labgate 0.5.44 → 0.5.46

package/dist/lib/container.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldUseDangerousPermissionsByDefault = shouldUseDangerousPermissionsByDefault;
 exports.computeMountFingerprint = computeMountFingerprint;
 exports.prepareMcpServers = prepareMcpServers;
 exports.imageToSifName = imageToSifName;
@@ -68,6 +69,20 @@ const slurm_poller_js_1 = require("./slurm-poller.js");
 const slurm_cli_passthrough_js_1 = require("./slurm-cli-passthrough.js");
 const startup_stage_lock_js_1 = require("./startup-stage-lock.js");
 const log = __importStar(require("./log.js"));
+function isTruthyEnvFlag(value) {
+    const normalized = String(value || '').trim().toLowerCase();
+    return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on';
+}
+function shouldUseDangerousPermissionsByDefault(agent, options = {}) {
+    if (agent !== 'codex')
+        return false;
+    if (String(options.linkedWebTerminalId || '').trim().length > 0)
+        return false;
+    const env = options.env ?? process.env;
+    if (isTruthyEnvFlag(env.LABGATE_CODEX_STANDARD_PERMISSIONS))
+        return false;
+    return true;
+}
 /**
  * Compute a deterministic fingerprint of mount-affecting config fields.
  * Used to detect when running sessions need a restart after config changes.
@@ -715,6 +730,8 @@ function imageToSifName(image) {
     return `${readable}-${hash}.sif`;
 }
 const APPTAINER_SIF_INSPECT_TIMEOUT_MS = 15_000;
+const SLOW_APPTAINER_SIF_INSPECT_WARN_MS = 5_000;
+const SLOW_IMAGE_PULL_LOCK_WAIT_WARN_MS = 5_000;
 function isUsableApptainerSif(runtime, sifPath) {
     if (!(0, fs_1.existsSync)(sifPath))
         return false;
@@ -733,19 +750,36 @@ function isUsableApptainerSif(runtime, sifPath) {
  * Ensure a SIF image exists in the cache directory.
  * Pulls from docker:// URI if not already cached.
  */
-async function ensureSifImage(runtime, image) {
+async function ensureSifImage(runtime, image, hooks = {}) {
+    const recordTiming = (label, startedAt) => {
+        hooks.onTiming?.(label, Math.max(0, Date.now() - startedAt));
+    };
     const imagesDir = (0, config_js_1.getImagesDir)();
     (0, fs_1.mkdirSync)(imagesDir, { recursive: true });
     const sifPath = (0, path_1.join)(imagesDir, imageToSifName(image));
     const pullLockPath = `${sifPath}.pull.lock`;
-    if (isUsableApptainerSif(runtime, sifPath) && !(0, fs_1.existsSync)(pullLockPath)) {
+    const initialInspectStartedAt = Date.now();
+    const initialCacheHit = isUsableApptainerSif(runtime, sifPath);
+    recordTiming('image_prepare_sif_cache_inspect', initialInspectStartedAt);
+    if (Math.max(0, Date.now() - initialInspectStartedAt) >= SLOW_APPTAINER_SIF_INSPECT_WARN_MS) {
+        hooks.onWarning?.('slow_sif_cache_inspect');
+    }
+    if (initialCacheHit && !(0, fs_1.existsSync)(pullLockPath)) {
         return sifPath;
     }
+    let pullLockTimingRecorded = false;
     try {
         await (0, image_pull_lock_js_1.withImagePullFileLock)(pullLockPath, image, async () => {
-            if (isUsableApptainerSif(runtime, sifPath))
+            const reInspectStartedAt = Date.now();
+            const cacheHitAfterLock = isUsableApptainerSif(runtime, sifPath);
+            recordTiming('image_prepare_sif_cache_reinspect', reInspectStartedAt);
+            if (Math.max(0, Date.now() - reInspectStartedAt) >= SLOW_APPTAINER_SIF_INSPECT_WARN_MS) {
+                hooks.onWarning?.('slow_sif_cache_reinspect');
+            }
+            if (cacheHitAfterLock)
                 return;
             if ((0, fs_1.existsSync)(sifPath)) {
+                hooks.onWarning?.('cached_sif_failed_validation');
                 log.warn(`Cached SIF for ${log.dim(image)} failed validation. Re-pulling image.`);
                 try {
                     (0, fs_1.rmSync)(sifPath, { force: true });
@@ -757,10 +791,19 @@ async function ensureSifImage(runtime, image) {
             const tempSifPath = `${sifPath}.tmp-${process.pid}-${(0, crypto_1.randomBytes)(6).toString('hex')}`;
             log.info(`Pulling image ${log.dim(image)}`);
             try {
+                hooks.onHint?.('sif_pull_required');
+                const pullStartedAt = Date.now();
                 (0, child_process_1.execFileSync)(runtime, ['pull', tempSifPath, `docker://${image}`], {
                     stdio: 'inherit',
                 });
-                if (!isUsableApptainerSif(runtime, tempSifPath)) {
+                recordTiming('image_prepare_sif_pull', pullStartedAt);
+                const validatePulledStartedAt = Date.now();
+                const pulledSifUsable = isUsableApptainerSif(runtime, tempSifPath);
+                recordTiming('image_prepare_sif_pull_validate', validatePulledStartedAt);
+                if (Math.max(0, Date.now() - validatePulledStartedAt) >= SLOW_APPTAINER_SIF_INSPECT_WARN_MS) {
+                    hooks.onWarning?.('slow_sif_pull_validate');
+                }
+                if (!pulledSifUsable) {
                     throw new Error(`Pulled SIF failed validation: ${tempSifPath}`);
                 }
                 (0, fs_1.renameSync)(tempSifPath, sifPath);
@@ -774,6 +817,13 @@ async function ensureSifImage(runtime, image) {
                 }
             }
         }, {
+            onAcquired: ({ waitedMs }) => {
+                pullLockTimingRecorded = true;
+                hooks.onTiming?.('image_prepare_pull_lock_wait', waitedMs);
+                if (waitedMs >= SLOW_IMAGE_PULL_LOCK_WAIT_WARN_MS) {
+                    hooks.onWarning?.('slow_image_pull_lock_wait');
+                }
+            },
             onWait: ({ owner }) => {
                 const ownerLabel = owner && owner !== 'unknown' ? ` (owner: ${owner})` : '';
                 log.step(`Waiting for shared image pull lock for ${log.dim(image)}${ownerLabel}...`);
@@ -791,6 +841,9 @@ async function ensureSifImage(runtime, image) {
         console.error(String(msg).trim().slice(0, 500));
         process.exit(1);
     }
+    if (!pullLockTimingRecorded) {
+        hooks.onTiming?.('image_prepare_pull_lock_wait', 0);
+    }
     return sifPath;
 }
 function ensurePodmanImage(runtime, image) {
@@ -1672,6 +1725,112 @@ function buildEntrypoint(agent, options = {}) {
         '    chmod +x "$HOME/.labgate-bin/$_cmd"',
         '  done',
         'fi',
+        'labgate_install_bzip2_shims() {',
+        '  local needs_bzip2="0"',
+        '  local py=""',
+        '  for _cmd in bzip2 bunzip2 bzcat; do',
+        '    if ! command -v "$_cmd" >/dev/null 2>&1; then',
+        '      needs_bzip2="1"',
+        '      break',
+        '    fi',
+        '  done',
+        '  [ "$needs_bzip2" = "1" ] || return 0',
+        '  if ! command -v python3 >/dev/null 2>&1; then',
+        '    return 0',
+        '  fi',
+        '  cat > "$HOME/.labgate-bin/bzip2" <<\'EOF\'',
+        '#!/usr/bin/env python3',
+        'import bz2',
+        'import os',
+        'import sys',
+        '',
+        'prog = os.path.basename(sys.argv[0])',
+        'args = sys.argv[1:]',
+        'decompress = prog in ("bunzip2", "bzcat")',
+        'stdout_mode = prog == "bzcat"',
+        'keep = prog == "bzcat"',
+        'force = False',
+        'files = []',
+        '',
+        'def fail(message: str, code: int = 2) -> None:',
+        '    sys.stderr.write(message + "\\n")',
+        '    raise SystemExit(code)',
+        '',
+        'def read_bytes(path: str | None) -> bytes:',
+        '    if not path or path == "-":',
+        '        return sys.stdin.buffer.read()',
+        '    with open(path, "rb") as handle:',
+        '        return handle.read()',
+        '',
+        'def write_bytes(path: str | None, data: bytes) -> None:',
+        '    if not path or path == "-":',
+        '        sys.stdout.buffer.write(data)',
+        '        return',
+        '    with open(path, "wb") as handle:',
+        '        handle.write(data)',
+        '',
+        'while args:',
+        '    arg = args.pop(0)',
+        '    if arg == "--":',
+        '        files.extend(args)',
+        '        break',
+        '    if arg == "-":',
+        '        files.append(arg)',
+        '        continue',
+        '    if arg.startswith("-") and arg != "-":',
+        '        for flag in arg[1:]:',
+        '            if flag == "d":',
+        '                decompress = True',
+        '            elif flag == "z":',
+        '                decompress = False',
+        '            elif flag == "c":',
+        '                stdout_mode = True',
+        '            elif flag == "k":',
+        '                keep = True',
+        '            elif flag == "f":',
+        '                force = True',
+        '            else:',
+        '                fail(f"bzip2 shim: unsupported option -{flag}")',
+        '        continue',
+        '    files.append(arg)',
+        '',
+        'if not files:',
+        '    files = ["-"]',
+        '',
+        'exit_code = 0',
+        'for path in files:',
+        '    try:',
+        '        raw = read_bytes(path)',
+        '        data = bz2.decompress(raw) if decompress else bz2.compress(raw)',
+        '        if stdout_mode or path == "-":',
+        '            write_bytes(None, data)',
+        '            continue',
+        '        if decompress:',
+        '            target = path[:-4] if path.endswith(".bz2") else path + ".out"',
+        '        else:',
+        '            target = path + ".bz2"',
+        '        if os.path.exists(target) and not force:',
+        '            sys.stderr.write(f"{target} already exists; use -f to overwrite\\n")',
+        '            exit_code = 1',
+        '            continue',
+        '        write_bytes(target, data)',
+        '        if not keep:',
+        '            try:',
+        '                os.unlink(path)',
+        '            except OSError:',
+        '                pass',
+        '    except Exception as exc:',
+        '        label = "stdin" if path == "-" else path',
+        '        sys.stderr.write(f"{label}: {exc}\\n")',
+        '        exit_code = 1',
+        '',
+        'raise SystemExit(exit_code)',
+        'EOF',
+        '  chmod +x "$HOME/.labgate-bin/bzip2"',
+        '  ln -sf "$HOME/.labgate-bin/bzip2" "$HOME/.labgate-bin/bunzip2"',
+        '  ln -sf "$HOME/.labgate-bin/bzip2" "$HOME/.labgate-bin/bzcat"',
+        '}',
+        'labgate_install_bzip2_shims',
         '',
         // Minimal progress indicator for first-run npm installs (keeps logs quiet, avoids "nothing happening" UX).
         'labgate_npm_install_global() {',
@@ -1709,10 +1868,10 @@ function buildEntrypoint(agent, options = {}) {
         '',
     ];
     const preLaunchLines = [];
+    if (ensureCommands.length > 0) {
+        preLaunchLines.push('labgate_install_system_package() {', '  local manager="${1:-}"', '  local pkg="${2:-}"', '  [ -n "$manager" ] && [ -n "$pkg" ] || return 1', '  case "$manager" in', '    apt-get) apt-get install -y "$pkg" >/dev/null 2>&1 ;;', '    apk) apk add --no-cache "$pkg" >/dev/null 2>&1 ;;', '    dnf) dnf install -y "$pkg" >/dev/null 2>&1 ;;', '    yum) yum install -y "$pkg" >/dev/null 2>&1 ;;', '    microdnf) microdnf install -y "$pkg" >/dev/null 2>&1 ;;', '    *) return 1 ;;', '  esac', '}', 'labgate_candidate_packages_for_command() {', '  local cmd="${1:-}"', '  case "$cmd" in', '    rg) echo "ripgrep rg" ;;', '    fd) echo "fd-find fd" ;;', '    pip) echo "python3-pip py3-pip pip" ;;', '    python) echo "python3 python" ;;', '    *) echo "$cmd" ;;', '  esac', '}', 'labgate_ensure_commands() {', `  local required=(${ensureCommands.map((cmd) => JSON.stringify(cmd)).join(' ')})`, '  local missing=()', '  local cmd=""', '  for cmd in "${required[@]}"; do', '    if ! command -v "$cmd" >/dev/null 2>&1; then', '      missing+=("$cmd")', '    fi', '  done', '  if [ "${#missing[@]}" -eq 0 ]; then', '    return 0', '  fi', '  if [ "$(id -u)" != "0" ]; then', '    echo "[labgate] Warning: missing container command(s): ${missing[*]}." >&2', '    echo "[labgate] Configure an image with required tools preinstalled for reliable startup." >&2', '    return 0', '  fi', '  local manager=""', '  if command -v apt-get >/dev/null 2>&1; then', '    manager="apt-get"', '    export DEBIAN_FRONTEND=noninteractive', '    apt-get update >/dev/null 2>&1 || true', '  elif command -v apk >/dev/null 2>&1; then', '    manager="apk"', '  elif command -v dnf >/dev/null 2>&1; then', '    manager="dnf"', '  elif command -v yum >/dev/null 2>&1; then', '    manager="yum"', '  elif command -v microdnf >/dev/null 2>&1; then', '    manager="microdnf"', '  fi', '  if [ -z "$manager" ]; then', '    echo "[labgate] Warning: cannot install missing commands (${missing[*]}); no known package manager found." >&2', '    return 0', '  fi', '  echo "[labgate] Installing missing container tools: ${missing[*]}..."', '  local candidate=""', '  local installed="0"', '  for cmd in "${missing[@]}"; do', '    installed="0"', '    for candidate in $(labgate_candidate_packages_for_command "$cmd"); do', '      if labgate_install_system_package "$manager" "$candidate"; then', '        installed="1"', '        if command -v "$cmd" >/dev/null 2>&1; then', '          break', '        fi', '      fi', '    done', '    if [ "$installed" != "1" ]; then', '      echo "[labgate] Warning: failed to install command ${cmd}." >&2', '    fi', '  done', '  local still_missing=()', '  for cmd in "${required[@]}"; do', '    if ! command -v "$cmd" >/dev/null 2>&1; then', '      still_missing+=("$cmd")', '    fi', '  done', '  if [ "${#still_missing[@]}" -gt 0 ]; then', '    echo "[labgate] Warning: command(s) still unavailable after install attempt: ${still_missing[*]}." >&2', '    echo "[labgate] Configure an image with these tools preinstalled for reliable startup." >&2', '  fi', '}', 'labgate_ensure_commands', '');
+    }
     if (agent === 'claude') {
-        if (ensureCommands.length > 0) {
-            preLaunchLines.push('labgate_install_system_package() {', '  local manager="${1:-}"', '  local pkg="${2:-}"', '  [ -n "$manager" ] && [ -n "$pkg" ] || return 1', '  case "$manager" in', '    apt-get) apt-get install -y "$pkg" >/dev/null 2>&1 ;;', '    apk) apk add --no-cache "$pkg" >/dev/null 2>&1 ;;', '    dnf) dnf install -y "$pkg" >/dev/null 2>&1 ;;', '    yum) yum install -y "$pkg" >/dev/null 2>&1 ;;', '    microdnf) microdnf install -y "$pkg" >/dev/null 2>&1 ;;', '    *) return 1 ;;', '  esac', '}', 'labgate_candidate_packages_for_command() {', '  local cmd="${1:-}"', '  case "$cmd" in', '    rg) echo "ripgrep rg" ;;', '    fd) echo "fd-find fd" ;;', '    pip) echo "python3-pip py3-pip pip" ;;', '    python) echo "python3 python" ;;', '    *) echo "$cmd" ;;', '  esac', '}', 'labgate_ensure_commands() {', `  local required=(${ensureCommands.map((cmd) => JSON.stringify(cmd)).join(' ')})`, '  local missing=()', '  local cmd=""', '  for cmd in "${required[@]}"; do', '    if ! command -v "$cmd" >/dev/null 2>&1; then', '      missing+=("$cmd")', '    fi', '  done', '  if [ "${#missing[@]}" -eq 0 ]; then', '    return 0', '  fi', '  if [ "$(id -u)" != "0" ]; then', '    echo "[labgate] Warning: missing container command(s): ${missing[*]}." >&2', '    echo "[labgate] Configure an image with required tools preinstalled for best Claude UX." >&2', '    return 0', '  fi', '  local manager=""', '  if command -v apt-get >/dev/null 2>&1; then', '    manager="apt-get"', '    export DEBIAN_FRONTEND=noninteractive', '    apt-get update >/dev/null 2>&1 || true', '  elif command -v apk >/dev/null 2>&1; then', '    manager="apk"', '  elif command -v dnf >/dev/null 2>&1; then', '    manager="dnf"', '  elif command -v yum >/dev/null 2>&1; then', '    manager="yum"', '  elif command -v microdnf >/dev/null 2>&1; then', '    manager="microdnf"', '  fi', '  if [ -z "$manager" ]; then', '    echo "[labgate] Warning: cannot install missing commands (${missing[*]}); no known package manager found." >&2', '    return 0', '  fi', '  echo "[labgate] Installing missing container tools: ${missing[*]}..."', '  local candidate=""', '  local installed="0"', '  for cmd in "${missing[@]}"; do', '    installed="0"', '    for candidate in $(labgate_candidate_packages_for_command "$cmd"); do', '      if labgate_install_system_package "$manager" "$candidate"; then', '        installed="1"', '        if command -v "$cmd" >/dev/null 2>&1; then', '          break', '        fi', '      fi', '    done', '    if [ "$installed" != "1" ]; then', '      echo "[labgate] Warning: failed to install command ${cmd}." >&2', '    fi', '  done', '  local still_missing=()', '  for cmd in "${required[@]}"; do', '    if ! command -v "$cmd" >/dev/null 2>&1; then', '      still_missing+=("$cmd")', '    fi', '  done', '  if [ "${#still_missing[@]}" -gt 0 ]; then', '    echo "[labgate] Warning: command(s) still unavailable after install attempt: ${still_missing[*]}." >&2', '    echo "[labgate] Configure an image with these tools preinstalled for reliable startup." >&2', '  fi', '}', 'labgate_ensure_commands', '');
-        }
         if (disableClaudeStatusLine) {
             // Set the statusLine to a no-op command so Claude Code renders an empty
             // status bar instead of falling back to its default "time ➜ at host |".
@@ -2137,10 +2296,12 @@ function createStartupReportData(session, runtime, image) {
     if (session.uiDetected === false)
         warnings.push('ui_not_detected');
     return {
-        schema_version: 1,
+        schema_version: 2,
         kind: 'labgate-startup-report',
         generated_at: now,
         updated_at: now,
+        startup_completed_at: null,
+        startup_completion: null,
         pid: process.pid,
         node: (0, os_1.hostname)(),
         agent: session.agent,
@@ -2152,6 +2313,7 @@ function createStartupReportData(session, runtime, image) {
         launch_mode: session.dryRun ? 'dry-run' : null,
         ui_detected: session.uiDetected ?? null,
         total_ms: 0,
+        session_total_ms: 0,
         first_output_ms: null,
         timings_ms: {},
         cold_start_hints: [],
@@ -2280,8 +2442,12 @@ async function startSession(session) {
     const flushStartupReport = () => {
         if (!startupReport || !session.startupReportPath || startupReportWriteFailed)
             return;
+        const elapsedMs = Math.max(0, Date.now() - startupStartedAt);
         startupReport.updated_at = new Date().toISOString();
-        startupReport.total_ms = Math.max(0, Date.now() - startupStartedAt);
+        startupReport.session_total_ms = elapsedMs;
+        if (startupReport.startup_completed_at === null) {
+            startupReport.total_ms = elapsedMs;
+        }
         try {
             writeStartupReportFile(session.startupReportPath, startupReport);
         }
@@ -2318,6 +2484,14 @@ async function startSession(session) {
         startupReport.launch_mode = mode;
         flushStartupReport();
     };
+    const completeStartup = (completion) => {
+        if (!startupReport || startupReport.startup_completed_at !== null)
+            return;
+        startupReport.startup_completed_at = new Date().toISOString();
+        startupReport.startup_completion = completion;
+        startupReport.total_ms = Math.max(0, Date.now() - startupStartedAt);
+        flushStartupReport();
+    };
     const noteStartupFirstOutput = (data) => {
         if (!startupReport)
             return;
@@ -2329,6 +2503,7 @@ async function startSession(session) {
         startupReport.first_output_ms = firstOutputMs;
         startupReport.timings_ms.launch_first_output = firstOutputMs;
         startupReport.status = 'running';
+        completeStartup('first-output');
         flushStartupReport();
     };
     const updateSlurmStartupReport = (payload) => {
@@ -2567,9 +2742,21 @@ async function startSession(session) {
                 sifPath = (0, path_1.join)((0, config_js_1.getImagesDir)(), imageToSifName(image));
             }
             else {
-                sifPath = await ensureSifImage(runtime, image);
+                sifPath = await ensureSifImage(runtime, image, {
+                    onTiming: (label, elapsedMs) => {
+                        if (startupReport) {
+                            startupReport.timings_ms[label] = elapsedMs;
+                            flushStartupReport();
+                        }
+                        startupTimings.push([label, elapsedMs]);
+                    },
+                    onWarning: noteStartupWarning,
+                    onHint: noteColdStartHint,
+                });
             }
+            const buildArgsStartedAt = Date.now();
             args = buildApptainerArgs(session, sifPath, sessionId, runtimeEnvArgs);
+            recordStartupTiming('image_prepare_build_args', buildArgsStartedAt);
         }
         else {
             if (bridgeCodexOauthForPodman) {
@@ -2595,6 +2782,7 @@ async function startSession(session) {
     if (session.dryRun) {
         setStartupLaunchMode('dry-run');
         setStartupStatus('dry-run');
+        completeStartup('dry-run');
         prettyPrintCommand(runtime, args);
         flushStartupReport();
         return;
@@ -2757,6 +2945,7 @@ async function startSession(session) {
                     launchHeartbeat.stop();
                     codexOauthHeartbeat?.stop();
                     if (startupReport) {
+                        completeStartup('process-exit');
                         startupReport.exit_code = event.exitCode ?? 0;
                         startupReport.status = 'exited';
                         flushStartupReport();
@@ -2807,12 +2996,14 @@ async function startSession(session) {
     const child = (0, child_process_1.spawn)(runtime, args, { stdio: 'inherit' });
     if (startupReport && startupReport.first_output_ms === null) {
         startupReport.status = 'running';
+        completeStartup('spawn');
         flushStartupReport();
     }
     startDeferredSlurmPassthrough();
     const timeoutHandle = setupSessionTimeout(session, sessionId, runtime, () => child.exitCode !== null, () => child.kill('SIGTERM'));
     child.on('close', (code) => {
         if (startupReport) {
+            completeStartup('process-exit');
             startupReport.exit_code = code ?? 0;
             startupReport.status = 'exited';
             flushStartupReport();
@@ -2968,6 +3159,9 @@ async function restartSession(id, opts) {
         config,
         dryRun: false,
         footerMode: 'once',
+        dangerouslySkipPermissions: shouldUseDangerousPermissionsByDefault(agent, {
+            linkedWebTerminalId: sessionData.webTerminalId,
+        }),
         sharedSessionsDir: effective.sharedSessionsDir,
         sharedAuditDir: effective.sharedAuditDir,
     });