zidane 7.2.4 → 8.0.4

package/dist/docker-BZhMMJUp.js

@@ -0,0 +1,727 @@
+import { t as alwaysQuote } from "./shell-quote-BmnhZmdM.js";
+import { c as DEFAULT_MAX_OUTPUT_BUFFER, f as outputExceededMessage, i as localTerminalProcess, l as appendCapped, n as endLocalPty, r as hasLocalPty, s as spawnLocalPty, t as TERMINAL_ENV } from "./local-terminal-D8QThwo_.js";
+import { n as globFilesViaShell, t as fileSizeViaExec } from "./exec-file-size-BRpoB6Io.js";
+import { Buffer } from "node:buffer";
+import { existsSync, mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { posix } from "node:path";
+import { homedir } from "node:os";
+import { execFileSync } from "node:child_process";
+//#region src/contexts/docker-exec.ts
+function createDockerExecCapped(s) {
+	const { containers, defaultLimits } = s;
+	/**
+	* The exec transport with an explicit output cap. The public `exec`
+	* uses the shared 10MB default; `readFile` passes headroom above the
+	* whole-read tool ceiling so docker's EFFECTIVE read limit matches
+	* every other context (the fileSize probe refuses oversized files
+	* before this ever runs — the transport cap is the safety net for
+	* probe-failure paths, not the primary bound).
+	*/
+	async function execCapped(handle, command, options, maxBuffer) {
+		const ref = containers.get(handle.id);
+		if (!ref) throw new Error(`Container ${handle.id} not found`);
+		const execCwd = options?.cwd ?? handle.cwd;
+		const env = options?.env ? Object.entries(options.env).map(([k, v]) => `${k}=${v}`) : [];
+		const timeout = options?.timeout ?? defaultLimits?.timeout ?? 30;
+		const exec = await ref.container.exec({
+			Cmd: [
+				"timeout",
+				String(timeout),
+				"sh",
+				"-c",
+				command
+			],
+			WorkingDir: execCwd,
+			Env: env,
+			AttachStdout: true,
+			AttachStderr: true
+		});
+		const stream = await exec.start({ Detach: false });
+		return new Promise((resolve) => {
+			const stdoutSlot = {
+				text: "",
+				bytes: 0
+			};
+			const stderrSlot = {
+				text: "",
+				bytes: 0
+			};
+			let resolved = false;
+			const overflow = () => {
+				if (resolved) return;
+				resolved = true;
+				try {
+					stream.destroy?.();
+				} catch {}
+				resolve({
+					stdout: stdoutSlot.text,
+					stderr: `${stderrSlot.text ? `${stderrSlot.text}\n` : ""}${outputExceededMessage(maxBuffer, "stream detached (server-side timeout reaps the process)")}`,
+					exitCode: 143
+				});
+			};
+			const cappedWrite = (slot) => (chunk) => {
+				const buf = typeof chunk === "string" ? Buffer.from(chunk, "utf-8") : chunk;
+				if (appendCapped(slot, buf, maxBuffer) !== "ok") overflow();
+				return true;
+			};
+			const stdoutSink = {
+				write: cappedWrite(stdoutSlot),
+				end() {},
+				on() {},
+				once() {},
+				emit() {
+					return true;
+				}
+			};
+			const stderrSink = {
+				write: cappedWrite(stderrSlot),
+				end() {},
+				on() {},
+				once() {},
+				emit() {
+					return true;
+				}
+			};
+			try {
+				ref.docker.modem.demuxStream(stream, stdoutSink, stderrSink);
+			} catch {
+				stream.on("data", (chunk) => {
+					cappedWrite(stdoutSlot)(chunk);
+				});
+			}
+			const timer = setTimeout(() => {
+				if (resolved) return;
+				resolved = true;
+				try {
+					stream.destroy?.();
+				} catch {}
+				resolve({
+					stdout: stdoutSlot.text,
+					stderr: stderrSlot.text ? `${stderrSlot.text}\n[timeout]` : "[timeout]",
+					exitCode: 124
+				});
+			}, timeout * 1e3 + 1e3);
+			stream.on("end", async () => {
+				if (resolved) return;
+				resolved = true;
+				clearTimeout(timer);
+				let exitCode;
+				let inspectNote = "";
+				try {
+					const inspect = await exec.inspect();
+					if (inspect.ExitCode == null) {
+						exitCode = -1;
+						inspectNote = "[exit code unavailable: exec still marked running by daemon]";
+					} else exitCode = inspect.ExitCode;
+				} catch (err) {
+					exitCode = -1;
+					inspectNote = `[exit code unavailable: exec inspect failed: ${err?.message ?? String(err)}]`;
+				}
+				resolve({
+					stdout: stdoutSlot.text,
+					stderr: inspectNote ? stderrSlot.text ? `${stderrSlot.text}\n${inspectNote}` : inspectNote : stderrSlot.text,
+					exitCode
+				});
+			});
+			stream.on("error", (err) => {
+				if (resolved) return;
+				resolved = true;
+				clearTimeout(timer);
+				resolve({
+					stdout: stdoutSlot.text,
+					stderr: stderrSlot.text ? `${stderrSlot.text}\n${err.message}` : err.message,
+					exitCode: 1
+				});
+			});
+		});
+	}
+	return execCapped;
+}
+//#endregion
+//#region src/contexts/docker-files.ts
+/**
+* `readFile` transport cap: headroom above the whole-read tool ceiling
+* (256MB in tools/whole-read-guard.ts) so tool policy — not the docker
+* transport — decides read limits, keeping refusal behavior consistent
+* across contexts. Still bounded: a probe-failure path can't buffer
+* more than this into host memory.
+*/
+const READ_FILE_MAX_BUFFER = 536870912;
+function dockerFileMethods(s, execCapped) {
+	const { containers } = s;
+	return {
+		async fileSize(handle, path) {
+			return fileSizeViaExec((command) => execCapped(handle, command, void 0, DEFAULT_MAX_OUTPUT_BUFFER), path);
+		},
+		async readFile(handle, path) {
+			const result = await execCapped(handle, `cat ${alwaysQuote(path)}`, void 0, READ_FILE_MAX_BUFFER);
+			if (result.exitCode !== 0) throw new Error(`Failed to read file: ${result.stderr}`);
+			return result.stdout;
+		},
+		async writeFile(handle, path, content, encoding = "utf-8") {
+			const bytes = typeof content === "string" ? Buffer.from(content, encoding) : content;
+			const ref = containers.get(handle.id);
+			if (!ref) throw new Error(`Container ${handle.id} not found`);
+			const dest = posix.isAbsolute(path) ? path : posix.join(handle.cwd, path);
+			const dir = posix.dirname(dest);
+			const name = posix.basename(dest);
+			if (!name || name === "." || name === ".." || path.endsWith("/")) throw new Error(`Failed to write file: invalid path ${path}`);
+			const mkdir = await s.ctx.exec(handle, `mkdir -p ${alwaysQuote(dir)}`);
+			if (mkdir.exitCode !== 0) throw new Error(`Failed to write file: ${mkdir.stderr}`);
+			const stagedName = `.zidane-write-${Math.random().toString(36).slice(2, 10)}.tmp`;
+			const staged = posix.join(dir, stagedName);
+			try {
+				await ref.container.putArchive(await packTarFile(stagedName, bytes), { path: dir });
+			} catch (err) {
+				throw new Error(`Failed to write file: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			const write = await s.ctx.exec(handle, `cat ${alwaysQuote(staged)} > ${alwaysQuote(dest)}; rc=$?; rm -f ${alwaysQuote(staged)}; exit $rc`);
+			if (write.exitCode !== 0) {
+				await s.ctx.exec(handle, `rm -f ${alwaysQuote(staged)}`).catch(() => {});
+				throw new Error(`Failed to write file: ${write.stderr}`);
+			}
+		},
+		async listFiles(handle, path, options) {
+			if (options?.glob) return globFilesViaShell(path, (command) => s.ctx.exec(handle, command), options?.limit ?? 1e3);
+			const result = await s.ctx.exec(handle, `ls -1p ${alwaysQuote(path)}`);
+			if (result.exitCode !== 0) throw new Error(result.stderr.trim() || `ls failed with exit ${result.exitCode}`);
+			return result.stdout.trim().split("\n").filter(Boolean);
+		}
+	};
+}
+/**
+* Pack a single file into an in-memory tar archive for `putArchive`, via
+* `tar-stream` (the same battle-tested packer the dockerode ecosystem uses
+* for build contexts). Optional peer dependency, loaded lazily like
+* dockerode itself so the module graph stays lean for non-docker users.
+*/
+async function packTarFile(name, data) {
+	let pack;
+	try {
+		pack = (await import("tar-stream")).pack;
+	} catch {
+		throw new Error("tar-stream is required for Docker writeFile. Install it with: bun add tar-stream");
+	}
+	const tar = pack();
+	tar.entry({ name }, data);
+	tar.finalize();
+	const chunks = [];
+	for await (const chunk of tar) chunks.push(chunk);
+	return Buffer.concat(chunks);
+}
+//#endregion
+//#region src/contexts/docker-spawn.ts
+/**
+* Format one {@link ContextMount} as a dockerode `HostConfig.Binds` entry.
+* Supports read-only (`:ro`) and SELinux shared-label (`:z`) options; the two
+* are mutually exclusive (a read-only mount can't also be a shared rw mount).
+*/
+function formatBindMount(mount) {
+	if (!mount.source) throw new Error("Docker mount source is required");
+	if (!mount.target || !mount.target.startsWith("/")) throw new Error(`Docker mount target must be an absolute path: ${mount.target}`);
+	if (mount.readonly && mount.shared) throw new Error(`Docker mount cannot be both readonly and shared: ${mount.target}`);
+	const opts = mount.readonly ? ":ro" : mount.shared ? ":z" : "";
+	return `${mount.source}:${mount.target}${opts}`;
+}
+/** Assemble dockerode `HostConfig.Binds` from the context's `mounts`. */
+function buildBindSpecs(mounts) {
+	return mounts.map(formatBindMount);
+}
+function dockerSpawnMethods(s) {
+	const { config, containers, defaultImage, defaultCwd, defaultEnv, defaultLimits, defaultMounts, defaultName } = s;
+	async function getDockerode() {
+		try {
+			const Dockerode = (await import("dockerode")).default;
+			return new Dockerode();
+		} catch {
+			throw new Error("dockerode is required for Docker execution context. Install it with: bun add dockerode");
+		}
+	}
+	return { async spawn(overrides) {
+		const docker = await getDockerode();
+		const id = `docker-${++s.counter}`;
+		const image = overrides?.image ?? defaultImage;
+		const cwd = overrides?.cwd ?? defaultCwd;
+		const mounts = [...defaultMounts, ...overrides?.mounts ?? []];
+		const name = overrides?.name ?? defaultName;
+		try {
+			await docker.getImage(image).inspect();
+		} catch {
+			await new Promise((resolve, reject) => {
+				docker.pull(image, (err, stream) => {
+					if (err) return reject(err);
+					docker.modem.followProgress(stream, (err2) => {
+						err2 ? reject(err2) : resolve();
+					});
+				});
+			});
+		}
+		const limits = {
+			...defaultLimits,
+			...overrides?.limits
+		};
+		const hostConfig = {};
+		if (limits?.memory) hostConfig.Memory = limits.memory * 1024 * 1024;
+		if (limits?.cpu) hostConfig.NanoCpus = Number.parseFloat(limits.cpu) * 1e9;
+		const hardening = {
+			...config?.hardening,
+			...overrides?.hardening
+		};
+		if (hardening.dropAllCapabilities) hostConfig.CapDrop = ["ALL"];
+		if (hardening.noNewPrivileges) hostConfig.SecurityOpt = ["no-new-privileges"];
+		if (hardening.readonlyRootfs) hostConfig.ReadonlyRootfs = true;
+		if (hardening.pidsLimit != null) hostConfig.PidsLimit = hardening.pidsLimit;
+		const env = {
+			...defaultEnv,
+			...overrides?.env
+		};
+		const bindSpecs = buildBindSpecs(mounts);
+		if (bindSpecs.length > 0) hostConfig.Binds = bindSpecs;
+		const portSpec = overrides?.ports ?? config?.ports;
+		const exposedPorts = {};
+		const portBindings = {};
+		if (portSpec?.length) {
+			for (const p of portSpec) {
+				const key = `${p.container}/${p.proto ?? "tcp"}`;
+				exposedPorts[key] = {};
+				portBindings[key] = [{ HostPort: p.host == null ? "" : String(p.host) }];
+			}
+			hostConfig.PortBindings = portBindings;
+		}
+		const user = overrides?.user ?? config?.user;
+		const network = overrides?.network ?? config?.network;
+		if (network) hostConfig.NetworkMode = network;
+		const labels = {
+			...config?.labels,
+			...overrides?.labels
+		};
+		const container = await docker.createContainer({
+			...name ? { name: `${name}-${s.counter}-${Math.random().toString(36).slice(2, 8)}` } : {},
+			Image: image,
+			Cmd: ["sleep", "infinity"],
+			WorkingDir: cwd,
+			Env: Object.entries(env).map(([k, v]) => `${k}=${v}`),
+			HostConfig: hostConfig,
+			...Object.keys(exposedPorts).length ? { ExposedPorts: exposedPorts } : {},
+			...user ? { User: user } : {},
+			...Object.keys(labels).length ? { Labels: labels } : {}
+		});
+		try {
+			await container.start();
+		} catch (err) {
+			await container.remove({ force: true }).catch(() => {});
+			throw err;
+		}
+		const handle = {
+			id,
+			type: "docker",
+			cwd
+		};
+		containers.set(id, {
+			handle,
+			container,
+			docker
+		});
+		return handle;
+	} };
+}
+//#endregion
+//#region src/contexts/docker-state.ts
+function createDockerState(config) {
+	return {
+		config,
+		counter: 0,
+		containers: /* @__PURE__ */ new Map(),
+		defaultImage: config?.image ?? "oven/bun:latest",
+		defaultCwd: config?.cwd ?? "/workspace",
+		defaultEnv: config?.env,
+		defaultLimits: config?.limits,
+		defaultMounts: config?.mounts ?? [],
+		defaultName: config?.name,
+		ctx: void 0
+	};
+}
+//#endregion
+//#region src/contexts/docker-stream.ts
+function dockerStreamMethods(s, execCapped) {
+	const { containers } = s;
+	return { 
+	/**
+	* Live bidirectional stream to a process in the container — see
+	* `ExecutionContext.execStream` for the seam contract.
+	*
+	* Spawns the `docker exec -i` CLI (see the runtime note in the body for
+	* why dockerode's hijack API is off the table), which adds a requirement
+	* the rest of this context doesn't have: the docker CLI must be on
+	* PATH — everything else here talks straight to the daemon socket.
+	* Deliberately NOT wrapped in coreutils `timeout` the way `execCapped`
+	* is — this seam's whole purpose is processes that outlive a single
+	* request.
+	*/
+async execStream(handle, command, options) {
+		const ref = containers.get(handle.id);
+		if (!ref) throw new Error(`Container ${handle.id} not found`);
+		options?.signal?.throwIfAborted();
+		const spawnChild = (await import("node:child_process")).spawn;
+		const { randomBytes } = await import("node:crypto");
+		const pidFile = `/tmp/.zidane-stream-${randomBytes(6).toString("hex")}.pid`;
+		const envPrefix = Object.entries(options?.env ?? {}).map(([k, v]) => `${k}=${alwaysQuote(v)} `).join("");
+		const leaderScript = `echo $$ > ${pidFile}; exec ${envPrefix ? `env ${envPrefix}` : ""}sh -c ${alwaysQuote(command)}`;
+		const quotedLeader = alwaysQuote(leaderScript);
+		const inner = `if setsid -w true 2>/dev/null; then exec setsid -w sh -c ${quotedLeader}; else exec sh -c ${quotedLeader}; fi`;
+		const child = spawnChild("docker", [
+			"exec",
+			"-i",
+			"-w",
+			options?.cwd ?? handle.cwd,
+			ref.container.id,
+			"sh",
+			"-c",
+			inner
+		], { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		let spawnError = null;
+		child.on("error", (err) => {
+			spawnError = err;
+		});
+		const exited = new Promise((resolveExit) => {
+			child.once("close", (code, signalName) => {
+				resolveExit(code ?? (signalName === "SIGTERM" ? 143 : signalName ? 128 : 1));
+			});
+		});
+		let pid = -1;
+		for (let attempt = 0; attempt < 20 && pid <= 0; attempt++) {
+			const probe = await execCapped(handle, `cat ${pidFile} 2>/dev/null || true`, void 0, 4096).catch(() => null);
+			const parsed = Number.parseInt(probe?.stdout.trim() ?? "", 10);
+			if (Number.isFinite(parsed) && parsed > 0) {
+				pid = parsed;
+				break;
+			}
+			if (child.exitCode !== null) break;
+			await new Promise((r) => setTimeout(r, 50));
+		}
+		const kill = async () => {
+			if (pid > 0) await execCapped(handle, `kill -TERM -${pid} 2>/dev/null || kill -TERM ${pid} 2>/dev/null || true`, void 0, 4096).catch(() => {});
+			await execCapped(handle, `rm -f ${pidFile}`, void 0, 4096).catch(() => {});
+			if (child.exitCode === null && child.signalCode === null) child.kill("SIGTERM");
+		};
+		if (options?.signal) {
+			if (options.signal.aborted) kill();
+			else {
+				const onAbort = () => {
+					kill();
+				};
+				const detach = () => options.signal.removeEventListener("abort", onAbort);
+				options.signal.addEventListener("abort", onAbort, { once: true });
+				exited.then(detach, detach);
+			}
+		}
+		return {
+			pid,
+			stdout: child.stdout,
+			stderr: child.stderr,
+			write: async (data) => {
+				if (spawnError) throw spawnError;
+				const stdin = child.stdin;
+				if (!stdin || stdin.destroyed) throw new Error(`execStream: stdin is closed (container ${handle.id})`);
+				await new Promise((resolveWrite, rejectWrite) => {
+					stdin.write(data, (err) => err ? rejectWrite(err) : resolveWrite());
+				});
+			},
+			kill,
+			exited
+		};
+	} };
+}
+function dockerTerminalMethods(s, execCapped) {
+	const { containers } = s;
+	return { 
+	/**
+	* A shell in the container: `docker exec -it` driven by a local PTY, so
+	* the CLI sees a real terminal and forwards resizes. Same CLI route as
+	* `execStream` (dockerode's interactive exec doesn't work under Bun).
+	* Closing the CLI doesn't end the exec'd shell, so the shell records
+	* its pid (a session leader under `-t`) and `kill` hangs up its group.
+	*/
+...hasLocalPty() ? { async openTerminal(handle, options) {
+		const ref = containers.get(handle.id);
+		if (!ref) throw new Error(`Container ${handle.id} not found`);
+		const { randomBytes } = await import("node:crypto");
+		const token = randomBytes(6).toString("hex");
+		const pidFile = `/tmp/.zidane-tty-${token}.pid`;
+		const leader = `echo $$ > ${pidFile}; if command -v bash >/dev/null 2>&1; then exec bash -l; else exec sh -l; fi`;
+		const envArgs = Object.entries({
+			...options.env,
+			...TERMINAL_ENV
+		}).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
+		const cliEnv = {};
+		for (const [k, v] of Object.entries(process.env)) if (typeof v === "string") cliEnv[k] = v;
+		const pty = spawnLocalPty([
+			"docker",
+			"exec",
+			"-it",
+			"-w",
+			options.cwd ?? handle.cwd,
+			...envArgs,
+			ref.container.id,
+			"sh",
+			"-c",
+			leader
+		], {
+			cwd: process.cwd(),
+			env: cliEnv,
+			cols: options.cols,
+			rows: options.rows,
+			onData: options.onData
+		});
+		pty.exited.then(() => execCapped(handle, `rm -f ${pidFile}`, void 0, 4096).catch(() => {}));
+		const kill = async () => {
+			const probe = await execCapped(handle, `cat ${pidFile} 2>/dev/null || true`, void 0, 4096).catch(() => null);
+			const pid = Number.parseInt(probe?.stdout.trim() ?? "", 10);
+			if (Number.isFinite(pid) && pid > 0) await execCapped(handle, `kill -HUP -${pid} 2>/dev/null || kill -HUP ${pid} 2>/dev/null || true`, void 0, 4096).catch(() => {});
+			await execCapped(handle, `rm -f ${pidFile}`, void 0, 4096).catch(() => {});
+			await endLocalPty(pty);
+		};
+		return localTerminalProcess(pty, {
+			id: `docker-${token}`,
+			localPid: false,
+			kill
+		});
+	} } : {} };
+}
+//#endregion
+//#region src/contexts/docker.ts
+/**
+* dockerode surfaces HTTP errors with a `statusCode`. 304 = container
+* already stopped, 404 = already gone — both are fine during teardown.
+*/
+function isGoneOrAlreadyStopped(err) {
+	const code = err?.statusCode;
+	return code === 304 || code === 404;
+}
+function createDockerContext(config) {
+	const s = createDockerState(config);
+	const { containers } = s;
+	const execCapped = createDockerExecCapped(s);
+	const spawnM = dockerSpawnMethods(s);
+	const streamM = dockerStreamMethods(s, execCapped);
+	const files = dockerFileMethods(s, execCapped);
+	const ctx = {
+		type: "docker",
+		capabilities: {
+			shell: true,
+			filesystem: true,
+			glob: true,
+			network: true,
+			gpu: false,
+			stream: true
+		},
+		spawn: spawnM.spawn,
+		async exec(handle, command, options) {
+			return execCapped(handle, command, options, DEFAULT_MAX_OUTPUT_BUFFER);
+		},
+		execStream: streamM.execStream,
+		...dockerTerminalMethods(s, execCapped),
+		fileSize: files.fileSize,
+		readFile: files.readFile,
+		writeFile: files.writeFile,
+		listFiles: files.listFiles,
+		async getMappedPort(handle, containerPort) {
+			const ref = containers.get(handle.id);
+			if (!ref) return null;
+			const bindings = (await ref.container.inspect())?.NetworkSettings?.Ports ?? {};
+			for (const proto of ["tcp", "udp"]) {
+				const list = bindings[`${containerPort}/${proto}`];
+				if (Array.isArray(list) && list.length > 0 && list[0]?.HostPort) return Number.parseInt(list[0].HostPort, 10);
+			}
+			return null;
+		},
+		async destroy(handle) {
+			const ref = containers.get(handle.id);
+			if (!ref) return;
+			try {
+				try {
+					await ref.container.stop({ t: 5 });
+				} catch {}
+				try {
+					await ref.container.remove({ force: true });
+				} catch (err) {
+					if (!isGoneOrAlreadyStopped(err)) throw err;
+				}
+			} finally {
+				containers.delete(handle.id);
+			}
+		}
+	};
+	s.ctx = ctx;
+	return ctx;
+}
+/**
+* Path-equal bind mounts that make a HOST working directory usable inside a
+* container: the enclosing git worktree (or `cwd` itself outside git) at the
+* same absolute path, plus the git common dir when it lives outside that
+* tree (a linked worktree's `.git` file points there — without it, git fails
+* in the container). Path-equal keeps host-side features (diffs, artifacts,
+* `@`-paths) valid for the same absolute paths the agent sees.
+*
+* The git dir's `hooks/` and `config` (plus `config.worktree` when present or
+* enabled) are overlaid read-only — created empty first if absent: host-side git
+* (zidane's own diff/workspace calls included) would otherwise run hooks or
+* `core.fsmonitor` / `core.hooksPath` planted from inside the container.
+* Deliberate cost: git commands that WRITE config fail inside the container —
+* `git push -u` / `--set-upstream`, `git branch --set-upstream-to`,
+* `git remote add`, `git config …`. Commits, fetches and a plain
+* `git push <remote> <branch>` work; environments that publish a branch must
+* push without recording an upstream.
+*
+* Returns `[]` when `cwd` is not an existing host directory, so a
+* container-only path (`--cwd /workspace`) keeps its historical meaning, and
+* when the tree to mount is `/`, `$HOME`, or an ancestor of `$HOME` (too broad
+* to hand a container read-write). A git root that is too broad falls back to
+* `cwd` alone (no git dir), so a dotfiles repo at `$HOME` doesn't blank every
+* project under it.
+*/
+function hostWorkspaceMounts(cwd) {
+	if (!posix.isAbsolute(cwd) || !isHostDirectory(cwd)) return [];
+	const rootMount = workspaceRootMount(cwd, gitProbe(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+	if (isTooBroadToMount(rootMount.source)) {
+		const cwdMount = {
+			source: safeRealpath(cwd),
+			target: cwd
+		};
+		return isTooBroadToMount(cwdMount.source) ? [] : [cwdMount];
+	}
+	const mounts = [rootMount];
+	const commonDir = gitProbe(cwd, ["rev-parse", "--git-common-dir"]);
+	if (commonDir) {
+		const realCommon = safeRealpath(commonDir);
+		let commonTarget;
+		if (isWithin(realCommon, rootMount.source)) commonTarget = posix.join(rootMount.target, posix.relative(rootMount.source, realCommon));
+		else {
+			mounts.push({
+				source: commonDir,
+				target: commonDir
+			});
+			commonTarget = commonDir;
+		}
+		const overlay = (source) => {
+			if (isWithin(source, realCommon)) mounts.push({
+				source,
+				target: posix.join(commonTarget, posix.relative(realCommon, source)),
+				readonly: true
+			});
+		};
+		if (ensureHostPath(posix.join(realCommon, "hooks"), "dir")) overlay(posix.join(realCommon, "hooks"));
+		if (ensureHostPath(posix.join(realCommon, "config"), "file")) overlay(posix.join(realCommon, "config"));
+		const worktreeConfig = gitProbe(cwd, [
+			"rev-parse",
+			"--git-path",
+			"config.worktree"
+		]);
+		if (worktreeConfig) {
+			const real = posix.join(safeRealpath(posix.dirname(worktreeConfig)), posix.basename(worktreeConfig));
+			if (existsSync(real) || worktreeConfigEnabled(cwd) && ensureHostPath(real, "file")) overlay(real);
+		}
+	}
+	return mounts;
+}
+/** Create an empty dir / file at `path` if absent. `false` when it can't exist. */
+function ensureHostPath(path, kind) {
+	try {
+		if (kind === "dir") mkdirSync(path, { recursive: true });
+		else if (!existsSync(path)) writeFileSync(path, "", { flag: "a" });
+		return true;
+	} catch {
+		return existsSync(path);
+	}
+}
+function worktreeConfigEnabled(cwd) {
+	try {
+		return execFileSync("git", [
+			"config",
+			"--bool",
+			"--get",
+			"extensions.worktreeConfig"
+		], {
+			cwd,
+			timeout: 1e3,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim() === "true";
+	} catch {
+		return false;
+	}
+}
+function isTooBroadToMount(source) {
+	const real = safeRealpath(source);
+	return real === "/" || isWithin(safeRealpath(homedir()), real);
+}
+function safeRealpath(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+function workspaceRootMount(cwd, root) {
+	try {
+		const realCwd = realpathSync(cwd);
+		if (root === cwd || realCwd === cwd) return {
+			source: root,
+			target: root
+		};
+		const candidate = posix.resolve(cwd, posix.relative(realCwd, root));
+		if (isWithin(cwd, candidate) && realpathSync(candidate) === realpathSync(root)) return {
+			source: root,
+			target: candidate
+		};
+		return {
+			source: realCwd,
+			target: cwd
+		};
+	} catch {
+		return {
+			source: root,
+			target: root
+		};
+	}
+}
+function isHostDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+function isWithin(child, parent) {
+	const rel = posix.relative(parent, child);
+	return rel === "" || !rel.startsWith("..") && !posix.isAbsolute(rel);
+}
+function gitProbe(cwd, args) {
+	try {
+		const out = execFileSync("git", args, {
+			cwd,
+			timeout: 1e3,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+		return out ? posix.resolve(cwd, out) : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { packTarFile as a, READ_FILE_MAX_BUFFER as i, hostWorkspaceMounts as n, buildBindSpecs as r, createDockerContext as t };
+
+//# sourceMappingURL=docker-BZhMMJUp.js.map