@outerlayer/cli 0.22.1 → 0.22.2

package/dist/{chunk-JZGFDTNC.js → chunk-SFHR45FA.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-WXJXHZVB.js';
 import { EXEC_PORT } from './chunk-2Q3PZ42G.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RELAY_PORT } from './chunk-URWYRAIC.js';
@@ -12,6 +13,7 @@ var HELPER_RECORD = "/run/outerlayer-helpers";
 var KERNEL_FLAG = "outerlayer.relay";
 var DOCKER_FLAG = "outerlayer.docker";
 var DOCKERD_CONFIG = "/run/outerlayer-dockerd.json";
+var NONLOCAL_BIND = "/proc/sys/net/ipv4/ip_nonlocal_bind";
 var DOCKERD_LOG = "/run/dockerd.log";
 var DOCKER_DATA_ROOT = "/build/docker";
 var BUILD_DISK = "/dev/vdb";
@@ -32,13 +34,25 @@ function relayPortsFrom(cmdline) {
 function dockerRequestedBy(cmdline) {
   return new RegExp(`(?:^|\\s)${DOCKER_FLAG.replace(".", "\\.")}=1(?:\\s|$)`).test(cmdline);
 }
+function startBridgeForwarder(host) {
+  host.writeFile(NONLOCAL_BIND, "1");
+  host.spawnDetached([
+    "/opt/outerlayer/bin/node",
+    "/opt/outerlayer/cli/dist/index.js",
+    "vm-forward",
+    "--listen",
+    `${BRIDGE_ADDRESS}:${TUNNEL_PORT}`,
+    "--to",
+    `127.0.0.1:${TUNNEL_PORT}`
+  ]);
+}
 function startDocker(host) {
   const proxy = `http://127.0.0.1:${RELAY_PORT}`;
   host.mount({ source: "cgroup2", target: "/sys/fs/cgroup", type: "cgroup2" });
   host.mkdir(DOCKER_DATA_ROOT, 457);
   host.writeFile(
     DOCKERD_CONFIG,
-    `${JSON.stringify({ "data-root": DOCKER_DATA_ROOT, proxies: { "http-proxy": proxy, "https-proxy": proxy, "no-proxy": "localhost,127.0.0.1" } }, null, 2)}
+    `${JSON.stringify({ "data-root": DOCKER_DATA_ROOT, bip: BRIDGE_CIDR, proxies: { "http-proxy": proxy, "https-proxy": proxy, "no-proxy": "localhost,127.0.0.1" } }, null, 2)}
 `
   );
   host.spawnDetached(["/bin/sh", "-c", `exec dockerd --config-file ${DOCKERD_CONFIG} >${DOCKERD_LOG} 2>&1`]);
@@ -65,7 +79,10 @@ function runGuestInit(host, cmdline) {
   host.writeFile("/proc/sys/kernel/hostname", HOSTNAME);
   host.mount({ source: "tmpfs", target: "/outerlayer/job", type: "tmpfs", options: "mode=0755" });
   const relay = host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
-  if (dockerRequestedBy(cmdline)) startDocker(host);
+  if (dockerRequestedBy(cmdline)) {
+    startBridgeForwarder(host);
+    startDocker(host);
+  }
   const agent = host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
   host.writeFile(HELPER_RECORD, [relay, agent].map((started) => `${started.pid} ${started.start}
 `).join(""));

package/dist/{chunk-6YBLN4TR.js → chunk-SNVXHNU7.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-USWVXQIH.js';
-import { defaultFetch } from './chunk-QF7WZUU6.js';
-import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-QS43O4DR.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-5OCIHFGE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-URAKVDSI.js → chunk-U6RKHNC7.js}

@@ -1,14 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-56X5TOJY.js';
+import { uploadSpooledSteps } from './chunk-JD6GWYY7.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-G3IJ3N6F.js';
-import { defaultFetch } from './chunk-QF7WZUU6.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-NTRCK4NH.js';
-import { writeSyncStatus, spoolDir } from './chunk-QC72I5GQ.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QS43O4DR.js';
+import { writeSyncStatus, spoolDir } from './chunk-HWZCE745.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
-import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
+import { hookExecSpoolPath } from './chunk-DYEFPYME.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-AEKSX4EY.js';
@@ -573,7 +572,7 @@ var LiveUploader = class {
     this.stopped = false;
     this.warned = /* @__PURE__ */ new Set();
     this.home = opts.home;
-    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.fetchImpl = opts.fetchImpl ?? cliFetch;
     this.sleepImpl = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.debounceMs = opts.debounceMs ?? DEFAULT_DEBOUNCE_MS;
     this.env = opts.env ?? process.env;

package/dist/{chunk-5NJIWKD4.js → chunk-WKSBSEWT.js}

@@ -6,8 +6,8 @@ import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LA
 import { RecipeError, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-3W333NFO.js';
 import { execCapture } from './chunk-NYTZ7HVN.js';
 import { GUEST_CID } from './chunk-2Q3PZ42G.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-CUFFDEF3.js';
-import { WorkCommandError } from './chunk-BET347JZ.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-IMCVQF5F.js';
+import { WorkCommandError } from './chunk-FQE5RDHI.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';

package/dist/chunk-WXJXHZVB.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RELAY_PORT, BUILD_HOME } from './chunk-URWYRAIC.js';
+import { createServer, connect } from 'net';
+
+createRequire(import.meta.url);
+var BRIDGE_ADDRESS = "172.17.0.1";
+var BRIDGE_CIDR = "172.17.0.1/16";
+var TUNNEL_PORT = RELAY_PORT;
+var CONTAINER_PROXY = `http://${BRIDGE_ADDRESS}:${TUNNEL_PORT}`;
+var CONTAINER_NO_PROXY = ["localhost", "127.0.0.1", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
+function dockerClientConfig() {
+  const proxies = { default: { httpProxy: CONTAINER_PROXY, httpsProxy: CONTAINER_PROXY, noProxy: CONTAINER_NO_PROXY.join(",") } };
+  return `${JSON.stringify({ proxies }, null, 2)}
+`;
+}
+async function writeDockerClientConfig(run, agentUser) {
+  const dir = `${BUILD_HOME}/.docker`;
+  const script = [
+    "set -e",
+    "umask 077",
+    `mkdir -p ${dir}`,
+    `cat > ${dir}/config.json.partial`,
+    `mv ${dir}/config.json.partial ${dir}/config.json`,
+    `chown "$(id -u "$1"):$(id -g "$1")" ${dir} ${dir}/config.json`,
+    `chmod 700 ${dir}`,
+    `chmod 600 ${dir}/config.json`
+  ].join("\n");
+  const result = await run(["/bin/sh", "-c", script, "sh", agentUser], dockerClientConfig());
+  if (result.status === 0) return void 0;
+  return `the Docker client configuration could not be written in the microVM (exit ${result.status}): ${result.stderr.trim().split("\n")[0]}`;
+}
+function parseAddress(text) {
+  const match = /^(.+):(\d+)$/.exec(text);
+  const port = Number(match?.[2]);
+  if (match === null || port > 65535) throw new Error(`${JSON.stringify(text)} is not host:port`);
+  return { host: match[1], port };
+}
+async function startBridgeForward(opts) {
+  const listen = parseAddress(opts.listen);
+  const to = parseAddress(opts.to);
+  const open = /* @__PURE__ */ new Set();
+  const server = createServer({ allowHalfOpen: true }, (client) => {
+    const upstream = connect({ host: to.host, port: to.port, allowHalfOpen: true });
+    open.add(client);
+    client.on("error", () => void 0);
+    upstream.on("error", () => void 0);
+    client.on("close", () => {
+      open.delete(client);
+      upstream.destroy();
+    });
+    upstream.on("close", () => client.destroy());
+    client.pipe(upstream);
+    upstream.pipe(client);
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(listen.port, listen.host, () => {
+      resolve();
+    });
+  });
+  server.on("error", (error) => process.stderr.write(`outerlayer: the bridge forwarder hit an error: ${error.message}
+`));
+  return {
+    port: server.address().port,
+    close: () => new Promise((resolve) => {
+      for (const socket of open) socket.destroy();
+      server.close(() => resolve());
+    })
+  };
+}
+
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig };

package/dist/{chunk-ZPSLJFGL.js → chunk-ZCXP35T3.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-4AVDD7VX.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-FRNYCJ4W.js';
-import { MIN_ENGINE_MAJOR } from './chunk-5NJIWKD4.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-FVDVC2GF.js';
+import { MIN_ENGINE_MAJOR } from './chunk-WKSBSEWT.js';
 import { runnerCredentialProblem } from './chunk-V5CG75NX.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';

package/dist/{claude-launcher-TBWV3YL3.js → claude-launcher-QD3C427Y.js}

@@ -236,7 +236,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-OWSNH6YA.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-HE6OSWKO.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);