@outerlayer/cli 0.2.0 → 0.4.1

package/dist/chunk-DM3VFDS3.js

@@ -0,0 +1,1461 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { DOCKERD_LOG } from './chunk-CBPPJSAR.js';
+import { installScrubContext } from './chunk-LYCDNMOH.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, ADDED_USER, createRunnerLog, createContainerRuntime, stopContainer, syncInContainer, formatDuration, cleanupContainer, retrySend, formatClock, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk } from './chunk-HZRNMGLF.js';
+import { CLAUDE_CODE_VERSION } from './chunk-ZNA27WEV.js';
+import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
+import { childEnvironment } from './chunk-774HEQL6.js';
+import { waitForAgent, vmExecArgs } from './chunk-W4SQCOZU.js';
+import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-B2G7JHHB.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-W5FVUZXV.js';
+import { planArtifactUpload } from './chunk-WFJ65NUD.js';
+import { scrubText } from './chunk-4C4THABW.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm } from './chunk-5Y3QQRUH.js';
+import { parseSize } from './chunk-F6GFZXZ3.js';
+import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT } from './chunk-AUFG23AA.js';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { resolveVersion } from './chunk-RA3O54FC.js';
+import { signerFor } from './chunk-M5POMKKW.js';
+import { runnerDir, buildDir, vsockPath, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { spawn, spawnSync } from 'child_process';
+import { randomBytes } from 'crypto';
+import { mkdirSync, chmodSync, writeFileSync, appendFileSync, statSync, accessSync, constants, existsSync, readFileSync, openSync, closeSync, rmSync, readdirSync } from 'fs';
+import { join, isAbsolute, dirname, delimiter } from 'path';
+
+createRequire(import.meta.url);
+var DEFAULT_MEMORY = "8g";
+var DEFAULT_DISK = "40g";
+var DEFAULT_CPUS = 4;
+var BOOT_ATTEMPTS = 120;
+var BOOT_POLL_MS = 500;
+var HOOK_ERRORS_LIMIT = 1024 * 1024;
+var HOOK_ERRORS_IN_GUEST = "/build/home/.outerlayer/spool/hook-errors.log";
+var DOCKER_WAIT_SECONDS = 60;
+var DOCKER_SOCKET = "/var/run/docker.sock";
+var DOCKER_LOG_LINES = 20;
+var GUEST_GH_DIR = `${JOB_MOUNT}/gh`;
+var GUEST_HOOKS_DIR = `${JOB_MOUNT}/git-hooks`;
+var GUEST_CONTEXT_DIR = `${JOB_MOUNT}/context`;
+function firstLine(text2) {
+  return text2.trim().split("\n")[0] ?? "";
+}
+function execEnvironment(image, env) {
+  const merged = { ...image, ...env.literals };
+  for (const [name, value] of Object.entries(env.passed)) if (value !== void 0) merged[name] = value;
+  return merged;
+}
+function tarOf(dir) {
+  const packed = spawnSync("tar", ["-C", dir, "-cf", "-", "."], { maxBuffer: 1024 * 1024 * 1024 });
+  if (packed.status !== 0) throw new Error(`tar could not pack ${dir}: ${packed.stderr.toString("utf8").trim()}`);
+  return packed.stdout;
+}
+function asRoot(runtime, state, argv, stdin) {
+  return runtime.vm.exec(state.vsockPath, { argv, user: "root", cwd: "/", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" } }, stdin === void 0 ? void 0 : { stdin });
+}
+async function writeGuestGhConfig(runtime, state, token) {
+  const script = [
+    "set -e",
+    "umask 022",
+    `mkdir -p ${GUEST_GH_DIR}`,
+    `cat > ${GUEST_GH_DIR}/hosts.yml.partial`,
+    `mv ${GUEST_GH_DIR}/hosts.yml.partial ${GUEST_GH_DIR}/hosts.yml`,
+    `printf '%s' ${shellQuote(GH_CONFIG_YML)} > ${GUEST_GH_DIR}/config.yml.partial`,
+    `mv ${GUEST_GH_DIR}/config.yml.partial ${GUEST_GH_DIR}/config.yml`
+  ].join("\n");
+  const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], ghHostsYml(token));
+  if (result.status !== 0) throw new Error(`writing gh's configuration in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
+}
+async function unpackIntoGuest(runtime, state, dir, target) {
+  const script = `set -e; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX ${target}`;
+  const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], tarOf(dir));
+  if (result.status !== 0) throw new Error(`unpacking into ${target} in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
+}
+async function deliverCommitHooks(input) {
+  await unpackIntoGuest(input.runtime, input.state, input.hooksDir, GUEST_HOOKS_DIR);
+}
+async function provisionMicroVm(input) {
+  const { config, runtime, item, itemKey, jobDir, log, tokens } = input;
+  const { vm } = runtime;
+  const tag = `#${item.number}`;
+  const logPath = join(jobDir, "provision.log");
+  const fail = (reason) => ({ ok: false, reason });
+  if (claudeCredential(runtime.hostEnv) === void 0) return fail(AGENT_CREDENTIAL_MISSING);
+  const repository = item.specRepository;
+  if (repository === void 0 || repository === null || repository === "") {
+    return fail("the work item names no repository to clone");
+  }
+  const runnerDirPath = runnerDir(config.configPath);
+  const tooDeep = socketPathProblem(buildDir(config.configPath, "0".repeat(12)));
+  if (tooDeep !== void 0) return fail(tooDeep);
+  let assets;
+  try {
+    assets = await vm.assets(runnerDirPath);
+  } catch (err) {
+    return fail(err instanceof AssetError ? err.message : `the microVM's assets could not be had: ${describeCallFailure(err)}`);
+  }
+  const obtained = await obtainImage({
+    config,
+    runtime,
+    tokens,
+    repository,
+    tag,
+    log,
+    aborted: input.aborted,
+    deadlineMs: input.deadlineMs,
+    now: input.now,
+    guestHelper: { path: assets.helper, sha256: assets.helperSha256 }
+  });
+  if (!obtained.ok) return obtained.aborted === true ? { ok: false, reason: obtained.reason, aborted: true } : fail(obtained.reason);
+  const { report } = obtained.built;
+  const buildId = randomBytes(6).toString("hex");
+  const buildDir2 = buildDir(config.configPath, buildId);
+  const state = {
+    buildId,
+    buildDir: buildDir2,
+    repository,
+    imageId: report.imageId,
+    containerEnv: report.apply.containerEnv,
+    builtIns: true
+  };
+  const env = buildEnvironment({
+    config,
+    item: item.number,
+    itemKey,
+    repository,
+    hostEnv: runtime.hostEnv,
+    containerEnv: report.apply.containerEnv,
+    builtIns: true
+  });
+  if (env.skippedTokenVariables.length > 0) {
+    log.line(`${tag} not passing ${env.skippedTokenVariables.join(", ")} from runner.build.variables into the build: its repository token comes from the runner`);
+  }
+  const environment = {
+    isolation: "vm",
+    recipe: { sourceCommit: report.sourceCommit, key: report.recipeKey, path: report.recipe },
+    imageId: report.imageId,
+    ignoredProperties: report.ignored.map(({ property, source }) => ({ property, source })),
+    variables: env.variables,
+    cliVersion: input.cliVersion
+  };
+  input.save(state, environment);
+  const bail = async (reason, aborted = false) => {
+    try {
+      await cleanupMicroVm(runtime, state);
+    } catch (err) {
+      log.error(`${tag} cleanup failed: ${describeCallFailure(err)}`);
+    }
+    return aborted ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(reason);
+  };
+  if (input.aborted()) return bail("", true);
+  let imageConfig;
+  try {
+    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId });
+    imageConfig = await vm.rootfs.imageConfig(report.imageId);
+  } catch (err) {
+    return bail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
+  }
+  state.imageEnv = imageConfig.env;
+  state.buildDisk = join(buildDir2, "build.ext4");
+  state.vsockPath = vsockPath(buildDir2);
+  input.save(state, environment);
+  if (input.aborted()) return bail("", true);
+  mkdirSync(buildDir2, { recursive: true, mode: 448 });
+  chmodSync(buildDir2, 448);
+  try {
+    const gitRemote = gitRemoteFor(runtime, { repository, branch: input.branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
+    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote));
+  } catch (err) {
+    return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
+  }
+  const limits = {
+    cpus: config.build?.cpus ?? DEFAULT_CPUS,
+    memoryBytes: parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY),
+    diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
+  };
+  const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: true });
+  const configPath = join(buildDir2, "vm.json");
+  try {
+    linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
+    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk });
+    writeFileSync(
+      configPath,
+      JSON.stringify(
+        machineConfig(limits, { kernel: assets.kernel, rootfs: state.rootfs, buildDisk: state.buildDisk, vsock: state.vsockPath, relayPorts: links.map((link) => link.port), docker: report.docker }),
+        null,
+        2
+      ),
+      { mode: 384 }
+    );
+  } catch (err) {
+    return bail(`the build's disk and machine could not be made: ${describeCallFailure(err)}`);
+  }
+  if (input.aborted()) return bail("", true);
+  const consolePath = join(jobDir, "vm-console.log");
+  try {
+    state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath });
+  } catch (err) {
+    return bail(`Firecracker did not start: ${describeCallFailure(err)}`);
+  }
+  input.save(state, environment);
+  if (input.aborted()) return bail("", true);
+  const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep });
+  if (!ready) {
+    const why = vm.firecracker.alive(state.firecracker) ? "its exec agent did not answer" : "it exited before its exec agent answered";
+    return bail(`the microVM did not start: ${why}; its console is in ${consolePath}`);
+  }
+  let pushes = Promise.resolve();
+  let firstWriteFailure;
+  let firstWriteSettled = false;
+  const reportWrite = (err) => {
+    if (!firstWriteSettled && firstWriteFailure === void 0) firstWriteFailure = err;
+    log.error(`${tag} the read token could not be written for gh in the guest: ${describeCallFailure(err)}`);
+  };
+  try {
+    await tokens.token("read");
+  } catch (err) {
+    return bail(
+      err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's gh configuration could not be written: ${describeCallFailure(err)}`
+    );
+  }
+  tokens.onRead((token) => {
+    pushes = pushes.then(async () => {
+      if (state.firecracker === void 0 || !vm.firecracker.alive(state.firecracker)) return;
+      await writeGuestGhConfig(runtime, state, token);
+    }, void 0).catch(reportWrite);
+  });
+  await pushes;
+  firstWriteSettled = true;
+  if (firstWriteFailure !== void 0) return bail(`the build's gh configuration could not be written: ${describeCallFailure(firstWriteFailure)}`);
+  tokens.markUsed("read");
+  environment.credentials = tokens.used();
+  const uidOf = async (user) => {
+    const probe = await asRoot(runtime, state, ["id", "-u", user]);
+    const uid = Number(probe.stdout);
+    return probe.status === 0 && Number.isInteger(uid) ? uid : null;
+  };
+  let agentUser;
+  try {
+    agentUser = await resolveAgentUser({ remoteUser: report.apply.remoteUser, imageUser: imageConfig.user, probe: uidOf });
+  } catch (err) {
+    if (err instanceof AgentUserError) return bail(err.message);
+    throw err;
+  }
+  state.agentUser = agentUser;
+  const tools = await asRoot(runtime, state, ["cat", "/opt/outerlayer/tools.json"]);
+  environment.agentVersion = agentVersionOf(tools.status === 0 ? tools.stdout : "");
+  input.save(state, environment);
+  if (report.docker === true) {
+    const failure = await waitForDocker(runtime, state, agentUser, input.now ?? (() => /* @__PURE__ */ new Date()));
+    if (failure !== void 0) return bail(failure);
+  }
+  const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
+  const steps = await runBuildSteps({
+    repository,
+    branch: input.branch,
+    lifecycle: report.apply.lifecycle,
+    exec: async (argv, workdir, opts) => {
+      const ran = await vm.exec(state.vsockPath, request(argv, workdir));
+      if (opts?.quiet !== true) appendFileSync(logPath, ran.stdout + ran.stderr);
+      return ran;
+    },
+    log,
+    tag,
+    aborted: input.aborted,
+    stageContext: () => stageGovernedContext({
+      config,
+      repository,
+      buildId,
+      buildDir: buildDir2,
+      fetchImpl: input.fetchImpl,
+      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`
+    }),
+    // The guest cannot read the build's directory, so the staged files are unpacked into its job directory.
+    deliverContext: async (staged) => {
+      try {
+        await unpackIntoGuest(runtime, state, staged.dir, GUEST_CONTEXT_DIR);
+        return { ok: true };
+      } catch (err) {
+        return { ok: false, reason: `context_unavailable: ${describeCallFailure(err)}` };
+      }
+    },
+    removeStagedContext: () => removeStagedContext(buildDir2)
+  });
+  if (!steps.ok) return bail(steps.reason, steps.aborted === true);
+  return { ok: true, workdir: CHECKOUT_DIR, state, environment };
+}
+async function waitForDocker(runtime, state, agentUser, now) {
+  const grant = `[ -S ${DOCKER_SOCKET} ] && chgrp "$(id -g ${shellQuote(agentUser)})" ${DOCKER_SOCKET} && chmod 660 ${DOCKER_SOCKET}`;
+  const request = { argv: ["timeout", "5", "docker", "info"], user: agentUser, cwd: "/", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" } };
+  const deadline = now().getTime() + DOCKER_WAIT_SECONDS * 1e3;
+  let lastError = "";
+  for (; ; ) {
+    const granted = await asRoot(runtime, state, ["/bin/sh", "-c", grant]);
+    if (granted.status !== 0) {
+      if (firstLine(granted.stderr) !== "") lastError = `giving the agent's group the Docker socket failed: ${firstLine(granted.stderr)}`;
+    } else {
+      const answered = await runtime.vm.exec(state.vsockPath, request);
+      if (answered.status === 0) return void 0;
+      lastError = firstLine(answered.stderr) === "" ? "" : `docker info said: ${firstLine(answered.stderr)}`;
+    }
+    if (now().getTime() >= deadline) break;
+    await runtime.sleep(1e3);
+  }
+  const tail = await asRoot(runtime, state, ["tail", "-n", String(DOCKER_LOG_LINES), DOCKERD_LOG]).catch(() => void 0);
+  const log = tail !== void 0 && tail.status === 0 ? tail.stdout.trim() : "";
+  const detail = [lastError, log === "" ? "" : `the daemon's log ends: ${log}`].filter((part) => part !== "");
+  return `the Docker daemon in the microVM did not answer docker info within ${DOCKER_WAIT_SECONDS} seconds${detail.length === 0 ? "" : `; ${detail.join("; ")}`}`;
+}
+function agentVersionOf(toolsJson) {
+  try {
+    const version = JSON.parse(toolsJson).claudeCodeVersion;
+    if (typeof version === "string" && version !== "") return version;
+  } catch {
+  }
+  return CLAUDE_CODE_VERSION;
+}
+function microVmCommandLine(input) {
+  const state = input.job.microvm;
+  const env = buildEnvironment({
+    config: input.config,
+    item: input.job.item,
+    itemKey: input.job.itemKey,
+    branch: input.job.branch,
+    repository: state.repository,
+    hostEnv: input.runtime.hostEnv,
+    containerEnv: state.containerEnv ?? {},
+    builtIns: state.builtIns === true,
+    identity: input.job.commitIdentity
+  });
+  const options = {
+    socket: state.vsockPath,
+    user: state.agentUser ?? ADDED_USER,
+    cwd: CHECKOUT_DIR,
+    env: { ...state.imageEnv, ...env.literals },
+    pass: Object.keys(env.passed).filter((name) => env.passed[name] !== void 0),
+    argv: ["/bin/sh", "-c", input.cmdline]
+  };
+  return {
+    line: [process.execPath, input.cli, "vm-exec", ...vmExecArgs(options)].map(shellQuote).join(" "),
+    options,
+    env: { ...childEnvironment(input.runtime.hostEnv), ...env.passed }
+  };
+}
+function isRunning(runtime, state) {
+  return state.firecracker !== void 0 && runtime.vm.firecracker.alive(state.firecracker);
+}
+async function syncInMicroVm(input) {
+  const { runtime, job } = input;
+  const state = job.microvm;
+  if (!isRunning(runtime, state)) return { ok: false, reason: "the microVM is gone, so its sessions cannot be read" };
+  try {
+    const env = buildEnvironment({
+      config: input.config,
+      item: job.item,
+      itemKey: job.itemKey,
+      branch: job.branch,
+      repository: state.repository,
+      hostEnv: runtime.hostEnv,
+      containerEnv: state.containerEnv ?? {},
+      builtIns: state.builtIns === true,
+      identity: job.commitIdentity
+    });
+    const result = await runtime.vm.exec(state.vsockPath, {
+      argv: ["outerlayer", "sync"],
+      user: state.agentUser ?? ADDED_USER,
+      cwd: job.workdir ?? CHECKOUT_DIR,
+      env: execEnvironment(state.imageEnv, env)
+    });
+    appendFileSync(join(input.jobDir, "sync.log"), result.stdout + result.stderr);
+    return result.status === 0 ? { ok: true } : { ok: false, reason: `exit ${result.status}` };
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+}
+async function copyHookErrors(runtime, state, jobDir) {
+  if (!isRunning(runtime, state)) return;
+  try {
+    const log = await asRoot(runtime, state, ["head", "-c", String(HOOK_ERRORS_LIMIT), HOOK_ERRORS_IN_GUEST]);
+    if (log.status === 0 && log.stdout !== "") writeFileSync(join(jobDir, "hook-errors.log"), log.stdout);
+  } catch {
+  }
+}
+async function cleanupMicroVm(runtime, state, jobDir) {
+  const failures = [];
+  if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
+  if (state.firecracker !== void 0) {
+    try {
+      await runtime.vm.firecracker.stop(state.firecracker);
+    } catch (err) {
+      failures.push(`the microVM (pid ${state.firecracker.pid}) was not stopped: ${describeCallFailure(err)}`);
+    }
+  }
+  if (state.buildDisk !== void 0) deleteBuildDisk(state.buildDisk);
+  const tunnel = runtime.tunnels.get(state.buildId);
+  if (tunnel !== void 0) {
+    runtime.tunnels.delete(state.buildId);
+    await tunnel.close();
+  }
+  rmSync(state.buildDir, { recursive: true, force: true });
+  if (failures.length > 0) throw new Error(failures.join("; "));
+}
+async function stopOrphanedMicroVms(input) {
+  const stopped = [];
+  for (const { job } of input.jobs) {
+    const state = job.microvm;
+    if (state === void 0) continue;
+    if (job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start)) {
+      try {
+        process.kill(-job.pid, "SIGKILL");
+      } catch {
+      }
+    }
+    if (state.firecracker !== void 0 && input.runtime.vm.firecracker.alive(state.firecracker)) {
+      await input.runtime.vm.firecracker.stop(state.firecracker);
+      stopped.push(state.buildId);
+    }
+  }
+  return stopped;
+}
+function provisionEnvironment(base, input) {
+  return {
+    ...base,
+    OUTERLAYER_BUILD_DIR: input.buildDir,
+    ...input.repository === void 0 || input.repository === null || input.repository === "" ? {} : { OUTERLAYER_REPOSITORY: input.repository },
+    ...input.recipeCommit === void 0 ? {} : { OUTERLAYER_RECIPE_COMMIT: input.recipeCommit },
+    OUTERLAYER_MEMORY: input.limits.memory,
+    OUTERLAYER_CPUS: String(input.limits.cpus),
+    OUTERLAYER_PIDS: String(input.limits.pids),
+    OUTERLAYER_DISK: input.limits.disk
+  };
+}
+function unspecified(address) {
+  if (!address.includes(":")) return address === "0.0.0.0";
+  const normal = new URL(`http://[${address}]/`).hostname;
+  return normal === "[::]" || normal === "[::ffff:0:0]";
+}
+function parseBroker(text2) {
+  const match = /^(?:\[([0-9a-fA-F:.]+)\]|([0-9.]+)):(\d{1,5})$/.exec(text2);
+  if (match === null) return void 0;
+  const host = match[1] ?? match[2];
+  const port = Number(match[3]);
+  if (!isLiteralAddress(host) || unspecified(host) || port < 1 || port > 65535) return void 0;
+  return { host, port, text: text2 };
+}
+function readReport(path) {
+  const named = `provision.out names recipe ${path}`;
+  if (!isAbsolute(path)) return { problem: `${named}, which is not an absolute path` };
+  let text2;
+  try {
+    text2 = readFileSync(path, "utf8");
+  } catch {
+    return { problem: `${named}, which does not exist` };
+  }
+  try {
+    const parsed = JSON.parse(text2);
+    const lifecycle = parsed.apply?.lifecycle;
+    if (typeof parsed.sourceCommit === "string" && typeof parsed.recipeKey === "string" && typeof parsed.imageId === "string" && typeof lifecycle === "object" && lifecycle !== null && Object.values(lifecycle).every((entries) => Array.isArray(entries) && entries.every((entry) => typeof entry === "object" && entry !== null))) {
+      return { report: { ...parsed, ignored: Array.isArray(parsed.ignored) ? parsed.ignored : [] } };
+    }
+  } catch {
+  }
+  return { problem: `${named}, which is not a recipe report` };
+}
+function resolveHostBuild(keys) {
+  const build = { isolation: parseIsolation(keys.isolation) };
+  if (keys.exec !== void 0) {
+    const named = `provision.out names exec ${keys.exec}`;
+    if (!isAbsolute(keys.exec)) return { ok: false, reason: `${named}, which is not an absolute path` };
+    try {
+      if (!statSync(keys.exec).isFile()) return { ok: false, reason: `${named}, which is not an executable file` };
+      accessSync(keys.exec, constants.X_OK);
+    } catch {
+      return { ok: false, reason: `${named}, which is not an executable file` };
+    }
+    build.exec = keys.exec;
+  }
+  if (keys.broker !== void 0) {
+    const broker = parseBroker(keys.broker);
+    if (broker === void 0) {
+      return { ok: false, reason: `provision.out names broker ${keys.broker}, which is not <IP>:<port> with a literal address that is not 0.0.0.0 or ::` };
+    }
+    build.broker = broker;
+  }
+  if (keys.recipe !== void 0) {
+    const read = readReport(keys.recipe);
+    if ("problem" in read) return { ok: false, reason: read.problem };
+    build.recipe = read.report;
+    build.recipePath = keys.recipe;
+  }
+  return { ok: true, build };
+}
+function hostEnvironment(build, cliVersion) {
+  const report = build.recipe;
+  return {
+    isolation: build.isolation,
+    ...report === void 0 ? {} : {
+      recipe: { sourceCommit: report.sourceCommit, key: report.recipeKey, path: report.recipe },
+      imageId: report.imageId,
+      ignoredProperties: report.ignored.map(({ property, source }) => ({ property, source }))
+    },
+    cliVersion
+  };
+}
+var CD_INTO_WORKDIR = 'cd -- "$0" && exec "$@"';
+function execArgv(workdir, argv) {
+  return ["/bin/sh", "-c", CD_INTO_WORKDIR, workdir, ...argv];
+}
+function execCommandLine(exec, workdir, cmdline) {
+  return [exec, ...execArgv(workdir, ["/bin/sh", "-c", cmdline])].map(shellQuote).join(" ");
+}
+function proxyUrlFor(build) {
+  if (build.broker === void 0) return `http://127.0.0.1:${RELAY_PORT}`;
+  return `http://${build.broker}`;
+}
+function hostCommandEnvironment(base, build, config, hooksPath) {
+  let env = { ...base };
+  if (build.exec !== void 0) {
+    const brokerHost = build.broker === void 0 ? void 0 : build.broker.slice(0, build.broker.lastIndexOf(":")).replace(/^\[|\]$/g, "");
+    Object.assign(env, proxyEnvironment(proxyUrlFor(build), brokerHost));
+  } else if (build.proxyPort !== void 0) {
+    Object.assign(env, proxyEnvironment(`http://127.0.0.1:${build.proxyPort}`));
+  }
+  const ports = build.destinations ?? [];
+  const portOf = (name) => ports.find((entry) => entry.name === name)?.port;
+  (config.build?.destinations ?? []).forEach((destination, index) => {
+    const port = portOf(destination.name);
+    const address = build.exec !== void 0 ? containerLocalAddress(index) : port === void 0 ? void 0 : `http://127.0.0.1:${port}/`;
+    if (address !== void 0) Object.assign(env, destinationEnvironment([destination], () => address));
+  });
+  if (build.builtIns === true) {
+    const credential = claudeCredential(base);
+    for (const name of CLAUDE_CREDENTIAL_VARIABLES) delete env[name];
+    Object.assign(env, builtInEnvironment((name) => `http://127.0.0.1:${portOf(name) ?? 0}`, credential));
+  }
+  if (build.exec === void 0 && hooksPath !== void 0) env = withHooksPath(env, hooksPath);
+  return env;
+}
+async function startHostServices(input) {
+  const { runtime, config, build } = input;
+  const destinations = config.build?.destinations ?? [];
+  const services = await startBuildServices({
+    startTunnel: runtime.startTunnel,
+    tunnelOptions: runtime.tunnelOptions,
+    buildDir: build.buildDir,
+    jobDir: input.jobDir,
+    destinations,
+    allowHosts: config.build?.allowHosts,
+    serve: input.process ? "tcp" : "both",
+    proxy: input.process,
+    ...input.process ? { builtIns: { gatewayUrl: config.url, itemKey: input.itemKey, claudeUpstream: runtime.claudeUpstream } } : {},
+    ports: {
+      proxy: build.proxyPort,
+      destinations: build.destinations?.filter((d) => !BUILT_IN_NAMES.includes(d.name)).map((d) => d.port),
+      builtIns: Object.fromEntries((build.destinations ?? []).filter((d) => BUILT_IN_NAMES.includes(d.name)).map((d) => [d.name, d.port]))
+    },
+    hostEnv: runtime.hostEnv,
+    destinationOptions: runtime.destinationOptions
+  });
+  build.proxyPort = services.proxyPort;
+  build.destinations = [
+    ...destinations.map((destination, index) => ({ name: destination.name, port: services.destinationPorts[index] })),
+    ...Object.entries(services.builtInPorts).map(([name, port]) => ({ name, port }))
+  ];
+  if (input.process) build.builtIns = true;
+  runtime.tunnels.set(build.buildId, services);
+  if (build.broker !== void 0) await listenOnBroker(services, build.broker);
+  return services;
+}
+async function listenOnBroker(tunnel, broker) {
+  const parsed = parseBroker(broker);
+  if (parsed === void 0) throw new Error(`${broker} is not a broker address`);
+  await tunnel.listenTcp({ host: parsed.host, port: parsed.port });
+}
+async function closeHostBuild(runtime, build) {
+  const tunnel = runtime.tunnels.get(build.buildId);
+  if (tunnel !== void 0) {
+    runtime.tunnels.delete(build.buildId);
+    await tunnel.close();
+  }
+  rmSync(build.buildDir, { recursive: true, force: true });
+  if (build.workDir !== void 0) rmSync(build.workDir, { recursive: true, force: true });
+}
+function readJobFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeJobFile(path, job) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  writeFileSync(path, JSON.stringify(job, null, 2), { mode: RUNNER_FILE_MODE });
+}
+var ENDED = "ended before provision finished";
+async function provisionProcess(input) {
+  const { config, runtime, item, jobDir } = input;
+  if (claudeCredential(runtime.hostEnv) === void 0) return { ok: false, reason: AGENT_CREDENTIAL_MISSING };
+  const repository = item.specRepository;
+  if (repository === void 0 || repository === null || repository === "") {
+    return { ok: false, reason: "the work item names no repository to clone" };
+  }
+  const buildId = randomBytes(6).toString("hex");
+  const buildDir2 = buildDir(config.configPath, buildId);
+  const workDir = join(jobDir, "work");
+  const state = { buildId, buildDir: buildDir2, workDir };
+  const environment = sharedUserEnvironment(input.cliVersion);
+  input.save(state, environment);
+  const bail = async (reason) => {
+    try {
+      await cleanupProcess(runtime, state);
+    } catch (err) {
+      input.log.error(`#${item.number} cleanup failed: ${describeCallFailure(err)}`);
+    }
+    return { ok: false, reason };
+  };
+  if (input.aborted()) return bail(ENDED);
+  mkdirSync(buildDir2, { recursive: true });
+  chmodSync(buildDir2, 493);
+  try {
+    await startHostServices({ runtime, config, build: state, jobDir, itemKey: input.itemKey, process: true });
+  } catch (err) {
+    return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
+  }
+  input.save(state, environment);
+  if (input.aborted()) return bail(ENDED);
+  const checkout = join(workDir, "checkout");
+  const remote = runtime.remoteFor?.(repository) ?? `https://github.com/${repository}.git`;
+  const cloned = await runtime.clone({ remote, dest: checkout });
+  if (!cloned.ok) return bail(cloned.reason);
+  if (input.aborted()) return bail(ENDED);
+  return { ok: true, workdir: checkout, state, environment };
+}
+function cleanupProcess(runtime, state) {
+  return closeHostBuild(runtime, state);
+}
+
+// src/runner/verdict.ts
+var VERDICT_SETTLE_MS = 5 * 6e4;
+var VERDICT_READ_EVERY_MS = 3e4;
+var REASON_MAX = 200;
+function text(value) {
+  return typeof value === "string" ? value : "";
+}
+function fields(value) {
+  return Object(value);
+}
+function parseEvaluation(value) {
+  if (value === void 0) return void 0;
+  const raw = fields(value);
+  const verdict = raw.verdict;
+  if (verdict !== "pass" && verdict !== "flag" && verdict !== "unverifiable" && verdict !== "waiting") return null;
+  const open = [];
+  for (const row of Array.isArray(raw.open) ? raw.open : []) {
+    const r = fields(row);
+    if (r.status !== "flag" && r.status !== "pending") continue;
+    open.push({ label: text(r.label), status: r.status, sentence: text(r.sentence) });
+  }
+  return { verdict, sentence: text(raw.sentence), waitingOn: raw.waitingOn, open };
+}
+async function readItemEvaluation(config, item, fetchImpl) {
+  try {
+    const { data } = await getJson(config.url, `/v1/work-items/${item}`, config.apiKey, config.appId, fetchImpl, await signerFor(config.configPath));
+    return { ok: true, evaluation: parseEvaluation(fields(data).evaluation) };
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+}
+function rowText(row) {
+  const name = row.label !== "" && row.sentence !== "" && row.label !== row.sentence ? `${row.label}: ${row.sentence}` : row.sentence || row.label;
+  return row.status === "pending" ? `${name} (no result)` : name;
+}
+function fit(prefix, parts) {
+  let text2 = prefix + parts.join("; ");
+  for (let kept = parts.length - 1; text2.length > REASON_MAX && kept > 0; kept--) {
+    text2 = `${prefix}${parts.slice(0, kept).join("; ")}; and ${parts.length - kept} more`;
+  }
+  return text2.length > REASON_MAX ? `${text2.slice(0, REASON_MAX - 1)}\u2026` : text2;
+}
+function decideFromEvaluation(read) {
+  if (!read.ok) return { outcome: "incomplete", reason: fit("the item's status could not be read: ", [read.reason]) };
+  const evaluation = read.evaluation;
+  if (evaluation === void 0) return { outcome: "ok" };
+  if (evaluation === null) return { outcome: "incomplete", reason: "the item has no evidence evaluation yet" };
+  if (evaluation.open.length > 0) return { outcome: "incomplete", reason: fit("checks not passing: ", evaluation.open.map(rowText)) };
+  if (evaluation.verdict === "pass") return { outcome: "ok" };
+  if (evaluation.verdict === "waiting" && evaluation.waitingOn === "review") return { outcome: "ok" };
+  if (evaluation.verdict === "waiting" && evaluation.waitingOn === "links") {
+    return { outcome: "incomplete", reason: "the item's evidence was still waiting on session links to be confirmed" };
+  }
+  if (evaluation.verdict === "waiting" && evaluation.waitingOn === "claim") {
+    return { outcome: "incomplete", reason: "the item's required checks had no result when the build ended" };
+  }
+  return { outcome: "incomplete", reason: fit("the item's verdict is not passing: ", [evaluation.sentence || evaluation.verdict]) };
+}
+function waitMs(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function settleVerdict(deps) {
+  const settleMs = deps.settleMs ?? VERDICT_SETTLE_MS;
+  const everyMs = deps.everyMs ?? VERDICT_READ_EVERY_MS;
+  const startedMs = deps.now().getTime();
+  for (; ; ) {
+    const decision = decideFromEvaluation(await deps.read());
+    if (decision.outcome === "ok") return decision;
+    if (deps.now().getTime() - startedMs + everyMs > settleMs) return decision;
+    await deps.sleep(everyMs);
+  }
+}
+
+// src/runner/job.ts
+var LEASE_SECONDS = 900;
+var RENEW_INTERVAL_SECONDS = 300;
+var IDLE_CPU_USEC_PER_MINUTE_FLOOR = 2e6;
+function jobEnv(config, item, itemKey, jobDirPath, baseEnv = process.env, branch, author) {
+  const secrets = new Set(headerVariables(config.build?.destinations));
+  const passthrough = {};
+  for (const [key, value] of Object.entries(baseEnv)) {
+    if (value === void 0) continue;
+    if (key.startsWith("OUTERLAYER_")) continue;
+    if (secrets.has(key)) continue;
+    passthrough[key] = value;
+  }
+  const path = cliFirstPath(passthrough.PATH);
+  return {
+    ...passthrough,
+    ...path === void 0 ? {} : { PATH: path },
+    OUTERLAYER_URL: config.url,
+    ...itemKey === void 0 ? {} : { OUTERLAYER_API_KEY: itemKey },
+    OUTERLAYER_APP_ID: config.appId,
+    OUTERLAYER_WORK: String(item),
+    OUTERLAYER_JOB_DIR: jobDirPath,
+    // The branch the claim named. A hook that makes its own checkout puts it
+    // on this branch, and the build's commands push to it.
+    ...branch === void 0 ? {} : { OUTERLAYER_BRANCH: branch },
+    // Git prefers these to any configuration, so a host's own git identity never authors a commit of the build.
+    ...authorEnvironment(author)
+  };
+}
+function cliFirstPath(currentPath) {
+  const entry = process.argv[1];
+  const cliDir = entry === void 0 || entry === "" ? void 0 : dirname(entry);
+  if (cliDir === void 0) return currentPath;
+  const parts = (currentPath ?? "").split(delimiter).filter((p) => p !== "");
+  if (parts[0] === cliDir) return currentPath;
+  return [cliDir, ...parts.filter((p) => p !== cliDir)].join(delimiter);
+}
+var HOOK_ENDED_EXIT_CODE = 124;
+function runHook(hookPath, env, cwd, logPath, spawnFn = spawn, limits, args = []) {
+  return new Promise((resolve, reject) => {
+    let fd;
+    try {
+      fd = openSync(logPath, "a", RUNNER_FILE_MODE);
+    } catch (err) {
+      reject(err instanceof Error ? err : new Error(String(err)));
+      return;
+    }
+    let timer;
+    let endedBy;
+    const settle = () => {
+      if (timer) clearInterval(timer);
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    };
+    const child = spawnFn(hookPath, args, { env, cwd, detached: true, stdio: ["ignore", fd, fd] });
+    if (limits !== void 0 && child.pid !== void 0) {
+      const pid = child.pid;
+      const readClock = limits.now ?? (() => /* @__PURE__ */ new Date());
+      let lastActivityAtMs = readClock().getTime();
+      let lastSeen = readLogState(logPath);
+      timer = setInterval(() => {
+        const nowMs = readClock().getTime();
+        const seen = readLogState(logPath);
+        if (seen.size !== lastSeen.size || seen.mtimeMs !== lastSeen.mtimeMs) {
+          lastSeen = seen;
+          lastActivityAtMs = nowMs;
+        }
+        const reason = nowMs >= limits.endBy ? "time limit" : nowMs - lastActivityAtMs >= limits.idleMs ? "idle" : void 0;
+        if (reason === void 0) return;
+        endedBy = reason;
+        if (timer) clearInterval(timer);
+        void stopProcessGroup(pid);
+      }, limits.pollMs ?? 1e3);
+      timer.unref?.();
+    }
+    child.on("error", (err) => {
+      settle();
+      reject(hookSpawnError(hookPath, err));
+    });
+    child.on("exit", (code, signal) => {
+      settle();
+      if (endedBy !== void 0) {
+        resolve({ code: HOOK_ENDED_EXIT_CODE, endedBy });
+        return;
+      }
+      if (signal !== null) {
+        resolve({ code: 1, signal });
+        return;
+      }
+      resolve({ code: code ?? 1 });
+    });
+  });
+}
+function hookSpawnError(hookPath, err) {
+  const code = err?.code;
+  if (code === "ENOENT") {
+    return new Error(
+      `${hookPath}: no such executable. A hook is run directly, not through a shell, so the path must name an executable file with no arguments and no variables to expand.`
+    );
+  }
+  if (code === "EACCES") {
+    return new Error(`${hookPath}: not executable. Give the file the execute bit, or name one that has it.`);
+  }
+  return err instanceof Error ? err : new Error(String(err));
+}
+function workdirProblem(workdir) {
+  let stats;
+  try {
+    stats = statSync(workdir);
+  } catch {
+    return "does not exist";
+  }
+  return stats.isDirectory() ? void 0 : "is not a directory";
+}
+function readProvisionOut(jobDirPath) {
+  const path = join(jobDirPath, "provision.out");
+  if (!existsSync(path)) return { ok: false };
+  let text2;
+  try {
+    text2 = readFileSync(path, "utf8");
+  } catch {
+    return { ok: false };
+  }
+  const kv = {};
+  for (const line of text2.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+    kv[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
+  }
+  if (!kv.workdir) return { ok: false };
+  return {
+    ok: true,
+    workdir: kv.workdir,
+    ...kv.cgroup ? { cgroup: kv.cgroup } : {},
+    ...kv.isolation !== void 0 ? { isolation: kv.isolation } : {},
+    ...kv.exec !== void 0 ? { exec: kv.exec } : {},
+    ...kv.broker !== void 0 ? { broker: kv.broker } : {},
+    ...kv.recipe !== void 0 ? { recipe: kv.recipe } : {}
+  };
+}
+var EXIT_CODE_FILE = "exit-code";
+function commandWithExitCodeTrailer(cmdline) {
+  return [
+    "__ol_record_status() {",
+    "  __ol_status=$?",
+    '  if [ -n "$OUTERLAYER_JOB_DIR" ]; then',
+    `    echo "$__ol_status" > "$OUTERLAYER_JOB_DIR/${EXIT_CODE_FILE}.partial" 2>/dev/null &&`,
+    `      mv -f "$OUTERLAYER_JOB_DIR/${EXIT_CODE_FILE}.partial" "$OUTERLAYER_JOB_DIR/${EXIT_CODE_FILE}" 2>/dev/null`,
+    "  fi",
+    '  return "$__ol_status"',
+    "}",
+    "trap __ol_record_status EXIT",
+    cmdline
+  ].join("\n");
+}
+function readExitCode(jobDirPath) {
+  let text2;
+  try {
+    text2 = readFileSync(join(jobDirPath, EXIT_CODE_FILE), "utf8");
+  } catch {
+    return void 0;
+  }
+  const trimmed = text2.trim();
+  return /^\d+$/.test(trimmed) ? Number(trimmed) : void 0;
+}
+function outcomeFromExitCode(jobDirPath) {
+  const code = readExitCode(jobDirPath);
+  if (code === void 0) return void 0;
+  return { outcome: code === 0 ? "ok" : "failed", code };
+}
+var REASON_FILE = "reason";
+var REASON_MAX2 = 200;
+function cutReasonLine(line, max = REASON_MAX2) {
+  const cut = line.slice(0, max);
+  const last = cut.charCodeAt(cut.length - 1);
+  return last >= 55296 && last <= 56319 ? cut.slice(0, -1) : cut;
+}
+function scrubList(value) {
+  return Array.isArray(value) ? value : [];
+}
+function mergeScrubConfig(a, b) {
+  if (!a && !b) return void 0;
+  return {
+    literals: [...scrubList(a?.literals), ...scrubList(b?.literals)],
+    patterns: [...scrubList(a?.patterns), ...scrubList(b?.patterns)]
+  };
+}
+function releaseScrub(config, home) {
+  const merged = mergeScrubConfig(config.scrub, readCloudConfig(home).scrub);
+  const secrets = [...headerVariables(config.build?.destinations), ...CLAUDE_CREDENTIAL_VARIABLES].map((name) => process.env[name] ?? "");
+  return { literals: [...scrubList(merged?.literals), ...secrets], patterns: scrubList(merged?.patterns) };
+}
+function stripUnsendableReasonChars(text2) {
+  return text2.replace(/\u0000/g, "").replace(/\p{Cs}/gu, "");
+}
+function readReasonLine(jobDirPath, config, home = homeFromEnv()) {
+  let raw;
+  try {
+    raw = readFileSync(join(jobDirPath, REASON_FILE), "utf8");
+  } catch {
+    return void 0;
+  }
+  return scrubReason(raw.split(/\r\n|\r|\n/)[0] ?? "", config, home);
+}
+function scrubReason(line, config, home = homeFromEnv()) {
+  installScrubContext(home, releaseScrub(config, home));
+  const oneLine = scrubText(stripUnsendableReasonChars(line)).replace(/[\r\n]+/g, " ");
+  const trimmed = cutReasonLine(oneLine).trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function scrubTunnelRecord(record, config) {
+  if (record === void 0) return void 0;
+  const home = homeFromEnv();
+  installScrubContext(home, releaseScrub(config, home));
+  return {
+    hosts: record.hosts.map((host) => scrubText(host)),
+    hostsMore: record.hostsMore,
+    refusalsMore: record.refusalsMore,
+    refusals: record.refusals.map((r) => ({ ...r, host: scrubText(r.host) })),
+    destinations: (record.destinations ?? []).map((name) => scrubText(name))
+  };
+}
+function runCommand(cmdline, env, cwd, logPath, spawnFn = spawn) {
+  const fd = openSync(logPath, "a", RUNNER_FILE_MODE);
+  const child = spawnFn("/bin/sh", ["-c", commandWithExitCodeTrailer(cmdline)], {
+    env,
+    cwd,
+    detached: true,
+    stdio: ["ignore", fd, fd]
+  });
+  const pid = child.pid;
+  if (pid === void 0) {
+    try {
+      closeSync(fd);
+    } catch {
+    }
+    throw new Error("command failed to spawn \u2014 no pid");
+  }
+  const onExit = new Promise((resolve) => {
+    const close = () => {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    };
+    child.on("exit", (code, signal) => {
+      close();
+      resolve({ code, signal });
+    });
+    child.on("error", (err) => {
+      close();
+      resolve({ code: null, signal: null, error: err instanceof Error ? err : new Error(String(err)) });
+    });
+  });
+  return { pid, start: startTimeOf(pid), onExit };
+}
+function isGroupAlive(pid) {
+  try {
+    process.kill(-pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function stopProcessGroup(pid, opts = {}) {
+  const graceMs = opts.graceMs ?? 15e3;
+  const pollMs = opts.pollMs ?? 200;
+  try {
+    process.kill(-pid, "SIGTERM");
+  } catch {
+    return;
+  }
+  const deadline = Date.now() + graceMs;
+  while (isGroupAlive(pid) && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  if (isGroupAlive(pid)) {
+    try {
+      process.kill(-pid, "SIGKILL");
+    } catch {
+    }
+    const killDeadline = Date.now() + 2e3;
+    while (isGroupAlive(pid) && Date.now() < killDeadline) {
+      await new Promise((resolve) => setTimeout(resolve, pollMs));
+    }
+  }
+}
+function isTimedOut(startedAtMs, nowMs, timeLimitMinutes) {
+  return nowMs - startedAtMs > timeLimitMinutes * 6e4;
+}
+function needsRenew(lastRenewAtMs, nowMs, intervalSeconds = RENEW_INTERVAL_SECONDS) {
+  return nowMs - lastRenewAtMs >= intervalSeconds * 1e3;
+}
+function isIdle(logMtimeMs, nowMs, idleLimitMinutes, cpuUsecPerMinuteOverWindow) {
+  const windowMs = nowMs - logMtimeMs;
+  if (windowMs <= idleLimitMinutes * 6e4) return false;
+  if (cpuUsecPerMinuteOverWindow === null) return true;
+  return cpuUsecPerMinuteOverWindow < IDLE_CPU_USEC_PER_MINUTE_FLOOR;
+}
+function readCpuUsec(cgroupPath) {
+  try {
+    const text2 = readFileSync(join(cgroupPath, "cpu.stat"), "utf8");
+    const match = /^usage_usec (\d+)$/m.exec(text2);
+    return match ? Number(match[1]) : null;
+  } catch {
+    return null;
+  }
+}
+async function renewLease(config, item, fetchImpl) {
+  try {
+    await postJson(
+      config.url,
+      `/v1/work-items/${item}/claim/renew`,
+      config.apiKey,
+      config.appId,
+      { host: config.host, seconds: LEASE_SECONDS },
+      fetchImpl,
+      void 0,
+      await signerFor(config.configPath)
+    );
+    return "renewed";
+  } catch (err) {
+    if (err instanceof WorkCommandError && isSignatureRefusal(err.code)) return "retry_later";
+    if (err instanceof WorkCommandError && !err.retryable) return "lease_lost";
+    return "retry_later";
+  }
+}
+var ALREADY_RELEASED = "already released";
+async function releaseLease(config, item, outcome, detail, fetchImpl) {
+  const send = async (environment2, sent2) => postJson(
+    config.url,
+    `/v1/work-items/${item}/claim/release`,
+    config.apiKey,
+    config.appId,
+    { host: config.host, outcome: sent2, stage: detail.stage, exitCode: detail.exitCode, reason: detail.reason, environment: environment2 },
+    fetchImpl,
+    void 0,
+    await signerFor(config.configPath)
+  );
+  let environment = detail.environment;
+  let sent = outcome;
+  let data;
+  for (; ; ) {
+    try {
+      ({ data } = await send(environment, sent));
+      break;
+    } catch (err) {
+      if (!(err instanceof WorkCommandError) || err.status !== 400 || err.code !== "invalid_request_body") throw err;
+      const namesOutcome = /\boutcome\b/.test(err.message);
+      if (sent === "incomplete" && namesOutcome) {
+        sent = "ok";
+      } else if (environment?.commitIdentity !== void 0) {
+        const { commitIdentity: _omitted, ...withoutIdentity } = environment;
+        environment = withoutIdentity;
+      } else if (sent === "incomplete") {
+        sent = "ok";
+      } else {
+        throw err;
+      }
+    }
+  }
+  return {
+    releasedAt: typeof data.releasedAt === "string" ? data.releasedAt : void 0,
+    outcome: data.outcome === void 0 ? void 0 : data.outcome
+  };
+}
+var RELEASE_SKEW_MS = 6e4;
+function wasAlreadyReleased(result, sentOutcome, sentAtMs) {
+  const stored = result.outcome ?? void 0;
+  if (stored !== void 0 && stored !== sentOutcome) return true;
+  if (result.releasedAt === void 0) return false;
+  const releasedAtMs = Date.parse(result.releasedAt);
+  return Number.isFinite(releasedAtMs) && releasedAtMs < sentAtMs - RELEASE_SKEW_MS;
+}
+function runSync(config, item, itemKey, workdir, jobDirPath, spawnFn = spawn, branch, author) {
+  return new Promise((resolve) => {
+    const env = jobEnv(config, item, itemKey, jobDirPath, process.env, branch, author);
+    let child;
+    try {
+      child = spawnFn(process.execPath, [process.argv[1] ?? "outerlayer", "sync"], {
+        cwd: workdir,
+        env,
+        stdio: "ignore"
+      });
+    } catch (err) {
+      resolve({ ok: false, reason: describeCallFailure(err) });
+      return;
+    }
+    child.on("exit", (code) => {
+      resolve(code === 0 || code === null ? { ok: true } : { ok: false, reason: `exit ${code}` });
+    });
+    child.on("error", (err) => {
+      resolve({ ok: false, reason: describeCallFailure(err) });
+    });
+  });
+}
+async function runSyncViaExec(config, job, jobDirPath, spawnFn = spawn) {
+  const build = job.build;
+  const env = hostCommandEnvironment(jobEnv(config, job.item, job.itemKey, jobDirPath, process.env, job.branch, job.commitIdentity?.author), build, config, job.commitIdentity?.hooksPath);
+  try {
+    const result = await runHook(
+      build.exec,
+      env,
+      jobDirPath,
+      join(jobDirPath, "sync.log"),
+      spawnFn,
+      void 0,
+      execArgv(job.workdir, ["outerlayer", "sync"])
+    );
+    return result.code === 0 ? { ok: true } : { ok: false, reason: `exit ${result.code}` };
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+}
+var MAX_NAMED_SPOOLED = 20;
+function spooledArtifactIds(home) {
+  try {
+    return planArtifactUpload({ home }).candidates.map((pending) => pending.record.artifactId);
+  } catch {
+    return [];
+  }
+}
+function leaseExpiry(job, fallback) {
+  const base = Date.parse(job.lastRenewAt ?? job.startedAt);
+  return new Date((Number.isFinite(base) ? base : fallback.getTime()) + LEASE_SECONDS * 1e3);
+}
+function setStage(job, jobDirPath, stage) {
+  job.stage = stage;
+  writeJobFile(join(jobDirPath, "job.json"), job);
+}
+function readTunnelRecord(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
+  const spawnFn = deps.spawnFn ?? spawn;
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const log = deps.log ?? createRunnerLog(now);
+  const jobFilePath = join(jobDirPath, "job.json");
+  const logPath = join(jobDirPath, "command.log");
+  const tag = `#${job.item}`;
+  const build = job.container === void 0 ? void 0 : { state: job.container, runtime: deps.container ?? createContainerRuntime() };
+  const vmBuild = job.microvm === void 0 ? void 0 : { state: job.microvm, runtime: deps.container ?? createContainerRuntime() };
+  if (build !== void 0 && job.pid !== void 0 && isGroupAlive(job.pid)) {
+    await stopContainer(build.runtime, build.state).catch((err) => {
+      log.error(`${tag} stopping the container failed: ${describeCallFailure(err)} \xB7 continuing`);
+    });
+    writeJobFile(jobFilePath, job);
+  }
+  if (job.pid !== void 0 && isGroupAlive(job.pid)) {
+    await stopProcessGroup(job.pid);
+  }
+  if (outcome !== void 0 && job.endStage === void 0) {
+    const TEARDOWN_STAGES = ["sync", "cleanup", "report"];
+    const staleTeardownStage = job.stage !== void 0 && TEARDOWN_STAGES.includes(job.stage);
+    job.endStage = ending?.stage ?? (staleTeardownStage ? job.exitCode !== void 0 ? "command" : void 0 : job.stage);
+    job.endExitCode = ending?.exitCode ?? (outcome === "ok" || outcome === "failed" ? job.exitCode : void 0);
+    writeJobFile(jobFilePath, job);
+  }
+  if (outcome !== void 0 && ending?.reason !== void 0) {
+    job.reason = scrubReason(ending.reason, config);
+    writeJobFile(jobFilePath, job);
+  }
+  const hookLimits = () => hookLimitsFor(config, now().getTime(), deps.now);
+  let tunnelRecord;
+  if (!job.cleanupRan) {
+    if (job.workdir) {
+      setStage(job, jobDirPath, "sync");
+      if (job.container === void 0 && job.microvm === void 0 && job.build?.exec === void 0 && workdirProblem(job.workdir) !== void 0) {
+        log.line(`${tag} sync skipped: workdir ${job.workdir} is gone`);
+      } else if (job.itemKey === void 0) {
+        log.line(`${tag} sync skipped: the job file holds no item key`);
+      } else {
+        log.line(`${tag} sync started`);
+        const startedMs = now().getTime();
+        const sync = build !== void 0 ? await syncInContainer({ config, runtime: build.runtime, job, jobDir: jobDirPath }) : vmBuild !== void 0 ? await syncInMicroVm({ config, runtime: vmBuild.runtime, job, jobDir: jobDirPath }) : job.build?.exec !== void 0 ? await runSyncViaExec(config, job, jobDirPath, spawnFn) : await runSync(config, job.item, job.itemKey, job.workdir, jobDirPath, spawnFn, job.branch, job.commitIdentity?.author);
+        const took = formatDuration(now().getTime() - startedMs);
+        if (sync.ok) log.line(`${tag} sync ok (${took})`);
+        else log.error(`${tag} sync failed: ${sync.reason ?? "no reason given"} \xB7 continuing`);
+        const left = spooledArtifactIds(deps.home ?? homeFromEnv());
+        if (left.length > 0) {
+          job.spooledArtifacts = left.slice(0, MAX_NAMED_SPOOLED);
+          const named = job.spooledArtifacts.join(", ");
+          log.error(
+            `${tag} ${left.length} spooled artifact(s) not uploaded: ${named}${left.length > MAX_NAMED_SPOOLED ? `, and ${left.length - MAX_NAMED_SPOOLED} more` : ""}`
+          );
+        }
+      }
+    }
+    setStage(job, jobDirPath, "cleanup");
+    try {
+      rmSync(join(jobDirPath, REASON_FILE));
+    } catch {
+    }
+    log.line(`${tag} cleanup started`);
+    const cleanupStartedMs = now().getTime();
+    const hostMade = job.build !== void 0 && job.build.workDir === void 0;
+    if (vmBuild !== void 0) {
+      let cleanedUp = true;
+      tunnelRecord = vmBuild.runtime.tunnels.get(vmBuild.state.buildId)?.record();
+      try {
+        await cleanupMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath);
+      } catch (err) {
+        cleanedUp = false;
+        log.error(`${tag} cleanup failed: ${describeCallFailure(err)} \xB7 continuing`);
+      }
+      if (cleanedUp) log.line(`${tag} cleanup ok (${formatDuration(now().getTime() - cleanupStartedMs)})`);
+    } else if (build !== void 0 || !hostMade && isBuiltinContainer(config.hooks.cleanup)) {
+      let cleanedUp = true;
+      if (build !== void 0) {
+        tunnelRecord = build.runtime.tunnels.get(build.state.buildId)?.record();
+        try {
+          await cleanupContainer(build.runtime, build.state, jobDirPath);
+        } catch (err) {
+          cleanedUp = false;
+          log.error(`${tag} cleanup failed: ${describeCallFailure(err)} \xB7 continuing`);
+        }
+      }
+      if (cleanedUp) log.line(`${tag} cleanup ok (${formatDuration(now().getTime() - cleanupStartedMs)})`);
+    } else if (!hostMade && (job.build !== void 0 || isBuiltinProcess(config.hooks.cleanup))) {
+      let cleanedUp = true;
+      if (job.build !== void 0) {
+        const runtime = deps.container ?? createContainerRuntime();
+        tunnelRecord = runtime.tunnels.get(job.build.buildId)?.record();
+        try {
+          await cleanupProcess(runtime, job.build);
+        } catch (err) {
+          cleanedUp = false;
+          log.error(`${tag} cleanup failed: ${describeCallFailure(err)} \xB7 continuing`);
+        }
+      }
+      if (cleanedUp) log.line(`${tag} cleanup ok (${formatDuration(now().getTime() - cleanupStartedMs)})`);
+    } else {
+      if (!isBuiltinContainer(config.hooks.cleanup) && !isBuiltinProcess(config.hooks.cleanup) && !isBuiltinVm(config.hooks.cleanup)) {
+        const cleanupEnv = {
+          ...jobEnv(config, job.item, job.itemKey, jobDirPath, process.env, job.branch, job.commitIdentity?.author),
+          ...job.build === void 0 ? {} : { OUTERLAYER_BUILD_DIR: job.build.buildDir },
+          OUTERLAYER_OUTCOME: outcome ?? "",
+          OUTERLAYER_LOG: logPath
+        };
+        const cleanup = await runHook(
+          config.hooks.cleanup,
+          cleanupEnv,
+          jobDirPath,
+          join(jobDirPath, "cleanup.log"),
+          spawnFn,
+          hookLimits()
+        ).catch((err) => {
+          log.error(`${tag} cleanup failed: ${describeCallFailure(err)} \xB7 continuing`);
+          return { code: -1 };
+        });
+        const cleanupTook = formatDuration(now().getTime() - cleanupStartedMs);
+        if (cleanup.endedBy !== void 0) {
+          log.error(`${tag} ${describeHookEnd("cleanup", cleanup.endedBy, config)} \xB7 continuing`);
+        } else if (cleanup.code > 0) {
+          log.error(`${tag} cleanup exited ${cleanup.code} (${cleanupTook}) \xB7 continuing`);
+        } else if (cleanup.code === 0) {
+          log.line(`${tag} cleanup ok (${cleanupTook})`);
+        }
+      }
+      if (job.build !== void 0) {
+        const runtime = deps.container ?? createContainerRuntime();
+        tunnelRecord = runtime.tunnels.get(job.build.buildId)?.record();
+        try {
+          await closeHostBuild(runtime, job.build);
+        } catch (err) {
+          log.error(`${tag} closing the build's tunnel failed: ${describeCallFailure(err)} \xB7 continuing`);
+        }
+      }
+    }
+    job.cleanupRan = true;
+    writeJobFile(jobFilePath, job);
+  }
+  let verdictReason;
+  if (outcome === "ok") {
+    const decision = await settleVerdict({
+      read: () => readItemEvaluation(config, job.item, deps.fetchImpl),
+      now,
+      sleep: deps.sleep ?? waitMs
+    });
+    if (decision.outcome === "incomplete") {
+      outcome = "incomplete";
+      verdictReason = scrubReason(decision.reason, config);
+      log.error(`${tag} the command exited 0 but the item is not done: ${verdictReason}`);
+    }
+  }
+  if (config.hooks.report) {
+    setStage(job, jobDirPath, "report");
+    log.line(`${tag} report started \xB7 phase end`);
+    const reportStartedMs = now().getTime();
+    const reportEnv = {
+      ...jobEnv(config, job.item, job.itemKey, jobDirPath, process.env, job.branch, job.commitIdentity?.author),
+      OUTERLAYER_PHASE: "end",
+      OUTERLAYER_OUTCOME: outcome ?? "",
+      OUTERLAYER_LOG: logPath
+    };
+    const report = await runHook(
+      config.hooks.report,
+      reportEnv,
+      jobDirPath,
+      join(jobDirPath, "report.log"),
+      spawnFn,
+      hookLimits()
+    ).catch((err) => {
+      log.error(`${tag} report failed: ${describeCallFailure(err)} \xB7 continuing`);
+      return { code: -1 };
+    });
+    const reportTook = formatDuration(now().getTime() - reportStartedMs);
+    if (report.endedBy !== void 0) {
+      log.error(`${tag} ${describeHookEnd("report", report.endedBy, config)} \xB7 continuing`);
+    } else if (report.code === 0) {
+      log.line(`${tag} report ok (${reportTook})`);
+    } else if (report.code > 0) {
+      log.error(`${tag} report exited ${report.code} (${reportTook}) \xB7 continuing`);
+    }
+  }
+  const isolated = job.container !== void 0 || job.microvm !== void 0;
+  const held = deps.container?.credentials.get(jobDirPath);
+  if (held !== void 0) {
+    await held.revokeAll();
+    deps.container.credentials.delete(jobDirPath);
+  }
+  if (outcome !== void 0) {
+    const fromHook = readReasonLine(jobDirPath, config);
+    if (verdictReason !== void 0) {
+      job.reason = verdictReason;
+    } else if (ending?.reason === void 0) {
+      job.reason = (outcome === "ok" ? void 0 : held?.reason) ?? (isolated ? fromHook ?? job.reason : fromHook);
+    }
+    const cliVersion = deps.cliVersion ?? resolveVersion();
+    const base = job.environment ?? (job.microvm !== void 0 ? { isolation: "vm", cliVersion } : job.container === void 0 ? sharedUserEnvironment(cliVersion) : { isolation: "container", cliVersion });
+    if (isolated || job.build !== void 0) {
+      tunnelRecord ??= readTunnelRecord(join(jobDirPath, "tunnel.json"));
+      job.environment = withTunnelRecord(base, scrubTunnelRecord(tunnelRecord, config), !isolated);
+    } else {
+      job.environment = base;
+    }
+    job.environment = { ...job.environment, commitIdentity: commitIdentityRecord(job.commitIdentity) };
+    writeJobFile(jobFilePath, job);
+  }
+  const sentAtMs = now().getTime();
+  const detail = outcome === void 0 ? {} : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment };
+  const release = await retrySend(() => releaseLease(config, job.item, outcome, detail, deps.fetchImpl), {
+    now: deps.now,
+    sleep: deps.sleep
+  });
+  const alreadyReleased = release.ok && wasAlreadyReleased(release.value, outcome, sentAtMs);
+  const endedAt = now();
+  job.outcome = outcome;
+  job.endedAt = endedAt.toISOString();
+  job.releaseFailed = release.ok ? alreadyReleased ? ALREADY_RELEASED : void 0 : release.reason;
+  writeJobFile(jobFilePath, job);
+  const total = formatDuration(endedAt.getTime() - new Date(job.startedAt).getTime());
+  if (alreadyReleased) {
+    log.line(
+      `${tag} lease was already released (outcome ${release.ok ? release.value.outcome ?? "none" : "unknown"}) \xB7 this attempt ended as ${outcome ?? "not attempted"}`
+    );
+  } else if (release.ok) {
+    log.line(
+      outcome === void 0 ? `${tag} released \xB7 not attempted (provision exit 75) \xB7 ${total}` : `${tag} released \xB7 outcome ${outcome} \xB7 ${total}`
+    );
+  } else {
+    log.error(
+      `${tag} release failed after ${release.attempts} attempt(s): ${release.reason}; the lease expires at ${formatClock(leaseExpiry(job, endedAt), endedAt)}`
+    );
+  }
+  return job;
+}
+function readLogState(logPath) {
+  try {
+    const stats = statSync(logPath);
+    return { size: stats.size, mtimeMs: stats.mtimeMs };
+  } catch {
+    return { size: -1, mtimeMs: -1 };
+  }
+}
+function describeHookEnd(stage, endedBy, config) {
+  return endedBy === "idle" ? `${stage} idle for ${config.idleLimitMinutes}m, ended` : `${stage} past the ${config.timeLimitMinutes}m time limit, ended`;
+}
+function hookLimitsFor(config, fromMs, now) {
+  return {
+    idleMs: config.idleLimitMinutes * 6e4,
+    endBy: fromMs + config.timeLimitMinutes * 6e4,
+    now
+  };
+}
+async function retryFailedReleases(jobsDirPath, config, deps) {
+  if (!existsSync(jobsDirPath)) return [];
+  const results = [];
+  for (const entry of readdirSync(jobsDirPath, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const dirPath = join(jobsDirPath, entry.name);
+    const jobFilePath = join(dirPath, "job.json");
+    const job = readJobFile(jobFilePath);
+    if (!job || job.releaseFailed === void 0 || job.releaseFailed === ALREADY_RELEASED || isUnfinished(job)) {
+      continue;
+    }
+    const detail = job.outcome === void 0 ? {} : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment };
+    const release = await retrySend(() => releaseLease(config, job.item, job.outcome, detail, deps.fetchImpl), {
+      now: deps.now,
+      sleep: deps.sleep
+    });
+    if (release.ok || !release.retryable) {
+      job.releaseFailed = void 0;
+      writeJobFile(jobFilePath, job);
+    } else {
+      job.releaseFailed = release.reason;
+      writeJobFile(jobFilePath, job);
+    }
+    results.push({ job, released: release.ok });
+  }
+  return results;
+}
+function isUnfinished(job) {
+  return job.outcome === void 0 && job.endedAt === void 0;
+}
+function unfinishedJobs(jobsDirPath) {
+  if (!existsSync(jobsDirPath)) return [];
+  const found = [];
+  for (const entry of readdirSync(jobsDirPath, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const dirPath = join(jobsDirPath, entry.name);
+    const job = readJobFile(join(dirPath, "job.json"));
+    if (job && isUnfinished(job)) found.push({ dirPath, job });
+  }
+  return found;
+}
+function listAdoptableJobs(jobsDirPath) {
+  return unfinishedJobs(jobsDirPath).filter(
+    ({ job }) => job.microvm === void 0 && job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start)
+  );
+}
+async function recoverLostJobs(jobsDirPath, config, deps) {
+  const recovered = [];
+  for (const { dirPath, job } of unfinishedJobs(jobsDirPath)) {
+    const alive = job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start);
+    if (alive) continue;
+    const recorded = outcomeFromExitCode(dirPath);
+    if (recorded !== void 0) job.exitCode = recorded.code;
+    recovered.push(await finishJob(job, dirPath, recorded?.outcome ?? "interrupted", config, deps));
+  }
+  return recovered;
+}
+
+export { LEASE_SECONDS, RENEW_INTERVAL_SECONDS, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, isGroupAlive, isIdle, isTimedOut, isUnfinished, jobEnv, listAdoptableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readJobFile, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, retryFailedReleases, runCommand, runHook, setStage, startHostServices, stopOrphanedMicroVms, unfinishedJobs, workdirProblem, writeJobFile };