@kitman-sh/cli 0.10.53 → 0.10.55

package/dist/{chunk-p6spvbwq.js → chunk-dgb6s5vq.js}

@@ -5,7 +5,7 @@ import {
   isObject,
   isJsonObject,
   isString
-} from "./chunk-arvwar2c.js";
+} from "./chunk-7evwar6b.js";
 import {
   pipeArguments,
   dual,
@@ -42,7 +42,7 @@ import {
   isFailure2,
   hasInterrupts,
   makeUnsafe5,
-  make17,
+  make16,
   _await,
   fail5,
   isDoneUnsafe,
@@ -154,7 +154,11 @@ import {
   encodePrettyJsonString,
   decodeJsonStringSync,
   encodeUnknownJsonStringSync
-} from "./chunk-mbctzx7e.js";
+} from "./chunk-61k67vxh.js";
+import {
+  Id,
+  secretReference
+} from "./chunk-4kssrezn.js";
 import {
   currentTimeMillis,
   SecureRandom,
@@ -217,11 +221,7 @@ import {
   installCommand,
   checkServicesFile,
   checkServices
-} from "./chunk-wh1pa2aa.js";
-import {
-  Id,
-  secretReference
-} from "./chunk-pp1p3g6e.js";
+} from "./chunk-m32wb6t0.js";
 import {
   join,
   interrupt,
@@ -257,12 +257,13 @@ import {
   writeSrtSettings2,
   srtStepArgv2,
   srtArgv2
-} from "./chunk-11p4wf6n.js";
+} from "./chunk-xgwjcq4z.js";
 import {
   writeAgentEnvironmentConfigFile2,
   readManifestSkillPaths2,
   tomlTableHeader2,
   tomlKeyPath2,
+  kitmanSkillEntry,
   SourceResolver,
   withSourceResolutionCache2,
   AgentEnvironmentMaterializationError2,
@@ -272,8 +273,8 @@ import {
   applyAgentEnvironmentMaterialization2,
   isPathWithin2,
   skillIdentity2
-} from "./chunk-7thnf14y.js";
-import"./chunk-g5bs3f6z.js";
+} from "./chunk-5y5axze6.js";
+import"./chunk-twp7aprz.js";
 import {
   sliceBytes2,
   maxLineBytes2,
@@ -281,31 +282,28 @@ import {
   decodedOption2,
   decoded2,
   readOpencode2
-} from "./chunk-x0b92bjb.js";
+} from "./chunk-vtn088tq.js";
 import {
   writeSecretRegistry,
   secretRefusalLog,
   parseSecretRefusals
-} from "./chunk-jafetf7z.js";
-import"./chunk-txwt6r25.js";
+} from "./chunk-g53wn1q8.js";
 import {
   uploadRunFile,
   programLease,
   rpcRunFiles,
   programHostsEnv,
   undeclaredHostsEnv
-} from "./chunk-jfvq7s24.js";
-import"./chunk-ctasxxz5.js";
+} from "./chunk-g7vk5tjp.js";
+import"./chunk-5j3cxsnp.js";
 import {
   nextInt
-} from "./chunk-vjmz23rs.js";
-import"./chunk-x9dhxfts.js";
+} from "./chunk-gwcqz1bj.js";
 import {
   ChildProcessSpawner,
-  make7
-} from "./chunk-3bj7sc3v.js";
-import"./chunk-1mc9vgcr.js";
-import"./chunk-z821b2gp.js";
+  make3
+} from "./chunk-mmetyep8.js";
+import"./chunk-148mjppg.js";
 
 // packages/core/src/sync-kit.ts
 import { createHash } from "crypto";
@@ -2432,20 +2430,20 @@ var requireKitCommands = (setup, runs) => gen(function* () {
 });
 var stepKitSetup = (agent, harness) => gen(function* () {
   const kits = agent.brief.kits ?? [];
-  if (kits.length === 0)
-    return;
-  const fetch = agent.setupArchive;
   const unavailable = (reason) => ({
     refused: failed("kit_setup_unavailable", `Kitman could not load the Run's Kit setup: ${reason}`)
   });
+  if (!isKitHarness(harness))
+    return kits.length === 0 ? undefined : unavailable(`no Kit setup renders for the ${harness} harness`);
+  if (kits.length === 0)
+    return materializeKitSetup(harness, [kitmanSkillEntry], agent.brief.listedSkills ?? []);
+  const fetch = agent.setupArchive;
   if (fetch === undefined)
     return unavailable("this Runner fetches no setup archives");
-  if (!isKitHarness(harness))
-    return unavailable(`no Kit setup renders for the ${harness} harness`);
   const setups = yield* forEach(kits, (kit) => fetch(kit.setupDigest).pipe(flatMap3(decodeSetupArchive), map8((archive) => ({ name: kit.name, version: kit.version, archive })))).pipe(result);
   if (isFailure(setups))
     return unavailable(setups.failure.message);
-  const setup = materializeKitSetup(harness, setups.success, agent.brief.listedSkills ?? []);
+  const setup = materializeKitSetup(harness, [...setups.success, kitmanSkillEntry], agent.brief.listedSkills ?? []);
   for (const server of setup.mcpServers) {
     const missing = kitMcpSecretNames(server.transport).find((name) => agent.secrets?.[name] === undefined);
     if (missing !== undefined)
@@ -5312,8 +5310,71 @@ var harnessesInSrt = (input) => gen(function* () {
     binaries: Object.fromEntries(probed.flatMap((entry) => entry.binary === undefined ? [] : [[entry.harness, entry.binary]]))
   };
 });
-// packages/agent-runtime/src/check-postgres.ts
+// packages/agent-runtime/src/check-docker.ts
+import { fileURLToPath as fileURLToPath2 } from "url";
+
+// packages/agent-runtime/src/loopback-tunnel.ts
 import * as net from "net";
+
+class LoopbackTunnelUnavailable extends TaggedError("LoopbackTunnelUnavailable") {
+}
+var srtLoopbackTunnel = (tunnel) => [
+  "proxy=${HTTP_PROXY:?srt set no HTTP_PROXY}",
+  "proxy=${proxy#*://}",
+  "proxy=${proxy%%/*}",
+  "auth=",
+  "case $proxy in *@*)",
+  `  auth=$(printf %s "\${proxy%@*}" | awk 'BEGIN { for (i = 1; i < 256; i++) hex[sprintf("%02X", i)] = sprintf("%c", i) }
+    { out = ""; while (match($0, /%[0-9A-Fa-f][0-9A-Fa-f]/)) { out = out substr($0, 1, RSTART - 1) hex[toupper(substr($0, RSTART + 1, 2))]; $0 = substr($0, RSTART + 3) } printf "%s", out $0 }')`,
+  "  proxy=${proxy##*@} ;;",
+  "esac",
+  "log=$(mktemp)",
+  `${tunnel.listener ?? `socat -t 86400 TCP-LISTEN:${tunnel.listenPort},bind=127.0.0.1,fork,reuseaddr "PROXY:\${proxy%:*}:127.0.0.1:${tunnel.hostPort},proxyport=\${proxy##*:}\${auth:+,proxyauth=$auth}"`} 2>"$log" &`,
+  "tunnel=$!",
+  `fail() { echo "Kitman: the ${tunnel.service} tunnel did not open: $1" >&2; cat "$log" >&2; kill $tunnel 2>/dev/null; rm -f "$log"; exit 1; }`,
+  "tries=0",
+  "while :; do",
+  '  kill -0 $tunnel 2>/dev/null || fail "its listener stopped"',
+  `  answer=$( (${tunnel.probe}; sleep 1) | socat - TCP:127.0.0.1:${tunnel.listenPort} 2>/dev/null | ${tunnel.read})`,
+  `  case $answer in ${tunnel.answers}) break ;; esac`,
+  "  tries=$((tries + 1))",
+  `  [ $tries -lt 30 ] || fail "${tunnel.service} did not answer through it"`,
+  "  sleep 0.2",
+  "done",
+  'kill -0 $tunnel 2>/dev/null || fail "its listener stopped"',
+  'sh -c "$1"',
+  "status=$?",
+  "kill $tunnel 2>/dev/null",
+  'rm -f "$log"',
+  "exit $status"
+].join(`
+`);
+var loopbackSocketForwarder = (hostPort, socket) => gen(function* () {
+  const fs = yield* FileSystem;
+  const dir = yield* flatMap3(fs.makeTempDirectoryScoped({ prefix: "kitman-lo-" }), fs.realPath).pipe(mapError2((error) => new LoopbackTunnelUnavailable({ reason: error.message })));
+  yield* acquireRelease(callback3((resume) => {
+    const open = new Set;
+    const server = net.createServer({ allowHalfOpen: true }, (client) => {
+      const upstream = net.connect({ port: hostPort, host: "127.0.0.1", allowHalfOpen: true });
+      for (const connection of [client, upstream]) {
+        open.add(connection);
+        connection.on("close", () => open.delete(connection));
+      }
+      client.pipe(upstream);
+      upstream.pipe(client);
+      client.on("error", () => upstream.destroy());
+      upstream.on("error", () => client.destroy());
+    });
+    server.once("error", (error) => resume(fail7(new LoopbackTunnelUnavailable({ reason: error.message }))));
+    server.listen(`${dir}/${socket}`, () => resume(succeed6({ server, open })));
+  }), ({ server, open }) => callback3((resume) => {
+    server.close(() => resume(void_3));
+    open.forEach((connection) => connection.destroy());
+  }));
+  return dir;
+});
+
+// packages/agent-runtime/src/check-postgres.ts
 var CheckPostgresImage = "pgvector/pgvector:0.8.7-pg16@sha256:7b822b0aac60967beb1ea5e576b8602c94c300a157d187f385ae3e0da199b90a";
 var checkPostgresSandboxPort = 5432;
 var checkPostgresAlias = "kitman-postgres";
@@ -5413,60 +5474,202 @@ var dockerCheckPostgres = (runnerId, replicaId) => (id) => gen(function* () {
   return { container, hostPort, user, password };
 });
 var sslRequestOctal = String.raw`\000\000\000\010\004\322\026\057`;
-var srtPostgresTunnel = (hostPort, listenPort = checkPostgresSandboxPort) => [
-  "proxy=${HTTP_PROXY:?srt set no HTTP_PROXY}",
-  "proxy=${proxy#*://}",
-  "proxy=${proxy%%/*}",
-  "auth=",
-  "case $proxy in *@*)",
-  `  auth=$(printf %s "\${proxy%@*}" | awk 'BEGIN { for (i = 1; i < 256; i++) hex[sprintf("%02X", i)] = sprintf("%c", i) }
-    { out = ""; while (match($0, /%[0-9A-Fa-f][0-9A-Fa-f]/)) { out = out substr($0, 1, RSTART - 1) hex[toupper(substr($0, RSTART + 1, 2))]; $0 = substr($0, RSTART + 3) } printf "%s", out $0 }')`,
-  "  proxy=${proxy##*@} ;;",
-  "esac",
-  "log=$(mktemp)",
-  `socat TCP-LISTEN:${listenPort},bind=127.0.0.1,fork,reuseaddr "PROXY:\${proxy%:*}:127.0.0.1:${hostPort},proxyport=\${proxy##*:}\${auth:+,proxyauth=$auth}" 2>"$log" &`,
-  "tunnel=$!",
-  'fail() { echo "Kitman: the Postgres tunnel did not open: $1" >&2; cat "$log" >&2; kill $tunnel 2>/dev/null; rm -f "$log"; exit 1; }',
-  "tries=0",
-  "while :; do",
-  '  kill -0 $tunnel 2>/dev/null || fail "its listener stopped"',
-  `  answer=$( (printf '${sslRequestOctal}'; sleep 1) | socat - TCP:127.0.0.1:${listenPort} 2>/dev/null | head -c 1)`,
-  "  case $answer in N|S) break ;; esac",
-  "  tries=$((tries + 1))",
-  '  [ $tries -lt 30 ] || fail "Postgres did not answer through it"',
-  "  sleep 0.2",
-  "done",
-  'kill -0 $tunnel 2>/dev/null || fail "its listener stopped"',
-  'sh -c "$1"',
-  "status=$?",
-  "kill $tunnel 2>/dev/null",
-  'rm -f "$log"',
-  "exit $status"
-].join(`
-`);
-var postgresSocketForwarder = (hostPort) => gen(function* () {
-  const fs = yield* FileSystem;
-  const dir = yield* fs.realPath(yield* fs.makeTempDirectoryScoped({ prefix: "kpg-" }));
-  yield* acquireRelease(callback3((resume) => {
-    const open = new Set;
-    const server = net.createServer((client) => {
-      const upstream = net.connect(hostPort, "127.0.0.1");
-      for (const socket of [client, upstream]) {
-        open.add(socket);
-        socket.on("close", () => open.delete(socket));
-      }
-      client.pipe(upstream);
-      upstream.pipe(client);
-      client.on("error", () => upstream.destroy());
-      upstream.on("error", () => client.destroy());
-    });
-    server.once("error", (error) => resume(fail7(new CheckPostgresUnavailable({ reason: error.message }))));
-    server.listen(`${dir}/.s.PGSQL.${checkPostgresSandboxPort}`, () => resume(succeed6({ server, open })));
-  }), ({ server, open }) => callback3((resume) => {
-    server.close(() => resume(void_3));
-    open.forEach((socket) => socket.destroy());
-  }));
-  return dir;
+var srtPostgresTunnel = (hostPort, listenPort = checkPostgresSandboxPort) => srtLoopbackTunnel({
+  service: "Postgres",
+  hostPort,
+  listenPort,
+  probe: `printf '${sslRequestOctal}'`,
+  read: "head -c 1",
+  answers: "N|S"
+});
+var postgresSocketForwarder = (hostPort) => loopbackSocketForwarder(hostPort, `.s.PGSQL.${checkPostgresSandboxPort}`).pipe(mapError2((error) => new CheckPostgresUnavailable({ reason: error.reason })));
+
+// packages/agent-runtime/src/check-docker.ts
+var checkDockerPort = 2375;
+var checkDockerAlias = "kitman-docker";
+var DockerHubRegistry = "https://registry-1.docker.io";
+var CheckDockerLabel = "kitman.check-docker";
+var CheckDockerReplicaLabel = "kitman.check-docker-replica";
+var rootlessDataRoot = "/home/rootless/.local/share/docker";
+var registryDataRoot = "/var/lib/registry";
+var registryMirrorPort = 5000;
+var egressProxyPort = 3128;
+
+class CheckDockerUnavailable extends TaggedError("CheckDockerUnavailable") {
+  get message() {
+    return `A pipeline check runs with a Docker daemon of its own, which this Runner could not start: ${this.reason}`;
+  }
+}
+var dockerName2 = (id) => id.replaceAll(/[^a-zA-Z0-9_.-]/g, "-");
+var checkRegistryCacheVolume = (runnerId) => `kitman-check-registry-cache-${dockerName2(runnerId)}`;
+var checkDockerProxyEnvironment = (proxy, mirror) => {
+  const direct = `localhost,127.0.0.1,${new URL(mirror).hostname}`;
+  return {
+    HTTP_PROXY: proxy,
+    HTTPS_PROXY: proxy,
+    http_proxy: proxy,
+    https_proxy: proxy,
+    NO_PROXY: direct,
+    no_proxy: direct
+  };
+};
+var checkDockerDaemonArgs = (input) => [
+  "run",
+  "--detach",
+  "--name",
+  input.name,
+  ...input.labels.flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+  "--network",
+  input.network,
+  "--network-alias",
+  checkDockerAlias,
+  "--security-opt",
+  "seccomp=unconfined",
+  "--security-opt",
+  "apparmor=unconfined",
+  "--security-opt",
+  "systempaths=unconfined",
+  "--device",
+  "/dev/net/tun",
+  "--volume",
+  rootlessDataRoot,
+  "--env",
+  "DOCKER_TLS_CERTDIR=",
+  ...Object.entries(input.proxy === undefined ? {} : checkDockerProxyEnvironment(input.proxy, input.mirror)).flatMap(([key, value]) => ["--env", `${key}=${value}`]),
+  input.image,
+  "--registry-mirror",
+  input.mirror,
+  "--tls=false"
+];
+var checkRegistryMirrorArgs = (input) => [
+  "run",
+  "--detach",
+  "--rm",
+  "--name",
+  input.name,
+  ...input.labels.flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+  "--network",
+  input.network,
+  "--volume",
+  `${input.volume}:${registryDataRoot}`,
+  "--env",
+  `REGISTRY_PROXY_REMOTEURL=${DockerHubRegistry}`,
+  "--env",
+  "REGISTRY_PROXY_TTL=0",
+  input.image
+];
+var checkDockerClientConfig = (proxy) => proxy === undefined ? {} : { proxies: { default: { httpProxy: proxy, httpsProxy: proxy, noProxy: "localhost,127.0.0.1" } } };
+var orphanedCheckDocker = (listing, live) => listing.split(`
+`).map((line) => line.trim().split(/\s+/)).flatMap(([id, replica]) => id === undefined || id === "" || live.has(replica ?? "") ? [] : [id]);
+var removeCheckDocker = (runnerId, liveReplicas) => gen(function* () {
+  const filter = ["--filter", `label=${CheckDockerLabel}=${runnerId}`];
+  const format = `{{.ID}} {{.Label "${CheckDockerReplicaLabel}"}}`;
+  const containers = orphanedCheckDocker(yield* runCommand2("docker", ["ps", "--all", ...filter, "--format", format], { timeout: "10 seconds" }), liveReplicas);
+  if (containers.length > 0)
+    yield* runCommand2("docker", ["rm", "--force", "--volumes", ...containers], { timeout: "30 seconds" });
+  const networks = orphanedCheckDocker(yield* runCommand2("docker", ["network", "ls", ...filter, "--format", format], { timeout: "10 seconds" }), liveReplicas);
+  if (networks.length > 0)
+    yield* runCommand2("docker", ["network", "rm", ...networks], { timeout: "30 seconds" });
+}).pipe(ignore);
+var daemonLogs = (container) => gen(function* () {
+  const state = yield* runCommand2("docker", [
+    "inspect",
+    "--format",
+    "{{.State.Status}} (exit code {{.State.ExitCode}})",
+    container
+  ]);
+  const logs = yield* runCommand2("sh", ["-c", 'docker logs --tail 40 "$0" 2>&1', container]);
+  return `${state.trim()}
+${logs.trim().slice(-3000)}`;
+}).pipe(orElseSucceed(() => "nothing, since docker could not show its state or logs"));
+var randomHex2 = () => Array.from(crypto.getRandomValues(new Uint8Array(4)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+var dockerCheckDaemon = (input) => ({ id, network: allowed }) => gen(function* () {
+  const run = `${dockerName2(id)}-${randomHex2()}`;
+  const daemon = `kitman-check-docker-${run}`;
+  const network = `kitman-check-docker-net-${run}`;
+  const outside = `kitman-check-docker-out-${run}`;
+  const mirror = `kitman-check-docker-mirror-${run}`;
+  const proxyContainer = `kitman-check-docker-egress-${run}`;
+  const forwarder = `kitman-check-docker-api-${run}`;
+  const runLabel = "kitman.check-docker-run";
+  const labels = [
+    [CheckDockerLabel, input.runnerId],
+    [CheckDockerReplicaLabel, input.replicaId],
+    [runLabel, run]
+  ];
+  const labelArgs = labels.flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+  const docker = (args, timeout = "30 seconds") => runCommand2("docker", args, { timeout }).pipe(mapError2((error) => new CheckDockerUnavailable({ reason: error.message })));
+  yield* acquireRelease(void_3, () => gen(function* () {
+    const ids = (yield* docker(["ps", "--all", "--quiet", "--filter", `label=${runLabel}=${run}`])).split(`
+`).filter((line) => line.trim() !== "");
+    if (ids.length > 0)
+      yield* docker(["rm", "--force", "--volumes", ...ids], "2 minutes");
+    yield* ignore(docker(["network", "rm", network]));
+    yield* ignore(docker(["network", "rm", outside]));
+  }).pipe(ignore));
+  yield* docker(["network", "create", "--opt", "com.docker.network.bridge.enable_icc=false", ...labelArgs, outside]);
+  yield* docker(["network", "create", ...allowed === "open" ? [] : ["--internal"], ...labelArgs, network]);
+  const addressOn = (container) => gen(function* () {
+    yield* docker(["network", "connect", network, container]);
+    const address = (yield* docker([
+      "inspect",
+      "--format",
+      `{{(index .NetworkSettings.Networks "${network}").IPAddress}}`,
+      container
+    ])).trim();
+    if (address === "")
+      return yield* new CheckDockerUnavailable({ reason: `${container} has no address` });
+    return address;
+  });
+  const helper = (name, args) => docker(["run", "--detach", "--rm", "--name", name, ...labelArgs, "--network", outside, ...args], "30 minutes");
+  yield* docker(checkRegistryMirrorArgs({
+    name: mirror,
+    image: input.registryImage,
+    labels,
+    network: outside,
+    volume: checkRegistryCacheVolume(input.runnerId)
+  }), "30 minutes");
+  const mirrorUrl = `http://${yield* addressOn(mirror)}:${registryMirrorPort}`;
+  const proxy = allowed === "open" ? undefined : yield* gen(function* () {
+    yield* helper(proxyContainer, [
+      "--volume",
+      `${fileURLToPath2(import.meta.resolve("./egress-proxy.ts"))}:/kitman/egress-proxy.ts:ro`,
+      input.proxyImage ?? EgressProxyImage,
+      "bun",
+      "/kitman/egress-proxy.ts",
+      allowed.hosts.join(",")
+    ]);
+    return `http://${yield* addressOn(proxyContainer)}:${egressProxyPort}`;
+  });
+  yield* docker(checkDockerDaemonArgs({
+    name: daemon,
+    image: input.image,
+    labels,
+    network,
+    mirror: mirrorUrl,
+    ...proxy === undefined ? undefined : { proxy }
+  }), "30 minutes");
+  yield* helper(forwarder, [
+    "--publish",
+    `127.0.0.1::${checkDockerPort}`,
+    "--volume",
+    `${fileURLToPath2(import.meta.resolve("./tcp-forwarder.ts"))}:/kitman/tcp-forwarder.ts:ro`,
+    input.proxyImage ?? EgressProxyImage,
+    "bun",
+    "/kitman/tcp-forwarder.ts",
+    String(checkDockerPort),
+    checkDockerAlias,
+    String(checkDockerPort)
+  ]);
+  yield* docker(["network", "connect", network, forwarder]);
+  const hostPort = publishedPort(yield* docker(["port", forwarder, `${checkDockerPort}/tcp`]));
+  if (hostPort === undefined)
+    return yield* new CheckDockerUnavailable({ reason: "docker published no port" });
+  yield* docker(["--host", `tcp://127.0.0.1:${hostPort}`, "version", "--format", "{{.Server.Version}}"], "10 seconds").pipe(retry({ schedule: spaced("500 millis"), times: 240 }), catch_((error) => gen(function* () {
+    const logs = yield* daemonLogs(daemon);
+    return yield* new CheckDockerUnavailable({ reason: `${error.reason}; the daemon logged: ${logs}` });
+  })));
+  return { container: daemon, hostPort, ...proxy === undefined ? undefined : { proxy } };
 });
 // packages/agent-runtime/src/codex-hook-trust.ts
 class CodexAppServerFailed extends TaggedError("CodexAppServerFailed") {
@@ -5494,7 +5697,7 @@ var codexAppServer = (binary = "codex") => (env) => gen(function* () {
   const input = yield* unbounded2();
   const pending = new Map;
   let lastId = 0;
-  const handle = yield* spawner.spawn(make7(binary, ["app-server"], {
+  const handle = yield* spawner.spawn(make3(binary, ["app-server"], {
     cwd: env.home,
     extendEnv: true,
     env: { HOME: env.home, CODEX_HOME: env.codexHome },
@@ -5517,7 +5720,7 @@ var codexAppServer = (binary = "codex") => (env) => gen(function* () {
   return {
     request: (method, params) => gen(function* () {
       const id = ++lastId;
-      const deferred = yield* make17();
+      const deferred = yield* make16();
       pending.set(id, deferred);
       yield* send({ id, method, params });
       return yield* _await(deferred).pipe(mapError2((error) => new CodexAppServerFailed({ reason: `${method}: ${error.message}` })));
@@ -5657,7 +5860,7 @@ var handshake = [
 `).join("");
 var kitmanMcpPreflight = (mcp) => gen(function* () {
   const spawner = yield* ChildProcessSpawner;
-  const server = yield* spawner.spawn(make7(mcp.command, [...mcp.args], {
+  const server = yield* spawner.spawn(make3(mcp.command, [...mcp.args], {
     extendEnv: true,
     env: mcp.env,
     stdin: { stream: make11(new TextEncoder().encode(handshake)), endOnDone: false },
@@ -5733,7 +5936,7 @@ var programProcessExecutor = (input) => (work) => gen(function* () {
   };
   const exitCode = sandbox === undefined ? yield* gen(function* () {
     const spawner = yield* ChildProcessSpawner;
-    const handle = yield* spawner.spawn(make7(input.bun ?? process.execPath, [file], {
+    const handle = yield* spawner.spawn(make3(input.bun ?? process.execPath, [file], {
       stdin: make11(new TextEncoder().encode(stdin)),
       stdout: "inherit",
       stderr: "inherit",
@@ -5796,9 +5999,110 @@ var programProcessExecutor = (input) => (work) => gen(function* () {
   status: "deferred",
   crashed: `it did not start: ${error.message}`.slice(0, 500)
 })));
+// packages/agent-runtime/src/half-close-relay.ts
+import { once } from "events";
+import { connect as connect2, createServer as createServer2 } from "net";
+var frameHeader = 4;
+var endOfInput = Buffer.alloc(frameHeader);
+var maxFrame = 1024 * 1024;
+var keepUp = (from, to, accepted) => {
+  if (accepted)
+    return;
+  from.pause();
+  to.once("drain", () => from.resume());
+};
+var closeTogether = (...sockets) => sockets.forEach((socket) => {
+  socket.on("error", () => sockets.forEach((other) => other.destroy()));
+  socket.on("close", () => sockets.forEach((other) => other.end()));
+});
+var listening = (server, port) => once(server.listen(port, "127.0.0.1"), "listening").then(() => server);
+var startHalfCloseDecoder = (input) => listening(createServer2({ allowHalfOpen: true }, (client) => {
+  const upstream = connect2({ port: input.targetPort, host: "127.0.0.1", allowHalfOpen: true });
+  let pending = Buffer.alloc(0);
+  client.on("data", (chunk) => {
+    pending = Buffer.concat([pending, chunk]);
+    if (pending.length >= frameHeader && pending.readUInt32BE(0) > maxFrame)
+      return void client.destroy();
+    while (pending.length >= frameHeader && pending.length >= frameHeader + pending.readUInt32BE(0)) {
+      const length = pending.readUInt32BE(0);
+      if (length === 0)
+        upstream.end();
+      else
+        keepUp(client, upstream, upstream.write(pending.subarray(frameHeader, frameHeader + length)));
+      pending = pending.subarray(frameHeader + length);
+    }
+  });
+  client.on("end", () => upstream.end());
+  upstream.pipe(client);
+  closeTogether(client, upstream);
+}), input.port);
+if (false)
+  ;
+
 // packages/agent-runtime/src/verification-executor.ts
+import { fileURLToPath as fileURLToPath3 } from "url";
 var checkTimeout = "30 minutes";
 var checkFilesPerVerification = 50;
+var halfCloseEncoder = [process.execPath, fileURLToPath3(import.meta.resolve("./half-close-relay.ts"))];
+var srtDockerTunnel = (relayPort) => srtLoopbackTunnel({
+  service: "Docker daemon",
+  hostPort: relayPort,
+  listenPort: checkDockerPort,
+  listener: `${halfCloseEncoder.map(quoted).join(" ")} ${checkDockerPort} "$HTTP_PROXY" ${relayPort}`,
+  probe: String.raw`printf 'GET /_ping HTTP/1.0\r\n\r\n'`,
+  read: "tail -c 2",
+  answers: "OK"
+});
+var pipelineEnvironment = (docker, dockerHost) => ({
+  DOCKER_HOST: dockerHost,
+  DOCKER_CONFIG: `${docker.clientDir}/docker`,
+  GCL_HOME: `${docker.clientDir}/gitlab-ci-local-home`
+});
+var dockerRoute = (backend, docker) => {
+  if (docker === undefined)
+    return { env: {}, hosts: [], unixSockets: [], services: [], tunnel: undefined };
+  if (backend === "docker")
+    return {
+      env: {
+        ...pipelineEnvironment(docker, `tcp://${checkDockerAlias}:${checkDockerPort}`),
+        NO_PROXY: `localhost,127.0.0.1,${checkDockerAlias}`,
+        no_proxy: `localhost,127.0.0.1,${checkDockerAlias}`
+      },
+      hosts: [],
+      unixSockets: [],
+      services: [{ container: docker.container, alias: checkDockerAlias }],
+      tunnel: undefined
+    };
+  switch (docker.route.kind) {
+    case "socket":
+      return {
+        env: pipelineEnvironment(docker, `unix://${docker.route.dir}/docker.sock`),
+        hosts: [],
+        unixSockets: [docker.route.dir],
+        services: [],
+        tunnel: undefined
+      };
+    case "relay":
+      return {
+        env: pipelineEnvironment(docker, `tcp://127.0.0.1:${checkDockerPort}`),
+        hosts: [`127.0.0.1:${docker.route.port}`],
+        unixSockets: [],
+        services: [],
+        tunnel: srtDockerTunnel(docker.route.port)
+      };
+    case "direct":
+      throw new Error("A pipeline check in srt reaches its daemon through a socket or the relay, never directly.");
+  }
+};
+var hostCheckEnvironment = (docker) => {
+  const { POSTGRES_URL: _runnerDatabase, ...runner } = withoutPreloads2();
+  if (docker === undefined)
+    return runner;
+  return {
+    ...Object.fromEntries(Object.entries(runner).filter(([name]) => !name.startsWith("DOCKER_") && !name.startsWith("GCL_") && name !== "SSH_AUTH_SOCK")),
+    ...pipelineEnvironment(docker, `tcp://127.0.0.1:${docker.hostPort}`)
+  };
+};
 var postgresRoute = (backend, postgres) => {
   if (postgres === undefined)
     return { url: undefined, hosts: [], unixSockets: [], services: [], tunnel: undefined };
@@ -5826,12 +6130,13 @@ var postgresRoute = (backend, postgres) => {
     tunnel: srtPostgresTunnel(postgres.hostPort)
   };
 };
-var checkSandboxPolicy = (work, sandbox, checkout, cache, filesDir, postgresHosts) => ({
+var checkSandboxPolicy = (work, sandbox, checkout, cache, filesDir, postgresHosts, clientDir) => ({
   ...runnerStateSandboxPolicy(sandbox.runner, [
     repositoryClone(sandbox.runner.workRoot, work.repoBinding.id),
-    checkout
+    checkout,
+    ...clientDir === undefined ? [] : [clientDir, ...halfCloseEncoder]
   ]),
-  writablePaths: [checkout, cache, filesDir],
+  writablePaths: [checkout, cache, filesDir, ...clientDir === undefined ? [] : [clientDir]],
   network: verificationNetworkAllowlist({
     apiUrl: sandbox.apiUrl,
     storageOrigin: work.storageOrigin,
@@ -5841,16 +6146,15 @@ var checkSandboxPolicy = (work, sandbox, checkout, cache, filesDir, postgresHost
   environment: srtCacheEnvironment2(cache)
 });
 var checkGitEnvironment = { GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0" };
-var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command, cwd, filesDir, onOutput, postgres }) => {
+var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command, cwd, filesDir, onOutput, postgres, docker }) => {
   const env = { ...checkGitEnvironment, KITMAN_RUN_FILES_DIR: filesDir };
   const output = onOutput === undefined ? undefined : { onOutput };
   if (sandbox === undefined || sandbox.backend === undefined) {
-    const { POSTGRES_URL: _runnerDatabase, ...runner } = withoutPreloads2();
     return runShell2(command, {
       cwd,
       extendEnv: false,
       env: {
-        ...runner,
+        ...hostCheckEnvironment(docker),
         ...env,
         ...postgres === undefined ? undefined : { POSTGRES_URL: checkPostgresUrl(postgres, "127.0.0.1", postgres.hostPort) }
       },
@@ -5859,14 +6163,18 @@ var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command,
     });
   }
   const route = postgresRoute(sandbox.backend, postgres);
-  const policy = checkSandboxPolicy(work, sandbox, checkout, cache, filesDir, route.hosts);
+  const daemon = dockerRoute(sandbox.backend, docker);
+  const policy = checkSandboxPolicy(work, sandbox, checkout, cache, filesDir, [...route.hosts, ...daemon.hosts], docker?.clientDir);
+  const [tunnel, ...innerTunnels] = [route.tunnel, daemon.tunnel].filter((script) => script !== undefined);
+  const tunnelled = innerTunnels.reduceRight((inner, script) => `sh -c ${quoted(script)} sh ${quoted(inner)}`, command);
   const sandboxCommand = {
-    argv: route.tunnel === undefined ? ["sh", "-c", command] : ["sh", "-c", route.tunnel, "sh", command],
+    argv: tunnel === undefined ? ["sh", "-c", command] : ["sh", "-c", tunnel, "sh", tunnelled],
     cwd,
     env: {
       ...env,
       KITMAN_CHECK_SANDBOX: sandbox.backend,
-      ...route.url === undefined ? undefined : { POSTGRES_URL: route.url }
+      ...route.url === undefined ? undefined : { POSTGRES_URL: route.url },
+      ...daemon.env
     },
     timeout: checkTimeout,
     ...output
@@ -5875,7 +6183,7 @@ var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command,
     backend: "srt",
     policy,
     command: { ...sandboxCommand, env: { ...inherited, ...sandboxCommand.env }, extendEnv: false },
-    unixSockets: route.unixSockets,
+    unixSockets: [...route.unixSockets, ...daemon.unixSockets],
     ...sandbox.srtCommand === undefined ? undefined : { srtCommand: sandbox.srtCommand }
   }) : runSandboxCommand({
     backend: "docker",
@@ -5885,7 +6193,7 @@ var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command,
     readOnlyPaths: [repositoryClone(sandbox.runner.workRoot, work.repoBinding.id)],
     policy,
     command: sandboxCommand,
-    services: route.services
+    services: [...route.services, ...daemon.services]
   });
 };
 var regularFiles = (dir) => gen(function* () {
@@ -5939,6 +6247,38 @@ var checkoutPostgres = (worktree, services) => gen(function* () {
     });
   return yield* services.postgres(services.id).pipe(mapError2((error) => new ServicesUnavailable({ reason: error.message })));
 });
+var decodeListeningPort = decodeUnknownEffect2(Struct({ port: Finite }));
+var pipelineDaemon = (services, check) => gen(function* () {
+  if (services.docker === undefined)
+    return yield* new ServicesUnavailable({
+      reason: `The pipeline check ${check} runs with a Docker daemon of its own, and this Runner cannot start one: set KITMAN_RUNNER_CHECK_DOCKER_IMAGE to a docker:*-dind-rootless image and KITMAN_RUNNER_CHECK_REGISTRY_IMAGE to a registry:3 image, each pinned by digest.`
+    });
+  const fs = yield* FileSystem;
+  const started = yield* services.docker({ id: services.id, network: services.network }).pipe(mapError2((error) => new ServicesUnavailable({ reason: error.message })));
+  const clientDir = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-check-docker-" });
+  yield* fs.makeDirectory(`${clientDir}/docker`);
+  yield* fs.makeDirectory(`${clientDir}/gitlab-ci-local-home`);
+  yield* fs.writeFileString(`${clientDir}/docker/config.json`, encodeUnknownJsonStringSync(checkDockerClientConfig(started.proxy)));
+  if (services.backend !== "srt")
+    return { ...started, clientDir, route: { kind: "direct" } };
+  if (services.platform !== "darwin") {
+    const relay = yield* acquireRelease(promise(() => startHalfCloseDecoder({ port: 0, targetPort: started.hostPort })), (server) => sync2(() => server.close()));
+    const { port } = yield* decodeListeningPort(relay.address()).pipe(mapError2(() => new ServicesUnavailable({
+      reason: `The pipeline check ${check} cannot reach its Docker daemon: its relay has no port`
+    })));
+    return { ...started, clientDir, route: { kind: "relay", port } };
+  }
+  return {
+    ...started,
+    clientDir,
+    route: {
+      kind: "socket",
+      dir: yield* loopbackSocketForwarder(started.hostPort, "docker.sock").pipe(mapError2((error) => new ServicesUnavailable({
+        reason: `The pipeline check ${check} cannot reach its Docker daemon: ${error.reason}`
+      })))
+    }
+  };
+});
 var reachCheckPostgres = (postgres, services, worktree, run) => gen(function* () {
   if (services.backend !== "srt")
     return postgres;
@@ -5987,11 +6327,13 @@ var runChecks = (worktree, checks, tree, known, run, keeper, services) => gen(fu
     const filesDir = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-check-files-" });
     const output = path.join(yield* fs.makeTempDirectoryScoped({ prefix: "kitman-check-output-" }), "output");
     const sink = keeper === undefined ? undefined : yield* fs.open(output, { flag: "w" });
+    const docker = check.pipeline === true ? yield* pipelineDaemon(services, check.name) : undefined;
     const ran = yield* run({
       command: check.command,
       cwd: path.join(worktree, check.workingDirectory ?? "."),
       filesDir,
       ...postgres === undefined ? undefined : { postgres },
+      ...docker === undefined ? undefined : { docker },
       ...sink === undefined ? undefined : { onOutput: (chunk) => sink.writeAll(chunk) }
     });
     const durationMs = (yield* currentTimeMillis) - startedAt;
@@ -6090,6 +6432,27 @@ var measureRevisions = (work, measure, checkouts, runIn) => gen(function* () {
     }
   };
 });
+var ownRepository = (worktree, clone, targetBranch) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const scratch = yield* fs.makeTempDirectoryScoped({
+    directory: path.dirname(worktree),
+    prefix: "kitman-check-git-"
+  });
+  const gitDir = path.join(scratch, "git");
+  const git = (...args) => runCommand2("git", ["--git-dir", gitDir, ...args]);
+  const revision = (yield* runCommand2("git", ["-C", worktree, "rev-parse", "HEAD"])).trim();
+  const originUrl = (yield* runCommand2("git", ["-C", clone, "config", "--get", "remote.origin.url"])).trim();
+  yield* runCommand2("git", ["clone", "--quiet", "--bare", "--no-hardlinks", clone, gitDir]);
+  yield* git("fetch", "--quiet", clone, "+refs/remotes/origin/*:refs/remotes/origin/*");
+  yield* git("config", "core.bare", "false");
+  yield* git("remote", "set-url", "origin", originUrl);
+  yield* git("symbolic-ref", "refs/remotes/origin/HEAD", `refs/remotes/origin/${targetBranch}`);
+  yield* git("update-ref", "--no-deref", "HEAD", revision);
+  yield* fs.remove(path.join(worktree, ".git"));
+  yield* fs.rename(gitDir, path.join(worktree, ".git"));
+  yield* runCommand2("git", ["-C", worktree, "reset", "--quiet"]);
+}).pipe(scoped);
 var treeOf = (worktree) => map8(runCommand2("git", ["-C", worktree, "rev-parse", "HEAD^{tree}"]), (tree) => tree.trim());
 var verificationExecutor = (input) => (work) => gen(function* () {
   if (input.sandbox !== undefined && input.sandbox.backend === undefined)
@@ -6115,15 +6478,22 @@ var verificationExecutor = (input) => (work) => gen(function* () {
   }, work.repoBinding);
   const pipelineOnly = work.checks.every((check) => check.pipeline === true);
   const baseline = pipelineOnly ? head : yield* baselineAt(work.baseline).pipe(catch_(() => baselineAt()));
+  if (work.checks.some((check) => check.pipeline === true))
+    yield* ownRepository(head, repositoryClone(input.rootDir, work.repoBinding.id), work.repoBinding.defaultTargetBranch);
   const headTree = yield* treeOf(head);
   const baselineTree = yield* treeOf(baseline);
   const trees = headTree === baselineTree ? [headTree] : [headTree, baselineTree];
   const known = yield* input.known(work, trees);
+  const sandbox = input.sandbox;
+  const checkNetwork = sandbox === undefined || sandbox.backend === undefined ? "open" : checkSandboxPolicy(work, sandbox, head, cache, cache, []).network;
+  const daemonNetwork = checkNetwork === "open" ? "open" : { hosts: checkNetwork.hosts };
   const services = (id) => ({
     id,
     backend: input.sandbox?.backend,
     platform: (input.sandbox?.backend === "srt" ? input.sandbox.platform : undefined) ?? process.platform,
-    postgres: input.postgres
+    postgres: input.postgres,
+    docker: input.docker,
+    network: daemonNetwork
   });
   const headChecks = yield* runChecks(head, work.checks, headTree, known, runIn(head), keeper(""), services(work.id)).pipe(scoped);
   return {
@@ -6138,7 +6508,7 @@ var verificationExecutor = (input) => (work) => gen(function* () {
         baseline: {
           revision: (yield* runCommand2("git", ["-C", baseline, "rev-parse", "HEAD"])).trim(),
           tree: baselineTree,
-          checks: yield* runChecks(baseline, work.checks, baselineTree, known, runIn(baseline), keeper("baseline-"), services(`${work.id}-baseline`)).pipe(scoped)
+          checks: yield* runChecks(baseline, work.checks.filter((check) => check.pipeline !== true), baselineTree, known, runIn(baseline), keeper("baseline-"), services(`${work.id}-baseline`)).pipe(scoped)
         }
       }
     }
@@ -6162,11 +6532,13 @@ export {
   AgentRuntimePackageName,
   AgentStepFailure,
   BundleRefused,
+  CheckDockerUnavailable,
   CheckPostgresImage,
   CheckPostgresUnavailable,
   CommandFailed2 as CommandFailed,
   CommandRunner2 as CommandRunner,
   ContainerError,
+  DockerHubRegistry,
   EgressProxyImage,
   HERDR_CORE_GENERATION2 as HERDR_CORE_GENERATION,
   HERDR_CORE_INSTALL_COMMAND2 as HERDR_CORE_INSTALL_COMMAND,
@@ -6190,11 +6562,18 @@ export {
   applyAgentEnvironmentMaterialization2 as applyAgentEnvironmentMaterialization,
   applyAgentEnvironmentPlans,
   assertHerdrRunnerCapability2 as assertHerdrRunnerCapability,
+  checkDockerAlias,
+  checkDockerClientConfig,
+  checkDockerDaemonArgs,
+  checkDockerPort,
+  checkDockerProxyEnvironment,
   checkPostgresAlias,
   checkPostgresSandboxPort,
   checkPostgresSocketUrl,
   checkPostgresSweepInterval,
   checkPostgresUrl,
+  checkRegistryCacheVolume,
+  checkRegistryMirrorArgs,
   clearSettledCheckpoints,
   commandHostProbe,
   compiled2 as compiled,
@@ -6202,6 +6581,7 @@ export {
   controlFailureKind,
   defaultAgentRuntimeUserConfigPath,
   detectHarnesses2 as detectHarnesses,
+  dockerCheckDaemon,
   dockerCheckPostgres,
   dockerContainerRunner,
   dockerExecArgv,
@@ -6239,6 +6619,7 @@ export {
   liveReplicaIds,
   loadAgentRuntimeConfig,
   makeReplicaSignals,
+  orphanedCheckDocker,
   orphanedCheckPostgres,
   pinnedSrtCommand2 as pinnedSrtCommand,
   pinnedSrtStepCommand2 as pinnedSrtStepCommand,
@@ -6253,6 +6634,7 @@ export {
   publishedPort,
   readManifestSkillPaths2 as readManifestSkillPaths,
   refuseAgentRequest,
+  removeCheckDocker,
   removeCheckPostgres,
   removeRunnerContainers,
   removeRunnerTerminals,