@outerlayer/cli 0.20.0 → 0.22.0

package/dist/chunk-WERZMIKA.js

@@ -0,0 +1,718 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RecipeError, BUILDKIT_IMAGE } from './chunk-3W333NFO.js';
+import { parseSize } from './chunk-7RQ73DLO.js';
+import { compareVersions } from './chunk-AEKSX4EY.js';
+import { ensureHostKey } from './chunk-KDHYLBRR.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-KIGSGZBB.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-V7MQKOZY.js';
+import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-GISNHSYL.js';
+import { StringDecoder } from 'string_decoder';
+import { spawn } from 'child_process';
+import { existsSync, readFileSync, mkdirSync, createWriteStream, rmSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';
+import { dirname, join, resolve } from 'path';
+import { createHash } from 'crypto';
+import { createRequire as createRequire$1 } from 'module';
+import { fileURLToPath } from 'url';
+
+createRequire(import.meta.url);
+var ITEM_KEY_FILE = "item-key";
+function itemKeyPath(jobPath) {
+  return join(dirname(jobPath), ITEM_KEY_FILE);
+}
+function withItemKey(jobPath, job) {
+  let key;
+  try {
+    key = readFileSync(itemKeyPath(jobPath), "utf8").trim();
+  } catch {
+    return job;
+  }
+  return key === "" ? job : { ...job, itemKey: key };
+}
+function writeOwnerOnly(path, content) {
+  if (existsSync(path)) chmodSync(path, RUNNER_FILE_MODE);
+  writeFileSync(path, content, { mode: RUNNER_FILE_MODE });
+}
+function readJobFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return withItemKey(path, JSON.parse(readFileSync(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function readJobFileChecked(path) {
+  if (!existsSync(path)) return { kind: "missing" };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { kind: "unreadable" };
+    return { kind: "ok", job: withItemKey(path, parsed) };
+  } catch {
+    return { kind: "unreadable" };
+  }
+}
+function writeJobFile(path, job) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  const { itemKey, ...rest } = job;
+  if (itemKey !== void 0) writeOwnerOnly(itemKeyPath(path), itemKey);
+  writeOwnerOnly(path, JSON.stringify(rest, null, 2));
+}
+
+// src/runner/runner-identity.ts
+var RUNNER_LABEL = "ai.outerlayer.runner";
+var IDENTITY_FILE = "identity.json";
+function identityPath(configPath) {
+  return join(runnerDir(configPath), IDENTITY_FILE);
+}
+function resolvedRunnerDir(configPath) {
+  try {
+    return realpathSync(runnerDir(configPath));
+  } catch {
+    try {
+      return join(realpathSync(dirname(resolve(configPath))), "runner");
+    } catch {
+      return resolve(runnerDir(configPath));
+    }
+  }
+}
+function shortHash(text) {
+  return createHash("sha256").update(text).digest("hex").slice(0, 12);
+}
+function pathLabelValue(configPath) {
+  return shortHash(resolvedRunnerDir(configPath));
+}
+function builderNameFor(label) {
+  return `outerlayer-${label}`;
+}
+function readRunnerIdentity(configPath) {
+  try {
+    const parsed = JSON.parse(readFileSync(identityPath(configPath), "utf8"));
+    return typeof parsed.label === "string" && /^[0-9a-f]{12}$/.test(parsed.label) && typeof parsed.builder === "string" && parsed.builder !== "" ? { label: parsed.label, builder: parsed.builder } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function dockerIdentity(run = spawnRun) {
+  return {
+    async holdsObjects(label, builder) {
+      const filter = `label=${RUNNER_LABEL}=${label}`;
+      for (const args of [["ps", "--all", "--quiet", "--filter", filter], ["volume", "ls", "--quiet", "--filter", filter]]) {
+        const listed = await run("docker", args);
+        if (listed.status !== 0) return void 0;
+        if (listed.stdout.trim() !== "") return true;
+      }
+      const inspected = await run("docker", ["buildx", "inspect", builder]);
+      if (inspected.status === 0) return true;
+      return /no builder .* found/i.test(inspected.stderr) ? false : void 0;
+    }
+  };
+}
+function folderHoldsContainerBuilds(configPath) {
+  const root = jobsDir(configPath);
+  if (!existsSync(root)) return false;
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const job = readJobFile(join(root, entry.name, "job.json"));
+    if (job?.container !== void 0 || job?.checkContainer !== void 0) return true;
+  }
+  return false;
+}
+function writeIdentity(configPath, identity) {
+  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  const target = identityPath(configPath);
+  const partial = `${target}.partial`;
+  writeFileSync(partial, `${JSON.stringify(identity)}
+`, { mode: RUNNER_FILE_MODE });
+  renameSync(partial, target);
+}
+async function ensureRunnerIdentity(configPath, deps = {}) {
+  const stored = readRunnerIdentity(configPath);
+  if (stored !== void 0) return stored;
+  const legacyLabel = pathLabelValue(configPath);
+  const legacy = { label: legacyLabel, builder: builderNameFor(legacyLabel) };
+  let keepLegacy = folderHoldsContainerBuilds(configPath);
+  if (!keepLegacy) {
+    const held = await (deps.docker ?? dockerIdentity()).holdsObjects(legacy.label, legacy.builder);
+    if (held === void 0) {
+      deps.log?.("Docker could not be asked what it holds under this runner's names \xB7 using the names its folder's path gives");
+      return void 0;
+    }
+    keepLegacy = held;
+  }
+  if (keepLegacy) {
+    writeIdentity(configPath, legacy);
+    return legacy;
+  }
+  const key = await ensureHostKey(configPath);
+  const label = shortHash(key.fingerprint);
+  const identity = { label, builder: builderNameFor(label) };
+  writeIdentity(configPath, identity);
+  return identity;
+}
+
+// src/runner/judge-command.ts
+var JUDGE_DIR = "/outerlayer/judge";
+var JUDGE_HOME = `${JUDGE_DIR}/home`;
+var JUDGE_TREE = `${JUDGE_DIR}/tree`;
+var JUDGE_REPORT = `${JUDGE_DIR}/report.html`;
+var JUDGE_PROGRAM = "/opt/outerlayer/claude/bin/claude";
+var MAX_REPORT_BYTES = 5 * 1024 * 1024;
+var JUDGE_MAX_TURNS = 60;
+var JUDGE_PATH = "/opt/outerlayer/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var JUDGE_TOOLS = "Read,Grep,Glob,Write";
+function judgeCommand(input) {
+  const env = {
+    HOME: JUDGE_HOME,
+    TMPDIR: `${JUDGE_HOME}/tmp`,
+    PATH: JUDGE_PATH,
+    ANTHROPIC_BASE_URL: `http://127.0.0.1:${CLAUDE_PORT}`,
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+    DISABLE_AUTOUPDATER: "1",
+    ...input.credential === void 0 ? {} : { [input.credential.variable]: input.credential.placeholder }
+  };
+  const argv = [
+    JUDGE_PROGRAM,
+    "-p",
+    "--output-format",
+    "json",
+    "--setting-sources",
+    "user",
+    "--strict-mcp-config",
+    "--disable-slash-commands",
+    "--no-session-persistence",
+    "--tools",
+    JUDGE_TOOLS,
+    "--allowedTools",
+    // A path that starts with two slashes is absolute in a permission rule.
+    `Read(/${JUDGE_DIR}/**),Edit(/${JUDGE_REPORT})`,
+    "--add-dir",
+    JUDGE_TREE,
+    "--permission-mode",
+    "dontAsk",
+    "--max-turns",
+    String(JUDGE_MAX_TURNS),
+    // After the separator, so a brief that starts with a dash is not read as an option.
+    "--",
+    input.brief
+  ];
+  return { argv, env, cwd: JUDGE_DIR };
+}
+var HASH_SCRIPT = 'const fs=require("fs"),c=require("crypto");const p=fs.realpathSync(process.argv[1]);process.stdout.write(c.createHash("sha256").update(fs.readFileSync(p)).digest("hex")+" "+p+"\\n")';
+var HASH_ARGV = ["/opt/outerlayer/bin/node", "-e", HASH_SCRIPT, JUDGE_PROGRAM];
+function parseProgramHash(stdout) {
+  return /^([0-9a-f]{64}) /.exec(stdout.trim())?.[1];
+}
+
+// src/runner/container/run-args.ts
+var COMMAND_DIR = "/build/.command";
+var BUILD_LABEL = "ai.outerlayer.build";
+function runnerLabelValue(configPath) {
+  return readRunnerIdentity(configPath)?.label ?? pathLabelValue(configPath);
+}
+function hardened(input) {
+  const { memory, cpus, pids, cpuset } = input.limits;
+  return [
+    "--label",
+    `${BUILD_LABEL}=${input.buildId}`,
+    "--label",
+    `${RUNNER_LABEL}=${input.runnerId}`,
+    "--network",
+    "none",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--read-only",
+    "--user",
+    input.user,
+    // The same figure for swap as for memory leaves the container none.
+    "--memory",
+    memory,
+    "--memory-swap",
+    memory,
+    "--cpus",
+    String(cpus),
+    ...cpuset === void 0 ? [] : ["--cpuset-cpus", cpuset],
+    "--pids-limit",
+    String(pids)
+  ];
+}
+function mountPath(path) {
+  if (/[",]/.test(path)) throw new Error(`${path} holds a comma or a quote, which a Docker mount cannot carry; move the runner's config file`);
+  return path;
+}
+function mountedDir(dir, what) {
+  if (dir === void 0) throw new Error(`${what} is required for a build whose files are not copied`);
+  return dir;
+}
+function containerRunArgs(input) {
+  const exec = input.transport === "exec";
+  const copied = input.jobFiles === "copied";
+  if (copied && !exec) throw new Error("a build's files are copied in only through docker exec");
+  return [
+    "--detach",
+    "--name",
+    input.container,
+    ...hardened(exec ? { ...input, user: RELAY_USER } : input),
+    // Only the relay's user can open the folder the joining socket is in.
+    ...exec ? ["--tmpfs", `${JOIN_DIR}:mode=0700,uid=${RELAY_ID},gid=${RELAY_ID}`] : [],
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
+    "--mount",
+    `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
+    ...copied ? [
+      // Owned by the relay's user, who writes the files in; the agent can read them and cannot change them. `exec` so the commit hooks can run.
+      "--tmpfs",
+      `${JOB_MOUNT}:exec,mode=0755,uid=${RELAY_ID},gid=${RELAY_ID}`,
+      // The judge runs in the build's own container, so only a container that has the built-in services has the folder.
+      ...input.builtIns === true ? ["--tmpfs", `${JUDGE_DIR}:mode=0755,uid=${RELAY_ID},gid=${RELAY_ID}`] : []
+    ] : [
+      "--mount",
+      `type=bind,src=${mountPath(mountedDir(input.buildDir, "buildDir"))},dst=${JOB_MOUNT},readonly`,
+      ...input.judgeDir === void 0 ? [] : ["--mount", `type=bind,src=${mountPath(input.judgeDir)},dst=${JUDGE_DIR}`]
+    ],
+    "--entrypoint",
+    "/opt/outerlayer/bin/tini",
+    input.image,
+    "--",
+    "/opt/outerlayer/bin/node",
+    "/opt/outerlayer/cli/dist/index.js",
+    "broker-relay",
+    "--port",
+    String(RELAY_PORT),
+    // With `--lease-watchdog` the relay stops the container when the runner stops renewing the build's lease.
+    ...exec ? ["--join", JOIN_SOCKET, "--lease-watchdog"] : ["--socket", `${JOB_MOUNT}/tunnel.sock`],
+    ...Array.from({ length: input.destinations ?? 0 }, (_unused, index) => [
+      "--forward",
+      `${DESTINATION_BASE_PORT + index}=${exec ? destinationTarget(index) : `${JOB_MOUNT}/dest-${index}.sock`}`
+    ]).flat(),
+    ...input.builtIns === true ? [
+      "--forward",
+      `${GATEWAY_PORT}=${exec ? TARGET_GATEWAY : `${JOB_MOUNT}/${GATEWAY_SOCKET}`}`,
+      "--forward",
+      `${CLAUDE_PORT}=${exec ? TARGET_CLAUDE : `${JOB_MOUNT}/${CLAUDE_SOCKET}`}`
+    ] : []
+  ];
+}
+function prepareRunArgs(input) {
+  return [
+    "--rm",
+    ...hardened(input),
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    "--entrypoint",
+    "mkdir",
+    input.image,
+    "-p",
+    "-m",
+    "1777",
+    "/build/tmp",
+    "/build/home",
+    "/build/work",
+    COMMAND_DIR
+  ];
+}
+function containerExecArgs(input) {
+  const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
+  const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
+  return [
+    ...input.detached === true ? ["-d"] : [],
+    ...input.interactive === true || input.stdin !== void 0 ? ["-i"] : [],
+    "-u",
+    input.user,
+    ...input.workdir === void 0 ? [] : ["-w", input.workdir],
+    ...literals,
+    ...passed,
+    input.container,
+    ...input.argv
+  ];
+}
+
+// src/runner/image/builder.ts
+var MIN_BUILDX_VERSION = "0.18.0";
+var INSTALL_HINT = "install Docker's Buildx plugin (docker-buildx-plugin on Debian and Ubuntu with Docker's apt repository, docker-buildx on Ubuntu's own packages)";
+function builderName(configPath) {
+  return readRunnerIdentity(configPath)?.builder ?? builderNameFor(runnerLabelValue(configPath));
+}
+function proxyEnvironment(env) {
+  const found = {};
+  for (const name of ["HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy"]) {
+    const value = env[name];
+    if (value !== void 0 && value !== "") found[name] = value;
+  }
+  return found;
+}
+function builderSpec(configPath, memory, env) {
+  return { name: builderName(configPath), memory, env: proxyEnvironment(env) };
+}
+function driverOpt(pair) {
+  return /[",]/.test(pair) ? `"${pair.replace(/"/g, '""')}"` : pair;
+}
+async function buildxState(run) {
+  const result = await run("docker", ["buildx", "version"]);
+  if (result.status !== 0) {
+    const said = (result.stderr.trim() || result.stdout.trim()).split("\n")[0] ?? "";
+    return { problem: `docker buildx is not available${said === "" ? "" : ` (${said})`}, so image builds cannot be limited; ${INSTALL_HINT}` };
+  }
+  const version = /\bv?(\d+\.\d+\.\d+)/.exec(result.stdout)?.[1];
+  if (version !== void 0 && compareVersions(version, MIN_BUILDX_VERSION) < 0) {
+    return { problem: `docker buildx ${version} is too old: the runner's image builder needs Buildx ${MIN_BUILDX_VERSION} or later; update ${INSTALL_HINT}` };
+  }
+  return "usable";
+}
+function isOutOfMemory(output) {
+  if (/cannot allocate memory/i.test(output)) return true;
+  if (/did not complete successfully: (exit code: 137|signal: killed)/i.test(output)) return true;
+  return /ResourceExhausted/i.test(output) && !/larger than max|message size|too large/i.test(output);
+}
+var running = 0;
+async function trackImageBuild(work) {
+  running++;
+  try {
+    return await work();
+  } finally {
+    running--;
+  }
+}
+var queue = Promise.resolve();
+function serialized(work) {
+  const next = queue.then(work, work);
+  queue = next.catch(() => void 0);
+  return next;
+}
+function readExisting(inspectOutput) {
+  const options = /^Driver Options:\s*(.*)$/m.exec(inspectOutput)?.[1] ?? "";
+  const option = (key) => new RegExp(`(?:^|\\s)${key}="([^"]*)"`).exec(options)?.[1];
+  return { driver: /^Driver:\s*(\S+)/m.exec(inspectOutput)?.[1], memory: option("memory"), image: option("image") };
+}
+function sameMemory(found, wanted) {
+  return (parseSize(found) ?? found) === (parseSize(wanted) ?? wanted);
+}
+var IDLE_POLL_MS = 1e3;
+var failures = 0;
+function ensureFailureCount() {
+  return failures;
+}
+function ensureBuilder(rawRun, spec, options = {}) {
+  const run = (command, args, opts) => rawRun(command, args, { ...opts, timeoutMs: args.includes("--bootstrap") ? 15 * 6e4 : 2 * 6e4 });
+  const result = serialized(async () => {
+    const state = await buildxState(run);
+    if (state !== "usable") return { ok: false, problem: state.problem };
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+    const inspected = await run("docker", ["buildx", "inspect", spec.name]);
+    let create = inspected.status !== 0;
+    if (!create) {
+      const found = readExisting(inspected.stdout);
+      const current = found.driver === "docker-container" && sameMemory(found.memory ?? "", spec.memory) && found.image === BUILDKIT_IMAGE;
+      if (!current && options.replaceStale === false) {
+        return {
+          ok: false,
+          problem: `the image builder ${spec.name} was made with other settings than runner.build.memory (${spec.memory}) and the pinned BuildKit image; the runner service replaces it when no build is running, or remove it with docker buildx rm ${spec.name}`
+        };
+      }
+      if (!current) {
+        if (options.waitForIdle === true) while (running > 0) await sleep(IDLE_POLL_MS);
+        if (running === 0) {
+          const removed = await run("docker", ["buildx", "rm", spec.name]);
+          if (removed.status !== 0) return { ok: false, problem: `could not replace the image builder ${spec.name}: ${removed.stderr.trim() || `docker exited ${removed.status}`}` };
+          create = true;
+        }
+      }
+    }
+    if (create) {
+      const opts = [
+        `memory=${spec.memory}`,
+        `memory-swap=${spec.memory}`,
+        `image=${BUILDKIT_IMAGE}`,
+        ...Object.entries(spec.env ?? {}).map(([name, value]) => `env.${name}=${value}`),
+        ...spec.driverOpts ?? []
+      ];
+      const created = await run("docker", [
+        "buildx",
+        "create",
+        "--name",
+        spec.name,
+        "--driver",
+        "docker-container",
+        ...opts.flatMap((opt) => ["--driver-opt", driverOpt(opt)])
+      ]);
+      if (created.status !== 0) {
+        const said = created.stderr.trim() || `docker exited ${created.status}`;
+        if (/failed to find driver/i.test(said)) {
+          return { ok: false, problem: `this Docker's Buildx has no docker-container driver, so image builds cannot be limited; ${INSTALL_HINT}` };
+        }
+        return { ok: false, problem: `could not create the image builder ${spec.name}: ${said}` };
+      }
+    }
+    if (options.bootstrap === true) {
+      const started = await run("docker", ["buildx", "inspect", "--bootstrap", spec.name]);
+      if (started.status !== 0) {
+        return { ok: false, problem: `the image builder ${spec.name} did not start: ${started.stderr.trim() || `docker exited ${started.status}`}` };
+      }
+    }
+    return { ok: true, changed: create };
+  });
+  return result.then(
+    (outcome) => {
+      if (!outcome.ok) failures++;
+      return outcome;
+    },
+    (err) => {
+      failures++;
+      throw err;
+    }
+  );
+}
+var PACKAGE = "@devcontainers/cli";
+function buildRootFromDist(moduleDir = dirname(fileURLToPath(import.meta.url))) {
+  try {
+    const info = JSON.parse(readFileSync(join(moduleDir, "build-info.json"), "utf8"));
+    return typeof info.root === "string" ? info.root : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveDevcontainerCli(opts = {}) {
+  const resolve2 = opts.resolve ?? createRequire$1(import.meta.url).resolve;
+  try {
+    const bin = join(dirname(resolve2(`${PACKAGE}/package.json`)), "devcontainer.js");
+    if (existsSync(bin)) return { command: process.execPath, args: [bin] };
+  } catch {
+  }
+  const buildRoot = opts.buildRoot ?? buildRootFromDist();
+  const fallback = buildRoot === void 0 ? void 0 : join(buildRoot, "node_modules", PACKAGE);
+  if (fallback !== void 0 && existsSync(join(fallback, "devcontainer.js"))) {
+    return { command: process.execPath, args: [join(fallback, "devcontainer.js")] };
+  }
+  throw new RecipeError(
+    "devcontainer_cli_missing",
+    `the devcontainer CLI is not installed: looked beside this package and in ${fallback ?? "the checkout this build came from (unknown)"}. Run yarn install in that checkout.`
+  );
+}
+function devcontainerBuildInvocation(cli, req) {
+  return {
+    command: cli.command,
+    args: [
+      ...cli.args,
+      "build",
+      "--workspace-folder",
+      req.workspace,
+      "--config",
+      req.config,
+      "--image-name",
+      req.imageName,
+      ...Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+      "--log-format",
+      "text",
+      // Written as an OCI layout instead of loaded into Docker: the runner's builder cannot read Docker's image store, so the next layer starts FROM the layout.
+      ...req.layoutOut === void 0 ? [] : ["--output", `type=oci,dest=${req.layoutOut},tar=false`]
+    ]
+  };
+}
+
+// src/runner/image/docker.ts
+var CHILD_ENVIRONMENT_NAMES = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "LANG",
+  "LC_ALL",
+  "DOCKER_HOST",
+  "DOCKER_CONFIG",
+  "DOCKER_CONTEXT",
+  "DOCKER_CERT_PATH",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_API_VERSION",
+  "DOCKER_BUILDKIT",
+  // `docker buildx build` fetches registry tokens in the client and hands them to the builder, so a host that reaches
+  // registries through a proxy needs it here as well as in the builder.
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "XDG_RUNTIME_DIR",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_STATE_HOME"
+];
+function childEnvironment(base) {
+  const env = {};
+  for (const name of CHILD_ENVIRONMENT_NAMES) {
+    const value = base[name];
+    if (value !== void 0) env[name] = value;
+  }
+  return env;
+}
+var spawnRun = (command, args, opts = {}) => new Promise((resolve2) => {
+  let log;
+  if (opts.logPath !== void 0) {
+    mkdirSync(dirname(opts.logPath), { recursive: true });
+    log = createWriteStream(opts.logPath, { flags: "a" });
+  }
+  const stdoutDecoder = new StringDecoder("utf8");
+  const stderrDecoder = new StringDecoder("utf8");
+  let stdout = "";
+  let stderr = "";
+  let settled = false;
+  const finish = (status, extra = "") => {
+    if (settled) return;
+    settled = true;
+    const result = { status, stdout: stdout + stdoutDecoder.end(), stderr: stderr + stderrDecoder.end() + extra };
+    if (log === void 0) {
+      resolve2(result);
+      return;
+    }
+    if (extra) log.write(extra);
+    log.end(() => resolve2(result));
+  };
+  let timer;
+  const child = spawn(command, args, {
+    env: { ...childEnvironment(process.env), ...opts.env },
+    stdio: [opts.input === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
+  });
+  child.stdout.on("data", (chunk) => {
+    stdout += stdoutDecoder.write(chunk);
+    log?.write(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += stderrDecoder.write(chunk);
+    log?.write(chunk);
+  });
+  if (opts.timeoutMs !== void 0) {
+    timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(124, `${command}: no answer within ${Math.round(opts.timeoutMs / 1e3)}s
+`);
+    }, opts.timeoutMs);
+    timer.unref();
+  }
+  child.on("error", (err) => finish(127, `${command}: ${err.message}
+`));
+  child.on("close", (code, signal) => {
+    if (timer !== void 0) clearTimeout(timer);
+    finish(code ?? (signal ? 128 : 1));
+  });
+  if (opts.input !== void 0) {
+    child.stdin.on("error", () => void 0);
+    child.stdin.end(opts.input);
+  }
+});
+function toInfo(row) {
+  return { id: row.Id, createdAt: row.Created, labels: row.Config?.Labels ?? {} };
+}
+var lines = (text) => [...new Set(text.split("\n").map((l) => l.trim()).filter(Boolean))];
+function layoutDigest(layout) {
+  const index = JSON.parse(readFileSync(join(layout, "index.json"), "utf8"));
+  const digest = index.manifests?.[0]?.digest;
+  if (digest === void 0) throw new Error(`${join(layout, "index.json")} lists no image`);
+  return digest;
+}
+function outOfMemory(builder, logPath) {
+  return new RecipeError(
+    "image_build_out_of_memory",
+    `the image build ran out of memory: the kernel stopped a build step at the limit of runner.build.memory (${builder.memory}). Raise runner.build.memory, or lower what the recipe's build steps use; the build log is at ${logPath}`,
+    logPath
+  );
+}
+function createDockerHost(deps = {}) {
+  const run = deps.run ?? spawnRun;
+  const cli = deps.cli ?? resolveDevcontainerCli;
+  const builderFor = () => {
+    if (deps.builder === void 0) {
+      throw new Error("no image builder is configured, so the image build was not started: every image build runs in the runner's builder, which carries runner.build.memory");
+    }
+    return deps.builder;
+  };
+  const inspectMany = async (refs) => {
+    const result = await run("docker", ["image", "inspect", ...refs]);
+    return result.status === 0 ? JSON.parse(result.stdout).map(toInfo) : [];
+  };
+  return {
+    async inspect(ref) {
+      return (await inspectMany([ref]))[0] ?? null;
+    },
+    async list(repository) {
+      const ids = await run("docker", [
+        "image",
+        "ls",
+        "--all",
+        "--no-trunc",
+        "--quiet",
+        "--filter",
+        `label=ai.outerlayer.repository=${repository}`
+      ]);
+      const found = lines(ids.stdout);
+      return found.length === 0 ? [] : inspectMany(found);
+    },
+    async inUse() {
+      const containers = lines((await run("docker", ["ps", "--all", "--no-trunc", "--quiet"])).stdout);
+      if (containers.length === 0) return [];
+      return lines((await run("docker", ["inspect", "--format", "{{.Image}}", ...containers])).stdout);
+    },
+    async ensureBuilder() {
+      const builder = builderFor();
+      const result = await ensureBuilder(run, builder, { waitForIdle: true, replaceStale: deps.replaceStaleBuilder });
+      if (!result.ok) throw new RecipeError("image_builder_unavailable", `the image builder is unavailable: ${result.problem}`);
+      return { name: builder.name, memory: builder.memory };
+    },
+    async exportLayout(ref, dir) {
+      rmSync(dir, { recursive: true, force: true });
+      mkdirSync(dir, { recursive: true });
+      const archive = join(dir, ".image.tar");
+      const saved = await run("docker", ["save", "--output", archive, ref]);
+      if (saved.status !== 0) throw new Error(saved.stderr.trim() || `docker save ${ref} exited ${saved.status}`);
+      const unpacked = await run("tar", ["-xf", archive, "-C", dir]);
+      rmSync(archive, { force: true });
+      if (unpacked.status !== 0) throw new Error(unpacked.stderr.trim() || `tar exited ${unpacked.status}`);
+    },
+    async buildDockerfile(req) {
+      const builder = builderFor();
+      if (req.layoutOut !== void 0) {
+        rmSync(req.layoutOut, { recursive: true, force: true });
+      }
+      const labels = Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+      const args = [
+        "buildx",
+        "build",
+        "--builder",
+        builder.name,
+        "--load",
+        ...req.layoutOut === void 0 ? [] : ["--output", `type=oci,dest=${req.layoutOut},tar=false`],
+        ...req.base === void 0 ? [] : ["--build-context", `${req.base.ref}=oci-layout://${req.base.layout}@${layoutDigest(req.base.layout)}`],
+        "--tag",
+        req.tag,
+        ...labels,
+        "--file",
+        "-",
+        req.context
+      ];
+      const result = await trackImageBuild(() => run("docker", args, { logPath: req.logPath, input: req.dockerfile }));
+      if (result.status !== 0 && isOutOfMemory(`${result.stdout}
+${result.stderr}`)) throw outOfMemory(builder, req.logPath);
+      return result.status;
+    },
+    async devcontainerBuild(req) {
+      const builder = builderFor();
+      const { command, args } = devcontainerBuildInvocation(cli(), req);
+      if (req.layoutOut !== void 0) {
+        rmSync(req.layoutOut, { recursive: true, force: true });
+      }
+      const result = await trackImageBuild(() => run(command, args, { logPath: req.logPath, env: { BUILDX_BUILDER: builder.name } }));
+      if (result.status !== 0 && isOutOfMemory(`${result.stdout}
+${result.stderr}`)) throw outOfMemory(builder, req.logPath);
+      return result.status;
+    },
+    async remove(id) {
+      const result = await run("docker", ["rmi", id]);
+      if (result.status !== 0) throw new Error(result.stderr.trim() || `docker rmi ${id} exited ${result.status}`);
+    }
+  };
+}
+
+export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, isOutOfMemory, judgeCommand, parseProgramHash, pathLabelValue, prepareRunArgs, proxyEnvironment, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, writeJobFile };