Class DevcontainerRuntime

src/node/runtime/DevcontainerRuntime.ts:60–942

 * - ensureReady → devcontainer up (starts/rebuilds container as needed)
 */
export class DevcontainerRuntime extends LocalBaseRuntime {
  private readonly worktreeManager: WorktreeManager;
  private readonly configPath: string;

  // Cached env used for credential forwarding
  private lastCredentialEnv?: Record<string, string>;
  private readonly shareCredentials: boolean;

  // Cached container requirements (mounts + env), computed by computeContainerRequirements()
  private containerMounts: BindMount[] = [];
  private containerEnv: Record<string, string> = {};

  // Cached from devcontainer up output
  private remoteHomeDir?: string;
  private remoteWorkspaceFolder?: string;
  private remoteUser?: string;

  // Current workspace context (set during postCreateSetup/ensureReady)
  private currentWorkspacePath?: string;

  readonly createFlags: RuntimeCreateFlags = {
    deferredRuntimeAccess: true,
  };

  /**
   * Compute all mounts and env vars the container needs.
   * Called once during postCreateSetup() and ensureReady(); results cached
   * on this.containerMounts / this.containerEnv for use by exec() and getContainerEnv().
   *
   * Gitdir mount is always resolved (worktree correctness).
   * Credential env/mounts are gated behind shareCredentials.
   */
  private computeContainerRequirements(
    workspacePath: string,
    runtimeEnv?: Record<string, string>
  ): void {
    const mounts: BindMount[] = [];
    const env: Record<string, string> = {};

    // Always: bind-mount parent .git dir for worktree support.
    // Without this, git inside the container can't resolve the gitdir reference.
    const gitdirMount = resolveGitdirMount(workspacePath);
    if (gitdirMount) mounts.push(gitdirMount);

    if (this.shareCredentials) {
      // Forward host credential env (GIT_ASKPASS, GIT_SSH_COMMAND, CODER_*, git identity)
      Object.assign(env, resolveHostCredentialEnv());

      // Mount /.coder-agent/ so GIT_ASKPASS=/.coder-agent/coder resolves
      const coderMount = resolveCoderAgentMount();
      if (coderMount) mounts.push(coderMount);

      // SSH agent socket
      const ssh = resolveSshAgentForwarding("/tmp/ssh-agent.sock");
      if (ssh) {
        mounts.push({ source: ssh.hostSocketPath, target: ssh.targetSocketPath });
        env.SSH_AUTH_SOCK = ssh.targetSocketPath;
      }