@outerlayer/cli 0.2.0 → 0.4.0

package/dist/chunk-FS2VYGZT.js

@@ -0,0 +1,1764 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { LEASE_SECONDS, releaseLease, isUnfinished, writeJobFile, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, readJobFile, hookLimitsFor } from './chunk-FAJSS2WN.js';
+import { RUNNER_PROTOCOL } from './chunk-FV2CCGXK.js';
+import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
+import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-YYYXRJUW.js';
+import { RepoFilter } from './chunk-TBT347UY.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, formatClock, measureDisk, createRunnerLog, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-7A6RVXPZ.js';
+import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-5DLBAXY5.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks } from './chunk-5Y3QQRUH.js';
+import { exceedsDisk } from './chunk-F6GFZXZ3.js';
+import { parseClaimIdentity, sharedUserEnvironment, JOB_MOUNT } from './chunk-AUFG23AA.js';
+import { resolveVersion } from './chunk-RA3O54FC.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-M5POMKKW.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { HOOKS_DIR_NAME, writeCommitHooks } from './chunk-XCCLFVXM.js';
+import { randomBytes } from 'crypto';
+import { mkdirSync, existsSync, chmodSync, statSync, readdirSync, readFileSync, rmSync, renameSync, writeFileSync } from 'fs';
+import { join, dirname } from 'path';
+
+createRequire(import.meta.url);
+
+// src/runner/heartbeat.ts
+var HEARTBEAT_TIMEOUT_MS = 1e4;
+var ERROR_CODE_MAX = 100;
+var ERROR_MESSAGE_MAX = 500;
+var UNREACHABLE_MESSAGE = "the request did not reach the platform";
+function noPlatformMessage(status) {
+  return `the request got HTTP ${status} with no error message from the platform`;
+}
+function cutForGateway(value, max) {
+  let cut = value.replaceAll("\0", "").toWellFormed().slice(0, max);
+  const last = cut.charCodeAt(cut.length - 1);
+  if (last >= 55296 && last <= 56319) cut = cut.slice(0, -1);
+  return cut;
+}
+function shapeWorkRequestFailure(code, status, message) {
+  const shapedCode = code !== void 0 ? code : status !== void 0 ? `http_${status}` : "unreachable";
+  const fallback = status !== void 0 ? noPlatformMessage(status) : UNREACHABLE_MESSAGE;
+  const bodyMessage = code !== void 0 && message !== void 0 ? cutForGateway(message, ERROR_MESSAGE_MAX) : "";
+  return {
+    ok: false,
+    code: cutForGateway(shapedCode, ERROR_CODE_MAX),
+    message: bodyMessage === "" ? fallback : bodyMessage
+  };
+}
+function workRequestFromFailure(err) {
+  if (!(err instanceof WorkCommandError)) return shapeWorkRequestFailure(void 0, void 0, void 0);
+  return shapeWorkRequestFailure(err.code, err.status, err.message);
+}
+function workRequestFromRetryFailure(outcome) {
+  return shapeWorkRequestFailure(outcome.code, outcome.status, outcome.message);
+}
+async function sendHeartbeat(args, fetchImpl) {
+  const body = {
+    host: args.host,
+    cliVersion: args.cliVersion,
+    runnerProtocol: RUNNER_PROTOCOL,
+    pollSeconds: args.pollSeconds,
+    slotsUsed: args.slotsUsed,
+    slotsTotal: args.slotsTotal,
+    workRequest: args.workRequest,
+    // The attempt count stays on the host; the gateway stores the outcome, its reason and its time.
+    lastUpdate: args.lastUpdate === void 0 ? void 0 : {
+      from: args.lastUpdate.from,
+      to: args.lastUpdate.to,
+      outcome: args.lastUpdate.outcome,
+      reason: args.lastUpdate.reason,
+      ...args.lastUpdate.at !== void 0 ? { at: args.lastUpdate.at } : {}
+    }
+  };
+  try {
+    const response = await postJson(
+      args.url,
+      "/v1/hosts/heartbeat",
+      args.apiKey,
+      args.appId,
+      body,
+      fetchImpl,
+      HEARTBEAT_TIMEOUT_MS,
+      await signerFor(args.configPath)
+    );
+    const runnerVersion = response.data?.runnerVersion;
+    return typeof runnerVersion === "string" ? { ok: true, runnerVersion } : { ok: true };
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+}
+var OUTCOMES = ["updated", "rolled_back", "verification_failed", "not_published", "retrying"];
+function lastUpdatePath(configPath) {
+  return join(runnerDir(configPath), "last-update.json");
+}
+function readLastUpdate(configPath) {
+  try {
+    const parsed = JSON.parse(readFileSync(lastUpdatePath(configPath), "utf8"));
+    if (typeof parsed.from !== "string" || typeof parsed.to !== "string") return void 0;
+    if (typeof parsed.outcome !== "string" || !OUTCOMES.includes(parsed.outcome)) return void 0;
+    if (parsed.reason !== null && typeof parsed.reason !== "string") return void 0;
+    const update = { from: parsed.from, to: parsed.to, outcome: parsed.outcome, reason: parsed.reason };
+    const at = typeof parsed.at === "string" ? isoTime(parsed.at) : void 0;
+    if (at !== void 0) update.at = at;
+    if (typeof parsed.attempts === "number" && Number.isInteger(parsed.attempts) && parsed.attempts > 0) update.attempts = parsed.attempts;
+    return update;
+  } catch {
+    return void 0;
+  }
+}
+function isoTime(text) {
+  const ms = Date.parse(text);
+  if (!Number.isFinite(ms)) return void 0;
+  const iso = new Date(ms).toISOString();
+  return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(iso) ? iso : void 0;
+}
+var REASON_MAX = 500;
+function storableReason(reason) {
+  if (reason === null) return null;
+  const cut = reason.replaceAll("\0", "").toWellFormed().slice(0, REASON_MAX);
+  const last = cut.charCodeAt(cut.length - 1);
+  const trimmed = last >= 55296 && last <= 56319 ? cut.slice(0, -1) : cut;
+  return trimmed === "" ? null : trimmed;
+}
+function writeLastUpdate(configPath, update) {
+  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  const path = lastUpdatePath(configPath);
+  const temporary = `${path}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify({ ...update, reason: storableReason(update.reason) })}
+`, { mode: RUNNER_FILE_MODE });
+  renameSync(temporary, path);
+}
+
+// src/runner/update/version-order.ts
+function parse(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(version);
+  if (match === null) return void 0;
+  return { core: [Number(match[1]), Number(match[2]), Number(match[3])], pre: match[4] };
+}
+function comparePre(a, b) {
+  const left = a.split(".");
+  const right = b.split(".");
+  for (let i = 0; i < Math.max(left.length, right.length); i++) {
+    const x = left[i];
+    const y = right[i];
+    if (x === void 0) return -1;
+    if (y === void 0) return 1;
+    const xNum = /^\d+$/.test(x);
+    const yNum = /^\d+$/.test(y);
+    if (xNum && yNum) {
+      const difference = Number(x) - Number(y);
+      if (difference !== 0) return Math.sign(difference);
+    } else if (xNum !== yNum) {
+      return xNum ? -1 : 1;
+    } else if (x < y) {
+      return -1;
+    } else if (x > y) {
+      return 1;
+    }
+  }
+  return 0;
+}
+function compareVersions(a, b) {
+  const left = parse(a);
+  const right = parse(b);
+  if (left === void 0 || right === void 0) return void 0;
+  for (let i = 0; i < 3; i++) {
+    const difference = left.core[i] - right.core[i];
+    if (difference !== 0) return Math.sign(difference);
+  }
+  if (left.pre === right.pre) return 0;
+  if (left.pre === void 0) return 1;
+  if (right.pre === void 0) return -1;
+  return comparePre(left.pre, right.pre);
+}
+function compareCores(a, b) {
+  for (let i = 0; i < 3; i++) {
+    const difference = a[i] - b[i];
+    if (difference !== 0) return Math.sign(difference);
+  }
+  return 0;
+}
+function parsePartial(text) {
+  if (text === "" || text === "*" || text === "x" || text === "X") return [];
+  const match = /^v?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?$/.exec(text);
+  if (match === null) return void 0;
+  const numbers = [];
+  for (const part of [match[1], match[2], match[3]]) {
+    if (part === void 0 || !/^\d+$/.test(part)) break;
+    numbers.push(Number(part));
+  }
+  return numbers;
+}
+function bumpLast(numbers) {
+  const core = [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
+  const last = numbers.length - 1;
+  core[last] = core[last] + 1;
+  for (let i = last + 1; i < 3; i++) core[i] = 0;
+  return core;
+}
+function fill(numbers) {
+  return [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
+}
+function meets(version, comparator) {
+  const match = /^(>=|<=|>|<|=|\^|~)?(.*)$/.exec(comparator);
+  const op = match[1] ?? "";
+  const numbers = parsePartial(match[2]);
+  if (numbers === void 0) return void 0;
+  if (numbers.length === 0) return op === "" || op === "=" || op === ">=" || op === "<=" ? true : void 0;
+  const low = fill(numbers);
+  const whole = numbers.length === 3;
+  switch (op) {
+    case ">=":
+      return compareCores(version, low) >= 0;
+    case ">":
+      return whole ? compareCores(version, low) > 0 : compareCores(version, bumpLast(numbers)) >= 0;
+    case "<":
+      return compareCores(version, low) < 0;
+    case "<=":
+      return whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0;
+    case "~":
+      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, Math.min(numbers.length, 2)))) < 0;
+    case "^": {
+      let pivot = numbers.findIndex((n) => n !== 0);
+      if (pivot === -1) pivot = numbers.length - 1;
+      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, pivot + 1))) < 0;
+    }
+    default:
+      return compareCores(version, low) >= 0 && (whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0);
+  }
+}
+function satisfiesRange(version, range) {
+  const parsed = parse(version.trim().replace(/^v/, ""));
+  if (parsed === void 0 || parsed.pre !== void 0) return void 0;
+  let anyUnreadable = false;
+  for (const alternative of range.split("||")) {
+    if (/\s-\s/.test(alternative)) {
+      anyUnreadable = true;
+      continue;
+    }
+    const comparators = alternative.trim().replace(/(>=|<=|>|<|=|\^|~)\s+/g, "$1").split(/\s+/).filter((c) => c !== "");
+    if (comparators.length === 0) comparators.push("*");
+    let all = true;
+    for (const comparator of comparators) {
+      const met = meets(parsed.core, comparator);
+      if (met === void 0) {
+        anyUnreadable = true;
+        all = false;
+        break;
+      }
+      if (!met) {
+        all = false;
+        break;
+      }
+    }
+    if (all) return true;
+  }
+  return anyUnreadable ? void 0 : false;
+}
+var RELEASE_REPOSITORY = "https://github.com/outerlayerai/outerlayer";
+var RELEASE_WORKFLOW_PATH = ".github/workflows/outerlayer-release.yml";
+var UpdateStepError = class extends Error {
+  constructor(reason, detail) {
+    super(reason);
+    this.reason = reason;
+    this.detail = detail;
+  }
+};
+function failed(reason) {
+  return { ok: false, outcome: "verification_failed", reason };
+}
+async function verifyVersion(configPath, version, deps) {
+  const staging = stagingDir(configPath, version);
+  rmSync(staging, { recursive: true, force: true });
+  try {
+    const result = await verifyInto(staging, version, deps);
+    if (!result.ok) rmSync(staging, { recursive: true, force: true });
+    return result;
+  } catch (err) {
+    rmSync(staging, { recursive: true, force: true });
+    throw err;
+  }
+}
+async function verifyInto(staging, version, deps) {
+  const meta = await fetchVersionMeta(version, deps.fetchImpl);
+  if (meta.kind === "not_published") {
+    return { ok: false, outcome: "not_published", reason: `the registry has no @outerlayer/cli ${version}` };
+  }
+  if (!meta.integrity.startsWith("sha512-")) return failed(`the registry's integrity for ${version} is not a sha512 digest`);
+  const expected = meta.integrity.slice("sha512-".length);
+  const digest = await fetchTarballDigest(meta.tarball, deps.fetchImpl);
+  if (digest !== expected) return failed(`the tarball for ${version} does not match the registry's integrity digest`);
+  const provenance = await fetchProvenance(version, deps.fetchImpl);
+  if (provenance === void 0) return failed(`${version} has no provenance attestation`);
+  if (provenance.repository !== RELEASE_REPOSITORY) {
+    return failed(`the provenance of ${version} names the repository ${provenance.repository}, not ${RELEASE_REPOSITORY}`);
+  }
+  if (provenance.workflowPath !== RELEASE_WORKFLOW_PATH) {
+    return failed(`the provenance of ${version} names the workflow ${provenance.workflowPath}, not ${RELEASE_WORKFLOW_PATH}`);
+  }
+  if (Buffer.from(provenance.subjectSha512, "hex").toString("base64") !== digest) {
+    return failed(`the provenance of ${version} covers a different package than the tarball`);
+  }
+  mkdirSync(staging, { recursive: true, mode: RUNNER_DIR_MODE });
+  const npm = await npmVersion(deps.runNpm, staging);
+  if (npm === void 0 || !npmSupportsProvenance(npm)) {
+    throw new Error(`npm ${npm ?? "(not found)"} cannot verify provenance; 9.5 or later is needed`);
+  }
+  const install = await installVersion(deps.runNpm, staging, version);
+  if (install.status !== 0) {
+    throw new UpdateStepError(`npm install of ${version} failed with exit ${install.status}`, `npm install of ${version} failed: ${install.stderr.trim().slice(0, 500)}`);
+  }
+  const audit = await auditSignatures(deps.runNpm, staging);
+  if (!audit.ok) {
+    if (!audit.verdict) throw new Error(audit.reason);
+    return failed(audit.reason);
+  }
+  const locked = lockedIntegrity(staging);
+  if (locked !== meta.integrity) return failed(`the installed package's integrity does not match the verified tarball's`);
+  const smoke = await deps.runNode([entryIn(staging), "--version"], staging);
+  if (smoke.status !== 0) {
+    throw new UpdateStepError(
+      `the installed ${version} exited ${smoke.status} when run`,
+      `the installed ${version} exited ${smoke.status} when run: ${(smoke.stderr.trim() || smoke.stdout.trim()).slice(0, 500)}`
+    );
+  }
+  if (!smoke.stdout.trim().startsWith(version)) return failed(`the installed ${version} did not print its version when run`);
+  return { ok: true, dir: staging };
+}
+function lockedIntegrity(staging) {
+  try {
+    const lock = JSON.parse(readFileSync(join(staging, "package-lock.json"), "utf8"));
+    return lock.packages["node_modules/@outerlayer/cli"].integrity;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/runner/update/self-update.ts
+var RESTART_EXIT_STATUS = 75;
+var MAX_MARKER_STARTS = 3;
+var RETRY_FIRST_WAIT_MS = 5 * 6e4;
+var RETRY_MAX_WAIT_MS = 6 * 60 * 6e4;
+function retryAfterMs(record) {
+  const at = record.at === void 0 ? Number.NaN : Date.parse(record.at);
+  if (!Number.isFinite(at)) return 0;
+  const failures = Math.max(1, record.attempts ?? 1);
+  return at + Math.min(RETRY_FIRST_WAIT_MS * 2 ** (failures - 1), RETRY_MAX_WAIT_MS);
+}
+function decide(input) {
+  const order = compareVersions(input.named, input.own);
+  if (order === void 0 || order <= 0) return "none";
+  if (!input.autoUpdate) return "none";
+  if (!input.fromCurrent) return "cannot_self_update";
+  const { record } = input;
+  if (record !== void 0 && record.to === input.named) {
+    if (record.outcome === "verification_failed" || record.outcome === "rolled_back") return "skip_known_bad";
+    if (record.outcome === "retrying" && input.nowMs < retryAfterMs(record)) return "retry_later";
+  }
+  return "update";
+}
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function isoAt(now) {
+  return new Date(now()).toISOString();
+}
+function retryFailure(version, err) {
+  if (err instanceof UpdateStepError) return { outcome: "retrying", reason: err.reason, detail: err.detail };
+  const code = err?.code;
+  if (typeof code === "string" && err.syscall !== void 0) {
+    return { outcome: "retrying", reason: `could not install ${version}: ${code}`, detail: messageOf(err) };
+  }
+  return { outcome: "retrying", reason: messageOf(err) };
+}
+function finish(args, failure) {
+  let update = { from: args.own, to: args.version, outcome: failure.outcome, reason: failure.reason, at: isoAt(args.now) };
+  if (failure.outcome === "retrying") {
+    const previous = readLastUpdate(args.configPath);
+    const attempts = previous?.to === args.version && previous.outcome === "retrying" ? (previous.attempts ?? 1) + 1 : 1;
+    update = { ...update, attempts };
+  }
+  try {
+    writeLastUpdate(args.configPath, update);
+  } catch (err) {
+    args.log.error(`could not record the update attempt: ${messageOf(err)}`);
+  }
+  if (failure.outcome === "retrying") {
+    return {
+      kind: "retrying",
+      reason: failure.reason,
+      detail: failure.detail ?? failure.reason,
+      attempts: update.attempts ?? 1,
+      retryAtMs: retryAfterMs(update)
+    };
+  }
+  return { kind: "failed", outcome: failure.outcome, reason: failure.reason };
+}
+async function earlyFailure(args) {
+  const current = currentVersion(args.configPath);
+  if (current !== args.own) return { outcome: "retrying", reason: `current names ${current ?? "nothing"}, not the running ${args.own}` };
+  let meta;
+  try {
+    meta = await fetchVersionMeta(args.version, args.deps.fetchImpl);
+  } catch (err) {
+    return retryFailure(args.version, err);
+  }
+  if (meta.kind === "not_published") return { outcome: "not_published", reason: `the registry has no @outerlayer/cli ${args.version}` };
+  const node = args.deps.nodeVersion ?? process.version;
+  if (meta.nodeRange !== void 0 && satisfiesRange(node, meta.nodeRange) === false) {
+    return {
+      outcome: "retrying",
+      reason: `${args.version} needs Node ${meta.nodeRange}, which this host does not run`,
+      detail: `${args.version} needs Node ${meta.nodeRange}; this host runs ${node}`
+    };
+  }
+  const npm = await npmVersion(args.deps.runNpm, dirname(args.configPath));
+  if (npm === void 0 || !npmSupportsProvenance(npm)) {
+    return {
+      outcome: "retrying",
+      reason: "npm on this host cannot verify provenance; 9.5 or later is needed",
+      detail: `npm ${npm ?? "(not found)"} cannot verify provenance; 9.5 or later is needed`
+    };
+  }
+  return void 0;
+}
+async function preflightUpdate(args) {
+  const failure = await earlyFailure(args);
+  return failure === void 0 ? void 0 : finish(args, failure);
+}
+async function performUpdate(args) {
+  const { configPath, own, version, deps } = args;
+  const early = await earlyFailure(args);
+  if (early !== void 0) return finish(args, early);
+  let verified;
+  try {
+    verified = await verifyVersion(configPath, version, deps);
+  } catch (err) {
+    return finish(args, retryFailure(version, err));
+  }
+  if (!verified.ok) return finish(args, { outcome: verified.outcome, reason: verified.reason });
+  const staged = await deps.runNode([entryIn(verified.dir), "runner", "check", "--config", configPath], verified.dir);
+  if (staged.status !== 0) {
+    try {
+      rmSync(verified.dir, { recursive: true, force: true });
+    } catch {
+    }
+    return finish(args, {
+      outcome: "retrying",
+      reason: `${version} failed \`runner check\` on this host (exit ${staged.status})`,
+      detail: `${version} failed \`runner check\` on this host: ${(staged.stderr.trim() || staged.stdout.trim()).slice(0, 500)}`
+    });
+  }
+  try {
+    if (version !== own) rmSync(versionDir(configPath, version), { recursive: true, force: true });
+    renameSync(verified.dir, versionDir(configPath, version));
+    writeMarker(configPath, { from: own, to: version, starts: 0 });
+    switchCurrent(configPath, version);
+  } catch (err) {
+    try {
+      rmSync(verified.dir, { recursive: true, force: true });
+      if (currentVersion(configPath) !== version) removeMarker(configPath);
+    } catch {
+    }
+    return finish(args, retryFailure(version, err));
+  }
+  try {
+    cleanVersions(configPath, [version, own]);
+  } catch (err) {
+    args.log.error(`could not remove an old version from the install layout: ${messageOf(err)}`);
+  }
+  args.log.line(`updating ${own} -> ${version} \xB7 restarting`);
+  return { kind: "switched" };
+}
+function rollBack(configPath, marker, reason, detail, now, log) {
+  try {
+    writeLastUpdate(configPath, { from: marker.from, to: marker.to, outcome: "rolled_back", reason, at: isoAt(now) });
+  } catch (err) {
+    log.error(`could not record the rollback: ${messageOf(err)}`);
+  }
+  try {
+    switchCurrent(configPath, marker.from);
+    removeMarker(configPath);
+  } catch (err) {
+    log.error(`could not put ${marker.from} back as current: ${messageOf(err)}`);
+  }
+  log.error(`rolled back ${marker.to} -> ${marker.from}: ${detail}`);
+}
+async function onStartUnderMarker(args) {
+  const { configPath, own, now, log } = args;
+  const marker = readMarker(configPath);
+  if (marker === void 0) return "proceed";
+  if (marker.to !== own) {
+    const switchedAway = marker.from === own && currentVersion(configPath) === marker.to;
+    const recorded = readLastUpdate(configPath);
+    if (switchedAway && !(recorded?.to === marker.to && recorded.outcome === "rolled_back")) {
+      const reason = `the service started ${own}, not ${marker.to}: it does not start the runner through current`;
+      rollBack(configPath, marker, reason, reason, now, log);
+      return "proceed";
+    }
+    removeMarker(configPath);
+    return "proceed";
+  }
+  const starts = marker.starts + 1;
+  if (starts > MAX_MARKER_STARTS) {
+    const reason = `${marker.to} started ${marker.starts} times without completing its first poll`;
+    rollBack(configPath, marker, reason, reason, now, log);
+    return "restart";
+  }
+  writeMarker(configPath, { ...marker, starts });
+  const result = await args.check();
+  if (!result.ok) {
+    rollBack(configPath, marker, `${result.check} failed`, `${result.check} failed: ${result.message}`, now, log);
+    return "restart";
+  }
+  return "proceed";
+}
+function settleUpdate(args) {
+  const marker = readMarker(args.configPath);
+  if (marker === void 0 || marker.to !== args.own) return;
+  try {
+    removeMarker(args.configPath);
+    writeLastUpdate(args.configPath, { from: marker.from, to: marker.to, outcome: "updated", reason: null, at: isoAt(args.now) });
+    args.log.line(`updated ${marker.from} -> ${marker.to}`);
+  } catch (err) {
+    args.log.error(`could not keep the update to ${marker.to}: ${messageOf(err)}`);
+  }
+}
+
+// src/runner/loop.ts
+var QUEUE_ORDER = ["amend", "implement"];
+var TRACKER_REPOSITORY_HOSTS = {
+  github: "github.com",
+  gitlab: "gitlab.com"
+};
+function logOf(state) {
+  state.deps.log ??= createRunnerLog(state.deps.now ?? (() => /* @__PURE__ */ new Date()));
+  return state.deps.log;
+}
+function nowOf(state) {
+  return (state.deps.now ?? (() => /* @__PURE__ */ new Date()))();
+}
+function runtimeOf(state) {
+  state.containerRuntime ??= createContainerRuntime(state.deps.container);
+  return state.containerRuntime;
+}
+function finishDepsOf(state) {
+  return {
+    fetchImpl: state.deps.fetchImpl,
+    spawnFn: state.deps.spawnFn,
+    now: state.deps.now,
+    sleep: state.deps.sleep,
+    log: logOf(state),
+    cliVersion: state.deps.cliVersion,
+    // Any job that has a container needs the runtime to stop and remove it, including one a config change left behind.
+    container: runtimeOf(state)
+  };
+}
+var DRAIN_LOG_EVERY_PASSES = 30;
+var REPEAT_EVERY_TICKS = 10;
+function reportRepeating(state, key, message, level = "error") {
+  const log = logOf(state);
+  const repeats = state.repeats ??= /* @__PURE__ */ new Map();
+  const seen = repeats.get(key);
+  if (message === void 0) {
+    if (seen) {
+      if (level === "error") log.line(`recovered: ${key} is working again, after ${seen.ticks} tick(s) failing`);
+      repeats.delete(key);
+    }
+    return;
+  }
+  if (!seen || seen.message !== message) {
+    repeats.set(key, { message, ticks: 1 });
+    log[level](message);
+    return;
+  }
+  seen.ticks++;
+  if (seen.ticks % REPEAT_EVERY_TICKS === 0) {
+    log[level](`still failing: ${message} (${seen.ticks} ticks)`);
+  }
+}
+function deriveRepo(item) {
+  const host = item.tracker === void 0 ? void 0 : TRACKER_REPOSITORY_HOSTS[item.tracker];
+  if (host === void 0) return void 0;
+  const hash = item.trackerKey.lastIndexOf("#");
+  const repoPart = hash === -1 ? item.trackerKey : item.trackerKey.slice(0, hash);
+  return repoPart === "" ? void 0 : `${host}/${repoPart}`;
+}
+async function listStartable(config, queue, fetchImpl) {
+  const query = queue === "amend" ? "needs=amend&startable=true" : "startable=true";
+  const page = await getJson(
+    config.url,
+    `/v1/work-items?${query}`,
+    config.apiKey,
+    config.appId,
+    fetchImpl,
+    await signerFor(config.configPath)
+  );
+  return Array.isArray(page.data) ? page.data : [];
+}
+function reloadConfig(state) {
+  let mtimeMs;
+  try {
+    mtimeMs = statSync(state.config.configPath).mtimeMs;
+  } catch {
+    return;
+  }
+  if (state.configMtimeMs === mtimeMs) return;
+  state.configMtimeMs = mtimeMs;
+  try {
+    const reloaded = loadRunnerConfig(state.config.configPath);
+    const hookProblem = checkHooks(reloaded);
+    if (hookProblem) {
+      logOf(state).error(`config re-read rejected: ${hookProblem} \xB7 keeping the last good config`);
+      return;
+    }
+    state.config = reloaded;
+    const timerNote = state.pollTimerSeconds !== void 0 && state.pollTimerSeconds !== reloaded.pollSeconds ? ` \xB7 still polling every ${state.pollTimerSeconds}s until the runner restarts` : "";
+    logOf(state).line(`config re-read \xB7 ${describeConfig(reloaded)}${timerNote}`);
+  } catch (err) {
+    logOf(state).error(`config re-read rejected: ${describeCallFailure(err)} \xB7 keeping the last good config`);
+  }
+}
+function describeConfig(config) {
+  return `queues ${config.queues.join(",")} \xB7 concurrency ${config.concurrency} \xB7 poll ${config.pollSeconds}s`;
+}
+async function sendTickHeartbeat(state, workRequest) {
+  if (state.heartbeating) {
+    if (workRequest !== void 0) state.queuedWorkRequest = workRequest;
+    reportRepeating(state, "the heartbeat's previous call", "heartbeat held: the previous heartbeat is still in flight", "line");
+    return;
+  }
+  state.heartbeating = true;
+  try {
+    let next = workRequest;
+    for (; ; ) {
+      reportRepeating(state, "the heartbeat's previous call", void 0, "line");
+      const result = await sendHeartbeat(
+        {
+          configPath: state.config.configPath,
+          url: state.config.url,
+          apiKey: state.config.apiKey,
+          appId: state.config.appId,
+          host: state.config.host,
+          cliVersion: state.deps.cliVersion ?? resolveVersion(),
+          pollSeconds: state.pollTimerSeconds ?? state.config.pollSeconds,
+          slotsUsed: state.jobs.size,
+          slotsTotal: state.config.concurrency,
+          workRequest: next,
+          lastUpdate: readLastUpdate(state.config.configPath)
+        },
+        state.deps.fetchImpl
+      );
+      reportRepeating(state, "the heartbeat", result.ok ? void 0 : `heartbeat failed: ${result.reason}`);
+      if (result.ok) considerNamedVersion(state, result.runnerVersion);
+      next = state.queuedWorkRequest;
+      state.queuedWorkRequest = void 0;
+      if (next === void 0) break;
+    }
+  } finally {
+    state.heartbeating = false;
+  }
+}
+function ownVersionOf(deps) {
+  return (deps.cliVersion ?? resolveVersion()).split(" ")[0] ?? "";
+}
+function selfUpdateBlocker(configPath, entryPath, own) {
+  const reinstall = "run `outerlayer runner install` and start the runner from the ExecStart line it prints";
+  if (!isInLayout(configPath, entryPath)) return `it was not started from its install layout \xB7 ${reinstall}`;
+  if (!startedThroughCurrent(configPath, entryPath)) {
+    return `its service starts a version directory instead of \`current\`, so a switch would not change what runs \xB7 ${reinstall}`;
+  }
+  const current = currentVersion(configPath);
+  if (current !== own) return `\`current\` names ${current ?? "nothing"}, not the running ${own} \xB7 restart the runner`;
+  return void 0;
+}
+function considerNamedVersion(state, named) {
+  const update = state.deps.update;
+  if (update === void 0 || named === void 0) return;
+  const configPath = state.config.configPath;
+  const own = ownVersionOf(state.deps);
+  const blocker = selfUpdateBlocker(configPath, update.entryPath, own);
+  const decision = decide({
+    own,
+    named,
+    autoUpdate: state.config.autoUpdate,
+    fromCurrent: blocker === void 0,
+    record: readLastUpdate(configPath),
+    nowMs: nowOf(state).getTime()
+  });
+  const updating = decision === "update" && !retryHeld(state, named);
+  state.pendingUpdate = updating ? named : void 0;
+  if (!updating || state.preflightedUpdate !== named) state.preflightedUpdate = void 0;
+  if (decision === "cannot_self_update" && !state.cannotSelfUpdateLogged) {
+    state.cannotSelfUpdateLogged = true;
+    logOf(state).line(`this runner cannot update itself to ${named}: ${blocker}`);
+  }
+}
+function retryHeld(state, version) {
+  return state.updateRetry?.version === version && nowOf(state).getTime() < state.updateRetry.retryAtMs;
+}
+function updateArgsOf(state, update, version) {
+  return {
+    configPath: state.config.configPath,
+    own: ownVersionOf(state.deps),
+    version,
+    deps: update,
+    now: () => nowOf(state).getTime(),
+    log: logOf(state)
+  };
+}
+function dropPendingUpdate(state) {
+  state.pendingUpdate = void 0;
+  state.preflightedUpdate = void 0;
+}
+function reportUpdateResult(state, version, result) {
+  if (result.kind === "retrying") state.updateRetry = { version, retryAtMs: result.retryAtMs };
+  if (result.kind === "failed") {
+    if (result.outcome === "verification_failed") logOf(state).error(`not updating to ${version}: ${result.reason}`);
+    return;
+  }
+  const retryAt = new Date(result.retryAtMs).toISOString().slice(11, 16);
+  logOf(state).error(`could not update to ${version}: ${result.detail} \xB7 attempt ${result.attempts}, trying again after ${retryAt} UTC`);
+}
+async function updateWhenIdle(state) {
+  const update = state.deps.update;
+  const version = state.pendingUpdate;
+  if (update === void 0 || version === void 0) return false;
+  if (!state.config.autoUpdate || retryHeld(state, version)) {
+    dropPendingUpdate(state);
+    return false;
+  }
+  if (state.jobs.size > 0) {
+    const record = readLastUpdate(state.config.configPath);
+    if (record?.to === version && record.outcome === "retrying") {
+      const failedAtMs = record.at === void 0 ? Number.NaN : Date.parse(record.at);
+      if (!(nowOf(state).getTime() >= failedAtMs + RETRY_MAX_WAIT_MS)) return false;
+    }
+    if (state.preflightedUpdate === version) return true;
+    const early = await preflightUpdate(updateArgsOf(state, update, version));
+    if (early !== void 0) {
+      dropPendingUpdate(state);
+      reportUpdateResult(state, version, early);
+      return false;
+    }
+    state.preflightedUpdate = version;
+    return true;
+  }
+  dropPendingUpdate(state);
+  const result = await performUpdate(updateArgsOf(state, update, version));
+  if (result.kind === "switched") {
+    (state.exitForUpdate ?? (() => update.exit(RESTART_EXIT_STATUS)))();
+    return true;
+  }
+  reportUpdateResult(state, version, result);
+  return false;
+}
+async function tick(state) {
+  if (state.ticking) {
+    await sendTickHeartbeat(state, void 0);
+    return;
+  }
+  state.ticking = true;
+  state.lastWorkRequest = void 0;
+  try {
+    await runTick(state);
+  } catch (err) {
+    logOf(state).error(`unexpected error: ${describeCallFailure(err)}`);
+  } finally {
+    state.ticking = false;
+  }
+  await sendTickHeartbeat(state, state.lastWorkRequest);
+}
+async function runTick(state) {
+  reloadConfig(state);
+  if (await updateWhenIdle(state)) return;
+  const log = logOf(state);
+  const repoFilter = new RepoFilter(state.config.repos);
+  let filtered = 0;
+  let attempts = 0;
+  while (state.jobs.size < state.config.concurrency && attempts < state.config.concurrency) {
+    attempts++;
+    let claimed = false;
+    for (const queue of QUEUE_ORDER) {
+      if (!state.config.queues.includes(queue)) continue;
+      let items;
+      try {
+        items = await listStartable(state.config, queue, state.deps.fetchImpl);
+        reportRepeating(state, "the work item list", void 0);
+        state.lastWorkRequest = { ok: true };
+      } catch (err) {
+        state.lastWorkRequest = workRequestFromFailure(err);
+        reportRepeating(state, "the work item list", `list failed: ${describeCallFailure(err)} \xB7 retrying next tick`);
+        return;
+      }
+      for (const item of items) {
+        if (item.startable === false) continue;
+        if (!repoFilter.allows(deriveRepo(item))) {
+          filtered++;
+          continue;
+        }
+        const attempt = await tryClaimAndStart(state, item, queue);
+        if (attempt.kind === "started") {
+          claimed = true;
+          break;
+        }
+        if (attempt.kind === "outdated" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch") {
+          return;
+        }
+        if (attempt.kind === "error") {
+          log.error(`claim for #${item.number} failed: ${attempt.reason} \xB7 retrying next tick`);
+          return;
+        }
+      }
+      if (claimed) break;
+    }
+    if (!claimed) break;
+  }
+  reportRepeating(
+    state,
+    "the repository filter",
+    filtered === 0 ? void 0 : `skipped ${filtered} listed item(s) not allowed by repos.include/exclude`,
+    "line"
+  );
+}
+var CLAIM_REFUSAL_CODES = new Set(
+  "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
+);
+async function tryClaimAndStart(state, item, queue) {
+  const { postJson: postJson2 } = await import('./work-cmd-UOQO2AD4.js');
+  const log = logOf(state);
+  const hostKey = await loadHostKey(state.config.configPath);
+  const claim = await retrySend(
+    () => postJson2(
+      state.config.url,
+      `/v1/work-items/${item.number}/claim`,
+      state.config.apiKey,
+      state.config.appId,
+      {
+        host: state.config.host,
+        kind: queue,
+        seconds: LEASE_SECONDS,
+        runnerProtocol: RUNNER_PROTOCOL,
+        ...hostKey === void 0 ? {} : { hostKey: hostKey.hostKey }
+      },
+      state.deps.fetchImpl,
+      void 0,
+      hostKey?.signer
+    ),
+    { now: state.deps.now, sleep: state.deps.sleep }
+  );
+  if (!claim.ok) {
+    if (CLAIM_REFUSAL_CODES.has(claim.code ?? "")) {
+      log.line(`#${item.number} skipped: ${claim.code} \xB7 ${claim.message ?? claim.reason}`);
+      return { kind: "held" };
+    }
+    if (claim.code === "claim_not_held" || claim.reason.includes("(409)") || /work_item_claimed|held by/i.test(claim.reason)) {
+      log.line(`#${item.number} claim refused: ${claim.reason}`);
+      return { kind: "held" };
+    }
+    state.lastWorkRequest = workRequestFromRetryFailure(claim);
+    if (isSignatureRefusal(claim.code)) {
+      reportRepeating(state, "the request signature", claim.message ?? claim.reason);
+      return { kind: "signature" };
+    }
+    if (claim.code === "runner_upgrade_required") {
+      reportRepeating(state, "the runner protocol", claim.message ?? claim.reason);
+      return { kind: "outdated" };
+    }
+    return { kind: "error", reason: `${claim.reason} (${claim.attempts} attempt(s))` };
+  }
+  reportRepeating(state, "the runner protocol", void 0);
+  reportRepeating(state, "the request signature", void 0);
+  const { data } = claim.value;
+  const claimId = data.id === void 0 || data.id === null ? "" : String(data.id);
+  if (claimId === "") {
+    return { kind: "error", reason: "the claim response carried no claim id" };
+  }
+  if (wasExtended(data)) {
+    log.line(
+      `#${item.number} skipped: the claim extended a live lease under host "${state.config.host}" \xB7 set a distinct runner.host per config file`
+    );
+    return { kind: "held" };
+  }
+  if (claimIsAlreadyRunning(state, claimId)) {
+    log.line(`#${item.number} skipped: claim ${shortClaim(claimId)} is already running here`);
+    return { kind: "held" };
+  }
+  const itemKey = typeof data.itemKey === "string" && data.itemKey !== "" ? data.itemKey : void 0;
+  if (itemKey === void 0) {
+    const released = await retrySend(
+      () => releaseLease(state.config, item.number, void 0, {}, state.deps.fetchImpl),
+      { now: state.deps.now, sleep: state.deps.sleep }
+    );
+    reportRepeating(
+      state,
+      "the item key",
+      `the gateway returned no item key for #${item.number}; upgrade the gateway. ` + (released.ok ? "The claim was released and no build started" : `No build started, but releasing the claim failed (${released.reason}), so it stays held until its lease lapses`)
+    );
+    return { kind: "no_item_key" };
+  }
+  reportRepeating(state, "the item key", void 0);
+  const branch = typeof data.branch === "string" && data.branch !== "" ? data.branch : void 0;
+  if (branch === void 0) {
+    const released = await retrySend(
+      () => releaseLease(state.config, item.number, void 0, {}, state.deps.fetchImpl),
+      { now: state.deps.now, sleep: state.deps.sleep }
+    );
+    reportRepeating(
+      state,
+      "the branch",
+      `the gateway named no branch for #${item.number}; upgrade the gateway. ` + (released.ok ? "The claim was released and no build started" : `No build started, but releasing the claim failed (${released.reason}), so it stays held until its lease lapses`)
+    );
+    return { kind: "no_branch" };
+  }
+  reportRepeating(state, "the branch", void 0);
+  const identity = parseClaimIdentity(data);
+  try {
+    await startJob(state, item, queue, claimId, itemKey, branch, identity);
+  } catch (err) {
+    const stranded = [...state.jobs.values()].find((active) => active.job.claimId === claimId);
+    if (stranded === void 0) throw err;
+    const reason = `provision failed: ${describeCallFailure(err)}`;
+    logOf(state).error(`#${item.number} ${reason} \xB7 ending job as failed`);
+    await endJob(state, stranded, "failed", { stage: "provision", reason });
+  }
+  return { kind: "started" };
+}
+function claimIsAlreadyRunning(state, claimId) {
+  for (const active of state.jobs.values()) {
+    if (active.job.claimId === claimId) return true;
+  }
+  for (const { job } of listJobFiles(state.config.configPath)) {
+    if (job.claimId === claimId && isUnfinished(job)) return true;
+  }
+  return false;
+}
+function wasExtended(claim) {
+  const createdAtMs = Date.parse(String(claim.createdAt ?? ""));
+  const expiresAtMs = Date.parse(String(claim.expiresAt ?? ""));
+  if (!Number.isFinite(createdAtMs) || !Number.isFinite(expiresAtMs)) return false;
+  return expiresAtMs - createdAtMs > LEASE_SECONDS * 1e3 + 2e3;
+}
+async function startJob(state, item, queue, claimId, itemKey, branch, identity) {
+  const log = logOf(state);
+  const startedAt = nowOf(state);
+  const dirPath = freeJobDir(state.config.configPath, queue, item.number, claimId, startedAt);
+  mkdirSync(dirPath, { recursive: true, mode: RUNNER_DIR_MODE });
+  const runnerRoot = runnerDir(state.config.configPath);
+  const jobFilePath = join(dirPath, "job.json");
+  let job = {
+    item: item.number,
+    queue,
+    claimId,
+    itemKey,
+    branch,
+    commitIdentity: identity,
+    startedAt: startedAt.toISOString()
+  };
+  writeJobFile(jobFilePath, job);
+  const active = {
+    job,
+    dirPath,
+    lastRenewAtMs: startedAt.getTime(),
+    cmd: null,
+    cpuSample: null,
+    ending: false
+  };
+  state.jobs.set(dirPath, active);
+  log.line(
+    `claimed ${queue} #${item.number} ${item.trackerKey} (claim ${shortClaim(claimId)}) \u2192 ${relativeToRunner(runnerRoot, dirPath)}`
+  );
+  const hookLimits = () => hookLimitsFor(state.config, startedAt.getTime(), state.deps.now);
+  const tag = `#${item.number}`;
+  const containerMode = isBuiltinContainer(state.config.hooks.provision);
+  const vmMode = isBuiltinVm(state.config.hooks.provision);
+  let tokens;
+  if (containerMode || vmMode) {
+    active.job.environment = { isolation: vmMode ? "vm" : "container", cliVersion: state.deps.cliVersion ?? resolveVersion() };
+    writeJobFile(jobFilePath, active.job);
+    tokens = buildTokensFor(state, active, item.number);
+    runtimeOf(state).credentials.set(dirPath, tokens);
+    try {
+      await tokens.token("read");
+    } catch (err) {
+      if (active.ending) return;
+      await endOnTokenRefusal(state, active, err);
+      return;
+    }
+    if (active.ending) return;
+  }
+  if (state.config.hooks.report) {
+    setStage(job, dirPath, "report");
+    log.line(`${tag} report started \xB7 phase start`);
+    const reportStartedMs = nowOf(state).getTime();
+    const startEnv = { ...jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), OUTERLAYER_PHASE: "start" };
+    const report = await runHook(
+      state.config.hooks.report,
+      startEnv,
+      dirPath,
+      join(dirPath, "report.log"),
+      state.deps.spawnFn,
+      hookLimits()
+    ).catch((err) => {
+      log.error(`${tag} report failed: ${describeCallFailure(err)} \xB7 continuing`);
+      return { code: -1 };
+    });
+    const took = formatDuration(nowOf(state).getTime() - reportStartedMs);
+    if (report.endedBy !== void 0) {
+      log.error(`${tag} ${describeHookEnd("report", report.endedBy, state.config)} \xB7 continuing`);
+    } else if (report.code === 0) {
+      log.line(`${tag} report ok (${took})`);
+    } else if (report.code > 0) {
+      log.error(`${tag} report exited ${report.code} (${took}) \xB7 continuing`);
+    }
+  }
+  setStage(job, dirPath, "provision");
+  log.line(`${tag} provision started`);
+  const provisionStartedMs = nowOf(state).getTime();
+  const processMode = isBuiltinProcess(state.config.hooks.provision);
+  const cliVersion = state.deps.cliVersion ?? resolveVersion();
+  let workdir;
+  let cgroup;
+  if (containerMode) {
+    const provisioned = await provisionContainer({
+      config: state.config,
+      runtime: runtimeOf(state),
+      item,
+      itemKey,
+      tokens,
+      branch,
+      jobDir: dirPath,
+      cliVersion,
+      log,
+      save: (container, environment) => {
+        active.job.container = container;
+        active.job.environment = environment;
+        writeJobFile(jobFilePath, active.job);
+      },
+      aborted: () => active.ending,
+      deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
+      fetchImpl: state.deps.fetchImpl,
+      now: state.deps.now
+    }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
+    const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
+    if (active.ending) return;
+    if (!provisioned.ok) {
+      log.error(`${tag} provision failed (${provisionTook}): ${provisioned.reason} \xB7 ending job as failed`);
+      await endJob(state, active, "failed", { stage: "provision", reason: provisioned.reason });
+      return;
+    }
+    log.line(`${tag} provision ok (${provisionTook}) \xB7 container ${provisioned.state.container}`);
+    workdir = provisioned.workdir;
+    active.job.container = provisioned.state;
+    active.job.environment = provisioned.environment;
+    installCommitHooks(active.job, log, tag);
+  } else if (vmMode) {
+    const provisioned = await provisionMicroVm({
+      config: state.config,
+      runtime: runtimeOf(state),
+      item,
+      itemKey,
+      tokens,
+      branch,
+      jobDir: dirPath,
+      cliVersion,
+      log,
+      save: (microvm, environment) => {
+        active.job.microvm = microvm;
+        active.job.environment = environment;
+        writeJobFile(jobFilePath, active.job);
+      },
+      aborted: () => active.ending,
+      deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
+      fetchImpl: state.deps.fetchImpl,
+      now: state.deps.now
+    }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
+    const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
+    if (active.ending) return;
+    if (!provisioned.ok) {
+      log.error(`${tag} provision failed (${provisionTook}): ${provisioned.reason} \xB7 ending job as failed`);
+      await endJob(state, active, "failed", { stage: "provision", reason: provisioned.reason });
+      return;
+    }
+    log.line(`${tag} provision ok (${provisionTook}) \xB7 microVM build ${provisioned.state.buildId}`);
+    workdir = provisioned.workdir;
+    active.job.microvm = provisioned.state;
+    active.job.environment = provisioned.environment;
+    installCommitHooks(active.job, log, tag);
+    const identity2 = active.job.commitIdentity;
+    if (identity2?.hooksPath !== void 0) {
+      try {
+        await deliverCommitHooks({ runtime: runtimeOf(state), state: provisioned.state, hooksDir: join(provisioned.state.buildDir, HOOKS_DIR_NAME) });
+      } catch (err) {
+        identity2.hooksPath = void 0;
+        log.error(`${tag} could not write the commit hooks into the microVM: ${describeCallFailure(err)} \xB7 continuing without a co-author line`);
+      }
+    }
+  } else if (processMode) {
+    active.job.environment = sharedUserEnvironment(cliVersion);
+    writeJobFile(jobFilePath, active.job);
+    const provisioned = await provisionProcess({
+      config: state.config,
+      runtime: runtimeOf(state),
+      item,
+      itemKey,
+      jobDir: dirPath,
+      cliVersion,
+      log,
+      save: (build, environment) => {
+        active.job.build = build;
+        active.job.environment = environment;
+        writeJobFile(jobFilePath, active.job);
+      },
+      aborted: () => active.ending
+    }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}` }));
+    const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
+    if (active.ending) return;
+    if (!provisioned.ok) {
+      log.error(`${tag} provision failed (${provisionTook}): ${provisioned.reason} \xB7 ending job as failed`);
+      await endJob(state, active, "failed", { stage: "provision", reason: provisioned.reason });
+      return;
+    }
+    log.line(`${tag} provision ok (${provisionTook}) \xB7 workdir ${relativeToRunner(runnerRoot, provisioned.workdir)}`);
+    workdir = provisioned.workdir;
+    active.job.build = provisioned.state;
+    active.job.environment = provisioned.environment;
+    installCommitHooks(active.job, log, tag);
+  } else {
+    const runtime = runtimeOf(state);
+    const build = await startHostBuild(state, active, item.specRepository ?? void 0);
+    const provisionEnv = provisionEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), {
+      buildDir: build.state.buildDir,
+      repository: item.specRepository,
+      recipeCommit: build.recipeCommit,
+      limits: {
+        memory: state.config.build?.memory ?? "8g",
+        cpus: state.config.build?.cpus ?? 4,
+        pids: state.config.build?.pids ?? 4096,
+        disk: state.config.build?.disk ?? "40g"
+      }
+    });
+    const provision = await runHook(
+      state.config.hooks.provision,
+      provisionEnv,
+      dirPath,
+      join(dirPath, "provision.log"),
+      state.deps.spawnFn,
+      hookLimits()
+    ).catch((err) => {
+      log.error(`${tag} provision failed: ${describeCallFailure(err)}`);
+      return { code: -1 };
+    });
+    const provisionExit = provision.code;
+    const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
+    if (active.ending) return;
+    if (provision.endedBy !== void 0) {
+      log.error(`${tag} ${describeHookEnd("provision", provision.endedBy, state.config)}`);
+      await endJob(state, active, "failed");
+      return;
+    }
+    if (provision.signal !== void 0) {
+      log.error(`${tag} provision killed by ${provision.signal} (${provisionTook})`);
+      await endJob(state, active, "failed");
+      return;
+    }
+    if (provisionExit === 75) {
+      log.line(`${tag} provision declined the item (exit 75, ${provisionTook})`);
+      await endJob(state, active, void 0);
+      return;
+    }
+    if (provisionExit !== 0) {
+      log.error(`${tag} provision exited ${provisionExit} (${provisionTook}) \xB7 ending job as failed`);
+      await endJob(state, active, "failed", {
+        stage: "provision",
+        exitCode: provisionExit < 0 ? void 0 : provisionExit
+      });
+      return;
+    }
+    const provisioned = readProvisionOut(dirPath);
+    if (!provisioned.ok) {
+      log.error(`${tag} provision wrote no workdir= line to provision.out \xB7 ending job as failed`);
+      await endJob(state, active, "failed");
+      return;
+    }
+    const resolved = resolveHostBuild(provisioned);
+    if (!resolved.ok) {
+      log.error(`${tag} ${resolved.reason} \xB7 ending job as failed`);
+      await endJob(state, active, "failed", { stage: "provision", reason: resolved.reason });
+      return;
+    }
+    const named = resolved.build;
+    const badWorkdir = named.exec === void 0 ? workdirProblem(provisioned.workdir) : void 0;
+    if (badWorkdir !== void 0) {
+      log.error(
+        `${tag} provision reported a workdir that ${badWorkdir}: ${provisioned.workdir} \xB7 ending job as failed`
+      );
+      await endJob(state, active, "failed");
+      return;
+    }
+    if (named.exec !== void 0 || named.broker !== void 0) {
+      const tunnel = runtime.tunnels.get(build.state.buildId);
+      if (tunnel === void 0) {
+        const why = `the tunnel could not start: ${build.failed ?? "no reason recorded"}`;
+        log.error(`${tag} provision failed: ${why} \xB7 ending job as failed`);
+        await endJob(state, active, "failed", { stage: "provision", reason: why });
+        return;
+      }
+      if (named.broker !== void 0) {
+        try {
+          await listenOnBroker(tunnel, named.broker.text);
+        } catch (err) {
+          const why = `the tunnel could not listen on ${named.broker.text}: ${describeCallFailure(err)}`;
+          log.error(`${tag} provision failed: ${why} \xB7 ending job as failed`);
+          await endJob(state, active, "failed", { stage: "provision", reason: why });
+          return;
+        }
+        build.state.broker = named.broker.text;
+      }
+      if (named.exec !== void 0) build.state.exec = named.exec;
+    }
+    active.job.environment = hostEnvironment(named, cliVersion);
+    writeJobFile(jobFilePath, active.job);
+    if (named.exec !== void 0 && named.recipe !== void 0) {
+      const lifecycleEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build.state, state.config);
+      for (const step of lifecycleSteps(named.recipe.apply.lifecycle)) {
+        if (active.ending) return;
+        log.line(`${tag} lifecycle ${step.name} (${step.source})`);
+        const ran = await runHook(
+          named.exec,
+          lifecycleEnv,
+          dirPath,
+          join(dirPath, "provision.log"),
+          state.deps.spawnFn,
+          hookLimits(),
+          execArgv(provisioned.workdir, step.argv)
+        ).catch((err) => {
+          log.error(`${tag} lifecycle ${step.name} failed to start: ${describeCallFailure(err)}`);
+          return { code: -1 };
+        });
+        if (active.ending) return;
+        if (ran.code !== 0) {
+          const why = lifecycleFailureReason(step, ran.code);
+          log.error(`${tag} provision failed: ${why} \xB7 ending job as failed`);
+          await endJob(state, active, "failed", { stage: "provision", reason: why });
+          return;
+        }
+      }
+    }
+    log.line(`${tag} provision ok (${provisionTook}) \xB7 workdir ${relativeToRunner(runnerRoot, provisioned.workdir)}`);
+    workdir = provisioned.workdir;
+    cgroup = provisioned.cgroup;
+    installCommitHooks(active.job, log, tag);
+  }
+  job = { ...active.job, workdir, cgroup };
+  active.job = job;
+  writeJobFile(jobFilePath, job);
+  if (!containerMode && !vmMode) {
+    if (existsSync(join(workdir, ".git"))) {
+      try {
+        const prepared = await prepareBranch({ workdir, branch });
+        log.line(`${tag} on ${branch} at ${prepared.head.slice(0, 8)}`);
+      } catch (err) {
+        log.error(`${tag} could not put the workdir on ${branch}: ${describeCallFailure(err)} \xB7 ending job as failed`);
+        await endJob(state, active, "failed");
+        return;
+      }
+    } else {
+      log.line(`${tag} workdir is not a git checkout, so ${branch} was not checked out`);
+    }
+  }
+  const cmdline = state.config.commands[queue];
+  if (!cmdline) {
+    log.error(`${tag} has no runner.commands.${queue} in the config file \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "command" });
+    return;
+  }
+  let running;
+  try {
+    if (job.microvm !== void 0) {
+      const runtime = runtimeOf(state);
+      const composed = microVmCommandLine({ job, cmdline, runtime, config: state.config, cli: join(runtime.cliBuild().distDir, "index.js") });
+      running = runCommand(composed.line, { ...composed.env, OUTERLAYER_JOB_DIR: dirPath }, dirPath, join(dirPath, "command.log"), state.deps.spawnFn);
+    } else if (job.container !== void 0) {
+      const composed = containerCommandLine({ job, cmdline, runtime: runtimeOf(state), config: state.config });
+      running = runCommand(
+        composed.line,
+        { ...composed.env, OUTERLAYER_JOB_DIR: dirPath },
+        dirPath,
+        join(dirPath, "command.log"),
+        state.deps.spawnFn
+      );
+    } else {
+      const build = job.build;
+      const commandEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build, state.config, identity?.hooksPath);
+      running = build.exec === void 0 ? runCommand(cmdline, commandEnv, workdir, join(dirPath, "command.log"), state.deps.spawnFn) : runCommand(execCommandLine(build.exec, workdir, cmdline), commandEnv, dirPath, join(dirPath, "command.log"), state.deps.spawnFn);
+    }
+  } catch (err) {
+    log.error(`${tag} command could not start: ${describeCallFailure(err)} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "command" });
+    return;
+  }
+  active.cmd = running;
+  job = { ...job, stage: "command", pid: running.pid, start: running.start ?? void 0 };
+  active.job = job;
+  writeJobFile(jobFilePath, job);
+  const commandStartedMs = nowOf(state).getTime();
+  log.line(`${tag} command started \xB7 pid ${running.pid}`);
+  running.onExit.then(({ code, signal, error }) => {
+    if (active.ending) return;
+    if (error !== void 0) {
+      log.error(`${tag} command could not start: ${error.message} \xB7 ending job as failed`);
+      void endJob(state, active, "failed");
+      return;
+    }
+    const took = formatDuration(nowOf(state).getTime() - commandStartedMs);
+    if (signal !== null) {
+      log.error(`${tag} command killed by ${signal} (${took})`);
+      void endJob(state, active, "failed");
+      return;
+    }
+    log.line(`${tag} command exited ${code ?? 0} (${took})`);
+    if (code !== null) active.job.exitCode = code;
+    void endJob(state, active, code === 0 ? "ok" : "failed");
+  });
+}
+function buildTokensFor(state, active, item) {
+  return new BuildTokens({
+    config: state.config,
+    item,
+    fetchImpl: state.deps.fetchImpl,
+    now: state.deps.now,
+    sleep: state.deps.sleep,
+    apiUrl: runtimeOf(state).github.apiUrl,
+    onUsed: (kinds) => {
+      const cliVersion = state.deps.cliVersion ?? resolveVersion();
+      active.job.environment = { ...active.job.environment ?? { isolation: "container", cliVersion }, credentials: kinds };
+      writeJobFile(join(active.dirPath, "job.json"), active.job);
+    }
+  });
+}
+async function endOnTokenRefusal(state, active, err) {
+  const log = logOf(state);
+  const tag = `#${active.job.item}`;
+  const refusal = classifyRefusal(err);
+  if (refusal.kind === "retry") {
+    log.error(`${tag} the build's read token could not be had (${describeCallFailure(err)}) \xB7 releasing the claim to try again`);
+    await endJob(state, active, void 0);
+  } else if (refusal.kind === "lease_lost") {
+    log.error(`${tag} the build's read token was refused: ${refusalCode(err)} \xB7 ending job as lease_lost`);
+    await endJob(state, active, "lease_lost");
+  } else {
+    log.error(`${tag} the build's read token was refused: ${refusal.reason} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason: refusal.reason });
+  }
+}
+function installCommitHooks(job, log, tag) {
+  const identity = job.commitIdentity;
+  if (identity?.coAuthor === void 0) return;
+  const buildDir2 = job.container?.buildDir ?? job.microvm?.buildDir ?? (job.build.exec === void 0 ? job.build.buildDir : void 0);
+  if (buildDir2 === void 0) {
+    log.line(`${tag} the build runs through an exec, so its commits are not given a co-author line`);
+    return;
+  }
+  try {
+    const dir = writeCommitHooks(buildDir2, identity.coAuthor);
+    identity.hooksPath = job.container === void 0 && job.microvm === void 0 ? dir : `${JOB_MOUNT}/${HOOKS_DIR_NAME}`;
+  } catch (err) {
+    log.error(`${tag} could not write the commit hooks: ${describeCallFailure(err)} \xB7 continuing without a co-author line`);
+  }
+}
+async function startHostBuild(state, active, repository) {
+  const buildId = randomBytes(6).toString("hex");
+  const buildDir2 = buildDir(state.config.configPath, buildId);
+  const build = { buildId, buildDir: buildDir2 };
+  active.job.build = build;
+  writeJobFile(join(active.dirPath, "job.json"), active.job);
+  mkdirSync(buildDir2, { recursive: true });
+  chmodSync(buildDir2, 493);
+  const runtime = runtimeOf(state);
+  let failed2;
+  try {
+    await startHostServices({ runtime, config: state.config, build, jobDir: active.dirPath, itemKey: active.job.itemKey, process: false });
+  } catch (err) {
+    failed2 = describeCallFailure(err);
+    logOf(state).error(`#${active.job.item} the tunnel and destination servers could not start: ${failed2} \xB7 continuing`);
+  }
+  writeJobFile(join(active.dirPath, "job.json"), active.job);
+  let recipeCommit;
+  if (repository !== void 0 && repository !== "") {
+    const remote = runtime.remoteFor?.(repository) ?? `https://github.com/${repository}.git`;
+    recipeCommit = await runtime.readHead(remote, runnerDir(state.config.configPath)).catch(() => void 0);
+  }
+  return { state: build, recipeCommit, failed: failed2 };
+}
+function freeJobDir(configPath, queue, item, claimId, startedAt) {
+  const stamp = attemptStamp(startedAt);
+  for (let i = 0; i < 100; i++) {
+    const candidate = jobDir(configPath, queue, item, claimId, i === 0 ? stamp : `${stamp}-${i}`);
+    if (!existsSync(candidate)) return candidate;
+  }
+  return jobDir(configPath, queue, item, claimId, `${stamp}-${process.pid}`);
+}
+async function endJob(state, active, outcome, ending) {
+  if (active.ending) return;
+  active.ending = true;
+  try {
+    const finished = await finishJob(active.job, active.dirPath, outcome, state.config, finishDepsOf(state), ending);
+    active.job = finished;
+  } catch (err) {
+    logOf(state).error(`#${active.job.item} could not be ended cleanly: ${describeCallFailure(err)}`);
+  } finally {
+    state.jobs.delete(active.dirPath);
+  }
+}
+async function watchTick(state, active, nowMs, logMtimeMs) {
+  if (active.ending) return;
+  const log = logOf(state);
+  const tag = `#${active.job.item}`;
+  const pid = active.job.pid;
+  if (pid !== void 0 && !isGroupAlive(pid)) {
+    if (active.cmd === null) {
+      const recorded = outcomeFromExitCode(active.dirPath);
+      if (recorded === void 0) {
+        log.line(`${tag} command gone, no exit code recorded \xB7 ending job as interrupted`);
+        await endJob(state, active, "interrupted");
+      } else {
+        log.line(`${tag} command exited ${recorded.code}`);
+        active.job.exitCode = recorded.code;
+        await endJob(state, active, recorded.outcome);
+      }
+    }
+    return;
+  }
+  if (needsRenew(active.lastRenewAtMs, nowMs)) {
+    const renew = await retrySend(() => renewLease(state.config, active.job.item, state.deps.fetchImpl), {
+      now: state.deps.now,
+      sleep: state.deps.sleep
+    });
+    const result = renew.ok ? renew.value : "retry_later";
+    if (result === "lease_lost") {
+      log.error(`${tag} lease lost \xB7 ending job as lease_lost`);
+      await endJob(state, active, "lease_lost");
+      return;
+    }
+    if (result === "renewed") {
+      active.job.lastRenewAt = new Date(nowMs).toISOString();
+      writeJobFile(join(active.dirPath, "job.json"), active.job);
+      log.line(`${tag} lease renewed \xB7 expires ${formatClock(new Date(nowMs + LEASE_SECONDS * 1e3), new Date(nowMs))}`);
+    } else {
+      log.error(`${tag} renew did not land \xB7 retrying in ${RENEW_INTERVAL_SECONDS / 60}m`);
+    }
+    active.lastRenewAtMs = nowMs;
+  }
+  const tokens = active.job.container === void 0 && active.job.microvm === void 0 ? void 0 : runtimeOf(state).credentials.get(active.dirPath);
+  if (tokens !== void 0) {
+    await tokens.renewReadIfDue();
+    const refusal = tokens.refusal();
+    if (refusal?.kind === "lease_lost") {
+      log.error(`${tag} a token request was refused as a lost lease \xB7 ending job as lease_lost`);
+      await endJob(state, active, "lease_lost");
+      return;
+    }
+    if (refusal?.kind === "failed") {
+      log.error(`${tag} a token request was refused: ${refusal.reason} \xB7 ending job as failed`);
+      await endJob(state, active, "failed", { stage: pid === void 0 ? "provision" : "command", reason: refusal.reason });
+      return;
+    }
+  }
+  if (isTimedOut(new Date(active.job.startedAt).getTime(), nowMs, state.config.timeLimitMinutes)) {
+    log.line(`${tag} past the ${state.config.timeLimitMinutes}m time limit \xB7 ending job as timed_out`);
+    await endJob(state, active, "timed_out");
+    return;
+  }
+  if (pid === void 0) return;
+  if (active.job.container !== void 0) {
+    const limit = state.config.build?.disk ?? "40g";
+    const used = await measureDisk(runtimeOf(state), active.job.container);
+    if (exceedsDisk(used ?? 0, limit)) {
+      log.line(`${tag} the build's volume holds ${used} KiB, past ${limit} \xB7 ending job as failed`);
+      await endJob(state, active, "failed", { stage: "command", reason: "disk_limit_exceeded" });
+      return;
+    }
+  }
+  let cpuUsecPerMinute = null;
+  if (active.job.cgroup) {
+    const usec = readCpuUsec(active.job.cgroup);
+    if (usec !== null && active.cpuSample) {
+      const deltaUsec = usec - active.cpuSample.usec;
+      const deltaMinutes = (nowMs - active.cpuSample.atMs) / 6e4;
+      cpuUsecPerMinute = deltaMinutes > 0 ? deltaUsec / deltaMinutes : null;
+    }
+    if (usec !== null) active.cpuSample = { usec, atMs: nowMs };
+  }
+  if (isIdle(logMtimeMs, nowMs, state.config.idleLimitMinutes, cpuUsecPerMinute)) {
+    log.line(`${tag} no output for ${state.config.idleLimitMinutes}m \xB7 ending job as idle`);
+    await endJob(state, active, "idle");
+  }
+}
+async function probeCredentials(config, fetchImpl = fetch) {
+  try {
+    await listStartable(config, config.queues[0] ?? "implement", fetchImpl);
+    return { ok: true };
+  } catch (err) {
+    const status = err instanceof WorkCommandError ? err.status : void 0;
+    if (err instanceof WorkCommandError && isSignatureRefusal(err.code)) {
+      return {
+        ok: false,
+        fatal: err.code === "runner_key_signature_invalid",
+        reason: `${config.configPath}: ${err.message}`
+      };
+    }
+    if (status === 401 || status === 403) {
+      return {
+        ok: false,
+        fatal: true,
+        reason: `${config.configPath}: the API key was refused (${status}). A runner key needs git.read and work.read to list and read work items, and work.claim to claim, renew and release.`
+      };
+    }
+    return { ok: false, fatal: false, reason: describeCallFailure(err) };
+  }
+}
+async function start(configPath, deps = { fetchImpl: fetch }) {
+  const log = deps.log ??= createRunnerLog(deps.now ?? (() => /* @__PURE__ */ new Date()));
+  const update = deps.update;
+  if (update !== void 0) {
+    const outcome = await onStartUnderMarker({
+      configPath,
+      own: ownVersionOf(deps),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-WQP2CZDW.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
+      log
+    });
+    if (outcome === "restart") {
+      update.exit(RESTART_EXIT_STATUS);
+      throw new RunnerStartError("went back to the previous version; restarting");
+    }
+  }
+  const config = loadRunnerConfig(configPath);
+  const hookProblem = checkHooks(config);
+  if (hookProblem) throw new RunnerStartError(hookProblem);
+  await ensureHostKey(configPath);
+  const probe = await probeCredentials(config, deps.fetchImpl);
+  if (!probe.ok && probe.fatal) throw new RunnerStartError(probe.reason);
+  if (!probe.ok) log.error(`the gateway did not answer at start: ${probe.reason} \xB7 starting anyway`);
+  mkdirSync(jobsDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  const self = { pid: process.pid, start: startTimeOf(process.pid) ?? "" };
+  claimPidFile(pidFilePath(configPath), self);
+  let configMtimeMs;
+  try {
+    configMtimeMs = statSync(configPath).mtimeMs;
+  } catch {
+    configMtimeMs = void 0;
+  }
+  const state = { config, jobs: /* @__PURE__ */ new Map(), deps, configMtimeMs };
+  log.line(`runner ${config.host} started \xB7 config ${configPath} \xB7 ${describeConfig(config)}`);
+  const nowMs = () => deps.now ? deps.now().getTime() : Date.now();
+  const runningMicroVms = await stopOrphanedMicroVms({ jobs: unfinishedJobs(jobsDir(configPath)), runtime: runtimeOf(state) }).catch((err) => {
+    log.error(`a microVM an earlier runner left could not be stopped: ${describeCallFailure(err)}`);
+    return [];
+  });
+  for (const buildId of runningMicroVms) log.line(`stopped microVM build ${buildId}, left running by an earlier runner`);
+  for (const { dirPath, job } of listAdoptableJobs(jobsDir(configPath))) {
+    const adopted = { job, dirPath, lastRenewAtMs: nowMs(), cmd: null, cpuSample: null, ending: false };
+    state.jobs.set(dirPath, adopted);
+    if (job.container !== void 0) {
+      const tokens = buildTokensFor(state, adopted, job.item);
+      runtimeOf(state).credentials.set(dirPath, tokens);
+      await ensureTunnel(runtimeOf(state), job.container, dirPath, config, job.itemKey, job.branch);
+      try {
+        await tokens.token("read");
+        keepGhConfigCurrent(
+          tokens,
+          job.container.buildDir,
+          (err) => log.error(`#${job.item} the read token could not be written for gh: ${describeCallFailure(err)}`)
+        );
+      } catch (err) {
+        log.error(`#${job.item} could not give the adopted build a read token: ${describeCallFailure(err)}`);
+      }
+    }
+    if (job.build !== void 0 && !runtimeOf(state).tunnels.has(job.build.buildId)) {
+      await startHostServices({ runtime: runtimeOf(state), config, build: job.build, jobDir: dirPath, itemKey: job.itemKey, process: job.build.workDir !== void 0 }).catch((err) => {
+        log.error(`the tunnel of #${job.item} could not start again: ${describeCallFailure(err)}`);
+      });
+    }
+    log.line(`adopted job ${job.queue} #${job.item} (claim ${shortClaim(job.claimId)}) \xB7 pid ${job.pid} still running`);
+  }
+  for (const { job, released } of await retryFailedReleases(jobsDir(configPath), config, {
+    fetchImpl: deps.fetchImpl,
+    now: deps.now,
+    log
+  })) {
+    log.line(
+      released ? `released the lease on #${job.item} that an earlier attempt could not \xB7 outcome ${job.outcome ?? "none"}` : `the lease on #${job.item} still cannot be released: ${job.releaseFailed ?? "no reason recorded"}`
+    );
+  }
+  for (const recovered of await recoverLostJobs(jobsDir(configPath), config, finishDepsOf(state))) {
+    const why = recovered.exitCode === void 0 ? `pid ${recovered.pid ?? "unknown"} is gone, no exit code recorded` : `its command recorded exit ${recovered.exitCode}`;
+    log.line(
+      `recovered job ${recovered.queue} #${recovered.item} (claim ${shortClaim(recovered.claimId)}) as ${recovered.outcome ?? "interrupted"}: ${why}`
+    );
+  }
+  let intakeClosed = false;
+  let closed = false;
+  let draining = false;
+  let stopping = false;
+  let exited = false;
+  let interrupts = 0;
+  state.pollTimerSeconds = state.config.pollSeconds;
+  const pollTimer = setInterval(() => void tick(state), state.pollTimerSeconds * 1e3);
+  const watchTimer = setInterval(() => {
+    const now = nowMs();
+    for (const active of state.jobs.values()) {
+      let mtime = now;
+      try {
+        mtime = statSync(join(active.dirPath, "command.log")).mtimeMs;
+      } catch {
+      }
+      void watchTick(state, active, now, mtime).catch((err) => {
+        log.error(`#${active.job.item} health check failed: ${describeCallFailure(err)}`);
+      });
+    }
+  }, deps.watchIntervalMs ?? 3e4);
+  const onSigterm = () => void drain();
+  const onSigusr1 = () => void stopNow();
+  const onSigint = () => {
+    interrupts++;
+    if (interrupts === 1) {
+      log.line("stopping: draining, press Ctrl-C again to stop now");
+      void drain();
+      return;
+    }
+    void stopNow();
+  };
+  const detachSignals = () => {
+    process.off("SIGTERM", onSigterm);
+    process.off("SIGUSR1", onSigusr1);
+    process.off("SIGINT", onSigint);
+  };
+  const stopIntake = () => {
+    if (intakeClosed) return;
+    intakeClosed = true;
+    clearInterval(pollTimer);
+  };
+  const close = () => {
+    stopIntake();
+    detachSignals();
+    if (closed) return;
+    closed = true;
+    clearInterval(watchTimer);
+  };
+  const finish2 = () => {
+    if (exited) return;
+    exited = true;
+    close();
+    releasePidFile(pidFilePath(configPath), self);
+    log.line("runner exited");
+  };
+  const drain = async (onWaiting) => {
+    if (draining) return;
+    draining = true;
+    stopIntake();
+    let passes = 0;
+    while (state.jobs.size > 0 && !exited) {
+      onWaiting?.([...state.jobs.keys()]);
+      if (passes % DRAIN_LOG_EVERY_PASSES === 0) {
+        log.line(
+          `stopping: draining, waiting on ${[...state.jobs.values()].map((a) => describeWaiting(a, nowMs())).join(", ")}`
+        );
+      }
+      passes++;
+      await new Promise((resolve) => setTimeout(resolve, 1e3));
+    }
+    finish2();
+  };
+  const stopNow = async () => {
+    if (stopping) return;
+    stopping = true;
+    stopIntake();
+    clearInterval(watchTimer);
+    log.line(`stopping: ending ${state.jobs.size} running job(s) now`);
+    await Promise.all([...state.jobs.values()].map((active) => endJob(state, active, "stopped")));
+    finish2();
+  };
+  if (update !== void 0) {
+    state.exitForUpdate = () => {
+      finish2();
+      update.exit(RESTART_EXIT_STATUS);
+    };
+  }
+  const handle = { state, drain, stopNow, close };
+  process.on("SIGTERM", onSigterm);
+  process.on("SIGUSR1", onSigusr1);
+  process.on("SIGINT", onSigint);
+  deps.onReady?.();
+  await tick(state);
+  if (update !== void 0) settleUpdate({ configPath, own: ownVersionOf(deps), now: () => nowOf(state).getTime(), log });
+  return handle;
+}
+function describeWaiting(active, nowMs) {
+  const elapsed = formatDuration(nowMs - new Date(active.job.startedAt).getTime());
+  return `#${active.job.item} (${active.job.stage ?? "starting"}, ${elapsed})`;
+}
+var RunnerStartError = class extends Error {
+};
+async function requestStop(configPath, stopNow = false, pollMs = 5e3) {
+  const entry = readPidFile(pidFilePath(configPath));
+  if (!entry) {
+    process.stdout.write("no runner is running on this config\n");
+    return;
+  }
+  if (!isSameProcess(entry.pid, entry.start)) {
+    releasePidFile(pidFilePath(configPath), entry);
+    process.stdout.write(`stale pid file for pid ${entry.pid} (process gone), removed
+`);
+    return;
+  }
+  const signal = stopNow ? "SIGUSR1" : "SIGTERM";
+  try {
+    process.kill(entry.pid, signal);
+  } catch (err) {
+    const code = err?.code;
+    if (code === "EPERM") {
+      process.stdout.write(`the runner (pid ${entry.pid}) belongs to another user and cannot be signalled from here
+`);
+      return;
+    }
+    releasePidFile(pidFilePath(configPath), entry);
+    process.stdout.write(`stale pid file for pid ${entry.pid} (process gone), removed
+`);
+    return;
+  }
+  process.stdout.write(
+    stopNow ? `sent SIGUSR1 to runner pid ${entry.pid}, stopping now
+` : `sent SIGTERM to runner pid ${entry.pid}, draining
+`
+  );
+  while (isSameProcess(entry.pid, entry.start)) {
+    const now = /* @__PURE__ */ new Date();
+    for (const { job } of listJobFiles(configPath).filter(({ job: job2 }) => isUnfinished(job2))) {
+      const elapsed = formatDuration(now.getTime() - new Date(job.startedAt).getTime());
+      process.stdout.write(`waiting on #${job.item} (${job.stage ?? "starting"}, ${elapsed})
+`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  process.stdout.write("runner exited\n");
+}
+function listJobFiles(configPath) {
+  const dir = jobsDir(configPath);
+  if (!existsSync(dir)) return [];
+  const result = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const job = readJobFile(join(dir, entry.name, "job.json"));
+    if (job) result.push({ dirName: entry.name, job });
+  }
+  return result;
+}
+function runnerProcessState(configPath) {
+  const entry = readPidFile(pidFilePath(configPath));
+  if (!entry) return { state: "absent" };
+  return isSameProcess(entry.pid, entry.start) ? { state: "running", pid: entry.pid } : { state: "stale", pid: entry.pid };
+}
+
+export { RunnerStartError, listJobFiles, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick };