opencode-ruby-upgrader 0.1.9 → 0.1.10

package/README.md

@@ -86,6 +86,12 @@ Three flags bound how much a single run can change.
 
 Use `/ruby-upgrade --dry-run` for a no-write inventory and proposed migration assessment; it creates no report, lock, checkpoint, or durable research evidence. Use `/ruby-upgrade --target <version>` (for example `/ruby-upgrade --target 3.4`) to pin an explicit final Ruby version, or `/ruby-upgrade --stop-after-hop` to validate and commit one hop before stopping.
 
+### Local credentials and environment files
+
+`git worktree add` only checks out files tracked by Git. Untracked files (such as `.env`, local credential files, `config/database.yml.local`, or project-specific test environment configuration) are **not** copied from your main worktree to the new linked worktree. If your specs or local test setup require environment variables or credentials to run, you must manually create or copy them into the new worktree (`../<repo>-ruby-<target>/`). The agent never creates, copies, or commits credentials or secrets.
+
+
+
 ## Validated end-to-end run
 
 The agent has completed a real end-to-end migration against a public fixture: [`ruby2-rails4-bootstrap-heroku`](https://github.com/lilla021/ruby2-rails4-bootstrap-heroku) (BSD-2-Clause) moved from **Ruby 2.4.10 / Rails 4.2.11.3** to **Ruby 3.4.10 / Rails 7.1.6** across 15 receipt-backed hops. Every hop was validated by `bundle exec rspec` in an isolated Docker container, then committed as a local checkpoint before the next hop began.
@@ -127,6 +133,18 @@ Both engines run credential-free on a per-run Docker network that carries two ow
 
 Prepared resources are labelled and bound to the worktree, and validation refuses to use them if they carry extra network attachments, published ports, privileged mode, unexpected mounts or commands, or a drifted image. Docker resources are not removed automatically when a run finishes — they persist so later runs stay reproducible. When you no longer need them, remove the run's containers and network by name and delete `.ruby-upgrades/runtime.json`; the names are recorded in that manifest.
 
+### Additional services (Redis, etc.)
+
+The isolated runtime provisions only what the project's tests declare. If the suite requires Redis (Sidekiq, Resque, `gem "redis"`, or references to `REDIS_URL`), the runtime automatically detects it from the project's own declarations and starts an isolated `redis:7-alpine` container on the same per-run network. Other services may be added in the future using the same evidence-based adapter pattern.
+
+- **Evidence-based detection only.** Redis is detected from concrete declarations: `gem "redis"`, `gem "sidekiq"`, `gem "resque"`, `gem "redis-rails"`, references to `Redis.new`, `Sidekiq.configure_server`, `REDIS_URL` in test/development config, or `redis (` entries in `Gemfile.lock`. Incidental strings do not trigger provisioning.
+- **Credential-free and isolated.** The Redis container runs without authentication on the private network, has no published ports, no bind mounts, and carries the same ownership labels as the database and app containers (`runId` and worktree SHA-256). The app container receives `REDIS_URL=redis://<redis-container>:6379/0` at creation time.
+- **Ownership and verification.** On every reuse, each service container is verified to belong to the same run and worktree, match the allowlisted image, run on only the isolated network, remain unprivileged with no published ports, and have the expected environment. Any drift causes safe replacement.
+- **No secrets exposed.** Service URLs are derived at runtime from container names; they are not read from user environment, not persisted in committed evidence beyond runtime.json metadata, and not logged.
+- **Automatic service provisioning.** Detects Redis (Sidekiq/Resque/redis gems) and browser/system test drivers (Selenium/Cuprite/Capybara system specs, `js: true`, `driven_by :selenium`) from project declarations. When detected, starts isolated allowlisted containers on the private network with per-run ownership labels, wires environment variables (e.g. `REDIS_URL`, `SELENIUM_URL`/`CHROME_REMOTE_URL`) into the app container, and verifies readiness before running tests.
+
+
+
 It writes nonsecret `.ruby-upgrades/runtime.json` with the run and worktree binding, the selected engine and container names, both resolved image IDs, and preparation digests; raw output, `DATABASE_URL`, and your local path are never persisted. `docker-bundle-rspec` reuses and verifies that manifest — including that it belongs to the run receiving the receipt, the exact requested Ruby execution, the exact requested database image, and the isolated network — before executing the fixed `docker exec --env DATABASE_CLEANER_ALLOW_REMOTE_DATABASE_URL=true <container> bundle exec rspec`. The safeguard override is scoped to the verified isolated test process; no container name, report path, or environment value is needed from the user.
 
 Receipts persist only an output digest and byte count, plus structured test metrics; raw validation output is deliberately not committed. Docker receipts additionally record the run identity, container IDs, image IDs, and network ID that produced them, so evidence cannot be silently re-pointed at another run or engine. Each receipt also binds to a non-evidence working-tree fingerprint, which the commit gate rechecks after final validation. A checkpoint commit carries the receipt digest.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-ruby-upgrader",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "A safe, evidence-driven Ruby runtime upgrade agent and local migration dashboard for OpenCode",
   "author": "Priscilla Cournoyer (https://github.com/lilla021)",
   "repository": {
@@ -57,4 +57,4 @@
   "publishConfig": {
     "access": "public"
   }
-}
+}

package/src/controller.js

@@ -260,7 +260,7 @@ export function recordExecutedBundlerIteration({ root = process.cwd(), reportPat
   const pinned = inventoryBundledWith(root);
   if (bundlerSeries(pinned ?? "") !== bundlerSeries(iteration.to)) throw new Error(`Gemfile.lock still records Bundler ${pinned ?? "none"}; a hop to ${iteration.to} requires the BUNDLED WITH pin to be rewritten first.`);
   if (bundlerSeries(receipt.environment?.bundlerVersion ?? "") !== bundlerSeries(iteration.to)) throw new Error(`Validation executed Bundler ${receipt.environment?.bundlerVersion ?? "an unrecorded version"}, not ${iteration.to}. Re-prepare the target runtime on the new Bundler before recording this hop.`);
-  run.iterations.push({ ...iteration, status: "complete", lockfilePin: pinned }); writeRun(root, reportPath, run); return run;
+  run.iterations.push({ ...iteration, status: "complete", lockfilePin: pinned, tests: { ...receipt.testEvidence, smoke: iteration?.tests?.smoke }, validationReceipts: [receipt] }); writeRun(root, reportPath, run); return run;
 }
 
 export function recordDependencyReview({ root = process.cwd(), reportPath, compatibility, licenses }) {
@@ -333,14 +333,13 @@ export function resumeRun({ root = process.cwd(), reportPath, continueAfterHop =
   const run = readRun(root, reportPath);
   if (run.status === "complete") throw new Error("This run is complete; start a new run instead.");
   if ((run.frameworkBridge || run.bundlerBridge) && run.phase === "blocked") throw new Error("This Ruby run is blocked by an approved compatibility bridge and cannot resume. Complete the linked bridge, then begin a fresh Ruby run.");
-  if (run.phase === "paused" && !transitions.paused.includes(run.resumePhase)) throw new Error("Paused run has no safe resume phase.");
+  if (run.phase !== "paused") throw new Error("Cannot resume a run that is not paused. If the lock is stale, use recovery (release-lock --force) after verifying no other process owns the worktree.");
+  if (!transitions.paused.includes(run.resumePhase)) throw new Error("Paused run has no safe resume phase.");
   if (run.control.stopAfterHop && run.iterations.length >= 1 && run.resumePhase === "committed" && !continueAfterHop) throw new Error("This run stopped after its requested hop. Resume with explicit --continue-after-hop only after user review.");
   if (continueAfterHop) run.control.stopAfterHop = false;
   const lock = acquireRunLock(root, reportPath); run.lockNonce = lock.nonce;
   try {
-   if (run.phase === "paused") {
     run.phase = run.resumePhase; run.status = "in_progress"; delete run.resumePhase; writeRun(root, reportPath, run);
-   }
   } catch (error) { releaseRunLock(root, reportPath, lock.nonce); throw error; }
   return { lock, run: readRun(root, reportPath) };
 }

package/src/services.js

@@ -0,0 +1,129 @@
+// Service adapters for isolated target runtime.
+//
+// Each adapter defines container lifecycle (image, start args, readiness probe)
+// and the environment variables the app container needs to reach the service
+// over the per-run private Docker network. Only allowlisted adapter images are
+// permitted; no user-supplied images or environment values.
+
+import fs from "node:fs";
+import path from "node:path";
+
+const NAME = /^[a-z0-9][a-z0-9-]{0,127}$/;
+
+function waitSecond() { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1000); }
+
+function readyLoop({ probe, attempts, label }) {
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    if (probe().status === 0) return;
+    waitSecond();
+  }
+  throw new Error(`Target ${label} did not become ready within ${attempts} seconds. Rerun prepare-target-runtime --ruby <x.y.z>.`);
+}
+
+export const services = Object.freeze({
+  redis: Object.freeze({
+    type: "redis",
+    label: "Redis",
+    image: "redis:7-alpine",
+    port: 6379,
+    // Start Redis in the foreground with default config; no authentication in
+    // the isolated test network.
+    startArgs: () => ["redis:7-alpine", "redis-server", "--appendonly", "no"],
+    // Probe readiness with redis-cli against localhost.
+    readyArgs: (container) => ["exec", container, "redis-cli", "ping"],
+    // Expose REDIS_URL so the app reaches Redis over the private network by
+    // container name. Use DB 0 for test isolation by convention.
+    env: ({ container }) => ({ REDIS_URL: `redis://${container}:6379/0` }),
+    ensureReady: ({ probe }) => readyLoop({ probe, attempts: 30, label: "Redis" })
+  }),
+  chrome: Object.freeze({
+    type: "chrome",
+    label: "Chrome",
+    image: "selenium/standalone-chrome:latest",
+    port: 4444,
+    startArgs: () => ["--shm-size=2g", "selenium/standalone-chrome:latest"],
+    readyArgs: (container) => ["exec", container, "curl", "-s", "--fail", "http://localhost:4444/wd/hub/status"],
+    env: ({ container }) => ({
+      SELENIUM_URL: "http://chrome:4444/wd/hub",
+      CHROME_REMOTE_URL: "http://chrome:4444",
+      CAPYBARA_SERVER_HOST: "0.0.0.0"
+    }),
+    ensureReady: ({ probe }) => readyLoop({ probe, attempts: 120, label: "Chrome" })
+  }),
+  selenium: Object.freeze({
+    type: "selenium",
+    label: "Selenium",
+    image: "selenium/standalone-chrome:latest",
+    port: 4444,
+    startArgs: () => ["--shm-size=2g", "selenium/standalone-chrome:latest"],
+    readyArgs: (container) => ["exec", container, "curl", "-s", "--fail", "http://localhost:4444/wd/hub/status"],
+    env: ({ container }) => ({
+      SELENIUM_URL: "http://selenium:4444/wd/hub",
+      CHROME_REMOTE_URL: "http://selenium:4444",
+      CAPYBARA_SERVER_HOST: "0.0.0.0"
+    }),
+    ensureReady: ({ probe }) => readyLoop({ probe, attempts: 120, label: "Selenium" })
+  })
+});
+
+export function resolveService(type) {
+  if (!type || !Object.hasOwn(services, type)) return undefined;
+  return services[type];
+}
+
+export function resolveServices(types = []) {
+  const result = [];
+  const seen = new Set();
+  for (const type of types) {
+    if (seen.has(type)) continue;
+    const svc = resolveService(type);
+    if (svc) { result.push({ type, adapter: svc }); seen.add(type); }
+  }
+  return result;
+}
+
+const REDIS_EVIDENCE = [
+  /\bgem\s*\(?\s*["']redis["']/i,
+  /\bgem\s*\(?\s*["']sidekiq["']/i,
+  /\bgem\s*\(?\s*["']resque["']/i,
+  /\bgem\s*\(?\s*["']redis-rails["']/i,
+  /\bredis\.yml\b/i,
+  /\bRedis\.new\b/i,
+  /\bSidekiq\.configure_server\b/i,
+  /\bREDIS_URL\b/i
+];
+const REDIS_LOCK = /^[ \t]*redis \(/m;
+const REDIS_LOCK_SIDEKIQ = /^[ \t]*sidekiq \(/m;
+const REDIS_LOCK_RESQUE = /^[ \t]*resque \(/m;
+
+export function detectServices(root = process.cwd()) {
+  const read = (file) => {
+    try { return fs.readFileSync(path.join(root, file), "utf8"); } catch { return ""; }
+  };
+  const uncommented = (contents) => contents.replace(/#.*$/gm, "");
+  const contents = [
+    "config/database.yml",
+    "Gemfile",
+    "Gemfile.lock",
+    "config/application.rb",
+    "config/environments/test.rb",
+    "config/environments/development.rb",
+    "config/initializers/sidekiq.rb",
+    "config/sidekiq.yml"
+  ].map(read).join("\n");
+  const text = uncommented(contents);
+  const lock = `${uncommented(read("Gemfile.lock"))}\n`;
+  const services = [];
+  const hasRedis = REDIS_EVIDENCE.some((re) => re.test(text)) ||
+    REDIS_LOCK.test(lock) ||
+    REDIS_LOCK_SIDEKIQ.test(lock) ||
+    REDIS_LOCK_RESQUE.test(lock);
+  if (hasRedis) services.push("redis");
+  const hasChrome = /driven_by\s*:\s*(?:selenium|cuprite|chrome)/i.test(text) ||
+    /selenium-webdriver|cuprite|capybara/i.test(text + lock);
+  if (hasChrome) services.push("chrome");
+  // De-duplicate while preserving order
+  return [...new Set(services)];
+}
+
+export { NAME };

package/src/target-runtime.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { RunStateError, readRun } from "./run-state.js";
 import { NAME, databases, detectDatabase, resolveDatabase } from "./databases.js";
+import { services as serviceAdapters, detectServices, resolveServices } from "./services.js";
 
 const RUNTIME_FILE = "runtime.json";
 const LABEL = "io.opencode-ruby-upgrader.run-id";
@@ -117,7 +118,11 @@ function appMatches(container, root, runtime, db) {
   const env = environment(container);
   const mounts = container?.Mounts ?? [];
   const command = container?.Config?.Cmd ?? [];
-  return container?.State?.Running && container?.Config?.Image === `ruby:${runtime.ruby}` && container?.Config?.WorkingDir === "/app" && mounts.length === 1 && mountedFromRoot(container, root) && command.length === 2 && command[0] === "sleep" && command[1] === "infinity" && onlyNetwork(container, runtime.network) && isolatedContainer(container) && env.RAILS_ENV === "test" && env.DATABASE_URL === db.databaseUrl(runtime.databaseContainer);
+    const servicesMatch = !runtime.services || runtime.services.every((svc) => {
+    const expected = serviceAdapters[svc.type]?.env?.({ container: svc.container }) || {};
+    return Object.entries(expected).every(([k, v]) => env[k] === v);
+  });
+  return container?.State?.Running && container?.Config?.Image === `ruby:${runtime.ruby}` && container?.Config?.WorkingDir === "/app" && mounts.length === 1 && mountedFromRoot(container, root) && command.length === 2 && command[0] === "sleep" && command[1] === "infinity" && onlyNetwork(container, runtime.network) && isolatedContainer(container) && env.RAILS_ENV === "test" && env.DATABASE_URL === db.databaseUrl(runtime.databaseContainer) && servicesMatch;
 }
 function databaseMatches(container, runtime, db) {
   const env = environment(container);
@@ -142,9 +147,13 @@ function selectedRun(root, reportPath) {
   if (!["in_progress", "paused"].includes(run.status)) throw new RunStateError("Target runtime preparation requires an active or paused upgrade run.", "run-not-resumable");
   return { reportPath, run };
 }
-function names(runId, db) {
+function names(runId, db, serviceList = []) {
   const prefix = `ruby-upgrader-${runId}`;
-  return { appContainer: `${prefix}-app`, databaseContainer: `${prefix}-${db.adapter}`, network: `${prefix}-network` };
+  const out = { appContainer: `${prefix}-app`, databaseContainer: `${prefix}-${db.adapter}`, network: `${prefix}-network` };
+  for (const svc of serviceList) {
+    out[`${svc.type}Container`] = `${prefix}-${svc.type}`;
+  }
+  return out;
 }
 function writeRuntime(root, runtime) {
   const file = runtimePath(root, true);
@@ -164,6 +173,7 @@ export function readTargetRuntime(root = process.cwd()) {
       runtime = { ...legacy, database: "postgres", databaseContainer: postgresContainer };
     }
     if (runtime?.version !== 2 || typeof runtime.runId !== "string" || !rubyVersion.test(runtime.ruby ?? "") || !/^sha256:[a-f0-9]{64}$/i.test(runtime.resolvedImageId ?? "") || (runtime.databaseImageId !== undefined && !/^sha256:[a-f0-9]{64}$/i.test(runtime.databaseImageId)) || !runtime.preparation || !Object.hasOwn(databases, runtime.database) || ![runtime.appContainer, runtime.databaseContainer, runtime.network].every((name) => NAME.test(name ?? ""))) throw new Error();
+    if (runtime.services && !Array.isArray(runtime.services)) throw new Error();
     return runtime;
   } catch { throw new Error("Target runtime metadata is invalid. Rerun prepare-target-runtime --ruby <x.y.z>."); }
 }
@@ -172,10 +182,13 @@ export function prepareTargetRuntime({ root = process.cwd(), reportPath, ruby, d
   if (!rubyVersion.test(ruby ?? "")) throw new Error("--ruby must be an exact numeric Ruby version such as 3.4.1.");
   const canonical = canonicalRoot(root);
   const db = resolveDatabase(database ?? detectDatabase(canonical));
+  const detectedServices = detectServices(canonical);
+  const serviceList = resolveServices(detectedServices);
   const selected = selectedRun(canonical, reportPath);
   const run = readRun(canonical, selected.reportPath);
   const bundlerToInstall = run.reportType === "bundler_bridge" ? run.targetBundler : (run.bundlerBridge ? run.bundlerBridge.bundlerTo : undefined) || "2.4.22";
-  const runtime = { version: 2, runId: selected.run.runId, reportPath: selected.reportPath, ruby, database: db.adapter, bundlerToInstall, ...names(selected.run.runId, db) };
+  const runtimeNames = names(selected.run.runId, db, serviceList);
+  const runtime = { version: 2, runId: selected.run.runId, reportPath: selected.reportPath, ruby, database: db.adapter, bundlerToInstall, services: [], ...runtimeNames };
   const owner = identity(runtime.runId, canonical);
   const existing = readTargetRuntime(canonical);
   if (existing && existing.runId !== runtime.runId) {
@@ -187,7 +200,9 @@ export function prepareTargetRuntime({ root = process.cwd(), reportPath, ruby, d
   let app = docker(spawn, ["inspect", runtime.appContainer]);
   let network = docker(spawn, ["network", "inspect", runtime.network]);
   const databaseInspections = new Map(databaseNames.map((name) => [name, docker(spawn, ["inspect", name])]));
-  const resources = [app.status === 0 && parseInspection(app), network.status === 0 && parseInspection(network), ...[...databaseInspections.values()].filter((result) => result.status === 0).map(parseInspection)].filter(Boolean);
+  const serviceNames = serviceList.map((svc) => runtimeNames[`${svc.type}Container`]).filter(Boolean);
+  const serviceInspections = new Map(serviceNames.map((name) => [name, docker(spawn, ["inspect", name])]));
+  const resources = [app.status === 0 && parseInspection(app), network.status === 0 && parseInspection(network), ...[...databaseInspections.values()].filter((result) => result.status === 0).map(parseInspection), ...[...serviceInspections.values()].filter((result) => result.status === 0).map(parseInspection)].filter(Boolean);
 for (const resource of resources) {
     const resourceLabels = labels(resource);
     if (resourceLabels[LABEL] !== owner.runId || (resourceLabels[WORKTREE_LABEL] !== undefined && resourceLabels[WORKTREE_LABEL] !== owner.worktreeHash)) throw new Error("Refusing to use or replace a Docker resource not owned by this run and worktree.");
@@ -195,7 +210,7 @@ for (const resource of resources) {
   const legacy = resources.some((resource) => labels(resource)[WORKTREE_LABEL] === undefined);
   if (legacy && resources.length) {
     if (app.status !== 0 || !mountedFromRoot(parseInspection(app), canonical)) throw new Error("Refusing to migrate legacy Docker resources because ownership by this worktree cannot be established.");
-    for (const [name, result] of [[runtime.appContainer, app], ...databaseInspections]) {
+    for (const [name, result] of [[runtime.appContainer, app], ...databaseInspections, ...serviceInspections]) {
       if (result.status === 0 && docker(spawn, ["rm", "--force", name]).status !== 0) throw new Error("Could not remove a legacy target-runtime container.");
     }
     if (network.status !== 0 && docker(spawn, ["network", "rm", runtime.network]).status !== 0) throw new Error("Could not remove the legacy target-runtime Docker network.");
@@ -227,6 +242,37 @@ for (const resource of resources) {
     try { docker(spawn, ["rm", "--force", runtime.databaseContainer]); } catch {}
     throw error;
   }
+  // Provision additional service containers (evidence-based)
+  const serviceStates = [];
+  for (const svc of serviceList) {
+    const svcContainer = runtimeNames[`${svc.type}Container`];
+    let svcResult = serviceInspections.get(svcContainer) ?? { status: 1 };
+    if (svcResult.status === 0) {
+      const c = parseInspection(svcResult);
+      const expectedEnv = (serviceAdapters[svc.type]?.env?.({ container: svcContainer }) || {});
+      const env = environment(c);
+      const hasBindMount = (c?.Mounts ?? []).some((mount) => mount.Type === "bind");
+      const owned = hasOwnership(c, owner);
+      const matches = c?.State?.Running && c?.Config?.Image === svc.adapter.image && onlyNetwork(c, runtime.network) && isolatedContainer(c) && !hasBindMount && owned && Object.entries(expectedEnv).every(([k, v]) => env[k] === v);
+      if (!matches) {
+        if (docker(spawn, ["rm", "--force", svcContainer]).status !== 0) throw new Error(`Could not replace the prior target-runtime ${svc.adapter.label} container.`);
+        svcResult = docker(spawn, ["inspect", svcContainer]);
+      }
+    }
+    if (svcResult.status !== 0) {
+      if (docker(spawn, ["run", "--detach", "--name", svcContainer, ...ownershipArgs, "--network", runtime.network, ...svc.adapter.startArgs()]).status !== 0) throw new Error(`Could not start the isolated target-runtime ${svc.adapter.label} container.`);
+    }
+    try {
+      svc.adapter.ensureReady({ probe: () => docker(spawn, svc.adapter.readyArgs(svcContainer)) });
+    } catch (error) {
+      try { docker(spawn, ["rm", "--force", svcContainer]); } catch {}
+      throw error;
+    }
+    const svcInspection = inspect(spawn, svcContainer, `Target ${svc.adapter.label} container is unavailable. Rerun prepare-target-runtime --ruby <x.y.z>.`);
+    if (!/^sha256:[a-f0-9]{64}$/i.test(svcInspection?.Image ?? "")) throw new Error(`Target ${svc.adapter.label} image ID is unavailable.`);
+    serviceStates.push({ type: svc.type, container: svcContainer, imageId: svcInspection.Image });
+    runtime.services = serviceStates;
+  }
   if (app.status === 0) {
     const container = parseInspection(app);
     if (!appMatches(container, canonical, runtime, db)) {
@@ -234,7 +280,13 @@ for (const resource of resources) {
       app = docker(spawn, ["inspect", runtime.appContainer]);
     }
   }
-  if (app.status !== 0 && docker(spawn, ["run", "--detach", "--name", runtime.appContainer, ...ownershipArgs, "--network", runtime.network, "--mount", `type=bind,src=${canonical},dst=/app`, "--workdir", "/app", "--env", "RAILS_ENV=test", "--env", `DATABASE_URL=${db.databaseUrl(runtime.databaseContainer)}`, `ruby:${ruby}`, "sleep", "infinity"]).status !== 0) throw new Error("Could not start the target Ruby app container.");
+  const appEnv = ["--env", "RAILS_ENV=test", "--env", `DATABASE_URL=${db.databaseUrl(runtime.databaseContainer)}`];
+  for (const svc of serviceList) {
+    const svcContainer = runtimeNames[`${svc.type}Container`];
+    const envs = serviceAdapters[svc.type]?.env?.({ container: svcContainer }) || {};
+    for (const [k, v] of Object.entries(envs)) appEnv.push("--env", `${k}=${v}`);
+  }
+  if (app.status !== 0 && docker(spawn, ["run", "--detach", "--name", runtime.appContainer, ...ownershipArgs, "--network", runtime.network, "--mount", `type=bind,src=${canonical},dst=/app`, "--workdir", "/app", ...appEnv, `ruby:${ruby}`, "sleep", "infinity"]).status !== 0) throw new Error("Could not start the target Ruby app container.");
   const prepared = bootstrap(spawn, runtime, db, railsProject(canonical));
   const appInspection = inspect(spawn, runtime.appContainer, "Target Ruby app container is unavailable. Rerun prepare-target-runtime --ruby <x.y.z>.");
   const databaseInspection = inspect(spawn, runtime.databaseContainer, `Target ${db.label} container is unavailable. Rerun prepare-target-runtime --ruby <x.y.z>.`);