@outerlayer/cli 0.24.0 → 0.25.1

package/dist/{chunk-6GSA2SKT.js → chunk-A6ORKBVJ.js}

@@ -1,32 +1,33 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { senderPidfile } from './chunk-W7O4LA4E.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-A62QFN2M.js';
-import { writeDockerClientConfig } from './chunk-CZUH2SLQ.js';
-import { installScrubContext } from './chunk-D7K446H6.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-GU4PKXN7.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-TTLVQZSH.js';
+import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
+import { senderPidfile } from './chunk-VAMUWK55.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-2N72GPS2.js';
+import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
+import { installScrubContext } from './chunk-C36EOUUU.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-ENFBARQP.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-Q435LWVN.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-5XCAPBE2.js';
-import { CLAUDE_CODE_VERSION } from './chunk-3W333NFO.js';
-import { waitForAgent, vmExecArgs } from './chunk-LY2L3O2O.js';
-import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-PDIM5T65.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-TQ6Y7YV6.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-RVYOOYOA.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-N3VSI5ZI.js';
+import { CLAUDE_CODE_VERSION } from './chunk-APBTVIM4.js';
+import { waitForAgent, vmExecArgs } from './chunk-HPOEVC2V.js';
+import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-XGJUNNXL.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-3FNPTQRH.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-CQRIZNE6.js';
 import { planArtifactUpload } from './chunk-BUP5N3X6.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-D7X5ITVT.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { scrubText } from './chunk-D4AMAEZ7.js';
+import { scrubText } from './chunk-QE3UQAHK.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolvePackRoot } from './chunk-HBISTTG3.js';
 import { parsePolicy } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-PVRBE7S4.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-KF37SUDM.js';
-import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BN3CSI7S.js';
-import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-GISNHSYL.js';
-import { existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, rmSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
+import { signerFor } from './chunk-ZODVSFI4.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-ZI2ZVWKT.js';
+import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2K3TCQHW.js';
+import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-JGD5TWQ2.js';
+import { existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, rmSync, readdirSync, linkSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
 import { randomBytes, createHash } from 'crypto';
@@ -94,6 +95,61 @@ function judgeProbe(probe, missedBefore) {
   if (probe.alive) return { kind: "running" };
   return missedBefore ? { kind: "lost" } : { kind: "recheck" };
 }
+function unitNameFor(buildId) {
+  return `outerlayer-build-${buildId}`;
+}
+function linkIn(buildDir2, name, source) {
+  const target = join(buildDir2, name);
+  rmSync(target, { force: true });
+  try {
+    linkSync(source, target);
+  } catch (err) {
+    if (err.code === "EXDEV") {
+      throw new Error(`${source} and ${buildDir2} are on different file systems, so the build's files cannot be linked into its jail`);
+    }
+    throw err;
+  }
+  chmodSync(source, 292);
+}
+async function startJailed(input) {
+  linkIn(input.buildDir, "kernel", input.kernel);
+  linkIn(input.buildDir, "rootfs.ext4", input.rootfs);
+  for (const name of input.sockets) {
+    try {
+      chmodSync(join(input.buildDir, name), 438);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+  return input.client.start({ build: input.buildId, kind: input.kind });
+}
+async function startJailedInto(state, input, save) {
+  state.jailed = { unit: unitNameFor(state.buildId), chroot: "" };
+  save();
+  try {
+    const started = await startJailed({ ...input, buildId: state.buildId, buildDir: state.buildDir });
+    state.jailed = { unit: started.unit, chroot: started.chroot };
+    state.vsockPath = started.vsock;
+  } catch (err) {
+    if (err instanceof HelperRefusal) {
+      delete state.jailed;
+      save();
+    }
+    throw err;
+  }
+  save();
+}
+async function stopJailed(helper, state) {
+  const probe = await helper.probe();
+  if (!probe.ok) throw new Error(`the build's unit ${state.jailed?.unit ?? unitNameFor(state.buildId)} could not be stopped, because there is no helper to ask: ${probe.detail}`);
+  try {
+    await probe.client.stop(state.buildId);
+  } catch (err) {
+    throw new Error(`the build's unit ${state.jailed?.unit ?? unitNameFor(state.buildId)} was not stopped: ${describeCallFailure(err)}`);
+  }
+}
+
+// src/runner/microvm/hooks.ts
 var DEFAULT_MEMORY = "8g";
 var DEFAULT_DISK = "40g";
 var DEFAULT_CPUS = 4;
@@ -147,6 +203,34 @@ async function unpackIntoGuest(runtime, state, dir, target, opts = {}) {
 async function deliverCommitHooks(input) {
   await unpackIntoGuest(input.runtime, input.state, input.hooksDir, GUEST_HOOKS_DIR);
 }
+function vmAlive(runtime, state) {
+  if (state.jailed !== void 0) return runtime.vm.helper.alive(state.jailed.unit);
+  return state.firecracker !== void 0 && runtime.vm.firecracker.alive(state.firecracker);
+}
+async function helperFor(runtime, log) {
+  const probe = await runtime.vm.helper.probe();
+  if (probe.ok) return probe.client;
+  if (probe.reason === "unsupported") log(probe.detail);
+  else if (probe.unreachable === true) log(`${probe.detail}, so this build runs without the jailer`);
+  return void 0;
+}
+function silence(runtime, state, lastError, console) {
+  if (!vmAlive(runtime, state)) return `it exited before its exec agent answered; ${console}`;
+  const last = lastError === void 0 ? "" : `; the last connection to its exec agent failed: ${describeCallFailure(lastError)}`;
+  return `its exec agent did not answer; ${console}${last}`;
+}
+function consoleNote(state, consolePath) {
+  return state.jailed === void 0 ? `its console is in ${consolePath}` : `its console output is in the journal of the unit ${state.jailed.unit}`;
+}
+async function helperKills(runtime, state) {
+  const probe = await runtime.vm.helper.probe();
+  return probe.ok ? (await probe.client.state(state.buildId)).oomKills : 0;
+}
+async function microVmOomKills(runtime, state) {
+  if (state.cgroup !== void 0 && runtime.vm.cgroup.oomKills(state.cgroup) > 0) return 1;
+  if (state.jailed !== void 0) return helperKills(runtime, state);
+  return 0;
+}
 async function provisionMicroVm(input) {
   const { config, runtime, item, itemKey, jobDir, log, tokens } = input;
   const { vm } = runtime;
@@ -224,9 +308,9 @@ async function provisionMicroVm(input) {
   input.save(state, environment);
   const bail = async (reason, aborted = false) => {
     let why = reason;
-    if (!aborted && state.cgroup !== void 0) {
+    if (!aborted && (state.cgroup !== void 0 || state.jailed !== void 0)) {
       try {
-        if (runtime.vm.cgroup.oomKills(state.cgroup) > 0) why = outOfMemoryReason(config.build?.memory);
+        if (await microVmOomKills(runtime, state) > 0) why = outOfMemoryReason(config.build?.memory);
       } catch (err) {
         log.error(`${tag} could not read the build's memory events: ${describeCallFailure(err)} \xB7 continuing`);
       }
@@ -266,8 +350,9 @@ async function provisionMicroVm(input) {
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: true });
   const configPath = join(buildDir2, "vm.json");
+  const helper = await helperFor(runtime, (line) => log.line(`${tag} ${line}`));
   try {
-    linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
+    if (helper === void 0) linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
     await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
     writeFileSync(
       configPath,
@@ -282,24 +367,34 @@ async function provisionMicroVm(input) {
     return bail(`the build's disk and machine could not be made: ${describeCallFailure(err)}`);
   }
   if (input.aborted()) return bail("", true);
-  try {
-    state.cgroup = vm.cgroup.create(buildId, limits.memoryBytes);
-  } catch (err) {
-    return bail(`the build's memory limit could not be set: ${describeCallFailure(err)}`);
+  if (helper === void 0) {
+    try {
+      state.cgroup = vm.cgroup.create(buildId, limits.memoryBytes);
+    } catch (err) {
+      return bail(`the build's memory limit could not be set: ${describeCallFailure(err)}`);
+    }
+    if (state.cgroup !== void 0) input.save(state, environment);
   }
-  if (state.cgroup !== void 0) input.save(state, environment);
   const consolePath = join(jobDir, "vm-console.log");
-  try {
-    state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath, cgroup: state.cgroup });
-  } catch (err) {
-    return bail(`Firecracker did not start: ${describeCallFailure(err)}`);
+  if (helper !== void 0) {
+    try {
+      await startJailedInto(state, { client: helper, kind: "build", kernel: assets.kernel, rootfs: state.rootfs, sockets: links.map((link) => link.socket) }, () => input.save(state, environment));
+    } catch (err) {
+      return bail(`the microVM did not start under the jailer: ${describeCallFailure(err)}`);
+    }
+  } else {
+    try {
+      state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath, cgroup: state.cgroup });
+    } catch (err) {
+      return bail(`Firecracker did not start: ${describeCallFailure(err)}`);
+    }
+    input.save(state, environment);
   }
-  input.save(state, environment);
   if (input.aborted()) return bail("", true);
-  const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep });
+  let lastError;
+  const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep, onFailure: (err) => lastError = err });
   if (!ready) {
-    const why = vm.firecracker.alive(state.firecracker) ? "its exec agent did not answer" : "it exited before its exec agent answered";
-    return bail(`the microVM did not start: ${why}; its console is in ${consolePath}`);
+    return bail(`the microVM did not start: ${silence(runtime, state, lastError, consoleNote(state, consolePath))}`);
   }
   let pushes = Promise.resolve();
   let firstWriteFailure;
@@ -325,7 +420,7 @@ async function provisionMicroVm(input) {
   }
   tokens.onRead((token) => {
     pushes = pushes.then(async () => {
-      if (state.firecracker === void 0 || !vm.firecracker.alive(state.firecracker)) return;
+      if (!vmAlive(runtime, state)) return;
       await writeGuestGhConfig(runtime, state, token);
     }, void 0).catch(reportWrite);
   });
@@ -467,7 +562,7 @@ function microVmSenderCommand(input) {
   return { command: process.execPath, args: [input.cli, "vm-exec", ...vmExecArgs(options)], env };
 }
 function isRunning(runtime, state) {
-  return state.firecracker !== void 0 && runtime.vm.firecracker.alive(state.firecracker);
+  return vmAlive(runtime, state);
 }
 async function syncInMicroVm(input) {
   const { runtime, job } = input;
@@ -549,7 +644,7 @@ function microVmJudgeEnvironment(input) {
   const state = job.microvm;
   const agentUser = state.agentUser ?? ADDED_USER;
   const needsVm = () => {
-    if (state.firecracker !== void 0 && !isRunning(runtime, state)) throw new Error("the build's microVM is gone");
+    if ((state.firecracker !== void 0 || state.jailed !== void 0) && !isRunning(runtime, state)) throw new Error("the build's microVM is gone");
   };
   return {
     stop: async () => {
@@ -681,8 +776,9 @@ async function startCheckMicroVm(input) {
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: false });
   const configPath = join(buildDir2, "vm.json");
+  const helper = await helperFor(runtime, (line) => log.line(`${tag} ${line}`));
   try {
-    linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
+    if (helper === void 0) linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
     await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
     writeFileSync(
       configPath,
@@ -697,24 +793,34 @@ async function startCheckMicroVm(input) {
     return fail(`the check environment's disk and machine could not be made: ${describeCallFailure(err)}`);
   }
   if (abandoned()) return fail(ABANDONED);
-  try {
-    state.cgroup = vm.cgroup.create(buildId, limits.memoryBytes);
-  } catch (err) {
-    return fail(`the check environment's memory limit could not be set: ${describeCallFailure(err)}`);
-  }
-  if (state.cgroup !== void 0) input.save(state);
-  const boot = async () => {
+  if (helper === void 0) {
     try {
-      state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath, cgroup: state.cgroup });
+      state.cgroup = vm.cgroup.create(buildId, limits.memoryBytes);
     } catch (err) {
-      return `Firecracker did not start: ${describeCallFailure(err)}`;
+      return fail(`the check environment's memory limit could not be set: ${describeCallFailure(err)}`);
+    }
+    if (state.cgroup !== void 0) input.save(state);
+  }
+  const boot = async () => {
+    if (helper !== void 0) {
+      try {
+        await startJailedInto(state, { client: helper, kind: "check", kernel: assets.kernel, rootfs: state.rootfs, sockets: links.map((link) => link.socket) }, () => input.save(state));
+      } catch (err) {
+        return `the microVM did not start under the jailer: ${describeCallFailure(err)}`;
+      }
+    } else {
+      try {
+        state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath, cgroup: state.cgroup });
+      } catch (err) {
+        return `Firecracker did not start: ${describeCallFailure(err)}`;
+      }
+      input.save(state);
     }
-    input.save(state);
     if (abandoned()) return ABANDONED;
-    const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep });
+    let lastError;
+    const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep, onFailure: (err) => lastError = err });
     if (!ready) {
-      const why = vm.firecracker.alive(state.firecracker) ? "its exec agent did not answer" : "it exited before its exec agent answered";
-      return `the microVM did not start: ${why}; its console is in ${consolePath}`;
+      return `the microVM did not start: ${silence(runtime, state, lastError, consoleNote(state, consolePath))}`;
     }
     if (built.docker === true) return waitForDocker(runtime, state, agentUser, () => /* @__PURE__ */ new Date());
     return void 0;
@@ -740,7 +846,8 @@ async function startCheckMicroVm(input) {
       },
       restart: async () => {
         try {
-          await vm.firecracker.stop(state.firecracker);
+          if (state.jailed !== void 0) await stopJailed(vm.helper, state);
+          else await vm.firecracker.stop(state.firecracker);
           rmSync(state.vsockPath, { force: true });
           if (await boot() !== void 0) return false;
           if (evalInput.delivered) await deliverEvalInput();
@@ -754,6 +861,10 @@ async function startCheckMicroVm(input) {
 }
 async function stopBuildMicroVm(runtime, state, jobDir) {
   await copyHookErrors(runtime, state, jobDir);
+  if (state.jailed !== void 0) {
+    await stopJailed(runtime.vm.helper, state);
+    return;
+  }
   if (state.firecracker === void 0) return;
   await runtime.vm.firecracker.stop(state.firecracker);
   if (runtime.vm.firecracker.alive(state.firecracker)) throw new Error(`the microVM (pid ${state.firecracker.pid}) is still running after it was stopped`);
@@ -761,6 +872,13 @@ async function stopBuildMicroVm(runtime, state, jobDir) {
 async function cleanupMicroVm(runtime, state, jobDir) {
   const failures = [];
   if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
+  if (state.jailed !== void 0) {
+    try {
+      await stopJailed(runtime.vm.helper, state);
+    } catch (err) {
+      failures.push(describeCallFailure(err));
+    }
+  }
   if (state.firecracker !== void 0) {
     try {
       await runtime.vm.firecracker.stop(state.firecracker);
@@ -786,6 +904,8 @@ async function cleanupMicroVm(runtime, state, jobDir) {
 }
 async function stopOrphanedMicroVms(input) {
   const stopped = [];
+  const report = (line) => input.onError?.(line);
+  const jailedByJobs = [];
   for (const { job } of input.jobs) {
     const states = [job.microvm, job.checkMicrovm].filter((state) => state !== void 0);
     if (states.length === 0) continue;
@@ -798,12 +918,38 @@ async function stopOrphanedMicroVms(input) {
       while (isSameProcess(job.pid, job.start) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 10));
     }
     for (const state of states) {
+      if (state.jailed !== void 0) jailedByJobs.push(state.jailed.unit);
       if (state.firecracker !== void 0 && input.runtime.vm.firecracker.alive(state.firecracker)) {
-        await input.runtime.vm.firecracker.stop(state.firecracker);
-        stopped.push(state.buildId);
+        try {
+          await input.runtime.vm.firecracker.stop(state.firecracker);
+          stopped.push(state.buildId);
+        } catch (err) {
+          report(`the microVM of build ${state.buildId} (pid ${state.firecracker.pid}) was not stopped: ${describeCallFailure(err)}`);
+        }
       }
     }
   }
+  const probe = await input.runtime.vm.helper.probe();
+  if (!probe.ok) {
+    if (jailedByJobs.length > 0) report(`the units ${jailedByJobs.join(", ")} could not be stopped, because there is no helper to ask: ${probe.detail}`);
+    return stopped;
+  }
+  let builds;
+  try {
+    builds = await probe.client.list();
+  } catch (err) {
+    report(`the helper's list of builds could not be read: ${describeCallFailure(err)}`);
+    return stopped;
+  }
+  for (const build of builds) {
+    try {
+      await probe.client.stop(build);
+    } catch (err) {
+      report(`the unit of build ${build} was not stopped: ${describeCallFailure(err)}`);
+      continue;
+    }
+    if (!stopped.includes(build)) stopped.push(build);
+  }
   return stopped;
 }
 function provisionEnvironment(base, input) {
@@ -2468,9 +2614,9 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     }
   }
   let outOfMemory;
-  if (vmBuild?.state.cgroup !== void 0 && outcome !== void 0 && outcome !== "ok" && ending?.reason === void 0) {
+  if ((vmBuild?.state.cgroup !== void 0 || vmBuild?.state.jailed !== void 0) && outcome !== void 0 && outcome !== "ok" && ending?.reason === void 0) {
     try {
-      if (vmBuild.runtime.vm.cgroup.oomKills(vmBuild.state.cgroup) > 0) {
+      if (await microVmOomKills(vmBuild.runtime, vmBuild.state) > 0) {
         outOfMemory = outOfMemoryReason(config.build?.memory);
       }
     } catch (err) {
@@ -2739,8 +2885,15 @@ function unfinishedJobs(jobsDirPath) {
 function isContainerTracked(job) {
   return job.container?.tracking === "container";
 }
+function isReadable(job) {
+  return readsJobState(job, READ_JOB_STATE_FORMATS);
+}
+function listUnreadableJobs(jobsDirPath) {
+  return unfinishedJobs(jobsDirPath).flatMap(({ dirPath, job }) => isReadable(job) ? [] : [{ dirPath, job, format: jobStateFormatOf(job) }]);
+}
 function listTrackedJobs(jobsDirPath) {
   return unfinishedJobs(jobsDirPath).flatMap(({ dirPath, job }) => {
+    if (!isReadable(job)) return [];
     const tracking = job.container?.tracking;
     if (tracking === void 0) return [];
     if (tracking === "container" && inTeardown(job)) return [];
@@ -2749,12 +2902,13 @@ function listTrackedJobs(jobsDirPath) {
 }
 function listAdoptableJobs(jobsDirPath) {
   return unfinishedJobs(jobsDirPath).filter(
-    ({ job }) => job.microvm === void 0 && job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start)
+    ({ job }) => isReadable(job) && job.microvm === void 0 && job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start)
   );
 }
 async function recoverLostJobs(jobsDirPath, config, deps) {
   const recovered = [];
   for (const { dirPath, job } of unfinishedJobs(jobsDirPath)) {
+    if (!isReadable(job)) continue;
     const tracking = job.container?.tracking;
     if (tracking !== void 0 && tracking !== "container") {
       recovered.push(await finishJob(job, dirPath, "interrupted", config, deps, { reason: UNKNOWN_TRACKING_REASON }));
@@ -2928,4 +3082,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, isContainerTracked, isGroupAlive, isIdle, isTimedOut, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, probeCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, setStage, startHostServices, startSender, stopOrphanedMicroVms, unfinishedJobs, workdirProblem };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isReadable, isTimedOut, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, probeCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, setStage, startHostServices, startSender, stopOrphanedMicroVms, unfinishedJobs, workdirProblem };

package/dist/{chunk-3W333NFO.js → chunk-APBTVIM4.js}

@@ -242,12 +242,12 @@ var MICROVM_ARCHES = ["x86_64"];
 function firecrackerArch(nodeArch) {
   return nodeArch === "x64" ? "x86_64" : nodeArch === "arm64" ? "aarch64" : nodeArch;
 }
-var FIRECRACKER_VERSION = "1.13.1";
+var FIRECRACKER_VERSION = "1.16.2";
 var FIRECRACKER_SHA256 = {
-  x86_64: "59450b9171ff2ebdf2f9a25be3a248a7ba79fb6371aec51a9d6d8eefca7b4faf"
+  x86_64: "32e3cdcd4081f91fe2b024a266f57dcb3b4e5fec5033e0cb22467ad7f7820bda"
 };
 var FIRECRACKER_BINARY_SHA256 = {
-  x86_64: "7d3924e0c8761edafbf85cb2a94c268ffad249644a40fd02d4e15cde4c206f6e"
+  x86_64: "8227875ceda44177a4d501052dae4a2f9d7837362f5399f02cf0748e68418377"
 };
 var GUEST_ASSETS_VERSION = "1";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
@@ -261,5 +261,16 @@ function guestAssetsPinned(arch) {
   const zero = "0".repeat(64);
   return GUEST_KERNEL_SHA256[arch] !== zero && GUEST_HELPER_SHA256[arch] !== zero;
 }
+var JAILER_BINARY_SHA256 = {
+  x86_64: "99832d2270741af67ffacd46da716b4b016338541af5a742907ab965b2e9ac9e"
+};
+var HOST_HELPER_ASSETS_VERSION = "4";
+var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;
+var HOST_HELPER_SHA256 = {
+  x86_64: "5c9d9e46daf165411ebe594fa28f4adc6b363989d77673c7651ab6dccb808684"
+};
+function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
+  return hashes[arch] !== "0".repeat(64);
+}
 
-export { BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, MICROVM_ARCHES, NODE_IMAGE, RecipeError, SANITIZED_NAME, TINI_SHA256, TINI_VERSION, assertBuildable, classifyProperties, firecrackerArch, guestAssetsPinned, locateRecipe, readRecipe, writeSanitizedRecipe };
+export { BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, DOCKER_FEATURE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, JAILER_BINARY_SHA256, MICROVM_ARCHES, NODE_IMAGE, RecipeError, SANITIZED_NAME, TINI_SHA256, TINI_VERSION, assertBuildable, classifyProperties, firecrackerArch, guestAssetsPinned, hostHelperPinned, locateRecipe, readRecipe, writeSanitizedRecipe };

package/dist/{chunk-HHXBOTRO.js → chunk-ATGHVEU4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-VV7ZD5LR.js';
+import { currentLink } from './chunk-QMQC6JCO.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-D7K446H6.js → chunk-C36EOUUU.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-F7Y2USIM.js';
+import { uploadSpooledSteps } from './chunk-H6ZFLIX3.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FKXGQOF5.js';
-import { writeSyncStatus, spoolDir } from './chunk-755WXDBI.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
+import { writeSyncStatus, spoolDir } from './chunk-K5WVK7IC.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-DYEFPYME.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-D4AMAEZ7.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
@@ -18,7 +18,7 @@ import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signerFor, signRunnerRequest } from './chunk-PVRBE7S4.js';
+import { signerFor, signRunnerRequest } from './chunk-ZODVSFI4.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';

package/dist/{chunk-RVYOOYOA.js → chunk-CQRIZNE6.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-F2W2IYNP.js';
-import { workPageUrl } from './chunk-V5Q3S4NM.js';
+import { detectActiveSession, autoConnect } from './chunk-3WZ5ECSM.js';
+import { workPageUrl } from './chunk-SNQR2EYI.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-FKXGQOF5.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-M4B6QKNZ.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
+import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signRunnerRequest } from './chunk-PVRBE7S4.js';
+import { signRunnerRequest } from './chunk-ZODVSFI4.js';
 
 createRequire(import.meta.url);
 
@@ -368,10 +368,11 @@ function issueLabel(subject) {
   if ("issue" in subject) return `issue ${sanitizeTerminal(subject.repository)}#${subject.issue}`;
   return `issue ${sanitizeTerminal(subject.key)}`;
 }
-function itemPageUrl(home, cwd, appId, workItemId) {
+function itemPageUrl(home, cwd, appId, workItemId, number) {
   const connection = readRepoConnection(cwd);
   if (connection === void 0 || connection.appId !== appId || typeof workItemId !== "string" || workItemId === "") return void 0;
-  return `${workPageUrl(home, connection.organization.name, connection.factory.name)}/${encodeURIComponent(workItemId)}`;
+  const segment = encodeURIComponent(number == null ? workItemId : String(number));
+  return `${workPageUrl(home, connection.organization.name, connection.factory.name)}/${segment}`;
 }
 async function runWorkBuild(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -416,7 +417,7 @@ async function runWorkBuild(opts) {
     ...facts
   };
   const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep);
-  const page = itemPageUrl(home, cwd, appId, data.workItemId);
+  const page = itemPageUrl(home, cwd, appId, data.workItemId, data.number);
   const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} build requested ${C.dim}\xB7${C.reset} ${itemLabel(data)}${"subject" in body ? ` (${issueLabel(body.subject)})` : ""} ${C.dim}\xB7${C.reset} by ${data.attestor}` + (page !== void 0 ? `
   ${page}` : "") + tokenWarning(data);
   if (!opts.quiet) process.stdout.write(output + "\n");
@@ -427,7 +428,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-3JL4PXLG.js');
+      const { logHookError } = await import('./hook-fast-NEELST6G.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -514,9 +515,17 @@ async function runWorkRemove(opts) {
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
+function mergedUnverifiedLine(data) {
+  const block = data.gates?.block;
+  if (block?.mergedDespiteVerdict !== true) return "";
+  const at = typeof block.mergedAt === "string" ? ` at ${sanitizeTerminal(block.mergedAt)}` : "";
+  return `${C.yellow}Merged, unverified${C.reset}: the pull request merged${at} before its checks or review passed, so the stage stays at review.
+
+`;
+}
 function statusOutput(data, json) {
   if (json) return JSON.stringify(data);
-  const document = JSON.stringify(data, null, 2);
+  const document = mergedUnverifiedLine(data) + JSON.stringify(data, null, 2);
   const criteria = data.criteria;
   if (criteria === void 0) return document;
   if (criteria === null || !Array.isArray(criteria.items)) return `${document}

package/dist/{chunk-FWEWFW3F.js → chunk-DEBOL6ON.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZI2ZVWKT.js';
 import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';