@outerlayer/cli 0.20.0 → 0.22.0

package/dist/{chunk-3ZR7Y23Y.js → chunk-VX74ND77.js}

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-IRBNIRQJ.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-VMJPFQNE.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, JUDGE_DIR, MAX_REPORT_BYTES } from './chunk-3UZTIRLF.js';
-import { execCapture } from './chunk-GGOMT6KF.js';
-import { GUEST_CID } from './chunk-X5H2WYMB.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-XZ4H4X5F.js';
-import { WorkCommandError } from './chunk-FBTGMSQF.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-WERZMIKA.js';
+import { RecipeError, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-3W333NFO.js';
+import { execCapture } from './chunk-PHHBYAL6.js';
+import { GUEST_CID } from './chunk-BLW6GPBZ.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-C3OVGKVJ.js';
+import { WorkCommandError } from './chunk-2HT2XGJX.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3CWUOFV6.js';
-import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QNLX477Q.js';
-import { sharedSkillNames, skillConflictMessage } from './chunk-LLM3I5YU.js';
-import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-G2YNJIGF.js';
+import { sharedSkillNames, skillConflictMessage } from './chunk-ZNPE7FW5.js';
+import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-AEKSX4EY.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-WFSUUUAN.js';
 import { downconvertSession } from './chunk-7VUK5RFS.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-N2PXGQRL.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BQXFBI7T.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-KIGSGZBB.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-V7MQKOZY.js';
+import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-GISNHSYL.js';
 import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { join, dirname, basename } from 'path';
 import { spawnSync, spawn } from 'child_process';
 import { availableParallelism, networkInterfaces } from 'os';
 import { randomBytes, createHash } from 'crypto';
+import http2 from 'http2';
+import { Duplex, Transform } from 'stream';
 import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
-import { Transform } from 'stream';
 import { pipeline, finished } from 'stream/promises';
 import { createGunzip, gunzipSync, constants as constants$1 } from 'zlib';
 import { isIP, connect, createServer as createServer$1 } from 'net';
@@ -306,6 +306,39 @@ function createCpuAllocator(cores) {
     }
   };
 }
+
+// src/runner/container/lease-channel.ts
+var LEASE_SECONDS = 900;
+function leaseExpiresAtMs(job) {
+  const base = Date.parse(job.lastRenewAt ?? job.startedAt);
+  return (Number.isFinite(base) ? base : Date.now()) + LEASE_SECONDS * 1e3;
+}
+function createLeaseChannel(expiryMs) {
+  const open = /* @__PURE__ */ new Set();
+  let stopped = false;
+  const write = (stream) => {
+    if (!stopped && !stream.destroyed && stream.writable) stream.write(`${Math.floor(expiryMs())}
+`);
+  };
+  return {
+    accept(stream) {
+      stream.on("error", () => void 0);
+      open.add(stream);
+      stream.once("close", () => open.delete(stream));
+      queueMicrotask(() => write(stream));
+    },
+    publish() {
+      for (const stream of open) write(stream);
+    },
+    stop() {
+      stopped = true;
+    },
+    close() {
+      for (const stream of [...open]) stream.destroy();
+      open.clear();
+    }
+  };
+}
 var AssetError = class extends Error {
   constructor(file, message) {
     super(message);
@@ -396,8 +429,7 @@ async function ensureAssets(options) {
   const helper = await ensureFile(dir, `outerlayer-guest-${arch}`, pins.helper, fetchImpl, 493);
   return { firecracker, kernel, helper, helperSha256: pins.helper.sha256 };
 }
-
-// src/runner/container/docker.ts
+var STOP_GRACE_SECONDS = 15;
 function parseImageConfig(json) {
   const config = JSON.parse(json);
   const env = {};
@@ -435,10 +467,37 @@ function createContainerHost(deps = {}) {
     exec(input, opts) {
       const env = {};
       for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
-      return run("docker", ["exec", ...containerExecArgs(input)], { ...opts, env });
+      return run("docker", ["exec", ...containerExecArgs(input)], { ...opts, env, ...input.stdin === void 0 ? {} : { input: input.stdin } });
+    },
+    execDetached(input) {
+      const env = {};
+      for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
+      return run("docker", ["exec", ...containerExecArgs({ ...input, detached: true })], { env });
+    },
+    async state(container) {
+      const result = await run("docker", ["inspect", "--format", "{{.State.Running}}", container]);
+      if (result.status !== 0) return /no such (object|container)/i.test(result.stderr) ? "missing" : "unknown";
+      return result.stdout.trim() === "true" ? "running" : "stopped";
+    },
+    execStream(input) {
+      const child = (deps.spawn ?? spawn)("docker", ["exec", ...containerExecArgs({ ...input, interactive: true })], {
+        env: childEnvironment(process.env),
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      let stderr = "";
+      child.stderr?.on("data", (chunk) => {
+        stderr = (stderr + chunk.toString()).slice(-400);
+      });
+      child.stderr?.on("error", () => void 0);
+      const exited = new Promise((resolve) => {
+        child.once("error", () => resolve(-1));
+        child.once("close", (code) => resolve(code ?? -1));
+      });
+      child.stdin.on("error", () => void 0);
+      return { stdin: child.stdin, stdout: child.stdout, exited, kill: () => void child.kill("SIGKILL"), stderrTail: () => stderr };
     },
     stop(container) {
-      return run("docker", ["stop", container]);
+      return run("docker", ["stop", "--time", String(STOP_GRACE_SECONDS), container]);
     },
     start(container) {
       return run("docker", ["start", container]);
@@ -713,7 +772,7 @@ var DELIVER_SCRIPT = [
   'src="$1"; dest="$2"',
   'if [ -e "$dest" ]; then chmod -R u+w "$dest"; rm -rf "$dest"; fi',
   'mkdir -p "$dest"',
-  "for entry in AGENTS.md CLAUDE.md settings.json .claude .outerlayer; do",
+  "for entry in AGENTS.md CLAUDE.md settings.json .claude .outerlayer .agents; do",
   '  if [ -e "$src/$entry" ]; then cp -R "$src/$entry" "$dest/"; fi',
   "done",
   'chmod -R a-w "$dest"'
@@ -723,23 +782,33 @@ var WRITE_SHIM_SCRIPT = 'mkdir -p "$1" && printf "%s" "$2" > "$1/claude" && chmo
 function failure(what, result) {
   return `context_delivery_failed: ${what} (exit ${result.status})${firstLine3(result.stderr) === "" ? "" : `: ${firstLine3(result.stderr)}`}`;
 }
+async function repositorySkills(input, folder) {
+  const listed = await input.exec(["ls", "-1", folder], CHECKOUT_DIR, { quiet: true });
+  if (listed.status !== 0) return /* @__PURE__ */ new Set();
+  return new Set(listed.stdout.split("\n").map((name) => name.trim()));
+}
 async function deliveryRefusal(input, staged) {
   if (input.agentVersion !== void 0 && !versionAtLeast(input.agentVersion)) {
     return `context_agent_too_old: the build image's Claude Code is ${input.agentVersion}, and a governed build needs ${MINIMUM_CLAUDE_VERSION} or later to load its control plane's instructions; rebuild the image`;
   }
-  const own = await input.exec(["ls", "-1", ".claude/skills"], CHECKOUT_DIR, { quiet: true });
-  if (own.status !== 0) return void 0;
-  const ownNames = new Set(own.stdout.split("\n").map((name) => name.trim()));
-  const clash = sharedSkillNames(join(staged.dir, "tree")).find((name) => ownNames.has(name));
+  const own = /* @__PURE__ */ new Map([
+    [".claude/skills", await repositorySkills(input, ".claude/skills")],
+    [".agents/skills", await repositorySkills(input, ".agents/skills")]
+  ]);
+  const clash = sharedSkillNames(join(staged.dir, "tree")).find((name) => [...own.values()].some((names) => names.has(name)));
   if (clash === void 0) return void 0;
-  return `context_skill_conflict: ${skillConflictMessage({ skill: clash, repository: input.repository, controlPlane: staged.repository })}, and would replace it in this build; rename or remove it from the repository`;
+  const folder = own.get(".claude/skills").has(clash) ? ".claude/skills" : ".agents/skills";
+  return `context_skill_conflict: ${skillConflictMessage({ skill: clash, folder, repository: input.repository, controlPlane: staged.repository })}, and would replace it in this build; rename or remove it from the repository`;
+}
+async function writeShim(input) {
+  const shim = await input.exec(["sh", "-c", WRITE_SHIM_SCRIPT, "shim", SHIM_DIR, shimScript()], "/build/work");
+  if (shim.status !== 0) return { ok: false, reason: failure("writing the claude shim failed", shim) };
+  return { ok: true };
 }
 async function deliver(input, staged) {
   const dir = deliveryDir(staged.repository, staged.sha);
   const copied = await input.exec(["sh", "-c", DELIVER_SCRIPT, "deliver", STAGED_TREE, dir], "/build/work");
   if (copied.status !== 0) return { ok: false, reason: failure("copying the control plane into the build failed", copied) };
-  const shim = await input.exec(["sh", "-c", WRITE_SHIM_SCRIPT, "shim", SHIM_DIR, shimScript()], "/build/work");
-  if (shim.status !== 0) return { ok: false, reason: failure("writing the claude shim failed", shim) };
   const record = JSON.stringify({ schemaVersion: 1, repository: staged.repository, ref: staged.ref, sha: staged.sha, dir });
   const recorded = await input.exec(["sh", "-c", RECORD_SCRIPT, "record", record], CHECKOUT_DIR);
   if (recorded.status !== 0) return { ok: false, reason: failure("recording the delivery failed", recorded) };
@@ -813,6 +882,11 @@ async function runBuildSteps(input) {
   const staged = await input.stageContext();
   if (staged.kind === "refused") return { ok: false, reason: staged.reason };
   let controlPlane;
+  const shimmed = await writeShim(input);
+  if (!shimmed.ok) {
+    if (staged.kind === "staged") input.removeStagedContext();
+    return shimmed;
+  }
   if (staged.kind === "staged") {
     try {
       const refusal = await deliveryRefusal(input, staged);
@@ -1048,17 +1122,190 @@ function copyJudgeTree(from, to, limits2 = { files: MAX_TREE_FILES, bytes: MAX_T
 
 // src/runner/container/agent-user.ts
 var ADDED_USER = "ol-agent";
+var RELAY_REFUSAL = `the agent's user cannot be \`${RELAY_USER}\``;
 var AgentUserError = class extends Error {
 };
 async function resolveAgentUser(input) {
   const named = input.remoteUser !== void 0 && input.remoteUser !== "" ? input.remoteUser : input.imageUser;
   const candidate = (named ?? "").split(":")[0];
   if (candidate === "" || candidate === "root") return ADDED_USER;
-  if (/^\d+$/.test(candidate)) return Number(candidate) === 0 ? ADDED_USER : candidate;
+  if (candidate === RELAY_USER) throw new AgentUserError(RELAY_REFUSAL);
+  if (/^\d+$/.test(candidate)) {
+    if (Number(candidate) === RELAY_ID) throw new AgentUserError(RELAY_REFUSAL);
+    return Number(candidate) === 0 ? ADDED_USER : candidate;
+  }
   const uid = await input.probe(candidate);
   if (uid === null) throw new AgentUserError(`the user "${candidate}" is not in the image, so no command can run as it`);
+  if (uid === RELAY_ID) throw new AgentUserError(RELAY_REFUSAL);
   return uid === 0 ? ADDED_USER : candidate;
 }
+var noop = () => void 0;
+var FRAME_HEADER_BYTES = 9;
+var GOAWAY_FRAME = 7;
+function watchSentGoaway(onError) {
+  let head = Buffer.alloc(0);
+  let want = FRAME_HEADER_BYTES;
+  let skip = 0;
+  return (chunk) => {
+    let at = 0;
+    while (at < chunk.length) {
+      if (skip > 0) {
+        const n = Math.min(skip, chunk.length - at);
+        skip -= n;
+        at += n;
+        continue;
+      }
+      const take = Math.min(want - head.length, chunk.length - at);
+      head = Buffer.concat([head, chunk.subarray(at, at + take)]);
+      at += take;
+      if (head.length < want) return;
+      const length = head.readUIntBE(0, 3);
+      if (want === FRAME_HEADER_BYTES && head[3] === GOAWAY_FRAME && length >= 8) {
+        want = FRAME_HEADER_BYTES + 8;
+        continue;
+      }
+      if (want > FRAME_HEADER_BYTES && head.readUInt32BE(FRAME_HEADER_BYTES + 4) !== http2.constants.NGHTTP2_NO_ERROR) onError();
+      skip = length - (want - FRAME_HEADER_BYTES);
+      head = Buffer.alloc(0);
+      want = FRAME_HEADER_BYTES;
+    }
+  };
+}
+function serveSession(transport, services, opts = {}) {
+  const maxStreams = opts.maxStreams ?? MAX_OPEN_STREAMS;
+  let open = 0;
+  let served = 0;
+  let malformed = false;
+  transport.on("error", noop);
+  const watch = watchSentGoaway(() => {
+    malformed = true;
+    setImmediate(() => session.destroy());
+  });
+  const outbound = new Transform({
+    transform(chunk, _encoding, done) {
+      watch(chunk);
+      done(null, chunk);
+    }
+  });
+  outbound.on("error", noop);
+  outbound.pipe(transport);
+  const wire = Duplex.from({ readable: transport, writable: outbound });
+  wire.on("error", noop);
+  const session = http2.performServerHandshake(wire, { settings: { initialWindowSize: STREAM_WINDOW, enablePush: false } });
+  try {
+    session.setLocalWindowSize(SESSION_WINDOW);
+  } catch {
+  }
+  const ended = new Promise((resolve) => {
+    session.on("error", (err) => {
+      if (typeof err.code === "string" && err.code.startsWith("ERR_HTTP2_")) malformed = true;
+    });
+    session.on("close", () => resolve({ malformed, served }));
+  });
+  session.on("stream", (stream, headers) => {
+    stream.on("error", noop);
+    const target = headers[":method"] === "POST" ? targetOfPath(headers[":path"]) : void 0;
+    if (target === void 0 || open >= maxStreams) {
+      stream.close(http2.constants.NGHTTP2_REFUSED_STREAM);
+      return;
+    }
+    open++;
+    stream.once("close", () => {
+      open--;
+    });
+    if (!services.accept(target, stream)) {
+      stream.close(http2.constants.NGHTTP2_REFUSED_STREAM);
+      return;
+    }
+    served++;
+    if (!stream.headersSent && !stream.destroyed) stream.respond({ ":status": 200 });
+  });
+  return {
+    ended,
+    // A session the peer is closing gracefully waits for its open streams, which a stopped container never ends: destroy it whatever its state.
+    close: () => {
+      if (!session.destroyed) session.destroy();
+    }
+  };
+}
+var FIRST_BACKOFF_MS = 200;
+var LONGEST_BACKOFF_MS = 5e3;
+var JOINED_AFTER_MS = 2e3;
+var EXIT_WAIT_MS = 5e3;
+function exitedWithin(stream, ms) {
+  let timer;
+  const late = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(void 0), ms);
+    timer.unref();
+  });
+  return Promise.race([stream.exited, late]).finally(() => clearTimeout(timer));
+}
+function superviseRelay(input) {
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const exitWaitMs = input.exitWaitMs ?? EXIT_WAIT_MS;
+  let closed = false;
+  let fatal;
+  let running;
+  let wake;
+  const loop = (async () => {
+    let malformedInARow = 0;
+    let backoff = FIRST_BACKOFF_MS;
+    let failing = false;
+    while (!closed && fatal === void 0) {
+      const startedMs = Date.now();
+      const stream = input.execStream({
+        container: input.container,
+        user: RELAY_USER,
+        env: { literals: {}, passed: {} },
+        argv: ["outerlayer", "broker-relay", "join"],
+        interactive: true
+      });
+      stream.stdin.on("error", noop);
+      stream.stdout.on("error", noop);
+      const session = serveSession(Duplex.from({ readable: stream.stdout, writable: stream.stdin }), input.services);
+      running = { stream, session };
+      void stream.exited.then(() => session.close());
+      const end = await session.ended;
+      stream.kill();
+      const status = await exitedWithin(stream, exitWaitMs);
+      running = void 0;
+      if (status === void 0) input.log?.(`the relay's exec into ${input.container} did not end when killed \xB7 going on without it`);
+      const joined = end.served > 0 || Date.now() - startedMs >= JOINED_AFTER_MS;
+      if (joined) {
+        backoff = FIRST_BACKOFF_MS;
+        failing = false;
+        if (!closed) input.log?.(`the session with ${input.container} ended \xB7 joining again`);
+      }
+      if (!end.malformed && end.served > 0) malformedInARow = 0;
+      if (end.malformed) {
+        malformedInARow++;
+        if (malformedInARow >= MAX_MALFORMED_SESSIONS) {
+          fatal = MALFORMED_REASON;
+          input.log?.(`the session with ${input.container} broke HTTP/2 framing ${malformedInARow} times in a row \xB7 ending the build`);
+          input.onFatal?.(fatal);
+          return;
+        }
+      } else if (!joined && !failing) {
+        failing = true;
+        const reason = stream.stderrTail?.().trim() ?? "";
+        input.log?.(`could not join the relay in ${input.container}${status === 0 || status === void 0 ? "" : ` (exec exited ${status})`}${reason === "" ? "" : `: ${reason}`} \xB7 trying again`);
+      }
+      if (closed) return;
+      await Promise.race([sleep(backoff), new Promise((resolve) => wake = resolve)]);
+      backoff = Math.min(backoff * 2, LONGEST_BACKOFF_MS);
+    }
+  })();
+  return {
+    fatal: () => fatal,
+    close: async () => {
+      closed = true;
+      wake?.();
+      running?.session.close();
+      running?.stream.kill();
+      await loop;
+    }
+  };
+}
 var FILE_MODE = 420;
 var DIR_MODE = 493;
 function replaceFile(path, text) {
@@ -1086,6 +1333,140 @@ function writeGhConfig(dir, token) {
   replaceFile(join(dir, "hosts.yml"), ghHostsYml(token));
   replaceFile(join(dir, "config.yml"), GH_CONFIG_YML);
 }
+var DeliveryFailure = class extends Error {
+};
+var BLOCK = 512;
+var DELIVERY_TIMEOUT_MS = 5 * 6e4;
+var RECEIVE_ARGV = ["/opt/outerlayer/bin/node", "/opt/outerlayer/cli/dist/index.js", "receive-files"];
+var REASON_LINE_MAX = 240;
+var STEPS = {
+  gh: "the build's gh configuration",
+  "git-hooks": "the commit hooks",
+  context: "the staged context",
+  "eval-input": "the checks' input"
+};
+function field(header, at, length, text) {
+  header.write(text, at, length, "latin1");
+}
+function octalField(header, at, length, value) {
+  field(header, at, length, `${value.toString(8).padStart(length - 1, "0")}\0`);
+}
+function tarHeader(name, type, mode, size) {
+  const header = Buffer.alloc(BLOCK);
+  header.write(name, 0, 100, "utf8");
+  octalField(header, 100, 8, mode);
+  octalField(header, 108, 8, 0);
+  octalField(header, 116, 8, 0);
+  octalField(header, 124, 12, size);
+  octalField(header, 136, 12, 0);
+  field(header, 148, 8, "        ");
+  header.write(type, 156, 1, "latin1");
+  field(header, 257, 6, "ustar\0");
+  field(header, 263, 2, "00");
+  let sum = 0;
+  for (const byte of header) sum += byte;
+  field(header, 148, 8, `${sum.toString(8).padStart(6, "0")}\0 `);
+  return header;
+}
+function padded(data) {
+  const rest = data.length % BLOCK;
+  return rest === 0 ? data : Buffer.concat([data, Buffer.alloc(BLOCK - rest)]);
+}
+function paxRecord(key, value) {
+  const body = Buffer.from(` ${key}=${value}
+`, "utf8");
+  let length = body.length + 1;
+  while (String(length).length + body.length !== length) length = String(length).length + body.length;
+  return Buffer.concat([Buffer.from(String(length), "latin1"), body]);
+}
+function packTar(entries) {
+  const blocks = [];
+  for (const entry of entries) {
+    const data = entry.type === "file" ? entry.data ?? Buffer.alloc(0) : Buffer.alloc(0);
+    const name = entry.type === "dir" && !entry.path.endsWith("/") ? `${entry.path}/` : entry.path;
+    if (Buffer.byteLength(name, "utf8") > 100) {
+      const record = paxRecord("path", name);
+      blocks.push(tarHeader("PaxHeader", "x", 420, record.length), padded(record));
+    }
+    blocks.push(tarHeader(name, entry.type === "dir" ? "5" : "0", entry.mode, data.length), padded(data));
+  }
+  blocks.push(Buffer.alloc(BLOCK * 2));
+  return Buffer.concat(blocks);
+}
+function fileMode(hostMode) {
+  return 292 | hostMode & 128 | ((hostMode & 73) === 0 ? 0 : 73);
+}
+function packFolder(dir, options = {}) {
+  const entries = options.rootMode === void 0 ? [] : [{ path: "./", type: "dir", mode: options.rootMode }];
+  const walk = (current, prefix) => {
+    for (const name of readdirSync(current).sort()) {
+      const path = join(current, name);
+      const stat = lstatSync(path);
+      const rel = prefix === "" ? name : `${prefix}/${name}`;
+      if (stat.isDirectory()) {
+        entries.push({ path: rel, type: "dir", mode: options.dirModes?.[rel] ?? 493 });
+        walk(path, rel);
+      } else if (stat.isFile()) {
+        entries.push({ path: rel, type: "file", mode: fileMode(stat.mode), data: readFileSync(path) });
+      }
+    }
+  };
+  walk(dir, "");
+  return packTar(entries);
+}
+function scrubDelivery(text, secrets) {
+  let out = text.replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+  for (const secret of secrets()) if (secret !== "") out = out.split(secret).join("[redacted]");
+  out = out.replace(/\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]+/g, "[redacted]");
+  out = out.trim();
+  return out.length > REASON_LINE_MAX ? `${out.slice(0, REASON_LINE_MAX)}...` : out;
+}
+async function deliverTar(runtime, state, input) {
+  try {
+    const result = await runtime.host.exec(
+      {
+        container: state.container,
+        user: RELAY_USER,
+        env: { literals: {}, passed: {} },
+        argv: [...RECEIVE_ARGV, "--into", input.into, ...input.replace === true ? ["--replace"] : []],
+        stdin: input.tar
+      },
+      { timeoutMs: DELIVERY_TIMEOUT_MS }
+    );
+    if (result.status === 0) return { ok: true };
+    const line = scrubDelivery(result.stderr.trim().split("\n")[0] ?? "", input.secrets);
+    return { ok: false, reason: `${input.step} could not be delivered (exit ${result.status})${line === "" ? "" : `: ${line}`}` };
+  } catch (err) {
+    return { ok: false, reason: `${input.step} could not be delivered: ${scrubDelivery(describeCallFailure(err), input.secrets)}` };
+  }
+}
+async function deliverJobFiles(runtime, state, parts, secrets) {
+  for (const part of parts) {
+    const dir = join(state.buildDir, part === "eval-input" ? EVAL_INPUT_NAME : part);
+    if (!existsSync(dir)) continue;
+    let tar;
+    try {
+      tar = packFolder(dir);
+    } catch (err) {
+      return { ok: false, reason: `${STEPS[part]} could not be read on the host: ${scrubDelivery(describeCallFailure(err), secrets)}` };
+    }
+    const delivered = await deliverTar(runtime, state, { step: STEPS[part], tar, into: `${JOB_MOUNT}/${part}`, replace: part === "eval-input", secrets });
+    if (!delivered.ok) return delivered;
+  }
+  return { ok: true };
+}
+function deliverGhConfig(runtime, state, secrets) {
+  return deliverJobFiles(runtime, state, ["gh"], secrets);
+}
+function deliverEvalInput(runtime, state, secrets) {
+  return deliverJobFiles(runtime, state, ["eval-input"], secrets);
+}
+async function deliverJudgeInputs(runtime, state, dir, secrets) {
+  return deliverTar(runtime, state, { step: "the judge's inputs", tar: packFolder(dir, { rootMode: 1023, dirModes: { home: 511, "home/tmp": 511 } }), into: JUDGE_DIR, replace: true, secrets });
+}
+function clearJudgeFolder(runtime, state, secrets) {
+  return deliverTar(runtime, state, { step: "clearing the judge's folder", tar: packTar([]), into: JUDGE_DIR, replace: true, secrets });
+}
 function gitEnv(extra) {
   const env = {};
   for (const [name, value] of Object.entries(process.env)) if (!name.startsWith("GIT_")) env[name] = value;
@@ -1898,17 +2279,20 @@ ${body}`);
     });
     req.pipe(upstream);
   }
-  if (existsSync(socketPath)) unlinkSync(socketPath);
-  await new Promise((resolveListen, reject) => {
-    server.once("error", reject);
-    server.listen(socketPath, () => resolveListen());
-  });
-  chmodSync(socketPath, 438);
+  if (opts.socket !== false) {
+    if (existsSync(socketPath)) unlinkSync(socketPath);
+    await new Promise((resolveListen, reject) => {
+      server.once("error", reject);
+      server.listen(socketPath, () => resolveListen());
+    });
+    chmodSync(socketPath, 438);
+  }
   const tcpServers = [];
   return {
     socketPath,
     record,
     destinationUsed,
+    acceptStream: (stream) => void server.emit("connection", stream),
     async listenTcp(address) {
       const tcp = createServer$1((socket) => server.emit("connection", socket));
       await new Promise((resolveListen, reject) => {
@@ -1939,6 +2323,9 @@ function createContainerRuntime(opts = {}) {
     host: opts.host ?? createContainerHost(),
     cpus: opts.cpus ?? createCpuAllocator(usableCpus()),
     tunnels: opts.tunnels ?? /* @__PURE__ */ new Map(),
+    relays: opts.relays ?? /* @__PURE__ */ new Map(),
+    relayFatal: opts.relayFatal ?? /* @__PURE__ */ new Map(),
+    leases: opts.leases ?? /* @__PURE__ */ new Map(),
     buildImage: opts.buildImage ?? ((build) => buildRepositoryImage(
       {
         repository: build.repository,
@@ -1967,13 +2354,47 @@ function createContainerRuntime(opts = {}) {
     cliBuild: () => cli ?? currentCliBuild()
   };
 }
-function keepGhConfigCurrent(tokens, buildDir2, onError) {
+var REPORT_READ_TIMEOUT_MS = 6e4;
+var GH_CONFIG_RETRY_MS = 3e4;
+var GH_CONFIG_RETRIES = 5;
+function secretsOf(runtime, jobDir) {
+  return () => jobDir === void 0 ? [] : runtime.credentials.get(jobDir)?.issuedTokens() ?? [];
+}
+function filesAreCopied(state) {
+  return state.jobFiles === "copied";
+}
+function keepGhConfigCurrent(tokens, buildDir2, onError, copy) {
+  let last = copy?.delivered;
+  let queued;
+  let queue = Promise.resolve();
+  const deliver2 = (token, attemptsLeft) => {
+    queued = token;
+    queue = queue.then(async () => {
+      if (copy === void 0 || queued !== token) return;
+      const delivered = await deliverGhConfig(copy.runtime, copy.state, copy.secrets);
+      if (delivered.ok) {
+        last = token;
+        queued = void 0;
+        return;
+      }
+      copy.onFailure(delivered.reason);
+      queued = void 0;
+      if (attemptsLeft <= 0) return;
+      const timer = setTimeout(() => {
+        if (queued === void 0 && last !== token) deliver2(token, attemptsLeft - 1);
+      }, GH_CONFIG_RETRY_MS);
+      timer.unref();
+    });
+  };
   tokens.onRead((token) => {
     try {
       writeGhConfig(ghConfigDir(buildDir2), token);
     } catch (err) {
       onError(err);
+      return;
     }
+    if (copy === void 0 || token === last || token === queued) return;
+    deliver2(token, GH_CONFIG_RETRIES);
   });
 }
 function gitRemoteFor(runtime, input) {
@@ -1997,12 +2418,43 @@ function firstLine5(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 var NO_ENV = { literals: {}, passed: {} };
+function transportOf(state) {
+  const recorded = state.transport;
+  if (recorded === void 0 || recorded === "sockets") return "sockets";
+  return recorded === "exec" ? "exec" : "unknown";
+}
+function relayUserOf(state) {
+  return transportOf(state) === "exec" ? RELAY_USER : ADDED_USER;
+}
+function joinBuild(runtime, state, services, log) {
+  runtime.relays.set(
+    state.buildId,
+    superviseRelay({
+      container: state.container,
+      services: services.streams,
+      execStream: (input) => runtime.host.execStream(input),
+      log,
+      onFatal: (reason) => runtime.relayFatal.set(state.buildId, reason)
+    })
+  );
+}
+async function leaveBuild(runtime, state) {
+  const relay = runtime.relays.get(state.buildId);
+  if (relay === void 0) return;
+  runtime.relays.delete(state.buildId);
+  await relay.close();
+}
+function rejoinBuild(runtime, state, log) {
+  const services = runtime.tunnels.get(state.buildId);
+  if (services?.streams === void 0 || runtime.relays.has(state.buildId) || transportOf(state) !== "exec") return;
+  joinBuild(runtime, state, { streams: services.streams }, log);
+}
 var RELAY_PROBE = `const s=require("net").connect(${RELAY_PORT},"127.0.0.1");s.on("connect",()=>process.exit(0));s.on("error",()=>process.exit(1));setTimeout(()=>process.exit(1),2000)`;
 async function waitForRelay(runtime, state) {
   for (let attempt = 0; attempt < RELAY_ATTEMPTS; attempt++) {
     const probe = await runtime.host.exec({
       container: state.container,
-      user: ADDED_USER,
+      user: relayUserOf(state),
       env: NO_ENV,
       argv: ["/opt/outerlayer/bin/node", "-e", RELAY_PROBE]
     });
@@ -2116,8 +2568,11 @@ async function provisionContainer(input) {
     builtIns: true,
     lifecycle: report.apply.lifecycle,
     ...governingSource.kind === "governed" ? { governing: { repository: governingSource.repository, ref: governingSource.ref, commit: governingSource.sha } } : {},
-    cpuset: formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4))
+    cpuset: formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4)),
+    transport: "exec",
+    jobFiles: "copied"
   };
+  const secrets = secretsOf(runtime, jobDir);
   const envInput = {
     config,
     item: item.number,
@@ -2152,10 +2607,11 @@ async function provisionContainer(input) {
   const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`);
   if (input.aborted()) return bail("", true);
   mkdirSync(buildDir2, { recursive: true });
-  chmodSync(buildDir2, 493);
   const ghDir = ghConfigDir(buildDir2);
+  let readToken;
   try {
-    writeGhConfig(ghDir, await tokens.token("read"));
+    readToken = await tokens.token("read");
+    writeGhConfig(ghDir, readToken);
   } catch (err) {
     return bail(
       err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's gh configuration could not be written: ${describeCallFailure(err)}`
@@ -2172,9 +2628,11 @@ async function provisionContainer(input) {
   keepGhConfigCurrent(tokens, buildDir2, (err) => log.error(`${tag} the read token could not be written for gh: ${describeCallFailure(err)}`));
   tokens.markUsed("read");
   environment.credentials = tokens.used();
+  let services;
   try {
     const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
-    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote));
+    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "stream", input.leaseExpiryMs === void 0 ? void 0 : leaseFor(runtime, buildId, input.leaseExpiryMs));
+    runtime.tunnels.set(buildId, services);
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
@@ -2183,28 +2641,35 @@ async function provisionContainer(input) {
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
   if (input.aborted()) return bail("", true);
-  const judgeDir = join(jobDir, "judge");
-  mkdirSync(judgeDir, { recursive: true });
-  chmodSync(judgeDir, 493);
   const runInput = {
     buildId,
     runnerId,
     container: name,
     volume: name,
-    buildDir: buildDir2,
     image: report.imageId,
     user: ADDED_USER,
     limits: limits2,
     destinations: config.build?.destinations?.length ?? 0,
     builtIns: true,
-    judgeDir
+    transport: "exec",
+    jobFiles: "copied"
   };
   const prepared = await host.run(prepareRunArgs(runInput), { logPath });
   if (prepared.status !== 0) return dockerFailed("preparing the build's volume", prepared);
   const started = await host.run(containerRunArgs(runInput), { logPath });
   if (started.status !== 0) return dockerFailed("starting the build's container", started);
+  joinBuild(runtime, state, services, (line) => log.line(`${tag} ${line}`));
   if (input.aborted()) return bail("", true);
   if (!await waitForRelay(runtime, state)) return bail("the relay in the build's container did not start");
+  const ghDelivered = await deliverGhConfig(runtime, state, secrets);
+  if (!ghDelivered.ok) return bail(ghDelivered.reason);
+  keepGhConfigCurrent(tokens, buildDir2, (err) => log.error(`${tag} the read token could not be written for gh: ${describeCallFailure(err)}`), {
+    runtime,
+    state,
+    secrets,
+    delivered: readToken,
+    onFailure: (reason) => log.error(`${tag} ${reason}`)
+  });
   const imageConfig = await host.imageConfig(report.imageId);
   state.imageEnv = imageConfig.env;
   let agentUser;
@@ -2243,7 +2708,7 @@ async function provisionContainer(input) {
     log,
     tag,
     aborted: input.aborted,
-    // The control plane is read on the host, with a token the gateway issues (or the host's git login when it has no GitHub App). The container reads the staged files from its mount of the build's directory.
+    // The control plane is read on the host, with a token the gateway issues (or the host's git login when it has no GitHub App). The staged files are copied into the container.
     stageContext: () => stageGovernedContext({
       config,
       repository,
@@ -2256,6 +2721,10 @@ async function provisionContainer(input) {
       log,
       tag
     }),
+    deliverContext: async () => {
+      const delivered = await deliverJobFiles(runtime, state, ["context"], secrets);
+      return delivered.ok ? delivered : { ok: false, reason: `context_unavailable: ${delivered.reason}` };
+    },
     removeStagedContext: () => removeStagedContext(buildDir2)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
@@ -2274,7 +2743,7 @@ function agentVersionOf(toolsJson) {
 function shellQuote(word) {
   return /^[A-Za-z0-9_@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
 }
-function containerCommandLine(input) {
+function containerCommandExec(input) {
   const state = input.job.container;
   const env = buildEnvironment({
     config: input.config,
@@ -2289,16 +2758,13 @@ function containerCommandLine(input) {
     identity: input.job.commitIdentity,
     imageEnv: state.imageEnv
   });
-  const args = containerExecArgs({
+  return {
     container: state.container,
     user: state.agentUser ?? ADDED_USER,
     workdir: CHECKOUT_DIR,
     env,
-    argv: ["/bin/sh", "-c", commandWithShim(input.job, input.cmdline)]
-  });
-  return {
-    line: ["docker", "exec", ...args].map(shellQuote).join(" "),
-    env: { ...childEnvironment(input.runtime.hostEnv), ...env.passed }
+    argv: ["outerlayer", "build-command", "--", "/bin/sh", "-c", commandWithShim(input.job, input.cmdline)],
+    detached: true
   };
 }
 function containerSenderCommand(input) {
@@ -2329,15 +2795,22 @@ function senderSignalScript(pidfile, signal) {
   const file = shellQuote(pidfile);
   return `p="$(cat ${file})" && [ -n "$p" ] && grep -qa session-sender "/proc/$p/cmdline" && kill -${signal} "$p"`;
 }
+function senderAliveScript(pidfile) {
+  const file = shellQuote(pidfile);
+  return `p="$(cat ${file})" && [ -n "$p" ] && grep -qa session-sender "/proc/$p/cmdline" && echo alive`;
+}
 async function signalInContainer(runtime, state, pidfile, signal) {
-  await runtime.host.exec({
+  const { status } = await runtime.host.exec({
     container: state.container,
     user: state.agentUser ?? ADDED_USER,
     env: NO_ENV,
     argv: ["/bin/sh", "-c", senderSignalScript(pidfile, signal)]
   });
+  return status === 0;
 }
 async function stopContainer(runtime, state) {
+  runtime.leases.get(state.buildId)?.stop();
+  await leaveBuild(runtime, state);
   await runtime.host.stop(state.container);
   state.stopped = true;
 }
@@ -2350,7 +2823,7 @@ async function measureDisk(runtime, state) {
   });
   return result.status === 0 ? parseDuKilobytes(result.stdout) : void 0;
 }
-async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote) {
+async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote, serve = "socket", lease) {
   return startBuildServices({
     startTunnel: runtime.startTunnel,
     tunnelOptions: { ...runtime.tunnelOptions, ...gitRemote === void 0 ? {} : { gitRemote } },
@@ -2358,28 +2831,58 @@ async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, bui
     jobDir,
     destinations: config.build?.destinations ?? [],
     allowHosts: config.build?.allowHosts,
-    serve: "socket",
+    serve,
+    ...lease === void 0 ? {} : { lease },
     ...builtIns ? { builtIns: { gatewayUrl: config.url, itemKey, claudeUpstream: runtime.claudeUpstream } } : {},
     hostEnv: runtime.hostEnv,
     destinationOptions: runtime.destinationOptions
   });
 }
-async function ensureTunnel(runtime, state, jobDir, config, itemKey, branch, repositories) {
+function leaseFor(runtime, buildId, expiryMs) {
+  let channel = runtime.leases.get(buildId);
+  if (channel === void 0) {
+    channel = createLeaseChannel(expiryMs);
+    runtime.leases.set(buildId, channel);
+  }
+  return channel;
+}
+async function ensureTunnel(runtime, state, jobDir, config, itemKey, branch, repositories, log, leaseExpiryMs) {
   if (runtime.tunnels.has(state.buildId)) return;
+  const transport = transportOf(state);
+  if (transport === "unknown") {
+    runtime.relayFatal.set(state.buildId, UNKNOWN_TRANSPORT_REASON);
+    return;
+  }
   const tokens = runtime.credentials.get(jobDir);
   const served = repositoriesOf({ repositories, repository: state.repository, branch });
   const gitRemote = tokens === void 0 || served.length === 0 ? void 0 : gitRemoteFor(runtime, { repositories: served, tokens, buildDir: state.buildDir });
-  runtime.tunnels.set(state.buildId, await startServicesFor(runtime, config, state.buildDir, jobDir, itemKey, state.builtIns === true, gitRemote));
+  const lease = transport === "exec" && leaseExpiryMs !== void 0 ? leaseFor(runtime, state.buildId, leaseExpiryMs) : void 0;
+  if (state.stopped === true) lease?.stop();
+  const services = await startServicesFor(runtime, config, state.buildDir, jobDir, itemKey, state.builtIns === true, gitRemote, transport === "exec" ? "stream" : "socket", lease);
+  runtime.tunnels.set(state.buildId, services);
+  if (transport === "exec") joinBuild(runtime, state, services, log);
+}
+async function redeliver(runtime, state, jobDir) {
+  if (!filesAreCopied(state)) return { ok: true };
+  const parts = ["gh", "git-hooks", "context"];
+  return deliverJobFiles(runtime, state, parts, secretsOf(runtime, jobDir));
+}
+async function deliverContainerHooks(runtime, state, jobDir) {
+  if (!filesAreCopied(state)) return { ok: true };
+  return deliverJobFiles(runtime, state, ["git-hooks"], secretsOf(runtime, jobDir));
 }
 async function syncInContainer(input) {
   const { runtime, job } = input;
   const state = job.container;
   try {
-    await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch, job.repositories);
+    await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch, job.repositories, input.log, () => leaseExpiresAtMs(job));
     if (state.stopped) {
       await runtime.host.start(state.container);
       state.stopped = false;
       if (!await waitForRelay(runtime, state)) return { ok: false, reason: "the relay did not start again" };
+      rejoinBuild(runtime, state, input.log);
+      const delivered = await redeliver(runtime, state, input.jobDir);
+      if (!delivered.ok) return { ok: false, reason: delivered.reason };
     }
     const env = buildEnvironment({
       config: input.config,
@@ -2430,6 +2933,10 @@ async function copyHookErrors(runtime, state, jobDir) {
 async function cleanupContainer(runtime, state, jobDir) {
   const failures = [];
   if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
+  await leaveBuild(runtime, state);
+  runtime.relayFatal.delete(state.buildId);
+  runtime.leases.get(state.buildId)?.close();
+  runtime.leases.delete(state.buildId);
   const removedContainer = await runtime.host.remove(state.container);
   if (removedContainer.status !== 0 && !/no such container/i.test(removedContainer.stderr)) {
     failures.push(`container ${state.container} was not removed: ${removedContainer.stderr.trim()}`);
@@ -2457,12 +2964,15 @@ function containerJudgeEnvironment(input) {
   const folder = join(input.jobDir, "judge");
   return {
     stop: async () => {
-      if (input.config !== void 0) await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch, job.repositories);
+      if (input.config !== void 0) await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch, job.repositories, input.log);
       await stopContainer(runtime, state);
       const started = await runtime.host.start(state.container);
       if (started.status !== 0) throw new Error(`the build's container could not be started again (exit ${started.status})`);
       state.stopped = false;
       if (!await waitForRelay(runtime, state)) throw new Error("the relay in the build's container did not start again");
+      rejoinBuild(runtime, state, input.log);
+      const delivered = await redeliver(runtime, state, input.jobDir);
+      if (!delivered.ok) throw new Error(delivered.reason);
     },
     hashProgram: async () => {
       const ran = await runtime.host.exec({ container: state.container, user: ADDED_USER, env: NO_ENV, argv: [...HASH_ARGV] });
@@ -2470,6 +2980,20 @@ function containerJudgeEnvironment(input) {
       return sha256 === void 0 ? { ok: false, reason: firstLine5(ran.stderr) || `the hash could not be taken (exit ${ran.status})` } : { ok: true, sha256 };
     },
     prepare: async (files, tree) => {
+      if (filesAreCopied(state)) {
+        const staging = join(input.jobDir, "judge-input");
+        rmSync(staging, { recursive: true, force: true });
+        mkdirSync(join(staging, "home", "tmp"), { recursive: true });
+        try {
+          for (const [fileName, text] of Object.entries(files)) writeFileSync(join(staging, fileName), text, { mode: 420 });
+          if (tree !== void 0) copyJudgeTree(tree, join(staging, "tree"));
+          const delivered = await deliverJudgeInputs(runtime, state, staging, secretsOf(runtime, input.jobDir));
+          if (!delivered.ok) throw new Error(delivered.reason);
+        } finally {
+          rmSync(staging, { recursive: true, force: true });
+        }
+        return;
+      }
       mkdirSync(folder, { recursive: true });
       for (const entry of readdirSync(folder)) rmSync(join(folder, entry), { recursive: true, force: true });
       mkdirSync(join(folder, "home", "tmp"), { recursive: true });
@@ -2480,12 +3004,26 @@ function containerJudgeEnvironment(input) {
       chmodSync(folder, 1023);
     },
     run: (command, opts) => runtime.host.exec({ container: state.container, user, workdir: command.cwd, env: { literals: command.env, passed: {} }, argv: command.argv }, { logPath: opts.logPath }),
-    readReport: async () => readRegularFile(join(folder, "report.html"), MAX_REPORT_BYTES),
+    readReport: async () => {
+      if (!filesAreCopied(state)) return readRegularFile(join(folder, "report.html"), MAX_REPORT_BYTES);
+      const file = JUDGE_REPORT;
+      const read = await runtime.host.exec({
+        container: state.container,
+        user,
+        env: NO_ENV,
+        argv: ["/bin/sh", "-c", `[ -f ${file} ] && [ ! -L ${file} ] && head -c ${MAX_REPORT_BYTES + 1} ${file}`]
+      }, { timeoutMs: REPORT_READ_TIMEOUT_MS });
+      if (read.status > 1) throw new Error(`reading the judge report exited ${read.status}: ${firstLine5(read.stderr)}`);
+      return read.status === 0 && Buffer.byteLength(read.stdout) <= MAX_REPORT_BYTES ? read.stdout : void 0;
+    },
     // The judge's files belong to the build's user, and Claude Code makes some of its folders private to it, so the runner's user cannot remove them from the
     // host. Every capability is dropped in the container, so root there could not either; the build's user removes its own, and the runner removes the rest.
     clear: async () => {
       const removed = await runtime.host.exec({ container: state.container, user, env: NO_ENV, argv: ["find", JUDGE_DIR, "-mindepth", "1", "-user", user, "-delete"] });
       if (removed.status !== 0) throw new Error(`find exited ${removed.status}: ${firstLine5(removed.stderr)}`);
+      if (!filesAreCopied(state)) return;
+      const emptied = await clearJudgeFolder(runtime, state, secretsOf(runtime, input.jobDir));
+      if (!emptied.ok) throw new Error(emptied.reason);
     }
   };
 }
@@ -2511,7 +3049,21 @@ async function startCheckContainer(input) {
   const buildDir2 = buildDir(config.configPath, buildId);
   const agentUser = built.agentUser ?? ADDED_USER;
   const cpuset = built.cpuset ?? formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4));
-  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, imageEnv: built.imageEnv, agentUser, cpuset };
+  const transport = transportOf(built);
+  if (transport === "unknown") return { ok: false, reason: UNKNOWN_TRANSPORT_REASON };
+  const state = {
+    buildId,
+    container: name,
+    volume: name,
+    buildDir: buildDir2,
+    repository,
+    imageId: built.imageId,
+    imageEnv: built.imageEnv,
+    agentUser,
+    cpuset,
+    transport,
+    ...transport === "exec" ? { jobFiles: "copied" } : {}
+  };
   const checksDir = join(jobDir, "checks");
   mkdirSync(checksDir, { recursive: true });
   const logPath = join(checksDir, "environment.log");
@@ -2526,7 +3078,8 @@ async function startCheckContainer(input) {
   };
   const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`);
   mkdirSync(buildDir2, { recursive: true });
-  chmodSync(buildDir2, 493);
+  if (!filesAreCopied(state)) chmodSync(buildDir2, 493);
+  let services;
   try {
     const gitRemote = gitRemoteFor(runtime, {
       repositories: repositoriesOf({ repositories: job.repositories, repository, branch: job.branch }),
@@ -2535,7 +3088,8 @@ async function startCheckContainer(input) {
       log: (line) => log.line(`${tag} ${line}`),
       readOnly: true
     });
-    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote));
+    services = await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote, transport === "exec" ? "stream" : "socket");
+    runtime.tunnels.set(buildId, services);
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
@@ -2548,33 +3102,59 @@ async function startCheckContainer(input) {
     runnerId,
     container: name,
     volume: name,
-    buildDir: buildDir2,
+    ...filesAreCopied(state) ? { jobFiles: "copied" } : { buildDir: buildDir2 },
     image: built.imageId,
     user: ADDED_USER,
     limits: limits2,
     destinations: config.build?.destinations?.length ?? 0,
-    builtIns: false
+    builtIns: false,
+    transport
   };
   const prepared = await host.run(prepareRunArgs(runInput), { logPath });
   if (prepared.status !== 0) return dockerFailed("preparing the check environment's volume", prepared);
   const started = await host.run(containerRunArgs(runInput), { logPath });
   if (started.status !== 0) return dockerFailed("starting the check environment's container", started);
+  if (transport === "exec") joinBuild(runtime, state, services, (line) => log.line(`${tag} ${line}`));
   if (!await waitForRelay(runtime, state)) return fail("the relay in the check environment's container did not start");
   const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {}, imageEnv: built.imageEnv });
+  const secrets = () => tokens.issuedTokens();
+  let delivered = false;
+  const deliverInput = async () => {
+    const result = await deliverEvalInput(runtime, state, secrets);
+    if (result.ok) delivered = true;
+    return result;
+  };
   return {
     ok: true,
     container: {
       state,
-      // The directory the container sees read-only at `JOB_MOUNT` is the build's directory on the host, so a folder written there is already in place.
-      evalInput: { dir: join(buildDir2, EVAL_INPUT_NAME), deliver: async () => void 0 },
+      // A container that mounts the build's directory already has the folder the runner wrote there; any other is given a copy.
+      evalInput: {
+        dir: join(buildDir2, EVAL_INPUT_NAME),
+        deliver: async () => {
+          if (!filesAreCopied(state)) return;
+          const result = await deliverInput();
+          if (!result.ok) throw new DeliveryFailure(result.reason);
+        }
+      },
       exec: (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env, argv }, opts?.logPath === void 0 ? void 0 : { logPath: opts.logPath }),
       restart: async () => {
+        await leaveBuild(runtime, state);
         await host.stop(name);
         const again = await host.start(name);
-        return again.status === 0 && await waitForRelay(runtime, state);
+        if (again.status !== 0 || !await waitForRelay(runtime, state)) return false;
+        rejoinBuild(runtime, state, (line) => log.line(`${tag} ${line}`));
+        if (delivered) {
+          const again2 = await deliverInput();
+          if (!again2.ok) {
+            log.error(`${tag} ${again2.reason}`);
+            return false;
+          }
+        }
+        return true;
       }
     }
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, EVAL_INPUT_NAME, GH_CONFIG_YML, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandLine, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, deleteBuildDisk, ensureRootfs, ensureTunnel, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, resolveAgentUser, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, deleteBuildDisk, deliverContainerHooks, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };