libre-webui 0.16.1 → 0.18.0

package/backend/dist/services/workRuntimeService.js

@@ -19,6 +19,8 @@ import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { getDatabase } from '../db.js';
 import { createLogger } from '../utils/logger.js';
+import { buildWorkGitCommand, parseWorkGitBranches, parseWorkGitLog, parseWorkGitStatus, validateWorkGitBranchName, validateWorkGitRepositoryPaths, } from '../utils/workGit.js';
+import workPreviewProxyService from './workPreviewProxyService.js';
 const logger = createLogger('services:work-runtime');
 const activeDockerProcesses = new Set();
 export const WORK_RUNTIME_DEFAULTS = {
@@ -32,10 +34,14 @@ export const WORK_RUNTIME_DEFAULTS = {
     pidsLimit: 256,
     previewPort: 4173,
     previewBind: '127.0.0.1',
+    networkName: 'libre-webui-work',
 };
+// Two runtimes per administrator so a second task does not have to wait for
+// the first, three per instance to bound the worst case at three containers'
+// resource caps. Both remain tunable through WORK_MAX_ACTIVE_RUNTIMES_*.
 export const WORK_RUNTIME_ADMISSION_DEFAULTS = {
-    maxActiveRuntimesGlobal: 2,
-    maxActiveRuntimesPerUser: 1,
+    maxActiveRuntimesGlobal: 3,
+    maxActiveRuntimesPerUser: 2,
 };
 const config = {
     image: process.env.WORK_RUNTIME_IMAGE || WORK_RUNTIME_DEFAULTS.image,
@@ -50,24 +56,29 @@ const config = {
     // Interface the daemon publishes a task preview on. Loopback keeps a preview
     // private to the Docker host, which is correct when the browser runs there.
     previewBind: process.env.WORK_PREVIEW_BIND || WORK_RUNTIME_DEFAULTS.previewBind,
-    // Host advertised in the preview URL. It differs from the bind address when
-    // the browser reaches the Docker host by another name.
-    previewHost: process.env.WORK_PREVIEW_HOST ||
-        process.env.WORK_PREVIEW_BIND ||
-        WORK_RUNTIME_DEFAULTS.previewBind,
     maxActiveRuntimesGlobal: positiveInteger(process.env.WORK_MAX_ACTIVE_RUNTIMES_GLOBAL, WORK_RUNTIME_ADMISSION_DEFAULTS.maxActiveRuntimesGlobal),
     maxActiveRuntimesPerUser: positiveInteger(process.env.WORK_MAX_ACTIVE_RUNTIMES_PER_USER, WORK_RUNTIME_ADMISSION_DEFAULTS.maxActiveRuntimesPerUser),
+    // Dedicated bridge network for networked Work tasks. It is created with
+    // inter-container communication disabled, so a sandbox cannot reach other
+    // Work sandboxes or the deployment's own containers on the default bridge.
+    networkName: process.env.WORK_NETWORK_NAME || WORK_RUNTIME_DEFAULTS.networkName,
+    // Optional resolvers forced onto every networked sandbox. Pointing this at
+    // a filtering resolver is the supported egress-policy hook.
+    dnsServers: parseDnsServers(process.env.WORK_RUNTIME_DNS),
 };
 const PREVIEW_READY_TIMEOUT_MS = 15000;
 const PREVIEW_POLL_INTERVAL_MS = 250;
 const runtimePolicyFingerprint = createHash('sha256')
     .update(JSON.stringify({
-    version: 1,
+    version: 2,
     memoryLimit: config.memoryLimit,
     cpuLimit: config.cpuLimit,
     pidsLimit: config.pidsLimit,
     previewPort: config.previewPort,
     previewBind: config.previewBind,
+    networkName: config.networkName,
+    dnsServers: config.dnsServers,
+    memorySwapPinned: true,
 }))
     .digest('hex');
 export class WorkRuntimeError extends Error {
@@ -86,6 +97,8 @@ export class WorkRuntimeService {
             maxRounds: config.maxAgentRounds,
             commandTimeoutMs: config.commandTimeoutMs,
             maxOutputChars: config.maxOutputChars,
+            maxActiveRuntimesGlobal: config.maxActiveRuntimesGlobal,
+            maxActiveRuntimesPerUser: config.maxActiveRuntimesPerUser,
         };
         this.lifecycleTails = new Map();
         this.preparations = new Map();
@@ -95,6 +108,7 @@ export class WorkRuntimeService {
         this.lastDockerUnavailableReason = null;
         this.runtimeLeases = new Map();
         this.previewLeaseReleases = new Map();
+        this.terminalHolds = new Map();
         this.recoveryTasks = new Map();
         this.shuttingDown = false;
     }
@@ -133,6 +147,20 @@ export class WorkRuntimeService {
     get dockerUnavailableReason() {
         return this.lastDockerUnavailableReason;
     }
+    /**
+     * Live runtime occupancy, so the interface can say "1 of 2 runtimes in use"
+     * instead of surprising the administrator with a 429 at submit time.
+     */
+    activeRuntimeCounts(userId) {
+        let user = 0;
+        if (userId) {
+            for (const lease of this.runtimeLeases.values()) {
+                if (lease.userId === userId)
+                    user += 1;
+            }
+        }
+        return { global: this.runtimeLeases.size, user };
+    }
     async beginRecovery(tasks) {
         for (const task of tasks) {
             this.recoveryTasks.set(task.id, task);
@@ -227,6 +255,46 @@ export class WorkRuntimeService {
             throw error;
         }
     }
+    /**
+     * Hold the task container up for an interactive terminal session. The hold
+     * goes through the same admission (runtime lease), policy verification, and
+     * container preparation as every other runtime operation, and keeps the
+     * idle-stop path from tearing the container down while a shell is attached.
+     */
+    async acquireTerminalHold(task) {
+        if (this.activeCommands.has(task.id)) {
+            throw new WorkRuntimeError('A Work command is running in this container. Wait for it to finish, then reconnect the terminal.', 409, 'WORK_TERMINAL_COMMAND_ACTIVE');
+        }
+        const releaseLease = await this.prepare(task);
+        this.terminalHolds.set(task.id, (this.terminalHolds.get(task.id) ?? 0) + 1);
+        let released = false;
+        return async () => {
+            if (released)
+                return;
+            released = true;
+            const remaining = (this.terminalHolds.get(task.id) ?? 1) - 1;
+            if (remaining <= 0) {
+                this.terminalHolds.delete(task.id);
+            }
+            else {
+                this.terminalHolds.set(task.id, remaining);
+            }
+            try {
+                if (remaining <= 0 && !this.shuttingDown) {
+                    await this.withLifecycleLock(task.id, () => this.stopContainerIfIdleWithLock(task));
+                }
+            }
+            catch (error) {
+                logger.warn(`Could not idle Work container ${task.containerName} after terminal session:`, error);
+            }
+            finally {
+                releaseLease();
+            }
+        };
+    }
+    terminalSessionCount(taskId) {
+        return this.terminalHolds.get(taskId) ?? 0;
+    }
     beginShutdown() {
         this.shuttingDown = true;
         if (this.recoveryTimer) {
@@ -323,8 +391,39 @@ export class WorkRuntimeService {
             this.assertTaskIsActive(task);
         }
     }
+    async ensureWorkNetwork(task) {
+        if (!task.networkEnabled)
+            return;
+        const inspect = await this.docker([
+            'network',
+            'inspect',
+            '--format',
+            '{{index .Labels "ai.libre-webui.managed"}} {{index .Options "com.docker.network.bridge.enable_icc"}}',
+            config.networkName,
+        ], { acceptFailure: true });
+        if (inspect.exitCode === 0) {
+            const [managed, icc] = inspect.stdout.trim().split(' ');
+            if (managed !== 'true' || icc !== 'false') {
+                throw new WorkRuntimeError(`Docker network "${config.networkName}" exists but is not the managed Work sandbox network (label ai.libre-webui.managed=true with inter-container communication disabled). Remove it or point WORK_NETWORK_NAME at an unused name.`, 503, 'WORK_NETWORK_CONFLICT');
+            }
+            return;
+        }
+        const created = await this.docker([
+            'network',
+            'create',
+            '--label',
+            'ai.libre-webui.managed=true',
+            '--opt',
+            'com.docker.network.bridge.enable_icc=false',
+            config.networkName,
+        ], { acceptFailure: true });
+        if (created.exitCode !== 0 && !/already exists/i.test(created.stderr)) {
+            throw new WorkRuntimeError(`Could not create the Work sandbox network "${config.networkName}": ${created.stderr.trim()}`, 503, 'WORK_NETWORK_UNAVAILABLE');
+        }
+    }
     async ensureContainer(task) {
         this.assertRuntimeLease(task);
+        await this.ensureWorkNetwork(task);
         if (await this.containerExists(task.containerName)) {
             await this.assertManagedContainer(task);
             if (!(await this.containerMatchesTaskPolicy(task))) {
@@ -539,6 +638,10 @@ export class WorkRuntimeService {
     async stopContainerIfIdleWithLock(task) {
         if (this.activeCommands.has(task.id))
             return;
+        // An attached terminal session owns the running container exactly like a
+        // ready preview does.
+        if ((this.terminalHolds.get(task.id) ?? 0) > 0)
+            return;
         try {
             if ((await this.previewProcessCheckWithLock(task)) === 'ready' &&
                 this.previewLeaseReleases.has(task.id)) {
@@ -558,7 +661,11 @@ export class WorkRuntimeService {
         return this.withWorkspaceHelperContainer(task, async () => {
             const result = await this.exec(task, ['node', '-e', READ_FILE_SCRIPT, '--', workspacePath], 
             // JSON may escape each input byte as a six-character Unicode sequence.
-            { maxOutputChars: 12100000 });
+            { maxOutputChars: 12100000, acceptFailure: true });
+            if (result.exitCode === 24) {
+                throw new WorkRuntimeError('This file is not valid UTF-8 and cannot be opened in the text editor.', 415, 'WORK_FILE_NOT_UTF8');
+            }
+            this.assertSuccessfulHelperCommand(result, 'The workspace file could not be read.', 'WORK_FILE_READ_FAILED');
             const payload = parseJsonOutput(result.stdout);
             return {
                 path: workspacePath,
@@ -567,6 +674,114 @@ export class WorkRuntimeService {
             };
         });
     }
+    async getGitStatus(task) {
+        return this.withWorkspaceHelperContainer(task, () => this.loadGitStatus(task));
+    }
+    async getGitDiff(task, requestedPath) {
+        const workspacePath = requestedPath
+            ? validateWorkspacePath(requestedPath, false)
+            : undefined;
+        return this.withWorkspaceHelperContainer(task, async () => {
+            const status = await this.loadGitStatus(task);
+            if (!status.initialized) {
+                throw new WorkRuntimeError('Initialize Git before requesting a diff.', 409, 'WORK_GIT_NOT_INITIALIZED');
+            }
+            const revisionArgs = status.head ? ['HEAD'] : ['--cached'];
+            const result = await this.execGit(task, [
+                'diff',
+                ...revisionArgs,
+                '--no-ext-diff',
+                '--no-textconv',
+                '--',
+                ...(workspacePath ? [workspacePath] : []),
+            ], { maxOutputChars: 600000 });
+            return {
+                ...(workspacePath ? { path: workspacePath } : {}),
+                patch: result.stdout,
+                truncated: result.truncated,
+            };
+        });
+    }
+    async initializeGit(task) {
+        return this.withGitMutation(task, async () => {
+            const current = await this.loadGitStatus(task);
+            if (current.initialized)
+                return current;
+            await this.requireGitSuccess(task, ['init', '--initial-branch=main', '--template=', '.'], 'Git could not initialize this workspace.');
+            return this.loadGitStatus(task);
+        });
+    }
+    async stageGitPaths(task, requestedPaths) {
+        if (requestedPaths.length < 1 || requestedPaths.length > 200) {
+            throw new WorkRuntimeError('Choose between 1 and 200 workspace paths to stage.', 400, 'WORK_GIT_INVALID_PATHS');
+        }
+        const workspacePaths = [
+            ...new Set(requestedPaths.map(value => validateWorkspacePath(value, false))),
+        ];
+        return this.withGitMutation(task, async () => {
+            await this.requireGitRepository(task);
+            await this.assertNoExecutableGitFilters(task);
+            await this.requireGitSuccess(task, ['add', '--all', '--', ...workspacePaths], 'Git could not stage the selected paths.');
+            return this.loadGitStatus(task);
+        });
+    }
+    async commitGit(task, message, identity) {
+        const commitMessage = message.trim();
+        if (!commitMessage ||
+            commitMessage.length > 4000 ||
+            commitMessage.includes('\0')) {
+            throw new WorkRuntimeError('Commit message must contain between 1 and 4,000 characters.', 400, 'WORK_GIT_INVALID_COMMIT_MESSAGE');
+        }
+        const name = validateGitIdentity(identity.name, 'name');
+        const email = validateGitIdentity(identity.email, 'email');
+        return this.withGitMutation(task, async () => {
+            await this.requireGitRepository(task);
+            await this.requireGitSuccess(task, [
+                '-c',
+                `user.name=${name}`,
+                '-c',
+                `user.email=${email}`,
+                'commit',
+                '--no-verify',
+                '-m',
+                commitMessage,
+            ], 'Git could not create the commit.');
+            return this.loadGitStatus(task);
+        });
+    }
+    async createGitBranch(task, requestedName) {
+        const branchName = validateGitBranchInput(requestedName);
+        return this.withGitMutation(task, async () => {
+            const status = await this.loadGitStatus(task);
+            if (!status.initialized) {
+                throw new WorkRuntimeError('Initialize Git before creating a branch.', 409, 'WORK_GIT_NOT_INITIALIZED');
+            }
+            if (!status.head) {
+                throw new WorkRuntimeError('Create the first commit before creating another branch.', 409, 'WORK_GIT_UNBORN_BRANCH');
+            }
+            await this.requireValidGitBranch(task, branchName);
+            await this.requireGitSuccess(task, ['branch', branchName], 'Git could not create the branch.');
+            return this.loadGitStatus(task);
+        });
+    }
+    async switchGitBranch(task, requestedName) {
+        const branchName = validateGitBranchInput(requestedName);
+        return this.withGitMutation(task, async () => {
+            const status = await this.loadGitStatus(task);
+            if (!status.initialized) {
+                throw new WorkRuntimeError('Initialize Git before switching branches.', 409, 'WORK_GIT_NOT_INITIALIZED');
+            }
+            if (status.changes.length > 0) {
+                throw new WorkRuntimeError('Commit or discard workspace changes before switching branches.', 409, 'WORK_GIT_DIRTY_WORKTREE');
+            }
+            if (!status.branches.includes(branchName)) {
+                throw new WorkRuntimeError('Only an existing local branch can be selected.', 400, 'WORK_GIT_UNKNOWN_BRANCH');
+            }
+            await this.assertNoExecutableGitFilters(task);
+            await this.requireGitSuccess(task, ['switch', '--no-guess', branchName], 'Git could not switch branches.');
+            return this.loadGitStatus(task);
+        });
+    }
     async writeFile(task, requestedPath, content, expectedUpdatedAt) {
         const workspacePath = validateWorkspacePath(requestedPath, false);
         if (Buffer.byteLength(content, 'utf8') > 2000000) {
@@ -600,6 +815,59 @@ export class WorkRuntimeService {
             };
         });
     }
+    /**
+     * Delete a workspace file, symlink, or directory. Directories require an
+     * explicit recursive flag, and the workspace root is never deletable. Runs
+     * through the helper container, so it also works while a preview holds the
+     * task container.
+     */
+    async deletePath(task, requestedPath, recursive = false) {
+        const workspacePath = validateWorkspacePath(requestedPath, false);
+        return this.withWorkspaceHelperContainer(task, async () => {
+            const result = await this.exec(task, [
+                'node',
+                '-e',
+                DELETE_PATH_SCRIPT,
+                '--',
+                workspacePath,
+                recursive ? 'recursive' : '',
+            ], { maxOutputChars: 10000, acceptFailure: true });
+            if (result.exitCode === 21) {
+                throw new WorkRuntimeError(`No file or directory exists at ${workspacePath}.`, 404, 'WORK_FILE_NOT_FOUND');
+            }
+            if (result.exitCode === 22) {
+                throw new WorkRuntimeError(`${workspacePath} is a directory. Pass recursive: true to delete it with its contents.`, 409, 'WORK_DELETE_REQUIRES_RECURSIVE');
+            }
+            if (result.exitCode !== 0) {
+                throw new WorkRuntimeError(result.stderr.trim() || 'Could not delete the workspace path.', 503, 'WORK_FILE_DELETE_FAILED');
+            }
+            const payload = parseJsonOutput(result.stdout);
+            return { path: workspacePath, type: payload.type };
+        });
+    }
+    /**
+     * Move or rename a workspace file or directory. Destination parents are
+     * created inside the workspace, an existing destination is never
+     * overwritten, and like deletePath this works while a preview is running.
+     */
+    async movePath(task, requestedFrom, requestedTo) {
+        const fromPath = validateWorkspacePath(requestedFrom, false);
+        const toPath = validateWorkspacePath(requestedTo, false);
+        return this.withWorkspaceHelperContainer(task, async () => {
+            const result = await this.exec(task, ['node', '-e', MOVE_PATH_SCRIPT, '--', fromPath, toPath], { maxOutputChars: 10000, acceptFailure: true });
+            if (result.exitCode === 21) {
+                throw new WorkRuntimeError(`No file or directory exists at ${fromPath}.`, 404, 'WORK_FILE_NOT_FOUND');
+            }
+            if (result.exitCode === 24) {
+                throw new WorkRuntimeError(`${toPath} already exists. Delete it first or choose another destination.`, 409, 'WORK_DESTINATION_EXISTS');
+            }
+            if (result.exitCode !== 0) {
+                throw new WorkRuntimeError(result.stderr.trim() || 'Could not move the workspace path.', 503, 'WORK_FILE_MOVE_FAILED');
+            }
+            parseJsonOutput(result.stdout);
+            return { from: fromPath, to: toPath };
+        });
+    }
     async searchFiles(task, query, requestedPath = '.') {
         const workspacePath = validateWorkspacePath(requestedPath);
         if (!query.trim() || query.length > 500) {
@@ -853,7 +1121,7 @@ export class WorkRuntimeService {
             if (!publishedPort) {
                 throw new WorkRuntimeError('Docker did not publish the preview port.', 503, 'WORK_PREVIEW_PORT_UNAVAILABLE');
             }
-            return `http://${formatPreviewHost(config.previewHost)}:${publishedPort}`;
+            return workPreviewProxyService.createPreviewUrl(task.id, publishedPort);
         }
         catch (error) {
             try {
@@ -1093,7 +1361,7 @@ export class WorkRuntimeService {
             ? inspected.Mounts.map(objectRecord)
             : [];
         const workspaceMount = mounts.find(mount => mount.Destination === '/workspace');
-        const expectedNetwork = task.networkEnabled ? 'bridge' : 'none';
+        const expectedNetwork = task.networkEnabled ? config.networkName : 'none';
         const portBindings = objectRecord(hostConfig.PortBindings);
         const previewBindings = Array.isArray(portBindings[`${config.previewPort}/tcp`])
             ? portBindings[`${config.previewPort}/tcp`].map(objectRecord)
@@ -1118,6 +1386,7 @@ export class WorkRuntimeService {
             securityOpt.includes('no-new-privileges') &&
             Number(hostConfig.PidsLimit) === config.pidsLimit &&
             Number(hostConfig.Memory) > 0 &&
+            Number(hostConfig.MemorySwap) === Number(hostConfig.Memory) &&
             Number(hostConfig.NanoCpus) > 0 &&
             hostConfig.NetworkMode === expectedNetwork &&
             portPolicyMatches &&
@@ -1193,6 +1462,136 @@ export class WorkRuntimeService {
             }
         }
     }
+    async withGitMutation(task, operation) {
+        this.assertGitMutationIdle(task.id);
+        return this.withWorkspaceHelperContainer(task, async () => {
+            this.assertGitMutationIdle(task.id);
+            return operation();
+        });
+    }
+    assertGitMutationIdle(taskId) {
+        if (this.activeCommands.has(taskId) ||
+            (this.terminalHolds.get(taskId) ?? 0) > 0 ||
+            this.previewLeaseReleases.has(taskId)) {
+            throw new WorkRuntimeError('Stop the active Work run, terminal, and preview before changing Git state.', 409, 'WORK_GIT_RUNTIME_BUSY');
+        }
+    }
+    async loadGitStatus(task) {
+        if (!(await this.probeGitRepository(task))) {
+            return {
+                initialized: false,
+                detached: false,
+                ahead: 0,
+                behind: 0,
+                changes: [],
+                branches: [],
+                commits: [],
+            };
+        }
+        const statusResult = await this.execGit(task, ['status', '--porcelain=v2', '--branch', '-z', '--untracked-files=all'], { maxOutputChars: 2000000 });
+        if (statusResult.truncated) {
+            throw new WorkRuntimeError('Git status is too large to display safely.', 413, 'WORK_GIT_STATUS_TOO_LARGE');
+        }
+        const status = parseWorkGitStatus(statusResult.stdout);
+        const branchesResult = await this.execGit(task, ['for-each-ref', '--format=%(refname:short)', 'refs/heads'], { maxOutputChars: 100000 });
+        if (branchesResult.truncated) {
+            throw new WorkRuntimeError('The local branch list is too large to display safely.', 413, 'WORK_GIT_BRANCHES_TOO_LARGE');
+        }
+        status.branches = parseWorkGitBranches(branchesResult.stdout);
+        if (status.branch && !status.branches.includes(status.branch)) {
+            status.branches.unshift(status.branch);
+        }
+        if (status.head) {
+            const logResult = await this.execGit(task, ['log', '-n', '20', '--format=format:%H%x00%h%x00%an%x00%aI%x00%s%x00'], { maxOutputChars: 200000 });
+            if (logResult.truncated) {
+                throw new WorkRuntimeError('Git history is too large to display safely.', 413, 'WORK_GIT_HISTORY_TOO_LARGE');
+            }
+            status.commits = parseWorkGitLog(logResult.stdout);
+        }
+        return status;
+    }
+    async probeGitRepository(task) {
+        const result = await this.execGit(task, [
+            'rev-parse',
+            '--path-format=absolute',
+            '--show-toplevel',
+            '--git-dir',
+            '--git-common-dir',
+        ], { acceptFailure: true, maxOutputChars: 20000 });
+        if (result.exitCode === 127) {
+            throw new WorkRuntimeError('Git is not installed in the configured Work runtime image.', 503, 'WORK_GIT_UNAVAILABLE');
+        }
+        if (result.exitCode !== 0)
+            return false;
+        try {
+            validateWorkGitRepositoryPaths(result.stdout);
+        }
+        catch (error) {
+            throw new WorkRuntimeError(error instanceof Error
+                ? error.message
+                : 'Git repository layout is unsafe.', 409, 'WORK_GIT_UNSAFE_REPOSITORY');
+        }
+        const [, gitDirectory, commonDirectory] = result.stdout
+            .trimEnd()
+            .split('\n');
+        const realPathCheck = await this.exec(task, [
+            'node',
+            '-e',
+            VALIDATE_GIT_REPOSITORY_PATHS_SCRIPT,
+            '--',
+            gitDirectory,
+            commonDirectory,
+        ], { acceptFailure: true, maxOutputChars: 10000 });
+        if (realPathCheck.exitCode !== 0) {
+            throw new WorkRuntimeError('Git metadata must resolve inside /workspace.', 409, 'WORK_GIT_UNSAFE_REPOSITORY');
+        }
+        return true;
+    }
+    async requireGitRepository(task) {
+        if (await this.probeGitRepository(task))
+            return;
+        throw new WorkRuntimeError('Initialize Git before changing repository state.', 409, 'WORK_GIT_NOT_INITIALIZED');
+    }
+    async assertNoExecutableGitFilters(task) {
+        const result = await this.execGit(task, [
+            'config',
+            '--includes',
+            '--get-regexp',
+            '^filter\\..*\\.(clean|smudge|process)$',
+        ], { acceptFailure: true, maxOutputChars: 20000 });
+        if (result.exitCode > 1) {
+            this.throwGitFailure(result, 'Git configuration could not be inspected.');
+        }
+        if (result.stdout.trim()) {
+            throw new WorkRuntimeError('This repository configures executable Git filters. Remove them before using Git write actions in Work.', 409, 'WORK_GIT_EXECUTABLE_FILTER_BLOCKED');
+        }
+    }
+    async requireValidGitBranch(task, branchName) {
+        const result = await this.execGit(task, ['check-ref-format', '--branch', branchName], { acceptFailure: true, maxOutputChars: 10000 });
+        if (result.exitCode !== 0) {
+            throw new WorkRuntimeError('Branch name is invalid.', 400, 'WORK_GIT_INVALID_BRANCH');
+        }
+    }
+    async requireGitSuccess(task, args, fallbackMessage) {
+        const result = await this.execGit(task, args, {
+            acceptFailure: true,
+            maxOutputChars: 100000,
+        });
+        if (result.exitCode !== 0)
+            this.throwGitFailure(result, fallbackMessage);
+        return result;
+    }
+    throwGitFailure(result, fallbackMessage) {
+        throw new WorkRuntimeError(result.stderr.trim() || result.stdout.trim() || fallbackMessage, 409, 'WORK_GIT_COMMAND_FAILED');
+    }
+    assertSuccessfulHelperCommand(result, fallbackMessage, code) {
+        if (result.exitCode === 0)
+            return;
+        throw new WorkRuntimeError(result.stderr.trim() || result.stdout.trim() || fallbackMessage, 503, code);
+    }
+    async execGit(task, args, options = {}) {
+        return this.exec(task, buildWorkGitCommand(args), options);
+    }
     async exec(task, command, options = {}) {
         const args = [
             'exec',
@@ -1274,15 +1673,25 @@ export function buildWorkContainerRunArgs(task, image = config.image) {
         String(config.pidsLimit),
         '--memory',
         config.memoryLimit,
+        // Same value as --memory: the memory cap cannot be sidestepped via swap.
+        '--memory-swap',
+        config.memoryLimit,
         '--cpus',
         config.cpuLimit,
         '--network',
-        task.networkEnabled ? 'bridge' : 'none',
+        task.networkEnabled ? config.networkName : 'none',
     ];
     if (task.networkEnabled) {
         args.push('--publish', `${config.previewBind}::${config.previewPort}`);
+        for (const server of config.dnsServers) {
+            args.push('--dns', server);
+        }
     }
-    args.push('--mount', `type=volume,src=${task.volumeName},dst=/workspace,volume-nocopy`, image, 'tail', '-f', '/dev/null');
+    args.push('--mount', task.hostPath
+        ? // Host-folder workspaces are opt-in per deployment and validated
+            // against an allowlist before ever reaching this point.
+            `type=bind,src=${task.hostPath},dst=/workspace`
+        : `type=volume,src=${task.volumeName},dst=/workspace,volume-nocopy`, image, 'tail', '-f', '/dev/null');
     return args;
 }
 export function validateWorkspacePath(input, allowRoot = true) {
@@ -1302,6 +1711,25 @@ export function validateWorkspacePath(input, allowRoot = true) {
     }
     return canonical;
 }
+function validateGitBranchInput(input) {
+    try {
+        return validateWorkGitBranchName(input);
+    }
+    catch {
+        throw new WorkRuntimeError('Branch name is invalid.', 400, 'WORK_GIT_INVALID_BRANCH');
+    }
+}
+function validateGitIdentity(value, field) {
+    const maximum = field === 'name' ? 200 : 320;
+    const hasControlCharacter = [...value].some(character => {
+        const code = character.charCodeAt(0);
+        return code <= 31 || code === 127;
+    });
+    if (!value || value.length > maximum || hasControlCharacter) {
+        throw new WorkRuntimeError(`Git ${field} is invalid.`, 400, 'WORK_GIT_INVALID_IDENTITY');
+    }
+    return value;
+}
 export function parsePublishedPort(output, _containerPort = config.previewPort, bindAddress = config.previewBind) {
     // Only a binding on the interface this deployment asked for counts. The
     // default stays loopback, so a stray wildcard binding is still rejected.
@@ -1443,6 +1871,21 @@ function positiveInteger(value, fallback) {
     const parsed = Number(value);
     return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
 }
+export function parseDnsServers(value) {
+    if (!value)
+        return [];
+    return value
+        .split(',')
+        .map(server => server.trim())
+        .filter(server => {
+        if (!server)
+            return false;
+        if (/^[0-9a-fA-F:.]+$/.test(server))
+            return true;
+        logger.warn(`Ignoring WORK_RUNTIME_DNS entry "${server}": not an IPv4/IPv6 address.`);
+        return false;
+    });
+}
 function objectRecord(value) {
     return value && typeof value === 'object'
         ? value
@@ -1489,6 +1932,21 @@ const rel = process.argv[1] || '.';
 const target = path.resolve(root, rel);
 if (!inside(target)) throw new Error('Path escapes workspace');
 `;
+const VALIDATE_GIT_REPOSITORY_PATHS_SCRIPT = String.raw `
+const fs = require('node:fs');
+const path = require('node:path');
+const root = fs.realpathSync('/workspace');
+const inside = candidate => candidate === root || candidate.startsWith(root + path.sep);
+for (const candidate of process.argv.slice(1)) {
+  let resolved;
+  try {
+    resolved = fs.realpathSync(candidate);
+  } catch {
+    process.exit(25);
+  }
+  if (!inside(resolved) || !fs.statSync(resolved).isDirectory()) process.exit(25);
+}
+`;
 const PREVIEW_READY_SCRIPT = String.raw `
 const fs = require('node:fs');
 const net = require('node:net');
@@ -1797,8 +2255,14 @@ if (!inside(targetReal)) throw new Error('Path escapes workspace');
 const stat = fs.statSync(targetReal);
 if (!stat.isFile()) throw new Error('Path is not a file');
 if (stat.size > 2000000) throw new Error('File exceeds 2 MB limit');
+let content;
+try {
+  content = new TextDecoder('utf-8', {fatal:true}).decode(fs.readFileSync(targetReal));
+} catch {
+  process.exit(24);
+}
 console.log(JSON.stringify({
-  content: fs.readFileSync(targetReal, 'utf8'),
+  content,
   size: stat.size,
   updatedAt: stat.mtimeMs
 }));
@@ -1878,6 +2342,64 @@ process.stdin.on('end', () => {
   console.log(JSON.stringify({size:stat.size, updatedAt:stat.mtimeMs}));
 });
 `;
+const DELETE_PATH_SCRIPT = `${COMMON_PATH_GUARD}
+if (target === rootReal) throw new Error('Refusing to delete the workspace root');
+const parentReal = fs.realpathSync(path.dirname(target));
+if (!inside(parentReal)) throw new Error('Path escapes workspace');
+const safeTarget = path.join(parentReal, path.basename(target));
+let stat;
+try { stat = fs.lstatSync(safeTarget); } catch { process.exit(21); }
+const recursive = process.argv[2] === 'recursive';
+let type;
+if (stat.isSymbolicLink()) {
+  type = 'symlink';
+  fs.unlinkSync(safeTarget);
+} else if (stat.isDirectory()) {
+  if (!recursive) process.exit(22);
+  type = 'directory';
+  fs.rmSync(safeTarget, {recursive: true});
+} else {
+  type = 'file';
+  fs.unlinkSync(safeTarget);
+}
+process.stdout.write(JSON.stringify({type}));
+`;
+const MOVE_PATH_SCRIPT = `${COMMON_PATH_GUARD}
+const destRel = process.argv[2] || '';
+if (!destRel) throw new Error('Destination path is required');
+const destTarget = path.resolve(root, destRel);
+if (!inside(destTarget)) throw new Error('Path escapes workspace');
+if (target === rootReal || destTarget === rootReal) {
+  throw new Error('Refusing to move the workspace root');
+}
+const sourceParentReal = fs.realpathSync(path.dirname(target));
+if (!inside(sourceParentReal)) throw new Error('Path escapes workspace');
+const safeSource = path.join(sourceParentReal, path.basename(target));
+let sourceStat;
+try { sourceStat = fs.lstatSync(safeSource); } catch { process.exit(21); }
+const destParent = path.dirname(destTarget);
+const destParts = path.relative(root, destParent).split(path.sep).filter(Boolean);
+let destParentReal = rootReal;
+for (const part of destParts) {
+  const next = path.join(destParentReal, part);
+  if (!fs.existsSync(next)) fs.mkdirSync(next, {mode:0o755});
+  if (fs.lstatSync(next).isSymbolicLink()) throw new Error('Refusing to traverse symlink');
+  destParentReal = fs.realpathSync(next);
+  if (!inside(destParentReal) || !fs.statSync(destParentReal).isDirectory()) {
+    throw new Error('Path escapes workspace');
+  }
+}
+const safeDest = path.join(destParentReal, path.basename(destTarget));
+let destTaken = false;
+try { fs.lstatSync(safeDest); destTaken = true; } catch {}
+if (destTaken) process.exit(24);
+if (safeSource === safeDest) throw new Error('Source and destination are the same path');
+if (sourceStat.isDirectory() && safeDest.startsWith(safeSource + path.sep)) {
+  throw new Error('Cannot move a directory inside itself');
+}
+fs.renameSync(safeSource, safeDest);
+process.stdout.write(JSON.stringify({moved: true}));
+`;
 const SEARCH_FILES_SCRIPT = `${COMMON_PATH_GUARD}
 const query = String(process.argv[2] || '').toLowerCase();
 const targetReal = fs.realpathSync(target);