@agent-vm/agent-vm 0.0.87 → 0.0.88

package/dist/cli/build-command.js

@@ -2,9 +2,10 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { buildImageAssetFileNames, hasBuiltImageAssets, } from '@agent-vm/gondolin-adapter';
 import { z } from 'zod';
-import { buildDockerImage as buildDockerImageDefault } from '../build/docker-image-builder.js';
+import { buildDockerImage as buildDockerImageDefault, resolveDockerRootfsIdentity as resolveDockerRootfsIdentityDefault, } from '../build/docker-image-builder.js';
 import { buildGondolinImage as buildGondolinImageDefault, computeFingerprintFromConfigPath, } from '../build/gondolin-image-builder.js';
 import { generateManagedDockerfile as generateManagedDockerfileDefault, resolveManagedImageRelease as resolveManagedImageReleaseDefault, } from '../build/managed-image-dockerfile.js';
+import { writePreparedGondolinImage } from '../build/prepared-gondolin-image-cache.js';
 import { deleteStaleImageDirectories as deleteStaleImageDirectoriesDefault, findPrunableImageDirectories as findPrunableImageDirectoriesDefault, } from '../build/stale-image-cleaner.js';
 import { assertGondolinZigCompatibility, resolveGondolinCompatibleZigVersion, resolveHostZigVersion, } from '../build/zig-compatibility.js';
 import { loadJsonConfigFile } from '../config/json-config-file.js';
@@ -16,6 +17,11 @@ const ociImageTagSchema = z.object({
     }),
 });
 const RETAIN_STALE_IMAGE_GENERATIONS_PER_PROFILE = 2;
+const DOCKER_BUILD_CONCURRENCY = 2;
+const GONDOLIN_BUILD_CONCURRENCY = 2;
+const BUILD_DETAIL_MAX_LENGTH = 180;
+const GONDOLIN_BUILD_SANDBOX_HELPERS_FROM_SOURCE_ENV = 'GONDOLIN_BUILD_SANDBOX_HELPERS_FROM_SOURCE';
+const TASK_OUTPUT_BUFFER_MAX_LENGTH = 4_096;
 const gatewayRuntimeRecordFileName = 'gateway-runtime.json';
 const openClawManagedPackageConfigSchema = z
     .object({
@@ -40,8 +46,42 @@ function imageTargetKey(imageTarget) {
 function imageTargetDedupeKey(options) {
     return `${path.resolve(options.buildConfigPath)}${imageTargetKeySeparator}${options.fingerprint}`;
 }
-function imageTargetFingerprintKey(options) {
-    return path.resolve(options.buildConfigPath);
+function imageTargetFingerprintInputKey(options) {
+    return `${path.resolve(options.buildConfigPath)}${imageTargetKeySeparator}${JSON.stringify(options.fingerprintInput ?? null)}`;
+}
+async function runWithConcurrency(items, concurrency, fn) {
+    let nextIndex = 0;
+    const workerCount = Math.min(concurrency, items.length);
+    const workers = Array.from({ length: workerCount }, async () => {
+        for (;;) {
+            const index = nextIndex;
+            nextIndex += 1;
+            if (index >= items.length) {
+                return;
+            }
+            const item = items[index];
+            if (item === undefined) {
+                throw new Error(`Expected build queue item at index ${index}.`);
+            }
+            // oxlint-disable-next-line no-await-in-loop -- each worker intentionally processes its own queue slot serially while workers run in parallel
+            await fn(item);
+        }
+    });
+    await Promise.all(workers);
+}
+function createRunTaskGroupFallback(runTaskStep) {
+    return async (tasks, options) => {
+        await runWithConcurrency(tasks, options.concurrency, async (task) => {
+            await runTaskStep(task.title, task.fn);
+        });
+    };
+}
+function firstGondolinTargetPlan(targetPlans) {
+    const [targetPlan] = targetPlans;
+    if (!targetPlan) {
+        throw new Error('Expected at least one Gondolin target plan.');
+    }
+    return targetPlan;
 }
 function createEmptyCurrentImageFingerprints() {
     return {
@@ -96,6 +136,16 @@ async function materializeGondolinImageAlias(options) {
     }
     return targetImagePath;
 }
+async function materializePreparedTargetImage(options) {
+    const targetImagePath = path.join(options.targetCacheDirectory, options.fingerprint);
+    if (path.resolve(options.sourceImagePath) === path.resolve(targetImagePath)) {
+        return targetImagePath;
+    }
+    if (!(await hasBuiltImageAssets(options.sourceImagePath))) {
+        return options.sourceImagePath;
+    }
+    return await materializeGondolinImageAlias(options);
+}
 async function findZoneIdsWithGatewayRuntimeRecords(systemConfig) {
     const zoneIds = [];
     for (const zone of systemConfig.zones) {
@@ -120,18 +170,29 @@ async function findZoneIdsWithGatewayRuntimeRecords(systemConfig) {
     }
     return zoneIds;
 }
-function startElapsedStatusHeartbeat(taskContext, baseStatus) {
-    taskContext?.setStatus(baseStatus);
-    if (taskContext?.interactive !== true) {
-        return () => { };
-    }
+function startElapsedStatusController(taskContext, initialStatus) {
+    let currentStatus = initialStatus;
+    const renderStatus = () => {
+        if (taskContext?.interactive === true) {
+            const elapsedSeconds = Math.max(1, Math.floor((Date.now() - startedAtMs) / 1000));
+            taskContext.setStatus(`${currentStatus} · ${elapsedSeconds}s elapsed`);
+            return;
+        }
+        taskContext?.setStatus(currentStatus);
+    };
     const startedAtMs = Date.now();
-    const heartbeatInterval = setInterval(() => {
-        const elapsedSeconds = Math.max(1, Math.floor((Date.now() - startedAtMs) / 1000));
-        taskContext.setStatus(`${baseStatus} · ${elapsedSeconds}s elapsed`);
-    }, 8_000);
-    return () => {
-        clearInterval(heartbeatInterval);
+    taskContext?.setStatus(currentStatus);
+    const heartbeatInterval = taskContext?.interactive === true ? setInterval(renderStatus, 8_000) : undefined;
+    return {
+        setBaseStatus: (status) => {
+            currentStatus = status;
+            renderStatus();
+        },
+        stop: () => {
+            if (heartbeatInterval) {
+                clearInterval(heartbeatInterval);
+            }
+        },
     };
 }
 async function resolveOciImageTagFromConfig(buildConfigPath) {
@@ -150,20 +211,31 @@ async function assertZigBuildPrerequisite(resolveRequiredZigVersion, resolveZigV
         ...(zigVersion ? { installedVersion: zigVersion } : {}),
     });
 }
+function isTruthyEnvironmentFlag(value) {
+    const normalizedValue = value?.trim().toLowerCase();
+    return (normalizedValue === '1' ||
+        normalizedValue === 'true' ||
+        normalizedValue === 'yes' ||
+        normalizedValue === 'on');
+}
+function shouldAssertZigBuildPrerequisite(env = process.env) {
+    return isTruthyEnvironmentFlag(env[GONDOLIN_BUILD_SANDBOX_HELPERS_FROM_SOURCE_ENV]);
+}
 async function assertUniqueDockerImageTags(imageTargets, resolveOciImageTag) {
     const profileByTag = new Map();
-    const tagByProfile = new Map();
+    const tagByTargetKey = new Map();
     for (const imageTarget of imageTargets) {
         // oxlint-disable-next-line no-await-in-loop -- collision errors are clearer in stable target order
         const imageTag = await resolveOciImageTag(imageTarget.buildConfigPath);
         const existingProfile = profileByTag.get(imageTag);
+        const key = imageTargetKey(imageTarget);
         if (existingProfile) {
-            throw new Error(`Docker image tag '${imageTag}' is used by both image profiles '${existingProfile}' and '${imageTarget.name}'. Give each Docker-backed image profile a unique oci.image tag.`);
+            throw new Error(`Docker image tag '${imageTag}' is used by both image profiles '${existingProfile}' and '${key}'. Give each Docker-backed image profile a unique oci.image tag.`);
         }
-        profileByTag.set(imageTag, imageTarget.name);
-        tagByProfile.set(imageTarget.name, imageTag);
+        profileByTag.set(imageTag, key);
+        tagByTargetKey.set(key, imageTag);
     }
-    return tagByProfile;
+    return tagByTargetKey;
 }
 const defaultRunTask = async (title, fn) => {
     process.stderr.write(`  ${title}...\n`);
@@ -222,46 +294,177 @@ async function resolveRequiredOpenClawPackagesForTarget(systemConfig, imageTarge
     }
     return [...requiredPackageNames].toSorted();
 }
-function formatManagedDockerfilePlan(plan) {
-    const lines = [
-        `Managed image plan: ${plan.imageTargetFamily}/${plan.imageTargetName}`,
-        `base image: ${plan.baseImage.reference}`,
-        `source: ${plan.baseImage.source}`,
-        `generated Dockerfile: ${plan.dockerfilePath}`,
+function shortenBuildDetail(detail) {
+    if (detail.length <= BUILD_DETAIL_MAX_LENGTH) {
+        return detail;
+    }
+    const prefixLength = Math.max(20, Math.floor((BUILD_DETAIL_MAX_LENGTH - 5) * 0.55));
+    const suffixLength = BUILD_DETAIL_MAX_LENGTH - prefixLength - 5;
+    return `${detail.slice(0, prefixLength)} ... ${detail.slice(-suffixLength)}`;
+}
+function packageNameFromSpec(packageSpec) {
+    const versionSeparatorIndex = packageSpec.lastIndexOf('@');
+    const unversionedSpec = versionSeparatorIndex > 0 ? packageSpec.slice(0, versionSeparatorIndex) : packageSpec;
+    return unversionedSpec.replace(/^@openclaw\//, '').replace(/^@agent-vm\//, '');
+}
+function packageVersionFromSpec(packageSpec) {
+    const versionSeparatorIndex = packageSpec.lastIndexOf('@');
+    if (versionSeparatorIndex <= 0) {
+        return undefined;
+    }
+    return packageSpec.slice(versionSeparatorIndex + 1);
+}
+function formatAgentVmPackageStatus(packages) {
+    if (packages.length === 0) {
+        return undefined;
+    }
+    const versions = [
+        ...new Set(packages
+            .map((packageEntry) => packageVersionFromSpec(packageEntry.spec))
+            .filter((version) => version !== undefined)),
     ];
-    if (plan.openClawAgentVmPluginPackage) {
-        lines.push(`agent-vm plugin: ${plan.openClawAgentVmPluginPackage.spec}`, `source: ${plan.openClawAgentVmPluginPackage.source}`);
+    return versions.length === 1 ? `agent-vm ${versions[0]}` : 'agent-vm packages';
+}
+function formatManagedPackagePlanEntry(packageEntry) {
+    return `${packageNameFromSpec(packageEntry.spec)}@${packageVersionFromSpec(packageEntry.spec) ?? 'unversioned'}[${packageEntry.source}]`;
+}
+function formatDockerBaseDetail(options) {
+    const details = [];
+    const plan = options.managedDockerfilePlan;
+    if (!plan) {
+        return shortenBuildDetail(`dockerfile ${path.basename(options.dockerfilePath)}`);
+    }
+    details.push(`base ${plan.base}:${plan.baseImage.tag}`);
+    if (options.imageTarget.source?.overlay) {
+        details.push(`overlay ${path.basename(options.imageTarget.source.overlay)}`);
+    }
+    const agentVmPackages = [
+        plan.openClawAgentVmPluginPackage,
+        plan.openClawMcpPortalPluginPackage,
+        plan.mcpPortalPackage,
+    ].filter((packageEntry) => packageEntry !== undefined);
+    const agentVmPackageStatus = formatAgentVmPackageStatus(agentVmPackages);
+    if (agentVmPackageStatus) {
+        details.push(agentVmPackageStatus);
     }
     if (plan.openClawPackages.length > 0) {
-        lines.push('OpenClaw packages:');
-        for (const packageEntry of plan.openClawPackages) {
-            lines.push(`  ${packageEntry.spec}`, `  source: ${packageEntry.source}`);
-        }
+        details.push(`packages ${plan.openClawPackages.map((packageEntry) => formatManagedPackagePlanEntry(packageEntry)).join(',')}`);
     }
     if (plan.warnings.length > 0) {
-        lines.push('warnings:');
-        for (const warning of plan.warnings) {
-            lines.push(`  ${warning.message}`);
+        details.push(`warnings ${plan.warnings.length}`);
+    }
+    return shortenBuildDetail(details.join(' | '));
+}
+function normalizeDockerOutputLine(line) {
+    const normalizedLine = line.trim();
+    if (normalizedLine.length === 0) {
+        return undefined;
+    }
+    return normalizedLine.replace(/\s+/g, ' ');
+}
+function createDockerTaskOutput(taskContext, baseDetail) {
+    if (taskContext?.interactive !== true) {
+        return undefined;
+    }
+    return {
+        write: (chunk) => {
+            const line = normalizeDockerOutputLine(String(chunk));
+            if (!line) {
+                return true;
+            }
+            const detailSuffix = baseDetail ? ` | ${baseDetail}` : '';
+            taskContext.setOutput(shortenBuildDetail(`${line}${detailSuffix}`));
+            return true;
+        },
+    };
+}
+const gondolinPhasePatterns = [
+    { pattern: /^Extracting OCI rootfs\b/, status: 'extracting OCI rootfs' },
+    {
+        pattern: /^Creating OCI export container\b/,
+        status: 'exporting OCI rootfs',
+    },
+    {
+        pattern: /^Extracting Alpine minirootfs for rootfs\b/,
+        status: 'extracting rootfs',
+    },
+    {
+        pattern: /^Extracting Alpine minirootfs for initramfs\b/,
+        status: 'extracting initramfs',
+    },
+    { pattern: /^Installing rootfs packages\b/, status: 'installing rootfs packages' },
+    { pattern: /^Installing initramfs packages\b/, status: 'installing initramfs packages' },
+    { pattern: /^Bootstrapped busybox shell\b/, status: 'bootstrapping rootfs shell' },
+    { pattern: /^Applying post-build copies\b/, status: 'applying post-build copies' },
+    { pattern: /^Running post-build command\b/, status: 'running post-build commands' },
+    { pattern: /^Syncing kernel modules\b/, status: 'copying kernel modules' },
+    { pattern: /^Creating rootfs ext4 image\b/, status: 'creating rootfs image' },
+    { pattern: /^Creating initramfs\b/, status: 'creating initramfs' },
+    { pattern: /^Rootfs image written\b/, status: 'rootfs image ready' },
+    { pattern: /^Fetching kernel\b/, status: 'fetching kernel' },
+    { pattern: /^Fetching libkrunfw-compatible kernel\b/, status: 'fetching libkrunfw kernel' },
+    { pattern: /^Copying assets to output directory\b/, status: 'copying vm assets' },
+    { pattern: /^Generating manifest\b/, status: 'generating vm manifest' },
+    { pattern: /^Build complete\b/, status: 'vm asset build complete' },
+];
+function parseGondolinPhaseStatus(line) {
+    const normalizedLine = line.trim();
+    for (const phasePattern of gondolinPhasePatterns) {
+        if (phasePattern.pattern.test(normalizedLine)) {
+            return phasePattern.status;
         }
     }
-    return lines.join('\n');
+    return undefined;
+}
+function createGondolinPhaseTaskOutput(taskContext, statusController) {
+    if (taskContext?.interactive !== true) {
+        return undefined;
+    }
+    let bufferedOutput = '';
+    return {
+        write: (chunk) => {
+            bufferedOutput += String(chunk);
+            let lineBreakIndex = bufferedOutput.indexOf('\n');
+            while (lineBreakIndex !== -1) {
+                const line = bufferedOutput.slice(0, lineBreakIndex);
+                bufferedOutput = bufferedOutput.slice(lineBreakIndex + 1);
+                const phaseStatus = parseGondolinPhaseStatus(line);
+                if (phaseStatus) {
+                    statusController.setBaseStatus(phaseStatus);
+                }
+                lineBreakIndex = bufferedOutput.indexOf('\n');
+            }
+            if (bufferedOutput.length > TASK_OUTPUT_BUFFER_MAX_LENGTH) {
+                bufferedOutput = bufferedOutput.slice(-TASK_OUTPUT_BUFFER_MAX_LENGTH);
+            }
+            return true;
+        },
+    };
 }
 export async function runBuildCommand(options, dependencies = {}) {
     const buildDockerImage = dependencies.buildDockerImage ?? buildDockerImageDefault;
+    const resolveDockerRootfsIdentity = dependencies.resolveDockerRootfsIdentity ?? resolveDockerRootfsIdentityDefault;
     const buildGondolinImage = dependencies.buildGondolinImage ?? buildGondolinImageDefault;
     const computeGondolinFingerprint = dependencies.computeGondolinFingerprint ??
-        (async (fingerprintOptions) => await computeFingerprintFromConfigPath(fingerprintOptions.buildConfigPath));
+        (async (fingerprintOptions) => fingerprintOptions.fingerprintInput === undefined
+            ? await computeFingerprintFromConfigPath(fingerprintOptions.buildConfigPath)
+            : await computeFingerprintFromConfigPath(fingerprintOptions.buildConfigPath, {
+                fingerprintInput: fingerprintOptions.fingerprintInput,
+            }));
     const deleteStaleImageDirectories = dependencies.deleteStaleImageDirectories ?? deleteStaleImageDirectoriesDefault;
     const findPrunableImageDirectories = dependencies.findPrunableImageDirectories ?? findPrunableImageDirectoriesDefault;
     const resolveOciImageTag = dependencies.resolveOciImageTag ?? resolveOciImageTagFromConfig;
     const resolveRequiredZigVersion = dependencies.resolveRequiredZigVersion ?? resolveGondolinCompatibleZigVersion;
     const resolveZigVersion = dependencies.resolveZigVersion ?? resolveHostZigVersion;
     const runTaskStep = dependencies.runTask ?? defaultRunTask;
+    const runTaskGroup = dependencies.runTaskGroup ?? createRunTaskGroupFallback(runTaskStep);
     const resolveProjectRoot = dependencies.resolveProjectRootFromDockerfile ?? resolveProjectRootFromDockerfile;
     const generateManagedDockerfile = dependencies.generateManagedDockerfile ?? generateManagedDockerfileDefault;
     const resolveManagedImageRelease = dependencies.resolveManagedImageRelease ?? resolveManagedImageReleaseDefault;
     const syncBundledOpenClawPlugin = dependencies.syncBundledOpenClawPlugin ?? syncBundledOpenClawPluginBundle;
-    await assertZigBuildPrerequisite(resolveRequiredZigVersion, resolveZigVersion);
+    if (shouldAssertZigBuildPrerequisite()) {
+        await assertZigBuildPrerequisite(resolveRequiredZigVersion, resolveZigVersion);
+    }
     const gatewayImageTargets = Object.entries(options.systemConfig.imageProfiles.gateways).map(([profileName, profile]) => ({
         buildConfigPath: profile.buildConfig,
         cacheDirectory: path.join(options.systemConfig.cacheDir, 'gateway-images', profileName),
@@ -281,15 +484,17 @@ export async function runBuildCommand(options, dependencies = {}) {
     }));
     const imageTargets = [...gatewayImageTargets, ...toolVmImageTargets];
     const dockerImageTargets = imageTargets.filter((imageTarget) => imageTarget.dockerfile !== undefined || imageTarget.source !== undefined);
-    const dockerImageTagByProfile = await assertUniqueDockerImageTags(dockerImageTargets, resolveOciImageTag);
+    const dockerImageTagByTargetKey = await assertUniqueDockerImageTags(dockerImageTargets, resolveOciImageTag);
     const managedImageRelease = dockerImageTargets.some((imageTarget) => imageTarget.source !== undefined)
         ? await resolveManagedImageRelease()
         : undefined;
-    // oxlint-disable-next-line no-await-in-loop -- image builds are intentionally sequential for stable task output and shared image tags
+    const dockerBuildPlans = [];
+    const dockerFingerprintInputByTargetKey = new Map();
+    // oxlint-disable-next-line no-await-in-loop -- Docker inputs are prepared in stable order before bounded parallel builds start
     for (const imageTarget of dockerImageTargets) {
-        const imageTag = dockerImageTagByProfile.get(imageTarget.name);
+        const imageTag = dockerImageTagByTargetKey.get(imageTargetKey(imageTarget));
         if (!imageTag) {
-            throw new Error(`Missing resolved Docker image tag for image profile '${imageTarget.name}'.`);
+            throw new Error(`Missing resolved Docker image tag for image profile '${imageTargetKey(imageTarget)}'.`);
         }
         let dockerfilePath = imageTarget.dockerfile;
         let managedDockerfilePlan;
@@ -327,48 +532,73 @@ export async function runBuildCommand(options, dependencies = {}) {
                 await syncBundledOpenClawPlugin(projectRootDirectory, imageTarget.name);
             });
         }
-        // oxlint-disable-next-line no-await-in-loop -- docker builds intentionally run one at a time to keep task output readable
-        await runTaskStep(`Docker: ${imageTarget.family}/${imageTarget.name} (${imageTag})`, async (taskContext) => {
-            if (managedDockerfilePlan) {
-                taskContext?.setOutput({ message: formatManagedDockerfilePlan(managedDockerfilePlan) });
-            }
+        dockerBuildPlans.push({
+            dockerfilePath,
+            imageTag,
+            imageTarget,
+            ...(managedDockerfilePlan ? { managedDockerfilePlan } : {}),
+        });
+    }
+    await runTaskGroup(dockerBuildPlans.map((dockerBuildPlan) => ({
+        title: `Docker: ${dockerBuildPlan.imageTarget.family}/${dockerBuildPlan.imageTarget.name} (${dockerBuildPlan.imageTag})`,
+        fn: async (taskContext) => {
+            const dockerBaseDetail = formatDockerBaseDetail({
+                dockerfilePath: dockerBuildPlan.dockerfilePath,
+                imageTarget: dockerBuildPlan.imageTarget,
+                ...(dockerBuildPlan.managedDockerfilePlan
+                    ? { managedDockerfilePlan: dockerBuildPlan.managedDockerfilePlan }
+                    : {}),
+            });
+            taskContext?.setOutput(dockerBaseDetail);
+            const dockerTaskOutput = createDockerTaskOutput(taskContext, dockerBaseDetail);
             taskContext?.setStatus('docker build');
             await buildDockerImage({
-                dockerfilePath,
-                imageTag,
-                ...(taskContext?.interactive === true && taskContext.streamPreview
-                    ? { streamPreview: taskContext.streamPreview }
-                    : {}),
+                dockerfilePath: dockerBuildPlan.dockerfilePath,
+                imageTag: dockerBuildPlan.imageTag,
+                ...(taskContext?.interactive === true ? { quiet: true } : {}),
+                ...(dockerTaskOutput ? { streamPreview: dockerTaskOutput } : {}),
+            });
+            taskContext?.setStatus('inspect layers');
+            const dockerRootfsIdentity = await resolveDockerRootfsIdentity(dockerBuildPlan.imageTag);
+            if (!dockerRootfsIdentity) {
+                throw new Error(`Docker image '${dockerBuildPlan.imageTag}' was built but its rootfs identity could not be inspected.`);
+            }
+            dockerFingerprintInputByTargetKey.set(imageTargetKey(dockerBuildPlan.imageTarget), {
+                dockerRootfsIdentity,
+                schemaVersion: 1,
             });
             taskContext?.setStatus('docker image ready');
-        });
-    }
-    const dockerBackedTargets = new Set(dockerImageTargets.map((imageTarget) => imageTargetKey(imageTarget)));
+        },
+    })), { concurrency: DOCKER_BUILD_CONCURRENCY });
     const currentFingerprints = createEmptyCurrentImageFingerprints();
     const fingerprintByInputKey = new Map();
     const targetPlans = [];
     const targetPlansByDedupeKey = new Map();
     for (const imageTarget of imageTargets) {
-        const fingerprintInputKey = imageTargetFingerprintKey({
+        const key = imageTargetKey(imageTarget);
+        const fingerprintInput = dockerFingerprintInputByTargetKey.get(key);
+        const fingerprintInputKey = imageTargetFingerprintInputKey({
             buildConfigPath: imageTarget.buildConfigPath,
+            fingerprintInput,
         });
         let fingerprint = fingerprintByInputKey.get(fingerprintInputKey);
         if (fingerprint === undefined) {
             // oxlint-disable-next-line no-await-in-loop -- fingerprint errors should identify the matching profile path
             fingerprint = await computeGondolinFingerprint({
                 buildConfigPath: imageTarget.buildConfigPath,
+                ...(fingerprintInput === undefined ? {} : { fingerprintInput }),
             });
             fingerprintByInputKey.set(fingerprintInputKey, fingerprint);
         }
-        const key = imageTargetKey(imageTarget);
         const dedupeKey = imageTargetDedupeKey({
             buildConfigPath: imageTarget.buildConfigPath,
             fingerprint,
         });
-        const shouldResetGondolinCache = options.forceRebuild === true || dockerBackedTargets.has(key);
+        const shouldResetGondolinCache = options.forceRebuild === true;
         const targetPlan = {
             dedupeKey,
             fingerprint,
+            fingerprintInput,
             imageTarget,
             key,
             sharedDedupeKey: false,
@@ -388,46 +618,66 @@ export async function runBuildCommand(options, dependencies = {}) {
         }
     }
     const builtImageByDedupeKey = new Map();
-    for (const targetPlan of targetPlans) {
-        // oxlint-disable-next-line no-await-in-loop -- gondolin cache rebuilds are intentionally sequenced per image target
-        await runTaskStep(`Gondolin: ${targetPlan.imageTarget.family}/${targetPlan.imageTarget.name}`, async (taskContext) => {
-            const existingBuild = builtImageByDedupeKey.get(targetPlan.dedupeKey);
-            if (existingBuild) {
-                await materializeGondolinImageAlias({
-                    fingerprint: existingBuild.result.fingerprint,
-                    fullReset: targetPlan.shouldResetGondolinCache,
-                    sourceImagePath: existingBuild.result.imagePath,
-                    targetCacheDirectory: targetPlan.imageTarget.cacheDirectory,
-                });
-                setCurrentImageFingerprint(currentFingerprints, targetPlan.imageTarget, existingBuild.result.fingerprint);
-                taskContext?.setStatus(`vm assets reused from ${existingBuild.imageTarget.family}/${existingBuild.imageTarget.name}`);
-                return;
-            }
-            const stopHeartbeat = startElapsedStatusHeartbeat(taskContext, targetPlan.shouldResetGondolinCache ? 'building vm assets' : 'checking vm assets');
+    const canonicalTargetPlans = [...targetPlansByDedupeKey.values()].map(firstGondolinTargetPlan);
+    const builtImageResults = [];
+    await runTaskGroup(canonicalTargetPlans.map((targetPlan) => ({
+        title: `Gondolin: ${targetPlan.imageTarget.family}/${targetPlan.imageTarget.name}`,
+        fn: async (taskContext) => {
+            const statusController = startElapsedStatusController(taskContext, targetPlan.shouldResetGondolinCache ? 'building vm assets' : 'checking vm assets');
+            const gondolinTaskOutput = createGondolinPhaseTaskOutput(taskContext, statusController);
             let result;
             try {
                 result = await buildGondolinImage({
                     buildConfigPath: targetPlan.imageTarget.buildConfigPath,
                     cacheDir: targetPlan.imageTarget.cacheDirectory,
+                    ...(targetPlan.fingerprintInput === undefined
+                        ? {}
+                        : { fingerprintInput: targetPlan.fingerprintInput }),
                     ...(targetPlan.shouldResetGondolinCache ? { fullReset: true } : {}),
-                    ...(taskContext?.interactive === true && taskContext.streamPreview
-                        ? { streamPreview: taskContext.streamPreview }
-                        : {}),
+                    ...(gondolinTaskOutput ? { streamPreview: gondolinTaskOutput } : {}),
                 });
             }
             finally {
-                stopHeartbeat();
+                statusController.stop();
             }
             if (targetPlan.sharedDedupeKey && result.fingerprint !== targetPlan.fingerprint) {
                 throw new Error(`Fingerprint mismatch for image profile '${targetPlan.key}': precomputed '${targetPlan.fingerprint}' but build returned '${result.fingerprint}'.`);
             }
-            builtImageByDedupeKey.set(targetPlan.dedupeKey, {
+            builtImageResults.push({
                 imageTarget: targetPlan.imageTarget,
                 result,
+                targetPlan,
             });
-            setCurrentImageFingerprint(currentFingerprints, targetPlan.imageTarget, result.fingerprint);
             taskContext?.setStatus(result.built ? 'vm assets ready' : 'vm assets cache hit');
+        },
+    })), { concurrency: GONDOLIN_BUILD_CONCURRENCY });
+    for (const builtImageResult of builtImageResults) {
+        builtImageByDedupeKey.set(builtImageResult.targetPlan.dedupeKey, {
+            imageTarget: builtImageResult.imageTarget,
+            result: builtImageResult.result,
+        });
+    }
+    for (const targetPlan of targetPlans) {
+        const existingBuild = builtImageByDedupeKey.get(targetPlan.dedupeKey);
+        if (!existingBuild) {
+            throw new Error(`Missing built image result for image profile '${targetPlan.key}'.`);
+        }
+        // oxlint-disable-next-line no-await-in-loop -- alias materialization is kept deterministic so duplicate-profile errors name the matching profile
+        const imagePath = await materializePreparedTargetImage({
+            fingerprint: existingBuild.result.fingerprint,
+            fullReset: targetPlan.shouldResetGondolinCache,
+            sourceImagePath: existingBuild.result.imagePath,
+            targetCacheDirectory: targetPlan.imageTarget.cacheDirectory,
+        });
+        // oxlint-disable-next-line no-await-in-loop -- prepared records are profile-local and must report the matching profile path on failure
+        await writePreparedGondolinImage({
+            buildConfigPath: targetPlan.imageTarget.buildConfigPath,
+            cacheDir: targetPlan.imageTarget.cacheDirectory,
+            fingerprint: existingBuild.result.fingerprint,
+            fingerprintInput: targetPlan.fingerprintInput,
+            imagePath,
         });
+        setCurrentImageFingerprint(currentFingerprints, targetPlan.imageTarget, existingBuild.result.fingerprint);
     }
     await runTaskStep('Cache auto-prune', async (taskContext) => {
         taskContext?.setStatus('checking old image generations');