@outerlayer/cli 0.17.0 → 0.19.0

package/dist/{chunk-WVUIRTWA.js → chunk-5MYFOW5V.js}

@@ -1,35 +1,35 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-G5NPRL2K.js';
-import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-RMWLBUCJ.js';
-import { writePendingUpdate } from './chunk-O765JR4W.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-6U3MV7TZ.js';
+import { writePendingUpdate } from './chunk-MTP2QEVO.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-S5PCA3SN.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
+import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-SADUQSO4.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
-import { RUNNER_PROTOCOL } from './chunk-ADJRGVZC.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-LWSJQJC6.js';
+import { RUNNER_PROTOCOL } from './chunk-BWSUPRDK.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-DADWEUH3.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-AMFWYESY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-MAK5LYRF.js';
-import { spawnRun } from './chunk-KMDLFI4P.js';
-import { checkFit } from './chunk-RLYZLUQ7.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-S3NYLI2P.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-22RMZBGW.js';
-import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-4NPZVMJU.js';
+import { provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, measureDisk, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-7KSSBQTS.js';
+import { spawnRun } from './chunk-VMJPFQNE.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-3UZTIRLF.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-XSZD4AZ6.js';
+import { checkFit } from './chunk-QEFKA2QD.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-HPJNLETG.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-P53VEAOF.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
-import { parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-4Q7OMKAT.js';
-import { parseClaimIdentity } from './chunk-BYT5O5RV.js';
+import { claimPidFile, readPidFile, releasePidFile } from './chunk-ECODQ7II.js';
+import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-V7NIVOFD.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-ZM2IMMYN.js';
-import { HOOKS_DIR_NAME, writeCommitHooks } from './chunk-XCCLFVXM.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-M2ZWWTWZ.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-N2PXGQRL.js';
+import { parseClaimIdentity, parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-BQXFBI7T.js';
 import { randomBytes } from 'crypto';
-import { mkdirSync, existsSync, chmodSync, statSync, readdirSync, readFileSync, rmSync, renameSync, writeFileSync, closeSync, openSync, constants, lstatSync } from 'fs';
+import { mkdirSync, existsSync, chmodSync, statSync, readdirSync, writeFileSync, readFileSync, rmSync, renameSync, closeSync, openSync, constants, lstatSync } from 'fs';
 import { join, dirname } from 'path';
-import { totalmem } from 'os';
+import { totalmem, constants as constants$1 } from 'os';
 
 createRequire(import.meta.url);
 function openKvm() {
@@ -785,6 +785,145 @@ async function removeStaleRootDisks(root, unfinished, options) {
   }
   return freed;
 }
+var HOOKS_DIR_NAME = "git-hooks";
+var CO_AUTHOR_FILE = "co-author";
+var HOOKS = [
+  "applypatch-msg",
+  "pre-applypatch",
+  "post-applypatch",
+  "pre-commit",
+  "pre-merge-commit",
+  "prepare-commit-msg",
+  "commit-msg",
+  "post-commit",
+  "pre-rebase",
+  "post-checkout",
+  "post-merge",
+  "pre-push",
+  "pre-receive",
+  "update",
+  "post-receive",
+  "post-update",
+  "reference-transaction",
+  "pre-auto-gc",
+  "post-rewrite",
+  "sendemail-validate",
+  "post-index-change"
+];
+var READS_STDIN = /* @__PURE__ */ new Set(["pre-push", "pre-receive", "post-receive", "reference-transaction", "post-rewrite"]);
+var ADD_TRAILER = `
+# Every commit of the build names the requester once: a trailer already there is left alone.
+file=\${1-}
+if [ -n "$file" ] && [ -f "$file" ]; then
+  git interpret-trailers --in-place --if-exists addIfDifferent --trailer "Co-authored-by: $(cat "$here/${CO_AUTHOR_FILE}")" "$file" ||
+    echo "outerlayer: could not add the co-author line to the commit message" >&2
+fi
+`;
+var HOOK_WRAPPER_MARKER = "# Written by the OuterLayer runner.";
+function script(name) {
+  const adds = name === "prepare-commit-msg";
+  return `#!/bin/sh
+${HOOK_WRAPPER_MARKER} Runs the repository's own ${name} hook, then
+# ${adds ? "adds the co-author line to the commit message" : "hands its status on"}.
+here=$(dirname "$0")
+
+# The hooks path git would use without this directory: cut the list of configuration
+# entries the runner passes just before its own core.hooksPath entry, then ask git.
+n=\${GIT_CONFIG_COUNT-0}
+case $n in '' | *[!0-9]*) n=0 ;; esac
+cut=$n
+i=$n
+while [ "$i" -gt 0 ]; do
+  i=$((i - 1))
+  eval "key=\\\${GIT_CONFIG_KEY_$i-}"
+  eval "value=\\\${GIT_CONFIG_VALUE_$i-}"
+  if [ "$key" = core.hooksPath ] && { [ "$value" = "$here" ] || [ "$value" -ef "$here" ]; }; then
+    cut=$i
+    break
+  fi
+done
+path=$(GIT_CONFIG_COUNT=$cut git config --type=path core.hooksPath 2>/dev/null) || path=
+if [ -z "$path" ]; then
+  path=$(git rev-parse --git-common-dir 2>/dev/null)/hooks
+fi
+
+hook=$path/${name}
+status=0
+if [ "$path" -ef "$here" ] || [ ! -f "$hook" ] || [ ! -x "$hook" ]; then
+${READS_STDIN.has(name) ? "  cat >/dev/null\n" : ""}  :
+else
+${adds ? `  "$hook" "$@" || status=$?` : `  exec "$hook" "$@"`}
+fi
+${adds ? `[ "$status" -eq 0 ] || exit "$status"
+${ADD_TRAILER}` : ""}exit 0
+`;
+}
+function writeCommitHooks(buildDir2, coAuthor) {
+  const dir = join(buildDir2, HOOKS_DIR_NAME);
+  mkdirSync(dir, { recursive: true });
+  chmodSync(dir, 493);
+  for (const name of HOOKS) {
+    const path = join(dir, name);
+    writeFileSync(path, script(name));
+    chmodSync(path, 493);
+  }
+  const data = join(dir, CO_AUTHOR_FILE);
+  writeFileSync(data, `${coAuthor.name} <${coAuthor.email}>
+`);
+  chmodSync(data, 420);
+  return dir;
+}
+function linuxSignalName(number) {
+  const names = {
+    1: "SIGHUP",
+    2: "SIGINT",
+    3: "SIGQUIT",
+    4: "SIGILL",
+    5: "SIGTRAP",
+    6: "SIGABRT",
+    7: "SIGBUS",
+    8: "SIGFPE",
+    9: "SIGKILL",
+    10: "SIGUSR1",
+    11: "SIGSEGV",
+    12: "SIGUSR2",
+    13: "SIGPIPE",
+    14: "SIGALRM",
+    15: "SIGTERM",
+    16: "SIGSTKFLT",
+    17: "SIGCHLD",
+    18: "SIGCONT",
+    19: "SIGSTOP",
+    20: "SIGTSTP",
+    21: "SIGTTIN",
+    22: "SIGTTOU",
+    23: "SIGURG",
+    24: "SIGXCPU",
+    25: "SIGXFSZ",
+    26: "SIGVTALRM",
+    27: "SIGPROF",
+    28: "SIGWINCH",
+    29: "SIGIO",
+    30: "SIGPWR",
+    31: "SIGSYS"
+  };
+  return names[number];
+}
+function hostSignalName(number) {
+  return Object.entries(constants$1.signals).find(([, value]) => value === number)?.[0];
+}
+function notEndedByRunnerReason(exit, isolated) {
+  if (exit.signal !== null) {
+    return `the command was killed by ${exit.signal} on the host; the runner did not end it`;
+  }
+  const number = exit.code - 128;
+  const name = isolated ? linuxSignalName(number) : hostSignalName(number);
+  if (name === void 0) return void 0;
+  return `the command exited ${exit.code}, the status of a process killed by ${name}; the runner did not end it`;
+}
+function jobNotEndedByRunnerReason(exit, job) {
+  return notEndedByRunnerReason(exit, job.container !== void 0 || job.microvm !== void 0);
+}
 
 // src/runner/loop.ts
 var QUEUE_ORDER = ["amend", "implement"];
@@ -794,7 +933,12 @@ var TRACKER_REPOSITORY_HOSTS = {
 var HOUSEKEEPING_INTERVAL_MS = 36e5;
 function logOf(state) {
   state.deps.log ??= createRunnerLog(state.deps.now ?? (() => /* @__PURE__ */ new Date()));
-  return state.deps.log;
+  state.attemptLog ??= attemptLogsOf(state).wrap(state.deps.log);
+  return state.attemptLog;
+}
+function attemptLogsOf(state) {
+  state.attemptLogs ??= new AttemptLogBook(state.deps.now);
+  return state.attemptLogs;
 }
 function nowOf(state) {
   return (state.deps.now ?? (() => /* @__PURE__ */ new Date()))();
@@ -810,6 +954,7 @@ function finishDepsOf(state) {
     now: state.deps.now,
     sleep: state.deps.sleep,
     log: logOf(state),
+    attemptLogs: attemptLogsOf(state),
     cliVersion: state.deps.cliVersion,
     // Any job that has a container needs the runtime to stop and remove it, including one a config change left behind.
     container: runtimeOf(state)
@@ -839,8 +984,11 @@ function reportRepeating(state, key, message, level = "error") {
   }
 }
 function deriveRepo(item) {
-  const host = item.tracker === void 0 ? void 0 : TRACKER_REPOSITORY_HOSTS[item.tracker];
-  if (host === void 0) return void 0;
+  if (item.tracker === void 0) return void 0;
+  const host = TRACKER_REPOSITORY_HOSTS[item.tracker];
+  if (host === void 0) {
+    return item.specRepository ? `${TRACKER_REPOSITORY_HOSTS.github}/${item.specRepository}` : void 0;
+  }
   const hash = item.trackerKey.lastIndexOf("#");
   const repoPart = hash === -1 ? item.trackerKey : item.trackerKey.slice(0, hash);
   return repoPart === "" ? void 0 : `${host}/${repoPart}`;
@@ -1315,7 +1463,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-Z2WXLZPH.js');
+  const { postJson: postJson2 } = await import('./work-cmd-5EPPD33Y.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1474,9 +1622,10 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     ending: false
   };
   state.jobs.set(dirPath, active);
-  log.line(
-    `claimed ${queue} #${item.number} ${item.trackerKey} (claim ${shortClaim(claimId)}) \u2192 ${relativeToRunner(runnerRoot, dirPath)}`
-  );
+  attemptLogsOf(state).open(item.number, dirPath);
+  const claimLine = `claimed ${queue} #${item.number} ${item.trackerKey} (claim ${shortClaim(claimId)}) \u2192 ${relativeToRunner(runnerRoot, dirPath)}`;
+  log.line(claimLine);
+  attemptLogsOf(state).note(item.number, claimLine);
   const hookLimits = () => hookLimitsFor(state.config, startedAt.getTime(), state.deps.now);
   const tag = `#${item.number}`;
   const containerMode = isBuiltinContainer(state.config.hooks.provision);
@@ -1610,6 +1759,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       config: state.config,
       runtime: runtimeOf(state),
       item,
+      repository: primary?.repository,
       itemKey,
       jobDir: dirPath,
       cliVersion,
@@ -1635,10 +1785,10 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     installCommitHooks(active.job, log, tag);
   } else {
     const runtime = runtimeOf(state);
-    const build = await startHostBuild(state, active, item.specRepository ?? void 0);
+    const build = await startHostBuild(state, active, primary?.repository);
     const provisionEnv = provisionEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), {
       buildDir: build.state.buildDir,
-      repository: item.specRepository,
+      repository: primary?.repository ?? null,
       recipeCommit: build.recipeCommit,
       limits: {
         memory: state.config.build?.memory ?? "8g",
@@ -1836,11 +1986,13 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     const took = formatDuration(nowOf(state).getTime() - commandStartedMs);
     if (signal !== null) {
       log.error(`${tag} command killed by ${signal} (${took})`);
+      active.job.commandEndReason = jobNotEndedByRunnerReason({ code: null, signal }, active.job);
       void endJob(state, active, "failed");
       return;
     }
     log.line(`${tag} command exited ${code ?? 0} (${took})`);
     if (code !== null) active.job.exitCode = code;
+    active.job.commandEndReason = jobNotEndedByRunnerReason({ code, signal }, active.job);
     void endJob(state, active, code === 0 ? "ok" : "failed");
   });
 }
@@ -1978,7 +2130,7 @@ async function renewLeaseIfDue(state, active, nowMs) {
 }
 async function watchTick(state, active, nowMs, logMtimeMs) {
   if (active.ending) {
-    if (active.job.stage === "checks") await renewLeaseIfDue(state, active, nowMs);
+    if (active.job.stage === "checks" || active.job.stage === "judge") await renewLeaseIfDue(state, active, nowMs);
     return;
   }
   const log = logOf(state);
@@ -2074,7 +2226,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-5XE7XMC4.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-UWQAL2MN.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2112,9 +2264,11 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     return [];
   });
   for (const buildId of runningMicroVms) log.line(`stopped microVM build ${buildId}, left running by an earlier runner`);
+  const attemptLogs = attemptLogsOf(state);
   for (const { dirPath, job } of listAdoptableJobs(jobsDir(configPath))) {
     const adopted = { job, dirPath, lastRenewAtMs: nowMs(), cmd: null, cpuSample: null, ending: false };
     state.jobs.set(dirPath, adopted);
+    attemptLogs.open(job.item, dirPath);
     if (job.container !== void 0) {
       const cores = job.container.cpuset === void 0 ? void 0 : parseCpuList(job.container.cpuset);
       if (cores !== void 0) runtimeOf(state).cpus.hold(job.container.buildId, cores);
@@ -2126,18 +2280,20 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
         keepGhConfigCurrent(
           tokens,
           job.container.buildDir,
-          (err) => log.error(`#${job.item} the read token could not be written for gh: ${describeCallFailure(err)}`)
+          (err) => logOf(state).error(`#${job.item} the read token could not be written for gh: ${describeCallFailure(err)}`)
         );
       } catch (err) {
-        log.error(`#${job.item} could not give the adopted build a read token: ${describeCallFailure(err)}`);
+        logOf(state).error(`#${job.item} could not give the adopted build a read token: ${describeCallFailure(err)}`);
       }
     }
     if (job.build !== void 0 && !runtimeOf(state).tunnels.has(job.build.buildId)) {
       await startHostServices({ runtime: runtimeOf(state), config, build: job.build, jobDir: dirPath, itemKey: job.itemKey, process: job.build.workDir !== void 0 }).catch((err) => {
-        log.error(`the tunnel of #${job.item} could not start again: ${describeCallFailure(err)}`);
+        logOf(state).error(`the tunnel of #${job.item} could not start again: ${describeCallFailure(err)}`);
       });
     }
-    log.line(`adopted job ${job.queue} #${job.item} (claim ${shortClaim(job.claimId)}) \xB7 pid ${job.pid} still running`);
+    const adoptedLine = `adopted job ${job.queue} #${job.item} (claim ${shortClaim(job.claimId)}) \xB7 pid ${job.pid} still running`;
+    log.line(adoptedLine);
+    attemptLogs.note(job.item, adoptedLine);
   }
   for (const { job, released } of await retryFailedReleases(jobsDir(configPath), config, {
     fetchImpl: deps.fetchImpl,
@@ -2177,7 +2333,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       } catch {
       }
       void watchTick(state, active, now, mtime).catch((err) => {
-        log.error(`#${active.job.item} health check failed: ${describeCallFailure(err)}`);
+        logOf(state).error(`#${active.job.item} health check failed: ${describeCallFailure(err)}`);
       });
     }
   }, deps.watchIntervalMs ?? 3e4);
@@ -2224,6 +2380,9 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     let passes = 0;
     while (state.jobs.size > 0 && !exited) {
       onWaiting?.([...state.jobs.keys()]);
+      for (const active of state.jobs.values()) {
+        attemptLogs.noteChanged(active.job.item, "drain", `stopping: draining, waiting on #${active.job.item} (${active.job.stage ?? "starting"})`);
+      }
       if (passes % DRAIN_LOG_EVERY_PASSES === 0) {
         log.line(
           `stopping: draining, waiting on ${[...state.jobs.values()].map((a) => describeWaiting(a, nowMs())).join(", ")}`