- ExecSessionManager::get_target replaces get_container_id, so image paste,
file drop and the audio bridge reuse the session's own target instead of
rebuilding a Docker one; the web terminal builds its target per project.
- Drop the error-prefix rewriting helper: download/backup/run-now errors now
carry the host layer's own message after their prefix.
- Remove the now-unused create_attached_exec and MAX_ONESHOT_OUTPUT re-export.
- The boundary test's allowlist is down to migration (Docker-only) and
container_watch (phase 1b). CLAUDE.md documents the host layer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase 1a of the AWS host work: these files no longer name bollard or
docker::exec; every exec, upload and is-running check goes through
host::ContainerTarget. No behaviour change: same user, working dir, env,
tty and stdin attachment for every exec.
- auth_bridge: the poller, reconcile and PortForward hold a ContainerTarget
(AuthBridgeManager::start keeps its container_id signature).
tunnel_connection_with_prelude keeps its String signature for the
browser-view proxy and wraps the new tunnel_into_with_prelude.
- browser_view: the supervisor and viewer helpers take a ContainerTarget;
detect::detect_in is the target-taking form of detect; install.rs's
run_step uses ContainerTarget::attach with an ExecSpec equal to the old
create_attached_exec_as call. page.rs builds the target at each exec.
- terminal_commands: open_terminal_session uses ContainerTarget::for_project;
session-derived calls build ContainerTarget::docker from the session's id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
file_commands.rs and inspect_commands.rs no longer name bollard,
docker::exec or get_docker. The archive read, running checks, attached
download/backup execs, one-shot execs, uploads and the detached
scheduler run all go through ContainerTarget, with each exec's options
(user, env, no working dir, no TTY, no stdin) and user-facing error
wording preserved.
fetch_container_file and require_running keep their container-id
signatures because file_viewer_commands.rs calls them with an id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
setup-token, the viewer's poll/probe execs, the marketplace sync and the
container gh login now reach the container via host::ContainerTarget
instead of docker::exec / is_container_running. No behaviour change: same
user, working dir, env, tty and stdin attachment for every exec.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase 1 of the AWS host work (docs/superpowers/specs/2026-11-13-aws-ecs-host-design.md).
- host::ContainerTarget (one Docker variant today) wraps every
container-interior operation: one-shot/attached/detached execs, resize,
exit status, uploads, archive download, is_running. It delegates to
docker/exec.rs with no behaviour change.
- AttachedExec now yields host-neutral ExecChunk instead of bollard's
LogOutput; docker/exec.rs converts at the boundary.
- ExecSessionManager moves to host::sessions and holds a ContainerTarget.
- A boundary test lists the files that still reach into containers through
bollard / docker::exec directly; follow-up commits empty it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5