 4096 },
+                });
+                signal?.throwIfAborted();
+                if (result.success) {
+                    const tracked = result.truncated ||
+                        result.stdout
+                            .split('\0')
+                            .some((path) => path && !['.gitkeep', '.keep', '.gitignore'].includes((0, node_path_1.basename)(path)));
+                    return tracked ? 'project-code' : 'project-bind';
+                }
+            }
+            catch {
+                signal?.throwIfAborted();
+            }
+            return readOnly ? 'project-code' : 'project-bind';
+        }
         if ((0, docker_plan_files_1.within)(this.homePath(), source))
             return 'home-bind';
         return readOnly ? 'readonly-external-bind' : 'external-bind';
@@ -282,7 +703,8 @@ let DockerPlanSourceService = class DockerPlanSourceService {
 };
 exports.DockerPlanSourceService = DockerPlanSourceService;
 exports.DockerPlanSourceService = DockerPlanSourceService = __decorate([
-    (0, common_1.Injectable)()
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [process_executor_port_1.ProcessExecutor])
 ], DockerPlanSourceService);
 class DockerAvailabilityError extends docker_engine_client_1.DockerEngineError {
     reason;
@@ -347,15 +769,17 @@ function explicitlyNamed(inspect, mount) {
 }
 function sharesData(a, b) {
     const copied = (mount) => docker_plan_dto_1.COPYABLE_MOUNT_KINDS.includes(mount.kind);
-    return a.mounts.some((x) => copied(x) &&
-        b.mounts.some((y) => {
-            if (!copied(y) || (x.readOnly && y.readOnly))
-                return false;
-            const xv = (0, docker_plan_dto_1.isVolumeMount)(x.kind);
-            const yv = (0, docker_plan_dto_1.isVolumeMount)(y.kind);
-            return xv && yv
-                ? x.source === y.source
-                : !xv && !yv && ((0, docker_plan_files_1.within)(x.source, y.source) || (0, docker_plan_files_1.within)(y.source, x.source));
-        }));
+    const writer = (mount) => copied(mount) || (mount.kind === 'project-code' && !mount.readOnly);
+    return a.mounts.some((x) => b.mounts.some((y) => {
+        if (x.readOnly && y.readOnly)
+            return false;
+        if (!(copied(x) && writer(y)) && !(copied(y) && writer(x)))
+            return false;
+        const xv = (0, docker_plan_dto_1.isVolumeMount)(x.kind);
+        const yv = (0, docker_plan_dto_1.isVolumeMount)(y.kind);
+        return xv && yv
+            ? x.source === y.source
+            : !xv && !yv && ((0, docker_plan_files_1.within)(x.source, y.source) || (0, docker_plan_files_1.within)(y.source, x.source));
+    }));
 }
 //# sourceMappingURL=docker-plan-source.service.js.map