happy2 0.0.5 → 0.0.11

package/packages/happy2-server/dist/modules/sandbox/catalog.d.ts

@@ -0,0 +1,15 @@
+import type { SandboxProbeOptions, SandboxProvider, SandboxProviderStatus } from "./types.js";
+export declare const SANDBOX_EXECUTION_NOTICE = "Happy runs agent code inside the selected sandbox provider, isolated from the Happy server process.";
+export interface SandboxProviderDiscovery {
+    executionNotice: string;
+    providers: SandboxProviderStatus[];
+    recommendedProviderId?: string;
+}
+/** Immutable provider lookup and discovery boundary; durable selection remains owned by setup actions. */
+export declare class SandboxProviderCatalog {
+    private readonly byId;
+    constructor(providers: readonly SandboxProvider[]);
+    get(id: string): SandboxProvider | undefined;
+    discover(options?: SandboxProbeOptions): Promise<SandboxProviderDiscovery>;
+}
+//# sourceMappingURL=catalog.d.ts.map

package/packages/happy2-server/dist/modules/sandbox/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9F,eAAO,MAAM,wBAAwB,wGACoE,CAAC;AAE1G,MAAM,WAAW,wBAAwB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,0GAA0G;AAC1G,qBAAa,sBAAsB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuC;IAE5D,YAAY,SAAS,EAAE,SAAS,eAAe,EAAE,EAWhD;IAED,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE3C;IAEK,QAAQ,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAUnF;CACJ"}

package/packages/happy2-server/dist/modules/sandbox/catalog.js

@@ -0,0 +1,31 @@
+export const SANDBOX_EXECUTION_NOTICE = "Happy runs agent code inside the selected sandbox provider, isolated from the Happy server process.";
+/** Immutable provider lookup and discovery boundary; durable selection remains owned by setup actions. */
+export class SandboxProviderCatalog {
+    byId;
+    constructor(providers) {
+        const byId = new Map();
+        for (const provider of providers) {
+            if (!/^[a-z][a-z0-9_-]{0,63}$/.test(provider.id))
+                throw new Error(`Invalid sandbox provider id ${provider.id}`);
+            if (byId.has(provider.id))
+                throw new Error(`Duplicate sandbox provider id ${provider.id}`);
+            byId.set(provider.id, provider);
+        }
+        if (byId.size === 0)
+            throw new Error("At least one sandbox provider must be registered");
+        this.byId = byId;
+    }
+    get(id) {
+        return this.byId.get(id);
+    }
+    async discover(options = {}) {
+        const providers = await Promise.all([...this.byId.values()].map((provider) => provider.probe(options)));
+        const healthy = providers.filter(({ health }) => health === "healthy");
+        return {
+            executionNotice: SANDBOX_EXECUTION_NOTICE,
+            providers,
+            ...(healthy.length === 1 ? { recommendedProviderId: healthy[0].id } : {}),
+        };
+    }
+}
+//# sourceMappingURL=catalog.js.map

package/packages/happy2-server/dist/modules/sandbox/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../sources/modules/sandbox/catalog.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,wBAAwB,GACjC,qGAAqG,CAAC;AAQ1G,0GAA0G;AAC1G,MAAM,OAAO,sBAAsB;IACd,IAAI,CAAuC;IAE5D,YAAY,SAAqC;QAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAChD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,EAAU;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAwB,EAAE;QAC5C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CACrE,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACvE,OAAO;YACH,eAAe,EAAE,wBAAwB;YACzC,SAAS;YACT,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;IACN,CAAC;CACJ"}

package/packages/happy2-server/dist/modules/sandbox/index.d.ts

@@ -0,0 +1,4 @@
+export { SANDBOX_EXECUTION_NOTICE, SandboxProviderCatalog, type SandboxProviderDiscovery, } from "./catalog.js";
+export { LocalOciSandboxProvider, localSandboxProviders } from "./localOciSandboxProvider.js";
+export type { AgentImageBuildInput, AgentImageBuildOptions, AgentImageBuildUpdate, AgentSandboxCreateInput, AgentSandboxRuntime, AgentSandboxRuntimeResolver, PluginSandboxCreateInput, SandboxFileEgressInput, SandboxFileIngressInput, SandboxProbeOptions, SandboxProvider, SandboxProviderHealth, SandboxProviderStatus, SandboxTerminalHandle, SandboxTerminalInput, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/packages/happy2-server/dist/modules/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,wBAAwB,GAChC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,YAAY,EACR,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACvB,MAAM,YAAY,CAAC"}

package/packages/happy2-server/dist/modules/sandbox/index.js

@@ -0,0 +1,3 @@
+export { SANDBOX_EXECUTION_NOTICE, SandboxProviderCatalog, } from "./catalog.js";
+export { LocalOciSandboxProvider, localSandboxProviders } from "./localOciSandboxProvider.js";
+//# sourceMappingURL=index.js.map

package/packages/happy2-server/dist/modules/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../sources/modules/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,wBAAwB,EACxB,sBAAsB,GAEzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC"}

package/packages/happy2-server/dist/modules/sandbox/localOciSandboxProvider.d.ts

@@ -0,0 +1,35 @@
+import type { AgentImageBuildInput, AgentImageBuildOptions, AgentSandboxCreateInput, PluginSandboxCreateInput, SandboxFileEgressInput, SandboxFileIngressInput, SandboxProbeOptions, SandboxProvider, SandboxProviderStatus, SandboxTerminalHandle, SandboxTerminalInput } from "./types.js";
+interface LocalOciSandboxProviderOptions {
+    command: string;
+    displayName: string;
+    id: "docker" | "podman";
+}
+/** Local Docker/Podman driver with identical sandbox security, lifecycle, file, and terminal semantics. */
+export declare class LocalOciSandboxProvider implements SandboxProvider {
+    readonly locality: "local";
+    readonly command: string;
+    readonly displayName: string;
+    readonly id: "docker" | "podman";
+    constructor(options: LocalOciSandboxProviderOptions);
+    probe(options?: SandboxProbeOptions): Promise<SandboxProviderStatus>;
+    buildImage(input: AgentImageBuildInput, options?: AgentImageBuildOptions): Promise<{
+        imageId: string;
+    }>;
+    createSandbox(input: AgentSandboxCreateInput, signal?: AbortSignal): Promise<void>;
+    createPluginSandbox(input: PluginSandboxCreateInput, signal?: AbortSignal): Promise<void>;
+    removeSandbox(containerName: string): Promise<void>;
+    copyFileToSandbox(input: SandboxFileIngressInput, signal?: AbortSignal): Promise<void>;
+    copyFileFromSandbox(input: SandboxFileEgressInput, signal?: AbortSignal): Promise<void>;
+    attachTerminal(input: SandboxTerminalInput, signal?: AbortSignal): SandboxTerminalHandle;
+    private buildArguments;
+    private createWithBindMountRetry;
+    private probeCommand;
+    private run;
+    private commandEnvironment;
+    private timedOutStatus;
+    private installRemediation;
+    private startRemediation;
+}
+export declare function localSandboxProviders(): readonly SandboxProvider[];
+export {};
+//# sourceMappingURL=localOciSandboxProvider.d.ts.map

package/packages/happy2-server/dist/modules/sandbox/localOciSandboxProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localOciSandboxProvider.d.ts","sourceRoot":"","sources":["../../../sources/modules/sandbox/localOciSandboxProvider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACR,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACvB,MAAM,YAAY,CAAC;AAkDpB,UAAU,8BAA8B;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC3B;AAWD,2GAA2G;AAC3G,qBAAa,uBAAwB,YAAW,eAAe;IAC3D,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAEjC,YAAY,OAAO,EAAE,8BAA8B,EAIlD;IAEK,KAAK,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA2C7E;IAEK,UAAU,CACZ,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CA+B9B;IAEK,aAAa,CAAC,KAAK,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvF;IAEK,mBAAmB,CACrB,KAAK,EAAE,wBAAwB,EAC/B,MAAM,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,IAAI,CAAC,CA8Cf;IAEK,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEK,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3F;IAEK,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5F;IAED,cAAc,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,qBAAqB,CA6BvF;IAED,OAAO,CAAC,cAAc;YAaR,wBAAwB;YAmBxB,YAAY;IA0B1B,OAAO,CAAC,GAAG;IAsEX,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,gBAAgB;CAK3B;AAED,wBAAgB,qBAAqB,IAAI,SAAS,eAAe,EAAE,CAKlE"}

package/packages/happy2-server/dist/modules/sandbox/localOciSandboxProvider.js

@@ -0,0 +1,529 @@
+import { spawn } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+const DEFAULT_PROBE_TIMEOUT_MS = 3_000;
+const MAX_COMMAND_OUTPUT = 32_768;
+const MAX_VERSION_BYTES = 512;
+const BIND_MOUNT_RETRY_DELAYS_MS = [25, 50, 100, 200, 400, 800, 1_600];
+const PLUGIN_MEMORY_BYTES = 1024 * 1024 * 1024;
+const PLUGIN_CPUS = "1";
+const PLUGIN_PID_LIMIT = "256";
+const PLUGIN_CLI_ENV_PREFIXES = ["CONTAINER_", "CONTAINERS_", "DOCKER_", "DYLD_", "LD_", "PODMAN_"];
+const PLUGIN_CLI_ENV_NAMES = new Set([
+    "ALL_PROXY",
+    "CONMON",
+    "CURL_CA_BUNDLE",
+    "DBUS_SESSION_BUS_ADDRESS",
+    "GIT_CONFIG_GLOBAL",
+    "GIT_CONFIG_SYSTEM",
+    "GIT_SSL_CAINFO",
+    "GODEBUG",
+    "GOTRACEBACK",
+    "HOME",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "LD_LIBRARY_PATH",
+    "LD_PRELOAD",
+    "NODE_CHANNEL_FD",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "NODE_UNIQUE_ID",
+    "NO_PROXY",
+    "OCI_RUNTIME",
+    "PATH",
+    "PATHEXT",
+    "REGISTRY_AUTH_FILE",
+    "SSH_AUTH_SOCK",
+    "SSL_CERT_DIR",
+    "SSL_CERT_FILE",
+    "STORAGE_DRIVER",
+    "STORAGE_OPTS",
+    "SYSTEMROOT",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "WINDIR",
+    "XDG_CACHE_HOME",
+    "XDG_CONFIG_HOME",
+    "XDG_DATA_HOME",
+    "XDG_RUNTIME_DIR",
+]);
+/** Local Docker/Podman driver with identical sandbox security, lifecycle, file, and terminal semantics. */
+export class LocalOciSandboxProvider {
+    locality = "local";
+    command;
+    displayName;
+    id;
+    constructor(options) {
+        this.command = options.command;
+        this.displayName = options.displayName;
+        this.id = options.id;
+    }
+    async probe(options = {}) {
+        const timeoutMs = options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000)
+            throw new Error("Sandbox provider probe timeout must be between 1 and 30000 ms");
+        const deadline = Date.now() + timeoutMs;
+        const version = await this.probeCommand(["--version"], timeoutMs, options.signal);
+        if (version.state !== "complete") {
+            if (version.state === "timed_out")
+                return this.timedOutStatus("version probe");
+            if (options.signal?.aborted)
+                throw abortError(this.displayName);
+            return {
+                id: this.id,
+                displayName: this.displayName,
+                health: "unavailable",
+                detail: `${this.displayName} is not installed or is not available on PATH.`,
+                remediation: this.installRemediation(),
+            };
+        }
+        const versionText = boundedDetail(version.result.stdout || version.result.stderr);
+        const health = await this.probeCommand(["info", "--format", "{{json .}}"], Math.max(1, deadline - Date.now()), options.signal);
+        if (health.state !== "complete") {
+            if (health.state === "timed_out")
+                return this.timedOutStatus("health probe", versionText);
+            if (options.signal?.aborted)
+                throw abortError(this.displayName);
+            return {
+                id: this.id,
+                displayName: this.displayName,
+                health: "unhealthy",
+                detail: `${this.displayName} is installed, but its local engine is not responding: ${commandFailureDetail(health.error)}`,
+                remediation: this.startRemediation(),
+                ...(versionText ? { version: versionText } : {}),
+            };
+        }
+        return {
+            id: this.id,
+            displayName: this.displayName,
+            health: "healthy",
+            detail: `${this.displayName} is installed and its local engine is ready.`,
+            ...(versionText ? { version: versionText } : {}),
+        };
+    }
+    async buildImage(input, options = {}) {
+        const temporaryContext = input.buildContext
+            ? undefined
+            : await mkdtemp(join(tmpdir(), "happy2-agent-image-"));
+        try {
+            const progress = new OciBuildProgress();
+            await this.run(this.buildArguments(input, temporaryContext), {
+                input: input.dockerfile,
+                onOutput: (chunk) => {
+                    const nextProgress = progress.push(chunk);
+                    options.onUpdate?.({
+                        logChunk: chunk,
+                        ...(nextProgress === undefined ? {} : { progress: nextProgress }),
+                    });
+                },
+                signal: options.signal,
+            });
+            const finalProgress = progress.finish();
+            if (finalProgress !== undefined)
+                options.onUpdate?.({ logChunk: "", progress: finalProgress });
+            const inspected = await this.run(["image", "inspect", "--format", "{{.Id}}", input.tag], { signal: options.signal });
+            const imageId = inspected.stdout.trim();
+            if (!imageId)
+                throw new Error(`${this.displayName} did not return the built image id.`);
+            return { imageId };
+        }
+        finally {
+            if (temporaryContext)
+                await rm(temporaryContext, { recursive: true, force: true }).catch(() => undefined);
+        }
+    }
+    async createSandbox(input, signal) {
+        const args = [
+            "create",
+            "--name",
+            input.containerName,
+            "--label",
+            "dev.happy2.managed=true",
+            "--label",
+            `dev.happy2.agent=${input.agentUserId}`,
+            "--label",
+            `dev.happy2.agent-image=${input.imageId}`,
+            ...(input.security.readonlyRootFilesystem ? ["--read-only"] : []),
+            ...(input.security.init ? ["--init"] : []),
+            "--shm-size",
+            String(input.security.sharedMemoryBytes),
+            ...input.security.tmpfs.flatMap(({ mode, target }) => [
+                "--tmpfs",
+                `${target}:rw,nosuid,nodev,mode=${mode.toString(8)}`,
+            ]),
+            "--mount",
+            bindMount(input.homeDirectory, "/home"),
+            "--mount",
+            bindMount(input.workspaceDirectory, "/workspace"),
+            "--env",
+            "HOME=/home",
+            "--env",
+            "TMPDIR=/tmp",
+            "--workdir",
+            "/workspace",
+            "--entrypoint",
+            "/bin/sh",
+            input.imageTag,
+            "-c",
+            "trap : TERM INT; while :; do sleep 2073600; done",
+        ];
+        try {
+            await this.createWithBindMountRetry(args, input.containerName, signal);
+            await this.run(["start", input.containerName], { signal });
+        }
+        catch (error) {
+            await this.removeSandbox(input.containerName);
+            throw error;
+        }
+    }
+    async createPluginSandbox(input, signal) {
+        const args = [
+            "create",
+            "--name",
+            input.containerName,
+            "--label",
+            "dev.happy2.managed=true",
+            "--label",
+            `dev.happy2.plugin-installation=${input.installationId}`,
+            "--read-only",
+            "--init",
+            "--cap-drop",
+            "ALL",
+            "--security-opt",
+            "no-new-privileges",
+            "--memory",
+            String(PLUGIN_MEMORY_BYTES),
+            "--cpus",
+            PLUGIN_CPUS,
+            "--pids-limit",
+            PLUGIN_PID_LIMIT,
+            "--shm-size",
+            "268435456",
+            "--tmpfs",
+            "/tmp:rw,nosuid,nodev,mode=1777",
+            "--tmpfs",
+            "/run:rw,nosuid,nodev,mode=755",
+            "--env",
+            "HOME=/tmp",
+            "--env",
+            "TMPDIR=/tmp",
+            "--workdir",
+            "/tmp",
+            "--entrypoint",
+            "/bin/sh",
+            input.imageTag,
+            "-c",
+            "trap : TERM INT; while :; do sleep 2073600; done",
+        ];
+        try {
+            await this.run(args, { signal });
+            await this.run(["start", input.containerName], { signal });
+        }
+        catch (error) {
+            await this.removeSandbox(input.containerName);
+            throw error;
+        }
+    }
+    async removeSandbox(containerName) {
+        await this.run(["rm", "--force", containerName]).catch(() => undefined);
+    }
+    async copyFileToSandbox(input, signal) {
+        await this.run(["cp", input.sourcePath, `${input.containerName}:${input.destinationPath}`], { signal });
+    }
+    async copyFileFromSandbox(input, signal) {
+        await this.run(["cp", `${input.containerName}:${input.sourcePath}`, input.destinationPath], { signal });
+    }
+    attachTerminal(input, signal) {
+        const command = input.command?.length ? [...input.command] : ["/bin/sh"];
+        const environment = Object.entries(input.environment ?? {});
+        const childEnvironment = pluginCliEnvironment(this.commandEnvironment(), environment);
+        const child = spawn(this.command, [
+            "exec",
+            "--interactive",
+            ...environment.flatMap(([key]) => ["--env", key]),
+            input.containerName,
+            ...command,
+        ], {
+            env: childEnvironment,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const abort = () => child.kill("SIGTERM");
+        signal?.addEventListener("abort", abort, { once: true });
+        const wait = childResult(child).finally(() => signal?.removeEventListener("abort", abort));
+        if (signal?.aborted)
+            abort();
+        return {
+            stdin: child.stdin,
+            stdout: child.stdout,
+            stderr: child.stderr,
+            wait,
+            close: abort,
+        };
+    }
+    buildArguments(input, temporaryContext) {
+        return [
+            "build",
+            "--pull",
+            ...(this.id === "docker" ? ["--progress", "plain"] : []),
+            "--tag",
+            input.tag,
+            "--file",
+            "-",
+            input.buildContext ?? temporaryContext,
+        ];
+    }
+    async createWithBindMountRetry(args, containerName, signal) {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                await this.run(args, { signal });
+                return;
+            }
+            catch (error) {
+                const delay = BIND_MOUNT_RETRY_DELAYS_MS[attempt];
+                if (this.id !== "docker" || delay === undefined || !isMissingBindSource(error))
+                    throw error;
+                await this.removeSandbox(containerName);
+                await abortableDelay(delay, signal, this.displayName);
+            }
+        }
+    }
+    async probeCommand(args, timeoutMs, signal) {
+        const controller = new AbortController();
+        let timedOut = false;
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeoutMs);
+        const abort = () => controller.abort();
+        signal?.addEventListener("abort", abort, { once: true });
+        try {
+            return {
+                state: "complete",
+                result: await this.run(args, { signal: controller.signal }),
+            };
+        }
+        catch (error) {
+            return { state: timedOut ? "timed_out" : "failed", error };
+        }
+        finally {
+            clearTimeout(timeout);
+            signal?.removeEventListener("abort", abort);
+        }
+    }
+    run(args, options = {}) {
+        if (options.signal?.aborted)
+            return Promise.reject(abortError(this.displayName));
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            let forcedKill;
+            const child = spawn(this.command, args, {
+                env: this.commandEnvironment(),
+                stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+            });
+            let stdout = "";
+            let stderr = "";
+            const finish = (action) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (forcedKill)
+                    clearTimeout(forcedKill);
+                action();
+            };
+            const abort = () => {
+                child.kill("SIGTERM");
+                forcedKill = setTimeout(() => child.kill("SIGKILL"), 250);
+                forcedKill.unref();
+            };
+            options.signal?.addEventListener("abort", abort, { once: true });
+            child.stdout?.on("data", (chunk) => {
+                const text = chunk.toString();
+                stdout = appendOutput(stdout, text);
+                options.onOutput?.(text);
+            });
+            child.stderr?.on("data", (chunk) => {
+                const text = chunk.toString();
+                stderr = appendOutput(stderr, text);
+                options.onOutput?.(text);
+            });
+            child.once("error", (error) => {
+                options.signal?.removeEventListener("abort", abort);
+                finish(() => reject(new Error(`Could not run ${this.displayName}: ${error.message}`, {
+                    cause: error,
+                })));
+            });
+            child.once("close", (code, closedSignal) => {
+                options.signal?.removeEventListener("abort", abort);
+                if (options.signal?.aborted) {
+                    finish(() => reject(abortError(this.displayName)));
+                    return;
+                }
+                if (code === 0) {
+                    finish(() => resolve({ stderr, stdout }));
+                    return;
+                }
+                const detail = stderr.trim() || stdout.trim() || `signal ${closedSignal ?? "unknown"}`;
+                finish(() => reject(new Error(`${this.displayName} ${args[0] ?? "command"} failed with exit code ${code ?? -1}: ${detail}`)));
+            });
+            if (options.input !== undefined)
+                child.stdin?.end(options.input);
+        });
+    }
+    commandEnvironment() {
+        const environment = this.id === "docker" ? { ...process.env, DOCKER_BUILDKIT: "1" } : { ...process.env };
+        delete environment.NODE_CHANNEL_FD;
+        delete environment.NODE_UNIQUE_ID;
+        return environment;
+    }
+    timedOutStatus(operation, version) {
+        return {
+            id: this.id,
+            displayName: this.displayName,
+            health: "timed_out",
+            detail: `${this.displayName} ${operation} exceeded its time limit.`,
+            remediation: this.startRemediation(),
+            ...(version ? { version } : {}),
+        };
+    }
+    installRemediation() {
+        return this.id === "docker"
+            ? "Install Docker Desktop or Docker Engine and make the docker command available on PATH."
+            : "Install Podman and make the podman command available on PATH.";
+    }
+    startRemediation() {
+        return this.id === "docker"
+            ? "Start Docker Desktop or the Docker daemon, then try again."
+            : "Start the Podman machine or local Podman service, then try again.";
+    }
+}
+export function localSandboxProviders() {
+    return [
+        new LocalOciSandboxProvider({ id: "docker", displayName: "Docker", command: "docker" }),
+        new LocalOciSandboxProvider({ id: "podman", displayName: "Podman", command: "podman" }),
+    ];
+}
+function pluginCliEnvironment(base, plugin) {
+    const seen = new Set();
+    for (const [key] of plugin) {
+        const normalized = key.toUpperCase();
+        if (seen.has(normalized) ||
+            PLUGIN_CLI_ENV_NAMES.has(normalized) ||
+            PLUGIN_CLI_ENV_PREFIXES.some((prefix) => normalized.startsWith(prefix)))
+            throw new Error(`Plugin variable ${key} cannot shadow the container CLI environment`);
+        seen.add(normalized);
+    }
+    return { ...base, ...Object.fromEntries(plugin) };
+}
+class OciBuildProgress {
+    buffer = "";
+    completedSteps = new Set();
+    current = 1;
+    stages = new Map();
+    vertices = new Map();
+    push(chunk) {
+        this.buffer += chunk.replaceAll("\r", "\n");
+        let changed = false;
+        for (;;) {
+            const newline = this.buffer.indexOf("\n");
+            if (newline < 0)
+                break;
+            const line = this.buffer.slice(0, newline);
+            this.buffer = this.buffer.slice(newline + 1);
+            changed = this.readLine(line) || changed;
+        }
+        return changed ? this.current : undefined;
+    }
+    finish() {
+        if (!this.buffer)
+            return undefined;
+        const changed = this.readLine(this.buffer);
+        this.buffer = "";
+        return changed ? this.current : undefined;
+    }
+    readLine(line) {
+        const step = line.match(/^(#\d+) \[(.+) (\d+)\/(\d+)\]/);
+        if (step) {
+            const [, vertex, stage, rawIndex, rawTotal] = step;
+            const index = Number(rawIndex);
+            const total = Number(rawTotal);
+            this.vertices.set(vertex, { index, stage: stage });
+            this.stages.set(stage, Math.max(this.stages.get(stage) ?? 0, total));
+            for (let previous = 1; previous < index; previous += 1)
+                this.completedSteps.add(`${stage}:${previous}`);
+        }
+        const terminal = line.match(/^(#\d+)\s+(?:DONE|CACHED)\b/);
+        if (terminal) {
+            const known = this.vertices.get(terminal[1]);
+            if (known)
+                this.completedSteps.add(`${known.stage}:${known.index}`);
+        }
+        const total = [...this.stages.values()].reduce((sum, value) => sum + value, 0);
+        if (!total)
+            return false;
+        const next = Math.min(95, 5 + Math.floor((this.completedSteps.size / total) * 90));
+        if (next <= this.current)
+            return false;
+        this.current = next;
+        return true;
+    }
+}
+function bindMount(source, target) {
+    if (source.includes(","))
+        throw new Error("Agent sandbox paths cannot contain commas when used as OCI mounts.");
+    return `type=bind,source=${source},target=${target}`;
+}
+function appendOutput(current, addition) {
+    const combined = current + addition;
+    return combined.length <= MAX_COMMAND_OUTPUT
+        ? combined
+        : combined.slice(combined.length - MAX_COMMAND_OUTPUT);
+}
+function boundedDetail(value) {
+    const result = value.trim();
+    if (!result)
+        return undefined;
+    const bytes = Buffer.from(result, "utf8");
+    if (bytes.byteLength <= MAX_VERSION_BYTES)
+        return result;
+    let end = MAX_VERSION_BYTES;
+    while (end > 0 && (bytes[end] & 0xc0) === 0x80)
+        end -= 1;
+    return bytes.subarray(0, end).toString("utf8");
+}
+function commandFailureDetail(error) {
+    return boundedDetail(error instanceof Error ? error.message : String(error)) ?? "unknown error";
+}
+function abortError(displayName) {
+    const error = new Error(`${displayName} operation was aborted.`);
+    error.name = "AbortError";
+    return error;
+}
+function isMissingBindSource(error) {
+    return (error instanceof Error &&
+        error.message.includes('invalid mount config for type "bind"') &&
+        error.message.includes("bind source path does not exist"));
+}
+function abortableDelay(milliseconds, signal, displayName) {
+    if (signal?.aborted)
+        return Promise.reject(abortError(displayName));
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            clearTimeout(timer);
+            reject(abortError(displayName));
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", abort);
+            resolve();
+        }, milliseconds);
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}
+function childResult(child) {
+    return new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("close", (exitCode, signal) => resolve({ exitCode, signal }));
+    });
+}
+//# sourceMappingURL=localOciSandboxProvider.js.map