@kitman-sh/cli 0.10.54 → 0.10.55

package/dist/{chunk-19aqk325.js → chunk-99ver3za.js}

@@ -6,7 +6,7 @@ import {
   decideSecretRequest,
   readSecretRegistry,
   appendSecretRefusals
-} from "./chunk-3d6abgjh.js";
+} from "./chunk-g53wn1q8.js";
 
 // packages/agent-runtime/src/srt-step.ts
 import { SandboxRuntimeConfigSchema } from "@anthropic-ai/sandbox-runtime";

package/dist/{chunk-my987gxf.js → chunk-axdmbr61.js}

@@ -44,6 +44,8 @@ import {
   String2
 } from "./chunk-xgwjcq4z.js";
 import {
+  SecureRandom,
+  layerWebCrypto,
   canonicalJson,
   digestSha256,
   schemaBodyJson,
@@ -408,7 +410,9 @@ var buildKit = (directory, options = {}) => gen(function* () {
   if (!installed.ok)
     return yield* new DependencyInstallFailed({ reason: failure(installed) });
   const packages = yield* kitModules(root);
-  const entry = path.join(root, ".kitman-build-entry.ts");
+  const id = yield* SecureRandom.pipe(flatMap3((random) => random.uuidV4()), provide3(layerWebCrypto));
+  const entryName = `.kitman-build-entry-${id}.ts`;
+  const entry = path.join(root, entryName);
   yield* acquireRelease(fs.writeFileString(entry, buildEntry(identity, packages)), () => ignore(fs.remove(entry)));
   const out = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-kit-" });
   const bundleFile = path.join(out, "bundle.js");
@@ -474,7 +478,7 @@ var buildKit = (directory, options = {}) => gen(function* () {
     ...own.schedules === undefined ? undefined : { schedules: own.schedules },
     carried
   }).pipe(mapError2((error) => new DeclarationsInvalid({ reason: error.message })));
-  const bundle = yield* fs.readFile(bundleFile).pipe(mapError2((error) => new BundleFailed({ reason: error.message })));
+  const bundle = yield* fs.readFileString(bundleFile).pipe(map8((text) => new TextEncoder().encode(text.replaceAll(entryName, ".kitman-build-entry.ts"))), mapError2((error) => new BundleFailed({ reason: error.message })));
   return {
     ...identity,
     bundle,

package/dist/{chunk-c0wrcam4.js → chunk-dgb6s5vq.js}

@@ -287,7 +287,7 @@ import {
   writeSecretRegistry,
   secretRefusalLog,
   parseSecretRefusals
-} from "./chunk-3d6abgjh.js";
+} from "./chunk-g53wn1q8.js";
 import {
   uploadRunFile,
   programLease,
@@ -5310,8 +5310,71 @@ var harnessesInSrt = (input) => gen(function* () {
     binaries: Object.fromEntries(probed.flatMap((entry) => entry.binary === undefined ? [] : [[entry.harness, entry.binary]]))
   };
 });
-// packages/agent-runtime/src/check-postgres.ts
+// packages/agent-runtime/src/check-docker.ts
+import { fileURLToPath as fileURLToPath2 } from "url";
+
+// packages/agent-runtime/src/loopback-tunnel.ts
 import * as net from "net";
+
+class LoopbackTunnelUnavailable extends TaggedError("LoopbackTunnelUnavailable") {
+}
+var srtLoopbackTunnel = (tunnel) => [
+  "proxy=${HTTP_PROXY:?srt set no HTTP_PROXY}",
+  "proxy=${proxy#*://}",
+  "proxy=${proxy%%/*}",
+  "auth=",
+  "case $proxy in *@*)",
+  `  auth=$(printf %s "\${proxy%@*}" | awk 'BEGIN { for (i = 1; i < 256; i++) hex[sprintf("%02X", i)] = sprintf("%c", i) }
+    { out = ""; while (match($0, /%[0-9A-Fa-f][0-9A-Fa-f]/)) { out = out substr($0, 1, RSTART - 1) hex[toupper(substr($0, RSTART + 1, 2))]; $0 = substr($0, RSTART + 3) } printf "%s", out $0 }')`,
+  "  proxy=${proxy##*@} ;;",
+  "esac",
+  "log=$(mktemp)",
+  `${tunnel.listener ?? `socat -t 86400 TCP-LISTEN:${tunnel.listenPort},bind=127.0.0.1,fork,reuseaddr "PROXY:\${proxy%:*}:127.0.0.1:${tunnel.hostPort},proxyport=\${proxy##*:}\${auth:+,proxyauth=$auth}"`} 2>"$log" &`,
+  "tunnel=$!",
+  `fail() { echo "Kitman: the ${tunnel.service} tunnel did not open: $1" >&2; cat "$log" >&2; kill $tunnel 2>/dev/null; rm -f "$log"; exit 1; }`,
+  "tries=0",
+  "while :; do",
+  '  kill -0 $tunnel 2>/dev/null || fail "its listener stopped"',
+  `  answer=$( (${tunnel.probe}; sleep 1) | socat - TCP:127.0.0.1:${tunnel.listenPort} 2>/dev/null | ${tunnel.read})`,
+  `  case $answer in ${tunnel.answers}) break ;; esac`,
+  "  tries=$((tries + 1))",
+  `  [ $tries -lt 30 ] || fail "${tunnel.service} did not answer through it"`,
+  "  sleep 0.2",
+  "done",
+  'kill -0 $tunnel 2>/dev/null || fail "its listener stopped"',
+  'sh -c "$1"',
+  "status=$?",
+  "kill $tunnel 2>/dev/null",
+  'rm -f "$log"',
+  "exit $status"
+].join(`
+`);
+var loopbackSocketForwarder = (hostPort, socket) => gen(function* () {
+  const fs = yield* FileSystem;
+  const dir = yield* flatMap3(fs.makeTempDirectoryScoped({ prefix: "kitman-lo-" }), fs.realPath).pipe(mapError2((error) => new LoopbackTunnelUnavailable({ reason: error.message })));
+  yield* acquireRelease(callback3((resume) => {
+    const open = new Set;
+    const server = net.createServer({ allowHalfOpen: true }, (client) => {
+      const upstream = net.connect({ port: hostPort, host: "127.0.0.1", allowHalfOpen: true });
+      for (const connection of [client, upstream]) {
+        open.add(connection);
+        connection.on("close", () => open.delete(connection));
+      }
+      client.pipe(upstream);
+      upstream.pipe(client);
+      client.on("error", () => upstream.destroy());
+      upstream.on("error", () => client.destroy());
+    });
+    server.once("error", (error) => resume(fail7(new LoopbackTunnelUnavailable({ reason: error.message }))));
+    server.listen(`${dir}/${socket}`, () => resume(succeed6({ server, open })));
+  }), ({ server, open }) => callback3((resume) => {
+    server.close(() => resume(void_3));
+    open.forEach((connection) => connection.destroy());
+  }));
+  return dir;
+});
+
+// packages/agent-runtime/src/check-postgres.ts
 var CheckPostgresImage = "pgvector/pgvector:0.8.7-pg16@sha256:7b822b0aac60967beb1ea5e576b8602c94c300a157d187f385ae3e0da199b90a";
 var checkPostgresSandboxPort = 5432;
 var checkPostgresAlias = "kitman-postgres";
@@ -5411,60 +5474,202 @@ var dockerCheckPostgres = (runnerId, replicaId) => (id) => gen(function* () {
   return { container, hostPort, user, password };
 });
 var sslRequestOctal = String.raw`\000\000\000\010\004\322\026\057`;
-var srtPostgresTunnel = (hostPort, listenPort = checkPostgresSandboxPort) => [
-  "proxy=${HTTP_PROXY:?srt set no HTTP_PROXY}",
-  "proxy=${proxy#*://}",
-  "proxy=${proxy%%/*}",
-  "auth=",
-  "case $proxy in *@*)",
-  `  auth=$(printf %s "\${proxy%@*}" | awk 'BEGIN { for (i = 1; i < 256; i++) hex[sprintf("%02X", i)] = sprintf("%c", i) }
-    { out = ""; while (match($0, /%[0-9A-Fa-f][0-9A-Fa-f]/)) { out = out substr($0, 1, RSTART - 1) hex[toupper(substr($0, RSTART + 1, 2))]; $0 = substr($0, RSTART + 3) } printf "%s", out $0 }')`,
-  "  proxy=${proxy##*@} ;;",
-  "esac",
-  "log=$(mktemp)",
-  `socat TCP-LISTEN:${listenPort},bind=127.0.0.1,fork,reuseaddr "PROXY:\${proxy%:*}:127.0.0.1:${hostPort},proxyport=\${proxy##*:}\${auth:+,proxyauth=$auth}" 2>"$log" &`,
-  "tunnel=$!",
-  'fail() { echo "Kitman: the Postgres tunnel did not open: $1" >&2; cat "$log" >&2; kill $tunnel 2>/dev/null; rm -f "$log"; exit 1; }',
-  "tries=0",
-  "while :; do",
-  '  kill -0 $tunnel 2>/dev/null || fail "its listener stopped"',
-  `  answer=$( (printf '${sslRequestOctal}'; sleep 1) | socat - TCP:127.0.0.1:${listenPort} 2>/dev/null | head -c 1)`,
-  "  case $answer in N|S) break ;; esac",
-  "  tries=$((tries + 1))",
-  '  [ $tries -lt 30 ] || fail "Postgres did not answer through it"',
-  "  sleep 0.2",
-  "done",
-  'kill -0 $tunnel 2>/dev/null || fail "its listener stopped"',
-  'sh -c "$1"',
-  "status=$?",
-  "kill $tunnel 2>/dev/null",
-  'rm -f "$log"',
-  "exit $status"
-].join(`
-`);
-var postgresSocketForwarder = (hostPort) => gen(function* () {
-  const fs = yield* FileSystem;
-  const dir = yield* fs.realPath(yield* fs.makeTempDirectoryScoped({ prefix: "kpg-" }));
-  yield* acquireRelease(callback3((resume) => {
-    const open = new Set;
-    const server = net.createServer((client) => {
-      const upstream = net.connect(hostPort, "127.0.0.1");
-      for (const socket of [client, upstream]) {
-        open.add(socket);
-        socket.on("close", () => open.delete(socket));
-      }
-      client.pipe(upstream);
-      upstream.pipe(client);
-      client.on("error", () => upstream.destroy());
-      upstream.on("error", () => client.destroy());
-    });
-    server.once("error", (error) => resume(fail7(new CheckPostgresUnavailable({ reason: error.message }))));
-    server.listen(`${dir}/.s.PGSQL.${checkPostgresSandboxPort}`, () => resume(succeed6({ server, open })));
-  }), ({ server, open }) => callback3((resume) => {
-    server.close(() => resume(void_3));
-    open.forEach((socket) => socket.destroy());
-  }));
-  return dir;
+var srtPostgresTunnel = (hostPort, listenPort = checkPostgresSandboxPort) => srtLoopbackTunnel({
+  service: "Postgres",
+  hostPort,
+  listenPort,
+  probe: `printf '${sslRequestOctal}'`,
+  read: "head -c 1",
+  answers: "N|S"
+});
+var postgresSocketForwarder = (hostPort) => loopbackSocketForwarder(hostPort, `.s.PGSQL.${checkPostgresSandboxPort}`).pipe(mapError2((error) => new CheckPostgresUnavailable({ reason: error.reason })));
+
+// packages/agent-runtime/src/check-docker.ts
+var checkDockerPort = 2375;
+var checkDockerAlias = "kitman-docker";
+var DockerHubRegistry = "https://registry-1.docker.io";
+var CheckDockerLabel = "kitman.check-docker";
+var CheckDockerReplicaLabel = "kitman.check-docker-replica";
+var rootlessDataRoot = "/home/rootless/.local/share/docker";
+var registryDataRoot = "/var/lib/registry";
+var registryMirrorPort = 5000;
+var egressProxyPort = 3128;
+
+class CheckDockerUnavailable extends TaggedError("CheckDockerUnavailable") {
+  get message() {
+    return `A pipeline check runs with a Docker daemon of its own, which this Runner could not start: ${this.reason}`;
+  }
+}
+var dockerName2 = (id) => id.replaceAll(/[^a-zA-Z0-9_.-]/g, "-");
+var checkRegistryCacheVolume = (runnerId) => `kitman-check-registry-cache-${dockerName2(runnerId)}`;
+var checkDockerProxyEnvironment = (proxy, mirror) => {
+  const direct = `localhost,127.0.0.1,${new URL(mirror).hostname}`;
+  return {
+    HTTP_PROXY: proxy,
+    HTTPS_PROXY: proxy,
+    http_proxy: proxy,
+    https_proxy: proxy,
+    NO_PROXY: direct,
+    no_proxy: direct
+  };
+};
+var checkDockerDaemonArgs = (input) => [
+  "run",
+  "--detach",
+  "--name",
+  input.name,
+  ...input.labels.flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+  "--network",
+  input.network,
+  "--network-alias",
+  checkDockerAlias,
+  "--security-opt",
+  "seccomp=unconfined",
+  "--security-opt",
+  "apparmor=unconfined",
+  "--security-opt",
+  "systempaths=unconfined",
+  "--device",
+  "/dev/net/tun",
+  "--volume",
+  rootlessDataRoot,
+  "--env",
+  "DOCKER_TLS_CERTDIR=",
+  ...Object.entries(input.proxy === undefined ? {} : checkDockerProxyEnvironment(input.proxy, input.mirror)).flatMap(([key, value]) => ["--env", `${key}=${value}`]),
+  input.image,
+  "--registry-mirror",
+  input.mirror,
+  "--tls=false"
+];
+var checkRegistryMirrorArgs = (input) => [
+  "run",
+  "--detach",
+  "--rm",
+  "--name",
+  input.name,
+  ...input.labels.flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+  "--network",
+  input.network,
+  "--volume",
+  `${input.volume}:${registryDataRoot}`,
+  "--env",
+  `REGISTRY_PROXY_REMOTEURL=${DockerHubRegistry}`,
+  "--env",
+  "REGISTRY_PROXY_TTL=0",
+  input.image
+];
+var checkDockerClientConfig = (proxy) => proxy === undefined ? {} : { proxies: { default: { httpProxy: proxy, httpsProxy: proxy, noProxy: "localhost,127.0.0.1" } } };
+var orphanedCheckDocker = (listing, live) => listing.split(`
+`).map((line) => line.trim().split(/\s+/)).flatMap(([id, replica]) => id === undefined || id === "" || live.has(replica ?? "") ? [] : [id]);
+var removeCheckDocker = (runnerId, liveReplicas) => gen(function* () {
+  const filter = ["--filter", `label=${CheckDockerLabel}=${runnerId}`];
+  const format = `{{.ID}} {{.Label "${CheckDockerReplicaLabel}"}}`;
+  const containers = orphanedCheckDocker(yield* runCommand2("docker", ["ps", "--all", ...filter, "--format", format], { timeout: "10 seconds" }), liveReplicas);
+  if (containers.length > 0)
+    yield* runCommand2("docker", ["rm", "--force", "--volumes", ...containers], { timeout: "30 seconds" });
+  const networks = orphanedCheckDocker(yield* runCommand2("docker", ["network", "ls", ...filter, "--format", format], { timeout: "10 seconds" }), liveReplicas);
+  if (networks.length > 0)
+    yield* runCommand2("docker", ["network", "rm", ...networks], { timeout: "30 seconds" });
+}).pipe(ignore);
+var daemonLogs = (container) => gen(function* () {
+  const state = yield* runCommand2("docker", [
+    "inspect",
+    "--format",
+    "{{.State.Status}} (exit code {{.State.ExitCode}})",
+    container
+  ]);
+  const logs = yield* runCommand2("sh", ["-c", 'docker logs --tail 40 "$0" 2>&1', container]);
+  return `${state.trim()}
+${logs.trim().slice(-3000)}`;
+}).pipe(orElseSucceed(() => "nothing, since docker could not show its state or logs"));
+var randomHex2 = () => Array.from(crypto.getRandomValues(new Uint8Array(4)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+var dockerCheckDaemon = (input) => ({ id, network: allowed }) => gen(function* () {
+  const run = `${dockerName2(id)}-${randomHex2()}`;
+  const daemon = `kitman-check-docker-${run}`;
+  const network = `kitman-check-docker-net-${run}`;
+  const outside = `kitman-check-docker-out-${run}`;
+  const mirror = `kitman-check-docker-mirror-${run}`;
+  const proxyContainer = `kitman-check-docker-egress-${run}`;
+  const forwarder = `kitman-check-docker-api-${run}`;
+  const runLabel = "kitman.check-docker-run";
+  const labels = [
+    [CheckDockerLabel, input.runnerId],
+    [CheckDockerReplicaLabel, input.replicaId],
+    [runLabel, run]
+  ];
+  const labelArgs = labels.flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+  const docker = (args, timeout = "30 seconds") => runCommand2("docker", args, { timeout }).pipe(mapError2((error) => new CheckDockerUnavailable({ reason: error.message })));
+  yield* acquireRelease(void_3, () => gen(function* () {
+    const ids = (yield* docker(["ps", "--all", "--quiet", "--filter", `label=${runLabel}=${run}`])).split(`
+`).filter((line) => line.trim() !== "");
+    if (ids.length > 0)
+      yield* docker(["rm", "--force", "--volumes", ...ids], "2 minutes");
+    yield* ignore(docker(["network", "rm", network]));
+    yield* ignore(docker(["network", "rm", outside]));
+  }).pipe(ignore));
+  yield* docker(["network", "create", "--opt", "com.docker.network.bridge.enable_icc=false", ...labelArgs, outside]);
+  yield* docker(["network", "create", ...allowed === "open" ? [] : ["--internal"], ...labelArgs, network]);
+  const addressOn = (container) => gen(function* () {
+    yield* docker(["network", "connect", network, container]);
+    const address = (yield* docker([
+      "inspect",
+      "--format",
+      `{{(index .NetworkSettings.Networks "${network}").IPAddress}}`,
+      container
+    ])).trim();
+    if (address === "")
+      return yield* new CheckDockerUnavailable({ reason: `${container} has no address` });
+    return address;
+  });
+  const helper = (name, args) => docker(["run", "--detach", "--rm", "--name", name, ...labelArgs, "--network", outside, ...args], "30 minutes");
+  yield* docker(checkRegistryMirrorArgs({
+    name: mirror,
+    image: input.registryImage,
+    labels,
+    network: outside,
+    volume: checkRegistryCacheVolume(input.runnerId)
+  }), "30 minutes");
+  const mirrorUrl = `http://${yield* addressOn(mirror)}:${registryMirrorPort}`;
+  const proxy = allowed === "open" ? undefined : yield* gen(function* () {
+    yield* helper(proxyContainer, [
+      "--volume",
+      `${fileURLToPath2(import.meta.resolve("./egress-proxy.ts"))}:/kitman/egress-proxy.ts:ro`,
+      input.proxyImage ?? EgressProxyImage,
+      "bun",
+      "/kitman/egress-proxy.ts",
+      allowed.hosts.join(",")
+    ]);
+    return `http://${yield* addressOn(proxyContainer)}:${egressProxyPort}`;
+  });
+  yield* docker(checkDockerDaemonArgs({
+    name: daemon,
+    image: input.image,
+    labels,
+    network,
+    mirror: mirrorUrl,
+    ...proxy === undefined ? undefined : { proxy }
+  }), "30 minutes");
+  yield* helper(forwarder, [
+    "--publish",
+    `127.0.0.1::${checkDockerPort}`,
+    "--volume",
+    `${fileURLToPath2(import.meta.resolve("./tcp-forwarder.ts"))}:/kitman/tcp-forwarder.ts:ro`,
+    input.proxyImage ?? EgressProxyImage,
+    "bun",
+    "/kitman/tcp-forwarder.ts",
+    String(checkDockerPort),
+    checkDockerAlias,
+    String(checkDockerPort)
+  ]);
+  yield* docker(["network", "connect", network, forwarder]);
+  const hostPort = publishedPort(yield* docker(["port", forwarder, `${checkDockerPort}/tcp`]));
+  if (hostPort === undefined)
+    return yield* new CheckDockerUnavailable({ reason: "docker published no port" });
+  yield* docker(["--host", `tcp://127.0.0.1:${hostPort}`, "version", "--format", "{{.Server.Version}}"], "10 seconds").pipe(retry({ schedule: spaced("500 millis"), times: 240 }), catch_((error) => gen(function* () {
+    const logs = yield* daemonLogs(daemon);
+    return yield* new CheckDockerUnavailable({ reason: `${error.reason}; the daemon logged: ${logs}` });
+  })));
+  return { container: daemon, hostPort, ...proxy === undefined ? undefined : { proxy } };
 });
 // packages/agent-runtime/src/codex-hook-trust.ts
 class CodexAppServerFailed extends TaggedError("CodexAppServerFailed") {
@@ -5794,9 +5999,110 @@ var programProcessExecutor = (input) => (work) => gen(function* () {
   status: "deferred",
   crashed: `it did not start: ${error.message}`.slice(0, 500)
 })));
+// packages/agent-runtime/src/half-close-relay.ts
+import { once } from "events";
+import { connect as connect2, createServer as createServer2 } from "net";
+var frameHeader = 4;
+var endOfInput = Buffer.alloc(frameHeader);
+var maxFrame = 1024 * 1024;
+var keepUp = (from, to, accepted) => {
+  if (accepted)
+    return;
+  from.pause();
+  to.once("drain", () => from.resume());
+};
+var closeTogether = (...sockets) => sockets.forEach((socket) => {
+  socket.on("error", () => sockets.forEach((other) => other.destroy()));
+  socket.on("close", () => sockets.forEach((other) => other.end()));
+});
+var listening = (server, port) => once(server.listen(port, "127.0.0.1"), "listening").then(() => server);
+var startHalfCloseDecoder = (input) => listening(createServer2({ allowHalfOpen: true }, (client) => {
+  const upstream = connect2({ port: input.targetPort, host: "127.0.0.1", allowHalfOpen: true });
+  let pending = Buffer.alloc(0);
+  client.on("data", (chunk) => {
+    pending = Buffer.concat([pending, chunk]);
+    if (pending.length >= frameHeader && pending.readUInt32BE(0) > maxFrame)
+      return void client.destroy();
+    while (pending.length >= frameHeader && pending.length >= frameHeader + pending.readUInt32BE(0)) {
+      const length = pending.readUInt32BE(0);
+      if (length === 0)
+        upstream.end();
+      else
+        keepUp(client, upstream, upstream.write(pending.subarray(frameHeader, frameHeader + length)));
+      pending = pending.subarray(frameHeader + length);
+    }
+  });
+  client.on("end", () => upstream.end());
+  upstream.pipe(client);
+  closeTogether(client, upstream);
+}), input.port);
+if (false)
+  ;
+
 // packages/agent-runtime/src/verification-executor.ts
+import { fileURLToPath as fileURLToPath3 } from "url";
 var checkTimeout = "30 minutes";
 var checkFilesPerVerification = 50;
+var halfCloseEncoder = [process.execPath, fileURLToPath3(import.meta.resolve("./half-close-relay.ts"))];
+var srtDockerTunnel = (relayPort) => srtLoopbackTunnel({
+  service: "Docker daemon",
+  hostPort: relayPort,
+  listenPort: checkDockerPort,
+  listener: `${halfCloseEncoder.map(quoted).join(" ")} ${checkDockerPort} "$HTTP_PROXY" ${relayPort}`,
+  probe: String.raw`printf 'GET /_ping HTTP/1.0\r\n\r\n'`,
+  read: "tail -c 2",
+  answers: "OK"
+});
+var pipelineEnvironment = (docker, dockerHost) => ({
+  DOCKER_HOST: dockerHost,
+  DOCKER_CONFIG: `${docker.clientDir}/docker`,
+  GCL_HOME: `${docker.clientDir}/gitlab-ci-local-home`
+});
+var dockerRoute = (backend, docker) => {
+  if (docker === undefined)
+    return { env: {}, hosts: [], unixSockets: [], services: [], tunnel: undefined };
+  if (backend === "docker")
+    return {
+      env: {
+        ...pipelineEnvironment(docker, `tcp://${checkDockerAlias}:${checkDockerPort}`),
+        NO_PROXY: `localhost,127.0.0.1,${checkDockerAlias}`,
+        no_proxy: `localhost,127.0.0.1,${checkDockerAlias}`
+      },
+      hosts: [],
+      unixSockets: [],
+      services: [{ container: docker.container, alias: checkDockerAlias }],
+      tunnel: undefined
+    };
+  switch (docker.route.kind) {
+    case "socket":
+      return {
+        env: pipelineEnvironment(docker, `unix://${docker.route.dir}/docker.sock`),
+        hosts: [],
+        unixSockets: [docker.route.dir],
+        services: [],
+        tunnel: undefined
+      };
+    case "relay":
+      return {
+        env: pipelineEnvironment(docker, `tcp://127.0.0.1:${checkDockerPort}`),
+        hosts: [`127.0.0.1:${docker.route.port}`],
+        unixSockets: [],
+        services: [],
+        tunnel: srtDockerTunnel(docker.route.port)
+      };
+    case "direct":
+      throw new Error("A pipeline check in srt reaches its daemon through a socket or the relay, never directly.");
+  }
+};
+var hostCheckEnvironment = (docker) => {
+  const { POSTGRES_URL: _runnerDatabase, ...runner } = withoutPreloads2();
+  if (docker === undefined)
+    return runner;
+  return {
+    ...Object.fromEntries(Object.entries(runner).filter(([name]) => !name.startsWith("DOCKER_") && !name.startsWith("GCL_") && name !== "SSH_AUTH_SOCK")),
+    ...pipelineEnvironment(docker, `tcp://127.0.0.1:${docker.hostPort}`)
+  };
+};
 var postgresRoute = (backend, postgres) => {
   if (postgres === undefined)
     return { url: undefined, hosts: [], unixSockets: [], services: [], tunnel: undefined };
@@ -5824,12 +6130,13 @@ var postgresRoute = (backend, postgres) => {
     tunnel: srtPostgresTunnel(postgres.hostPort)
   };
 };
-var checkSandboxPolicy = (work, sandbox, checkout, cache, filesDir, postgresHosts) => ({
+var checkSandboxPolicy = (work, sandbox, checkout, cache, filesDir, postgresHosts, clientDir) => ({
   ...runnerStateSandboxPolicy(sandbox.runner, [
     repositoryClone(sandbox.runner.workRoot, work.repoBinding.id),
-    checkout
+    checkout,
+    ...clientDir === undefined ? [] : [clientDir, ...halfCloseEncoder]
   ]),
-  writablePaths: [checkout, cache, filesDir],
+  writablePaths: [checkout, cache, filesDir, ...clientDir === undefined ? [] : [clientDir]],
   network: verificationNetworkAllowlist({
     apiUrl: sandbox.apiUrl,
     storageOrigin: work.storageOrigin,
@@ -5839,16 +6146,15 @@ var checkSandboxPolicy = (work, sandbox, checkout, cache, filesDir, postgresHost
   environment: srtCacheEnvironment2(cache)
 });
 var checkGitEnvironment = { GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0" };
-var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command, cwd, filesDir, onOutput, postgres }) => {
+var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command, cwd, filesDir, onOutput, postgres, docker }) => {
   const env = { ...checkGitEnvironment, KITMAN_RUN_FILES_DIR: filesDir };
   const output = onOutput === undefined ? undefined : { onOutput };
   if (sandbox === undefined || sandbox.backend === undefined) {
-    const { POSTGRES_URL: _runnerDatabase, ...runner } = withoutPreloads2();
     return runShell2(command, {
       cwd,
       extendEnv: false,
       env: {
-        ...runner,
+        ...hostCheckEnvironment(docker),
         ...env,
         ...postgres === undefined ? undefined : { POSTGRES_URL: checkPostgresUrl(postgres, "127.0.0.1", postgres.hostPort) }
       },
@@ -5857,14 +6163,18 @@ var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command,
     });
   }
   const route = postgresRoute(sandbox.backend, postgres);
-  const policy = checkSandboxPolicy(work, sandbox, checkout, cache, filesDir, route.hosts);
+  const daemon = dockerRoute(sandbox.backend, docker);
+  const policy = checkSandboxPolicy(work, sandbox, checkout, cache, filesDir, [...route.hosts, ...daemon.hosts], docker?.clientDir);
+  const [tunnel, ...innerTunnels] = [route.tunnel, daemon.tunnel].filter((script) => script !== undefined);
+  const tunnelled = innerTunnels.reduceRight((inner, script) => `sh -c ${quoted(script)} sh ${quoted(inner)}`, command);
   const sandboxCommand = {
-    argv: route.tunnel === undefined ? ["sh", "-c", command] : ["sh", "-c", route.tunnel, "sh", command],
+    argv: tunnel === undefined ? ["sh", "-c", command] : ["sh", "-c", tunnel, "sh", tunnelled],
     cwd,
     env: {
       ...env,
       KITMAN_CHECK_SANDBOX: sandbox.backend,
-      ...route.url === undefined ? undefined : { POSTGRES_URL: route.url }
+      ...route.url === undefined ? undefined : { POSTGRES_URL: route.url },
+      ...daemon.env
     },
     timeout: checkTimeout,
     ...output
@@ -5873,7 +6183,7 @@ var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command,
     backend: "srt",
     policy,
     command: { ...sandboxCommand, env: { ...inherited, ...sandboxCommand.env }, extendEnv: false },
-    unixSockets: route.unixSockets,
+    unixSockets: [...route.unixSockets, ...daemon.unixSockets],
     ...sandbox.srtCommand === undefined ? undefined : { srtCommand: sandbox.srtCommand }
   }) : runSandboxCommand({
     backend: "docker",
@@ -5883,7 +6193,7 @@ var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command,
     readOnlyPaths: [repositoryClone(sandbox.runner.workRoot, work.repoBinding.id)],
     policy,
     command: sandboxCommand,
-    services: route.services
+    services: [...route.services, ...daemon.services]
   });
 };
 var regularFiles = (dir) => gen(function* () {
@@ -5937,6 +6247,38 @@ var checkoutPostgres = (worktree, services) => gen(function* () {
     });
   return yield* services.postgres(services.id).pipe(mapError2((error) => new ServicesUnavailable({ reason: error.message })));
 });
+var decodeListeningPort = decodeUnknownEffect2(Struct({ port: Finite }));
+var pipelineDaemon = (services, check) => gen(function* () {
+  if (services.docker === undefined)
+    return yield* new ServicesUnavailable({
+      reason: `The pipeline check ${check} runs with a Docker daemon of its own, and this Runner cannot start one: set KITMAN_RUNNER_CHECK_DOCKER_IMAGE to a docker:*-dind-rootless image and KITMAN_RUNNER_CHECK_REGISTRY_IMAGE to a registry:3 image, each pinned by digest.`
+    });
+  const fs = yield* FileSystem;
+  const started = yield* services.docker({ id: services.id, network: services.network }).pipe(mapError2((error) => new ServicesUnavailable({ reason: error.message })));
+  const clientDir = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-check-docker-" });
+  yield* fs.makeDirectory(`${clientDir}/docker`);
+  yield* fs.makeDirectory(`${clientDir}/gitlab-ci-local-home`);
+  yield* fs.writeFileString(`${clientDir}/docker/config.json`, encodeUnknownJsonStringSync(checkDockerClientConfig(started.proxy)));
+  if (services.backend !== "srt")
+    return { ...started, clientDir, route: { kind: "direct" } };
+  if (services.platform !== "darwin") {
+    const relay = yield* acquireRelease(promise(() => startHalfCloseDecoder({ port: 0, targetPort: started.hostPort })), (server) => sync2(() => server.close()));
+    const { port } = yield* decodeListeningPort(relay.address()).pipe(mapError2(() => new ServicesUnavailable({
+      reason: `The pipeline check ${check} cannot reach its Docker daemon: its relay has no port`
+    })));
+    return { ...started, clientDir, route: { kind: "relay", port } };
+  }
+  return {
+    ...started,
+    clientDir,
+    route: {
+      kind: "socket",
+      dir: yield* loopbackSocketForwarder(started.hostPort, "docker.sock").pipe(mapError2((error) => new ServicesUnavailable({
+        reason: `The pipeline check ${check} cannot reach its Docker daemon: ${error.reason}`
+      })))
+    }
+  };
+});
 var reachCheckPostgres = (postgres, services, worktree, run) => gen(function* () {
   if (services.backend !== "srt")
     return postgres;
@@ -5985,11 +6327,13 @@ var runChecks = (worktree, checks, tree, known, run, keeper, services) => gen(fu
     const filesDir = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-check-files-" });
     const output = path.join(yield* fs.makeTempDirectoryScoped({ prefix: "kitman-check-output-" }), "output");
     const sink = keeper === undefined ? undefined : yield* fs.open(output, { flag: "w" });
+    const docker = check.pipeline === true ? yield* pipelineDaemon(services, check.name) : undefined;
     const ran = yield* run({
       command: check.command,
       cwd: path.join(worktree, check.workingDirectory ?? "."),
       filesDir,
       ...postgres === undefined ? undefined : { postgres },
+      ...docker === undefined ? undefined : { docker },
       ...sink === undefined ? undefined : { onOutput: (chunk) => sink.writeAll(chunk) }
     });
     const durationMs = (yield* currentTimeMillis) - startedAt;
@@ -6088,6 +6432,27 @@ var measureRevisions = (work, measure, checkouts, runIn) => gen(function* () {
     }
   };
 });
+var ownRepository = (worktree, clone, targetBranch) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const scratch = yield* fs.makeTempDirectoryScoped({
+    directory: path.dirname(worktree),
+    prefix: "kitman-check-git-"
+  });
+  const gitDir = path.join(scratch, "git");
+  const git = (...args) => runCommand2("git", ["--git-dir", gitDir, ...args]);
+  const revision = (yield* runCommand2("git", ["-C", worktree, "rev-parse", "HEAD"])).trim();
+  const originUrl = (yield* runCommand2("git", ["-C", clone, "config", "--get", "remote.origin.url"])).trim();
+  yield* runCommand2("git", ["clone", "--quiet", "--bare", "--no-hardlinks", clone, gitDir]);
+  yield* git("fetch", "--quiet", clone, "+refs/remotes/origin/*:refs/remotes/origin/*");
+  yield* git("config", "core.bare", "false");
+  yield* git("remote", "set-url", "origin", originUrl);
+  yield* git("symbolic-ref", "refs/remotes/origin/HEAD", `refs/remotes/origin/${targetBranch}`);
+  yield* git("update-ref", "--no-deref", "HEAD", revision);
+  yield* fs.remove(path.join(worktree, ".git"));
+  yield* fs.rename(gitDir, path.join(worktree, ".git"));
+  yield* runCommand2("git", ["-C", worktree, "reset", "--quiet"]);
+}).pipe(scoped);
 var treeOf = (worktree) => map8(runCommand2("git", ["-C", worktree, "rev-parse", "HEAD^{tree}"]), (tree) => tree.trim());
 var verificationExecutor = (input) => (work) => gen(function* () {
   if (input.sandbox !== undefined && input.sandbox.backend === undefined)
@@ -6113,15 +6478,22 @@ var verificationExecutor = (input) => (work) => gen(function* () {
   }, work.repoBinding);
   const pipelineOnly = work.checks.every((check) => check.pipeline === true);
   const baseline = pipelineOnly ? head : yield* baselineAt(work.baseline).pipe(catch_(() => baselineAt()));
+  if (work.checks.some((check) => check.pipeline === true))
+    yield* ownRepository(head, repositoryClone(input.rootDir, work.repoBinding.id), work.repoBinding.defaultTargetBranch);
   const headTree = yield* treeOf(head);
   const baselineTree = yield* treeOf(baseline);
   const trees = headTree === baselineTree ? [headTree] : [headTree, baselineTree];
   const known = yield* input.known(work, trees);
+  const sandbox = input.sandbox;
+  const checkNetwork = sandbox === undefined || sandbox.backend === undefined ? "open" : checkSandboxPolicy(work, sandbox, head, cache, cache, []).network;
+  const daemonNetwork = checkNetwork === "open" ? "open" : { hosts: checkNetwork.hosts };
   const services = (id) => ({
     id,
     backend: input.sandbox?.backend,
     platform: (input.sandbox?.backend === "srt" ? input.sandbox.platform : undefined) ?? process.platform,
-    postgres: input.postgres
+    postgres: input.postgres,
+    docker: input.docker,
+    network: daemonNetwork
   });
   const headChecks = yield* runChecks(head, work.checks, headTree, known, runIn(head), keeper(""), services(work.id)).pipe(scoped);
   return {
@@ -6136,7 +6508,7 @@ var verificationExecutor = (input) => (work) => gen(function* () {
         baseline: {
           revision: (yield* runCommand2("git", ["-C", baseline, "rev-parse", "HEAD"])).trim(),
           tree: baselineTree,
-          checks: yield* runChecks(baseline, work.checks, baselineTree, known, runIn(baseline), keeper("baseline-"), services(`${work.id}-baseline`)).pipe(scoped)
+          checks: yield* runChecks(baseline, work.checks.filter((check) => check.pipeline !== true), baselineTree, known, runIn(baseline), keeper("baseline-"), services(`${work.id}-baseline`)).pipe(scoped)
         }
       }
     }
@@ -6160,11 +6532,13 @@ export {
   AgentRuntimePackageName,
   AgentStepFailure,
   BundleRefused,
+  CheckDockerUnavailable,
   CheckPostgresImage,
   CheckPostgresUnavailable,
   CommandFailed2 as CommandFailed,
   CommandRunner2 as CommandRunner,
   ContainerError,
+  DockerHubRegistry,
   EgressProxyImage,
   HERDR_CORE_GENERATION2 as HERDR_CORE_GENERATION,
   HERDR_CORE_INSTALL_COMMAND2 as HERDR_CORE_INSTALL_COMMAND,
@@ -6188,11 +6562,18 @@ export {
   applyAgentEnvironmentMaterialization2 as applyAgentEnvironmentMaterialization,
   applyAgentEnvironmentPlans,
   assertHerdrRunnerCapability2 as assertHerdrRunnerCapability,
+  checkDockerAlias,
+  checkDockerClientConfig,
+  checkDockerDaemonArgs,
+  checkDockerPort,
+  checkDockerProxyEnvironment,
   checkPostgresAlias,
   checkPostgresSandboxPort,
   checkPostgresSocketUrl,
   checkPostgresSweepInterval,
   checkPostgresUrl,
+  checkRegistryCacheVolume,
+  checkRegistryMirrorArgs,
   clearSettledCheckpoints,
   commandHostProbe,
   compiled2 as compiled,
@@ -6200,6 +6581,7 @@ export {
   controlFailureKind,
   defaultAgentRuntimeUserConfigPath,
   detectHarnesses2 as detectHarnesses,
+  dockerCheckDaemon,
   dockerCheckPostgres,
   dockerContainerRunner,
   dockerExecArgv,
@@ -6237,6 +6619,7 @@ export {
   liveReplicaIds,
   loadAgentRuntimeConfig,
   makeReplicaSignals,
+  orphanedCheckDocker,
   orphanedCheckPostgres,
   pinnedSrtCommand2 as pinnedSrtCommand,
   pinnedSrtStepCommand2 as pinnedSrtStepCommand,
@@ -6251,6 +6634,7 @@ export {
   publishedPort,
   readManifestSkillPaths2 as readManifestSkillPaths,
   refuseAgentRequest,
+  removeCheckDocker,
   removeCheckPostgres,
   removeRunnerContainers,
   removeRunnerTerminals,

package/dist/{chunk-y48wz1sa.js → chunk-dj7pp4w4.js}

@@ -496,6 +496,12 @@ var sandboxMissing = (sandbox, missing) => ({
 });
 var personalCheckBackend = (agentSandbox, dockerAvailable) => agentSandbox === "srt" || agentSandbox === "docker" && dockerAvailable ? agentSandbox : undefined;
 var checkHostsSetting = (value) => (value ?? "").split(",").map((host) => host.trim()).filter((host) => host !== "");
+var pinnedImage = (value) => {
+  const image = value?.trim();
+  return image !== undefined && /@sha256:[a-f0-9]{64}$/.test(image) ? image : undefined;
+};
+var checkDockerImageSetting = pinnedImage;
+var checkRegistryImageSetting = pinnedImage;
 var herdrCoreSession = (runnerId, personal) => personal ? undefined : `kitman-${sha2562(runnerId).slice(0, 16)}`;
 var OpenHerdrCore = Reference("kitman/cli/OpenHerdrCore", {
   defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-mtgkvbk4.js")), ({ HerdrCore, herdrCoreLayer }) => provide3(service(HerdrCore), herdrCoreLayer(options)))
@@ -1645,7 +1651,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.10.54";
+var cliVersion = "0.10.55";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1894,7 +1900,7 @@ var Usage = [
   "Every run, loop, agent, verify, constraint, secret, claim, deploy, dev and kit command takes --json."
 ].join(`
 `);
-var agentRuntime = promise(() => import("./chunk-c0wrcam4.js"));
+var agentRuntime = promise(() => import("./chunk-dgb6s5vq.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -2762,7 +2768,9 @@ var runnerSettings = gen(function* () {
     sshAgentAvailable: (yield* optional("SSH_AUTH_SOCK")) !== undefined,
     sandbox,
     dockerImage: yield* optional("KITMAN_RUNNER_DOCKER_IMAGE"),
-    checkHosts: checkHostsSetting(yield* optional("KITMAN_RUNNER_CHECK_HOSTS"))
+    checkHosts: checkHostsSetting(yield* optional("KITMAN_RUNNER_CHECK_HOSTS")),
+    checkDockerImage: checkDockerImageSetting(yield* optional("KITMAN_RUNNER_CHECK_DOCKER_IMAGE")),
+    checkRegistryImage: checkRegistryImageSetting(yield* optional("KITMAN_RUNNER_CHECK_REGISTRY_IMAGE"))
   };
 });
 var herdrRunnerRootDir = gen(function* () {
@@ -2787,8 +2795,10 @@ function startCanonicalHerdrRunnerCommand(input) {
       HerdrCore,
       herdrCoreAgentBackendLayer,
       detectHarnesses,
+      dockerCheckDaemon,
       dockerCheckPostgres,
       liveReplicaIds,
+      removeCheckDocker,
       removeCheckPostgres,
       checkPostgresSweepInterval,
       herdrRunnerCapabilities,
@@ -3016,7 +3026,9 @@ function startCanonicalHerdrRunnerCommand(input) {
         const removeOrphanedCheckPostgres = gen(function* () {
           const now = yield* currentTimeMillis;
           const { items } = yield* controlPlane.client.listRunnerReplicas(input.runnerId);
-          yield* removeCheckPostgres(input.runnerId, liveReplicaIds(items, replica.id, now));
+          const live = liveReplicaIds(items, replica.id, now);
+          yield* removeCheckPostgres(input.runnerId, live);
+          yield* removeCheckDocker(input.runnerId, live);
         }).pipe(ignore);
         yield* removeOrphanedCheckPostgres;
         yield* removeOrphanedCheckPostgres.pipe(delay(checkPostgresSweepInterval), forever, forkScoped);
@@ -3026,6 +3038,14 @@ function startCanonicalHerdrRunnerCommand(input) {
           gitCredentials: rpc.gitCredential,
           runFiles: { client: rpc, storage },
           postgres: dockerCheckPostgres(input.runnerId, replica.id),
+          ...settings.checkDockerImage === undefined || settings.checkRegistryImage === undefined ? undefined : {
+            docker: dockerCheckDaemon({
+              runnerId: input.runnerId,
+              replicaId: replica.id,
+              image: settings.checkDockerImage,
+              registryImage: settings.checkRegistryImage
+            })
+          },
           ...checkSandbox === undefined ? undefined : { sandbox: { ...checkSandbox, apiUrl: input.apiUrl, hosts: settings.checkHosts } }
         });
         const control = (capacitySlot) => {
@@ -4312,9 +4332,9 @@ function claimCommand(args) {
     }
   });
 }
-var KitWriter = map8(promise(() => import("./chunk-my987gxf.js")), (build) => build.writeKit);
+var KitWriter = map8(promise(() => import("./chunk-axdmbr61.js")), (build) => build.writeKit);
 var KitBuilder = Reference("kitman/cli/KitBuilder", {
-  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-my987gxf.js")), (build) => build.buildKit(directory))
+  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-axdmbr61.js")), (build) => build.buildKit(directory))
 });
 var uploadKit = (client, workspaceId, built) => gen(function* () {
   yield* client.uploadKitBundle(workspaceId, built.digest, { bundle: encode2(built.bundle) });

package/dist/egress-proxy.ts

@@ -1,6 +1,6 @@
 // Runs alone inside the egress proxy container, so it imports nothing outside Node.
 import { once } from 'node:events'
-import { connect, createServer, type Server, type Socket } from 'node:net'
+import { connect, createServer, type LookupFunction, type Server, type Socket } from 'node:net'
 
 /** Whether the allowlist takes `host:port`: an entry `host` takes any port, `host:port` one, `*.domain` subdomains. */
 export const egressAllowed = (hosts: readonly string[], host: string, port: number) => {
@@ -39,7 +39,93 @@ const httpTarget = (absolute: string) => {
 
 const answer = (socket: Socket, status: string) => socket.end(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`)
 
-const handle = (hosts: readonly string[]) => (client: Socket) => {
+/** Takes the next bytes a client sends: how many of them belong to the request body, and whether the body has ended. */
+type BodyFraming = (chunk: Buffer) => { readonly used: number; readonly done: boolean } | 'malformed'
+
+const countedBody = (length: number): BodyFraming => {
+  let remaining = length
+
+  return chunk => {
+    const used = Math.min(remaining, chunk.length)
+    remaining -= used
+
+    return { used, done: remaining === 0 }
+  }
+}
+
+const chunkedBody = (): BodyFraming => {
+  let state: 'size' | 'data' | 'trailer' | 'done' = 'size'
+  let line = ''
+  // The chunk's data and the CRLF after it.
+  let remaining = 0
+
+  return chunk => {
+    let index = 0
+
+    while (index < chunk.length && state !== 'done') {
+      if (state === 'data') {
+        const used = Math.min(remaining, chunk.length - index)
+        index += used
+        remaining -= used
+
+        if (remaining === 0) state = 'size'
+
+        continue
+      }
+
+      const byte = chunk[index++]
+
+      if (byte !== 0x0a) {
+        line += String.fromCharCode(byte ?? 0)
+
+        if (line.length > 4_096) return 'malformed'
+
+        continue
+      }
+
+      const content = line.trim()
+      line = ''
+
+      if (state === 'trailer') {
+        if (content === '') state = 'done'
+        continue
+      }
+
+      const hex = content.split(';')[0]?.trim() ?? ''
+
+      if (!/^[0-9a-f]+$/i.test(hex)) return 'malformed'
+
+      const size = Number.parseInt(hex, 16)
+
+      if (size === 0) state = 'trailer'
+      else {
+        remaining = size + 2
+        state = 'data'
+      }
+    }
+
+    return { used: index, done: state === 'done' }
+  }
+}
+
+const requestBody = (headers: readonly string[]): BodyFraming | 'malformed' => {
+  const value = (name: string) =>
+    headers.flatMap(line => (line.toLowerCase().startsWith(`${name}:`) ? [line.slice(name.length + 1).trim()] : []))
+
+  const transferEncoding = value('transfer-encoding').join(',').toLowerCase()
+
+  if (transferEncoding !== '') return /(^|,)\s*chunked\s*$/.test(transferEncoding) ? chunkedBody() : 'malformed'
+
+  const lengths = [...new Set(value('content-length'))]
+
+  if (lengths.length === 0) return countedBody(0)
+
+  const [length = ''] = lengths
+
+  return lengths.length === 1 && /^\d+$/.test(length) ? countedBody(Number(length)) : 'malformed'
+}
+
+const handle = (hosts: readonly string[], lookup: LookupFunction | undefined) => (client: Socket) => {
   let head = Buffer.alloc(0)
 
   const onData = (chunk: Buffer) => {
@@ -48,6 +134,8 @@ const handle = (hosts: readonly string[]) => (client: Socket) => {
 
     if (end === -1) return head.length > 16_384 ? answer(client, '431 Request Header Fields Too Large') : undefined
     client.off('data', onData)
+    // What a pipelining client sends next arrives while the proxy connects, and a flowing socket would drop it.
+    client.pause()
 
     const [requestLine = '', ...headers] = head.subarray(0, end).toString().split('\r\n')
     const [method = '', target = '', version = 'HTTP/1.1'] = requestLine.split(' ')
@@ -57,30 +145,57 @@ const handle = (hosts: readonly string[]) => (client: Socket) => {
 
     if (!egressAllowed(hosts, destination.host, destination.port)) return answer(client, '403 Forbidden')
 
-    const upstream = connect(destination.port, destination.host, () => {
-      if (!('path' in destination)) {
-        client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
-        upstream.write(head.subarray(end + 4))
-      } else {
-        // One request per connection: a reused one could carry a request for another host to this one.
+    const framing = 'path' in destination ? requestBody(headers) : undefined
+
+    if (framing === 'malformed') return answer(client, '400 Bad Request')
+
+    const request = 'path' in destination && framing !== undefined ? { path: destination.path, framing } : undefined
+
+    const upstream = connect(
+      { port: destination.port, host: destination.host, ...(lookup === undefined ? undefined : { lookup }) },
+      () => {
+        if (request === undefined) {
+          client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+          upstream.write(head.subarray(end + 4))
+          client.pipe(upstream)
+          upstream.pipe(client)
+          client.resume()
+
+          return
+        }
+
+        // One request per connection, and the client's connection ends with its response: a reused one could
+        // carry a request for another host to this one, and a pipelined one would mismatch the answers.
         const kept = headers.filter(line => !/^(proxy-)?connection:/i.test(line))
+        upstream.write([[method, request.path, version].join(' '), ...kept, 'Connection: close', '', ''].join('\r\n'))
 
-        upstream.write(
-          Buffer.concat([
-            Buffer.from(
-              [[method, destination.path, version].join(' '), ...kept, 'Connection: close', '', ''].join('\r\n')
-            ),
-            head.subarray(end + 4)
-          ])
-        )
-      }
+        let bodyDone = false
 
-      client.pipe(upstream)
-      upstream.pipe(client)
-    })
+        const forward = (chunk: Buffer) => {
+          if (bodyDone) return
+
+          const framed = request.framing(chunk)
+
+          if (framed === 'malformed') return client.destroy()
+
+          bodyDone = framed.done
+
+          if (upstream.write(chunk.subarray(0, framed.used))) return
+          client.pause()
+          upstream.once('drain', () => client.resume())
+        }
+
+        // Pipelined requests after the body are dropped; the client sends them again on a new connection.
+        client.on('data', forward)
+        upstream.pipe(client)
+        client.resume()
+        forward(head.subarray(end + 4))
+      }
+    )
 
     upstream.on('error', () => (client.writable ? answer(client, '502 Bad Gateway') : client.destroy()))
     client.on('error', () => upstream.destroy())
+    client.on('close', () => upstream.destroy())
   }
 
   client.on('data', onData)
@@ -92,8 +207,10 @@ export const startEgressProxy = (input: {
   readonly hosts: readonly string[]
   readonly port: number
   readonly hostname: string
+  /** How it resolves a host, if not as the system does. */
+  readonly lookup?: LookupFunction
 }): Promise<Server> => {
-  const server = createServer(handle(input.hosts)).listen(input.port, input.hostname)
+  const server = createServer(handle(input.hosts, input.lookup)).listen(input.port, input.hostname)
 
   return once(server, 'listening').then(() => server)
 }

package/dist/half-close-relay.ts

@@ -0,0 +1,125 @@
+// Runs alone inside a pipeline check's sandbox too, so it imports nothing outside Node.
+import { once } from 'node:events'
+import { connect, createServer, type Server, type Socket } from 'node:net'
+
+/**
+ * srt's proxy closes a connection once its client stops sending, and a Docker client attached to a job stops before
+ * the job prints anything. So the encoder inside the sandbox never stops sending: it sends what its client sends as
+ * frames, each a 4-byte big-endian length and that many bytes, and the client's end as a frame of length 0. The
+ * decoder outside the sandbox turns that frame back into the end of what it sends on.
+ */
+const frameHeader = 4
+
+const frame = (chunk: Buffer) => {
+  const header = Buffer.alloc(frameHeader)
+
+  header.writeUInt32BE(chunk.length)
+
+  return Buffer.concat([header, chunk])
+}
+
+const endOfInput = Buffer.alloc(frameHeader)
+
+/** Far more than the one socket chunk the encoder frames; a longer frame is not the encoder's. */
+export const maxFrame = 1024 * 1024
+
+/** Holds `from` until `to` has caught up, when a write to `to` was `accepted` only into its buffer. */
+const keepUp = (from: Socket, to: Socket, accepted: boolean) => {
+  if (accepted) return
+  from.pause()
+  to.once('drain', () => from.resume())
+}
+
+/** Ends each of `sockets` once another has closed, after what it holds is sent, and destroys them all if one fails. */
+const closeTogether = (...sockets: readonly Socket[]) =>
+  sockets.forEach(socket => {
+    socket.on('error', () => sockets.forEach(other => other.destroy()))
+    socket.on('close', () => sockets.forEach(other => other.end()))
+  })
+
+const listening = (server: Server, port: number) =>
+  once(server.listen(port, '127.0.0.1'), 'listening').then(() => server)
+
+/** Serves `port` outside the sandbox, sending each connection's frames on to `127.0.0.1:<targetPort>`. */
+export const startHalfCloseDecoder = (input: { readonly port: number; readonly targetPort: number }) =>
+  listening(
+    createServer({ allowHalfOpen: true }, client => {
+      const upstream = connect({ port: input.targetPort, host: '127.0.0.1', allowHalfOpen: true })
+      let pending: Buffer = Buffer.alloc(0)
+
+      client.on('data', (chunk: Buffer) => {
+        pending = Buffer.concat([pending, chunk])
+
+        if (pending.length >= frameHeader && pending.readUInt32BE(0) > maxFrame) return void client.destroy()
+
+        while (pending.length >= frameHeader && pending.length >= frameHeader + pending.readUInt32BE(0)) {
+          const length = pending.readUInt32BE(0)
+
+          if (length === 0) upstream.end()
+          else keepUp(client, upstream, upstream.write(pending.subarray(frameHeader, frameHeader + length)))
+          pending = pending.subarray(frameHeader + length)
+        }
+      })
+      client.on('end', () => upstream.end())
+      upstream.pipe(client)
+      closeTogether(client, upstream)
+    }),
+    input.port
+  )
+
+/** `host` as `net.connect` takes it: a URL writes an IPv6 address in brackets. */
+const unbracketed = (host: string) => host.replace(/^\[(.*)\]$/, '$1')
+
+/**
+ * Serves `port` inside the sandbox, sending each connection through `proxy` to the decoder on the Runner's
+ * `127.0.0.1:<targetPort>`, as frames.
+ */
+export const startHalfCloseEncoder = (input: {
+  readonly port: number
+  readonly proxy: string
+  readonly targetPort: number
+}) => {
+  const proxy = new URL(input.proxy)
+  const target = `127.0.0.1:${input.targetPort}`
+
+  const credential =
+    proxy.username === ''
+      ? ''
+      : `Proxy-Authorization: Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`).toString('base64')}\r\n`
+
+  return listening(
+    createServer({ allowHalfOpen: true }, client => {
+      client.pause()
+      const upstream = connect({ port: Number(proxy.port === '' ? 80 : proxy.port), host: unbracketed(proxy.hostname) })
+      let head = Buffer.alloc(0)
+
+      const onHead = (chunk: Buffer) => {
+        head = Buffer.concat([head, chunk])
+        const end = head.indexOf('\r\n\r\n')
+
+        if (end === -1) return
+        upstream.off('data', onHead)
+
+        if (!/^HTTP\/1\.[01] 200/.test(head.toString('latin1', 0, end))) return void upstream.destroy()
+        client.write(head.subarray(end + 4))
+        upstream.pipe(client)
+        client.on('data', (chunk: Buffer) => keepUp(client, upstream, upstream.write(frame(chunk))))
+        client.on('end', () => upstream.write(endOfInput))
+        client.resume()
+      }
+
+      upstream.on('data', onHead)
+      upstream.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n${credential}\r\n`)
+      closeTogether(client, upstream)
+    }),
+    input.port
+  )
+}
+
+// `bun half-close-relay.ts <port> <proxy URL> <decoder port>`, inside srt.
+if (import.meta.main)
+  await startHalfCloseEncoder({
+    port: Number(Bun.argv[2]),
+    proxy: Bun.argv[3] ?? '',
+    targetPort: Number(Bun.argv[4])
+  })

package/dist/index.js

@@ -8,12 +8,12 @@ if (args[0] === "srt") {
   const { runSrtCli } = await import("./chunk-wczs5vrq.js");
   await runSrtCli();
 } else if (args[0] === "srt-step") {
-  const { runSrtStep } = await import("./chunk-19aqk325.js");
+  const { runSrtStep } = await import("./chunk-99ver3za.js");
   await runSrtStep(args.slice(1));
 } else if (args[0] === "opencode-read") {
   const { runOpencodeReader } = await import("./chunk-rjfxnk05.js");
   runOpencodeReader();
 } else {
-  const { runCli } = await import("./chunk-y48wz1sa.js");
+  const { runCli } = await import("./chunk-dj7pp4w4.js");
   runCli(args);
 }

package/dist/tcp-forwarder.ts

@@ -0,0 +1,29 @@
+// Runs alone inside a check Docker daemon's API forwarder container, so it imports nothing outside Node.
+import { once } from 'node:events'
+import { connect, createServer, type Server } from 'node:net'
+
+/** Forwards each connection to `port` on to `target:targetPort`, and only there. */
+export const startTcpForwarder = (input: {
+  readonly port: number
+  readonly target: string
+  readonly targetPort: number
+}): Promise<Server> => {
+  // A Docker client attached to a container stops sending long before the container's output ends.
+  const server = createServer({ allowHalfOpen: true }, client => {
+    const upstream = connect({ port: input.targetPort, host: input.target, allowHalfOpen: true })
+
+    client.pipe(upstream)
+    upstream.pipe(client)
+    client.on('error', () => upstream.destroy())
+    upstream.on('error', () => client.destroy())
+  }).listen(input.port, '0.0.0.0')
+
+  return once(server, 'listening').then(() => server)
+}
+
+if (import.meta.main)
+  await startTcpForwarder({
+    port: Number(Bun.argv[2]),
+    target: Bun.argv[3] ?? '',
+    targetPort: Number(Bun.argv[4])
+  })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/cli",
-  "version": "0.10.54",
+  "version": "0.10.55",
   "type": "module",
   "license": "UNLICENSED",
   "bin": {