@cat-factory/worker 0.174.1 → 0.176.0

package/dist/infrastructure/containers/CloudflareContainerTransport.js

@@ -1,13 +1,38 @@
 import { CONTAINER_EVICTION_ERROR, harnessDispatchError, readRunnerDispatchAck, } from '@cat-factory/kernel';
-import { isRolloutSignal } from './ExecutionContainer';
+import { isRolloutSignal } from './stopCause';
 // The human-readable message for a failed poll the transport maps to a container eviction. The
 // eviction verdict the engine acts on rides the STRUCTURED `RunnerJobView.evicted` field
-// (`crash` / `transient`) minted alongside it — the "(container evicted or crashed)" /
-// "(transient infrastructure eviction)" wording is now DESCRIPTIVE context only, no longer
-// regex-classified by any consumer (error-message coverage I5). The Cloudflare-specific
-// "rollout ⇒ transient" mapping lives here, in the facade; the engine stays runtime-neutral.
+// (`crash` / `transient`) minted alongside it. The "(container evicted or crashed)" wording and
+// the parenthetical each cause adds are DESCRIPTIVE context only, no longer regex-classified by
+// any consumer (error-message coverage I5). Which Cloudflare events count as transient churn is
+// decided HERE, in the facade; the engine stays runtime-neutral.
 const EVICTION_ERROR = CONTAINER_EVICTION_ERROR;
 const ROLLOUT_EVICTION_ERROR = `${EVICTION_ERROR} (transient infrastructure eviction)`;
+// An idle reclaim is churn too, but a DIFFERENT operator's problem from a release draining a
+// container: it says the driver stopped polling for longer than the container's idle window,
+// so the remedy is the poll scheduling, not the deploy. Both recover on the transient budget;
+// only the wording tells them apart, and a shared one would hide a recurring hiccup behind
+// "there must have been a deploy" (stuck-run audit F12).
+const IDLE_EVICTION_ERROR = `${EVICTION_ERROR} (idle container reclaimed between polls)`;
+/**
+ * Every cause a container can OBSERVE about its own reclaim is infrastructure churn, so the
+ * table maps each to its wording and the verdict is `transient` for all of them. Exhaustive by
+ * type, so a new cause cannot ship without deciding what the operator is told about it.
+ */
+const TRANSIENT_EVICTION_ERROR = {
+    rollout: ROLLOUT_EVICTION_ERROR,
+    idle: IDLE_EVICTION_ERROR,
+};
+/**
+ * The failed view for a 404 poll, given what the container itself observed about its reclaim.
+ * No observed cause ⇒ the container is simply gone with nothing to explain it, which is a
+ * `crash` (an OOM, a genuine fault) and recovers on the small budget.
+ */
+function evictionView(cause) {
+    if (!cause)
+        return { state: 'failed', error: EVICTION_ERROR, evicted: 'crash' };
+    return { state: 'failed', error: TRANSIENT_EVICTION_ERROR[cause], evicted: 'transient' };
+}
 // The default runner transport: a per-RUN Cloudflare Container. One Durable Object
 // instance per run id (`ref.runId`) hosts that run's whole sequence of step jobs; the
 // base Container.fetch proxies to the Pi harness inside it, which keys each job by the
@@ -46,7 +71,7 @@ export class CloudflareContainerTransport {
     constructor(
     // Either per-run container class: `ExecutionContainer` (the agent harness, bound as
     // `EXEC_CONTAINER`) or `DeployContainer` (the deploy harness, bound as `DEPLOY_CONTAINER`).
-    // Both expose the same `/jobs` HTTP contract on 8080 plus `recentlyRolledOut`/`shutdown`,
+    // Both expose the same `/jobs` HTTP contract on 8080 plus `recentEvictionCause`/`shutdown`,
     // so this transport drives either unchanged — a deploy-dedicated instance simply gets the
     // deploy namespace.
     namespace, 
@@ -106,6 +131,23 @@ export class CloudflareContainerTransport {
         // write so a malformed/absent body can never cost the reaper its record of a live container.
         return readRunnerDispatchAck(await safeJson(res));
     }
+    /**
+     * The failed view for a container that has gone away, spending whatever the container recorded
+     * about its own reclaim.
+     *
+     * BOTH eviction paths funnel through here, including the one that already knows the cause from
+     * the thrown rollout signal, because the claim is not only how the cause is read: it is how a
+     * record is marked spent. A path that reported an eviction without claiming would leave the
+     * record behind to excuse a second one.
+     *
+     * Claiming is best-effort. An unreachable DO answers nothing, which reads as the crash it may
+     * well have been, and a container mid-rollout drain routinely is unreachable — so the cause the
+     * transport OBSERVED itself wins over a read that could not happen.
+     */
+    async evictionOf(stub, ref, observed) {
+        const claimed = await stub.recentEvictionCause(ref.jobId).catch(() => undefined);
+        return evictionView(observed ?? claimed);
+    }
     async poll(ref) {
         // The per-run container is the Durable Object addressed by the run id; its DO id is
         // the closest thing to a stable "container id" to surface in the run's details (a
@@ -126,9 +168,8 @@ export class CloudflareContainerTransport {
             // "new version rollout" signal (exit 143) rather than returning a 404. Report it
             // as a transient rollout eviction so the engine recovers it on the larger
             // rollout budget instead of failing the run.
-            if (isRolloutSignal(err)) {
-                return { state: 'failed', error: ROLLOUT_EVICTION_ERROR, evicted: 'transient' };
-            }
+            if (isRolloutSignal(err))
+                return this.evictionOf(stub, ref, 'rollout');
             throw err;
         }
         if (res.status === 404) {
@@ -136,13 +177,11 @@ export class CloudflareContainerTransport {
             // stops (the run-sweeper may then re-drive it from durable state). The eviction
             // verdict rides the STRUCTURED `evicted` field the caller reads directly (the
             // "(container evicted or crashed)" string is descriptive context only — no consumer
-            // regex-matches it any more, see I5). Ask the DO whether it was just drained by a
-            // new-version rollout (a deploy) — if so, tag it so the engine treats it as
-            // transient infra churn rather than a crash/OOM.
-            const rolledOut = await stub.recentlyRolledOut().catch(() => false);
-            return rolledOut
-                ? { state: 'failed', error: ROLLOUT_EVICTION_ERROR, evicted: 'transient' }
-                : { state: 'failed', error: EVICTION_ERROR, evicted: 'crash' };
+            // regex-matches it any more, see I5). Ask the DO what it observed about its own reclaim
+            // (a new-version rollout, or its idle window elapsing between polls). Either is infra
+            // churn the engine should ride out on the larger transient budget rather than spend the
+            // crash budget on.
+            return this.evictionOf(stub, ref);
         }
         if (!res.ok) {
             throw new Error(`Container job poll failed (HTTP ${res.status}): ${await safeText(res)}`);

package/dist/infrastructure/containers/CloudflareContainerTransport.js.map

@@ -1 +1 @@
-{"version":3,"file":"CloudflareContainerTransport.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/CloudflareContainerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,GAOtB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAA2B,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAG/E,+FAA+F;AAC/F,yFAAyF;AACzF,uFAAuF;AACvF,2FAA2F;AAC3F,wFAAwF;AACxF,6FAA6F;AAC7F,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAC/C,MAAM,sBAAsB,GAAG,GAAG,cAAc,sCAAsC,CAAA;AAEtF,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,oFAAoF;AACpF,2EAA2E;AAC3E,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,UAAU;AAEV,oFAAoF;AACpF,+EAA+E;AAC/E,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,iGAAiG;AACjG,6FAA6F;AAC7F,0FAA0F;AAC1F,MAAM,eAAe,GAAG,MAAM,CAAA;AAE9B,kFAAkF;AAClF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAEhD,MAAM,OAAO,4BAA4B;IAUpB,SAAS;IAIT,QAAQ;IAQR,YAAY;IArB/B,6EAA6E;IACpE,OAAO,GAAG,sBAAsB,CAAA;IAEzC;IACE,oFAAoF;IACpF,4FAA4F;IAC5F,0FAA0F;IAC1F,0FAA0F;IAC1F,oBAAoB;IACH,SAE0B;IAC3C,kFAAkF;IACjE,QAAoC;IACrD;;;;;;OAMG;IACc,YAAqB;yBAZrB,SAAS;wBAIT,QAAQ;4BAQR,YAAY;IAC5B,CAAC;IAEJ,oFAAoF;IAC5E,YAAY;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,CAAC;IAED,2EAA2E;IAC3E,kFAAkF;IAClF,+EAA+E;IAC/E,mFAAmF;IACnF,mFAAmF;IACnF,yDAAyD;IACzD,KAAK,CAAC,QAAQ,CACZ,GAAiB,EACjB,IAA6B,EAC7B,IAAI,GAAuB,OAAO;QAElC,mFAAmF;QACnF,mFAAmF;QACnF,4EAA4E;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,iFAAiF;QACjF,mFAAmF;QACnF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE;YACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,wFAAwF;YACxF,0FAA0F;YAC1F,wFAAwF;YACxF,MAAM,oBAAoB,CAAC;gBACzB,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,kFAAkF;QAClF,kFAAkF;QAClF,+EAA+E;QAC/E,oDAAoD;QACpD,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC9C,wFAAwF;QACxF,6FAA6F;QAC7F,OAAO,qBAAqB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,oFAAoF;QACpF,kFAAkF;QAClF,uFAAuF;QACvF,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC/E,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,iFAAiF;YACjF,0EAA0E;YAC1E,6CAA6C;YAC7C,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;YACjF,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,2EAA2E;YAC3E,gFAAgF;YAChF,8EAA8E;YAC9E,oFAAoF;YACpF,kFAAkF;YAClF,4EAA4E;YAC5E,iDAAiD;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;YACnE,OAAO,SAAS;gBACd,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,WAAW,EAAE;gBAC1E,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,oFAAoF;QACpF,sFAAsF;QACtF,8DAA8D;QAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;QAChD,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,+EAA+E;QAC/E,wEAAwE;QACxE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,yEAAyE;YACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtC,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;gBACrF,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAA;YACF,4FAA4F;YAC5F,2FAA2F;YAC3F,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAoC,CAAA;gBACrE,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;YACjD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2FAA2F;YAC3F,sEAAsE;YACtE,IAAI,eAAe,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;QAC9C,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;CACF;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAA;IACpB,CAAC;AACH,CAAC"}
+{"version":3,"file":"CloudflareContainerTransport.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/CloudflareContainerTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,GAOtB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAA2B,eAAe,EAAE,MAAM,aAAa,CAAA;AAGtE,+FAA+F;AAC/F,yFAAyF;AACzF,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,iEAAiE;AACjE,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAC/C,MAAM,sBAAsB,GAAG,GAAG,cAAc,sCAAsC,CAAA;AACtF,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,2FAA2F;AAC3F,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,GAAG,cAAc,2CAA2C,CAAA;AAExF;;;;GAIG;AACH,MAAM,wBAAwB,GAAuC;IACnE,OAAO,EAAE,sBAAsB;IAC/B,IAAI,EAAE,mBAAmB;CAC1B,CAAA;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAqC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;IAC/E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,wBAAwB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;AAC1F,CAAC;AAED,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,sFAAsF;AACtF,oFAAoF;AACpF,2EAA2E;AAC3E,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,UAAU;AAEV,oFAAoF;AACpF,+EAA+E;AAC/E,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,iGAAiG;AACjG,6FAA6F;AAC7F,0FAA0F;AAC1F,MAAM,eAAe,GAAG,MAAM,CAAA;AAE9B,kFAAkF;AAClF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAEhD,MAAM,OAAO,4BAA4B;IAUpB,SAAS;IAIT,QAAQ;IAQR,YAAY;IArB/B,6EAA6E;IACpE,OAAO,GAAG,sBAAsB,CAAA;IAEzC;IACE,oFAAoF;IACpF,4FAA4F;IAC5F,4FAA4F;IAC5F,0FAA0F;IAC1F,oBAAoB;IACH,SAE0B;IAC3C,kFAAkF;IACjE,QAAoC;IACrD;;;;;;OAMG;IACc,YAAqB;yBAZrB,SAAS;wBAIT,QAAQ;4BAQR,YAAY;IAC5B,CAAC;IAEJ,oFAAoF;IAC5E,YAAY;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,CAAC;IAED,2EAA2E;IAC3E,kFAAkF;IAClF,+EAA+E;IAC/E,mFAAmF;IACnF,mFAAmF;IACnF,yDAAyD;IACzD,KAAK,CAAC,QAAQ,CACZ,GAAiB,EACjB,IAA6B,EAC7B,IAAI,GAAuB,OAAO;QAElC,mFAAmF;QACnF,mFAAmF;QACnF,4EAA4E;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,iFAAiF;QACjF,mFAAmF;QACnF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE;YACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,wFAAwF;YACxF,0FAA0F;YAC1F,wFAAwF;YACxF,MAAM,oBAAoB,CAAC;gBACzB,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,kFAAkF;QAClF,kFAAkF;QAClF,+EAA+E;QAC/E,oDAAoD;QACpD,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC9C,wFAAwF;QACxF,6FAA6F;QAC7F,OAAO,qBAAqB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,UAAU,CACtB,IAAyF,EACzF,GAAiB,EACjB,QAA6B;QAE7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAChF,OAAO,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,oFAAoF;QACpF,kFAAkF;QAClF,uFAAuF;QACvF,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC/E,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,iFAAiF;YACjF,0EAA0E;YAC1E,6CAA6C;YAC7C,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;YACtE,MAAM,GAAG,CAAA;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,2EAA2E;YAC3E,gFAAgF;YAChF,8EAA8E;YAC9E,oFAAoF;YACpF,wFAAwF;YACxF,sFAAsF;YACtF,wFAAwF;YACxF,mBAAmB;YACnB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,oFAAoF;QACpF,sFAAsF;QACtF,8DAA8D;QAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;QAChD,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,+EAA+E;QAC/E,wEAAwE;QACxE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,yEAAyE;YACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtC,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,GAAiB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;gBACrF,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAA;YACF,4FAA4F;YAC5F,2FAA2F;YAC3F,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAoC,CAAA;gBACrE,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;YACjD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2FAA2F;YAC3F,sEAAsE;YACtE,IAAI,eAAe,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;QAC9C,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;CACF;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAA;IACpB,CAAC;AACH,CAAC"}

package/dist/infrastructure/containers/DeployContainer.d.ts

@@ -1,22 +1,4 @@
-import { Container } from '@cloudflare/containers';
-import type { StopParams } from '@cloudflare/containers';
-import type { Env } from '../env';
-export declare class DeployContainer extends Container<Env> {
-    defaultPort: number;
-    envVars: Record<string, string>;
-    sleepAfter: string;
-    /**
-     * Record that THIS run's deploy container was drained by a new-version rollout (exit 143)
-     * rather than crashing, so the transport's next 404 poll classifies it as a transient
-     * rollout eviction (recovered on the larger budget) instead of a crash. Mirrors
-     * {@link ExecutionContainer.onError}.
-     */
-    onError(error: unknown): Promise<unknown>;
-    /** Belt-and-braces rollout capture via `onStop` (see {@link ExecutionContainer.onStop}). */
-    onStop(params: StopParams): void;
-    /** Whether this run's deploy container was rolled out within the attribution window. */
-    recentlyRolledOut(): Promise<boolean>;
-    /** Reclaim this container now (SIGKILL via the base class) rather than idling out. */
-    shutdown(): Promise<void>;
+import { RunContainer } from './RunContainer';
+export declare class DeployContainer extends RunContainer {
 }
 //# sourceMappingURL=DeployContainer.d.ts.map

package/dist/infrastructure/containers/DeployContainer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeployContainer.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/DeployContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAqBjC,qBAAa,eAAgB,SAAQ,SAAS,CAAC,GAAG,CAAC;IAExC,WAAW,SAAO;IAGlB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAElC;IAIG,UAAU,SAAQ;IAE3B;;;;;OAKG;IACY,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAKvD;IAED,4FAA4F;IACnF,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxC;IAED,wFAAwF;IAClF,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG1C;IAED,sFAAsF;IAChF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAM9B;CACF"}
+{"version":3,"file":"DeployContainer.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/DeployContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAW7C,qBAAa,eAAgB,SAAQ,YAAY;CAAG"}

package/dist/infrastructure/containers/DeployContainer.js

@@ -1,62 +1,13 @@
-import { Container } from '@cloudflare/containers';
-// Share the rollout-attribution machinery with ExecutionContainer so the storage key + window
-// can't drift between the two per-run container classes.
-import { isRolloutSignal, ROLLED_OUT_AT_KEY, ROLLOUT_ATTRIBUTION_WINDOW_MS, } from './ExecutionContainer';
+import { RunContainer } from './RunContainer';
 // One DEPLOY container per run (addressed by the run id), mirroring {@link ExecutionContainer}
 // but pulling the SEPARATE deploy-harness image (slim base + real `kubectl`/`kustomize`/`helm`)
-// instead of the executor-harness. A Cloudflare Container's image is pinned per container class
-// by the wrangler `[[containers]]` block, so the `image: 'deploy'` dispatch variant needs its own
-// class — this one — bound as `DEPLOY_CONTAINER`. The transport routes a deploy job here while
-// agent jobs stay on `EXEC_CONTAINER`, so the k8s CLIs never bloat an agent run's cold-start.
+// instead of the executor-harness: a Cloudflare Container's image is pinned per container
+// class, so the `image: 'deploy'` dispatch variant needs its own class. This one is bound as
+// `DEPLOY_CONTAINER`, so the k8s CLIs never bloat an agent run's cold start.
 //
 // The deploy harness serves the SAME `POST /jobs` + `GET /jobs/{id}` contract on 8080, so the
-// generic `CloudflareContainerTransport` drives it unchanged (it just gets this namespace). As
-// with the executor container, no long-lived secrets are configured: the per-job apiserver +
-// git tokens arrive in the `/jobs` request body and the optional inbound-auth shared secret is
-// the only class-level env var.
-export class DeployContainer extends Container {
-    // The deploy-harness HTTP server port (matches its Dockerfile EXPOSE/ENTRYPOINT).
-    defaultPort = 8080;
-    // Hand the inbound-auth shared secret to the harness when configured (it then rejects any
-    // /jobs call without the matching `x-harness-secret` header the transport sends).
-    envVars = this.env.HARNESS_SHARED_SECRET
-        ? { HARNESS_SHARED_SECRET: this.env.HARNESS_SHARED_SECRET }
-        : {};
-    // A deploy is dispatched then polled every ~15s while it renders + applies + waits on
-    // rollout, so the instance stays warm for the job's duration; the idle window only elapses
-    // once polling stops (the job finished).
-    sleepAfter = '10m';
-    /**
-     * Record that THIS run's deploy container was drained by a new-version rollout (exit 143)
-     * rather than crashing, so the transport's next 404 poll classifies it as a transient
-     * rollout eviction (recovered on the larger budget) instead of a crash. Mirrors
-     * {@link ExecutionContainer.onError}.
-     */
-    async onError(error) {
-        if (isRolloutSignal(error)) {
-            await this.ctx.storage.put(ROLLED_OUT_AT_KEY, Date.now());
-        }
-        return super.onError(error);
-    }
-    /** Belt-and-braces rollout capture via `onStop` (see {@link ExecutionContainer.onStop}). */
-    onStop(params) {
-        if (params.reason === 'runtime_signal' && params.exitCode === 143) {
-            void this.ctx.storage.put(ROLLED_OUT_AT_KEY, Date.now());
-        }
-    }
-    /** Whether this run's deploy container was rolled out within the attribution window. */
-    async recentlyRolledOut() {
-        const at = await this.ctx.storage.get(ROLLED_OUT_AT_KEY);
-        return typeof at === 'number' && Date.now() - at <= ROLLOUT_ATTRIBUTION_WINDOW_MS;
-    }
-    /** Reclaim this container now (SIGKILL via the base class) rather than idling out. */
-    async shutdown() {
-        try {
-            await this.destroy();
-        }
-        catch {
-            // Already gone / not running — nothing to reclaim.
-        }
-    }
+// generic `CloudflareContainerTransport` drives it unchanged (it just gets this namespace), and
+// its lifecycle behaviour is {@link RunContainer}'s, shared byte-for-byte with the agent one.
+export class DeployContainer extends RunContainer {
 }
 //# sourceMappingURL=DeployContainer.js.map

package/dist/infrastructure/containers/DeployContainer.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeployContainer.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/DeployContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAGlD,8FAA8F;AAC9F,yDAAyD;AACzD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAA;AAE7B,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,EAAE;AACF,8FAA8F;AAC9F,+FAA+F;AAC/F,6FAA6F;AAC7F,+FAA+F;AAC/F,gCAAgC;AAChC,MAAM,OAAO,eAAgB,SAAQ,SAAc;IACjD,kFAAkF;IACzE,WAAW,GAAG,IAAI,CAAA;IAC3B,0FAA0F;IAC1F,kFAAkF;IACzE,OAAO,GAA2B,IAAI,CAAC,GAAG,CAAC,qBAAqB;QACvE,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE;QAC3D,CAAC,CAAC,EAAE,CAAA;IACN,sFAAsF;IACtF,2FAA2F;IAC3F,yCAAyC;IAChC,UAAU,GAAG,KAAK,CAAA;IAE3B;;;;;OAKG;IACM,KAAK,CAAC,OAAO,CAAC,KAAc;QACnC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED,4FAA4F;IACnF,MAAM,CAAC,MAAkB;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAClE,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,iBAAiB;QACrB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAS,iBAAiB,CAAC,CAAA;QAChE,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,6BAA6B,CAAA;IACnF,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"DeployContainer.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/DeployContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,+FAA+F;AAC/F,gGAAgG;AAChG,0FAA0F;AAC1F,6FAA6F;AAC7F,6EAA6E;AAC7E,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,8FAA8F;AAC9F,MAAM,OAAO,eAAgB,SAAQ,YAAY;CAAG"}

package/dist/infrastructure/containers/ExecutionContainer.d.ts

@@ -1,53 +1,4 @@
-import { Container } from '@cloudflare/containers';
-import type { StopParams } from '@cloudflare/containers';
-import type { Env } from '../env';
-/** DO-storage key recording when a new-version rollout last drained this container. */
-export declare const ROLLED_OUT_AT_KEY = "rolledOutAt";
-/** How long after a rollout a 404 poll is still attributed to it (ms). */
-export declare const ROLLOUT_ATTRIBUTION_WINDOW_MS = 120000;
-/**
- * Whether a container error/stop is the runtime's *new-version rollout* signal — a
- * deploy draining the old container (exit 143) — rather than a crash/OOM. The
- * @cloudflare/containers base class surfaces this through `onError` with the wording
- * "...new version rollout: 143" (which its own exit-code parser, keyed on the plain
- * "runtime signalled the container to exit:" form, does not recognise).
- */
-export declare function isRolloutSignal(error: unknown): boolean;
-export declare class ExecutionContainer extends Container<Env> {
-    defaultPort: number;
-    envVars: Record<string, string>;
-    sleepAfter: string;
-    /**
-     * Record that THIS run's container was drained by a new-version rollout (a deploy,
-     * exit 143) rather than crashing. The transport's next job poll — which 404s once
-     * the container restarts empty — reads this via {@link recentlyRolledOut} to
-     * classify the eviction as a transient rollout, so the engine recovers it on the
-     * larger rollout budget instead of failing the run as a crash. Persisted to DO
-     * storage (not in-memory) so it survives a DO isolate reset that a combined
-     * worker+container deploy would cause.
-     */
-    onError(error: unknown): Promise<unknown>;
-    /**
-     * Belt-and-braces: depending on the runtime version, a rollout drain can surface
-     * as a `runtime_signal` stop with SIGTERM (143) through `onStop` instead of (or as
-     * well as) `onError`. Record it the same way.
-     */
-    onStop(params: StopParams): void;
-    /**
-     * Whether this run's container was drained by a new-version rollout within the
-     * last {@link ROLLOUT_ATTRIBUTION_WINDOW_MS}. Called over RPC by the transport
-     * after a job poll 404s, to tell a transient rollout eviction apart from a
-     * crash/OOM. Time-bounded so a stale flag from an earlier rollout in this run
-     * can't misclassify a later genuine crash.
-     */
-    recentlyRolledOut(): Promise<boolean>;
-    /**
-     * Reclaim this container now (SIGKILL via the base class), rather than waiting
-     * for the `sleepAfter` idle timer. Called over RPC when a run faults so a leaked
-     * instance isn't billed while idle. Best-effort and idempotent: destroying an
-     * already-stopped container is a no-op, and we swallow any error so the caller's
-     * failure handling is never derailed by cleanup.
-     */
-    shutdown(): Promise<void>;
+import { RunContainer } from './RunContainer';
+export declare class ExecutionContainer extends RunContainer {
 }
 //# sourceMappingURL=ExecutionContainer.d.ts.map

package/dist/infrastructure/containers/ExecutionContainer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ExecutionContainer.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/ExecutionContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAC9C,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,SAAU,CAAA;AAEpD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIvD;AAaD,qBAAa,kBAAmB,SAAQ,SAAS,CAAC,GAAG,CAAC;IAE3C,WAAW,SAAO;IAIlB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAElC;IAMG,UAAU,SAAQ;IAE3B;;;;;;;;OAQG;IACY,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAMvD;IAED;;;;OAIG;IACM,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxC;IAED;;;;;;OAMG;IACG,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG1C;IAED;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAM9B;CACF"}
+{"version":3,"file":"ExecutionContainer.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/ExecutionContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAU7C,qBAAa,kBAAmB,SAAQ,YAAY;CAAG"}

package/dist/infrastructure/containers/ExecutionContainer.js

@@ -1,96 +1,12 @@
-import { Container } from '@cloudflare/containers';
-/** DO-storage key recording when a new-version rollout last drained this container. */
-export const ROLLED_OUT_AT_KEY = 'rolledOutAt';
-/** How long after a rollout a 404 poll is still attributed to it (ms). */
-export const ROLLOUT_ATTRIBUTION_WINDOW_MS = 120_000;
-/**
- * Whether a container error/stop is the runtime's *new-version rollout* signal — a
- * deploy draining the old container (exit 143) — rather than a crash/OOM. The
- * @cloudflare/containers base class surfaces this through `onError` with the wording
- * "...new version rollout: 143" (which its own exit-code parser, keyed on the plain
- * "runtime signalled the container to exit:" form, does not recognise).
- */
-export function isRolloutSignal(error) {
-    const message = error instanceof Error ? error.message : typeof error === 'string' ? error : String(error);
-    return /new version rollout|runtime signalled the container to exit/i.test(message);
-}
-// One container instance per run: Cloudflare Containers map a Durable Object id
-// to a dedicated container, so addressing `env.EXEC_CONTAINER.get(<executionId>)`
-// gives each execution its own ephemeral sandbox. The container runs the Pi
-// coding-agent harness (see @cat-factory/executor-harness) listening on 8080;
-// the base `Container.fetch` proxies inbound requests there once it has booted.
+import { RunContainer } from './RunContainer';
+// One container instance per run: Cloudflare Containers map a Durable Object id to a dedicated
+// container, so addressing `env.EXEC_CONTAINER.get(<executionId>)` gives each execution its own
+// ephemeral sandbox running the Pi coding-agent harness (see @cat-factory/executor-harness).
 //
-// No long-lived secrets are configured here: the image carries none, and the per-job
-// GitHub token + LLM session token are passed in the `/run` request body at dispatch
-// time, never via image build args or class-level env vars. The one exception is the
-// optional `HARNESS_SHARED_SECRET` below — an inbound-auth shared secret (not a tenant
-// credential), passed so the harness can require it on the Worker → harness calls.
-export class ExecutionContainer extends Container {
-    // The harness HTTP server port (matches the Dockerfile ENTRYPOINT).
-    defaultPort = 8080;
-    // When configured, hand the inbound-auth shared secret to the harness so it rejects
-    // any /jobs call that doesn't present the matching `x-harness-secret` header (which
-    // the transport sends). Omitted when unset, leaving the harness open as before.
-    envVars = this.env.HARNESS_SHARED_SECRET
-        ? { HARNESS_SHARED_SECRET: this.env.HARNESS_SHARED_SECRET }
-        : {};
-    // A run is dispatched, then polled every ~15s while its background job runs, so
-    // the instance stays warm for the job's duration without holding a single
-    // request open. This idle window only elapses once polling stops (the job has
-    // finished); the headroom tolerates a transient gap between polls without the
-    // instance being reclaimed mid-job.
-    sleepAfter = '10m';
-    /**
-     * Record that THIS run's container was drained by a new-version rollout (a deploy,
-     * exit 143) rather than crashing. The transport's next job poll — which 404s once
-     * the container restarts empty — reads this via {@link recentlyRolledOut} to
-     * classify the eviction as a transient rollout, so the engine recovers it on the
-     * larger rollout budget instead of failing the run as a crash. Persisted to DO
-     * storage (not in-memory) so it survives a DO isolate reset that a combined
-     * worker+container deploy would cause.
-     */
-    async onError(error) {
-        if (isRolloutSignal(error)) {
-            await this.ctx.storage.put(ROLLED_OUT_AT_KEY, Date.now());
-        }
-        // Preserve the base behaviour (log + rethrow) so nothing else changes.
-        return super.onError(error);
-    }
-    /**
-     * Belt-and-braces: depending on the runtime version, a rollout drain can surface
-     * as a `runtime_signal` stop with SIGTERM (143) through `onStop` instead of (or as
-     * well as) `onError`. Record it the same way.
-     */
-    onStop(params) {
-        if (params.reason === 'runtime_signal' && params.exitCode === 143) {
-            void this.ctx.storage.put(ROLLED_OUT_AT_KEY, Date.now());
-        }
-    }
-    /**
-     * Whether this run's container was drained by a new-version rollout within the
-     * last {@link ROLLOUT_ATTRIBUTION_WINDOW_MS}. Called over RPC by the transport
-     * after a job poll 404s, to tell a transient rollout eviction apart from a
-     * crash/OOM. Time-bounded so a stale flag from an earlier rollout in this run
-     * can't misclassify a later genuine crash.
-     */
-    async recentlyRolledOut() {
-        const at = await this.ctx.storage.get(ROLLED_OUT_AT_KEY);
-        return typeof at === 'number' && Date.now() - at <= ROLLOUT_ATTRIBUTION_WINDOW_MS;
-    }
-    /**
-     * Reclaim this container now (SIGKILL via the base class), rather than waiting
-     * for the `sleepAfter` idle timer. Called over RPC when a run faults so a leaked
-     * instance isn't billed while idle. Best-effort and idempotent: destroying an
-     * already-stopped container is a no-op, and we swallow any error so the caller's
-     * failure handling is never derailed by cleanup.
-     */
-    async shutdown() {
-        try {
-            await this.destroy();
-        }
-        catch {
-            // Already gone / not running — nothing to reclaim.
-        }
-    }
+// Everything this class does (the port, the inbound-auth secret, the idle window, the
+// reclaim-cause bookkeeping, `shutdown`) is {@link RunContainer}'s. The class exists
+// because a Cloudflare Container's image is pinned per container CLASS by the wrangler
+// `[[containers]]` block: this one is bound as `EXEC_CONTAINER` and carries the executor image.
+export class ExecutionContainer extends RunContainer {
 }
 //# sourceMappingURL=ExecutionContainer.js.map

package/dist/infrastructure/containers/ExecutionContainer.js.map

@@ -1 +1 @@
-{"version":3,"file":"ExecutionContainer.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/ExecutionContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAIlD,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAC9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,OAAO,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5F,OAAO,8DAA8D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACrF,CAAC;AAED,gFAAgF;AAChF,kFAAkF;AAClF,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,mFAAmF;AACnF,MAAM,OAAO,kBAAmB,SAAQ,SAAc;IACpD,oEAAoE;IAC3D,WAAW,GAAG,IAAI,CAAA;IAC3B,oFAAoF;IACpF,oFAAoF;IACpF,gFAAgF;IACvE,OAAO,GAA2B,IAAI,CAAC,GAAG,CAAC,qBAAqB;QACvE,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE;QAC3D,CAAC,CAAC,EAAE,CAAA;IACN,gFAAgF;IAChF,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,oCAAoC;IAC3B,UAAU,GAAG,KAAK,CAAA;IAE3B;;;;;;;;OAQG;IACM,KAAK,CAAC,OAAO,CAAC,KAAc;QACnC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,uEAAuE;QACvE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED;;;;OAIG;IACM,MAAM,CAAC,MAAkB;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAClE,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAS,iBAAiB,CAAC,CAAA;QAChE,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,6BAA6B,CAAA;IACnF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"ExecutionContainer.js","sourceRoot":"","sources":["../../../src/infrastructure/containers/ExecutionContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,+FAA+F;AAC/F,gGAAgG;AAChG,6FAA6F;AAC7F,EAAE;AACF,sFAAsF;AACtF,qFAAqF;AACrF,uFAAuF;AACvF,gGAAgG;AAChG,MAAM,OAAO,kBAAmB,SAAQ,YAAY;CAAG"}

package/dist/infrastructure/containers/RunContainer.d.ts

@@ -0,0 +1,98 @@
+import { Container } from '@cloudflare/containers';
+import type { StopParams } from '@cloudflare/containers';
+import type { Env } from '../env';
+import { type ContainerStopCause } from './stopCause';
+/**
+ * The behaviour every per-run Cloudflare Container shares: one Durable Object instance per run
+ * id hosts that run's sequence of jobs, the harness listens on 8080, and the base
+ * `Container.fetch` proxies inbound requests there once it has booted.
+ *
+ * The two concrete classes ({@link import('./ExecutionContainer').ExecutionContainer} and
+ * {@link import('./DeployContainer').DeployContainer}) exist only because a Cloudflare
+ * Container's IMAGE is pinned per container class by the wrangler `[[containers]]` block. They
+ * are two bindings onto one behaviour, which is why that behaviour lives here rather than being
+ * kept in step by hand across both.
+ *
+ * No long-lived secrets are configured: the image carries none, and every per-job credential
+ * (the VCS token, the LLM session token, an apiserver token) arrives in the `/jobs` request
+ * body at dispatch time. The one exception is `HARNESS_SHARED_SECRET` below, an inbound-auth
+ * shared secret rather than a tenant credential.
+ */
+export declare abstract class RunContainer extends Container<Env> {
+    /** The harness HTTP server port (matches each image's Dockerfile ENTRYPOINT/EXPOSE). */
+    defaultPort: number;
+    envVars: Record<string, string>;
+    sleepAfter: string;
+    /**
+     * Record that THIS run's container was drained by a new-version rollout (a deploy, exit 143)
+     * rather than crashing. The transport's next job poll (which 404s once the container restarts
+     * empty) reads this back through {@link recentEvictionCause}, so the engine
+     * recovers it on the larger transient budget instead of failing the run as a crash.
+     * Persisted to DO storage (not in-memory) so it survives the isolate reset a combined
+     * worker+container deploy causes.
+     */
+    onError(error: unknown): Promise<unknown>;
+    /**
+     * Belt-and-braces: depending on the runtime version, a rollout drain can surface as a
+     * `runtime_signal` stop with SIGTERM (143) through `onStop` instead of (or as well as)
+     * `onError`. Record it the same way.
+     */
+    onStop(params: StopParams): void;
+    /**
+     * The idle window elapsed. Record it as the reclaim cause it is, then reclaim as the base
+     * class would.
+     *
+     * This container is kept warm ONLY by the driver's job polls, so an idle expiry with a job
+     * still outstanding means the backend stopped polling for longer than `sleepAfter`: a
+     * poll-scheduling hiccup, not the workload dying. Unrecorded, the resulting 404 poll is
+     * indistinguishable from an OOM: it spends the single crash-eviction budget, and a second
+     * hiccup in the same step then fails a healthy run (stuck-run audit F12).
+     *
+     * This hook cannot tell that case from the ROUTINE one (the run parked on a human decision and
+     * nothing is running), because only the harness knows whether a job is still live and asking
+     * it would itself be activity. So the marker is minted for both, and what keeps that honest is
+     * the boundary in {@link fetch}: the routine marker is dropped by the next dispatch, so it
+     * cannot still be lying around to excuse the following step's crash.
+     *
+     * Nothing is recorded when the container is already gone: the base class stops nothing in
+     * that case, so a marker would be attributing a reclaim that never happened.
+     */
+    onActivityExpired(): Promise<void>;
+    /**
+     * Proxy an inbound harness call, and take a JOB ACCEPTANCE as the end of whatever this
+     * container previously observed about itself.
+     *
+     * A stop cause explains the death of a container that was serving the jobs outstanding when it
+     * was recorded. `POST /jobs` answering 2xx says a new job starts here, so nothing recorded
+     * before it can account for that job's death. Without the boundary the routine case poisons
+     * the rare one: a run parks on a human decision, its container idles out with nothing running,
+     * and the `idle` marker that leaves behind is still inside its (deliberately wide) window to
+     * excuse a genuine OOM in the NEXT step as transient churn.
+     *
+     * It has to be the acceptance rather than the container starting: a 404 poll BOOTS the
+     * container on its way to discovering the job is gone, so clearing on start would drop the
+     * record moments before the read that exists to consume it.
+     */
+    fetch(request: Request): Promise<Response>;
+    /**
+     * Why this run's container went away, for the transport to read over RPC after `jobId`'s poll
+     * 404s: the one thing that tells a reclaim apart from a crash. `undefined` means no reclaim
+     * this container observed explains that 404, so the caller reports a crash.
+     *
+     * Claimed by the polling job rather than deleted, so a retried durable poll step re-reads the
+     * same answer while a different job still finds it spent. See {@link takeStopCause}.
+     */
+    recentEvictionCause(jobId: string): Promise<ContainerStopCause | undefined>;
+    /**
+     * Reclaim this container now (SIGKILL via the base class), rather than waiting for the
+     * `sleepAfter` idle timer. Called over RPC when a run settles or faults, so a leaked instance
+     * isn't billed while idle. Best-effort and idempotent: destroying an already-stopped
+     * container is a no-op, and we swallow any error so the caller's failure handling is never
+     * derailed by cleanup.
+     */
+    shutdown(): Promise<void>;
+    private record;
+    /** The DO storage, narrowed to what the stop-cause bookkeeping uses. */
+    private get storage();
+}
+//# sourceMappingURL=RunContainer.d.ts.map

package/dist/infrastructure/containers/RunContainer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunContainer.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/containers/RunContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,OAAO,EAEL,KAAK,kBAAkB,EAKxB,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,YAAa,SAAQ,SAAS,CAAC,GAAG,CAAC;IACvD,wFAAwF;IAC/E,WAAW,SAAO;IAKlB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAElC;IAMG,UAAU,SAAQ;IAE3B;;;;;;;OAOG;IACY,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAIvD;IAED;;;;OAIG;IACM,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIxC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACY,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGhD;IAED;;;;;;;;;;;;;;OAcG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWxD;IAED;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAEhF;IAED;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAO9B;IAED,OAAO,CAAC,MAAM;IAId,wEAAwE;IACxE,OAAO,KAAK,OAAO,GAElB;CACF"}