Starting impl devcontainer spec

@@ -19,5 +19,6 @@
     },
     "workspaceMount": "source=${localWorkspaceFolder},target=/workspaces/herald,type=bind",
     "workspaceFolder": "/workspaces/herald",
+   	"runArgs": ["--userns=keep-id", "--security-opt", "label=disable"],

@@ -0,0 +14,4 @@
+}
+
+#[derive(Debug, Deserialize)]
+pub struct DevContainerSchema {

@@ -0,0 +94,4 @@
+    }
+}
+
+fn first_existing_container_file(base_dir: &Path) -> PathBuf {

@@ -0,0 +102,4 @@
+        .unwrap_or_else(|| base_dir.join("Dockerfile"))
+}
+
+pub async fn parse(path: impl AsRef<Path>) -> Result<DevContainer, ParseError> {

@@ -0,0 +127,4 @@
+    use std::fs;
+
+    #[test]
+    fn resolves_configured_containerfile_relative_to_devcontainer_file() {

@@ -0,0 +477,4 @@
+}
+
+/// Nettoie une chaîne pour qu'elle puisse servir de nom d'image/container docker.
+fn sanitize(input: &str) -> String {

@@ -0,0 +100,4 @@
+    dest: &Path,
+) -> anyhow::Result<()> {
+    let dest = dest.display().to_string();
+

@@ -0,0 +144,4 @@
+/// Runs git with the token injected through `http.extraHeader`, keeping the
+/// secret out of the process arguments.
+async fn run_git(token: &str, args: &[String]) -> anyhow::Result<()> {
+    let output = tokio::process::Command::new("git")

@@ -0,0 +177,4 @@
+    let normalized =
+        normalize(&candidate).with_context(|| format!("path `{path}` escapes the workspace"))?;
+
+    if !normalized.starts_with(workspace) {

@@ -19,5 +19,6 @@
     },
     "workspaceMount": "source=${localWorkspaceFolder},target=/workspaces/herald,type=bind",
     "workspaceFolder": "/workspaces/herald",
+   	"runArgs": ["--userns=keep-id", "--security-opt", "label=disable"],

@@ -1,4 +0,0 @@
-target/

@@ -15,1 +21,3 @@
-          - cargo test
+          - cargo test --workspace --all-targets
+
+    - name: container-build

@@ -1,12 +1,15 @@
-FROM rust:1.96 as builder
+FROM rust:1.97-trixie as builder

@@ -10,3 +13,2 @@
 WORKDIR /app
-COPY --from=builder /app/target/release/herald .
-CMD [ "./herald" ]
+COPY --from=builder /app/target/release/herald-server .

@@ -41,0 +59,4 @@
+The container runtime is selected with `CONTAINER_RUNTIME` (`docker` or
+`podman`). The repository must contain a `.devcontainer/devcontainer.json`.
+
+Each sandbox is isolated: it gets its own image tag, container and network. The

@@ -0,0 +323,4 @@
+        ];
+
+        if let Some(network) = network {
+            args.push("--network".to_string());

@@ -0,0 +337,4 @@
+            args.push(format!("{key}={value}"));
+        }
+
+        args.extend(self.run_args.iter().cloned());

@@ -0,0 +86,4 @@
+            .parent()
+            .ok_or_else(|| ParseError::InvalidDevContainerPath(devcontainer_path.clone()))?;
+
+        let container_file_path = base_dir.join(schema.build.dockerfile);

@@ -0,0 +25,4 @@
+metrics = { workspace = true }
+metrics-exporter-prometheus = { workspace = true }
+devcontainer-rs = { path = "../devcontainer-rs" }
+tempfile = "3"

@@ -0,0 +29,4 @@
+    let metrics_bind_addr = std::env::var("METRICS_BIND_ADDR").ok();
+    let container_runtime =
+        std::env::var("CONTAINER_RUNTIME").unwrap_or_else(|_| "docker".to_string());
+    let sandbox_max_iterations = std::env::var("SANDBOX_MAX_ITERATIONS")

@@ -0,0 +83,4 @@
+        max_iterations: config.sandbox_max_iterations,
+    };
+
+    if !sandbox.runtime.available().await {

@@ -0,0 +44,4 @@
+
+    for iteration in 1..=max_iterations {
+        let response = open_router
+            .chat_with_tools(messages.clone(), tool_definitions.clone())

@@ -0,0 +122,4 @@
+    into_stdout(output)
+}
+
+async fn read_file(sandbox: &Sandbox, args: &Value) -> anyhow::Result<String> {

@@ -1,4 +1,4 @@
-FROM debian:trixie
+FROM rust:1.98-trixie

@@ -1,4 +0,0 @@
-target/

@@ -18,5 +17,8 @@ SENTRY_DSN=
 RUST_LOG=info
 RUST_BACKTRACE=1
 
+METRICS_BIND_ADDR=

@@ -3,13 +3,27 @@ when:
         - push
 
 steps:
+    - name: fmt

@@ -0,0 +1,22 @@
+{

@@ -5,3 +5,3 @@
 [[package]]
 name = "actix-codec"
-version = "0.5.2"
+version = "0.5.3"

@@ -2,3 +1,1 @@
-name = "herald"
-version = "1.1.0"
-edition = "2024"
+[workspace]

@@ -1,12 +1,15 @@
-FROM rust:1.96 as builder
+FROM rust:1.97-trixie as builder

@@ -38,6 +37,34 @@ Herald reads its configuration from environment variables (a `.env` file is supp
 | `METRICS_BIND_ADDR` | *(optional)* Bind address for the Prometheus metrics endpoint (e.g. `0.0.0.0:9100`). If unset, the metrics exporter is disabled. |
 | `SENTRY_DSN` | *(optional)* Sentry DSN for error tracking |
 | `RUST_LOG` | *(optional)* Log level, defaults to `info` |
+| `CONTAINER_RUNTIME` | *(optional)* Container runtime binary used for the sandbox (`docker` or `podman`). Defaults to `docker` |

@@ -0,0 +1,264 @@
+use crate::{
+    gitea::{GiteaAPI, WebhookType},

@@ -0,0 +1,863 @@
+use tracing::{info, instrument, warn};

@@ -0,0 +1,58 @@
+pub const GITEA_SIG_HEADER_NAME: &str = "x-gitea-signature";

@@ -0,0 +12,4 @@
+    pub gitea_token: String,
+    pub gitea_timeout: u64,
+    pub metrics_bind_addr: Option<String>,
+    pub container_runtime: String,

@@ -0,0 +1,441 @@
+//! Minimal OpenRouter chat-completions client.

@@ -0,0 +1,137 @@
+//! Tool-calling loop driving the model against a [`Sandbox`].

@@ -0,0 +1,195 @@
+//! Sandboxed tool execution for the AI bot.

@@ -0,0 +17,4 @@
+use anyhow::Context;
+use devcontainer_rs::{Container, ContainerRuntime, ExecOutput};
+use tempfile::TempDir;
+use tracing::{info, instrument};

@@ -0,0 +1,246 @@
+//! Tool definitions exposed to the model and their execution inside a

@@ -1,12 +1,15 @@
-FROM rust:1.96 as builder
+FROM rust:1.97-trixie as builder

@@ -38,6 +37,34 @@ Herald reads its configuration from environment variables (a `.env` file is supp
 | `METRICS_BIND_ADDR` | *(optional)* Bind address for the Prometheus metrics endpoint (e.g. `0.0.0.0:9100`). If unset, the metrics exporter is disabled. |
 | `SENTRY_DSN` | *(optional)* Sentry DSN for error tracking |
 | `RUST_LOG` | *(optional)* Log level, defaults to `info` |
+| `CONTAINER_RUNTIME` | *(optional)* Container runtime binary used for the sandbox (`docker` or `podman`). Defaults to `docker` |

@@ -0,0 +12,4 @@
+    pub gitea_token: String,
+    pub gitea_timeout: u64,
+    pub metrics_bind_addr: Option<String>,
+    pub container_runtime: String,

@@ -0,0 +1,131 @@
+use crate::{

@@ -0,0 +1,441 @@
+//! Minimal OpenRouter chat-completions client.

@@ -0,0 +1,137 @@
+//! Tool-calling loop driving the model against a [`Sandbox`].

@@ -0,0 +1,195 @@
+//! Sandboxed tool execution for the AI bot.

@@ -0,0 +1,246 @@
+//! Tool definitions exposed to the model and their execution inside a

@@ -1,214 +0,0 @@
-use futures_util::stream::TryStreamExt;

@@ -1,44 +0,0 @@
-pub const GITEA_SIG_HEADER_NAME: &str = "x-gitea-signature";

@@ -0,0 +111,4 @@
+                    .collect(),
+            ),
+            working_dir: Some(workspace_folder.clone()),
+            host_config: Some(HostConfig {

@@ -0,0 +122,4 @@
+                // est refusé (EACCES), ce qui fait échouer tous les outils de la
+                // sandbox. C'est le compromis inverse de l'alternative `:Z` sur le
+                // montage, qui re-labellise le clone et garde le confinement SELinux.
+                security_opt: Some(vec![String::from("label=disable")]),

@@ -0,0 +59,4 @@
+            .parent()
+            .ok_or_else(|| ParseError::InvalidDevContainerPath(devcontainer_path.clone()))?;
+
+        let container_file_path = base_dir.join(schema.build.dockerfile);

@@ -0,0 +72,4 @@
+            container,
+        };
+
+        sandbox.check_workspace().await?;

@@ -0,0 +78,4 @@
+    ///
+    /// La suppression du réseau et de l'image est best-effort : ils peuvent déjà être absents.
+    pub async fn remove(&self) -> Result<(), ContainerError> {
+        self.runtime.remove_container(&self.name).await?;

@@ -0,0 +122,4 @@
+                // est refusé (EACCES), ce qui fait échouer tous les outils de la
+                // sandbox. C'est le compromis inverse de l'alternative `:Z` sur le
+                // montage, qui re-labellise le clone et garde le confinement SELinux.
+                security_opt: Some(vec![String::from("label=disable")]),

@@ -0,0 +193,4 @@
+    let workspace = sandbox.workspace_folder();
+    let candidate = Path::new(workspace).join(path);
+
+    let normalized =

@@ -0,0 +37,4 @@
+            std::env::var("DOCKER_HOST").unwrap_or_else(|_| String::from(DEFAULT_ENDPOINT));
+
+        Ok(Self {
+            docker: Docker::connect_with_defaults()?,

@@ -0,0 +59,4 @@
+            .parent()
+            .ok_or_else(|| ParseError::InvalidDevContainerPath(devcontainer_path.clone()))?;
+
+        let container_file_path = base_dir.join(schema.build.dockerfile);

@@ -0,0 +216,4 @@
+    let normalized =
+        normalize(&candidate).with_context(|| format!("path `{path}` escapes the workspace"))?;
+
+    if !normalized.starts_with(workspace) {

@@ -1,4 +0,0 @@
-target/

@@ -0,0 +78,4 @@
+    ///
+    /// La suppression du réseau et de l'image est best-effort : ils peuvent déjà être absents.
+    pub async fn remove(&self) -> Result<(), ContainerError> {
+        self.runtime.remove_container(&self.name).await?;

@@ -0,0 +34,4 @@
+    /// Se connecte au daemon désigné par `DOCKER_HOST`, ou au socket local par défaut.
+    pub fn connect() -> Result<Self, ContainerError> {
+        let endpoint =
+            std::env::var("DOCKER_HOST").unwrap_or_else(|_| String::from(DEFAULT_ENDPOINT));

@@ -0,0 +108,4 @@
+            while let Some(info) = stream.next().await {
+                let info: BuildInfo = info?;
+
+                if let Some(message) = info.error_detail.and_then(|detail| detail.message) {

@@ -0,0 +22,4 @@
+pub struct DevContainerSchema {
+    #[serde(default)]
+    pub name: Option<String>,
+    pub build: DevContainerBuildSchema,

@@ -0,0 +216,4 @@
+    let normalized =
+        normalize(&candidate).with_context(|| format!("path `{path}` escapes the workspace"))?;
+
+    if !normalized.starts_with(workspace) {

@@ -0,0 +78,4 @@
+    ///
+    /// La suppression du réseau et de l'image est best-effort : ils peuvent déjà être absents.
+    pub async fn remove(&self) -> Result<(), ContainerError> {
+        self.runtime.remove_container(&self.name).await?;

@@ -0,0 +222,4 @@
+            )));
+        };
+
+        let mut stdout = String::new();

@@ -0,0 +216,4 @@
+    let normalized =
+        normalize(&candidate).with_context(|| format!("path `{path}` escapes the workspace"))?;
+
+    if !normalized.starts_with(workspace) {