feat: label pall8t containers and report the labels in ls --json

[TakiTake]

Closes #55. Stacked on #63 (which is stacked on #62) — only the last commit belongs to this PR; GitHub retargets as the stack merges.

Why

list_pall8t selected on c.name.starts_with("pall8t-"): it matched any container a user named that way, and carried no information beyond the name. pall8t ls --json emitted {name, status}, so "which sandbox serves this herdr pane?" had no answer short of parsing container names.

What

• Every pall8t run container is labelled: pall8t.version, pall8t.project, pall8t.image, pall8t.worktree.git_dir (when cwd is a worktree), and pall8t.herdr.{pane,workspace,tab,sandbox} when the run started from a herdr pane.
• pall8t ls --json reports image and labels in addition to the existing name/status — nothing already reading them breaks.
• is_pall8t_container selects on the pall8t.version label, with the name prefix kept as a fallback so containers started by an older pall8t still list through an upgrade. They are --rm foreground sessions, so the fallback can go after a release.
• The worktree probe (worktree::main_git_dir) is now done once and used by both the mount and the label, instead of spawning git twice.

One thing worth flagging

apple/container 1.2.2's Parser.labels splits on = with maxSplits: 2 and throws invalid label format on three parts. A project directory is free to contain an =, so an unsanitised pall8t.project label would fail the whole run — a launch broken by provenance metadata. Values are sanitised on the way out (= and control characters → _), pinned by label_values_cannot_break_the_run.

Verification

115 unit tests, scripts/lint.sh clean. The listing parser is tested against captured 1.2.2 JSON, including a container with no labels and someone else's labelled container.

Live on container 1.2.2 — a run under a faked herdr pane:

$ container ls --format json | jq '.[].configuration.labels'
{ "pall8t.herdr.pane": "%7", "pall8t.herdr.sandbox": "full",
  "pall8t.image": "pall8t-p8t-label-live-2b9e1e88:501-20-e016550b27ee",
  "pall8t.project": "/private/tmp/p8t-label-live", "pall8t.version": "0.4.0" }

$ pall8t ls --json   # same labels, plus a label-less container from an older run still listed

🤖 Generated with Claude Code

https://claude.ai/code/session_01YTFLvjR7dWvxFQfSyBY4Zm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 990402a0-7a0e-450b-bc6f-686ef4320c2f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}