@outerlayer/cli 0.26.4 → 0.27.0

package/dist/{chunk-OQUD3UYF.js → chunk-QIVOTQOQ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-EHBDYLM6.js';
-import { MIN_ENGINE_MAJOR } from './chunk-SBW4K3XZ.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-VGHKTSHU.js';
-import { runnerCredentialProblem } from './chunk-JWRX5ZTT.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-UQYBCJ2L.js';
+import { MIN_ENGINE_MAJOR } from './chunk-YF56R4DV.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-GFUE5TKO.js';
+import { runnerCredentialProblem } from './chunk-EPPIISRD.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-Y4BXRVDI.js → chunk-QKIQ2R7F.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-K4FXNMV5.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-7Z2WMXM5.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-QHH4OSD4.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-MATUHHN4.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-F3BBEBPL.js';
+import { RUNNER_DIR_MODE } from './chunk-RHAGBUL5.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-F3BBEBPL.js → chunk-RHAGBUL5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-2K3TCQHW.js';
+import { BUILD_HOME } from './chunk-2I3LIRZP.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-OFTFW7TH.js → chunk-RHGF73IU.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-27RDUTQH.js → chunk-RK7FWC6B.js}

@@ -1,48 +1,50 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { senderPidfile } from './chunk-Q2SVLBMI.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-MWPBF2XG.js';
-import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
-import { installScrubContext } from './chunk-VQ7OAG6H.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-SBW4K3XZ.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-GFHLEVUE.js';
+import { senderPidfile } from './chunk-Y7ZCHBYB.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-6KKM7VGZ.js';
+import { writeDockerClientConfig } from './chunk-XS3FDWSZ.js';
+import { installScrubContext } from './chunk-VS27BP3E.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-YF56R4DV.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-WSYXLLA5.js';
+import { fdName } from './chunk-YB3CSYXX.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-24ID7EQ2.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-QUP6CVBQ.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR, COMMAND_DIR } from './chunk-JH2GQU5T.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-B6K7R5UY.js';
-import { waitForAgent, vmExecArgs } from './chunk-MXTN35XN.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-XLC7KEUV.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-OZKEEXVH.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6CGXSMKX.js';
+import { waitForAgent, vmExecArgs } from './chunk-XBPUTQ7E.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-GLUKDQS4.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-55GNQPO6.js';
 import { planArtifactUpload } from './chunk-BUP5N3X6.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-JWRX5ZTT.js';
-import { parseSize } from './chunk-7RQ73DLO.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-EPPIISRD.js';
+import { parseSize } from './chunk-YJLHUKYS.js';
+import { resolvePackRoot, MAINTAINED_SKILLS } from './chunk-7OUOLGUV.js';
 import { scrubText } from './chunk-QE3UQAHK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { resolvePackRoot } from './chunk-HBISTTG3.js';
 import { parsePolicy } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-GWRDL75D.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-F3BBEBPL.js';
-import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2K3TCQHW.js';
+import { signerFor } from './chunk-Y4OKEFAX.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-RHAGBUL5.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2I3LIRZP.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-JGD5TWQ2.js';
-import { existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, rmSync, readdirSync, linkSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
+import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, readdirSync, linkSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';
-import { spawn, spawnSync } from 'child_process';
-import { randomBytes, createHash } from 'crypto';
 import { once } from 'events';
 import { createServer } from 'net';
+import { spawn, spawnSync } from 'child_process';
+import { randomBytes, createHash } from 'crypto';
 import { pathToFileURL } from 'url';
 
 createRequire(import.meta.url);
 var PROBE_TIMEOUT_MS = 3e4;
 var PROBE_BYTES = 256 * 1024;
-var PROBE_SCRIPT = `d=${COMMAND_DIR}
+function probeScript(dir, alive) {
+  return `d=${dir}
 code=$(cat "$d/exit-code" 2>/dev/null | tr -d ' \\r\\n')
 pid=$(cat "$d/command.pid" 2>/dev/null | tr -d ' \\r\\n')
 alive=0
-if [ -n "$pid" ] && grep -qa build-command "/proc/$pid/cmdline" 2>/dev/null; then alive=1; fi
+if [ -n "$pid" ] && ${alive}; then alive=1; fi
 size=$(wc -c < "$d/command.log" 2>/dev/null || echo 0)
 size=$(echo $size)
 echo "OL-COMMAND exit=$code alive=$alive size=$size"
@@ -51,8 +53,10 @@ if [ "$n" -gt "$2" ]; then n=$2; fi
 if [ "$n" -gt 0 ]; then tail -c +$(($1 + 1)) "$d/command.log" | head -c "$n" | base64 | tr -d '\\n'; fi
 echo
 `;
-function probeArgv(offset) {
-  return ["/bin/sh", "-c", PROBE_SCRIPT, "probe", String(offset), String(PROBE_BYTES)];
+}
+var PROBE_SCRIPT = probeScript(COMMAND_DIR, 'grep -qa build-command "/proc/$pid/cmdline" 2>/dev/null');
+function probeArgv(offset, script = PROBE_SCRIPT) {
+  return ["/bin/sh", "-c", script, "probe", String(offset), String(PROBE_BYTES)];
 }
 function parseProbe(stdout) {
   const [header = "", body = ""] = stdout.split("\n");
@@ -97,14 +101,19 @@ function judgeProbe(probe, missedBefore) {
   if (probe.alive) return { kind: "running" };
   return missedBefore ? { kind: "lost" } : { kind: "recheck" };
 }
-async function serveLease(socketPath, channel, makeServer = createServer) {
+async function serveLease(socketPath, channel, makeServer = createServer, listenOn) {
   const server = makeServer((socket) => channel.accept(socket));
-  rmSync(socketPath, { force: true });
-  server.listen(socketPath);
-  await once(server, "listening");
+  if (listenOn === void 0) {
+    rmSync(socketPath, { force: true });
+    server.listen(socketPath);
+    await once(server, "listening");
+  } else {
+    await listenOn(server);
+  }
   server.on("error", () => void 0);
   return {
     ...channel,
+    listener: server,
     close() {
       channel.close();
       server.close();
@@ -112,6 +121,57 @@ async function serveLease(socketPath, channel, makeServer = createServer) {
     }
   };
 }
+
+// src/runner/microvm/command-state.ts
+var MICROVM_COMMAND_DIR = "/build/.command";
+var SCRIPT = probeScript(MICROVM_COMMAND_DIR, '[ -d "/proc/$pid" ]');
+var GUEST_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var STOP_COMMAND_SCRIPT = `pid=$(cat ${MICROVM_COMMAND_DIR}/command.pid 2>/dev/null | tr -d ' \\r\\n'); [ -n "$pid" ] && kill -KILL "-$pid" 2>/dev/null; true`;
+var EXEC_TIMEOUT_MS = 3e4;
+var ABORT_GRACE_MS = 5e3;
+async function withinTime(exec) {
+  const controller = new AbortController();
+  let abortTimer;
+  let graceTimer;
+  const deadline = new Promise((_resolve, reject) => {
+    abortTimer = setTimeout(() => {
+      controller.abort();
+      graceTimer = setTimeout(() => reject(new Error("the guest did not end the exec after it was aborted")), ABORT_GRACE_MS);
+    }, EXEC_TIMEOUT_MS);
+  });
+  try {
+    return await Promise.race([exec(controller.signal), deadline]);
+  } finally {
+    clearTimeout(abortTimer);
+    clearTimeout(graceTimer);
+  }
+}
+async function probeMicroVmCommand(runtime, state, offset) {
+  try {
+    const result = await withinTime(
+      (signal) => runtime.vm.exec(state.vsockPath, { argv: probeArgv(offset, SCRIPT), user: state.agentUser ?? ADDED_USER, cwd: "/", env: { PATH: GUEST_PATH } }, { signal })
+    );
+    return result.status === 0 ? parseProbe(result.stdout) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var MAX_TAIL_READS2 = 8;
+async function copyMicroVmLogTail(runtime, state, jobDir) {
+  for (let reads = 0; reads < MAX_TAIL_READS2; reads++) {
+    const offset = commandLogOffset(jobDir, state.commandLogBase);
+    const probe = await probeMicroVmCommand(runtime, state, offset);
+    if (probe === void 0) return false;
+    appendCommandLog(jobDir, probe.bytes);
+    if (probe.bytes.length === 0 || offset + probe.bytes.length >= probe.size) return true;
+  }
+  return false;
+}
+async function stopMicroVmCommand(runtime, state) {
+  await withinTime(
+    (signal) => runtime.vm.exec(state.vsockPath, { argv: ["/bin/sh", "-c", STOP_COMMAND_SCRIPT], user: "root", cwd: "/", env: { PATH: GUEST_PATH } }, { signal })
+  );
+}
 function unitNameFor(buildId) {
   return `outerlayer-build-${buildId}`;
 }
@@ -256,6 +316,30 @@ async function microVmOomKills(runtime, state) {
   if (state.jailed !== void 0) return helperKills(runtime, state);
   return 0;
 }
+var socketNameOf = (file) => file.replace(/\.sock$/, "");
+async function keepSockets(runtime, buildId, listeners, leaseServer, line, error) {
+  const store = runtime.vm.fdStore;
+  const status = await store.status();
+  if (!status.ok) {
+    line(`this build ends with its runner: ${status.reason}`);
+    return [];
+  }
+  const sockets = Object.entries(listeners);
+  if (leaseServer !== void 0) sockets.push([LEASE_LINK.socket, leaseServer]);
+  const stored = [];
+  try {
+    for (const [file, server] of sockets) {
+      const name = fdName(buildId, socketNameOf(file));
+      await store.push(name, server);
+      stored.push(name);
+    }
+  } catch (err) {
+    error(`this build ends with its runner: its sockets could not be kept for the next one: ${describeCallFailure(err)}`);
+    for (const name of stored) await store.remove(name).catch(() => void 0);
+    return [];
+  }
+  return stored;
+}
 async function provisionMicroVm(input) {
   const { config, runtime, item, itemKey, jobDir, log, tokens } = input;
   const { vm } = runtime;
@@ -363,9 +447,11 @@ async function provisionMicroVm(input) {
   mkdirSync(buildDir2, { recursive: true, mode: 448 });
   chmodSync(buildDir2, 448);
   makeBuildsDirPrivate(buildDir2);
+  let services;
   try {
     const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
-    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote));
+    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote);
+    runtime.tunnels.set(buildId, services);
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
@@ -376,11 +462,13 @@ async function provisionMicroVm(input) {
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: true });
   const served = input.leaseTimeLeftMs === void 0 ? links : [...links, LEASE_LINK];
+  let leaseServer;
   if (input.leaseTimeLeftMs !== void 0) {
     try {
       const channel = createLeaseChannel(input.leaseTimeLeftMs);
       const served2 = await serveLease(join(buildDir2, LEASE_LINK.socket), { ...channel, accept: (stream) => runtime.leases.get(buildId)?.accept(stream) });
       runtime.leases.set(buildId, { ...channel, close: served2.close });
+      leaseServer = served2.listener;
     } catch (err) {
       return bail(`the lease stream could not start: ${describeCallFailure(err)}`);
     }
@@ -430,6 +518,11 @@ async function provisionMicroVm(input) {
     } catch (err) {
       return bail(`the microVM did not start under the jailer: ${describeCallFailure(err)}`);
     }
+    const kept = await keepSockets(runtime, buildId, services.listeners, leaseServer, (line) => log.line(`${tag} ${line}`), (line) => log.error(`${tag} ${line}`));
+    if (kept.length > 0) {
+      state.fdStore = kept;
+      input.save(state, environment);
+    }
   } else {
     try {
       state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath, cgroup: state.cgroup });
@@ -606,6 +699,38 @@ function microVmCommandLine(input) {
   const { options, env } = vmExecFor(input, ["/bin/sh", "-c", commandWithShim(input.job, input.cmdline)]);
   return { line: [process.execPath, input.cli, "vm-exec", ...vmExecArgs(options)].map(shellQuote).join(" "), options, env };
 }
+async function startMicroVmCommand(input) {
+  const state = input.job.microvm;
+  const env = buildEnvironment({
+    config: input.config,
+    item: input.job.item,
+    itemKey: input.job.itemKey,
+    branch: input.job.branch,
+    repository: state.repository,
+    repositories: input.job.repositories,
+    hostEnv: input.runtime.hostEnv,
+    containerEnv: state.containerEnv ?? {},
+    builtIns: state.builtIns === true,
+    identity: input.job.commitIdentity,
+    imageEnv: state.imageEnv
+  });
+  const started = await input.runtime.vm.exec(state.vsockPath, {
+    argv: ["/bin/sh", "-c", commandWithShim(input.job, input.cmdline)],
+    user: state.agentUser ?? ADDED_USER,
+    cwd: CHECKOUT_DIR,
+    env: execEnvironment(state.imageEnv, env),
+    detach: state.commandDir ?? MICROVM_COMMAND_DIR
+  });
+  if (started.status !== 0) {
+    const said = firstLine(started.stderr);
+    throw new Error(`the guest's exec agent exited ${started.status}${said === "" ? "" : `: ${said}`}`);
+  }
+}
+async function endMicroVmCommand(runtime, state, jobDir, onError) {
+  if (!vmAlive(runtime, state)) return;
+  await copyMicroVmLogTail(runtime, state, jobDir).catch((err) => onError(`copying the end of the command's log failed: ${describeCallFailure(err)} \xB7 continuing`));
+  await stopMicroVmCommand(runtime, state).catch((err) => onError(`ending the command in the microVM failed: ${describeCallFailure(err)} \xB7 continuing`));
+}
 function microVmSenderCommand(input) {
   const { options, env } = vmExecFor(input, ["outerlayer", "session-sender"]);
   return { command: process.execPath, args: [input.cli, "vm-exec", ...vmExecArgs(options)], env };
@@ -954,6 +1079,7 @@ async function cleanupMicroVm(runtime, state, jobDir) {
     runtime.tunnels.delete(state.buildId);
     await tunnel.close();
   }
+  for (const name of state.fdStore ?? []) await runtime.vm.fdStore.remove(name).catch(() => void 0);
   rmSync(state.buildDir, { recursive: true, force: true });
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
@@ -961,7 +1087,9 @@ async function stopOrphanedMicroVms(input) {
   const stopped = [];
   const report = (line) => input.onError?.(line);
   const jailedByJobs = [];
+  const kept = input.keep ?? /* @__PURE__ */ new Set();
   for (const { job } of input.jobs) {
+    if (job.microvm !== void 0 && kept.has(job.microvm.buildId)) continue;
     const states = [job.microvm, job.checkMicrovm].filter((state) => state !== void 0);
     if (states.length === 0) continue;
     if (job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start)) {
@@ -997,6 +1125,7 @@ async function stopOrphanedMicroVms(input) {
     return stopped;
   }
   for (const build of builds) {
+    if (kept.has(build)) continue;
     try {
       await probe.client.stop(build);
     } catch (err) {
@@ -1429,6 +1558,18 @@ function readInside(root, rel) {
     return void 0;
   }
 }
+var MAINTAINED_BRIEF = /^\.(?:agents|outerlayer)\/skills\/(outerlayer-[a-z]+)\/([A-Za-z0-9_./-]+)$/;
+function readBrief(root, brief) {
+  const own = readInside(root, brief);
+  if (own !== void 0) return own;
+  const match = MAINTAINED_BRIEF.exec(brief);
+  if (match === null || match[2].split("/").includes("..") || !MAINTAINED_SKILLS.includes(match[1])) return void 0;
+  try {
+    return readFileSync(join(resolvePackRoot(), "maintained", match[1], match[2]), "utf8");
+  } catch {
+    return void 0;
+  }
+}
 function validatorFilesIn(root) {
   const dir = join(root, VALIDATORS_DIR);
   let names;
@@ -1453,7 +1594,7 @@ function checksIn(root, log, tag) {
   const hostChecks = loaded.customs.filter((def) => def.runWhere === "host" && def.level !== "off" && def.declaresEmit !== null);
   const checks = [];
   for (const def of hostChecks) {
-    if (def.judge !== void 0) checks.push({ name: def.declaresEmit, judge: { brief: def.judge.brief, text: readInside(root, def.judge.brief) } });
+    if (def.judge !== void 0) checks.push({ name: def.declaresEmit, judge: { brief: def.judge.brief, text: readBrief(root, def.judge.brief) } });
     else if (def.command !== void 0) checks.push({ name: def.declaresEmit, command: def.command });
   }
   return checks;
@@ -2564,6 +2705,9 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   const build = job.container === void 0 ? void 0 : { state: job.container, runtime: deps.container ?? createContainerRuntime() };
   const vmBuild = job.microvm === void 0 ? void 0 : { state: job.microvm, runtime: deps.container ?? createContainerRuntime() };
   const commandMayRun = job.pid !== void 0 && isGroupAlive(job.pid) || isContainerTracked(job) && job.exitCode === void 0;
+  if (vmBuild !== void 0 && isMicroVmTracked(job) && job.exitCode === void 0) {
+    await endMicroVmCommand(vmBuild.runtime, vmBuild.state, jobDirPath, (line) => log.error(`${tag} ${line}`));
+  }
   if (build !== void 0 && commandMayRun) {
     if (isContainerTracked(job) && build.state.stopped !== true) {
       await copyCommandLogTail(build.runtime, build.state, jobDirPath).catch((err) => {
@@ -2637,8 +2781,11 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   }
   if (job.checkMicrovm !== void 0 && job.checksRan === true) {
     try {
-      await cleanupMicroVm(deps.container ?? createContainerRuntime(), job.checkMicrovm);
+      const runtime = deps.container ?? createContainerRuntime();
+      const again = isMicroVmTracked(job) && outcome === "ok" && !job.cleanupRan;
+      await cleanupMicroVm(runtime, job.checkMicrovm);
       delete job.checkMicrovm;
+      if (again) job.checksRan = false;
       writeJobFile(jobFilePath, job);
     } catch (err) {
       log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
@@ -2947,6 +3094,15 @@ function unfinishedJobs(jobsDirPath) {
 function isContainerTracked(job) {
   return job.container?.tracking === "container";
 }
+function isMicroVmTracked(job) {
+  return job.microvm?.tracking === "microvm";
+}
+function isTracked(job) {
+  return isContainerTracked(job) || isMicroVmTracked(job);
+}
+function trackingOf(job) {
+  return job.container?.tracking ?? job.microvm?.tracking;
+}
 function isReadable(job) {
   return readsJobState(job, READ_JOB_STATE_FORMATS);
 }
@@ -2956,10 +3112,10 @@ function listUnreadableJobs(jobsDirPath) {
 function listTrackedJobs(jobsDirPath) {
   return unfinishedJobs(jobsDirPath).flatMap(({ dirPath, job }) => {
     if (!isReadable(job)) return [];
-    const tracking = job.container?.tracking;
+    const tracking = trackingOf(job);
     if (tracking === void 0) return [];
-    if (tracking === "container" && inTeardown(job)) return [];
-    return [{ dirPath, job, known: tracking === "container" }];
+    if ((tracking === "container" || tracking === "microvm") && inTeardown(job)) return [];
+    return [{ dirPath, job, known: tracking === "container" || tracking === "microvm" }];
   });
 }
 function listAdoptableJobs(jobsDirPath) {
@@ -2971,12 +3127,12 @@ async function recoverLostJobs(jobsDirPath, config, deps) {
   const recovered = [];
   for (const { dirPath, job } of unfinishedJobs(jobsDirPath)) {
     if (!isReadable(job)) continue;
-    const tracking = job.container?.tracking;
-    if (tracking !== void 0 && tracking !== "container") {
+    const tracking = trackingOf(job);
+    if (tracking !== void 0 && tracking !== "container" && tracking !== "microvm") {
       recovered.push(await finishJob(job, dirPath, "interrupted", config, deps, { reason: UNKNOWN_TRACKING_REASON }));
       continue;
     }
-    if (tracking === "container" && !inTeardown(job)) continue;
+    if ((tracking === "container" || tracking === "microvm") && !inTeardown(job)) continue;
     const alive = job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start);
     if (alive) continue;
     const recorded = outcomeFromExitCode(dirPath);
@@ -3144,4 +3300,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isReadable, isTimedOut, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, probeCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, setStage, startHostServices, startSender, stopOrphanedMicroVms, unfinishedJobs, workdirProblem };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, serveLease, setStage, startHostServices, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-6MZSX4M7.js → chunk-STSLH5EJ.js}

@@ -33,12 +33,14 @@ function inspectService(unit, configDir, probes) {
   const pid = Number(property(shown, "MainPID") ?? "0");
   const mainPid = Number.isInteger(pid) && pid > 0 ? pid : void 0;
   const delegate = property(shown, "Delegate");
+  const storeMax = Number(property(shown, "FileDescriptorStoreMax"));
   const status = mainPid === void 0 ? void 0 : probes.readFile(`/proc/${mainPid}/status`);
   const kvm = probes.kvmGid();
   return {
     unit,
     mainPid,
     delegate: delegate === void 0 ? void 0 : delegate !== "no",
+    ...Number.isInteger(storeMax) && property(shown, "FileDescriptorStoreMax") !== void 0 ? { fdStoreMax: storeMax } : {},
     hasKvmGroup: status === void 0 || kvm === void 0 ? void 0 : holdsGroup(status, kvm),
     credentialVariables: credentialNames(probes.readFile(join(configDir, "runner.env")))
   };
@@ -46,7 +48,7 @@ function inspectService(unit, configDir, probes) {
 function realInspectProbes() {
   return {
     show: (unit) => {
-      const result = spawnSync("systemctl", ["show", "--property=LoadState,MainPID,Delegate", unit], { encoding: "utf8", timeout: 1e4 });
+      const result = spawnSync("systemctl", ["show", "--property=LoadState,MainPID,Delegate,FileDescriptorStoreMax", unit], { encoding: "utf8", timeout: 1e4 });
       return result.status === 0 ? result.stdout : void 0;
     },
     readFile: (path) => {

package/dist/{chunk-ZMZGWLYD.js → chunk-TXHJ7BGR.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned, checkBuildSkill } from './chunk-6WTAYEKJ.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-6CGXSMKX.js';
-import { isLinkedRepository } from './chunk-PZA6ZFYW.js';
+import { checkStarterFiles, contextIsGoverned, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills } from './chunk-G3EZA6MK.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-55GNQPO6.js';
+import { isLinkedRepository } from './chunk-N4D5TMVU.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { checkFormerSkillNames } from './chunk-MQ743JX3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-MCSINUVC.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-UZEQVPKF.js';
+import { checkFormerSkillNames } from './chunk-MHX7YX7Y.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-BWH36FOC.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-DJHNEGNM.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -191,7 +191,7 @@ function runDoctor(env = {}) {
     ...checkInstalls(env),
     ...starter?.checks ?? [],
     ...laptop ? checkRenamedSkills(env.cwd) : [],
-    ...checkBuildSkillState(env.cwd),
+    ...checkBuildSkillState(env.cwd, home),
     ...starter !== void 0 && !starter.mcpOutdated ? checkMcpCommand(env.cwd, env.processEnv) : [],
     ...checkContextSource(env.cwd),
     ...checkGovernsList(env.cwd),
@@ -204,10 +204,10 @@ function checkRenamedSkills(cwd) {
   if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return [];
   return checkFormerSkillNames(dirs.repoRoot);
 }
-function checkBuildSkillState(cwd) {
+function checkBuildSkillState(cwd, home) {
   const dirs = findGitDirs(cwd ?? process.cwd());
   if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return [];
-  return checkBuildSkill(dirs.repoRoot);
+  return [...checkBuildSkill(dirs.repoRoot), ...checkMachineSkills({ repoRoot: dirs.repoRoot, home }), ...checkCommittedMaintainedSkills(dirs.repoRoot)];
 }
 function checkInstalledCli(home, cwd) {
   const name = "Installed CLI";
@@ -1174,7 +1174,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-JJ3EO7SB.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-TWS5VZEN.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1186,7 +1186,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-U2N7AF3N.js');
+    const { runnerHostChecks } = await import('./doctor-6ZIF2BRZ.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1220,8 +1220,8 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-AFMXH25X.js');
+      const { inspectService, realInspectProbes } = await import('./inspect-IPFA7AAT.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-6OIY3KHZ.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-EHBDYLM6.js → chunk-UQYBCJ2L.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-SBW4K3XZ.js';
-import { runnerImageVersion } from './chunk-2J46BQ5Y.js';
+import { MIN_ENGINE_MAJOR } from './chunk-YF56R4DV.js';
+import { runnerImageVersion } from './chunk-M3MHHIUW.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-B6K7R5UY.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-VQ7OAG6H.js → chunk-VS27BP3E.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-WK35HB56.js';
+import { uploadSpooledSteps } from './chunk-O2IJTY7L.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-MCSINUVC.js';
-import { writeSyncStatus, spoolDir } from './chunk-UZEQVPKF.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-BWH36FOC.js';
+import { writeSyncStatus, spoolDir } from './chunk-DJHNEGNM.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
@@ -18,7 +18,7 @@ import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signerFor, signRunnerRequest } from './chunk-GWRDL75D.js';
+import { signerFor, signRunnerRequest } from './chunk-Y4OKEFAX.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';

package/dist/{chunk-OZKEEXVH.js → chunk-WSYXLLA5.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-6CGXSMKX.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-4UFSTKE5.js';
-import { signingFetchFor } from './chunk-MCSINUVC.js';
-import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-VPEGE3QZ.js';
+import { WorkCommandError, postJson } from './chunk-55GNQPO6.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-BPKO76QR.js';
+import { signingFetchFor } from './chunk-BWH36FOC.js';
+import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-6TRNCUM4.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
-import { signerFor } from './chunk-GWRDL75D.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-F3BBEBPL.js';
+import { signerFor } from './chunk-Y4OKEFAX.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-RHAGBUL5.js';
 import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, cpSync, readFileSync, existsSync, lstatSync } from 'fs';
 import { relative, join, dirname } from 'path';
 

package/dist/{chunk-WX2WEERU.js → chunk-WUL2OP5A.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-MQ743JX3.js';
+import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-LOKSLO25.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-MHX7YX7Y.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-7OUOLGUV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-JKNYTNYD.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-RKOTJQVG.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';