@outerlayer/cli 0.26.3 → 0.27.0

package/dist/{chunk-XF77SNB4.js → chunk-ZXRWMOJ3.js}

@@ -1,34 +1,35 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-SKZG7SAN.js';
-import { writePendingUpdate } from './chunk-TKL74NLB.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-RK7FWC6B.js';
+import { writePendingUpdate } from './chunk-RHGF73IU.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-6FAP657M.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-ABXQBEYK.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-ZPXI7LMG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-4IFKLYMM.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-WVDP6HVZ.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-MATUHHN4.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-VHVFU6QU.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-665QWBNW.js';
+import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, createContainerRuntime, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-YF56R4DV.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-WSYXLLA5.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-M3MHHIUW.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { checkFit } from './chunk-MLD2NA7N.js';
-import { claimPidFile, readPidFile, releasePidFile } from './chunk-PYSKSROG.js';
+import { checkFit } from './chunk-7AQ5AM7U.js';
+import { fdName } from './chunk-YB3CSYXX.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-D7ECMB7B.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-ZLEXMZFW.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-J7BXZLSO.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-UKCNOAO6.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWRX5ZTT.js';
-import { exceedsDisk } from './chunk-7RQ73DLO.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-JH2GQU5T.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-55GNQPO6.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-EPPIISRD.js';
+import { exceedsDisk } from './chunk-YJLHUKYS.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-F6DIHHBS.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-L4CW6LZQ.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-2K3TCQHW.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-Y4OKEFAX.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-RHAGBUL5.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-2I3LIRZP.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-JGD5TWQ2.js';
 import { randomBytes } from 'crypto';
-import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, rmSync, closeSync, openSync, constants, lstatSync } from 'fs';
+import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, openSync, constants, lstatSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem, constants as constants$1 } from 'os';
 
@@ -272,8 +273,11 @@ function stageReason(job) {
   }
 }
 function ownReason({ job, ending }) {
-  if (job.microvm !== void 0) return "runs in a microVM, which does not carry on through a restart";
-  if (!isContainerTracked(job)) return "is not a container build tracked inside its container";
+  if (job.microvm !== void 0) {
+    if (!isMicroVmTracked(job)) return "is a microVM build that a restarted runner cannot adopt";
+  } else if (!isContainerTracked(job)) {
+    return "is not a container build tracked inside its container";
+  }
   if (ending) return "is being ended";
   return stageReason(job);
 }
@@ -986,6 +990,30 @@ function writeCommitHooks(buildDir2, coAuthor) {
   chmodSync(data, 420);
   return dir;
 }
+
+// src/runner/microvm/adopt.ts
+var MICROVM_STOPPED_REASON = "the build's microVM stopped while no runner was managing it";
+var MICROVM_SOCKETS_LOST_REASON = "the build's sockets did not survive the runner's restart";
+var MICROVM_HELPER_UNREACHABLE_REASON = "the runner could not ask its helper about the build's microVM when it started";
+async function judgeMicroVmAdoption(input) {
+  const { job, runtime } = input;
+  const state = job.microvm;
+  if (state === void 0 || !isMicroVmTracked(job)) return "unservable";
+  const probe = await runtime.vm.helper.probe();
+  if (probe.ok) {
+    const unit = await probe.client.state(state.buildId).catch((err) => {
+      input.onError?.(`the state of the unit of build ${state.buildId} could not be read: ${describeCallFailure(err)}`);
+      return { active: true, oomKills: 0 };
+    });
+    if (!unit.active) return "stopped";
+  } else {
+    input.onError?.(`the unit of build ${state.buildId} could not be asked about, because there is no helper to ask: ${probe.detail}`);
+    return probe.unreachable === true ? "unasked" : "unservable";
+  }
+  const inherited = runtime.vm.fdStore.inherited();
+  const names = state.fdStore ?? [];
+  return names.length > 0 && names.every((name) => inherited.has(name)) ? "adopt" : "unservable";
+}
 function linuxSignalName(number) {
   const names = {
     1: "SIGHUP",
@@ -1749,7 +1777,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-UQ45HDM4.js');
+  const { postJson: postJson2 } = await import('./work-cmd-VECTYST6.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1933,11 +1961,16 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     writeJobFile(jobFilePath, active.job);
     tokens = buildTokensFor(state, active, item.number);
     runtimeOf(state).credentials.set(dirPath, tokens);
+    let asking;
     try {
       await tokens.token("read");
+      for (const entry of repositories) {
+        asking = entry.repository;
+        await tokens.token("read", entry.repository);
+      }
     } catch (err) {
       if (active.ending) return;
-      await endOnTokenRefusal(state, active, err);
+      await endOnTokenRefusal(state, active, err, asking);
       return;
     }
     if (active.ending) return;
@@ -2242,8 +2275,16 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   try {
     if (job.microvm !== void 0) {
       const runtime = runtimeOf(state);
-      const composed = microVmCommandLine({ job, cmdline, runtime, config: state.config, cli: join(runtime.cliBuild().distDir, "index.js") });
-      running = runCommand(composed.line, { ...composed.env, OUTERLAYER_JOB_DIR: dirPath }, dirPath, join(dirPath, "command.log"), state.deps.spawnFn);
+      if (job.microvm.jailed !== void 0 && (job.microvm.fdStore?.length ?? 0) > 0) {
+        job.microvm.tracking = "microvm";
+        job.microvm.commandDir = MICROVM_COMMAND_DIR;
+        job.microvm.commandLogBase = commandLogOffset(dirPath, 0);
+        writeJobFile(jobFilePath, job);
+        await startMicroVmCommand({ job, cmdline, runtime, config: state.config });
+      } else {
+        const composed = microVmCommandLine({ job, cmdline, runtime, config: state.config, cli: join(runtime.cliBuild().distDir, "index.js") });
+        running = runCommand(composed.line, { ...composed.env, OUTERLAYER_JOB_DIR: dirPath }, dirPath, join(dirPath, "command.log"), state.deps.spawnFn);
+      }
     } else if (job.container !== void 0) {
       const runtime = runtimeOf(state);
       const exec = containerCommandExec({ job, cmdline, runtime, config: state.config });
@@ -2271,7 +2312,9 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   writeJobFile(jobFilePath, job);
   const commandStartedMs = nowOf(state).getTime();
   active.commandStartedMs = commandStartedMs;
-  log.line(running === void 0 ? `${tag} command started \xB7 in container ${job.container.container}` : `${tag} command started \xB7 pid ${running.pid}`);
+  log.line(
+    running !== void 0 ? `${tag} command started \xB7 pid ${running.pid}` : job.container !== void 0 ? `${tag} command started \xB7 in container ${job.container.container}` : `${tag} command started \xB7 in microVM build ${job.microvm.buildId}`
+  );
   const sender = await startSender({
     config: state.config,
     job,
@@ -2323,19 +2366,21 @@ function buildTokensFor(state, active, item) {
     }
   });
 }
-async function endOnTokenRefusal(state, active, err) {
+async function endOnTokenRefusal(state, active, err, repository) {
   const log = logOf(state);
   const tag = `#${active.job.item}`;
   const refusal = classifyRefusal(err);
+  const which = repository === void 0 ? "the build's read token" : `the build's read token for ${repository}`;
   if (refusal.kind === "retry") {
-    log.error(`${tag} the build's read token could not be had (${describeCallFailure(err)}) \xB7 releasing the claim to try again`);
+    log.error(`${tag} ${which} could not be had (${describeCallFailure(err)}) \xB7 releasing the claim to try again`);
     await endJob(state, active, void 0);
   } else if (refusal.kind === "lease_lost") {
-    log.error(`${tag} the build's read token was refused: ${refusalCode(err)} \xB7 ending job as lease_lost`);
+    log.error(`${tag} ${which} was refused: ${refusalCode(err)} \xB7 ending job as lease_lost`);
     await endJob(state, active, "lease_lost");
   } else {
-    log.error(`${tag} the build's read token was refused: ${refusal.reason} \xB7 ending job as failed`);
-    await endJob(state, active, "failed", { stage: "provision", reason: refusal.reason });
+    const reason = repository === void 0 ? refusal.reason : `${which} could not be had: ${refusal.reason}`;
+    log.error(`${tag} ${which} was refused: ${refusal.reason} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason });
   }
 }
 async function endOnProvisionFailure(state, active, tokens, took, reason) {
@@ -2457,19 +2502,67 @@ async function endStoppedBuild(state, active, where) {
   );
   void endJob(state, active, "interrupted", { stage: "command", reason: COMMAND_LOST_REASON });
 }
+var DISK_FAILURES_LIMIT = 2;
+async function checkDisk(state, active, container, tag) {
+  const log = logOf(state);
+  const limit = state.config.build?.disk ?? "40g";
+  const runtime = runtimeOf(state);
+  const reading = await measureDisk(runtime, container);
+  if (active.ending) return false;
+  if (exceedsDisk(reading.kib ?? 0, limit)) {
+    log.line(`${tag} the build's volume holds ${reading.kib} KiB, past ${limit} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "command", reason: "disk_limit_exceeded" });
+    return true;
+  }
+  if (reading.failure === void 0) {
+    active.diskFailures = 0;
+    return false;
+  }
+  if (await runtime.host.state(container.container) !== "running" || active.ending) return false;
+  active.diskFailures = (active.diskFailures ?? 0) + 1;
+  if (active.diskFailures < DISK_FAILURES_LIMIT) {
+    log.error(`${tag} disk check failed (${active.diskFailures} of ${DISK_FAILURES_LIMIT}): ${reading.failure} \xB7 checking again`);
+    return false;
+  }
+  log.error(`${tag} disk check failed (${active.diskFailures} of ${DISK_FAILURES_LIMIT}): ${reading.failure} \xB7 ending job as failed`);
+  await endJob(state, active, "failed", { stage: "command", reason: "disk_check_failed" });
+  return true;
+}
+async function endOrWaitForMicroVm(state, active) {
+  const log = logOf(state);
+  const tag = `#${active.job.item}`;
+  const microvm = active.job.microvm;
+  const runtime = runtimeOf(state);
+  const helper = await runtime.vm.helper.probe();
+  const unit = helper.ok ? await helper.client.state(microvm.buildId).catch(() => void 0) : void 0;
+  if (active.ending) return;
+  if (unit?.active === false) {
+    const killed = await microVmOomKills(runtime, microvm).catch(() => 0);
+    log.line(`${tag} the build's microVM stopped \xB7 ending job as interrupted`);
+    void endJob(state, active, "interrupted", killed > 0 ? { stage: "command" } : { stage: "command", reason: MICROVM_STOPPED_REASON });
+  } else if (active.probeFailing !== true) {
+    active.probeFailing = true;
+    log.error(`${tag} the build's command could not be read from its microVM \xB7 trying again`);
+  }
+}
 async function probeBuild(state, active) {
   const container = active.job.container;
-  if (container === void 0 || !isContainerTracked(active.job) || active.ending || active.probing) return;
+  const tracked = container !== void 0 && isContainerTracked(active.job) ? container : isMicroVmTracked(active.job) ? active.job.microvm : void 0;
+  if (tracked === void 0 || active.ending || active.probing) return;
   active.probing = true;
   const log = logOf(state);
   const tag = `#${active.job.item}`;
   try {
     const runtime = runtimeOf(state);
     for (; ; ) {
-      const offset = commandLogOffset(active.dirPath, container.commandLogBase);
-      const probe = await probeCommand(runtime, container, offset);
+      const offset = commandLogOffset(active.dirPath, tracked.commandLogBase);
+      const probe = container === void 0 ? await probeMicroVmCommand(runtime, active.job.microvm, offset) : await probeCommand(runtime, container, offset);
       if (active.ending) return;
       if (probe === void 0) {
+        if (container === void 0) {
+          await endOrWaitForMicroVm(state, active);
+          return;
+        }
         const where = await runtime.host.state(container.container);
         if (where === "stopped" || where === "missing") {
           await endStoppedBuild(state, active, where);
@@ -2520,7 +2613,7 @@ async function watchTick(state, active, nowMs, logMtimeMs) {
   const log = logOf(state);
   const tag = `#${active.job.item}`;
   const pid = active.job.pid;
-  const started = pid !== void 0 || isContainerTracked(active.job);
+  const started = pid !== void 0 || isTracked(active.job);
   if (pid !== void 0 && !isGroupAlive(pid)) {
     if (active.cmd === null) {
       const recorded = outcomeFromExitCode(active.dirPath);
@@ -2563,13 +2656,12 @@ async function watchTick(state, active, nowMs, logMtimeMs) {
     return;
   }
   if (!started) return;
-  if (active.job.container !== void 0) {
-    const limit = state.config.build?.disk ?? "40g";
-    const used = await measureDisk(runtimeOf(state), active.job.container);
-    if (exceedsDisk(used ?? 0, limit)) {
-      log.line(`${tag} the build's volume holds ${used} KiB, past ${limit} \xB7 ending job as failed`);
-      await endJob(state, active, "failed", { stage: "command", reason: "disk_limit_exceeded" });
-      return;
+  if (active.job.container !== void 0 && active.diskChecking !== true) {
+    active.diskChecking = true;
+    try {
+      if (await checkDisk(state, active, active.job.container, tag)) return;
+    } finally {
+      active.diskChecking = false;
     }
   }
   let cpuUsecPerMinute = null;
@@ -2641,7 +2733,7 @@ async function adoptTrackedBuilds(state, jobsDirPath) {
   const attemptLogs = attemptLogsOf(state);
   const runtime = runtimeOf(state);
   for (const { dirPath, job, known } of listTrackedJobs(jobsDirPath)) {
-    if (!known) continue;
+    if (!known || job.container === void 0) continue;
     const container = job.container;
     const where = await runtime.host.state(container.container).catch(() => "unknown");
     if (where === "stopped" || where === "missing") {
@@ -2662,6 +2754,116 @@ async function adoptTrackedBuilds(state, jobsDirPath) {
     void probeBuild(state, adopted);
   }
 }
+async function planMicroVmAdoption(state, jobsDirPath) {
+  const plan = { adopt: [], away: [], unservable: [], unasked: [] };
+  for (const { dirPath, job, known } of listTrackedJobs(jobsDirPath)) {
+    if (!known || !isMicroVmTracked(job)) continue;
+    const verdict = await judgeMicroVmAdoption({ job, runtime: runtimeOf(state), onError: (line) => logOf(state).error(line) });
+    plan[verdict === "adopt" ? "adopt" : verdict === "stopped" ? "away" : verdict === "unasked" ? "unasked" : "unservable"].push({ dirPath, job });
+  }
+  return plan;
+}
+async function rejoinMicroVmBuild(state, adopted) {
+  const { job, dirPath } = adopted;
+  const config = state.config;
+  const microvm = job.microvm;
+  const runtime = runtimeOf(state);
+  const tag = `#${job.item}`;
+  const log = logOf(state);
+  const inherited = runtime.vm.fdStore.inherited();
+  const inherit = (socket) => {
+    const fd = inherited.get(fdName(microvm.buildId, socket.replace(/\.sock$/, "")));
+    return fd === void 0 ? void 0 : (server) => runtime.vm.fdStore.listenOn(server, fd);
+  };
+  const tokens = buildTokensFor(state, adopted, job.item);
+  runtime.credentials.set(dirPath, tokens);
+  let servicesServed = false;
+  let leaseServed = false;
+  try {
+    const repositories = repositoriesOf({ repositories: job.repositories, repository: microvm.repository, branch: job.branch });
+    const gitRemote = repositories.length === 0 ? void 0 : gitRemoteFor(runtime, { repositories, tokens, buildDir: microvm.buildDir, log: (line) => log.line(`${tag} ${line}`) });
+    runtime.tunnels.set(microvm.buildId, await startServicesFor(runtime, config, microvm.buildDir, dirPath, job.itemKey, microvm.builtIns === true, gitRemote, "socket", void 0, inherit));
+    servicesServed = true;
+  } catch (err) {
+    log.error(`${tag} the adopted build's services could not be served again: ${describeCallFailure(err)}`);
+  }
+  try {
+    const channel = createLeaseChannel(leaseTimeLeftFor(state, adopted));
+    const served = await serveLease(join(microvm.buildDir, "lease.sock"), { ...channel, accept: (stream) => runtime.leases.get(microvm.buildId)?.accept(stream) }, void 0, inherit("lease.sock"));
+    runtime.leases.set(microvm.buildId, { ...channel, close: served.close });
+    leaseServed = true;
+  } catch (err) {
+    log.error(`${tag} the adopted build's lease stream could not be served again: ${describeCallFailure(err)}`);
+  }
+  try {
+    await tokens.token("read");
+  } catch (err) {
+    log.error(`${tag} could not give the adopted build a read token: ${describeCallFailure(err)}`);
+  }
+  let pushes = Promise.resolve();
+  tokens.onRead((token) => {
+    pushes = pushes.then(async () => {
+      if (vmAlive(runtime, microvm)) await writeGuestGhConfig(runtime, microvm, token);
+    }).catch((err) => log.error(`${tag} the read token could not be written for gh in the guest: ${describeCallFailure(err)}`));
+  });
+  await pushes;
+  return servicesServed && leaseServed;
+}
+async function adoptTrackedMicroVms(state, plan) {
+  const log = logOf(state);
+  const attemptLogs = attemptLogsOf(state);
+  const runtime = runtimeOf(state);
+  for (const { dirPath, job } of plan.away) await finishMicroVmWhileAway(state, dirPath, job, MICROVM_STOPPED_REASON, "its unit stopped");
+  for (const { dirPath, job } of plan.unservable) await finishMicroVmWhileAway(state, dirPath, job, MICROVM_SOCKETS_LOST_REASON, "the sockets it reaches the runner on are gone");
+  for (const { dirPath, job } of plan.unasked) await finishMicroVmWhileAway(state, dirPath, job, MICROVM_HELPER_UNREACHABLE_REASON, "the helper did not answer about its unit");
+  for (const { dirPath, job } of plan.adopt) {
+    const adopted = { job, dirPath, lastRenewAtMs: 0, cmd: null, cpuSample: null, ending: false };
+    state.jobs.set(dirPath, adopted);
+    attemptLogs.open(job.item, dirPath);
+    if (!await rejoinMicroVmBuild(state, adopted)) {
+      state.jobs.delete(dirPath);
+      await finishMicroVmWhileAway(state, dirPath, job, MICROVM_SOCKETS_LOST_REASON, "the sockets it reaches the runner on could not be served again");
+      continue;
+    }
+    if (!await renewLeaseIfDue(state, adopted, nowOf(state).getTime())) continue;
+    const sender = await restartSender({ config: state.config, job: adopted.job, jobDir: dirPath, deps: { spawnFn: state.deps.spawnFn, runtime, log, sleep: state.deps.sleep } });
+    adopted.job = sender === void 0 ? { ...adopted.job, sender: void 0 } : { ...adopted.job, sender };
+    writeJobFile(join(dirPath, "job.json"), adopted.job);
+    const line = `adopted job ${job.queue} #${job.item} (claim ${shortClaim(job.claimId)}) \xB7 command tracked in microVM build ${job.microvm.buildId}`;
+    log.line(line);
+    attemptLogs.note(job.item, line);
+    void probeBuild(state, adopted);
+  }
+  await removeUnadoptedSockets(state, new Set(plan.adopt.map(({ job }) => job.microvm.buildId)));
+}
+async function removeUnadoptedSockets(state, adopted) {
+  const store = runtimeOf(state).vm.fdStore;
+  for (const [name, fd] of store.inherited()) {
+    const buildId = /^ol-([0-9a-f]+)-/.exec(name)?.[1];
+    if (buildId === void 0 || adopted.has(buildId)) continue;
+    await store.remove(name).catch((err) => logOf(state).error(`the descriptor ${name} could not be taken out of the store: ${describeCallFailure(err)}`));
+    try {
+      closeSync(fd);
+    } catch {
+    }
+  }
+}
+async function finishMicroVmWhileAway(state, dirPath, job, reason, why) {
+  const log = logOf(state);
+  const recorded = outcomeFromExitCode(dirPath);
+  let outcome = "interrupted";
+  let ending = { reason };
+  if (recorded !== void 0) {
+    job.exitCode = recorded.code;
+    job.commandEndReason = jobNotEndedByRunnerReason({ code: recorded.code, signal: null }, job);
+    outcome = recorded.outcome === "ok" ? "ok" : "failed";
+    ending = void 0;
+  }
+  const finished = await finishJob(job, dirPath, outcome, state.config, finishDepsOf(state), ending);
+  log.line(
+    `recovered job ${finished.queue} #${finished.item} (claim ${shortClaim(finished.claimId)}) as ${outcome}: ${recorded === void 0 ? `${why}, and no exit code had been read` : `its command recorded exit ${recorded.code}`}`
+  );
+}
 async function readStoppedBuild(state, dirPath, job) {
   const runtime = runtimeOf(state);
   const container = job.container;
@@ -2721,6 +2923,11 @@ async function finishTrackedWhileAway(state, dirPath, job, where) {
     `recovered job ${finished.queue} #${finished.item} (claim ${shortClaim(finished.claimId)}) as ${outcome}: ${code === void 0 ? `its container ${where === "missing" ? "is gone" : "stopped"} and its volume ${read.readable ? "holds no exit code" : "could not be read"}` : `its command recorded exit ${code}`}`
   );
 }
+async function canLeaveBuilds(state) {
+  if (state.deps.leave === void 0 || state.deps.image !== void 0 || !isBuiltinVm(state.config.hooks.provision)) return false;
+  const runtime = runtimeOf(state);
+  return (await runtime.vm.helper.probe()).ok && (await runtime.vm.fdStore.status()).ok;
+}
 async function logUnusableHelper(config, runtime, log) {
   if (!isBuiltinVm(config.hooks.provision)) return;
   const helper = await runtime.vm.helper.probe();
@@ -2735,7 +2942,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-WJJ325EQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-JVBAWIN6.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2773,9 +2980,29 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   }
   const state = { config, jobs: /* @__PURE__ */ new Map(), deps, configMtimeMs };
   log.line(`runner ${config.host} started \xB7 config ${configPath} \xB7 ${describeConfig(config)}`);
+  const leavesBuilds = await canLeaveBuilds(state);
+  let sigusr2Target;
+  let sigusr2Early = false;
+  const forwardSigusr2 = () => {
+    if (sigusr2Target === void 0) sigusr2Early = true;
+    else sigusr2Target();
+  };
+  if (leavesBuilds) {
+    process.on("SIGUSR2", forwardSigusr2);
+    writePidFile(pidFilePath(configPath), { ...self, leaves: true });
+  }
   const nowMs = () => deps.now ? deps.now().getTime() : Date.now();
   await logUnusableHelper(config, runtimeOf(state), log);
-  const runningMicroVms = await stopOrphanedMicroVms({ jobs: unfinishedJobs(jobsDir(configPath)), runtime: runtimeOf(state), onError: (line) => log.error(line) }).catch((err) => {
+  const microVmPlan = await planMicroVmAdoption(state, jobsDir(configPath)).catch((err) => {
+    log.error(`the microVM builds an earlier runner left could not be told apart: ${describeCallFailure(err)}`);
+    return { adopt: [], away: [], unservable: [], unasked: [] };
+  });
+  const runningMicroVms = await stopOrphanedMicroVms({
+    jobs: unfinishedJobs(jobsDir(configPath)),
+    runtime: runtimeOf(state),
+    onError: (line) => log.error(line),
+    keep: new Set(microVmPlan.adopt.map(({ job }) => job.microvm.buildId))
+  }).catch((err) => {
     log.error(`a microVM an earlier runner left could not be stopped: ${describeCallFailure(err)}`);
     return [];
   });
@@ -2799,6 +3026,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     attemptLogs.note(job.item, adoptedLine);
   }
   await adoptTrackedBuilds(state, jobsDir(configPath));
+  await adoptTrackedMicroVms(state, microVmPlan);
   for (const { job, released } of await retryFailedReleases(jobsDir(configPath), config, {
     fetchImpl: deps.fetchImpl,
     now: deps.now,
@@ -2843,9 +3071,13 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const probeTimer = setInterval(() => {
     for (const active of state.jobs.values()) void probeBuild(state, active);
   }, deps.probeIntervalMs ?? PROBE_INTERVAL_MS);
-  const onSigterm = () => deps.image === void 0 ? void drain() : leave();
+  const onSigterm = () => {
+    if (deps.image !== void 0) leave();
+    else if (leavesBuilds && buildBlockers(runningBuilds(state)).length === 0) leave();
+    else void drain();
+  };
   const onSigusr1 = () => void stopNow();
-  const onSigusr2 = () => drainKeepingUp();
+  const onSigusr2 = () => deps.image === void 0 ? void drain() : drainKeepingUp();
   const onSigint = () => {
     interrupts++;
     if (interrupts === 1) {
@@ -2859,6 +3091,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     process.off("SIGTERM", onSigterm);
     process.off("SIGUSR1", onSigusr1);
     process.off("SIGUSR2", onSigusr2);
+    process.off("SIGUSR2", forwardSigusr2);
     process.off("SIGINT", onSigint);
   };
   const stopIntake = () => {
@@ -2916,7 +3149,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     log.line(`stopping: leaving ${state.jobs.size} running build(s) for the next runner to adopt`);
     state.draining = true;
     finish2();
-    deps.image?.exit?.(0);
+    (deps.image?.exit ?? deps.leave?.exit)?.(0);
   };
   const stopNow = async () => {
     if (stopping) return;
@@ -2938,7 +3171,10 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const handle = { state, drain, stopNow, close };
   process.on("SIGTERM", onSigterm);
   process.on("SIGUSR1", onSigusr1);
-  if (deps.image !== void 0) process.on("SIGUSR2", onSigusr2);
+  if (leavesBuilds) {
+    sigusr2Target = onSigusr2;
+    if (sigusr2Early) onSigusr2();
+  } else if (deps.image !== void 0) process.on("SIGUSR2", onSigusr2);
   process.on("SIGINT", onSigint);
   deps.onReady?.();
   await tick(state);
@@ -2964,7 +3200,7 @@ async function requestStop(configPath, stopNow = false, pollMs = 5e3, options =
 `);
     return;
   }
-  const signal = stopNow ? "SIGUSR1" : options.image === true ? "SIGUSR2" : "SIGTERM";
+  const signal = stopNow ? "SIGUSR1" : options.image === true || entry.leaves === true ? "SIGUSR2" : "SIGTERM";
   try {
     kill(entry.pid, signal);
   } catch (err) {
@@ -2979,7 +3215,7 @@ async function requestStop(configPath, stopNow = false, pollMs = 5e3, options =
 `);
     return;
   }
-  if (signal === "SIGUSR2") {
+  if (signal === "SIGUSR2" && entry.leaves !== true) {
     process.stdout.write(
       `sent SIGUSR2 to runner pid ${entry.pid}: it takes no more work and keeps managing its builds.
 The container stays up. Run \`outerlayer runner status\` to see what is left, then \`docker stop\` the container once nothing is.
@@ -2989,7 +3225,7 @@ The container stays up. Run \`outerlayer runner status\` to see what is left, th
   }
   process.stdout.write(
     stopNow ? `sent SIGUSR1 to runner pid ${entry.pid}, stopping now
-` : `sent SIGTERM to runner pid ${entry.pid}, draining
+` : `sent ${signal} to runner pid ${entry.pid}, draining
 `
   );
   while (isSameProcess(entry.pid, entry.start)) {

package/dist/{claude-launcher-O2U6P6ZD.js → claude-launcher-TKX4WCUN.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sharedSkillNames } from './chunk-VPEGE3QZ.js';
+import { sharedSkillNames } from './chunk-6TRNCUM4.js';
 import { GOVERNANCE_VARIABLE, versionAtLeast, MINIMUM_CLAUDE_VERSION, SHIM_SCRIPT, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 export { MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import './chunk-HBISTTG3.js';
+import { setupMachineSkills } from './chunk-BM7EC3OZ.js';
+import './chunk-7OUOLGUV.js';
 import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -210,12 +211,15 @@ async function runClaudeLauncher(args, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   const stderr = deps.stderr ?? ((text) => void process.stderr.write(text));
+  const home = homeFromEnv(env);
+  const installed = setupMachineSkills(home);
+  for (const failure of installed.failures) stderr(`outerlayer claude: could not write a maintained skill: ${failure}
+`);
   const claude = findClaude(env.PATH);
   if (claude === void 0) {
     stderr("outerlayer claude: no claude program found on PATH\n");
     return 127;
   }
-  const home = homeFromEnv(env);
   try {
     removeStaleOwnSkillsDirs(home);
   } catch {
@@ -236,7 +240,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-654RV5PO.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-DBQA3KLJ.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);