@outerlayer/cli 0.24.0 → 0.25.1

package/dist/{chunk-H6IUKXXI.js → chunk-F57CLUH7.js}

@@ -1,31 +1,32 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-6GSA2SKT.js';
-import { writePendingUpdate } from './chunk-NGZID7UI.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-NTQTDCYR.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-A6ORKBVJ.js';
+import { writePendingUpdate } from './chunk-XRYUJTAT.js';
+import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-O2WYUIK7.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-5ECUMU53.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-24LQ34XL.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-QMQC6JCO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-VV7ZD5LR.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-GU4PKXN7.js';
-import { checkFit } from './chunk-DG2ULWM6.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-IDSHLKQA.js';
+import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-ENFBARQP.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-5222PA6S.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { claimPidFile, readPidFile, releasePidFile } from './chunk-FWEWFW3F.js';
+import { checkFit } from './chunk-IGRRD7PX.js';
+import { claimPidFile, readPidFile, releasePidFile } from './chunk-DEBOL6ON.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-5XCAPBE2.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-TQ6Y7YV6.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-RVYOOYOA.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-D7X5ITVT.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-N3VSI5ZI.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-3FNPTQRH.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-CQRIZNE6.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWRX5ZTT.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-PVRBE7S4.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-KF37SUDM.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-BN3CSI7S.js';
-import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-GISNHSYL.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-ZODVSFI4.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-ZI2ZVWKT.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-2K3TCQHW.js';
+import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-JGD5TWQ2.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, rmSync, closeSync, openSync, constants, lstatSync } from 'fs';
 import { join, dirname } from 'path';
@@ -238,6 +239,61 @@ function writeLastUpdate(configPath, update) {
 `, { mode: RUNNER_FILE_MODE });
   renameSync(temporary, path);
 }
+
+// src/runner/update/ask-formats.ts
+async function askJobStateFormats(runNode, entry, cwd) {
+  let result;
+  try {
+    result = await runNode([entry, "runner", "job-state-formats"], cwd);
+  } catch {
+    return void 0;
+  }
+  if (result.status !== 0) return void 0;
+  try {
+    const body = JSON.parse(result.stdout);
+    if (!Array.isArray(body.reads) || !body.reads.every((n) => Number.isInteger(n))) return void 0;
+    return body.reads;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/runner/update/survives-restart.ts
+function stageReason(job) {
+  if (job.stage === "command") return void 0;
+  if (!inTeardown(job)) return "is still in setup";
+  switch (job.stage) {
+    case "judge":
+      return "is running the criteria judge";
+    case "checks":
+      return "is running its checks";
+    default:
+      return `is finishing (${job.stage})`;
+  }
+}
+function ownReason({ job, ending }) {
+  if (job.microvm !== void 0) return "runs in a microVM, which does not carry on through a restart";
+  if (!isContainerTracked(job)) return "is not a container build tracked inside its container";
+  if (ending) return "is being ended";
+  return stageReason(job);
+}
+function buildBlockers(builds) {
+  return builds.flatMap((build) => {
+    const reason = ownReason(build);
+    return reason === void 0 ? [] : [{ item: build.job.item, reason }];
+  });
+}
+function restartBlockers(builds, reads) {
+  return builds.flatMap((build) => {
+    const reason = ownReason(build);
+    if (reason !== void 0) return [{ item: build.job.item, reason }];
+    if (reads === void 0) return [{ item: build.job.item, reason: "has job state the new version may not read: it did not say which formats it reads" }];
+    if (!readsJobState(build.job, reads)) {
+      return [{ item: build.job.item, reason: `has job-state format ${jobStateFormatOf(build.job)}, which the new version does not read` }];
+    }
+    return [];
+  });
+}
 var RELEASE_REPOSITORY = "https://github.com/outerlayerai/outerlayer";
 var RELEASE_WORKFLOW_PATH = ".github/workflows/outerlayer-release.yml";
 var UpdateStepError = class extends Error {
@@ -411,8 +467,8 @@ async function preflightUpdate(args) {
   const failure2 = await earlyFailure(args);
   return failure2 === void 0 ? void 0 : finish(args, failure2);
 }
-async function performUpdate(args) {
-  const { configPath, own, version, deps } = args;
+async function prepareUpdate(args) {
+  const { configPath, version, deps } = args;
   const early = await earlyFailure(args);
   if (early !== void 0) return finish(args, early);
   let verified;
@@ -424,24 +480,31 @@ async function performUpdate(args) {
   if (!verified.ok) return finish(args, { outcome: verified.outcome, reason: verified.reason });
   const staged = await deps.runNode([entryIn(verified.dir), "runner", "check", "--config", configPath], verified.dir);
   if (staged.status !== 0) {
-    try {
-      rmSync(verified.dir, { recursive: true, force: true });
-    } catch {
-    }
+    removeStaging(verified.dir);
     return finish(args, {
       outcome: "retrying",
       reason: `${version} failed \`runner check\` on this host (exit ${staged.status})`,
       detail: `${version} failed \`runner check\` on this host: ${(staged.stderr.trim() || staged.stdout.trim()).slice(0, 500)}`
     });
   }
+  return { kind: "prepared", dir: verified.dir };
+}
+function removeStaging(dir) {
+  try {
+    rmSync(dir, { recursive: true });
+  } catch {
+  }
+}
+function installPrepared(args, stagedDir) {
+  const { configPath, own, version } = args;
   try {
     if (version !== own) rmSync(versionDir(configPath, version), { recursive: true, force: true });
-    renameSync(verified.dir, versionDir(configPath, version));
+    renameSync(stagedDir, versionDir(configPath, version));
     writeMarker(configPath, { from: own, to: version, starts: 0 });
     switchCurrent(configPath, version);
   } catch (err) {
     try {
-      rmSync(verified.dir, { recursive: true, force: true });
+      rmSync(stagedDir, { recursive: true, force: true });
       if (currentVersion(configPath) !== version) removeMarker(configPath);
     } catch {
     }
@@ -455,6 +518,10 @@ async function performUpdate(args) {
   args.log.line(`updating ${own} -> ${version} \xB7 restarting`);
   return { kind: "switched" };
 }
+async function performUpdate(args) {
+  const prepared = await prepareUpdate(args);
+  return prepared.kind === "prepared" ? installPrepared(args, prepared.dir) : prepared;
+}
 function rollBack(configPath, marker, reason, detail, now, log) {
   try {
     writeLastUpdate(configPath, { from: marker.from, to: marker.to, outcome: "rolled_back", reason, at: isoAt(now) });
@@ -1242,12 +1309,20 @@ function updateArgsOf(state, update, version) {
 function dropPendingUpdate(state) {
   state.pendingUpdate = void 0;
   state.preflightedUpdate = void 0;
+  discardPrepared(state);
   clearUpdateWait(state);
 }
+function discardPrepared(state) {
+  if (state.preparedUpdate === void 0) return;
+  removeStaging(state.preparedUpdate.dir);
+  state.preparedUpdate = void 0;
+}
 function clearUpdateWait(state) {
   state.updateWait = void 0;
   state.updateLogged = void 0;
   state.upgradeRefused = false;
+  if (state.installWait !== void 0) return;
+  state.waitsLogged = void 0;
   recordPendingUpdate(state, void 0);
 }
 function recordPendingUpdate(state, record) {
@@ -1271,7 +1346,7 @@ function runningItems(state) {
   const numbers = [...state.jobs.values()].map((entry) => Number(entry.job.item)).filter((n) => Number.isFinite(n));
   return numbers.sort((a, b) => a - b);
 }
-function holdForUpdate(state, version, mayHold = true) {
+function holdForUpdate(state, version, mayHold = true, waits = []) {
   const log = logOf(state);
   const nowMs = nowOf(state).getTime();
   const wait = adoptUpdateWait(state, version, nowMs);
@@ -1286,6 +1361,11 @@ function holdForUpdate(state, version, mayHold = true) {
   const maxWaitMs = (state.config.update?.maxWaitHours ?? DEFAULT_UPDATE_MAX_WAIT_HOURS) * 60 * 6e4;
   const holding = mayHold && (state.upgradeRefused === true || nowMs - wait.sinceMs >= maxWaitMs);
   const record = { version, since: new Date(wait.sinceMs).toISOString() };
+  if (waits.length > 0) {
+    record.via = "self-update";
+    record.waits = recordedWaits(waits);
+  }
+  noteWaits(state, version, waits);
   if (holding) {
     wait.holdSinceMs ??= nowMs;
     const builds = runningItems(state);
@@ -1302,6 +1382,16 @@ function holdForUpdate(state, version, mayHold = true) {
   recordPendingUpdate(state, record);
   return holding;
 }
+function recordedWaits(waits) {
+  return waits.flatMap((wait) => Number.isFinite(Number(wait.item)) ? [{ item: Number(wait.item), reason: wait.reason }] : []);
+}
+function noteWaits(state, version, waits) {
+  const phrase = waits.map((wait) => `#${wait.item} ${wait.reason}`).join("; ");
+  const key = waits.length === 0 ? void 0 : `${version}:${phrase}`;
+  if (state.waitsLogged === key) return;
+  state.waitsLogged = key;
+  if (key !== void 0) logOf(state).line(`update to ${version} waits: ${phrase}`);
+}
 function buildsPhrase(builds) {
   return builds.length === 0 ? "the running builds" : builds.map((n) => `#${n}`).join(", ");
 }
@@ -1325,7 +1415,7 @@ function installedSwitchOf(state, update) {
     installed: current !== void 0 && existsSync(entryIn(versionDir(configPath, current)))
   });
 }
-function restartOntoInstalled(state) {
+async function restartOntoInstalled(state) {
   const update = state.deps.update;
   if (update === void 0) return false;
   const configPath = state.config.configPath;
@@ -1333,6 +1423,8 @@ function restartOntoInstalled(state) {
   const decision = installedSwitchOf(state, update);
   if (decision.kind === "none") {
     state.installedSwitch = void 0;
+    state.installedFormats = void 0;
+    state.installWait = void 0;
     return false;
   }
   const said = `${decision.kind}:${decision.to}`;
@@ -1348,8 +1440,14 @@ function restartOntoInstalled(state) {
     return false;
   }
   if (state.jobs.size > 0) {
-    if (first) log.line(`${decision.to} is installed \xB7 taking no new work, restarting onto it once ${state.jobs.size} running build(s) finish`);
-    return true;
+    const waits = await installBlockers(state, update, decision.to);
+    if (waits.length > 0) {
+      if (first) log.line(`${decision.to} is installed \xB7 taking no new work, restarting onto it once ${state.jobs.size} running build(s) finish`);
+      const wait = state.installWait = state.installWait?.version === decision.to ? state.installWait : { version: decision.to, sinceMs: nowOf(state).getTime() };
+      noteWaits(state, decision.to, waits);
+      recordPendingUpdate(state, { version: decision.to, since: new Date(wait.sinceMs).toISOString(), via: "install", waits: recordedWaits(waits) });
+      return true;
+    }
   }
   try {
     writeMarker(configPath, { from: own, to: decision.to, starts: 0 });
@@ -1360,10 +1458,66 @@ function restartOntoInstalled(state) {
   (state.exitForUpdate ?? (() => update.exit(RESTART_EXIT_STATUS)))();
   return true;
 }
+function runningBuilds(state) {
+  return [...state.jobs.values()].map((active) => ({ job: active.job, ending: active.ending }));
+}
+async function installBlockers(state, update, to) {
+  const stage = buildBlockers(runningBuilds(state));
+  if (stage.length > 0) return stage;
+  if (state.installedFormats?.version !== to) {
+    const dir = versionDir(state.config.configPath, to);
+    state.installedFormats = { version: to, reads: await askJobStateFormats(update.runNode, entryIn(dir), dir) };
+  }
+  return restartBlockers(runningBuilds(state), state.installedFormats.reads);
+}
+function formatBlocked(builds, reads) {
+  const byStage = new Set(buildBlockers(builds).map((blocker) => blocker.item));
+  return restartBlockers(builds, reads).some((blocker) => !byStage.has(blocker.item));
+}
+async function restartNow(state, update, version) {
+  const early = buildBlockers(runningBuilds(state));
+  if (early.length > 0) return { kind: "waiting", waits: early };
+  if (state.preparedUpdate !== void 0 && state.preparedUpdate.version !== version) discardPrepared(state);
+  const args = updateArgsOf(state, update, version);
+  let reads;
+  const declined = state.declinedFormats?.has(version) === true;
+  if (state.preparedUpdate !== void 0) {
+    reads = state.preparedUpdate.reads;
+  } else if (declined && restartBlockers(runningBuilds(state), state.declinedFormats.get(version)).length > 0) {
+    reads = state.declinedFormats.get(version);
+  } else {
+    const prepared = await prepareUpdate(args);
+    if (prepared.kind !== "prepared") {
+      dropPendingUpdate(state);
+      reportUpdateResult(state, version, prepared);
+      return { kind: "failed" };
+    }
+    reads = await askJobStateFormats(update.runNode, entryIn(prepared.dir), prepared.dir);
+    if (formatBlocked(runningBuilds(state), reads)) {
+      removeStaging(prepared.dir);
+      (state.declinedFormats ??= /* @__PURE__ */ new Map()).set(version, reads);
+    } else {
+      state.preparedUpdate = { version, dir: prepared.dir, reads };
+    }
+  }
+  const waits = restartBlockers(runningBuilds(state), reads);
+  if (waits.length > 0) return { kind: "waiting", waits };
+  const staged = state.preparedUpdate;
+  state.preparedUpdate = void 0;
+  dropPendingUpdate(state);
+  const result = installPrepared(args, staged.dir);
+  if (result.kind === "switched") {
+    (state.exitForUpdate ?? (() => update.exit(RESTART_EXIT_STATUS)))();
+    return { kind: "restarted" };
+  }
+  reportUpdateResult(state, version, result);
+  return { kind: "failed" };
+}
 async function updateWhenIdle(state) {
   const update = state.deps.update;
   const version = state.pendingUpdate;
   if (update === void 0 || version === void 0) {
+    discardPrepared(state);
     recordPendingUpdate(state, void 0);
     return false;
   }
@@ -1389,6 +1543,12 @@ async function updateWhenIdle(state) {
       }
       state.preflightedUpdate = version;
     }
+    if (update.underService === true) {
+      const outcome = await restartNow(state, update, version);
+      if (outcome.kind === "restarted") return true;
+      if (outcome.kind === "failed") return false;
+      return holdForUpdate(state, version, true, outcome.waits);
+    }
     return holdForUpdate(state, version);
   }
   dropPendingUpdate(state);
@@ -1523,7 +1683,7 @@ async function runTick(state) {
   state.holdingForUpdate = false;
   if (state.draining === true) return;
   reloadConfig(state);
-  if (restartOntoInstalled(state)) {
+  if (await restartOntoInstalled(state)) {
     state.restarting = true;
     return;
   }
@@ -1586,7 +1746,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-APXSER2D.js');
+  const { postJson: postJson2 } = await import('./work-cmd-6HARIBMW.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1646,7 +1806,7 @@ async function tryClaimAndStart(state, item, queue) {
   }
   if (wasExtended(data)) {
     log.line(
-      `#${item.number} skipped: the claim extended a live lease under host "${state.config.host}" \xB7 set a distinct runner.host per config file`
+      `#${item.number} skipped: the claim extended a live lease under the runner name "${state.config.host}" \xB7 set a distinct runner.name per config file`
     );
     return { kind: "held" };
   }
@@ -1736,6 +1896,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   const runnerRoot = runnerDir(state.config.configPath);
   const jobFilePath = join(dirPath, "job.json");
   let job = {
+    stateFormat: state.deps.jobStateFormat ?? JOB_STATE_FORMAT,
     item: item.number,
     queue,
     claimId,
@@ -2555,6 +2716,13 @@ async function finishTrackedWhileAway(state, dirPath, job, where) {
     `recovered job ${finished.queue} #${finished.item} (claim ${shortClaim(finished.claimId)}) as ${outcome}: ${code === void 0 ? `its container ${where === "missing" ? "is gone" : "stopped"} and its volume ${read.readable ? "holds no exit code" : "could not be read"}` : `its command recorded exit ${code}`}`
   );
 }
+async function logUnusableHelper(config, runtime, log) {
+  if (!isBuiltinVm(config.hooks.provision)) return;
+  const helper = await runtime.vm.helper.probe();
+  if (helper.ok) return;
+  if (helper.reason === "unsupported") log.line(helper.detail);
+  else if (helper.unreachable === true) log.line(`${helper.detail}, so microVM builds run without the jailer`);
+}
 async function start(configPath, deps = { fetchImpl: fetch }) {
   const log = deps.log ??= createRunnerLog(deps.now ?? (() => /* @__PURE__ */ new Date()));
   const update = deps.update;
@@ -2562,7 +2730,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-YYKNYFNI.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-C6HEFW6R.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2601,12 +2769,16 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const state = { config, jobs: /* @__PURE__ */ new Map(), deps, configMtimeMs };
   log.line(`runner ${config.host} started \xB7 config ${configPath} \xB7 ${describeConfig(config)}`);
   const nowMs = () => deps.now ? deps.now().getTime() : Date.now();
-  const runningMicroVms = await stopOrphanedMicroVms({ jobs: unfinishedJobs(jobsDir(configPath)), runtime: runtimeOf(state) }).catch((err) => {
+  await logUnusableHelper(config, runtimeOf(state), log);
+  const runningMicroVms = await stopOrphanedMicroVms({ jobs: unfinishedJobs(jobsDir(configPath)), runtime: runtimeOf(state), onError: (line) => log.error(line) }).catch((err) => {
     log.error(`a microVM an earlier runner left could not be stopped: ${describeCallFailure(err)}`);
     return [];
   });
   for (const buildId of runningMicroVms) log.line(`stopped microVM build ${buildId}, left running by an earlier runner`);
   const attemptLogs = attemptLogsOf(state);
+  for (const { job, format } of listUnreadableJobs(jobsDir(configPath))) {
+    log.error(`leaving job ${job.queue} #${job.item} alone: its job-state format ${format} is not one this version reads`);
+  }
   for (const { dirPath, job } of listAdoptableJobs(jobsDir(configPath))) {
     const adopted = { job, dirPath, lastRenewAtMs: nowMs(), cmd: null, cpuSample: null, ending: false };
     state.jobs.set(dirPath, adopted);
@@ -2843,4 +3015,4 @@ function runnerProcessState(configPath) {
   return isSameProcess(entry.pid, entry.start) ? { state: "running", pid: entry.pid } : { state: "stale", pid: entry.pid };
 }
 
-export { RunnerStartError, listJobFiles, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick };
+export { RunnerStartError, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick };

package/dist/{chunk-E4OUL7ZP.js → chunk-FXUVXSY2.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-MQ743JX3.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-FKXGQOF5.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-M4B6QKNZ.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-BN3CSI7S.js';
+import { withTokenHeader } from './chunk-2K3TCQHW.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-F7Y2USIM.js → chunk-H6ZFLIX3.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-F2W2IYNP.js';
+import { autoConnect, detectActiveSession } from './chunk-3WZ5ECSM.js';
 import { acquireSpoolLockAt } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FKXGQOF5.js';
-import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
+import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-LY2L3O2O.js → chunk-HPOEVC2V.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-PDIM5T65.js';
+import { EXEC_PORT } from './chunk-XGJUNNXL.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);
@@ -173,7 +173,8 @@ async function waitForAgent(socketPath, options) {
     try {
       await execCapture(socketPath, { argv: ["true"], user: "root", cwd: "/", env: {} });
       return true;
-    } catch {
+    } catch (err) {
+      options.onFailure?.(err);
       await options.sleep(options.delayMs);
     }
   }

package/dist/{chunk-ZFLOFAUG.js → chunk-I25F6YVP.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned, checkBuildSkill } from './chunk-XFGL53GU.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-RVYOOYOA.js';
-import { isLinkedRepository } from './chunk-V5Q3S4NM.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-CQRIZNE6.js';
+import { isLinkedRepository } from './chunk-SNQR2EYI.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { checkFormerSkillNames } from './chunk-MQ743JX3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-FKXGQOF5.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-755WXDBI.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-M4B6QKNZ.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-K5WVK7IC.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-DXDF43YG.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-D4AMAEZ7.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-GNPTU4BM.js';
@@ -1174,7 +1174,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-7Z5DHSGY.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-JJ3EO7SB.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1186,7 +1186,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-DOAFZV4O.js');
+    const { runnerHostChecks } = await import('./doctor-S6YCZGUU.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1221,7 +1221,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-ORQC26ZE.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-MPEJJ7X6.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-DG2ULWM6.js → chunk-IGRRD7PX.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-D7X5ITVT.js';
+import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { runnerDir } from './chunk-KF37SUDM.js';
+import { runnerDir } from './chunk-ZI2ZVWKT.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 
@@ -16,16 +16,19 @@ function escapeUnitPath(path) {
   return path.replace(/%/g, "%%").replace(/ /g, "\\x20");
 }
 function runnerUnit(unit) {
+  const helperService = unit.helper === void 0 ? void 0 : `${unit.helper.unit}.service`;
   return `${UNIT_MARKER}
 [Unit]
 Description=OuterLayer runner
-After=network-online.target${unit.docker ? " docker.service" : ""}
+After=network-online.target${unit.docker ? " docker.service" : ""}${helperService === void 0 ? "" : ` ${helperService}`}
 Wants=network-online.target
-${unit.docker ? "Requires=docker.service\n" : ""}
+${helperService === void 0 ? "" : `Wants=${helperService}
+`}${unit.docker ? "Requires=docker.service\n" : ""}
 [Service]
 User=${unit.user}
 ExecStart=${unit.execStart}
-EnvironmentFile=-${escapeUnitPath(`${unit.configDir}/runner.env`)}
+${unit.helper === void 0 ? "" : `Environment=OUTERLAYER_HELPER_SOCKET=${unit.helper.socket}
+`}EnvironmentFile=-${escapeUnitPath(`${unit.configDir}/runner.env`)}
 Restart=on-failure
 RestartForceExitStatus=75
 RestartSec=30
@@ -143,7 +146,8 @@ function installService(request, deps) {
     configDir: dirname(request.configPath),
     execStart: request.execStart,
     timeLimitMinutes: request.timeLimitMinutes,
-    docker: kind === "container" || kind === "vm" || builtinKind(request.hooks.cleanup) === "container" || builtinKind(request.hooks.cleanup) === "vm"
+    docker: kind === "container" || kind === "vm" || builtinKind(request.hooks.cleanup) === "container" || builtinKind(request.hooks.cleanup) === "vm",
+    ...request.helperSocket !== void 0 && request.helperUnit !== void 0 ? { helper: { unit: request.helperUnit, socket: request.helperSocket } } : {}
   });
   if (request.print === true) return outcome(true, "printed", [], unit);
   if (own) return outcome(false, "refused", [OWN_HOOKS]);
@@ -274,4 +278,4 @@ function uninstallService(request, deps) {
   return outcome(true, "removed", lines);
 }
 
-export { DEFAULT_UNIT_NAME, RUNNER_RESERVE_BYTES, VM_SERVICE_NAME, checkFit, installService, realTaskScheduler, uninstallService, unitPathFor };
+export { DEFAULT_UNIT_NAME, RUNNER_RESERVE_BYTES, UNIT_MARKER, VM_SERVICE_NAME, checkFit, installService, realTaskScheduler, uninstallService, unitPathFor };

package/dist/{chunk-GISNHSYL.js → chunk-JGD5TWQ2.js}

@@ -30,12 +30,14 @@ var UNKNOWN_TRANSPORT_REASON = "the runner cannot tell how this build reaches it
 var COMMAND_LOST_REASON = "the build's command ended without recording an exit code";
 var CONTAINER_STOPPED_REASON = "the build's container stopped while no runner was managing it";
 var UNKNOWN_TRACKING_REASON = "the runner cannot tell how this build is tracked";
+var DOCKER_DESKTOP_REASON = "Docker Desktop is accepted only for a runner in the runner image, so container builds here need Docker Engine: install it (on Windows, inside WSL2), run the runner image, or use builtin:process";
 var RUNNER_WORDED_REASONS = /* @__PURE__ */ new Set([
   MALFORMED_REASON,
   UNKNOWN_TRANSPORT_REASON,
   COMMAND_LOST_REASON,
   CONTAINER_STOPPED_REASON,
-  UNKNOWN_TRACKING_REASON
+  UNKNOWN_TRACKING_REASON,
+  DOCKER_DESKTOP_REASON
 ]);
 
-export { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON, JOIN_DIR, JOIN_SOCKET, JOIN_WAIT_MS, MALFORMED_REASON, MAX_MALFORMED_SESSIONS, MAX_OPEN_STREAMS, RELAY_ID, RELAY_USER, RUNNER_WORDED_REASONS, SESSION_WINDOW, STREAM_WINDOW, TARGET_CLAUDE, TARGET_GATEWAY, TARGET_LEASE, TARGET_TUNNEL, UNKNOWN_TRACKING_REASON, UNKNOWN_TRANSPORT_REASON, destinationTarget, targetOfPath };
+export { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON, DOCKER_DESKTOP_REASON, JOIN_DIR, JOIN_SOCKET, JOIN_WAIT_MS, MALFORMED_REASON, MAX_MALFORMED_SESSIONS, MAX_OPEN_STREAMS, RELAY_ID, RELAY_USER, RUNNER_WORDED_REASONS, SESSION_WINDOW, STREAM_WINDOW, TARGET_CLAUDE, TARGET_GATEWAY, TARGET_LEASE, TARGET_TUNNEL, UNKNOWN_TRACKING_REASON, UNKNOWN_TRANSPORT_REASON, destinationTarget, targetOfPath };

package/dist/{chunk-D7X5ITVT.js → chunk-JWRX5ZTT.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BN3CSI7S.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-2K3TCQHW.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';
@@ -92,6 +92,7 @@ function runnerVmOf(configPath) {
   }
 }
 var RUNNER_KEYS = [
+  "name",
   "host",
   "queues",
   "concurrency",
@@ -212,6 +213,9 @@ function loadRunnerConfig(configPath) {
   if (runner.autoUpdate !== void 0 && typeof runner.autoUpdate !== "boolean") {
     fail(configPath, "runner.autoUpdate", "must be true or false");
   }
+  if (runner.name !== void 0 && runner.host !== void 0 && runner.name !== runner.host) {
+    fail(configPath, "runner.name", `is "${runner.name}" and runner.host is "${runner.host}"; set runner.name only, since runner.host is its earlier name`);
+  }
   const queues = runner.queues && runner.queues.length > 0 ? runner.queues : [...RUNNER_QUEUES];
   for (const queue of queues) {
     if (!RUNNER_QUEUES.includes(queue)) {
@@ -241,7 +245,7 @@ function loadRunnerConfig(configPath) {
     appId: config.appId,
     repos: config.repos,
     scrub: config.scrub,
-    host: runner.host ?? hostname(),
+    host: runner.name ?? runner.host ?? hostname(),
     queues,
     concurrency: runner.concurrency ?? DEFAULT_CONCURRENCY,
     pollSeconds: runner.pollSeconds ?? DEFAULT_POLL_SECONDS,

package/dist/{chunk-755WXDBI.js → chunk-K5WVK7IC.js}

@@ -628,7 +628,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-GKGI6HJA.js');
+  const { governanceOf } = await import('./control-plane-launch-ZFT6SI4N.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-FKXGQOF5.js → chunk-M4B6QKNZ.js}

@@ -5,7 +5,7 @@ import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { signRunnerRequest, signerFor } from './chunk-PVRBE7S4.js';
+import { signRunnerRequest, signerFor } from './chunk-ZODVSFI4.js';
 
 createRequire(import.meta.url);