@outerlayer/cli 0.20.0 → 0.22.0

package/skill-pack/template/build/SKILL.md

@@ -1,260 +1,11 @@
 ---
 name: build
-description: >
-  Build one approved issue end to end: implement it, review it with a sized panel
-  of agents, run the repository's own checks, open the pull request, and attach
-  the review and criteria reports as evidence. Use when a work item exists for an
-  issue and you want it built. Invoke with OUTERLAYER_WORK=<number> claude "/build".
+description: Build one approved issue end to end. Invoke with OUTERLAYER_WORK=<n> claude "/build".
 disable-model-invocation: true
 ---
 
-Run the CLI as `outerlayer`. If that command is not on PATH, run `npx -y @outerlayer/cli` with the same arguments. Every `outerlayer ...` command below follows this rule.
+Read ../outerlayer-build/SKILL.md, relative to this skill's folder, and follow it from start to finish. Apply the changes below for this repository.
 
-Build one issue into an evidenced pull request. `/spec` writes and gets
-approval for the issue. This skill builds it. It never writes the spec.
+## Changes for this repository
 
-This file holds the phase order and the rules that bind every phase. Each
-phase reads its own reference on entry, never before:
-
-- [references/review-loop.md](references/review-loop.md): the review phase.
-- [references/review-briefs.md](references/review-briefs.md): the reviewer, refuter and mutation briefs.
-- [references/agent-briefs.md](references/agent-briefs.md): the briefs for every other agent.
-- [references/release.md](references/release.md): sync, pull request, CI.
-- [references/criteria-judge.md](references/criteria-judge.md): the brief that judges each criterion.
-- [references/evidence.md](references/evidence.md): manual test and evidence.
-
-Paste a brief verbatim into the agent that runs it. Add only the run's own
-values, such as paths, the branch and the item number.
-
-Every text a person will read follows the writing rule in the repository's
-instructions file, if it has one. Otherwise write for a reader who was not in
-the session: short sentences, the outcome first, and plain words. Paste that
-rule into every agent that writes prose.
-
-## Arguments
-
-`/build` takes no issue number. It builds the work item named by
-`OUTERLAYER_WORK`, the item's number. The launch is:
-
-    OUTERLAYER_WORK=<number> claude "/build"
-
-The item exists because someone ran `outerlayer work build --issue <reference>`.
-Given a request instead of a work item, stop and say:
-
-    Spec it first:  /spec <the request as given>
-
-Optional flag: `--unattended` means no person is present and nothing wakes
-the session after a turn ends. Spawn every agent in the foreground and wait
-for it in the same turn. Run the gate in the foreground with the maximum
-timeout. End the turn only at the final report.
-
-## State rules
-
-These bind the orchestrator in every phase. Rule 5 also binds every spawned agent.
-
-1. **Never end a turn waiting on nothing.** End a turn while work is in
-   flight only when something live will wake the session: a spawned agent or
-   a background command. Before saying "waiting on X", confirm X is live.
-   Work that is not live did not happen: redo it once.
-2. **One redo per piece of work.** A second failure of the same work means
-   the orchestrator takes it over. It reads what the agent left, finishes the
-   brief itself in the foreground, and names the takeover in its status line.
-   If the gate still cannot go green, escalate.
-3. **The gate runs in the foreground, one heavy command at a time.** The gate
-   is the repository's own pre-push checks and tests, as its instructions
-   file names them. Never run it in the background. Never start a suite while
-   an agent runs one. Never bypass a hook: no `--no-verify`, no skipped hook,
-   even when a hook fails. Fix what the hook reports.
-4. **Checkpoint and re-orient.** Before phase 1, write a state file at
-   `"$(git rev-parse --absolute-git-dir)/build-state.json"`, replacing any
-   earlier one. Record the phase, the review round, the spawned agents, the
-   agent count, the issue reference, the pull request number, the branch, and
-   from phase 4 the tier verdict. Overwrite it at every phase change. On
-   entering a phase, after any wake, and after any compaction, read the state
-   file, `git status`, the branch, the live agent list, and the issue or pull
-   request when the phase uses them. Live sources win over the file. Treat the
-   file as absent when its branch does not match the current branch.
-   When you overwrite the file, keep its `criteria` entry: phase 2 writes it
-   and the judge reads it.
-   Beside it, create `"$(git rev-parse --absolute-git-dir)/build-reports/"`,
-   emptied of any earlier run's files. Every spawned agent writes its full
-   report there and returns a summary of at most ten lines. Give each agent
-   the absolute path. Reports never land in the working tree, so review never
-   reads them as product code. Read summaries and pass file paths, never
-   report bodies. Delete both at the end of phase 6.
-   Once a pull request exists, read `outerlayer work threads --item
-   "$OUTERLAYER_WORK" --json`. Each thread with `waitingOn` of `agent` holds a
-   person's comment. Answer each before the run ends, as the `outerlayer-amend` skill does.
-5. **A session never records a pass or fail on an artifact.** It emits
-   artifacts. A person decides pass or fail. A build records one result, the
-   verdict of its own review, on the `code-review` check. The
-   `acceptance-criteria` check is judged and recorded by the factory host. When
-   the item holds no criteria, no judge runs and the host records a fail
-   saying so.
-6. **Observed status only.** Every status claim in the final report (a gate
-   result, a CI conclusion, mergeability) quotes command output observed
-   after the last change it describes. No quoted output means unknown, never
-   green. Quoted output goes in the report to the user. Pull request bodies
-   carry curated links, never raw output.
-7. **Files no issue.** The build files no issue anywhere, and no agent does.
-   A defect outside the change, or a follow-up the fix pass deferred, becomes a
-   candidate issue in a report: a title, a body and a target repository. The
-   final report lists every candidate for the user to file with `/spec`.
-8. **Reader pass.** No text reaches the git host as the session wrote it.
-   The pull request title and body, and every comment, go through one cold
-   rewrite agent. Its only inputs are the draft and the writing rule. It
-   returns the rewrite and the terms it cut or explained. Check that every
-   path, identifier, number, criterion id and link survived, and restore any
-   that did not.
-9. **Run budget.** Spawn at most sixty agents in a run. Keep the count in the
-   state file. Past three quarters, say where the count stands in the status
-   line. A run that would exceed the budget stops and lists what is left
-   unverified. The review phase also holds a limit on agents in flight.
-10. **Factory problems are findings.** Every agent records the problems it
-   hit outside the change with the `outerlayer-findings` skill, as its brief
-   says. The orchestrator records only the ones it hit itself. The final
-   report lists every finding by id.
-
-## Phases
-
-Run them in order.
-
-1. **Intake.** Read `OUTERLAYER_WORK`. If it is missing or does not parse,
-   stop and hand back:
-
-       outerlayer work build --issue <reference>   # once; prints the item number
-       OUTERLAYER_WORK=<number> claude "/build"
-
-   Run `outerlayer work status --item "$OUTERLAYER_WORK" --json` and read the
-   item's tracker key. It is a GitHub `#n`, or a Linear or Jira key. Read the
-   issue from the same JSON: `title`, and `issue`, which holds the issue as
-   OuterLayer last copied it from the tracker. `issue.body` is the
-   description in Markdown, and `url`, `state` and `labels` come with it. This
-   copy works for every tracker. A build often holds no Linear or Jira
-   credential, so do not depend on a tracker tool. Use one only to add what
-   the copy lacks, such as the issue's comments. When `issue.syncStatus` is
-   `unreadable`, the copy is from an earlier read: say so in the intake
-   summary. When it is `not_found`, or `issue.syncedAt` is null and no tracker
-   tool can read the issue, stop: there is no issue to build from.
-   Write the issue's title, URL and body to
-   `"$(git rev-parse --absolute-git-dir)/build-reports/issue.md"`. The issue
-   is the source of truth for the whole run. Every later agent is given that
-   file's path, so no agent needs a tracker tool to read it.
-   Restate the task in one or two sentences and confirm the issue is still
-   open (`issue.state`) and unclaimed. If the item shows a live claim by
-   another runner that has not expired, stop and name it.
-   Phase 2 finds the issue's criteria. If it finds some, they are the
-   definition of done, and each declares a proof form or a test. If it finds
-   none, the build drafts them from the issue's description, and the drafted
-   criteria are the definition of done in the same way. An issue is never
-   sent back for lacking criteria.
-   Ask nothing from here until the final report. An agent that needs a ruling
-   states its assumption in its report and continues. The final report lists
-   every assumption.
-2. **Read the criteria.** Record the issue's criteria on the item, so the
-   Criteria tab, the item's status and the judge hold the pull request to one
-   list. Read the whole issue and find its acceptance criteria in whatever
-   form they are written: under a heading of any wording, as a checklist or
-   numbered items, as "done when" prose, with ids or without. There is no
-   fixed shape. Keep each criterion's text exactly as the author wrote it.
-   Never reword one. A criterion you think is wrong becomes a note in the
-   final report, never an edit.
-
-   Write them, in the order the issue lists them, to a file:
-
-       { "criteria": [ { "id": "<the id, if the issue gives one>", "text": "<verbatim>", "proof": null } ] }
-
-   Give `proof` an artifact kind (`video`, `screenshot`, `report`, `log`,
-   `test` or `file`) only when the issue states that proof explicitly, as in
-   `(proof: screenshot)`. Never infer a proof kind from the words. Then run:
-
-       node .outerlayer/skills/build/scripts/record-criteria.mjs --item "$OUTERLAYER_WORK" --criteria-file <file>
-
-   The script keeps the issue's ids only when every criterion carries one
-   that fits the id grammar. Otherwise, a partly numbered list included, it
-   numbers every criterion `AC-<item number>-NN` in order, and the state file
-   says why. The final report says the criteria were numbered and from what.
-   A file the script cannot use exits 2 with the reason. Fix the file and
-   run it again.
-
-   When the issue has no criteria anywhere, draft them from the issue's
-   description. Each is one observable behavior the description asks for, in
-   its words, adding no scope it does not state. Write them to the same kind
-   of file without ids, set `proof` only when the description asks for that
-   proof, and run the script with `--drafted` added. It numbers the draft
-   `AC-<item number>-NN` and records it with `drafted: true`, so the Criteria
-   tab says the build drafted the list.
-
-   The script writes the list to
-   `"$(git rev-parse --absolute-git-dir)/build-reports/criteria.json"` and runs
-   `outerlayer emit criteria` on it. The gateway decides whether a list may be
-   recorded. A 409 means the item already has a recorded list. That list
-   stands, and nothing is recorded. No command returns the item's list, so the
-   build cannot read it: it holds the work to its own reading of the criteria
-   and says so in the final report. Any other refusal is written to the state
-   file with its message, and the build continues. The script writes the
-   outcome under `criteria` in the state file: `source` (`issue`, `drafted`,
-   `item`, or `none` when even a draft holds no criterion), `recorded`,
-   `count`, `list` and `numbered`. On a 409, `list` is empty, and the build's
-   reading of the criteria goes under `issueReading`.
-
-   Drafted criteria are tiered, proven and judged like any others. A drafted
-   list stands like any recorded list. A later build's record
-   answers 409 until a person replaces the list with
-   `outerlayer emit criteria`, even after criteria are added to the issue. The
-   final report says the criteria were drafted and how to replace them.
-
-   Change nothing in the issue. The intake summary names how many criteria
-   were recorded, whether they kept the issue's ids or were numbered, and
-   whether they were drafted.
-3. **Implement.** When `OUTERLAYER_BRANCH` is set, as it is in a host's
-   build, work on that branch, checking it out if it is not current, and
-   push only to it: the host refuses a push to any other branch. Otherwise
-   branch `feat/<slug>` from the default branch. Spawn the implementer with the Implementer brief from
-   [references/agent-briefs.md](references/agent-briefs.md), the issue, the
-   drafted criteria with their ids when the build drafted them, the branch
-   and the instructions-file pointer. The phase ends when the
-   repository's own pre-push checks and tests pass on the branch. Review
-   never opens on a red branch. A branch that cannot go green escalates.
-4. **Review.** Read [references/review-loop.md](references/review-loop.md) on
-   entry and run it. It sizes the panel to the finished diff: one generalist
-   for a small diff, the generalist and one focused reviewer for a medium
-   one, the generalist and up to three for a large or risky one. Findings are
-   merged into classes, checked by a refuter, fixed, and rechecked once. Then
-   write the review report as an HTML file and emit it:
-
-       outerlayer emit artifact <report>.html --caption "Review of the change and what it found"
-
-   Its verdict is recorded on the `code-review` check once the pull request
-   is open, as release.md says.
-
-5. **Sync and pull request.** Read [references/release.md](references/release.md)
-   on entry and run it. A release agent rebases, gates and pushes. Open the
-   pull request as release.md says: a runner build with `outerlayer work open-pr`,
-   which links it, and a local session with `gh pr create` and then
-   `outerlayer work pr <number>`. When the build recorded criteria, from the issue or drafted, a fresh agent judges them with
-   [references/criteria-judge.md](references/criteria-judge.md), and the
-   judge's HTML report is linked to its tests and emitted:
-
-       node .outerlayer/skills/build/scripts/criterion-citations.mjs --report <judge-report>.html
-       outerlayer emit artifact <judge-report>.html --for acceptance-criteria --caption "Each criterion judged against its test"
-
-   The build does not record that verdict: the factory host judges the
-   criteria itself and records the `acceptance-criteria` check, as release.md
-   says. When the state file holds no criteria, no judge runs.
-   Watch CI until every check has concluded.
-6. **Manual test and evidence.** Read [references/evidence.md](references/evidence.md)
-   when the pull request opens, and run it. Capture the proof each criterion
-   declares, emit it. Then release the lease.
-7. **Release the lease.** Run this last, after the pull request is open and
-   the evidence is emitted, and run no other tool call after it:
-
-       outerlayer work release --item "$OUTERLAYER_WORK"
-
-   A session that names a work item holds a lease on it, and review stays
-   closed until the lease is released. In a session this command releases the
-   session's own lease and no one else's. A later tool call takes the lease
-   again, so write the final report as plain text once this has run. Skip this
-   step in a runner build, whose host releases its own lease. Then end the run
-   with the final report. The report lists every candidate issue and every
-   assumption.
+None yet. Add a change under the name of the phase it applies to: Intake, Criteria, Implement, Review, Pull request, Evidence.

package/skill-pack/validators/acceptance-criteria.yaml

@@ -32,4 +32,4 @@ run:
   where: host
   emit: acceptance-criteria
   judge:
-    brief: .outerlayer/skills/build/references/criteria-judge.md
+    brief: .outerlayer/skills/outerlayer-build/references/criteria-judge.md

package/dist/build-TQ6X5PYN.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-3CWUOFV6.js';
-export { RecipeError } from './chunk-QOZKPLVJ.js';
-import './chunk-CX22S5BA.js';
-import './chunk-ECODQ7II.js';
-import './chunk-JBJTC3UU.js';
-import './chunk-N2PXGQRL.js';
-import './chunk-BQXFBI7T.js';
-import './chunk-Z5GEFMRW.js';
-
-createRequire(import.meta.url);

package/dist/chunk-3UZTIRLF.js

@@ -1,320 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { parseSize } from './chunk-7RQ73DLO.js';
-import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-QNLX477Q.js';
-import { runnerDir } from './chunk-N2PXGQRL.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BQXFBI7T.js';
-import { createHash } from 'crypto';
-import { realpathSync } from 'fs';
-import { join, dirname, resolve } from 'path';
-
-createRequire(import.meta.url);
-
-// src/runner/judge-command.ts
-var JUDGE_DIR = "/outerlayer/judge";
-var JUDGE_HOME = `${JUDGE_DIR}/home`;
-var JUDGE_TREE = `${JUDGE_DIR}/tree`;
-var JUDGE_REPORT = `${JUDGE_DIR}/report.html`;
-var JUDGE_PROGRAM = "/opt/outerlayer/claude/bin/claude";
-var MAX_REPORT_BYTES = 5 * 1024 * 1024;
-var JUDGE_MAX_TURNS = 60;
-var JUDGE_PATH = "/opt/outerlayer/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
-var JUDGE_TOOLS = "Read,Grep,Glob,Write";
-function judgeCommand(input) {
-  const env = {
-    HOME: JUDGE_HOME,
-    TMPDIR: `${JUDGE_HOME}/tmp`,
-    PATH: JUDGE_PATH,
-    ANTHROPIC_BASE_URL: `http://127.0.0.1:${CLAUDE_PORT}`,
-    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
-    DISABLE_AUTOUPDATER: "1",
-    ...input.credential === void 0 ? {} : { [input.credential.variable]: input.credential.placeholder }
-  };
-  const argv = [
-    JUDGE_PROGRAM,
-    "-p",
-    "--output-format",
-    "json",
-    "--setting-sources",
-    "user",
-    "--strict-mcp-config",
-    "--disable-slash-commands",
-    "--no-session-persistence",
-    "--tools",
-    JUDGE_TOOLS,
-    "--allowedTools",
-    // A path that starts with two slashes is absolute in a permission rule.
-    `Read(/${JUDGE_DIR}/**),Edit(/${JUDGE_REPORT})`,
-    "--add-dir",
-    JUDGE_TREE,
-    "--permission-mode",
-    "dontAsk",
-    "--max-turns",
-    String(JUDGE_MAX_TURNS),
-    // After the separator, so a brief that starts with a dash is not read as an option.
-    "--",
-    input.brief
-  ];
-  return { argv, env, cwd: JUDGE_DIR };
-}
-var HASH_SCRIPT = 'const fs=require("fs"),c=require("crypto");const p=fs.realpathSync(process.argv[1]);process.stdout.write(c.createHash("sha256").update(fs.readFileSync(p)).digest("hex")+" "+p+"\\n")';
-var HASH_ARGV = ["/opt/outerlayer/bin/node", "-e", HASH_SCRIPT, JUDGE_PROGRAM];
-function parseProgramHash(stdout) {
-  return /^([0-9a-f]{64}) /.exec(stdout.trim())?.[1];
-}
-
-// src/runner/container/run-args.ts
-var BUILD_LABEL = "ai.outerlayer.build";
-var RUNNER_LABEL = "ai.outerlayer.runner";
-function resolvedRunnerDir(configPath) {
-  try {
-    return realpathSync(runnerDir(configPath));
-  } catch {
-    try {
-      return join(realpathSync(dirname(resolve(configPath))), "runner");
-    } catch {
-      return resolve(runnerDir(configPath));
-    }
-  }
-}
-function runnerLabelValue(configPath) {
-  return createHash("sha256").update(resolvedRunnerDir(configPath)).digest("hex").slice(0, 12);
-}
-function hardened(input) {
-  const { memory, cpus, pids, cpuset } = input.limits;
-  return [
-    "--label",
-    `${BUILD_LABEL}=${input.buildId}`,
-    "--label",
-    `${RUNNER_LABEL}=${input.runnerId}`,
-    "--network",
-    "none",
-    "--cap-drop",
-    "ALL",
-    "--security-opt",
-    "no-new-privileges",
-    "--read-only",
-    "--user",
-    input.user,
-    // The same figure for swap as for memory leaves the container none.
-    "--memory",
-    memory,
-    "--memory-swap",
-    memory,
-    "--cpus",
-    String(cpus),
-    ...cpuset === void 0 ? [] : ["--cpuset-cpus", cpuset],
-    "--pids-limit",
-    String(pids)
-  ];
-}
-function mountPath(path) {
-  if (/[",]/.test(path)) throw new Error(`${path} holds a comma or a quote, which a Docker mount cannot carry; move the runner's config file`);
-  return path;
-}
-function containerRunArgs(input) {
-  return [
-    "--detach",
-    "--name",
-    input.container,
-    ...hardened(input),
-    "--mount",
-    `type=volume,src=${input.volume},dst=/build`,
-    // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
-    "--mount",
-    `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
-    "--mount",
-    `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
-    ...input.judgeDir === void 0 ? [] : ["--mount", `type=bind,src=${mountPath(input.judgeDir)},dst=${JUDGE_DIR}`],
-    "--entrypoint",
-    "/opt/outerlayer/bin/tini",
-    input.image,
-    "--",
-    "/opt/outerlayer/bin/node",
-    "/opt/outerlayer/cli/dist/index.js",
-    "broker-relay",
-    "--port",
-    String(RELAY_PORT),
-    "--socket",
-    `${JOB_MOUNT}/tunnel.sock`,
-    ...Array.from({ length: input.destinations ?? 0 }, (_unused, index) => [
-      "--forward",
-      `${DESTINATION_BASE_PORT + index}=${JOB_MOUNT}/dest-${index}.sock`
-    ]).flat(),
-    ...input.builtIns === true ? [
-      "--forward",
-      `${GATEWAY_PORT}=${JOB_MOUNT}/${GATEWAY_SOCKET}`,
-      "--forward",
-      `${CLAUDE_PORT}=${JOB_MOUNT}/${CLAUDE_SOCKET}`
-    ] : []
-  ];
-}
-function prepareRunArgs(input) {
-  return [
-    "--rm",
-    ...hardened(input),
-    "--mount",
-    `type=volume,src=${input.volume},dst=/build`,
-    "--entrypoint",
-    "mkdir",
-    input.image,
-    "-p",
-    "-m",
-    "1777",
-    "/build/tmp",
-    "/build/home",
-    "/build/work"
-  ];
-}
-function containerExecArgs(input) {
-  const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
-  const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
-  return [
-    "-u",
-    input.user,
-    ...input.workdir === void 0 ? [] : ["-w", input.workdir],
-    ...literals,
-    ...passed,
-    input.container,
-    ...input.argv
-  ];
-}
-
-// src/runner/image/builder.ts
-var MIN_BUILDX_VERSION = "0.18.0";
-var INSTALL_HINT = "install Docker's Buildx plugin (docker-buildx-plugin on Debian and Ubuntu with Docker's apt repository, docker-buildx on Ubuntu's own packages)";
-function builderName(configPath) {
-  return `outerlayer-${runnerLabelValue(configPath)}`;
-}
-function proxyEnvironment(env) {
-  const found = {};
-  for (const name of ["HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy"]) {
-    const value = env[name];
-    if (value !== void 0 && value !== "") found[name] = value;
-  }
-  return found;
-}
-function builderSpec(configPath, memory, env) {
-  return { name: builderName(configPath), memory, env: proxyEnvironment(env) };
-}
-function driverOpt(pair) {
-  return /[",]/.test(pair) ? `"${pair.replace(/"/g, '""')}"` : pair;
-}
-async function buildxState(run) {
-  const result = await run("docker", ["buildx", "version"]);
-  if (result.status !== 0) {
-    const said = (result.stderr.trim() || result.stdout.trim()).split("\n")[0] ?? "";
-    return { problem: `docker buildx is not available${said === "" ? "" : ` (${said})`}, so image builds cannot be limited; ${INSTALL_HINT}` };
-  }
-  const version = /\bv?(\d+\.\d+\.\d+)/.exec(result.stdout)?.[1];
-  if (version !== void 0 && compareVersions(version, MIN_BUILDX_VERSION) < 0) {
-    return { problem: `docker buildx ${version} is too old: the runner's image builder needs Buildx ${MIN_BUILDX_VERSION} or later; update ${INSTALL_HINT}` };
-  }
-  return "usable";
-}
-function isOutOfMemory(output) {
-  if (/cannot allocate memory/i.test(output)) return true;
-  if (/did not complete successfully: (exit code: 137|signal: killed)/i.test(output)) return true;
-  return /ResourceExhausted/i.test(output) && !/larger than max|message size|too large/i.test(output);
-}
-var running = 0;
-async function trackImageBuild(work) {
-  running++;
-  try {
-    return await work();
-  } finally {
-    running--;
-  }
-}
-var queue = Promise.resolve();
-function serialized(work) {
-  const next = queue.then(work, work);
-  queue = next.catch(() => void 0);
-  return next;
-}
-function readExisting(inspectOutput) {
-  const options = /^Driver Options:\s*(.*)$/m.exec(inspectOutput)?.[1] ?? "";
-  const option = (key) => new RegExp(`(?:^|\\s)${key}="([^"]*)"`).exec(options)?.[1];
-  return { driver: /^Driver:\s*(\S+)/m.exec(inspectOutput)?.[1], memory: option("memory"), image: option("image") };
-}
-function sameMemory(found, wanted) {
-  return (parseSize(found) ?? found) === (parseSize(wanted) ?? wanted);
-}
-var IDLE_POLL_MS = 1e3;
-var failures = 0;
-function ensureFailureCount() {
-  return failures;
-}
-function ensureBuilder(rawRun, spec, options = {}) {
-  const run = (command, args, opts) => rawRun(command, args, { ...opts, timeoutMs: args.includes("--bootstrap") ? 15 * 6e4 : 2 * 6e4 });
-  const result = serialized(async () => {
-    const state = await buildxState(run);
-    if (state !== "usable") return { ok: false, problem: state.problem };
-    const sleep = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
-    const inspected = await run("docker", ["buildx", "inspect", spec.name]);
-    let create = inspected.status !== 0;
-    if (!create) {
-      const found = readExisting(inspected.stdout);
-      const current = found.driver === "docker-container" && sameMemory(found.memory ?? "", spec.memory) && found.image === BUILDKIT_IMAGE;
-      if (!current && options.replaceStale === false) {
-        return {
-          ok: false,
-          problem: `the image builder ${spec.name} was made with other settings than runner.build.memory (${spec.memory}) and the pinned BuildKit image; the runner service replaces it when no build is running, or remove it with docker buildx rm ${spec.name}`
-        };
-      }
-      if (!current) {
-        if (options.waitForIdle === true) while (running > 0) await sleep(IDLE_POLL_MS);
-        if (running === 0) {
-          const removed = await run("docker", ["buildx", "rm", spec.name]);
-          if (removed.status !== 0) return { ok: false, problem: `could not replace the image builder ${spec.name}: ${removed.stderr.trim() || `docker exited ${removed.status}`}` };
-          create = true;
-        }
-      }
-    }
-    if (create) {
-      const opts = [
-        `memory=${spec.memory}`,
-        `memory-swap=${spec.memory}`,
-        `image=${BUILDKIT_IMAGE}`,
-        ...Object.entries(spec.env ?? {}).map(([name, value]) => `env.${name}=${value}`),
-        ...spec.driverOpts ?? []
-      ];
-      const created = await run("docker", [
-        "buildx",
-        "create",
-        "--name",
-        spec.name,
-        "--driver",
-        "docker-container",
-        ...opts.flatMap((opt) => ["--driver-opt", driverOpt(opt)])
-      ]);
-      if (created.status !== 0) {
-        const said = created.stderr.trim() || `docker exited ${created.status}`;
-        if (/failed to find driver/i.test(said)) {
-          return { ok: false, problem: `this Docker's Buildx has no docker-container driver, so image builds cannot be limited; ${INSTALL_HINT}` };
-        }
-        return { ok: false, problem: `could not create the image builder ${spec.name}: ${said}` };
-      }
-    }
-    if (options.bootstrap === true) {
-      const started = await run("docker", ["buildx", "inspect", "--bootstrap", spec.name]);
-      if (started.status !== 0) {
-        return { ok: false, problem: `the image builder ${spec.name} did not start: ${started.stderr.trim() || `docker exited ${started.status}`}` };
-      }
-    }
-    return { ok: true, changed: create };
-  });
-  return result.then(
-    (outcome) => {
-      if (!outcome.ok) failures++;
-      return outcome;
-    },
-    (err) => {
-      failures++;
-      throw err;
-    }
-  );
-}
-
-export { BUILD_LABEL, HASH_ARGV, JUDGE_DIR, JUDGE_MAX_TURNS, JUDGE_PROGRAM, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderSpec, buildxState, containerExecArgs, containerRunArgs, ensureBuilder, ensureFailureCount, isOutOfMemory, judgeCommand, parseProgramHash, prepareRunArgs, proxyEnvironment, runnerLabelValue, trackImageBuild };

package/dist/chunk-CX22S5BA.js

@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-
-createRequire(import.meta.url);
-
-// src/runner/image/pins.ts
-var CLAUDE_CODE_VERSION = "2.1.284";
-var DEFAULT_BASE_IMAGE = "ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3";
-var NODE_IMAGE = "node:22-bookworm-slim@sha256:43ac6c60b8f89723f746e8a92ce91abd5017e627ce1ddfe4238355d3a30b772c";
-var BUILDKIT_IMAGE = "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea";
-var GH_VERSION = "2.101.0";
-var GH_SHA256 = {
-  amd64: "9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8",
-  arm64: "b57e8063f18862647c9d22727c32e9da1b963f8bf9db648fe123a6975695640f"
-};
-var TINI_VERSION = "0.19.0";
-var TINI_SHA256 = {
-  amd64: "c5b0666b4cb676901f90dfcb37106783c5fe2077b04590973b885950611b30ee",
-  arm64: "eae1d3aa50c48fb23b8cbdf4e369d0910dfc538566bfd09df89a774aa84a48b9"
-};
-var MICROVM_ARCHES = ["x86_64"];
-function firecrackerArch(nodeArch) {
-  return nodeArch === "x64" ? "x86_64" : nodeArch === "arm64" ? "aarch64" : nodeArch;
-}
-var FIRECRACKER_VERSION = "1.13.1";
-var FIRECRACKER_SHA256 = {
-  x86_64: "59450b9171ff2ebdf2f9a25be3a248a7ba79fb6371aec51a9d6d8eefca7b4faf"
-};
-var FIRECRACKER_BINARY_SHA256 = {
-  x86_64: "7d3924e0c8761edafbf85cb2a94c268ffad249644a40fd02d4e15cde4c206f6e"
-};
-var GUEST_ASSETS_VERSION = "1";
-var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
-var GUEST_KERNEL_SHA256 = {
-  x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
-};
-var GUEST_HELPER_SHA256 = {
-  x86_64: "4175e89ae8cb633113b5f69ef8b6e206093954411fe53edf86357bc1b7e822f9"
-};
-function guestAssetsPinned(arch) {
-  const zero = "0".repeat(64);
-  return GUEST_KERNEL_SHA256[arch] !== zero && GUEST_HELPER_SHA256[arch] !== zero;
-}
-
-export { BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, MICROVM_ARCHES, NODE_IMAGE, TINI_SHA256, TINI_VERSION, firecrackerArch, guestAssetsPinned };