@outerlayer/cli 0.10.2 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @outerlayer/cli
 
+## 0.11.0
+
+### Minor Changes
+
+- b248d4f: A container or microVM build now checks out every repository connected to the factory. The primary stays at `/build/work/checkout`, and each other repository is cloned to `/build/work/repos/<owner>/<repo>` on its claim branch. `OUTERLAYER_REPOSITORIES` lists each repository with its path, branch and whether it is primary. `outerlayer work open-pr --repository <owner/name>` opens a pull request in any repository the claim names. The runner protocol is now 16: a gateway refuses an older runner a claim over more than one repository.
+- 4b30f06: A runner with an update pending now keeps taking work while a build runs, and updates the first time no build is running. It holds new work only when the gateway refuses its version or the update has waited longer than `runner.update.maxWaitHours` (default 6, `0` holds at once). The runner logs when an update is pending and when it starts holding work, and `outerlayer runner status` shows the pending version and the builds the runner waits for.
+
 ## 0.10.2
 
 ### Patch Changes

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-07T19:14:32.738Z+adc613b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-07T20:56:19.457Z+b4e50a8","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-EVO6F2NO.js → builder-PP436VGZ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-JSUUXA5W.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-CJGQQZWB.js';
 import './chunk-CX22S5BA.js';
 import './chunk-IU4NZROR.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-YT35WGIP.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-ZM2IMMYN.js';

package/dist/{check-NQYQHITZ.js → check-YDXOLVJ5.js}

@@ -1,35 +1,36 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-ERHJETKP.js';
+import { probeCredentials } from './chunk-3YFCWYBU.js';
+import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-I2UOAV7X.js';
 import './chunk-YETTWTAY.js';
-import './chunk-KZ5M4QOB.js';
+import './chunk-BHOBM3IZ.js';
 import './chunk-T6OIJQRT.js';
-import './chunk-PDTSUOVT.js';
-import './chunk-UGP76IZ5.js';
+import './chunk-FI5UYJMQ.js';
+import './chunk-O765JR4W.js';
 import './chunk-HKUH5AR2.js';
-import './chunk-V42JY4F6.js';
+import './chunk-HYZRY4KZ.js';
 import './chunk-Y6P5XX2B.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-ESZJ5QIC.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-R7BJYFD2.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-MC6J453K.js';
-import './chunk-472KC6JV.js';
-import './chunk-BREEX2Z7.js';
+import './chunk-7C4T5BGN.js';
+import './chunk-BEZSECPA.js';
+import './chunk-E5DC4VZL.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
 import './chunk-JKIWMRFH.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-VVIRHTH4.js';
+import './chunk-2GBCTEN4.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-JSUUXA5W.js';
+import './chunk-CJGQQZWB.js';
 import './chunk-CX22S5BA.js';
-import './chunk-6CXYORUS.js';
-import './chunk-S6IUUNCD.js';
+import './chunk-QKFB4K7X.js';
+import './chunk-RSNSZ2LJ.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-DTDZXDQ3.js';
@@ -41,10 +42,10 @@ import './chunk-IU4NZROR.js';
 import './chunk-USO2DKBD.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-M2PBLRB7.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-XR3BJN33.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';

package/dist/{chunk-VVIRHTH4.js → chunk-2GBCTEN4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-JSUUXA5W.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-CJGQQZWB.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-ERHJETKP.js → chunk-3YFCWYBU.js}

@@ -1,25 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-KZ5M4QOB.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-BHOBM3IZ.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
-import { RUNNER_PROTOCOL } from './chunk-PDTSUOVT.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-ESZJ5QIC.js';
+import { RUNNER_PROTOCOL } from './chunk-FI5UYJMQ.js';
+import { writePendingUpdate } from './chunk-O765JR4W.js';
+import { placeholderQueues, placeholderProblem } from './chunk-R7BJYFD2.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-BREEX2Z7.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-E5DC4VZL.js';
 import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-VVIRHTH4.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-JSUUXA5W.js';
+import { spawnRun } from './chunk-2GBCTEN4.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-CJGQQZWB.js';
 import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DTDZXDQ3.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-M2PBLRB7.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-XR3BJN33.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
-import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-M6G7TJVF.js';
+import { parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { parseClaimIdentity } from './chunk-BYT5O5RV.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-V7NIVOFD.js';
@@ -950,12 +951,19 @@ function considerNamedVersion(state, named) {
   });
   const updating = decision === "update" && !retryHeld(state, named);
   state.pendingUpdate = updating ? named : void 0;
+  if (!updating) clearUpdateWait(state);
   if (!updating || state.preflightedUpdate !== named) state.preflightedUpdate = void 0;
   if (decision === "cannot_self_update" && !state.cannotSelfUpdateLogged && installedSwitchOf(state, update).kind !== "restart") {
     state.cannotSelfUpdateLogged = true;
     logOf(state).line(`this runner cannot update itself to ${named}: ${blocker}`);
   }
 }
+function adoptUpdateWait(state, version) {
+  const previous = state.updateWait;
+  const wait = { version, sinceMs: previous?.sinceMs ?? nowOf(state).getTime(), holdSinceMs: previous?.holdSinceMs };
+  state.updateWait = wait;
+  return wait;
+}
 function retryHeld(state, version) {
   return state.updateRetry?.version === version && nowOf(state).getTime() < state.updateRetry.retryAtMs;
 }
@@ -972,6 +980,68 @@ function updateArgsOf(state, update, version) {
 function dropPendingUpdate(state) {
   state.pendingUpdate = void 0;
   state.preflightedUpdate = void 0;
+  clearUpdateWait(state);
+}
+function clearUpdateWait(state) {
+  state.updateWait = void 0;
+  state.updateLogged = void 0;
+  state.upgradeRefused = false;
+  recordPendingUpdate(state, void 0);
+}
+function recordPendingUpdate(state, record) {
+  const text = record === void 0 ? "none" : JSON.stringify(record);
+  if (state.updateRecord === text) return;
+  try {
+    writePendingUpdate(runnerDir(state.config.configPath), record);
+    state.updateRecord = text;
+    reportRepeating(state, "the update-pending.json record", void 0);
+  } catch (err) {
+    const code = err.code;
+    const cause = code?.replace(/^ERR_FS_/, "") ?? (err instanceof Error ? err.name : "unknown error");
+    reportRepeating(
+      state,
+      "the update-pending.json record",
+      `could not write update-pending.json (${cause}): \`runner status\` will not show the pending update`
+    );
+  }
+}
+function runningItems(state) {
+  const numbers = [...state.jobs.values()].map((entry) => Number(entry.job.item)).filter((n) => Number.isFinite(n));
+  return numbers.sort((a, b) => a - b);
+}
+function holdForUpdate(state, version, mayHold = true) {
+  const log = logOf(state);
+  const nowMs = nowOf(state).getTime();
+  const wait = adoptUpdateWait(state, version);
+  const failed2 = readLastUpdate(state.config.configPath);
+  const failedAtMs = failed2?.to === version && failed2.outcome === "retrying" ? new Date(failed2.at ?? Number.NaN).getTime() : Number.NaN;
+  if (failedAtMs < wait.sinceMs) wait.sinceMs = failedAtMs;
+  const logged = state.updateLogged ??= {};
+  if (logged.pending !== version) {
+    logged.pending = version;
+    log.line(`update to ${version} pending \xB7 updating when no build is running`);
+  }
+  const maxWaitMs = (state.config.update?.maxWaitHours ?? DEFAULT_UPDATE_MAX_WAIT_HOURS) * 60 * 6e4;
+  const holding = mayHold && (state.upgradeRefused === true || nowMs - wait.sinceMs >= maxWaitMs);
+  const record = { version, since: new Date(wait.sinceMs).toISOString() };
+  if (holding) {
+    wait.holdSinceMs ??= nowMs;
+    const builds = runningItems(state);
+    const key = `${version}:${builds.join(",")}`;
+    if (logged.hold !== key) {
+      logged.hold = key;
+      log.line(`claiming nothing: update to ${version} waits for ${buildsPhrase(builds)} to finish`);
+    }
+    record.holding = { builds, since: new Date(wait.holdSinceMs).toISOString() };
+  } else {
+    wait.holdSinceMs = void 0;
+    logged.hold = void 0;
+  }
+  recordPendingUpdate(state, record);
+  return holding;
+}
+function buildsPhrase(builds) {
+  return builds.length === 0 ? "the running builds" : builds.map((n) => `#${n}`).join(", ");
 }
 function reportUpdateResult(state, version, result) {
   if (result.kind === "retrying") state.updateRetry = { version, retryAtMs: result.retryAtMs };
@@ -1031,7 +1101,10 @@ function restartOntoInstalled(state) {
 async function updateWhenIdle(state) {
   const update = state.deps.update;
   const version = state.pendingUpdate;
-  if (update === void 0 || version === void 0) return false;
+  if (update === void 0 || version === void 0) {
+    recordPendingUpdate(state, void 0);
+    return false;
+  }
   if (!state.config.autoUpdate || retryHeld(state, version)) {
     dropPendingUpdate(state);
     return false;
@@ -1039,18 +1112,22 @@ async function updateWhenIdle(state) {
   if (state.jobs.size > 0) {
     const record = readLastUpdate(state.config.configPath);
     if (record?.to === version && record.outcome === "retrying") {
-      const failedAtMs = record.at === void 0 ? Number.NaN : Date.parse(record.at);
-      if (!(nowOf(state).getTime() >= failedAtMs + RETRY_MAX_WAIT_MS)) return false;
-    }
-    if (state.preflightedUpdate === version) return true;
-    const early = await preflightUpdate(updateArgsOf(state, update, version));
-    if (early !== void 0) {
-      dropPendingUpdate(state);
-      reportUpdateResult(state, version, early);
-      return false;
+      const failedAtMs = new Date(record.at ?? Number.NaN).getTime();
+      if (!(nowOf(state).getTime() >= failedAtMs + RETRY_MAX_WAIT_MS)) {
+        holdForUpdate(state, version, false);
+        return false;
+      }
     }
-    state.preflightedUpdate = version;
-    return true;
+    if (state.preflightedUpdate !== version) {
+      const early = await preflightUpdate(updateArgsOf(state, update, version));
+      if (early !== void 0) {
+        dropPendingUpdate(state);
+        reportUpdateResult(state, version, early);
+        return false;
+      }
+      state.preflightedUpdate = version;
+    }
+    return holdForUpdate(state, version);
   }
   dropPendingUpdate(state);
   const result = await performUpdate(updateArgsOf(state, update, version));
@@ -1215,7 +1292,7 @@ async function runTick(state) {
           claimed = true;
           break;
         }
-        if (attempt.kind === "outdated" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch") {
+        if (attempt.kind === "outdated" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch" || attempt.kind === "unreadable_repositories") {
           return;
         }
         if (attempt.kind === "error") {
@@ -1235,7 +1312,7 @@ async function runTick(state) {
   );
 }
 var CLAIM_REFUSAL_CODES = new Set(
-  "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
+  "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
   const { postJson: postJson2 } = await import('./work-cmd-ZJY3NA2G.js');
@@ -1276,11 +1353,13 @@ async function tryClaimAndStart(state, item, queue) {
     }
     if (claim.code === "runner_upgrade_required") {
       reportRepeating(state, "the runner protocol", claim.message ?? claim.reason);
+      state.upgradeRefused = true;
       return { kind: "outdated" };
     }
     return { kind: "error", reason: `${claim.reason} (${claim.attempts} attempt(s))` };
   }
   reportRepeating(state, "the runner protocol", void 0);
+  state.upgradeRefused = false;
   reportRepeating(state, "the request signature", void 0);
   const { data } = claim.value;
   const claimId = data.id === void 0 || data.id === null ? "" : String(data.id);
@@ -1326,8 +1405,22 @@ async function tryClaimAndStart(state, item, queue) {
   }
   reportRepeating(state, "the branch", void 0);
   const identity = parseClaimIdentity(data);
+  const repositories = parseClaimedRepositories(data.repositories);
+  if (repositories === null) {
+    const released = await retrySend(
+      () => releaseLease(state.config, item.number, void 0, {}, state.deps.fetchImpl),
+      { now: state.deps.now, sleep: state.deps.sleep }
+    );
+    reportRepeating(
+      state,
+      "the repositories",
+      `the gateway named repositories for #${item.number} that this runner cannot read; upgrade the runner or the gateway. ` + (released.ok ? "The claim was released and no build started" : `No build started, but releasing the claim failed (${released.reason}), so it stays held until its lease lapses`)
+    );
+    return { kind: "unreadable_repositories" };
+  }
+  reportRepeating(state, "the repositories", void 0);
   try {
-    await startJob(state, item, queue, claimId, itemKey, branch, identity);
+    await startJob(state, item, queue, claimId, itemKey, branch, identity, repositories);
   } catch (err) {
     const stranded = [...state.jobs.values()].find((active) => active.job.claimId === claimId);
     if (stranded === void 0) throw err;
@@ -1352,9 +1445,11 @@ function wasExtended(claim) {
   if (!Number.isFinite(createdAtMs) || !Number.isFinite(expiresAtMs)) return false;
   return expiresAtMs - createdAtMs > LEASE_SECONDS * 1e3 + 2e3;
 }
-async function startJob(state, item, queue, claimId, itemKey, branch, identity) {
+async function startJob(state, item, queue, claimId, itemKey, branch, identity, claimed) {
   const log = logOf(state);
   const startedAt = nowOf(state);
+  const repositories = repositoriesOf({ repositories: claimed, repository: item.specRepository, branch });
+  const primary = primaryOf(repositories);
   const dirPath = freeJobDir(state.config.configPath, queue, item.number, claimId, startedAt);
   mkdirSync(dirPath, { recursive: true, mode: RUNNER_DIR_MODE });
   const runnerRoot = runnerDir(state.config.configPath);
@@ -1366,7 +1461,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
     itemKey,
     branch,
     commitIdentity: identity,
-    ...item.specRepository === void 0 || item.specRepository === null || item.specRepository === "" ? {} : { repository: item.specRepository },
+    ...primary === void 0 ? {} : { repository: primary.repository, repositories },
     startedAt: startedAt.toISOString()
   };
   writeJobFile(jobFilePath, job);
@@ -1440,7 +1535,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
       item,
       itemKey,
       tokens,
-      branch,
+      branch: primary?.branch ?? branch,
+      repositories,
       jobDir: dirPath,
       cliVersion,
       log,
@@ -1472,7 +1568,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
       item,
       itemKey,
       tokens,
-      branch,
+      branch: primary?.branch ?? branch,
+      repositories,
       jobDir: dirPath,
       cliVersion,
       log,
@@ -1749,6 +1846,7 @@ function buildTokensFor(state, active, item) {
   return new BuildTokens({
     config: state.config,
     item,
+    primary: primaryOf(repositoriesOf({ repositories: active.job.repositories, repository: active.job.repository, branch: active.job.branch }))?.repository,
     fetchImpl: state.deps.fetchImpl,
     now: state.deps.now,
     sleep: state.deps.sleep,
@@ -1974,7 +2072,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-NQYQHITZ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-YDXOLVJ5.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2020,7 +2118,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       if (cores !== void 0) runtimeOf(state).cpus.hold(job.container.buildId, cores);
       const tokens = buildTokensFor(state, adopted, job.item);
       runtimeOf(state).credentials.set(dirPath, tokens);
-      await ensureTunnel(runtimeOf(state), job.container, dirPath, config, job.itemKey, job.branch);
+      await ensureTunnel(runtimeOf(state), job.container, dirPath, config, job.itemKey, job.branch, job.repositories);
       try {
         await tokens.token("read");
         keepGhConfigCurrent(

package/dist/{chunk-M6G7TJVF.js → chunk-4Q7OMKAT.js}

@@ -345,11 +345,38 @@ async function startBuildServices(input) {
   }
 }
 
+// src/runner/repositories.ts
+function parseClaimedRepositories(value) {
+  if (!Array.isArray(value) || value.length === 0) return void 0;
+  const parsed = [];
+  for (const entry of value) {
+    if (typeof entry !== "object" || entry === null) return null;
+    const { repository, branch, primary } = entry;
+    if (typeof repository !== "string" || repository === "" || typeof branch !== "string" || branch === "") return null;
+    parsed.push({ repository, branch, primary: primary === true });
+  }
+  const primaryAt = parsed.findIndex((entry) => entry.primary);
+  const at = primaryAt === -1 ? 0 : primaryAt;
+  return [{ ...parsed[at], primary: true }, ...parsed.filter((_, index) => index !== at).map((entry) => ({ ...entry, primary: false }))];
+}
+function repositoriesOf(input) {
+  if (input.repositories !== void 0 && input.repositories.length > 0) return input.repositories;
+  if (input.repository === void 0 || input.repository === null || input.repository === "" || input.branch === void 0) return [];
+  return [{ repository: input.repository, branch: input.branch, primary: true }];
+}
+function primaryOf(repositories) {
+  return repositories.find((entry) => entry.primary) ?? repositories[0];
+}
+
 // src/runner/container/environment.ts
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
 var EVAL_INPUT_DIR = `${JOB_MOUNT}/eval-input`;
 var CHECKOUT_DIR = "/build/work/checkout";
+var REPOS_DIR = "/build/work/repos";
+function checkoutPath(entry) {
+  return entry.primary ? CHECKOUT_DIR : `${REPOS_DIR}/${entry.repository}`;
+}
 var MAX_HOSTS = 200;
 function tokenVariables() {
   return ["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GITHUB_ENTERPRISE_TOKEN"];
@@ -377,7 +404,7 @@ function proxyEnvironment(proxyUrl, alsoNoProxy) {
     YARN_HTTP_PROXY: proxyUrl
   };
 }
-function runnerLiterals(repository) {
+function runnerLiterals(repository, repositories = []) {
   return {
     OUTERLAYER_JOB_DIR: JOB_MOUNT,
     HOME: "/build/home",
@@ -386,7 +413,13 @@ function runnerLiterals(repository) {
     GIT_TERMINAL_PROMPT: "0",
     GH_CONFIG_DIR: `${JOB_MOUNT}/gh`,
     GH_NO_UPDATE_NOTIFIER: "1",
-    ...repository === void 0 ? {} : { GH_REPO: repository }
+    ...repository === void 0 ? {} : { GH_REPO: repository },
+    // What the build's command reads to find every repository it holds: its path, its branch, and whether it is the primary.
+    ...repositories.length === 0 ? {} : {
+      OUTERLAYER_REPOSITORIES: JSON.stringify(
+        repositories.map((entry) => ({ repository: entry.repository, path: checkoutPath(entry), branch: entry.branch, primary: entry.primary }))
+      )
+    }
   };
 }
 function containerBuiltInAddress(name) {
@@ -448,7 +481,14 @@ function buildEnvironment(input) {
     delete passed.GIT_CONFIG_COUNT;
   }
   return {
-    literals: { ...recipe, ...destinations, ...runnerLiterals(input.repository), ...builtInLiterals, ...authored, ...hooks },
+    literals: {
+      ...recipe,
+      ...destinations,
+      ...runnerLiterals(input.repository, repositoriesOf({ repositories: input.repositories, repository: input.repository, branch: input.branch })),
+      ...builtInLiterals,
+      ...authored,
+      ...hooks
+    },
     passed,
     variables,
     skippedTokenVariables
@@ -504,4 +544,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, buildEnvironment, builtInEnvironment, checkEnvironment, claudeCredential, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseIsolation, proxyEnvironment, resolveDestinations, sharedUserEnvironment, startBuildServices, withTunnelRecord };
+export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseClaimedRepositories, parseIsolation, primaryOf, proxyEnvironment, repositoriesOf, resolveDestinations, sharedUserEnvironment, startBuildServices, withTunnelRecord };

package/dist/{chunk-MC6J453K.js → chunk-7C4T5BGN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-472KC6JV.js';
-import { MIN_ENGINE_MAJOR } from './chunk-BREEX2Z7.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-BEZSECPA.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E5DC4VZL.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-472KC6JV.js → chunk-BEZSECPA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-BREEX2Z7.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E5DC4VZL.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-KZ5M4QOB.js → chunk-BHOBM3IZ.js}

@@ -2,21 +2,21 @@
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
 import { senderPidfile } from './chunk-HKUH5AR2.js';
-import { DOCKERD_LOG } from './chunk-V42JY4F6.js';
+import { DOCKERD_LOG } from './chunk-HYZRY4KZ.js';
 import { installScrubContext } from './chunk-Y6P5XX2B.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-BREEX2Z7.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-E5DC4VZL.js';
 import { readBranchHead, diffBetween, fetchCommit } from './chunk-3FMPZPJQ.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-VVIRHTH4.js';
+import { childEnvironment } from './chunk-2GBCTEN4.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
-import { waitForAgent, vmExecArgs } from './chunk-6CXYORUS.js';
-import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-S6IUUNCD.js';
+import { waitForAgent, vmExecArgs } from './chunk-QKFB4K7X.js';
+import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-RSNSZ2LJ.js';
 import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-DTDZXDQ3.js';
 import { planArtifactUpload } from './chunk-VDI5POCC.js';
 import { scrubText } from './chunk-IU4NZROR.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-M2PBLRB7.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-XR3BJN33.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment, EVAL_INPUT_DIR } from './chunk-M6G7TJVF.js';
+import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4Q7OMKAT.js';
 import { parsePolicy } from './chunk-TB7EP24C.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-BYT5O5RV.js';
@@ -90,10 +90,10 @@ async function provisionMicroVm(input) {
   const logPath = join(jobDir, "provision.log");
   const fail = (reason) => ({ ok: false, reason });
   if (claudeCredential(runtime.hostEnv) === void 0) return fail(AGENT_CREDENTIAL_MISSING);
-  const repository = item.specRepository;
-  if (repository === void 0 || repository === null || repository === "") {
-    return fail("the work item names no repository to clone");
-  }
+  const repositories = repositoriesOf({ repositories: input.repositories, repository: item.specRepository, branch: input.branch });
+  const primary = primaryOf(repositories);
+  if (primary === void 0) return fail("the work item names no repository to clone");
+  const repository = primary.repository;
   const runnerDirPath = runnerDir(config.configPath);
   const tooDeep = socketPathProblem(buildDir(config.configPath, "0".repeat(12)));
   if (tooDeep !== void 0) return fail(tooDeep);
@@ -134,6 +134,7 @@ async function provisionMicroVm(input) {
     item: item.number,
     itemKey,
     repository,
+    repositories,
     hostEnv: runtime.hostEnv,
     containerEnv: report.apply.containerEnv,
     builtIns: true
@@ -182,7 +183,7 @@ async function provisionMicroVm(input) {
   mkdirSync(buildDir2, { recursive: true, mode: 448 });
   chmodSync(buildDir2, 448);
   try {
-    const gitRemote = gitRemoteFor(runtime, { repository, branch: input.branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
+    const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
     runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote));
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
@@ -243,6 +244,14 @@ async function provisionMicroVm(input) {
       err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's gh configuration could not be written: ${describeCallFailure(err)}`
     );
   }
+  for (const entry of repositories) {
+    if (entry.repository === primary.repository) continue;
+    try {
+      await tokens.token("read", entry.repository);
+    } catch (err) {
+      return bail(`the build's read token for ${entry.repository} could not be had: ${refusalCode(err)}`);
+    }
+  }
   tokens.onRead((token) => {
     pushes = pushes.then(async () => {
       if (state.firecracker === void 0 || !vm.firecracker.alive(state.firecracker)) return;
@@ -277,7 +286,8 @@ async function provisionMicroVm(input) {
   const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
   const steps = await runBuildSteps({
     repository,
-    branch: input.branch,
+    branch: primary.branch,
+    repositories,
     lifecycle: report.apply.lifecycle,
     exec: async (argv, workdir, opts) => {
       const ran = await vm.exec(state.vsockPath, request(argv, workdir));
@@ -351,6 +361,7 @@ function vmExecFor(input, argv) {
     itemKey: input.job.itemKey,
     branch: input.job.branch,
     repository: state.repository,
+    repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     builtIns: state.builtIns === true,
@@ -388,6 +399,7 @@ async function syncInMicroVm(input) {
       itemKey: job.itemKey,
       branch: job.branch,
       repository: state.repository,
+      repositories: job.repositories,
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
       builtIns: state.builtIns === true,
@@ -476,7 +488,13 @@ async function startCheckMicroVm(input) {
   input.save(state);
   mkdirSync(buildDir2, { recursive: true, mode: 448 });
   try {
-    const gitRemote = gitRemoteFor(runtime, { repository, branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`), readOnly: true });
+    const gitRemote = gitRemoteFor(runtime, {
+      repositories: repositoriesOf({ repositories: job.repositories, repository, branch }),
+      tokens,
+      buildDir: buildDir2,
+      log: (line) => log.line(`${tag} ${line}`),
+      readOnly: true
+    });
     runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote));
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);

package/dist/{chunk-JSUUXA5W.js → chunk-CJGQQZWB.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
 import { compareVersions } from './chunk-IU4NZROR.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-M6G7TJVF.js';
+import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { createHash } from 'crypto';
 import { realpathSync } from 'fs';