staff-mcp 1.3.0 → 2.0.0

package/dist/src/docker-proxy.js

@@ -1,9 +1,10 @@
-import { spawn } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-const HANDLED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { assertLocalDockerDaemon, DOCKER_DATA_STARTUP_TIMEOUT_MS, prepareDockerDataArgs, publishDockerDataBaseUrl, failDockerDataBootstrap, } from './data-stdio-docker.js';
+const HANDLED_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
 const DEFAULT_GRACEFUL_SHUTDOWN_TIMEOUT_MS = 20_000;
 const DEFAULT_CONTAINER_ID_WAIT_TIMEOUT_MS = 1_000;
 const DEFAULT_CONTAINER_CLEANUP_TIMEOUT_MS = 20_000;
@@ -11,27 +12,27 @@ const DEFAULT_FORCE_KILL_TIMEOUT_MS = 5_000;
 const CONTAINER_ID_POLL_INTERVAL_MS = 50;
 function exitCodeFromSignal(signal) {
     switch (signal) {
-        case "SIGHUP":
+        case 'SIGHUP':
             return 129;
-        case "SIGINT":
+        case 'SIGINT':
             return 130;
-        case "SIGKILL":
+        case 'SIGKILL':
             return 137;
-        case "SIGTERM":
+        case 'SIGTERM':
             return 143;
         default:
             return 1;
     }
 }
 function hasManagedIdentityArg(args) {
-    return args.some((arg) => arg === "--cidfile" ||
-        arg.startsWith("--cidfile=") ||
-        arg === "--name" ||
-        arg.startsWith("--name="));
+    return args.some((arg) => arg === '--cidfile' ||
+        arg.startsWith('--cidfile=') ||
+        arg === '--name' ||
+        arg.startsWith('--name='));
 }
-const CONTAINER_NAME_PREFIX = "staff-mcp";
+const CONTAINER_NAME_PREFIX = 'staff-mcp';
 const CONTAINER_NAME_HINT_MAX_LENGTH = 40;
-const NAME_SEGMENT_FALLBACK = "session";
+const NAME_SEGMENT_FALLBACK = 'session';
 /**
  * Sanitize an arbitrary string into a Docker-name-safe segment.
  * Docker names only accept [a-zA-Z0-9][a-zA-Z0-9_.-], so everything else is
@@ -40,11 +41,11 @@ const NAME_SEGMENT_FALLBACK = "session";
 export function sanitizeNameSegment(value, maxLength = 24) {
     return value
         .toLowerCase()
-        .replace(/[^a-z0-9_.-]+/g, "-")
-        .replace(/-{2,}/g, "-")
-        .replace(/^[-_.]+|[-_.]+$/g, "")
+        .replace(/[^a-z0-9_.-]+/g, '-')
+        .replace(/-{2,}/g, '-')
+        .replace(/^[-_.]+|[-_.]+$/g, '')
         .slice(0, maxLength)
-        .replace(/[-_.]+$/g, "");
+        .replace(/[-_.]+$/g, '');
 }
 /**
  * Build a human-meaningful hint for the container name from launch context,
@@ -55,10 +56,10 @@ export function sanitizeNameSegment(value, maxLength = 24) {
  */
 export function buildDockerNameHint(parts) {
     const workspace = path.basename(parts.workspaceDir);
-    if (parts.transport === "http" && parts.port) {
+    if (parts.transport === 'http' && parts.port) {
         return `${workspace}-${parts.port}`;
     }
-    if (parts.transport === "reverse" && parts.reverseName) {
+    if (parts.transport === 'reverse' && parts.reverseName) {
         const workspaceSlug = sanitizeNameSegment(workspace);
         const reverseSlug = sanitizeNameSegment(parts.reverseName);
         if (workspaceSlug && workspaceSlug === reverseSlug) {
@@ -75,34 +76,34 @@ export function buildDockerNameHint(parts) {
  * rejected safely by Docker at container creation time.
  */
 function buildContainerName(nameHint) {
-    const randomSuffix = randomBytes(3).toString("hex");
-    const hint = sanitizeNameSegment(nameHint ?? "", CONTAINER_NAME_HINT_MAX_LENGTH);
+    const randomSuffix = randomBytes(3).toString('hex');
+    const hint = sanitizeNameSegment(nameHint ?? '', CONTAINER_NAME_HINT_MAX_LENGTH);
     const discriminator = hint || NAME_SEGMENT_FALLBACK;
     return `${CONTAINER_NAME_PREFIX}-${discriminator}-${randomSuffix}`;
 }
 function prepareContainerIdentity(dockerArgs, nameHint) {
     const args = [...dockerArgs];
     if (hasManagedIdentityArg(args)) {
-        throw new Error("--cidfile and --name are managed internally by staff-mcp.");
+        throw new Error('--cidfile and --name are managed internally by staff-mcp.');
     }
-    const runIndex = args.indexOf("run");
+    const runIndex = args.indexOf('run');
     if (runIndex < 0) {
         throw new Error("Docker proxy arguments must contain the 'run' subcommand.");
     }
-    const ownedDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "staff-mcp-container-"));
-    const cidFilePath = path.join(ownedDirectory, "container.cid");
+    const ownedDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'staff-mcp-container-'));
+    const cidFilePath = path.join(ownedDirectory, 'container.cid');
     const containerName = buildContainerName(nameHint);
-    args.splice(runIndex + 1, 0, "--cidfile", cidFilePath, "--name", containerName);
+    args.splice(runIndex + 1, 0, '--cidfile', cidFilePath, '--name', containerName);
     return { args, cidFilePath, containerName, ownedDirectory };
 }
 function readContainerId(cidFilePath) {
     try {
-        const containerId = fs.readFileSync(cidFilePath, "utf8").trim();
+        const containerId = fs.readFileSync(cidFilePath, 'utf8').trim();
         return /^[a-f0-9]{64}$/i.test(containerId) ? containerId : undefined;
     }
     catch (error) {
         const code = error.code;
-        if (code === "ENOENT") {
+        if (code === 'ENOENT') {
             return undefined;
         }
         console.error(`[staff-mcp] Failed to read Docker cidfile '${cidFilePath}':`, error);
@@ -121,32 +122,82 @@ function isMissingContainerError(stderr) {
  * user-supplied Docker options only, because the command executed inside the
  * container can legitimately contain similarly named flags.
  */
-export function validateAdditionalDockerArgs(args) {
-    for (const arg of args) {
+export function validateAdditionalDockerArgs(args, dataAuto = false) {
+    for (const [index, arg] of args.entries()) {
         const normalized = arg.toLowerCase();
-        const isShortDetachOption = (/^-[^-][a-z]*$/i.test(arg) && arg.slice(1).includes("d")) || normalized.startsWith("-d=");
+        if (dataAuto &&
+            (/STAFF_MCP_DATA_(?:BOOTSTRAP|HOST|PORT)/i.test(arg) ||
+                arg.includes('/run/staff-mcp-data.json') ||
+                /(?:^|[^0-9])39173(?:[^0-9]|$)/.test(arg))) {
+            throw new Error('Docker data bootstrap environment, mount and port are managed internally.');
+        }
+        const isShortDetachOption = (/^-[^-][a-z]*$/i.test(arg) && arg.slice(1).includes('d')) ||
+            normalized.startsWith('-d=');
         if (isShortDetachOption ||
-            normalized === "--detach" ||
-            (normalized.startsWith("--detach=") && normalized !== "--detach=false")) {
-            throw new Error("detached containers are not supported by the staff-mcp Docker proxy");
+            normalized === '--detach' ||
+            (normalized.startsWith('--detach=') &&
+                normalized !== '--detach=false')) {
+            throw new Error('detached containers are not supported by the staff-mcp Docker proxy');
         }
-        if (normalized.startsWith("--rm=") && !["--rm=true", "--rm=t", "--rm=1"].includes(normalized)) {
-            throw new Error("--rm cannot be disabled by the staff-mcp Docker proxy");
+        if (normalized.startsWith('--rm=') &&
+            !['--rm=true', '--rm=t', '--rm=1'].includes(normalized)) {
+            throw new Error('--rm cannot be disabled by the staff-mcp Docker proxy');
         }
-        if (normalized.startsWith("--interactive=") &&
-            !["--interactive=true", "--interactive=t", "--interactive=1"].includes(normalized)) {
-            throw new Error("interactive stdin cannot be disabled by the staff-mcp Docker proxy");
+        if (normalized.startsWith('--interactive=') &&
+            ![
+                '--interactive=true',
+                '--interactive=t',
+                '--interactive=1',
+            ].includes(normalized)) {
+            throw new Error('interactive stdin cannot be disabled by the staff-mcp Docker proxy');
         }
         if (/^-[^-]*i[^=]*=/.test(arg)) {
-            throw new Error("assigned -i values are not supported; use -i or --interactive=true");
+            throw new Error('assigned -i values are not supported; use -i or --interactive=true');
+        }
+        if (normalized === '--cidfile' ||
+            normalized.startsWith('--cidfile=') ||
+            normalized === '--name' ||
+            normalized.startsWith('--name=')) {
+            throw new Error('--cidfile and --name are managed internally by staff-mcp');
         }
-        if (normalized === "--cidfile" ||
-            normalized.startsWith("--cidfile=") ||
-            normalized === "--name" ||
-            normalized.startsWith("--name=")) {
-            throw new Error("--cidfile and --name are managed internally by staff-mcp");
+    }
+}
+/** Topology is a capability limit, not permission to bypass managed options. */
+function unsupportedDataNetwork(args) {
+    return args.some((arg, index) => /^(?:--network|--net)=(?:host$|container:|none$)/i.test(arg) ||
+        (/^(?:--network|--net)$/i.test(arg) &&
+            /^(?:host$|container:|none$)/i.test(args[index + 1] ?? '')));
+}
+/** Validate requested permissions before reducing optional capabilities. */
+export async function preflightDockerExtensions(requested, transport, additionalArgs) {
+    const requestedDataAuto = transport === 'stdio' && requested.length > 0;
+    validateAdditionalDockerArgs(additionalArgs, requestedDataAuto);
+    if (!requested.length)
+        return [];
+    let reason;
+    if (os.platform() !== 'linux') {
+        reason = 'Docker extensions require a compatible Linux host package';
+    }
+    else if (requestedDataAuto) {
+        if (unsupportedDataNetwork(additionalArgs)) {
+            reason =
+                'Docker stdio data auto does not support host/container/none networking';
         }
+        else {
+            try {
+                await assertLocalDockerDaemon('docker', []);
+            }
+            catch {
+                reason =
+                    'Docker stdio data auto requires a verified local daemon; remote/TCP/SSH or unavailable contexts are unsupported';
+            }
+        }
+    }
+    if (reason) {
+        console.error(`[staff-mcp] Disabling requested Docker extensions (${requested.join(',')}): ${reason}. Basic MCP tools/control remain enabled.`);
+        return [];
     }
+    return [...requested];
 }
 /**
  * Run the Docker-compatible CLI and keep its lifecycle tied to this process.
@@ -158,17 +209,38 @@ export function validateAdditionalDockerArgs(args) {
  * still making the container exit if the host proxy disappears unexpectedly.
  */
 export async function runDockerProxy(dockerArgs, transport, options = {}) {
-    const command = options.command ?? "docker";
+    const command = options.command ?? 'docker';
     const commandPrefixArgs = [...(options.commandPrefixArgs ?? [])];
     const input = options.input ?? process.stdin;
     const signalSource = options.signalSource ?? process;
-    const gracefulShutdownTimeoutMs = options.gracefulShutdownTimeoutMs ?? DEFAULT_GRACEFUL_SHUTDOWN_TIMEOUT_MS;
-    const containerIdWaitTimeoutMs = options.containerIdWaitTimeoutMs ?? DEFAULT_CONTAINER_ID_WAIT_TIMEOUT_MS;
-    const containerCleanupTimeoutMs = options.containerCleanupTimeoutMs ?? DEFAULT_CONTAINER_CLEANUP_TIMEOUT_MS;
+    const gracefulShutdownTimeoutMs = options.gracefulShutdownTimeoutMs ??
+        DEFAULT_GRACEFUL_SHUTDOWN_TIMEOUT_MS;
+    const containerIdWaitTimeoutMs = options.containerIdWaitTimeoutMs ??
+        DEFAULT_CONTAINER_ID_WAIT_TIMEOUT_MS;
+    const containerCleanupTimeoutMs = options.containerCleanupTimeoutMs ??
+        DEFAULT_CONTAINER_CLEANUP_TIMEOUT_MS;
     const forceKillTimeoutMs = options.forceKillTimeoutMs ?? DEFAULT_FORCE_KILL_TIMEOUT_MS;
+    if (options.dataAuto &&
+        (transport !== 'stdio' || unsupportedDataNetwork(dockerArgs))) {
+        console.error('[staff-mcp] Docker data auto requires stdio with supported publication networking.');
+        return 1;
+    }
+    let metadataPath;
     let containerIdentity;
     try {
         containerIdentity = prepareContainerIdentity(dockerArgs, options.nameHint);
+        if (options.dataAuto) {
+            try {
+                metadataPath = prepareDockerDataArgs(containerIdentity.args, containerIdentity.ownedDirectory);
+            }
+            catch (error) {
+                fs.rmSync(containerIdentity.ownedDirectory, {
+                    recursive: true,
+                    force: true,
+                });
+                throw error;
+            }
+        }
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -192,6 +264,10 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
         let postCleanupTimer;
         let postCleanupFinalTimer;
         let cidPollTimer;
+        let startupTimer;
+        let parentWatch;
+        let bootstrapPending = metadataPath !== undefined;
+        const startupAbort = new AbortController();
         const signalHandlers = new Map();
         const captureContainerId = () => {
             if (!trackedContainerId) {
@@ -199,16 +275,23 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
             }
             return trackedContainerId;
         };
-        const isChildRunning = () => child !== undefined && child.exitCode === null && child.signalCode === null;
+        const isChildRunning = () => child !== undefined &&
+            child.exitCode === null &&
+            child.signalCode === null;
         const removeListeners = () => {
             for (const [signal, handler] of signalHandlers) {
                 signalSource.removeListener(signal, handler);
             }
             signalHandlers.clear();
-            if (transport === "stdio" && child?.stdin) {
-                input.unpipe(child.stdin);
-                input.removeListener("end", handleInputEnd);
-                input.removeListener("error", handleInputError);
+            if (transport === 'stdio') {
+                if (child?.stdin)
+                    input.unpipe(child.stdin);
+                input.removeListener('end', handleInputEnd);
+                input.removeListener('error', handleInputError);
+            }
+            if (metadataPath) {
+                process.stdout.removeListener('error', handleOutputError);
+                process.stderr.removeListener('error', handleOutputError);
             }
         };
         const finish = (exitCode) => {
@@ -216,6 +299,7 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
                 return;
             }
             settled = true;
+            startupAbort.abort();
             if (gracefulTimer) {
                 clearTimeout(gracefulTimer);
             }
@@ -228,9 +312,16 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
             if (cidPollTimer) {
                 clearInterval(cidPollTimer);
             }
+            if (startupTimer)
+                clearTimeout(startupTimer);
+            if (parentWatch)
+                clearInterval(parentWatch);
             removeListeners();
             try {
-                fs.rmSync(containerIdentity.ownedDirectory, { recursive: true, force: true });
+                fs.rmSync(containerIdentity.ownedDirectory, {
+                    recursive: true,
+                    force: true,
+                });
             }
             catch (error) {
                 console.error(`[staff-mcp] Failed to remove temporary cidfile directory '${containerIdentity.ownedDirectory}':`, error);
@@ -241,13 +332,15 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
             if (!runExit || cleanupInProgress) {
                 return;
             }
-            finish(cleanupFailed ? 1 : (runExit.code ?? exitCodeFromSignal(runExit.signal)));
+            finish(cleanupFailed
+                ? 1
+                : (runExit.code ?? exitCodeFromSignal(runExit.signal)));
         };
         const closeLifecyclePipe = () => {
             if (!child?.stdin) {
                 return;
             }
-            if (transport === "stdio") {
+            if (transport === 'stdio') {
                 input.unpipe(child.stdin);
             }
             if (!child.stdin.destroyed && !child.stdin.writableEnded) {
@@ -269,7 +362,7 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
             let cleanupTimer;
             let cleanupForceTimer;
             let cleanupFinalTimer;
-            let stderr = "";
+            let stderr = '';
             const complete = (success) => {
                 if (completed) {
                     return;
@@ -288,8 +381,8 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
                 resolveCleanup(success);
             };
             try {
-                cleanupChild = spawn(command, [...commandPrefixArgs, "rm", "-f", containerId], {
-                    stdio: ["ignore", "ignore", "pipe"],
+                cleanupChild = spawn(command, [...commandPrefixArgs, 'rm', '-f', containerId], {
+                    stdio: ['ignore', 'ignore', 'pipe'],
                 });
             }
             catch (error) {
@@ -297,21 +390,21 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
                 complete(false);
                 return;
             }
-            cleanupChild.once("spawn", () => {
+            cleanupChild.once('spawn', () => {
                 cleanupSpawned = true;
             });
-            cleanupChild.stderr?.on("data", (chunk) => {
+            cleanupChild.stderr?.on('data', (chunk) => {
                 if (stderr.length < 8_192) {
                     stderr += chunk.toString();
                 }
             });
-            cleanupChild.once("error", (error) => {
+            cleanupChild.once('error', (error) => {
                 console.error(`[staff-mcp] Failed to run fallback container cleanup for ${containerId}: ${error.message}`);
                 if (!cleanupSpawned && cleanupChild?.pid === undefined) {
                     complete(false);
                 }
             });
-            cleanupChild.once("close", (code, signal) => {
+            cleanupChild.once('close', (code, signal) => {
                 if (completed) {
                     return;
                 }
@@ -321,17 +414,17 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
                     complete(true);
                     return;
                 }
-                console.error(`[staff-mcp] Fallback container cleanup failed for ${containerId}: code ${code ?? "null"}` +
-                    `${signal ? `, signal ${signal}` : ""}${detail ? `, ${detail}` : ""}`);
+                console.error(`[staff-mcp] Fallback container cleanup failed for ${containerId}: code ${code ?? 'null'}` +
+                    `${signal ? `, signal ${signal}` : ''}${detail ? `, ${detail}` : ''}`);
                 complete(false);
             });
             cleanupTimer = setTimeout(() => {
                 console.error(`[staff-mcp] Fallback container cleanup for ${containerId} exceeded ${containerCleanupTimeoutMs}ms; sending SIGTERM.`);
-                cleanupChild?.kill("SIGTERM");
+                cleanupChild?.kill('SIGTERM');
                 cleanupForceTimer = setTimeout(() => {
                     if (!completed) {
                         console.error(`[staff-mcp] Fallback container cleanup for ${containerId} did not stop within an additional ${forceKillTimeoutMs}ms; sending SIGKILL.`);
-                        cleanupChild?.kill("SIGKILL");
+                        cleanupChild?.kill('SIGKILL');
                         cleanupFinalTimer = setTimeout(() => {
                             if (!completed) {
                                 console.error(`[staff-mcp] Fallback container cleanup for ${containerId} did not report completion after SIGKILL.`);
@@ -346,16 +439,16 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
             if (!isChildRunning() || postCleanupTimer) {
                 return;
             }
-            child.kill("SIGTERM");
+            child.kill('SIGTERM');
             postCleanupTimer = setTimeout(() => {
                 if (!isChildRunning()) {
                     return;
                 }
                 console.error(`[staff-mcp] Docker CLI did not exit within ${forceKillTimeoutMs}ms; sending SIGKILL.`);
-                child.kill("SIGKILL");
+                child.kill('SIGKILL');
                 postCleanupFinalTimer = setTimeout(() => {
                     if (!runExit && isChildRunning()) {
-                        console.error("[staff-mcp] Docker CLI did not report completion after SIGKILL.");
+                        console.error('[staff-mcp] Docker CLI did not report completion after SIGKILL.');
                         cleanupFailed = true;
                         runExit = { code: 1, signal: null };
                         maybeFinish();
@@ -433,6 +526,7 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
             }
             if (!shutdownStarted) {
                 shutdownStarted = true;
+                startupAbort.abort();
                 console.error(`[staff-mcp] Docker proxy shutdown requested: ${reason}`);
                 activateShutdown();
                 return;
@@ -443,101 +537,184 @@ export async function runDockerProxy(dockerArgs, transport, options = {}) {
             }
         };
         function handleInputEnd() {
-            requestShutdown("stdio input closed");
+            requestShutdown('stdio input closed');
         }
         function handleInputError(error) {
             console.error(`[staff-mcp] Docker proxy input error: ${error.message}`);
-            requestShutdown("stdio input error");
+            requestShutdown('stdio input error');
+        }
+        function handleOutputError() {
+            requestShutdown('parent output pipe closed');
+        }
+        if (transport === 'stdio') {
+            input.once('end', handleInputEnd);
+            input.once('error', handleInputError);
+            if ('readableEnded' in input && input.readableEnded)
+                handleInputEnd();
         }
         for (const signal of HANDLED_SIGNALS) {
             const handler = () => requestShutdown(`received ${signal}`, true);
             signalHandlers.set(signal, handler);
             signalSource.on(signal, handler);
         }
-        try {
-            child = spawn(command, [...commandPrefixArgs, ...containerIdentity.args], {
-                stdio: ["pipe", "inherit", "inherit"],
-            });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            console.error(`[staff-mcp] Failed to start docker proxy: ${message}`);
-            finish(1);
-            return;
-        }
-        if (!child.stdin) {
-            console.error("[staff-mcp] Failed to start docker proxy: child stdin is unavailable.");
-            child.kill("SIGKILL");
-            finish(1);
-            return;
-        }
-        child.stdin.on("error", (error) => {
-            if (!settled && error.code !== "EPIPE") {
-                console.error(`[staff-mcp] Docker proxy stdin error: ${error.message}`);
+        const failBootstrap = () => {
+            if (!bootstrapPending || settled || shutdownStarted)
+                return;
+            bootstrapPending = false;
+            if (startupTimer)
+                clearTimeout(startupTimer);
+            startupAbort.abort();
+            try {
+                failDockerDataBootstrap(metadataPath);
             }
-        });
-        child.once("error", (error) => {
-            if (settled) {
+            catch {
+                // The reader also fails closed on unreadable/missing metadata or timeout.
+                console.error('[staff-mcp] Could not record Docker data bootstrap failure (details suppressed).');
+            }
+            console.error('[staff-mcp] Docker data bootstrap unavailable; extension data configure will fail. Basic MCP tools/control remain enabled (details suppressed).');
+        };
+        const start = async () => {
+            if (metadataPath) {
+                try {
+                    // Recheck at launch: never publish a remote daemon's loopback as ours.
+                    await assertLocalDockerDaemon(command, commandPrefixArgs, startupAbort.signal);
+                }
+                catch {
+                    failBootstrap();
+                }
+            }
+            if (settled || shutdownStarted) {
+                finish(0);
                 return;
             }
-            if (child?.pid === undefined) {
-                console.error(`[staff-mcp] Failed to start docker proxy: ${error.message}`);
+            try {
+                child = spawn(command, [...commandPrefixArgs, ...containerIdentity.args], {
+                    stdio: ['pipe', 'inherit', 'inherit'],
+                });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.error(`[staff-mcp] Failed to start docker proxy: ${message}`);
                 finish(1);
                 return;
             }
-            console.error(`[staff-mcp] Docker proxy process error: ${error.message}`);
-            cleanupFailed = true;
-            requestShutdown("Docker proxy process error", true);
-        });
-        child.once("close", (code, signal) => {
-            if (settled) {
+            if (!child.stdin) {
+                console.error('[staff-mcp] Failed to start docker proxy: child stdin is unavailable.');
+                child.kill('SIGKILL');
+                finish(1);
                 return;
             }
-            captureContainerId();
-            runExit = { code, signal };
-            if (gracefulTimer) {
-                clearTimeout(gracefulTimer);
-            }
-            if (postCleanupTimer) {
-                clearTimeout(postCleanupTimer);
+            child.stdin.on('error', (error) => {
+                if (!settled && error.code !== 'EPIPE') {
+                    console.error(`[staff-mcp] Docker proxy stdin error: ${error.message}`);
+                }
+            });
+            child.once('error', (error) => {
+                if (settled) {
+                    return;
+                }
+                if (child?.pid === undefined) {
+                    console.error(`[staff-mcp] Failed to start docker proxy: ${error.message}`);
+                    finish(1);
+                    return;
+                }
+                console.error(`[staff-mcp] Docker proxy process error: ${error.message}`);
+                cleanupFailed = true;
+                requestShutdown('Docker proxy process error', true);
+            });
+            child.once('close', (code, signal) => {
+                if (settled) {
+                    return;
+                }
+                captureContainerId();
+                runExit = { code, signal };
+                if (gracefulTimer) {
+                    clearTimeout(gracefulTimer);
+                }
+                if (postCleanupTimer) {
+                    clearTimeout(postCleanupTimer);
+                }
+                if (postCleanupFinalTimer) {
+                    clearTimeout(postCleanupFinalTimer);
+                }
+                console.error(`[staff-mcp] Docker proxy exited with code ${code ?? 'null'}${signal ? ` (signal ${signal})` : ''}.`);
+                // If a supervisor killed the Docker CLI directly, --rm may not have
+                // completed. Clean up by exact ID when available, otherwise use the
+                // unique generated name that was part of the container-create request.
+                if (!cleanupInProgress &&
+                    !cleanupAttempted &&
+                    !containerCleanupConfirmed &&
+                    (signal !== null || code !== 0)) {
+                    const cleanupReference = trackedContainerId ?? containerIdentity.containerName;
+                    cleanupInProgress = true;
+                    cleanupAttempted = true;
+                    void forceRemoveContainer(cleanupReference)
+                        .then((removed) => {
+                        containerCleanupConfirmed = removed;
+                        cleanupFailed = !removed;
+                    })
+                        .finally(() => {
+                        cleanupInProgress = false;
+                        maybeFinish();
+                    });
+                    return;
+                }
+                maybeFinish();
+            });
+            cidPollTimer = setInterval(captureContainerId, CONTAINER_ID_POLL_INTERVAL_MS);
+            cidPollTimer.unref();
+            if (transport === 'stdio') {
+                input.pipe(child.stdin);
             }
-            if (postCleanupFinalTimer) {
-                clearTimeout(postCleanupFinalTimer);
+            // A signal source can synchronously request shutdown while handlers are
+            // being installed (and a real OS signal can arrive during startup).
+            activateShutdown();
+            if (metadataPath) {
+                const cancelled = () => !bootstrapPending ||
+                    settled ||
+                    shutdownStarted ||
+                    !isChildRunning();
+                while (!cancelled()) {
+                    const containerId = captureContainerId();
+                    if (containerId &&
+                        (await publishDockerDataBaseUrl(command, commandPrefixArgs, containerId, metadataPath, cancelled, startupAbort.signal))) {
+                        bootstrapPending = false;
+                        clearTimeout(startupTimer);
+                        return;
+                    }
+                    await delay(CONTAINER_ID_POLL_INTERVAL_MS);
+                }
             }
-            console.error(`[staff-mcp] Docker proxy exited with code ${code ?? "null"}${signal ? ` (signal ${signal})` : ""}.`);
-            // If a supervisor killed the Docker CLI directly, --rm may not have
-            // completed. Clean up by exact ID when available, otherwise use the
-            // unique generated name that was part of the container-create request.
-            if (!cleanupInProgress &&
-                !cleanupAttempted &&
-                !containerCleanupConfirmed &&
-                (signal !== null || code !== 0)) {
-                const cleanupReference = trackedContainerId ?? containerIdentity.containerName;
-                cleanupInProgress = true;
-                cleanupAttempted = true;
-                void forceRemoveContainer(cleanupReference)
-                    .then((removed) => {
-                    containerCleanupConfirmed = removed;
-                    cleanupFailed = !removed;
-                })
-                    .finally(() => {
-                    cleanupInProgress = false;
-                    maybeFinish();
-                });
+        };
+        if (metadataPath) {
+            process.stdout.on('error', handleOutputError);
+            process.stderr.on('error', handleOutputError);
+            startupTimer = setTimeout(failBootstrap, DOCKER_DATA_STARTUP_TIMEOUT_MS);
+            const parentPid = process.ppid;
+            parentWatch = setInterval(() => {
+                let parentAlive = process.ppid === parentPid;
+                try {
+                    process.kill(parentPid, 0);
+                }
+                catch {
+                    parentAlive = false;
+                }
+                if (!parentAlive)
+                    requestShutdown('parent exited');
+            }, 200);
+            parentWatch.unref();
+        }
+        void start().catch(() => {
+            if (settled)
+                return;
+            if (shutdownStarted) {
+                if (!child)
+                    finish(0);
                 return;
             }
-            maybeFinish();
+            // Helper failures may include credentials; expose only a fixed diagnostic.
+            failBootstrap();
         });
-        cidPollTimer = setInterval(captureContainerId, CONTAINER_ID_POLL_INTERVAL_MS);
-        cidPollTimer.unref();
-        if (transport === "stdio") {
-            input.once("end", handleInputEnd);
-            input.once("error", handleInputError);
-            input.pipe(child.stdin);
-        }
-        // A signal source can synchronously request shutdown while handlers are
-        // being installed (and a real OS signal can arrive during startup).
-        activateShutdown();
     });
 }
 //# sourceMappingURL=docker-proxy.js.map