dcc

#!/usr/bin/env bash
# Host-side wrapper for a restricted coding-agent dev container, rootless
# podman edition (keep-id userns — see template/devcontainer.json).
#   dcc init <name>     adopt: copy the template to ./.devcontainer and
#                      substitute <name> into it (run in the workspace root)
#   dcc seed [project]  copy the agent settings (statusline, claude settings,
#                      codex config, git identity — never tokens) from an
#                      existing project: its dcc name or its directory
#   dcc [attach] [cmd…] up if needed + interactive shell, or run cmd
#                      instead of the shell (e.g. dcc attach claude); tmux
#                      lives on the host — run dcc inside your own setup
#   dcc up [cmd…]       build/start the container (+ database sidecar if
#                      configured), optionally run cmd afterwards
#   dcc rebuild         recreate the dev container (new image, fresh firewall)
#                      and prune the images earlier rebuilds left untagged;
#                      the database and its data are untouched
#   dcc update [--since REV]
#                       bring .devcontainer up to date with the template on
#                       GitHub (runs .devcontainer/update); then dcc rebuild
#   dcc down            stop the dev container + database sidecar (data and
#                      containers stay; next dcc up restarts them)
#   dcc db reset        wipe the database sidecar + its data volume (re-inits
#                      from .devcontainer/db-init.d on next dcc up)
#   dcc allow <domain>  temporary egress grant (dies on container restart)
#   dcc chrome [on|off|status]
#                       your Chrome for the agent (claude --chrome): on = link
#                       the extension's socket into the container, off = unlink
#                       and drop the connections inside (dies on restart)
#   dcc watermarks [on|off|status]
#                       the watermarks-remover service for the remove-ai-marks
#                       skill: on = start it on loopback inside, off = stop it
#                       (dies on restart; Dockerfile opt-in)
#   dcc approve <plan> [--scope <glob>…]
#                       approve a committed plan: lets the run enter phase
#                       implement, optionally limited to a write scope
#   dcc approve-release <repo-dir> <pr>
#                       approve the merge of a Release PR at its current head
#   dcc check           run the harness gate checks (harness check) inside
#   dcc harness [on|off|status]
#                       the operator's runtime switch: off = the hooks make
#                       no decisions (plain Claude Code permissions apply)
#                       until `dcc harness on` or the next container start
#   dcc fw              re-run the firewall (e.g. after CDN IPs rotated)
#   dcc root            root shell (host-side escape hatch; no sudo inside)
# Needs podman and npx (@devcontainers/cli is fetched on demand). Everything
# except init reads per-project settings from .devcontainer/dcc.conf, found
# by walking up from the current directory.
set -euo pipefail

ENGINE=podman
# readlink -f: keep the template path correct when invoked via a symlink on PATH
TEMPLATE="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/template"

if [ "${1:-}" = init ]; then
    name="${2:?usage: dcc init <name>}"
    [[ $name =~ ^[a-z0-9][a-z0-9-]*$ ]] || { echo "ERROR: name must be lowercase [a-z0-9-]" >&2; exit 1; }
    [ ! -e .devcontainer ] || { echo "ERROR: .devcontainer already exists here" >&2; exit 1; }
    cp -r "$TEMPLATE" .devcontainer
    # perl -pi, not sed -i: BSD sed (macOS) wants -i '' and GNU sed wants -i
    # not update: its own code names the placeholder (its fetch() skips itself too)
    grep -rl PROJECTNAME .devcontainer | grep -v '/update$' | xargs -r perl -pi -e "s/PROJECTNAME/$name/g"
    # the sidecar subnet must be unique per project on this host: the first
    # 172.30.N.0/24 no podman network uses (dcc.conf SUBNET and the
    # DEVCONTAINER_SUBNET the firewall reads must agree, so both files)
    # ponytail: podman networks only; a host route on the range still collides
    # tr: inspect prints one line per network — newlines would break the case match
    used=$($ENGINE network inspect $($ENGINE network ls -q) -f '{{range .Subnets}}{{.Subnet}} {{end}}' 2>/dev/null | tr '\n' ' ' || true)
    for n in {0..255}; do
        case " $used " in *" 172.30.$n.0/24 "*) continue ;; esac
        perl -pi -e "s|172\.30\.0\.0/24|172.30.$n.0/24|g" .devcontainer/dcc.conf .devcontainer/devcontainer.json
        echo "sidecar subnet 172.30.$n.0/24"
        break
    done
    # agent state contains auth tokens — never commit it
    if [ -d .git ]; then
        for state in .claude-devcontainer/ .codex-devcontainer/ .graft-devcontainer/; do
            grep -qxF "$state" .gitignore 2>/dev/null || { echo "$state" >>.gitignore; echo "added $state to .gitignore"; }
        done
    fi
    # the template version, for .devcontainer/update (3-way merge base)
    git -C "$TEMPLATE" rev-parse HEAD >.devcontainer/template.rev 2>/dev/null || rm -f .devcontainer/template.rev
    echo "initialized .devcontainer for '$name'"
    echo "review .devcontainer/dcc.conf and devcontainer.json (masks, features, allowlist), then run: dcc"
    echo "settings from an existing project: dcc seed <name>"
    exit 0
fi

# workspace root: nearest ancestor holding .devcontainer/devcontainer.json
ROOT=$PWD
while [ ! -f "$ROOT/.devcontainer/devcontainer.json" ]; do
    [ "$ROOT" != / ] || { echo "ERROR: no .devcontainer found here or above — adopt with 'dcc init <name>'" >&2; exit 1; }
    ROOT=$(dirname "$ROOT")
done

NAME=$(basename "$ROOT")
SUBNET=172.30.0.0/24
DB_IMAGE=
DB_PORT=5433
DB_ENV="POSTGRES_USER=postgres POSTGRES_PASSWORD=postgres"
[ ! -f "$ROOT/.devcontainer/dcc.conf" ] || . "$ROOT/.devcontainer/dcc.conf"
CTR=$NAME-dev
DB=$NAME-db
NET=$NAME-net
VOL=$NAME-pgdata
CHROME_DIR=/tmp/dcc-$NAME-chrome   # bind source of the chrome toggle (devcontainer.json, opt-in)

running() { [ "$($ENGINE inspect -f '{{.State.Running}}' "$1" 2>/dev/null)" = true ]; }

ensure_db() {
    $ENGINE network inspect "$NET" >/dev/null 2>&1 \
        || $ENGINE network create --subnet "$SUBNET" "$NET" >/dev/null
    [ -n "$DB_IMAGE" ] || return 0
    if ! running "$DB"; then
        local args=() f e
        for f in "$ROOT/.devcontainer/db-init.d"/*; do
            [ -e "$f" ] && args+=(-v "$f:/docker-entrypoint-initdb.d/$(basename "$f"):ro")
        done
        for e in $DB_ENV; do args+=(-e "$e"); done
        $ENGINE start "$DB" >/dev/null 2>&1 || $ENGINE run -d --name "$DB" \
            --network "$NET" --network-alias postgres \
            --restart unless-stopped \
            -v "$VOL:/var/lib/postgresql/data" \
            -p "127.0.0.1:$DB_PORT:5432" \
            -e TZ=UTC -e PGTZ=UTC ${args[@]+"${args[@]}"} \
            "$DB_IMAGE" >/dev/null
    fi
    for _ in $(seq 1 30); do
        $ENGINE exec "$DB" pg_isready -q -U postgres 2>/dev/null && return 0
        sleep 1
    done
    echo "WARN: database sidecar not ready after 30s" >&2
}

up() {
    # a template line merged in by hand keeps its placeholder: podman would
    # build for minutes, then refuse the mount
    if grep -n PROJECTNAME "$ROOT/.devcontainer/devcontainer.json" >&2; then
        echo "ERROR: PROJECTNAME left in .devcontainer/devcontainer.json (above)" >&2; exit 1; fi
    # bind sources; podman won't create them (empty.d: directory-mask source).
    # The project-state dir under .claude-devcontainer too: a nested mount
    # there (e.g. the host memory dir) makes podman create the missing
    # parents as container root = host subuid, and the agent can't write them
    mkdir -p "$ROOT/.claude-devcontainer/projects/-$(printf %s "$ROOT" | sed 's|^/||; s|/|-|g')" \
        "$ROOT/.codex-devcontainer" "$ROOT/.graft-devcontainer" \
        "$ROOT/.devcontainer/empty.d" "$HOME/.config/$NAME-devcontainer"
    # the chrome toggle's bind source: ours, under /tmp — the extension's
    # socket is on that tmpfs and a hard link needs the same filesystem
    # (-O: nobody else pre-made it). Off at every container start, like an
    # egress grant
    mkdir -p -m 700 "$CHROME_DIR" && [ -O "$CHROME_DIR" ] \
        || { echo "ERROR: $CHROME_DIR is not yours" >&2; exit 1; }
    running "$CTR" || rm -f "$CHROME_DIR"/*.sock
    ensure_db
    npx --yes @devcontainers/cli up --docker-path "$ENGINE" \
        --workspace-folder "$ROOT" "$@"
}

exec_in() {   # run a command (default: interactive shell) inside as vscode
    [ $# -gt 0 ] || set -- bash
    local t=(); [ -t 0 ] && t=(-t)   # no pseudo-tty when scripted/piped
    # ${t[@]+…}: bash 3.2 (macOS /bin/bash) treats an empty array as unset under -u
    exec $ENGINE exec -i ${t[@]+"${t[@]}"} -u vscode -w "$ROOT" "$CTR" "$@"
}

seed() {   # agent settings from an existing project — never its tokens or logins
    local want=${1:-} src srcname f
    [ -n "$want" ] || read -rp "seed from project (dcc name or directory): " want || true
    src=$want
    # a name resolves through its container: the devcontainer CLI labels it
    # with the workspace path
    [ -d "$src/.devcontainer" ] || src=$($ENGINE inspect "$want-dev" \
        -f '{{index .Config.Labels "devcontainer.local_folder"}}' 2>/dev/null || true)
    [ -n "$src" ] && [ -d "$src/.devcontainer" ] \
        || { echo "ERROR: no project '$want' — the name of a started project, or its directory" >&2; exit 1; }
    src=$(cd "$src" && pwd -P)
    [ "$src" != "$ROOT" ] || { echo "ERROR: '$want' is this project" >&2; exit 1; }
    srcname=$(NAME=$(basename "$src"); . "$src/.devcontainer/dcc.conf" 2>/dev/null; echo "$NAME")
    mkdir -p "$ROOT/.claude-devcontainer" "$ROOT/.codex-devcontainer" "$HOME/.config/$NAME-devcontainer"
    seed_file() {   # src dst: copy unless dst exists; the source's absolute
                    # path becomes this one (codex keys project trust by it)
        [ -f "$1" ] || return 0
        [ ! -e "$2" ] || { echo "kept $2"; return 0; }
        perl -pe "s|\Q$src\E|$ROOT|g" "$1" >"$2" && echo "seeded $2"
    }
    for f in .claude-devcontainer/statusline-command.sh .claude-devcontainer/settings.json \
             .codex-devcontainer/config.toml; do
        seed_file "$src/$f" "$ROOT/$f"
    done
    seed_file "$HOME/.config/$srcname-devcontainer/gitconfig" "$HOME/.config/$NAME-devcontainer/gitconfig"
    echo "per project, not seeded: gh-token, signing-key (README 'Add your credentials'); log in inside: claude, codex login --device-auth"
}

[ $# -gt 0 ] || set -- attach
case "$1" in
    up)      shift; up; [ $# -eq 0 ] || exec_in "$@" ;;
    rebuild) rm -f "$CHROME_DIR"/*.sock; up --remove-existing-container   # a new container starts with chrome off
             # the replaced image pair (vsc-<name>-<hash>, -uid) stays behind untagged,
             # ~2 GB per rebuild. Dangling images off the devcontainers base only:
             # every dcc image is one, nothing else on the host qualifies
             echo "pruned $($ENGINE image prune -f --filter label=dev.containers.id=base-ubuntu | wc -l) layers of old dev container images" ;;
    update)  shift   # bootstrap: a project from before the script existed gets it from the template
             [ -x "$ROOT/.devcontainer/update" ] || cp -p "$TEMPLATE/update" "$ROOT/.devcontainer/update"
             exec "$ROOT/.devcontainer/update" "$@" ;;
    down)
        stopped=
        for c in "$CTR" "$DB"; do
            if running "$c"; then $ENGINE stop "$c" >/dev/null && echo "stopped $c"; stopped=1; fi
        done
        [ -n "$stopped" ] || echo "nothing running"
        ;;
    db)
        [ "${2:-}" = reset ] || { echo "usage: dcc db reset" >&2; exit 1; }
        [ -n "$DB_IMAGE" ] || { echo "ERROR: no database configured (DB_IMAGE in dcc.conf)" >&2; exit 1; }
        $ENGINE rm -f "$DB" >/dev/null 2>&1 || true
        $ENGINE volume rm "$VOL" >/dev/null 2>&1 || true
        echo "database wiped — next 'dcc up' re-initializes from .devcontainer/db-init.d"
        ;;
    allow)   $ENGINE exec -u root "$CTR" /usr/local/bin/cc-allow.sh "${2:?usage: dcc allow <domain>}" ;;
    # your Chrome for the agent: the Claude in Chrome extension keeps a native
    # host running on the host, listening on /tmp/claude-mcp-browser-bridge-<user>/<pid>.sock;
    # claude inside scans the same directory for user vscode = the read-only
    # bind mount of $CHROME_DIR. on = hard-link the live sockets in (same
    # tmpfs), off = unlink + kill whatever holds a connection inside. The
    # extension's own site permissions and prompts still apply, in your Chrome.
    chrome)
        h=/tmp/claude-mcp-browser-bridge-$(id -un)
        case "${2:-status}" in
            on)
                running "$CTR" || { echo "ERROR: $CTR is not running — dcc up first" >&2; exit 1; }
                $ENGINE inspect "$CTR" -f '{{range .Mounts}}{{.Destination}}{{"\n"}}{{end}}' | grep -qx /tmp/claude-mcp-browser-bridge-vscode \
                    || { echo "ERROR: $CTR has no chrome mount — uncomment it in .devcontainer/devcontainer.json, then dcc rebuild (README 'Use your Chrome from the container')" >&2; exit 1; }
                rm -f "$CHROME_DIR"/*.sock; n=0
                for s in "$h"/*.sock; do p=${s##*/}; p=${p%.sock}   # <pid>.sock — link the live ones
                    [ -e "$s" ] && kill -0 "$p" 2>/dev/null && ln "$s" "$CHROME_DIR"/ && n=$((n+1)); done
                [ "$n" -gt 0 ] || { echo "ERROR: no extension socket in $h — Chrome with the Claude in Chrome extension is not running on this host" >&2; exit 1; }
                echo "chrome ON — inside: claude --chrome, or /chrome → Reconnect extension; until 'dcc chrome off' or the next container start" ;;
            off)
                rm -f "$CHROME_DIR"/*.sock
                # a unix connect() creates the server's peer socket in the
                # client's netns, so only ss inside sees the pair: the row
                # with the socket path, and the client row with the pid
                ! running "$CTR" || $ENGINE exec -u vscode "$CTR" sh -c 'ss -xHp | awk "$1" | sort -u | xargs -r kill' sh \
                    'index($5,"/tmp/claude-mcp-browser-bridge-")==1{srv[$8]=1} {row[$6]=$0} END{for(i in srv) if(i in row && match(row[i],/pid=[0-9]+/)) print substr(row[i],RSTART+4,RLENGTH-4)}'
                echo "chrome off" ;;
            status)
                on=
                for l in "$CHROME_DIR"/*.sock; do [ -e "$l" ] || continue; on=1
                    if [ "$l" -ef "$h/${l##*/}" ]; then echo "chrome ON (${l##*/})"
                    else echo "chrome ON, but the socket is stale (Chrome restarted) — run: dcc chrome on"; fi
                done
                [ -n "$on" ] || echo "chrome off" ;;
            *) echo "usage: dcc chrome [on|off|status]" >&2; exit 1 ;;
        esac ;;
    # the watermarks-remover service (Dockerfile opt-in): a python process on
    # loopback inside, run as vscode while the user needs it; the
    # remove-ai-marks skill talks to it with curl and stops when it is down.
    # Off at every container start, like an egress grant.
    watermarks)
        wmr=/usr/local/lib/watermarks-remover
        health() { running "$CTR" && $ENGINE exec -u vscode "$CTR" curl -sf http://127.0.0.1:8765/health >/dev/null 2>&1; }
        case "${2:-status}" in
            on)
                running "$CTR" || { echo "ERROR: $CTR is not running — dcc up first" >&2; exit 1; }
                $ENGINE exec "$CTR" test -f "$wmr/service/scripts/server.py" \
                    || { echo "ERROR: $CTR has no watermarks-remover — uncomment its block in .devcontainer/Dockerfile, then dcc rebuild (README 'Use watermarks-remover')" >&2; exit 1; }
                # -w: server.py reads config/clean_strategy.json relative to the cwd
                health || $ENGINE exec -d -u vscode -w "$wmr" "$CTR" sh -c "exec python3 $wmr/service/scripts/server.py >/tmp/watermarks-remover.log 2>&1" >/dev/null   # -d prints the exec session id
                for _ in $(seq 1 20); do health && break; sleep 0.3; done
                health || { echo "ERROR: the service did not start — inside: cat /tmp/watermarks-remover.log" >&2; exit 1; }
                echo "watermarks ON — http://127.0.0.1:8765 inside, skill /remove-ai-marks; until 'dcc watermarks off' or the next container start" ;;
            off)
                ! running "$CTR" || $ENGINE exec -u vscode "$CTR" pkill -f "$wmr/service/scripts/server.py" || true
                echo "watermarks off" ;;
            status)
                if health; then echo "watermarks ON"; else echo "watermarks off"; fi ;;
            *) echo "usage: dcc watermarks [on|off|status]" >&2; exit 1 ;;
        esac ;;
    # approvals are root-only inside: the token lands in /run/harness/approvals,
    # which vscode reads and cannot write. Root in the userns is not the owner
    # of the workspace files, so git needs safe.directory for the blob hash.
    approve)
        shift; $ENGINE exec -u root -w "$ROOT" -e CLAUDE_PROJECT_DIR="$ROOT" \
            -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory -e GIT_CONFIG_VALUE_0='*' \
            "$CTR" /usr/local/lib/harness/harness.py approve "$@" ;;
    # the release token is the PR head SHA as the operator's gh on the host
    # sees it; the container gets no GitHub access for this, root just stores
    # the file (same name the release-approved checker looks up)
    approve-release)
        repo=${2:?usage: dcc approve-release <repo-dir> <pr>}; pr=${3:?usage: dcc approve-release <repo-dir> <pr>}
        read -r base sha <<<"$(cd "$repo" && gh pr view "$pr" --json baseRefName,headRefOid --jq '.baseRefName+" "+.headRefOid')"
        [ "$base" = production ] || { echo "ERROR: PR $pr does not target production (base: ${base:-?})" >&2; exit 1; }
        name=$(basename "$(cd "$repo" && pwd -P)")
        $ENGINE exec -u root "$CTR" sh -c 'printf %s "$1" >"/run/harness/approvals/release-$2-$3.approved"' sh "$sha" "$name" "$pr"
        echo "approved release PR $pr ($name) at ${sha:0:7}" ;;
    # GH_TOKEN reaches interactive shells only (bashrc); a podman exec is not
    # one, and the board checkers need gh — hand the token over explicitly
    check)   shift; $ENGINE exec -u vscode -w "$ROOT" -e CLAUDE_PROJECT_DIR="$ROOT" \
                 -e GH_TOKEN="$(cat "$HOME/.config/$NAME-devcontainer/gh-token" 2>/dev/null)" \
                 "$CTR" /usr/local/lib/harness/harness.py check "$@" ;;
    # the switch is a root-owned marker under /run/harness: the agent sees it
    # (harness status) and cannot flip it; /run is fresh on every start
    harness)
        case "${2:-status}" in
            off)    $ENGINE exec -u root "$CTR" sh -c 'mkdir -p /run/harness && touch /run/harness/off' \
                        && echo "harness OFF — until 'dcc harness on' or the next container start" ;;
            on)     $ENGINE exec -u root "$CTR" rm -f /run/harness/off && echo "harness on" ;;
            status) $ENGINE exec -u vscode -w "$ROOT" -e CLAUDE_PROJECT_DIR="$ROOT" "$CTR" /usr/local/lib/harness/harness.py status ;;
            *) echo "usage: dcc harness [on|off|status]" >&2; exit 1 ;;
        esac ;;
    seed)    seed "${2:-}" ;;
    fw)      $ENGINE exec -u root "$CTR" /usr/local/bin/devcontainer-firewall.sh ;;
    root)    shift; [ $# -gt 0 ] || set -- bash   # root shell, or one root command
             t=(); [ -t 0 ] && t=(-t)
             exec $ENGINE exec -i ${t[@]+"${t[@]}"} -u root "$CTR" "$@" ;;
    attach)
        shift
        running "$CTR" || up
        exec_in "$@"
        ;;
    *) echo "usage: dcc [attach [cmd…]|up [cmd…]|rebuild|update|down|db reset|allow <domain>|chrome [on|off|status]|watermarks [on|off|status]|approve <plan> [--scope g…]|approve-release <repo> <pr>|check|harness [on|off|status]|fw|root|init <name>|seed [project]]" >&2; exit 1 ;;
esac