@outerlayer/cli 0.2.0 → 0.4.1

package/dist/chunk-HZRNMGLF.js

@@ -0,0 +1,2233 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-ZNA27WEV.js';
+import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
+import { currentCliBuild } from './chunk-OGFGZQA3.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-774HEQL6.js';
+import { RecipeError } from './chunk-QOZKPLVJ.js';
+import { execCapture } from './chunk-W4SQCOZU.js';
+import { GUEST_CID } from './chunk-B2G7JHHB.js';
+import { WorkCommandError, postJson } from './chunk-W5FVUZXV.js';
+import { parseDuKilobytes, hostAllowed } from './chunk-F6GFZXZ3.js';
+import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, AGENT_CREDENTIAL_MISSING, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT } from './chunk-AUFG23AA.js';
+import { defaultGitRunner, materializeContext } from './chunk-XDDW4FRS.js';
+import { readContextManifest, readSourceCache } from './chunk-WIOZAJ2W.js';
+import { signingFetchFor } from './chunk-BCLJSQCV.js';
+import { signerFor } from './chunk-M5POMKKW.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
+import { relative, join, dirname, basename } from 'path';
+import { spawnSync, spawn } from 'child_process';
+import { randomBytes, createHash } from 'crypto';
+import { existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, renameSync, lstatSync, readFileSync, unlinkSync, readdirSync, openSync, closeSync, mkdtempSync, createWriteStream, statSync, createReadStream } from 'fs';
+import { createServer, request } from 'http';
+import { request as request$1 } from 'https';
+import { Transform } from 'stream';
+import { pipeline, finished } from 'stream/promises';
+import { createGunzip, gunzipSync, constants } from 'zlib';
+import { isIP, connect, createServer as createServer$1 } from 'net';
+import { lookup } from 'dns/promises';
+import { networkInterfaces } from 'os';
+
+createRequire(import.meta.url);
+function logStamp(at) {
+  return at.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function createRunnerLog(now = () => /* @__PURE__ */ new Date()) {
+  const write = (stream, text) => {
+    stream.write(`${logStamp(now())} ${text}
+`);
+  };
+  return {
+    line: (text) => write(process.stdout, text),
+    error: (text) => {
+      write(process.stdout, text);
+      write(process.stderr, text);
+    }
+  };
+}
+function formatDuration(ms) {
+  const total = Math.max(0, Math.round(ms / 1e3));
+  const hours = Math.floor(total / 3600);
+  const minutes = Math.floor(total % 3600 / 60);
+  const seconds = total % 60;
+  if (hours > 0) return `${hours}h ${minutes}m`;
+  if (minutes > 0) return `${minutes}m ${String(seconds).padStart(2, "0")}s`;
+  return `${seconds}s`;
+}
+function formatClock(at, today) {
+  const hhmm = `${String(at.getUTCHours()).padStart(2, "0")}:${String(at.getUTCMinutes()).padStart(2, "0")} UTC`;
+  const sameDay = at.getUTCFullYear() === today.getUTCFullYear() && at.getUTCMonth() === today.getUTCMonth() && at.getUTCDate() === today.getUTCDate();
+  if (sameDay) return hhmm;
+  const month = at.toLocaleString("en-US", { month: "short", timeZone: "UTC" });
+  return `${month} ${at.getUTCDate()} ${hhmm}`;
+}
+function shortClaim(claimId) {
+  return claimId.length <= 8 ? claimId : `${claimId.slice(0, 8)}\u2026`;
+}
+function relativeToRunner(runnerDirPath, path) {
+  const rel = relative(runnerDirPath, path);
+  return rel === "" || rel.startsWith("..") ? path : rel;
+}
+function describeCallFailure(err) {
+  if (err instanceof Error) {
+    const status = err.status;
+    return status === void 0 ? err.message : `${err.message} (${status})`;
+  }
+  return String(err);
+}
+
+// src/runner/retry.ts
+var RETRY_WINDOW_MS = 12e4;
+var FIRST_BACKOFF_MS = 1e3;
+var MAX_BACKOFF_MS = 15e3;
+function isRetryable(err) {
+  if (err instanceof WorkCommandError) return err.retryable;
+  return true;
+}
+async function retrySend(send, deps = {}) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const windowMs = deps.windowMs ?? RETRY_WINDOW_MS;
+  const startedMs = now().getTime();
+  let attempts = 0;
+  let backoffMs = FIRST_BACKOFF_MS;
+  for (; ; ) {
+    attempts++;
+    try {
+      return { ok: true, value: await send(), attempts };
+    } catch (err) {
+      const reason = describeCallFailure(err);
+      const code = err instanceof WorkCommandError ? err.code : void 0;
+      const status = err instanceof WorkCommandError ? err.status : void 0;
+      const message = err instanceof WorkCommandError ? err.message : void 0;
+      if (!isRetryable(err)) return { ok: false, attempts, reason, retryable: false, code, status, message };
+      const elapsedMs = now().getTime() - startedMs;
+      if (elapsedMs + backoffMs >= windowMs) return { ok: false, attempts, reason, retryable: true, code, status, message };
+      await sleep(backoffMs);
+      backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+    }
+  }
+}
+
+// src/runner/build-tokens.ts
+var ISSUE_RETRY_WINDOW_MS = 3e4;
+var REVOKE_TIMEOUT_MS = 15e3;
+function isDue(expiresAtMs, nowMs) {
+  return nowMs >= expiresAtMs - 10 * 6e4;
+}
+function classifyRefusal(err) {
+  if (!(err instanceof WorkCommandError)) return { kind: "retry" };
+  if (err.status === 401 || err.code === "claim_expired" || err.code === "claim_not_held") return { kind: "lease_lost" };
+  if (err.code === "github_unavailable") return { kind: "retry" };
+  if (err.retryable && err.code !== "repository_tokens_unavailable") return { kind: "retry" };
+  return { kind: "failed", reason: refusalCode(err) };
+}
+function refusalCode(err) {
+  if (!(err instanceof WorkCommandError)) return "unavailable";
+  return err.code ?? `http_${err.status ?? "unknown"}`;
+}
+var BuildTokens = class {
+  constructor(options) {
+    this.options = options;
+    this.held = /* @__PURE__ */ new Map();
+    this.asking = /* @__PURE__ */ new Map();
+    this.issued = [];
+    this.usedKinds = /* @__PURE__ */ new Set();
+    this.revoked = false;
+  }
+  now() {
+    return (this.options.now ?? (() => /* @__PURE__ */ new Date()))();
+  }
+  /** The token of `kind`, asking the gateway for a new one when the build holds none or its token is within ten minutes of expiry. */
+  token(kind) {
+    const held = this.held.get(kind);
+    if (held !== void 0 && !isDue(held.expiresAtMs, this.now().getTime())) return Promise.resolve(held.token);
+    let asking = this.asking.get(kind);
+    if (asking === void 0) {
+      asking = this.issueOrKeep(kind).finally(() => this.asking.delete(kind));
+      this.asking.set(kind, asking);
+    }
+    return asking;
+  }
+  /** A due token that has not yet expired is kept when the gateway cannot issue a new one. */
+  async issueOrKeep(kind) {
+    try {
+      return await this.issue(kind);
+    } catch (err) {
+      const held = this.held.get(kind);
+      if (held !== void 0 && this.now().getTime() < held.expiresAtMs && classifyRefusal(err).kind === "retry") return held.token;
+      throw err;
+    }
+  }
+  async issue(kind) {
+    const { config, item, fetchImpl } = this.options;
+    const asked = await retrySend(
+      async () => {
+        try {
+          return await postJson(
+            config.url,
+            `/v1/work-items/${item}/claim/tokens`,
+            config.apiKey,
+            config.appId,
+            { access: kind },
+            fetchImpl,
+            void 0,
+            await signerFor(config.configPath)
+          );
+        } catch (err2) {
+          if (err2 instanceof WorkCommandError && err2.code === "repository_tokens_unavailable") {
+            throw new WorkCommandError(err2.message, false, err2.status, err2.code);
+          }
+          throw err2;
+        }
+      },
+      { now: this.options.now, sleep: this.options.sleep, windowMs: ISSUE_RETRY_WINDOW_MS }
+    );
+    let err;
+    if (!asked.ok) {
+      err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
+    } else {
+      const { token, expiresAt } = asked.value.data;
+      const expiresAtMs = typeof expiresAt === "string" ? Date.parse(expiresAt) : Number.NaN;
+      if (typeof token === "string" && token !== "" && Number.isFinite(expiresAtMs)) {
+        if (this.revoked) {
+          await this.revoke([token]);
+          throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
+        }
+        this.held.set(kind, { token, expiresAtMs });
+        this.issued.push(token);
+        if (kind === "read") this.readSink?.(token);
+        return token;
+      }
+      err = new WorkCommandError("the gateway's token answer carried no token or no expiry", false, void 0, "malformed_token_response");
+    }
+    const refusal = classifyRefusal(err);
+    if (refusal.kind !== "retry") this.failure = refusal;
+    throw err;
+  }
+  /** Asks for a new read token when the build holds one within ten minutes of expiry. A refusal is kept for `refusal()`, not thrown. */
+  async renewReadIfDue() {
+    const held = this.held.get("read");
+    if (held === void 0 || !isDue(held.expiresAtMs, this.now().getTime())) return;
+    await this.token("read").catch(() => void 0);
+  }
+  /** Calls `sink` with the read token now, and again with each one that replaces it. */
+  onRead(sink) {
+    this.readSink = sink;
+    const held = this.held.get("read");
+    if (held !== void 0) sink(held.token);
+  }
+  markUsed(kind) {
+    if (this.usedKinds.has(kind)) return;
+    this.usedKinds.add(kind);
+    this.options.onUsed?.(this.used());
+  }
+  /** The kinds of token the build has used, read before push. */
+  used() {
+    return ["read", "push"].filter((kind) => this.usedKinds.has(kind));
+  }
+  /** The last refusal that ends the build, if a renewal or a push's token request met one. */
+  refusal() {
+    return this.failure;
+  }
+  /** Revokes every token this holder was issued, the superseded ones too, at GitHub with the token itself. A failure is not an error: the token lapses within the hour. */
+  async revokeAll() {
+    this.revoked = true;
+    const tokens = this.issued.splice(0);
+    this.held.clear();
+    await this.revoke(tokens);
+  }
+  async revoke(tokens) {
+    const apiUrl = this.options.apiUrl ?? "https://api.github.com";
+    await Promise.allSettled(
+      tokens.map(
+        (token) => this.options.fetchImpl(`${apiUrl}/installation/token`, {
+          method: "DELETE",
+          headers: {
+            authorization: `Bearer ${token}`,
+            accept: "application/vnd.github+json",
+            "x-github-api-version": "2022-11-28",
+            "user-agent": "outerlayer-runner"
+          },
+          signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+        })
+      )
+    );
+  }
+};
+var BranchPrepareError = class extends Error {
+};
+var OWN_PREFIX = "outerlayer/";
+var GIT_TIMEOUT_MS = 12e4;
+var REPO_BINDING_GIT_VARS = new Set(
+  `GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_OBJECT_DIRECTORY GIT_DIR GIT_WORK_TREE GIT_IMPLICIT_WORK_TREE
+   GIT_GRAFT_FILE GIT_INDEX_FILE GIT_NO_REPLACE_OBJECTS GIT_REPLACE_REF_BASE GIT_PREFIX
+   GIT_INTERNAL_SUPER_PREFIX GIT_SHALLOW_FILE GIT_COMMON_DIR GIT_NAMESPACE`.split(/\s+/)
+);
+function localGit(cwd, args) {
+  const env = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!REPO_BINDING_GIT_VARS.has(key)) env[key] = value;
+  }
+  env.GIT_TERMINAL_PROMPT = "0";
+  const result = spawnSync("git", args, { cwd, env, encoding: "utf8", timeout: GIT_TIMEOUT_MS });
+  if (result.error !== void 0) {
+    return Promise.resolve({ status: null, stdout: "", stderr: result.error.message });
+  }
+  return Promise.resolve({ status: result.status, stdout: result.stdout.trim(), stderr: result.stderr.trim() });
+}
+function firstLine(stderr) {
+  return (stderr.split("\n")[0] ?? "").replace(/\/\/[^/@\s]+@/g, "//");
+}
+async function mustGit(git2, cwd, step, args) {
+  const result = await git2(cwd, args);
+  if (result.status !== 0) {
+    const detail = firstLine(result.stderr);
+    throw new BranchPrepareError(`${step} failed${detail === "" ? "" : `: ${detail}`}`);
+  }
+  return result.stdout;
+}
+async function remoteDefaultBranch(git2, workdir) {
+  const out = await mustGit(git2, workdir, "reading the remote's default branch", ["ls-remote", "--symref", "origin", "HEAD"]);
+  const match = /^ref: refs\/heads\/(\S+)\s+HEAD$/m.exec(out);
+  if (match === null) {
+    throw new BranchPrepareError("reading the remote's default branch failed: the remote names none");
+  }
+  return match[1];
+}
+async function remoteHasBranch(git2, workdir, branch) {
+  return await mustGit(git2, workdir, `looking for ${branch} on the remote`, ["ls-remote", "--heads", "origin", `refs/heads/${branch}`]) !== "";
+}
+async function fetchBranch(git2, workdir, branch) {
+  await mustGit(git2, workdir, `fetching ${branch}`, ["fetch", "--quiet", "origin", `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
+}
+async function prepareBranch(opts) {
+  const { workdir, branch } = opts;
+  const git2 = opts.git ?? localGit;
+  const defaultBranch = await remoteDefaultBranch(git2, workdir);
+  const exists = await remoteHasBranch(git2, workdir, branch);
+  await fetchBranch(git2, workdir, defaultBranch);
+  if (exists) await fetchBranch(git2, workdir, branch);
+  let start;
+  if (exists && !(branch.startsWith(OWN_PREFIX) && await isMerged(git2, workdir, branch, defaultBranch))) {
+    start = `origin/${branch}`;
+  } else if (branch.startsWith(OWN_PREFIX)) {
+    start = `origin/${defaultBranch}`;
+  } else {
+    throw new BranchPrepareError(`the pull request's branch ${branch} is not on the remote`);
+  }
+  await mustGit(git2, workdir, `checking out ${branch}`, ["checkout", "--quiet", "-B", branch, start]);
+  return { branch, head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]) };
+}
+async function isMerged(git2, workdir, branch, defaultBranch) {
+  const result = await git2(workdir, ["merge-base", "--is-ancestor", `origin/${branch}`, `origin/${defaultBranch}`]);
+  if (result.status === 0) return true;
+  if (result.status === 1) return false;
+  const detail = firstLine(result.stderr);
+  throw new BranchPrepareError(`comparing ${branch} with ${defaultBranch} failed${detail === "" ? "" : `: ${detail}`}`);
+}
+
+// src/runner/container/lifecycle.ts
+var ORDER = ["onCreateCommand", "updateContentCommand", "postCreateCommand", "postStartCommand"];
+function commandArgv(command) {
+  if (typeof command === "string") return command === "" ? void 0 : ["/bin/sh", "-c", command];
+  if (Array.isArray(command) && command.length > 0 && command.every((part) => typeof part === "string")) return command;
+  return void 0;
+}
+function lifecycleSteps(lifecycle) {
+  const steps = [];
+  for (const name of ORDER) {
+    const entries = lifecycle[name];
+    if (entries === void 0) continue;
+    for (const { source, command } of entries) {
+      if (typeof command === "object" && command !== null && !Array.isArray(command)) {
+        for (const [key, value] of Object.entries(command)) {
+          const argv2 = commandArgv(value);
+          if (argv2 !== void 0) steps.push({ name: `${name}[${key}]`, source, argv: argv2 });
+        }
+        continue;
+      }
+      const argv = commandArgv(command);
+      if (argv !== void 0) steps.push({ name, source, argv });
+    }
+  }
+  return steps;
+}
+function lifecycleFailureReason(step, exitCode) {
+  return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
+}
+var AssetError = class extends Error {
+  constructor(file, message) {
+    super(message);
+    this.file = file;
+  }
+};
+var FIRECRACKER_RELEASES = "https://github.com/firecracker-microvm/firecracker/releases/download";
+var DOWNLOAD_TIMEOUT_MS = 10 * 6e4;
+function pinnedAssets(arch) {
+  const version = FIRECRACKER_VERSION;
+  return {
+    firecracker: {
+      url: `${FIRECRACKER_RELEASES}/v${version}/firecracker-v${version}-${arch}.tgz`,
+      sha256: FIRECRACKER_SHA256[arch],
+      binarySha256: FIRECRACKER_BINARY_SHA256[arch]
+    },
+    kernel: { url: `${GUEST_ASSETS_BASE_URL}/vmlinux-${arch}`, sha256: GUEST_KERNEL_SHA256[arch] },
+    helper: { url: `${GUEST_ASSETS_BASE_URL}/outerlayer-guest-${arch}`, sha256: GUEST_HELPER_SHA256[arch] }
+  };
+}
+var sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function pinProblem(file, expected, actual, where) {
+  const release = file.startsWith("vmlinux-") || file.startsWith("outerlayer-guest-") ? ` (guest assets release ${GUEST_ASSETS_VERSION})` : "";
+  return new AssetError(file, `${file} ${where} has sha256 ${actual}, not the ${expected} this release pins${release}, so no microVM build starts`);
+}
+function writeAtomic(path, bytes, mode) {
+  const temp = `${path}.${process.pid}.tmp`;
+  writeFileSync(temp, bytes, { mode });
+  renameSync(temp, path);
+}
+async function download(file, url, fetchImpl) {
+  let response;
+  try {
+    response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+  } catch (err) {
+    throw new AssetError(file, `${file} could not be downloaded from ${url}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!response.ok) throw new AssetError(file, `${file} could not be downloaded from ${url}: the server answered ${response.status}`);
+  return Buffer.from(await response.arrayBuffer());
+}
+async function ensureFile(dir, file, pin, fetchImpl, mode) {
+  const path = join(dir, file);
+  if (existsSync(path)) {
+    const actual2 = sha256Of(readFileSync(path));
+    if (actual2 !== pin.sha256) throw pinProblem(file, pin.sha256, actual2, `at ${path}`);
+    return path;
+  }
+  const bytes = await download(file, pin.url, fetchImpl);
+  const actual = sha256Of(bytes);
+  if (actual !== pin.sha256) throw pinProblem(file, pin.sha256, actual, `downloaded from ${pin.url}`);
+  writeAtomic(path, bytes, mode);
+  return path;
+}
+function extractWithTar(arch) {
+  const name = `firecracker-v${FIRECRACKER_VERSION}-${arch}`;
+  return async (tarball, destDir) => {
+    const result = spawnSync("tar", ["-xzf", tarball, "-C", destDir, "--strip-components=1", `release-v${FIRECRACKER_VERSION}-${arch}/${name}`], { encoding: "utf8" });
+    if (result.status !== 0) throw new Error(`tar could not unpack ${tarball}: ${result.stderr.trim()}`);
+    return join(destDir, name);
+  };
+}
+async function ensureAssets(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker or guest assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const firecracker = join(dir, "firecracker");
+  if (existsSync(firecracker)) {
+    const actual = sha256Of(readFileSync(firecracker));
+    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `at ${firecracker}`);
+  } else {
+    const tarballName = `firecracker-${arch}.tgz`;
+    const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
+    const scratch = mkdtempSync(join(dir, ".extract-"));
+    try {
+      const extracted = await (options.extractFirecracker ?? extractWithTar(arch))(tarball, scratch);
+      const bytes = readFileSync(extracted);
+      const actual = sha256Of(bytes);
+      if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `unpacked from ${tarballName}`);
+      writeAtomic(firecracker, bytes, 493);
+    } finally {
+      rmSync(scratch, { recursive: true, force: true });
+    }
+  }
+  const kernel = await ensureFile(dir, `vmlinux-${arch}`, pins.kernel, fetchImpl, RUNNER_FILE_MODE);
+  const helper = await ensureFile(dir, `outerlayer-guest-${arch}`, pins.helper, fetchImpl, 493);
+  return { firecracker, kernel, helper, helperSha256: pins.helper.sha256 };
+}
+function converterScript() {
+  return [
+    "set -eu",
+    "rootfs=/tmp/rootfs",
+    'mkdir -p "$rootfs"',
+    'tar -xf - -C "$rootfs"',
+    'used_kb=$(du -sk "$rootfs" | cut -f1)',
+    'files=$(find "$rootfs" | wc -l)',
+    // Room for the file system's own metadata, and for an inode per file with some to spare.
+    "total_kb=$(( used_kb + used_kb / 4 + 65536 ))",
+    'truncate -s "${total_kb}K" "/out/$OUT_NAME"',
+    'mke2fs -q -F -t ext4 -m 0 -N $(( files + files / 4 + 4096 )) -d "$rootfs" "/out/$OUT_NAME"',
+    'chown "$HOST_UID:$HOST_GID" "/out/$OUT_NAME"'
+  ].join("\n");
+}
+function templateScript() {
+  return [
+    "set -eu",
+    'truncate -s "$BYTES" "/out/$OUT_NAME"',
+    'mke2fs -q -F -t ext4 -m 0 -E lazy_itable_init=1,lazy_journal_init=1,nodiscard "/out/$OUT_NAME"',
+    'chown "$HOST_UID:$HOST_GID" "/out/$OUT_NAME"'
+  ].join("\n");
+}
+var ids = () => ({ uid: String(process.getuid?.() ?? 0), gid: String(process.getgid?.() ?? 0) });
+function converterArgs(dest, extra, script) {
+  const { uid, gid } = ids();
+  return [
+    "run",
+    "--rm",
+    "-i",
+    "--network",
+    "none",
+    "--mount",
+    `type=bind,src=${dirname(dest)},dst=/out`,
+    "-e",
+    `OUT_NAME=${basename(dest)}`,
+    "-e",
+    `HOST_UID=${uid}`,
+    "-e",
+    `HOST_GID=${gid}`,
+    ...extra,
+    // The image that runs `mke2fs` as root is the default base image: Ubuntu holds e2fsprogs.
+    DEFAULT_BASE_IMAGE,
+    "sh",
+    "-c",
+    script
+  ];
+}
+var firstLine2 = (text) => text.trim().split("\n")[0] ?? "";
+function exportInto(container, converter) {
+  return new Promise((resolve, reject) => {
+    const exporter = spawn("docker", ["export", container], { stdio: ["ignore", "pipe", "pipe"], env: childEnvironment(process.env) });
+    const writer = spawn("docker", converter, { stdio: ["pipe", "ignore", "pipe"], env: childEnvironment(process.env) });
+    const errors = [];
+    exporter.stderr.on("data", (chunk) => errors.push(`docker export: ${chunk.toString("utf8")}`));
+    writer.stderr.on("data", (chunk) => errors.push(`converter: ${chunk.toString("utf8")}`));
+    writer.stdin.on("error", () => void 0);
+    exporter.stdout.on("error", () => void 0);
+    exporter.stdout.pipe(writer.stdin);
+    exporter.once("error", reject);
+    writer.once("error", reject);
+    let exits = 0;
+    let failure;
+    const done = (name, code) => {
+      if (code !== 0 && failure === void 0) failure = `${name} exited ${code}`;
+      exits += 1;
+      if (exits < 2) return;
+      if (failure === void 0) resolve();
+      else reject(new Error(`${failure}: ${firstLine2(errors.join("\n"))}`));
+    };
+    exporter.once("exit", (code) => done("docker export", code));
+    writer.once("exit", (code) => done("the converter", code));
+  });
+}
+function createRootfsHost() {
+  const env = () => childEnvironment(process.env);
+  return {
+    async convert({ imageId, dest }) {
+      const created = await spawnRun("docker", ["create", imageId, "none"], { env: env() });
+      if (created.status !== 0) throw new Error(`docker create ${imageId} failed: ${firstLine2(created.stderr)}`);
+      const container = created.stdout.trim();
+      try {
+        await exportInto(container, converterArgs(dest, [], converterScript()));
+      } finally {
+        await spawnRun("docker", ["rm", "--force", "--volumes", container], { env: env() });
+      }
+    },
+    async makeTemplate({ bytes, dest }) {
+      const made = await spawnRun("docker", converterArgs(dest, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
+      if (made.status !== 0) throw new Error(`making the empty build disk failed: ${firstLine2(made.stderr)}`);
+    },
+    async imageConfig(imageId) {
+      const inspected = await spawnRun("docker", ["image", "inspect", "--format", "{{json .Config}}", imageId], { env: env() });
+      if (inspected.status !== 0) throw new Error(`docker image inspect ${imageId} failed: ${firstLine2(inspected.stderr)}`);
+      const config = JSON.parse(inspected.stdout);
+      const variables = {};
+      for (const entry of config.Env ?? []) {
+        const eq = entry.indexOf("=");
+        if (eq > 0) variables[entry.slice(0, eq)] = entry.slice(eq + 1);
+      }
+      return { env: variables, user: config.User ?? "" };
+    }
+  };
+}
+function sweepStalePartials(dir) {
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const pid = /\.partial-(\d+)-[0-9a-f]+$/.exec(name)?.[1];
+    if (pid === void 0 || Number(pid) === process.pid) continue;
+    try {
+      process.kill(Number(pid), 0);
+    } catch (err) {
+      if (err.code === "ESRCH") rmSync(join(dir, name), { force: true });
+    }
+  }
+}
+async function madeAtomically(path, make) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  const temp = `${path}.partial-${process.pid}-${randomBytes(3).toString("hex")}`;
+  sweepStalePartials(dirname(path));
+  try {
+    await make(temp);
+    renameSync(temp, path);
+  } catch (err) {
+    rmSync(temp, { force: true });
+    throw err;
+  }
+}
+async function ensureRootfs(input) {
+  const path = rootfsPathFor(input.runnerDir, input.imageId);
+  if (existsSync(path)) return path;
+  const { uid, gid } = ids();
+  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid) }));
+  return path;
+}
+async function createBuildDisk(input) {
+  const template = join(diskTemplatesDir(input.runnerDir), `${input.bytes}.ext4`);
+  if (!existsSync(template)) {
+    const { uid, gid } = ids();
+    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid) }));
+  }
+  mkdirSync(dirname(input.dest), { recursive: true });
+  if (input.host.copyTemplate) input.host.copyTemplate(template, input.dest);
+  else {
+    const copied = spawnSync("cp", ["--sparse=always", template, input.dest], { encoding: "utf8" });
+    if (copied.status !== 0) throw new Error(`copying the empty build disk failed: ${firstLine2(copied.stderr)}`);
+  }
+  chmodSync(input.dest, RUNNER_FILE_MODE);
+  truncateSync(input.dest, input.bytes);
+}
+function deleteBuildDisk(path) {
+  rmSync(path, { force: true });
+}
+var MIB = 1024 ** 2;
+var INIT = "/opt/outerlayer/bin/outerlayer-guest";
+function machineConfig(limits2, paths) {
+  const bootArgs = [
+    "console=ttyS0",
+    "reboot=k",
+    "panic=1",
+    "pci=off",
+    "i8042.noaux",
+    "i8042.nomux",
+    "i8042.nopnp",
+    "i8042.dumbkbd",
+    "ro",
+    "root=/dev/vda",
+    "rootfstype=ext4",
+    `init=${INIT}`,
+    ...paths.relayPorts.length === 0 ? [] : [`outerlayer.relay=${paths.relayPorts.join(",")}`],
+    ...paths.docker === true ? ["outerlayer.docker=1"] : []
+  ];
+  return {
+    "boot-source": { kernel_image_path: paths.kernel, boot_args: bootArgs.join(" ") },
+    drives: [
+      { drive_id: "rootfs", path_on_host: paths.rootfs, is_root_device: true, is_read_only: true },
+      { drive_id: "build", path_on_host: paths.buildDisk, is_root_device: false, is_read_only: false }
+    ],
+    "machine-config": { vcpu_count: limits2.cpus, mem_size_mib: Math.max(1, Math.floor(limits2.memoryBytes / MIB)), smt: false },
+    vsock: { guest_cid: GUEST_CID, uds_path: paths.vsock }
+  };
+}
+function firecrackerCommand(input) {
+  return { command: input.binary, args: ["--no-api", "--config-file", input.configPath] };
+}
+var STOP_WAIT_MS = 1e4;
+var POLL_MS = 20;
+function isZombie(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    return stat.slice(stat.lastIndexOf(")") + 2, stat.lastIndexOf(")") + 3) === "Z";
+  } catch {
+    return false;
+  }
+}
+function createFirecrackerHost(options = {}) {
+  const launch = options.launch ?? firecrackerCommand;
+  const exits = /* @__PURE__ */ new Map();
+  const alive = (vm) => isSameProcess(vm.pid, vm.start) && !isZombie(vm.pid);
+  return {
+    async spawn(input) {
+      const { command, args } = launch(input);
+      mkdirSync(dirname(input.consolePath), { recursive: true });
+      const consoleFd = openSync(input.consolePath, "a", 384);
+      try {
+        const child = spawn(command, args, { detached: true, stdio: ["ignore", consoleFd, consoleFd] });
+        const failed = new Promise((_resolve, reject) => child.once("error", reject));
+        const pid = child.pid;
+        if (pid === void 0) return await failed;
+        exits.set(pid, new Promise((resolve) => child.once("exit", () => resolve())));
+        child.unref();
+        const start = startTimeOf(pid);
+        if (start === null) throw new Error(`${command} exited as soon as it started; its console is at ${input.consolePath}`);
+        return { pid, start };
+      } finally {
+        closeSync(consoleFd);
+      }
+    },
+    async stop(vm) {
+      if (!alive(vm)) return;
+      try {
+        process.kill(vm.pid, "SIGKILL");
+      } catch {
+      }
+      const exited = exits.get(vm.pid);
+      const deadline = Date.now() + STOP_WAIT_MS;
+      if (exited !== void 0) await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, STOP_WAIT_MS))]);
+      while (alive(vm) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+      exits.delete(vm.pid);
+    },
+    alive
+  };
+}
+
+// src/runner/microvm/host.ts
+function createMicroVmPorts(over = {}) {
+  return {
+    assets: over.assets ?? ((runnerDir) => ensureAssets({ runnerDir })),
+    rootfs: over.rootfs ?? createRootfsHost(),
+    firecracker: over.firecracker ?? createFirecrackerHost(),
+    exec: over.exec ?? execCapture
+  };
+}
+
+// src/runner/build-steps.ts
+var aborted = () => ({ ok: false, reason: "", aborted: true });
+function firstLine3(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+function adoptionFailureReason(result) {
+  const line = result.stdout.trim().split("\n").at(-1) ?? "";
+  try {
+    const answer = JSON.parse(line);
+    if (typeof answer.code === "string" && typeof answer.message === "string") return `${answer.code}: ${answer.message}`;
+  } catch {
+  }
+  return `context_adoption_failed: adopting the control plane's context failed (exit ${result.status})${firstLine3(result.stderr) === "" ? "" : `: ${firstLine3(result.stderr)}`}`;
+}
+async function runBuildSteps(input) {
+  const { exec, log, tag, repository } = input;
+  const rewrite = await exec(["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"], "/build/work");
+  if (rewrite.status !== 0) return { ok: false, reason: `configuring the build's git remote failed (exit ${rewrite.status})` };
+  const clone = await exec(["git", "clone", "--filter=blob:none", "--single-branch", `https://github.com/${repository}.git`, CHECKOUT_DIR], "/build/work");
+  if (clone.status !== 0) return { ok: false, reason: `the clone of ${repository} failed (exit ${clone.status})` };
+  try {
+    const prepared = await prepareBranch({
+      workdir: CHECKOUT_DIR,
+      branch: input.branch,
+      git: async (cwd, args) => {
+        const ran = await exec(["git", ...args], cwd, { quiet: true });
+        return { status: ran.status, stdout: ran.stdout.trim(), stderr: ran.stderr.trim() };
+      }
+    });
+    log.line(`${tag} on ${prepared.branch} at ${prepared.head.slice(0, 8)}`);
+  } catch (err) {
+    if (err instanceof BranchPrepareError) return { ok: false, reason: err.message };
+    throw err;
+  }
+  for (const step of lifecycleSteps(input.lifecycle)) {
+    if (input.aborted()) return aborted();
+    log.line(`${tag} lifecycle ${step.name} (${step.source})`);
+    const ran = await exec(step.argv, CHECKOUT_DIR);
+    if (ran.status !== 0) return { ok: false, reason: lifecycleFailureReason(step, ran.status) };
+  }
+  if (input.aborted()) return aborted();
+  const staged = await input.stageContext();
+  if (staged.kind === "refused") return { ok: false, reason: staged.reason };
+  if (staged.kind === "staged") {
+    try {
+      const delivered = await input.deliverContext?.(staged) ?? { ok: true };
+      if (!delivered.ok) return { ok: false, reason: delivered.reason };
+      const adopted = await exec(["outerlayer", "context", "adopt", `${JOB_MOUNT}/context`, "--json"], CHECKOUT_DIR);
+      if (adopted.status !== 0) return { ok: false, reason: adoptionFailureReason(adopted) };
+      log.line(`${tag} governed context ${staged.sha.slice(0, 7)} adopted (${staged.files.length} files)`);
+    } finally {
+      input.removeStagedContext();
+    }
+    if (input.aborted()) return aborted();
+  }
+  return { ok: true };
+}
+
+// src/runner/container/agent-user.ts
+var ADDED_USER = "ol-agent";
+var AgentUserError = class extends Error {
+};
+async function resolveAgentUser(input) {
+  const named = input.remoteUser !== void 0 && input.remoteUser !== "" ? input.remoteUser : input.imageUser;
+  const candidate = (named ?? "").split(":")[0];
+  if (candidate === "" || candidate === "root") return ADDED_USER;
+  if (/^\d+$/.test(candidate)) return Number(candidate) === 0 ? ADDED_USER : candidate;
+  const uid = await input.probe(candidate);
+  if (uid === null) throw new AgentUserError(`the user "${candidate}" is not in the image, so no command can run as it`);
+  return uid === 0 ? ADDED_USER : candidate;
+}
+var unavailable = (why) => ({ kind: "refused", reason: `context_unavailable: ${why}` });
+function makeReadable(tree, dir, files) {
+  chmodSync(dir, 493);
+  chmodSync(tree, 493);
+  const directories = /* @__PURE__ */ new Set();
+  for (const rel of files) {
+    for (let current = dirname(join(tree, rel)); current !== tree; current = dirname(current)) directories.add(current);
+    chmodSync(join(tree, rel), (lstatSync(join(tree, rel)).mode & 73) !== 0 ? 493 : 420);
+  }
+  for (const directory of directories) chmodSync(directory, 493);
+}
+async function stageGovernedContext(input) {
+  const git2 = input.git ?? defaultGitRunner;
+  const dir = stagedContextDir(input.buildDir);
+  const tree = join(dir, "tree");
+  const finish = (outcome) => {
+    removeStagedContext(input.buildDir);
+    return outcome;
+  };
+  try {
+    mkdirSync(tree, { recursive: true });
+    for (const args of [
+      ["init", "-q", "--initial-branch=main", tree],
+      ["-C", tree, "remote", "add", "origin", `https://github.com/${input.repository}.git`]
+    ]) {
+      const done = git2(args, { cwd: dir, timeoutMs: 1e4 });
+      if (!done.ok) return finish(unavailable(`the staging directory could not be prepared: ${done.stderr.trim().split("\n")[0] ?? ""}`));
+    }
+    const { url, apiKey, appId, configPath } = input.config;
+    const result = await materializeContext({
+      cwd: tree,
+      sessionId: `build-${input.buildId}`,
+      home: contextHomeDir(configPath),
+      cloud: { url, apiKey, appId },
+      fetchImpl: signingFetchFor(input.fetchImpl, configPath, apiKey),
+      git: git2,
+      now: input.now,
+      resolveControlPlaneUrl: (repository) => input.controlPlaneUrl(repository)
+    });
+    switch (result.status) {
+      case "materialized": {
+        if (result.unfetched !== void 0 && result.unfetched.length > 0) {
+          return finish(unavailable(`the host's git login cannot read ${result.unfetched.join(" or ")}, a control plane named for ${input.repository}, so it cannot be ruled out as a second claimant`));
+        }
+        const manifest = readContextManifest(join(tree, ".git"));
+        const source = readSourceCache(join(tree, ".git"));
+        if (result.sha === null || manifest === void 0 || source?.status !== "governed" || source.repository === void 0 || source.ref === void 0) {
+          return finish(unavailable(`the context of ${input.repository} was materialized without a record of it`));
+        }
+        writeFileSync(
+          join(dir, "staged.json"),
+          JSON.stringify({ schemaVersion: 1, sha: result.sha, repository: source.repository, ref: source.ref, files: manifest.files }) + "\n"
+        );
+        makeReadable(tree, dir, manifest.files);
+        chmodSync(join(dir, "staged.json"), 420);
+        return { kind: "staged", dir, sha: result.sha, files: manifest.files };
+      }
+      case "self":
+        if (result.unfetched !== void 0 && result.unfetched.length > 0) {
+          return finish(unavailable(`the host's git login cannot read ${result.unfetched.join(" or ")}, the control plane named for ${input.repository}`));
+        }
+        if (result.designation === "answered") return finish({ kind: "none" });
+        if (result.authRejected === true) {
+          return finish(unavailable(`the gateway rejected the runner's API key (401/403) when asked which repository governs ${input.repository}`));
+        }
+        return finish(unavailable(`the gateway did not say which repository governs ${input.repository}`));
+      case "conflict":
+        return finish({ kind: "refused", reason: `context_conflict: ${result.message ?? "two control planes claim this repository"}` });
+      default:
+        return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
+    }
+  } catch (err) {
+    return finish(unavailable(`the context of ${input.repository} could not be staged: ${err instanceof Error ? err.message : String(err)}`));
+  }
+}
+function removeStagedContext(buildDir2) {
+  rmSync(stagedContextDir(buildDir2), { recursive: true, force: true });
+}
+
+// src/runner/container/run-args.ts
+var BUILD_LABEL = "ai.outerlayer.build";
+function hardened(input) {
+  const { memory, cpus, pids } = input.limits;
+  return [
+    "--label",
+    `${BUILD_LABEL}=${input.buildId}`,
+    "--network",
+    "none",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--read-only",
+    "--user",
+    input.user,
+    // The same figure for swap as for memory leaves the container none.
+    "--memory",
+    memory,
+    "--memory-swap",
+    memory,
+    "--cpus",
+    String(cpus),
+    "--pids-limit",
+    String(pids)
+  ];
+}
+function mountPath(path) {
+  if (/[",]/.test(path)) throw new Error(`${path} holds a comma or a quote, which a Docker mount cannot carry; move the runner's config file`);
+  return path;
+}
+function containerRunArgs(input) {
+  return [
+    "--detach",
+    "--name",
+    input.container,
+    ...hardened(input),
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
+    "--mount",
+    `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
+    "--mount",
+    `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
+    "--entrypoint",
+    "/opt/outerlayer/bin/tini",
+    input.image,
+    "--",
+    "/opt/outerlayer/bin/node",
+    "/opt/outerlayer/cli/dist/index.js",
+    "broker-relay",
+    "--port",
+    String(RELAY_PORT),
+    "--socket",
+    `${JOB_MOUNT}/tunnel.sock`,
+    ...Array.from({ length: input.destinations ?? 0 }, (_unused, index) => [
+      "--forward",
+      `${DESTINATION_BASE_PORT + index}=${JOB_MOUNT}/dest-${index}.sock`
+    ]).flat(),
+    ...[
+      "--forward",
+      `${GATEWAY_PORT}=${JOB_MOUNT}/${GATEWAY_SOCKET}`,
+      "--forward",
+      `${CLAUDE_PORT}=${JOB_MOUNT}/${CLAUDE_SOCKET}`
+    ] 
+  ];
+}
+function prepareRunArgs(input) {
+  return [
+    "--rm",
+    ...hardened(input),
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    "--entrypoint",
+    "mkdir",
+    input.image,
+    "-p",
+    "-m",
+    "1777",
+    "/build/tmp",
+    "/build/home",
+    "/build/work"
+  ];
+}
+function containerExecArgs(input) {
+  const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
+  const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
+  return [
+    "-u",
+    input.user,
+    ...input.workdir === void 0 ? [] : ["-w", input.workdir],
+    ...literals,
+    ...passed,
+    input.container,
+    ...input.argv
+  ];
+}
+
+// src/runner/container/docker.ts
+function createContainerHost(deps = {}) {
+  const run = deps.run ?? spawnRun;
+  return {
+    async version() {
+      const result = await run("docker", ["version", "--format", "{{.Server.Version}}"]);
+      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
+    },
+    async operatingSystem() {
+      const result = await run("docker", ["info", "--format", "{{.OperatingSystem}}"]);
+      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
+    },
+    async imageUser(imageId) {
+      const result = await run("docker", ["image", "inspect", "--format", "{{.Config.User}}", imageId]);
+      return result.status === 0 ? result.stdout.trim() : "";
+    },
+    createVolume(name, labels) {
+      const flags = Object.entries(labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+      return run("docker", ["volume", "create", ...flags, name]);
+    },
+    removeVolume(name) {
+      return run("docker", ["volume", "rm", "--force", name]);
+    },
+    run(args, opts) {
+      return run("docker", ["run", ...args], opts);
+    },
+    exec(input, opts) {
+      const env = {};
+      for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
+      return run("docker", ["exec", ...containerExecArgs(input)], { ...opts, env });
+    },
+    stop(container) {
+      return run("docker", ["stop", container]);
+    },
+    start(container) {
+      return run("docker", ["start", container]);
+    },
+    remove(container) {
+      return run("docker", ["rm", "--force", "--volumes", container]);
+    }
+  };
+}
+var FILE_MODE = 420;
+var DIR_MODE = 493;
+function replaceFile(path, text) {
+  const partial = `${path}.${process.pid}.partial`;
+  writeFileSync(partial, text);
+  chmodSync(partial, FILE_MODE);
+  renameSync(partial, path);
+}
+function ghHostsYml(token) {
+  return [
+    "github.com:",
+    "    users:",
+    "        x-access-token:",
+    `            oauth_token: ${token}`,
+    `    oauth_token: ${token}`,
+    "    user: x-access-token",
+    "    git_protocol: https",
+    ""
+  ].join("\n");
+}
+var GH_CONFIG_YML = 'version: "1"\n';
+function writeGhConfig(dir, token) {
+  mkdirSync(dir, { recursive: true, mode: DIR_MODE });
+  chmodSync(dir, DIR_MODE);
+  replaceFile(join(dir, "hosts.yml"), ghHostsYml(token));
+  replaceFile(join(dir, "config.yml"), GH_CONFIG_YML);
+}
+function gitEnv(extra) {
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) if (!name.startsWith("GIT_")) env[name] = value;
+  return { ...env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", ...extra };
+}
+async function git(args, cwd, env, input) {
+  const timeoutMs = 10 * 6e4;
+  const maxOutputBytes = 1024 * 1024;
+  const child = spawn("git", args, { cwd, env, stdio: [input === void 0 ? "ignore" : "pipe", "pipe", "ignore"], timeout: timeoutMs });
+  const out = [];
+  let size = 0;
+  child.stdout.on("data", (chunk) => {
+    if (size < maxOutputBytes) out.push(chunk);
+    size += chunk.length;
+  });
+  const closed = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (status) => resolve(status));
+  });
+  if (input !== void 0) {
+    await pipeline(input, child.stdin).catch(() => void 0);
+  }
+  return { status: await closed, stdout: Buffer.concat(out) };
+}
+async function isFastForward(input) {
+  const ref = `refs/heads/${input.branch}`;
+  mkdirSync(input.mirrorDir, { recursive: true });
+  const init = await git(["init", "--bare", "--quiet"], input.mirrorDir, gitEnv({}));
+  if (init.status !== 0) throw new Error("git could not prepare the mirror");
+  const credential = `Authorization: Basic ${Buffer.from(`x-access-token:${input.token}`).toString("base64")}`;
+  const remoteEnv = gitEnv({ GIT_CONFIG_COUNT: "1", GIT_CONFIG_KEY_0: `http.${input.remoteUrl}.extraHeader`, GIT_CONFIG_VALUE_0: credential });
+  const fetched = await git(["fetch", "--quiet", "--no-tags", "--force", input.remoteUrl, `+${ref}:${ref}`], input.mirrorDir, remoteEnv);
+  if (fetched.status !== 0) {
+    const listed = await git(["ls-remote", "--exit-code", input.remoteUrl, ref], input.mirrorDir, remoteEnv);
+    if (listed.status === 2) return false;
+    throw new Error(`git could not fetch ${input.branch} from GitHub`);
+  }
+  const body = createReadStream(input.bodyPath);
+  let decoded = body;
+  if (input.gzip) {
+    decoded = body.pipe(createGunzip());
+    body.on("error", (err) => decoded.destroy(err));
+  }
+  const received = await git(
+    ["-c", "receive.denyNonFastForwards=true", "-c", "receive.denyDeletes=true", "receive-pack", "--stateless-rpc", input.mirrorDir],
+    input.mirrorDir,
+    gitEnv({}),
+    decoded
+  );
+  return received.stdout.includes(`ok ${ref}
+`, 0, "utf8");
+}
+function limits() {
+  return { sectionBytes: 64 * 1024, compressedWindow: 16 * 1024, inflatedBytes: 1024 * 1024 };
+}
+var TOO_LONG = "the push commands are longer than the runner reads";
+var UNREADABLE = "the push commands are not in a form the runner reads";
+var NOT_GZIP = "the push body is not valid gzip";
+var COMMAND = /^([0-9a-f]{40}|[0-9a-f]{64}) ([0-9a-f]{40}|[0-9a-f]{64}) ([^\u0000- \u007f]+)$/;
+function refused(reason) {
+  return { kind: "refused", reason };
+}
+function decode(prefix, gzip) {
+  if (!gzip) return prefix;
+  try {
+    const { compressedWindow, inflatedBytes } = limits();
+    return gunzipSync(prefix.subarray(0, compressedWindow), { finishFlush: constants.Z_SYNC_FLUSH, maxOutputLength: inflatedBytes });
+  } catch (err) {
+    const code = err.code;
+    if (code === "ERR_BUFFER_TOO_LARGE") return refused(TOO_LONG);
+    return refused(NOT_GZIP);
+  }
+}
+function decodeText(bytes) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return void 0;
+  }
+}
+function parse(data) {
+  const commands = [];
+  let capabilities = [];
+  let offset = 0;
+  for (; ; ) {
+    if (data.length - offset < 4) return { kind: "need-more" };
+    const header = data.toString("latin1", offset, offset + 4);
+    if (!/^[0-9a-f]{4}$/i.test(header)) return refused(UNREADABLE);
+    const length = Number.parseInt(header, 16);
+    if (length === 0) return { kind: "commands", commands, capabilities };
+    if (data.length - offset < length) return { kind: "need-more" };
+    const line = data.subarray(offset + 4, offset + length);
+    offset += length;
+    if (offset > limits().sectionBytes) return refused(TOO_LONG);
+    const first = commands.length === 0;
+    const nul = line.indexOf(0);
+    const decoded = decodeText(first && nul !== -1 ? line.subarray(0, nul) : line);
+    if (decoded === void 0) return refused(UNREADABLE);
+    const text = decoded.replace(/\n$/, "");
+    if (first && text.startsWith("shallow ")) continue;
+    const match = COMMAND.exec(text);
+    if (match === null) return refused(UNREADABLE);
+    if (first && nul !== -1) capabilities = line.subarray(nul + 1).toString("latin1").split(/\s+/).filter((word) => word !== "");
+    commands.push({ oldId: match[1], newId: match[2], ref: match[3] });
+  }
+}
+function readCommandSection(prefix, gzip) {
+  const decoded = decode(prefix, gzip);
+  if (!Buffer.isBuffer(decoded)) return decoded;
+  const section = parse(decoded);
+  if (section.kind === "need-more" && gzip && prefix.length >= limits().compressedWindow) return refused(TOO_LONG);
+  return section;
+}
+function pkt(payload) {
+  const body = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+  return Buffer.concat([Buffer.from((body.length + 4).toString(16).padStart(4, "0")), body]);
+}
+var FLUSH = Buffer.from("0000");
+function banded(channel, data, max) {
+  const packets = [];
+  for (let at = 0; at < data.length; at += max) {
+    packets.push(pkt(Buffer.concat([Buffer.from([channel]), data.subarray(at, at + max)])));
+  }
+  return packets;
+}
+function encodeRefusal(commands, capabilities, message) {
+  const wantsReport = capabilities.includes("report-status") || capabilities.includes("report-status-v2");
+  const bigBand = capabilities.includes("side-band-64k");
+  const sideBand = bigBand || capabilities.includes("side-band");
+  const report = wantsReport ? Buffer.concat([pkt("unpack ok\n"), ...commands.map((c) => pkt(`ng ${c.ref} ${message}
+`)), FLUSH]) : Buffer.alloc(0);
+  if (!sideBand) return wantsReport ? report : FLUSH;
+  const max = bigBand ? 65515 : 995;
+  return Buffer.concat([...banded(2, Buffer.from(`${message}
+`), max), ...banded(1, report, max), FLUSH]);
+}
+
+// src/runner/container/push-rule.ts
+var OWNED_PREFIX = "outerlayer/";
+function isZero(id) {
+  return /^0+$/.test(id);
+}
+function needsFastForwardCheck(commands, branch) {
+  if (branch.startsWith(OWNED_PREFIX) || commands.length !== 1) return false;
+  const [only] = commands;
+  return only.ref === `refs/heads/${branch}` && !isZero(only.oldId) && !isZero(only.newId);
+}
+function judgePush(input) {
+  const { commands, branch } = input;
+  if (commands.some((c) => c.ref !== `refs/heads/${branch}`)) {
+    return { allowed: false, message: `this build may push only to ${branch}` };
+  }
+  if (branch.startsWith(OWNED_PREFIX)) return { allowed: true };
+  const creates = commands.every((c) => isZero(c.oldId) && !isZero(c.newId));
+  const forwards = commands.length === 1 && !isZero(commands[0].newId) && input.fastForward === true;
+  if (creates || forwards) return { allowed: true };
+  return { allowed: false, message: `${branch} is not an outerlayer/ branch, so this build may only fast-forward it` };
+}
+
+// src/runner/container/git-remote.ts
+var SEGMENT = /^[A-Za-z0-9_.-]+$/;
+var WORKFLOW_REFUSAL = /refusing to allow a GitHub App to create or update workflow .* without `workflows` permission/;
+function classifyRequest(method, rawUrl) {
+  const [path = "", ...queryParts] = rawUrl.split("?");
+  const search = queryParts.join("?");
+  const segments = path.split("/").slice(1);
+  if (segments[0] !== "github.com" || segments.length < 4) return void 0;
+  const [, owner, repo, ...rest] = segments;
+  const name = repo.replace(/\.git$/, "");
+  if (![owner, name, ...rest].every((segment) => SEGMENT.test(segment) && segment !== "." && segment !== "..")) return void 0;
+  const where = { owner, name };
+  const suffix = rest.join("/");
+  if (suffix === "info/refs") {
+    if (method !== "GET") return void 0;
+    const service = new URLSearchParams(search).get("service");
+    if (service !== "git-upload-pack" && service !== "git-receive-pack") return void 0;
+    return { ...where, kind: "info-refs", service, search: `service=${service}` };
+  }
+  if (method !== "POST") return void 0;
+  if (suffix === "git-upload-pack") return { ...where, kind: "upload-pack", search: "" };
+  if (suffix === "git-receive-pack") return { ...where, kind: "receive-pack", search: "" };
+  if (suffix === "info/lfs/objects/batch") return { ...where, kind: "lfs-batch", search: "" };
+  return void 0;
+}
+function isOwnRepository(own, owner, name) {
+  return `${owner}/${name}`.toLowerCase() === own.replace(/\.git$/, "").toLowerCase();
+}
+function basicAuthorization(token) {
+  return `Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+}
+function upstreamHeaders(incoming, authorization) {
+  const headers = {};
+  for (const name of ["content-type", "content-encoding", "accept", "git-protocol", "user-agent"]) {
+    const value = incoming[name];
+    if (typeof value === "string") headers[name] = value;
+  }
+  if (authorization !== void 0) headers.authorization = authorization;
+  return headers;
+}
+function isWorkflowRefusal(text) {
+  return WORKFLOW_REFUSAL.test(text);
+}
+function plain(res, status, text) {
+  res.writeHead(status, { "content-type": "text/plain", "content-length": Buffer.byteLength(text), connection: "close" });
+  res.end(text);
+}
+async function drain(req) {
+  req.resume();
+  try {
+    await finished(req);
+  } catch {
+  }
+}
+function readPrefix(req, gzip) {
+  return new Promise((resolve, reject) => {
+    const held = [];
+    const finish = (section) => {
+      req.off("data", onData);
+      req.off("end", onEnd);
+      req.off("error", reject);
+      req.pause();
+      resolve({ held, section });
+    };
+    const onData = (chunk) => {
+      held.push(chunk);
+      const section = readCommandSection(Buffer.concat(held), gzip);
+      if (section.kind !== "need-more") finish(section);
+    };
+    const onEnd = () => finish({ kind: "need-more" });
+    req.on("data", onData);
+    req.once("end", onEnd);
+    req.once("error", reject);
+  });
+}
+function readBody(req, limit) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > limit) {
+        req.pause();
+        resolve(void 0);
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.once("end", () => resolve(Buffer.concat(chunks)));
+    req.once("error", reject);
+  });
+}
+function createGitRemote(options) {
+  const gitUrl = options.gitUrl ?? "https://github.com";
+  const maxLfsBodyBytes = 1024 * 1024;
+  const hopByHop = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "proxy-authenticate", "proxy-authorization", "te", "trailer", "set-cookie"]);
+  const log = (line) => options.log?.(line);
+  function forward(input) {
+    const { route, res } = input;
+    const url = new URL(`${gitUrl}/${route.owner}/${route.name}.git/${route.kind === "info-refs" ? "info/refs" : route.kind === "lfs-batch" ? "info/lfs/objects/batch" : `git-${route.kind}`}${route.search === "" ? "" : `?${route.search}`}`);
+    const send = url.protocol === "https:" ? request$1 : request;
+    return new Promise((resolve) => {
+      const upstream = send(url, { method: input.method, headers: { ...input.headers, connection: "close" } }, (answer) => {
+        const headers = {};
+        for (const [name, value] of Object.entries(answer.headers)) {
+          if (!hopByHop.has(name)) headers[name] = value;
+        }
+        res.writeHead(answer.statusCode ?? 502, headers);
+        let tail = "";
+        let told = false;
+        answer.on("data", (chunk) => {
+          if (input.watchForWorkflowRefusal === true && !told) {
+            const window = tail + chunk.toString("latin1");
+            if (isWorkflowRefusal(window)) {
+              told = true;
+              options.onWorkflowRefused?.();
+            }
+            tail = window.slice(-256);
+          }
+          res.write(chunk);
+        });
+        answer.once("end", () => {
+          res.end();
+          resolve();
+        });
+        answer.once("error", () => {
+          res.destroy();
+          resolve();
+        });
+      });
+      upstream.on("error", (err) => {
+        log(`could not reach GitHub for ${route.kind}: ${err.message}`);
+        if (res.headersSent) res.destroy();
+        else plain(res, 502, "the runner could not reach GitHub\n");
+        resolve();
+      });
+      res.once("close", () => upstream.destroy());
+      input.feed(upstream);
+    });
+  }
+  async function tokenOrRefuse(res, kind) {
+    try {
+      return await options.tokens.token(kind);
+    } catch (err) {
+      log(`could not get a ${kind} token: ${refusalCode(err)}`);
+      plain(res, 502, `the runner could not get a ${kind} token: ${refusalCode(err)}
+`);
+      return void 0;
+    }
+  }
+  async function push(req, res, route) {
+    const encoding = req.headers["content-encoding"];
+    const gzip = encoding === "gzip";
+    const { held, section } = await readPrefix(req, gzip);
+    const refuse = async (reason) => {
+      log(`push refused: ${reason}`);
+      await drain(req);
+      plain(res, 400, `the runner refused this push: ${reason}
+`);
+    };
+    if (encoding !== void 0 && encoding !== "gzip" && encoding !== "identity") {
+      return refuse("the push body is encoded in a way the runner does not read");
+    }
+    if (section.kind === "need-more") return refuse("the request ended before its commands did");
+    if (section.kind === "refused") return refuse(section.reason);
+    const { commands, capabilities } = section;
+    const refuseInBand = async (message) => {
+      log(`push refused: ${commands.map((c) => c.ref).join(", ")} \u2014 ${message}`);
+      await drain(req);
+      res.writeHead(200, { "content-type": "application/x-git-receive-pack-result", "cache-control": "no-cache" });
+      res.end(encodeRefusal(commands, capabilities, message));
+    };
+    let bodyPath;
+    try {
+      let fastForward;
+      if (needsFastForwardCheck(commands, options.branch)) {
+        const read = await tokenOrRefuse(res, "read");
+        if (read === void 0) return void await drain(req);
+        mkdirSync(options.spoolDir, { recursive: true, mode: 448 });
+        bodyPath = join(options.spoolDir, randomBytes(8).toString("hex"));
+        const file = createWriteStream(bodyPath);
+        const cap = options.maxPushBytes ?? 2 * 1024 ** 3;
+        let size = 0;
+        for (const chunk of held) {
+          size += chunk.length;
+          file.write(chunk);
+        }
+        const capped = new Transform({
+          transform(chunk, _encoding, done) {
+            size += chunk.length;
+            done(null, size > cap ? void 0 : chunk);
+          }
+        });
+        await pipeline(req, capped, file);
+        if (size > cap) return void await refuseInBand(`the push is larger than the ${cap} bytes the runner holds to check it`);
+        try {
+          fastForward = await isFastForward({
+            mirrorDir: options.mirrorDir,
+            remoteUrl: `${gitUrl}/${route.owner}/${route.name}.git`,
+            token: read,
+            branch: options.branch,
+            bodyPath,
+            gzip
+          });
+        } catch (err) {
+          log(`fast-forward check could not run: ${err instanceof Error ? err.message : String(err)}`);
+          return void await refuseInBand(`the runner could not check whether this push fast-forwards ${options.branch}`);
+        }
+      }
+      const verdict = judgePush({ commands, branch: options.branch, fastForward });
+      if (!verdict.allowed) return void await refuseInBand(verdict.message);
+      const token = await tokenOrRefuse(res, "push");
+      if (token === void 0) return void await drain(req);
+      options.tokens.markUsed("push");
+      const headers = upstreamHeaders(req.headers, basicAuthorization(token));
+      const spooled = bodyPath;
+      if (spooled !== void 0) headers["content-length"] = String(statSync(spooled).size);
+      else if (typeof req.headers["content-length"] === "string") headers["content-length"] = req.headers["content-length"];
+      await forward({
+        route,
+        method: "POST",
+        headers,
+        res,
+        watchForWorkflowRefusal: true,
+        feed: (upstream) => {
+          if (spooled !== void 0) {
+            createReadStream(spooled).pipe(upstream);
+            return;
+          }
+          for (const chunk of held) upstream.write(chunk);
+          req.pipe(upstream);
+        }
+      });
+    } finally {
+      if (bodyPath !== void 0) rmSync(bodyPath, { force: true });
+    }
+  }
+  async function handle(req, res) {
+    const route = classifyRequest(req.method ?? "", req.url ?? "");
+    if (route === void 0) {
+      req.resume();
+      return plain(res, 404, "not found\n");
+    }
+    const own = isOwnRepository(options.repository, route.owner, route.name);
+    if (own && route.kind === "receive-pack") return push(req, res, route);
+    let kind = route.kind === "info-refs" && route.service === "git-receive-pack" ? "push" : "read";
+    let body;
+    if (route.kind === "lfs-batch") {
+      body = await readBody(req, maxLfsBodyBytes);
+      if (body === void 0) return plain(res, 413, "the request is too large\n");
+      kind = isLfsUpload(body) ? "push" : "read";
+    }
+    let authorization;
+    if (own) {
+      const token = await tokenOrRefuse(res, kind);
+      if (token === void 0) return void await drain(req);
+      authorization = basicAuthorization(token);
+      if (kind === "read" || route.kind === "lfs-batch") options.tokens.markUsed(kind);
+    }
+    const headers = upstreamHeaders(req.headers, authorization);
+    if (body !== void 0) headers["content-length"] = String(body.length);
+    else if (typeof req.headers["content-length"] === "string") headers["content-length"] = req.headers["content-length"];
+    await forward({
+      route,
+      method: req.method ?? "GET",
+      headers,
+      res,
+      feed: (upstream) => {
+        if (body !== void 0) upstream.end(body);
+        else req.pipe(upstream);
+      }
+    });
+  }
+  return async (req, res) => {
+    try {
+      await handle(req, res);
+    } catch (err) {
+      log(`could not serve a request: ${err instanceof Error ? err.message : String(err)}`);
+      if (res.headersSent) res.destroy();
+      else plain(res, 502, "the runner could not serve this request\n");
+    }
+  };
+}
+function isLfsUpload(body) {
+  try {
+    return JSON.parse(body.toString("utf8"))?.operation === "upload";
+  } catch {
+    return false;
+  }
+}
+
+// src/runner/container/ranges.ts
+var V4 = [
+  ["unspecified", "0.0.0.0/8"],
+  ["loopback", "127.0.0.0/8"],
+  ["private", "10.0.0.0/8"],
+  ["private", "172.16.0.0/12"],
+  ["private", "192.168.0.0/16"],
+  ["link-local", "169.254.0.0/16"],
+  ["shared-address", "100.64.0.0/10"],
+  ["multicast", "224.0.0.0/4"],
+  ["reserved", "240.0.0.0/4"]
+];
+var V6 = [
+  ["unspecified", "::/128"],
+  ["loopback", "::1/128"],
+  ["ipv4-mapped", "::ffff:0:0/96"],
+  ["nat64", "64:ff9b::/96"],
+  ["ipv4-compatible", "::/96"],
+  ["link-local", "fe80::/10"],
+  ["unique-local", "fc00::/7"],
+  ["multicast", "ff00::/8"]
+];
+var UNPARSEABLE = { name: "unparseable", cidr: "-" };
+function parseV4(text) {
+  const parts = text.split(".");
+  if (parts.length !== 4) return void 0;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return void 0;
+    const octet = Number(part);
+    if (octet > 255) return void 0;
+    value = value * 256 + octet;
+  }
+  return value;
+}
+function parseV6(input) {
+  const zone = input.indexOf("%");
+  let text = zone === -1 ? input : input.slice(0, zone);
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    const v4 = parseV4(tail);
+    if (v4 === void 0) return void 0;
+    text = `${text.slice(0, lastColon + 1)}${(v4 >>> 16).toString(16)}:${(v4 & 65535).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return void 0;
+  const groups = (part) => {
+    if (part === "") return [];
+    const found = part.split(":");
+    return found.every((g) => /^[0-9a-fA-F]{1,4}$/.test(g)) ? found : void 0;
+  };
+  const head = groups(halves[0]);
+  const rest = groups(halves[1] ?? "");
+  if (head === void 0 || rest === void 0) return void 0;
+  let words;
+  if (halves.length === 2) {
+    const missing = 8 - head.length - rest.length;
+    if (missing < 1) return void 0;
+    words = [...head, ...Array(missing).fill("0"), ...rest];
+  } else {
+    if (head.length !== 8) return void 0;
+    words = head;
+  }
+  return words.reduce((acc, word) => acc << BigInt(16) | BigInt(parseInt(word, 16)), BigInt(0));
+}
+function build4() {
+  return V4.map(([name, cidr]) => {
+    const [address, length] = cidr.split("/");
+    return { name, cidr, base: parseV4(address), bits: Number(length) };
+  });
+}
+function build6() {
+  return V6.map(([name, cidr]) => {
+    const [address, length] = cidr.split("/");
+    return { name, cidr, base: parseV6(address), bits: Number(length) };
+  });
+}
+var RANGES_4 = build4();
+var RANGES_6 = build6();
+[...RANGES_4, ...RANGES_6].map(({ name, cidr }) => ({ name, cidr }));
+function classifyAddress(address) {
+  const v4 = parseV4(address);
+  if (v4 !== void 0) {
+    for (const range of RANGES_4) {
+      const shift = 32 - range.bits;
+      if (Math.floor(v4 / 2 ** shift) === Math.floor(range.base / 2 ** shift)) return { name: range.name, cidr: range.cidr };
+    }
+    return void 0;
+  }
+  const v6 = parseV6(address);
+  if (v6 === void 0) return UNPARSEABLE;
+  for (const range of RANGES_6) {
+    const shift = BigInt(128 - range.bits);
+    if (v6 >> shift === range.base >> shift) return { name: range.name, cidr: range.cidr };
+  }
+  return void 0;
+}
+
+// src/runner/container/tunnel.ts
+function isLiteralAddress(text) {
+  return isIP(text) !== 0;
+}
+var MAX_SOCKET_PATH_BYTES = 100;
+var MAX_KEPT_HOSTS = 1e3;
+var MAX_KEPT_REFUSALS = 200;
+var MAX_COUNTED_EXTRA_HOSTS = 1e5;
+var CONNECT_TIMEOUT_MS = 3e4;
+var NOT_ALLOWED_RANGE = "not-allowed";
+var NOT_RESOLVED = "not resolved";
+var IDLE_TIMEOUT_MS = 10 * 6e4;
+async function systemResolve(host) {
+  const found = await lookup(host, { all: true, verbatim: true });
+  return found.map((a) => ({ address: a.address }));
+}
+function systemHostAddresses() {
+  return Object.values(networkInterfaces()).flatMap((list) => (list ?? []).map((i) => i.address));
+}
+function normalize(address) {
+  const zone = address.indexOf("%");
+  return (zone === -1 ? address : address.slice(0, zone)).toLowerCase();
+}
+function parseTarget(target) {
+  const match = /^\[([^\]]+)\]:(\d+)$/.exec(target) ?? /^([^:\[\]]+):(\d+)$/.exec(target);
+  if (match === null) return void 0;
+  const port = Number(match[2]);
+  return port >= 1 && port <= 65535 ? { host: match[1], port } : void 0;
+}
+async function startTunnel(socketPath, opts = {}) {
+  if (Buffer.byteLength(socketPath) > MAX_SOCKET_PATH_BYTES) {
+    throw new Error(`${socketPath} is too long for a Unix socket; keep the runner's config file nearer the root of the filesystem`);
+  }
+  const resolve = opts.resolve ?? systemResolve;
+  const openConnection = opts.connect ?? ((t) => connect({ host: t.address, port: t.port }));
+  const ownAddresses = opts.hostAddresses ?? systemHostAddresses;
+  const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
+  const idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
+  const hosts = [];
+  const seen = /* @__PURE__ */ new Set();
+  const extraHosts = /* @__PURE__ */ new Set();
+  let hostsMore = 0;
+  const refusals = [];
+  const refusalKeys = /* @__PURE__ */ new Set();
+  const extraRefusalKeys = /* @__PURE__ */ new Set();
+  let refusalsMore = 0;
+  const destinations = [];
+  if (opts.recordPath !== void 0 && existsSync(opts.recordPath)) {
+    try {
+      const saved = JSON.parse(readFileSync(opts.recordPath, "utf8"));
+      for (const host of saved.hosts ?? []) {
+        hosts.push(host);
+        seen.add(host);
+      }
+      hostsMore = saved.hostsMore ?? 0;
+      for (const name of saved.destinations ?? []) destinations.push(name);
+      refusalsMore = saved.refusalsMore ?? 0;
+      for (const refusal of saved.refusals ?? []) {
+        refusals.push(refusal);
+        refusalKeys.add(`${refusal.host}|${refusal.address}|${refusal.range}`);
+      }
+    } catch {
+    }
+  }
+  const record = () => ({
+    hosts: [...hosts],
+    hostsMore,
+    refusalsMore,
+    refusals: refusals.map((r) => ({ ...r })),
+    destinations: [...destinations]
+  });
+  const persist = () => {
+    if (opts.recordPath === void 0) return;
+    try {
+      writeFileSync(opts.recordPath, JSON.stringify(record()), { mode: RUNNER_FILE_MODE });
+    } catch {
+    }
+  };
+  const destinationUsed = (name) => {
+    if (destinations.includes(name)) return;
+    destinations.push(name);
+    persist();
+  };
+  const reached = (host) => {
+    const name = host.toLowerCase();
+    if (seen.has(name)) return;
+    if (hosts.length >= MAX_KEPT_HOSTS) {
+      if (extraHosts.has(name)) return;
+      if (extraHosts.size < MAX_COUNTED_EXTRA_HOSTS) extraHosts.add(name);
+      hostsMore++;
+    } else {
+      hosts.push(name);
+      seen.add(name);
+    }
+    persist();
+  };
+  const refused2 = (host, address, range) => {
+    const key = `${host}|${address}|${range}`;
+    if (refusalKeys.has(key)) return;
+    if (refusals.length >= MAX_KEPT_REFUSALS) {
+      if (extraRefusalKeys.has(key)) return;
+      if (extraRefusalKeys.size < MAX_COUNTED_EXTRA_HOSTS) extraRefusalKeys.add(key);
+      refusalsMore++;
+    } else {
+      refusalKeys.add(key);
+      refusals.push({ host, address, range });
+    }
+    persist();
+  };
+  async function decide(host) {
+    if (opts.allowHosts !== void 0 && !hostAllowed(host, opts.allowHosts)) {
+      refused2(host, NOT_RESOLVED, NOT_ALLOWED_RANGE);
+      return { ok: false, status: 403, body: `refused: ${host} is not in runner.build.allowHosts
+` };
+    }
+    let addresses;
+    try {
+      addresses = await resolve(host);
+    } catch {
+      return { ok: false, status: 502, body: `could not resolve ${host}
+` };
+    }
+    if (addresses.length === 0) return { ok: false, status: 502, body: `${host} has no address
+` };
+    const own = new Set(ownAddresses().map(normalize));
+    let firstRefusal;
+    for (const { address: address2 } of addresses) {
+      const range = own.has(normalize(address2)) ? { name: "host-address", cidr: address2 } : classifyAddress(address2);
+      if (range === void 0) return { ok: true, address: address2 };
+      firstRefusal ??= { address: address2, name: range.name, cidr: range.cidr };
+    }
+    const { address, name, cidr } = firstRefusal;
+    refused2(host, address, name);
+    return { ok: false, status: 403, body: `refused: ${host} is ${address}, in the ${name} range ${cidr}
+` };
+  }
+  const sockets = /* @__PURE__ */ new Set();
+  const server = createServer((req, res) => {
+    void proxyPlain(req, res);
+  });
+  server.on("connection", (socket) => {
+    sockets.add(socket);
+    socket.on("close", () => sockets.delete(socket));
+  });
+  server.on("connect", (req, client, head) => {
+    void tunnelConnect(req, client, head);
+  });
+  const statusLine = (status) => `HTTP/1.1 ${status} ${status === 403 ? "Forbidden" : "Bad Gateway"}`;
+  const reply = (client, status, body) => {
+    client.end(`${statusLine(status)}\r
+Content-Type: text/plain\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: close\r
+\r
+${body}`);
+  };
+  async function tunnelConnect(req, client, head) {
+    client.on("error", () => client.destroy());
+    const target = parseTarget(req.url ?? "");
+    if (target === void 0) {
+      client.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+      return;
+    }
+    const decision = await decide(target.host);
+    if (!decision.ok) {
+      reply(client, decision.status, decision.body);
+      return;
+    }
+    const upstream = openConnection({ address: decision.address, port: target.port });
+    upstream.setTimeout(connectTimeoutMs);
+    const failed = () => {
+      upstream.destroy();
+      reply(client, 502, `could not connect to ${target.host}
+`);
+    };
+    upstream.once("error", failed);
+    upstream.once("timeout", failed);
+    client.on("close", () => upstream.destroy());
+    const established = () => {
+      upstream.removeListener("error", failed);
+      upstream.removeListener("timeout", failed);
+      upstream.setTimeout(idleTimeoutMs, () => upstream.destroy());
+      upstream.on("error", () => void 0);
+      upstream.on("close", () => client.destroy());
+      reached(target.host);
+      client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+      upstream.write(head);
+      upstream.pipe(client);
+      client.pipe(upstream);
+    };
+    if (upstream.readyState === "open") established();
+    else upstream.once("connect", established);
+  }
+  async function proxyPlain(req, res) {
+    if (opts.gitRemote !== void 0 && (req.url ?? "").startsWith("/")) {
+      await opts.gitRemote(req, res);
+      return;
+    }
+    let url;
+    try {
+      url = new URL(req.url ?? "");
+    } catch {
+      res.writeHead(400, { "Content-Type": "text/plain", Connection: "close" });
+      res.end("this is a proxy: send an absolute http:// URL or CONNECT\n");
+      return;
+    }
+    if (url.protocol !== "http:") {
+      res.writeHead(400, { "Content-Type": "text/plain", Connection: "close" });
+      res.end("only http:// URLs are proxied; use CONNECT for https\n");
+      return;
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    const port = url.port === "" ? 80 : Number(url.port);
+    const decision = await decide(host);
+    if (!decision.ok) {
+      res.writeHead(decision.status, { "Content-Type": "text/plain", Connection: "close" });
+      res.end(decision.body);
+      return;
+    }
+    const headers = { ...req.headers, host: url.host, connection: "close" };
+    delete headers["proxy-connection"];
+    delete headers["proxy-authorization"];
+    const upstream = request(
+      {
+        method: req.method,
+        path: `${url.pathname}${url.search}`,
+        headers,
+        // With no agent named, `createConnection` is what opens the socket, so the address the tunnel chose is the one connected to.
+        createConnection: () => openConnection({ address: decision.address, port })
+      },
+      (answer) => {
+        reached(host);
+        res.writeHead(answer.statusCode ?? 502, answer.headers);
+        answer.pipe(res);
+      }
+    );
+    upstream.setTimeout(connectTimeoutMs, () => upstream.destroy());
+    res.on("close", () => upstream.destroy());
+    upstream.on("error", () => {
+      if (!res.headersSent) {
+        res.writeHead(502, { "Content-Type": "text/plain", Connection: "close" });
+        res.end(`could not reach ${host}
+`);
+      } else {
+        res.destroy();
+      }
+    });
+    req.pipe(upstream);
+  }
+  if (existsSync(socketPath)) unlinkSync(socketPath);
+  await new Promise((resolveListen, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => resolveListen());
+  });
+  chmodSync(socketPath, 438);
+  const tcpServers = [];
+  return {
+    socketPath,
+    record,
+    destinationUsed,
+    async listenTcp(address) {
+      const tcp = createServer$1((socket) => server.emit("connection", socket));
+      await new Promise((resolveListen, reject) => {
+        tcp.once("error", reject);
+        tcp.listen(address.port, address.host, () => resolveListen());
+      });
+      tcpServers.push(tcp);
+      return { port: tcp.address().port };
+    },
+    close: () => new Promise((resolveClose) => {
+      for (const socket of sockets) socket.destroy();
+      for (const tcp of tcpServers) tcp.close();
+      server.close(() => resolveClose());
+    })
+  };
+}
+
+// src/runner/container/hooks.ts
+var MIN_ENGINE_MAJOR = 26;
+var RELAY_ATTEMPTS = 20;
+var RELAY_WAIT_MS = 500;
+var BUSY_IMAGE_WAIT_MS = 5e3;
+var VOLUME_REMOVE_ATTEMPTS = 4;
+var WORKFLOW_PERMISSION_REASON = "workflow_permission_required";
+function createContainerRuntime(opts = {}) {
+  const { cli, remoteFor } = opts;
+  return {
+    host: opts.host ?? createContainerHost(),
+    tunnels: opts.tunnels ?? /* @__PURE__ */ new Map(),
+    buildImage: opts.buildImage ?? ((build) => buildRepositoryImage(
+      {
+        repository: build.repository,
+        remote: remoteFor?.(build.repository),
+        configPath: build.configPath,
+        cli: cli ?? currentCliBuild(),
+        readToken: build.readToken,
+        guestHelper: build.guestHelper
+      },
+      { host: opts.imageHost ?? createDockerHost() }
+    )),
+    startTunnel: opts.startTunnel ?? startTunnel,
+    tunnelOptions: opts.tunnelOptions,
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+    hostEnv: opts.hostEnv ?? process.env,
+    credentials: opts.credentials ?? /* @__PURE__ */ new Map(),
+    github: { gitUrl: opts.github?.gitUrl ?? "https://github.com", apiUrl: opts.github?.apiUrl ?? "https://api.github.com" },
+    remoteFor,
+    readHead: opts.readHead ?? readDefaultBranchHead,
+    clone: opts.clone ?? ((input) => cloneRepository(input.remote, input.dest)),
+    destinationOptions: opts.destinationOptions,
+    claudeUpstream: opts.claudeUpstream,
+    vm: createMicroVmPorts(opts.vm),
+    cliBuild: () => cli ?? currentCliBuild()
+  };
+}
+function keepGhConfigCurrent(tokens, buildDir2, onError) {
+  tokens.onRead((token) => {
+    try {
+      writeGhConfig(ghConfigDir(buildDir2), token);
+    } catch (err) {
+      onError(err);
+    }
+  });
+}
+function gitRemoteFor(runtime, input) {
+  const [owner = "", name = ""] = input.repository.split("/");
+  const runnerDirPath = runnerDirOfBuild(input.buildDir);
+  return createGitRemote({
+    repository: input.repository,
+    branch: input.branch,
+    tokens: input.tokens,
+    gitUrl: runtime.github.gitUrl,
+    mirrorDir: mirrorDir(runnerDirPath, owner, name),
+    spoolDir: spoolDir(runnerDirPath),
+    onWorkflowRefused: () => {
+      input.tokens.reason = WORKFLOW_PERMISSION_REASON;
+    },
+    log: input.log
+  });
+}
+function firstLine4(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+var NO_ENV = { literals: {}, passed: {} };
+var RELAY_PROBE = `const s=require("net").connect(${RELAY_PORT},"127.0.0.1");s.on("connect",()=>process.exit(0));s.on("error",()=>process.exit(1));setTimeout(()=>process.exit(1),2000)`;
+async function waitForRelay(runtime, state) {
+  for (let attempt = 0; attempt < RELAY_ATTEMPTS; attempt++) {
+    const probe = await runtime.host.exec({
+      container: state.container,
+      user: ADDED_USER,
+      env: NO_ENV,
+      argv: ["/opt/outerlayer/bin/node", "-e", RELAY_PROBE]
+    });
+    if (probe.status === 0) return true;
+    await runtime.sleep(RELAY_WAIT_MS);
+  }
+  return false;
+}
+async function obtainImage(input) {
+  const { config, runtime, tokens, repository, tag, log } = input;
+  for (; ; ) {
+    if (input.aborted()) return { ok: false, reason: "ended before provision finished", aborted: true };
+    let readToken;
+    try {
+      readToken = await tokens.token("read");
+    } catch (err) {
+      return {
+        ok: false,
+        reason: err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's read token could not be had: ${describeCallFailure(err)}`
+      };
+    }
+    try {
+      return { ok: true, built: await runtime.buildImage({ repository, configPath: config.configPath, readToken, guestHelper: input.guestHelper }) };
+    } catch (err) {
+      if (err instanceof RecipeError && err.code === "build_in_progress" && (input.now?.() ?? /* @__PURE__ */ new Date()).getTime() < input.deadlineMs) {
+        log.line(`${tag} waiting for another build of ${repository}'s image`);
+        await runtime.sleep(BUSY_IMAGE_WAIT_MS);
+        continue;
+      }
+      if (err instanceof RecipeError) {
+        log.error(`${tag} image build for ${repository} failed: ${err.code}: ${err.message}`);
+        return { ok: false, reason: err.code };
+      }
+      return { ok: false, reason: `the image build failed: ${describeCallFailure(err)}` };
+    }
+  }
+}
+async function provisionContainer(input) {
+  const { config, runtime, item, itemKey, jobDir, log, tokens } = input;
+  const { host } = runtime;
+  const tag = `#${item.number}`;
+  const logPath = join(jobDir, "provision.log");
+  const fail = (reason) => ({ ok: false, reason });
+  if (claudeCredential(runtime.hostEnv) === void 0) return fail(AGENT_CREDENTIAL_MISSING);
+  const repository = item.specRepository;
+  if (repository === void 0 || repository === null || repository === "") {
+    return fail("the work item names no repository to clone");
+  }
+  const engine = await host.version();
+  if (engine === null) return fail("Docker is not available: `docker version` failed");
+  if (!(Number.parseInt(engine, 10) >= MIN_ENGINE_MAJOR)) {
+    return fail(`Docker Engine ${engine} is too old: container builds need Engine ${MIN_ENGINE_MAJOR} or later`);
+  }
+  if (/docker desktop/i.test(await host.operatingSystem() ?? "")) {
+    return fail("Docker Desktop cannot pass the tunnel's socket into a container, so container builds need Docker Engine: install it (on Windows, inside WSL2) or use builtin:process");
+  }
+  const obtained = await obtainImage({ config, runtime, tokens, repository, tag, log, aborted: input.aborted, deadlineMs: input.deadlineMs, now: input.now });
+  if (!obtained.ok) return obtained.aborted === true ? { ok: false, reason: obtained.reason, aborted: true } : fail(obtained.reason);
+  const built = obtained.built;
+  const { report } = built;
+  const buildId = randomBytes(6).toString("hex");
+  const name = `outerlayer-build-${buildId}`;
+  const buildDir2 = buildDir(config.configPath, buildId);
+  const state = {
+    buildId,
+    container: name,
+    volume: name,
+    buildDir: buildDir2,
+    repository,
+    imageId: report.imageId,
+    containerEnv: report.apply.containerEnv,
+    builtIns: true
+  };
+  const env = buildEnvironment({
+    config,
+    item: item.number,
+    itemKey,
+    repository,
+    hostEnv: runtime.hostEnv,
+    containerEnv: report.apply.containerEnv,
+    builtIns: true
+  });
+  if (env.skippedTokenVariables.length > 0) {
+    log.line(`${tag} not passing ${env.skippedTokenVariables.join(", ")} from runner.build.variables into the build: its repository token comes from the runner`);
+  }
+  const environment = {
+    isolation: "container",
+    recipe: { sourceCommit: report.sourceCommit, key: report.recipeKey, path: report.recipe },
+    imageId: report.imageId,
+    ignoredProperties: report.ignored.map(({ property, source }) => ({ property, source })),
+    variables: env.variables,
+    cliVersion: input.cliVersion
+  };
+  input.save(state, environment);
+  const bail = async (reason, aborted2 = false) => {
+    try {
+      await cleanupContainer(runtime, state);
+    } catch (err) {
+      log.error(`${tag} cleanup failed: ${describeCallFailure(err)}`);
+    }
+    return aborted2 ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(reason);
+  };
+  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`);
+  if (input.aborted()) return bail("", true);
+  mkdirSync(buildDir2, { recursive: true });
+  chmodSync(buildDir2, 493);
+  const ghDir = ghConfigDir(buildDir2);
+  try {
+    writeGhConfig(ghDir, await tokens.token("read"));
+  } catch (err) {
+    return bail(
+      err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's gh configuration could not be written: ${describeCallFailure(err)}`
+    );
+  }
+  keepGhConfigCurrent(tokens, buildDir2, (err) => log.error(`${tag} the read token could not be written for gh: ${describeCallFailure(err)}`));
+  tokens.markUsed("read");
+  environment.credentials = tokens.used();
+  try {
+    const gitRemote = gitRemoteFor(runtime, { repository, branch: input.branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
+    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote));
+  } catch (err) {
+    return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
+  }
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
+  const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId });
+  if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
+  if (input.aborted()) return bail("", true);
+  const runInput = {
+    buildId,
+    container: name,
+    volume: name,
+    buildDir: buildDir2,
+    image: report.imageId,
+    user: ADDED_USER,
+    limits: limits2,
+    destinations: config.build?.destinations?.length ?? 0};
+  const prepared = await host.run(prepareRunArgs(runInput), { logPath });
+  if (prepared.status !== 0) return dockerFailed("preparing the build's volume", prepared);
+  const started = await host.run(containerRunArgs(runInput), { logPath });
+  if (started.status !== 0) return dockerFailed("starting the build's container", started);
+  if (input.aborted()) return bail("", true);
+  if (!await waitForRelay(runtime, state)) return bail("the relay in the build's container did not start");
+  const imageUser = await host.imageUser(report.imageId);
+  let agentUser;
+  try {
+    agentUser = await resolveAgentUser({
+      remoteUser: report.apply.remoteUser,
+      imageUser,
+      probe: async (user) => {
+        const probe = await host.exec({ container: name, user: ADDED_USER, env: NO_ENV, argv: ["id", "-u", user] });
+        const uid = Number(probe.stdout);
+        return probe.status === 0 && Number.isInteger(uid) ? uid : null;
+      }
+    });
+  } catch (err) {
+    if (err instanceof AgentUserError) return bail(err.message);
+    throw err;
+  }
+  state.agentUser = agentUser;
+  const tools = await host.exec({ container: name, user: ADDED_USER, env: NO_ENV, argv: ["cat", "/opt/outerlayer/tools.json"] });
+  environment.agentVersion = agentVersionOf(tools.status === 0 ? tools.stdout : "");
+  input.save(state, environment);
+  const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env, argv }, opts?.quiet === true ? void 0 : { logPath });
+  const steps = await runBuildSteps({
+    repository,
+    branch: input.branch,
+    lifecycle: report.apply.lifecycle,
+    exec,
+    log,
+    tag,
+    aborted: input.aborted,
+    // The control plane is read on the host, with the host's git login. The container reads the staged files from its mount of the build's directory.
+    stageContext: () => stageGovernedContext({
+      config,
+      repository,
+      buildId,
+      buildDir: buildDir2,
+      fetchImpl: input.fetchImpl,
+      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`
+    }),
+    removeStagedContext: () => removeStagedContext(buildDir2)
+  });
+  if (!steps.ok) return bail(steps.reason, steps.aborted === true);
+  return { ok: true, workdir: CHECKOUT_DIR, state, environment };
+}
+function agentVersionOf(toolsJson) {
+  try {
+    const version = JSON.parse(toolsJson).claudeCodeVersion;
+    if (typeof version === "string" && version !== "") return version;
+  } catch {
+  }
+  return CLAUDE_CODE_VERSION;
+}
+function shellQuote(word) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+function containerCommandLine(input) {
+  const state = input.job.container;
+  const env = buildEnvironment({
+    config: input.config,
+    item: input.job.item,
+    itemKey: input.job.itemKey,
+    branch: input.job.branch,
+    repository: state.repository,
+    hostEnv: input.runtime.hostEnv,
+    containerEnv: state.containerEnv ?? {},
+    builtIns: state.builtIns === true,
+    identity: input.job.commitIdentity
+  });
+  const args = containerExecArgs({
+    container: state.container,
+    user: state.agentUser ?? ADDED_USER,
+    workdir: CHECKOUT_DIR,
+    env,
+    argv: ["/bin/sh", "-c", input.cmdline]
+  });
+  return {
+    line: ["docker", "exec", ...args].map(shellQuote).join(" "),
+    env: { ...childEnvironment(input.runtime.hostEnv), ...env.passed }
+  };
+}
+async function stopContainer(runtime, state) {
+  await runtime.host.stop(state.container);
+  state.stopped = true;
+}
+async function measureDisk(runtime, state) {
+  const result = await runtime.host.exec({
+    container: state.container,
+    user: state.agentUser ?? ADDED_USER,
+    env: NO_ENV,
+    argv: ["du", "-skx", "/build"]
+  });
+  return result.status === 0 ? parseDuKilobytes(result.stdout) : void 0;
+}
+async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote) {
+  return startBuildServices({
+    startTunnel: runtime.startTunnel,
+    tunnelOptions: { ...runtime.tunnelOptions, ...gitRemote === void 0 ? {} : { gitRemote } },
+    buildDir: buildDir2,
+    jobDir,
+    destinations: config.build?.destinations ?? [],
+    allowHosts: config.build?.allowHosts,
+    serve: "socket",
+    ...builtIns ? { builtIns: { gatewayUrl: config.url, itemKey, claudeUpstream: runtime.claudeUpstream } } : {},
+    hostEnv: runtime.hostEnv,
+    destinationOptions: runtime.destinationOptions
+  });
+}
+async function ensureTunnel(runtime, state, jobDir, config, itemKey, branch) {
+  if (runtime.tunnels.has(state.buildId)) return;
+  const tokens = runtime.credentials.get(jobDir);
+  const gitRemote = tokens === void 0 || state.repository === void 0 || branch === void 0 ? void 0 : gitRemoteFor(runtime, { repository: state.repository, branch, tokens, buildDir: state.buildDir });
+  runtime.tunnels.set(state.buildId, await startServicesFor(runtime, config, state.buildDir, jobDir, itemKey, state.builtIns === true, gitRemote));
+}
+async function syncInContainer(input) {
+  const { runtime, job } = input;
+  const state = job.container;
+  try {
+    await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch);
+    if (state.stopped) {
+      await runtime.host.start(state.container);
+      state.stopped = false;
+      if (!await waitForRelay(runtime, state)) return { ok: false, reason: "the relay did not start again" };
+    }
+    const env = buildEnvironment({
+      config: input.config,
+      item: job.item,
+      itemKey: job.itemKey,
+      branch: job.branch,
+      repository: state.repository,
+      hostEnv: runtime.hostEnv,
+      containerEnv: state.containerEnv ?? {},
+      builtIns: state.builtIns === true,
+      identity: job.commitIdentity
+    });
+    const result = await runtime.host.exec(
+      { container: state.container, user: state.agentUser ?? ADDED_USER, workdir: job.workdir ?? CHECKOUT_DIR, env, argv: ["outerlayer", "sync"] },
+      { logPath: join(input.jobDir, "sync.log") }
+    );
+    return result.status === 0 ? { ok: true } : { ok: false, reason: `exit ${result.status}` };
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+}
+var HOOK_ERRORS_IN_CONTAINER = "/build/home/.outerlayer/spool/hook-errors.log";
+async function copyHookErrors(runtime, state, jobDir) {
+  try {
+    if (state.stopped) {
+      const started = await runtime.host.start(state.container);
+      if (started.status !== 0) return;
+    }
+    const log = await runtime.host.exec({ container: state.container, user: state.agentUser ?? ADDED_USER, env: NO_ENV, argv: ["cat", HOOK_ERRORS_IN_CONTAINER] });
+    if (log.status === 0 && log.stdout !== "") writeFileSync(join(jobDir, "hook-errors.log"), log.stdout);
+  } catch {
+  }
+}
+async function cleanupContainer(runtime, state, jobDir) {
+  const failures = [];
+  if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
+  const removedContainer = await runtime.host.remove(state.container);
+  if (removedContainer.status !== 0 && !/no such container/i.test(removedContainer.stderr)) {
+    failures.push(`container ${state.container} was not removed: ${removedContainer.stderr.trim()}`);
+  }
+  let volumeGone = false;
+  for (let attempt = 0; attempt < VOLUME_REMOVE_ATTEMPTS && !volumeGone; attempt++) {
+    const removed = await runtime.host.removeVolume(state.volume);
+    volumeGone = removed.status === 0 || /no such volume/i.test(removed.stderr);
+    if (!volumeGone) await runtime.sleep(500);
+  }
+  if (!volumeGone) failures.push(`volume ${state.volume} is still in use`);
+  const tunnel = runtime.tunnels.get(state.buildId);
+  if (tunnel !== void 0) {
+    runtime.tunnels.delete(state.buildId);
+    await tunnel.close();
+  }
+  rmSync(state.buildDir, { recursive: true, force: true });
+  if (failures.length > 0) throw new Error(failures.join("; "));
+}
+
+export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, shellQuote, shortClaim, stageGovernedContext, startServicesFor, stopContainer, syncInContainer };