@outerlayer/cli 0.26.4 → 0.27.1

package/dist/{chunk-27RDUTQH.js → chunk-6VFH52MP.js}

@@ -1,48 +1,50 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { senderPidfile } from './chunk-Q2SVLBMI.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-MWPBF2XG.js';
-import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
-import { installScrubContext } from './chunk-VQ7OAG6H.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-SBW4K3XZ.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-GFHLEVUE.js';
+import { senderPidfile } from './chunk-Y7ZCHBYB.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-6KKM7VGZ.js';
+import { writeDockerClientConfig } from './chunk-XS3FDWSZ.js';
+import { installScrubContext } from './chunk-VS27BP3E.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-R7SGBXUD.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-WSYXLLA5.js';
+import { fdName } from './chunk-YB3CSYXX.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-HWDYLXHH.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-QUP6CVBQ.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-B6K7R5UY.js';
-import { waitForAgent, vmExecArgs } from './chunk-MXTN35XN.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-XLC7KEUV.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-OZKEEXVH.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6CGXSMKX.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR, COMMAND_DIR } from './chunk-EX5MQYEF.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-2BTFKNTR.js';
+import { waitForAgent, vmExecArgs } from './chunk-XBPUTQ7E.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-GLUKDQS4.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-55GNQPO6.js';
 import { planArtifactUpload } from './chunk-BUP5N3X6.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-JWRX5ZTT.js';
-import { parseSize } from './chunk-7RQ73DLO.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-EPPIISRD.js';
+import { parseSize } from './chunk-YJLHUKYS.js';
+import { resolvePackRoot, MAINTAINED_SKILLS } from './chunk-7OUOLGUV.js';
 import { scrubText } from './chunk-QE3UQAHK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { resolvePackRoot } from './chunk-HBISTTG3.js';
 import { parsePolicy } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-GWRDL75D.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-F3BBEBPL.js';
-import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2K3TCQHW.js';
+import { signerFor } from './chunk-Y4OKEFAX.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-RHAGBUL5.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2I3LIRZP.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-JGD5TWQ2.js';
-import { existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, rmSync, readdirSync, linkSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
+import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, readdirSync, linkSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';
-import { spawn, spawnSync } from 'child_process';
-import { randomBytes, createHash } from 'crypto';
 import { once } from 'events';
 import { createServer } from 'net';
+import { spawn, spawnSync } from 'child_process';
+import { randomBytes, createHash } from 'crypto';
 import { pathToFileURL } from 'url';
 
 createRequire(import.meta.url);
 var PROBE_TIMEOUT_MS = 3e4;
 var PROBE_BYTES = 256 * 1024;
-var PROBE_SCRIPT = `d=${COMMAND_DIR}
+function probeScript(dir, alive) {
+  return `d=${dir}
 code=$(cat "$d/exit-code" 2>/dev/null | tr -d ' \\r\\n')
 pid=$(cat "$d/command.pid" 2>/dev/null | tr -d ' \\r\\n')
 alive=0
-if [ -n "$pid" ] && grep -qa build-command "/proc/$pid/cmdline" 2>/dev/null; then alive=1; fi
+if [ -n "$pid" ] && ${alive}; then alive=1; fi
 size=$(wc -c < "$d/command.log" 2>/dev/null || echo 0)
 size=$(echo $size)
 echo "OL-COMMAND exit=$code alive=$alive size=$size"
@@ -51,8 +53,10 @@ if [ "$n" -gt "$2" ]; then n=$2; fi
 if [ "$n" -gt 0 ]; then tail -c +$(($1 + 1)) "$d/command.log" | head -c "$n" | base64 | tr -d '\\n'; fi
 echo
 `;
-function probeArgv(offset) {
-  return ["/bin/sh", "-c", PROBE_SCRIPT, "probe", String(offset), String(PROBE_BYTES)];
+}
+var PROBE_SCRIPT = probeScript(COMMAND_DIR, 'grep -qa build-command "/proc/$pid/cmdline" 2>/dev/null');
+function probeArgv(offset, script = PROBE_SCRIPT) {
+  return ["/bin/sh", "-c", script, "probe", String(offset), String(PROBE_BYTES)];
 }
 function parseProbe(stdout) {
   const [header = "", body = ""] = stdout.split("\n");
@@ -97,14 +101,19 @@ function judgeProbe(probe, missedBefore) {
   if (probe.alive) return { kind: "running" };
   return missedBefore ? { kind: "lost" } : { kind: "recheck" };
 }
-async function serveLease(socketPath, channel, makeServer = createServer) {
+async function serveLease(socketPath, channel, makeServer = createServer, listenOn) {
   const server = makeServer((socket) => channel.accept(socket));
-  rmSync(socketPath, { force: true });
-  server.listen(socketPath);
-  await once(server, "listening");
+  if (listenOn === void 0) {
+    rmSync(socketPath, { force: true });
+    server.listen(socketPath);
+    await once(server, "listening");
+  } else {
+    await listenOn(server);
+  }
   server.on("error", () => void 0);
   return {
     ...channel,
+    listener: server,
     close() {
       channel.close();
       server.close();
@@ -112,6 +121,57 @@ async function serveLease(socketPath, channel, makeServer = createServer) {
     }
   };
 }
+
+// src/runner/microvm/command-state.ts
+var MICROVM_COMMAND_DIR = "/build/.command";
+var SCRIPT = probeScript(MICROVM_COMMAND_DIR, '[ -d "/proc/$pid" ]');
+var GUEST_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var STOP_COMMAND_SCRIPT = `pid=$(cat ${MICROVM_COMMAND_DIR}/command.pid 2>/dev/null | tr -d ' \\r\\n'); [ -n "$pid" ] && kill -KILL "-$pid" 2>/dev/null; true`;
+var EXEC_TIMEOUT_MS = 3e4;
+var ABORT_GRACE_MS = 5e3;
+async function withinTime(exec) {
+  const controller = new AbortController();
+  let abortTimer;
+  let graceTimer;
+  const deadline = new Promise((_resolve, reject) => {
+    abortTimer = setTimeout(() => {
+      controller.abort();
+      graceTimer = setTimeout(() => reject(new Error("the guest did not end the exec after it was aborted")), ABORT_GRACE_MS);
+    }, EXEC_TIMEOUT_MS);
+  });
+  try {
+    return await Promise.race([exec(controller.signal), deadline]);
+  } finally {
+    clearTimeout(abortTimer);
+    clearTimeout(graceTimer);
+  }
+}
+async function probeMicroVmCommand(runtime, state, offset) {
+  try {
+    const result = await withinTime(
+      (signal) => runtime.vm.exec(state.vsockPath, { argv: probeArgv(offset, SCRIPT), user: state.agentUser ?? ADDED_USER, cwd: "/", env: { PATH: GUEST_PATH } }, { signal })
+    );
+    return result.status === 0 ? parseProbe(result.stdout) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var MAX_TAIL_READS2 = 8;
+async function copyMicroVmLogTail(runtime, state, jobDir) {
+  for (let reads = 0; reads < MAX_TAIL_READS2; reads++) {
+    const offset = commandLogOffset(jobDir, state.commandLogBase);
+    const probe = await probeMicroVmCommand(runtime, state, offset);
+    if (probe === void 0) return false;
+    appendCommandLog(jobDir, probe.bytes);
+    if (probe.bytes.length === 0 || offset + probe.bytes.length >= probe.size) return true;
+  }
+  return false;
+}
+async function stopMicroVmCommand(runtime, state) {
+  await withinTime(
+    (signal) => runtime.vm.exec(state.vsockPath, { argv: ["/bin/sh", "-c", STOP_COMMAND_SCRIPT], user: "root", cwd: "/", env: { PATH: GUEST_PATH } }, { signal })
+  );
+}
 function unitNameFor(buildId) {
   return `outerlayer-build-${buildId}`;
 }
@@ -256,6 +316,30 @@ async function microVmOomKills(runtime, state) {
   if (state.jailed !== void 0) return helperKills(runtime, state);
   return 0;
 }
+var socketNameOf = (file) => file.replace(/\.sock$/, "");
+async function keepSockets(runtime, buildId, listeners, leaseServer, line, error) {
+  const store = runtime.vm.fdStore;
+  const status = await store.status();
+  if (!status.ok) {
+    line(`this build ends with its runner: ${status.reason}`);
+    return [];
+  }
+  const sockets = Object.entries(listeners);
+  if (leaseServer !== void 0) sockets.push([LEASE_LINK.socket, leaseServer]);
+  const stored = [];
+  try {
+    for (const [file, server] of sockets) {
+      const name = fdName(buildId, socketNameOf(file));
+      await store.push(name, server);
+      stored.push(name);
+    }
+  } catch (err) {
+    error(`this build ends with its runner: its sockets could not be kept for the next one: ${describeCallFailure(err)}`);
+    for (const name of stored) await store.remove(name).catch(() => void 0);
+    return [];
+  }
+  return stored;
+}
 async function provisionMicroVm(input) {
   const { config, runtime, item, itemKey, jobDir, log, tokens } = input;
   const { vm } = runtime;
@@ -363,9 +447,11 @@ async function provisionMicroVm(input) {
   mkdirSync(buildDir2, { recursive: true, mode: 448 });
   chmodSync(buildDir2, 448);
   makeBuildsDirPrivate(buildDir2);
+  let services;
   try {
     const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
-    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote));
+    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote);
+    runtime.tunnels.set(buildId, services);
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
@@ -376,11 +462,13 @@ async function provisionMicroVm(input) {
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: true });
   const served = input.leaseTimeLeftMs === void 0 ? links : [...links, LEASE_LINK];
+  let leaseServer;
   if (input.leaseTimeLeftMs !== void 0) {
     try {
       const channel = createLeaseChannel(input.leaseTimeLeftMs);
       const served2 = await serveLease(join(buildDir2, LEASE_LINK.socket), { ...channel, accept: (stream) => runtime.leases.get(buildId)?.accept(stream) });
       runtime.leases.set(buildId, { ...channel, close: served2.close });
+      leaseServer = served2.listener;
     } catch (err) {
       return bail(`the lease stream could not start: ${describeCallFailure(err)}`);
     }
@@ -430,6 +518,11 @@ async function provisionMicroVm(input) {
     } catch (err) {
       return bail(`the microVM did not start under the jailer: ${describeCallFailure(err)}`);
     }
+    const kept = await keepSockets(runtime, buildId, services.listeners, leaseServer, (line) => log.line(`${tag} ${line}`), (line) => log.error(`${tag} ${line}`));
+    if (kept.length > 0) {
+      state.fdStore = kept;
+      input.save(state, environment);
+    }
   } else {
     try {
       state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath, cgroup: state.cgroup });
@@ -606,6 +699,38 @@ function microVmCommandLine(input) {
   const { options, env } = vmExecFor(input, ["/bin/sh", "-c", commandWithShim(input.job, input.cmdline)]);
   return { line: [process.execPath, input.cli, "vm-exec", ...vmExecArgs(options)].map(shellQuote).join(" "), options, env };
 }
+async function startMicroVmCommand(input) {
+  const state = input.job.microvm;
+  const env = buildEnvironment({
+    config: input.config,
+    item: input.job.item,
+    itemKey: input.job.itemKey,
+    branch: input.job.branch,
+    repository: state.repository,
+    repositories: input.job.repositories,
+    hostEnv: input.runtime.hostEnv,
+    containerEnv: state.containerEnv ?? {},
+    builtIns: state.builtIns === true,
+    identity: input.job.commitIdentity,
+    imageEnv: state.imageEnv
+  });
+  const started = await input.runtime.vm.exec(state.vsockPath, {
+    argv: ["/bin/sh", "-c", commandWithShim(input.job, input.cmdline)],
+    user: state.agentUser ?? ADDED_USER,
+    cwd: CHECKOUT_DIR,
+    env: execEnvironment(state.imageEnv, env),
+    detach: state.commandDir ?? MICROVM_COMMAND_DIR
+  });
+  if (started.status !== 0) {
+    const said = firstLine(started.stderr);
+    throw new Error(`the guest's exec agent exited ${started.status}${said === "" ? "" : `: ${said}`}`);
+  }
+}
+async function endMicroVmCommand(runtime, state, jobDir, onError) {
+  if (!vmAlive(runtime, state)) return;
+  await copyMicroVmLogTail(runtime, state, jobDir).catch((err) => onError(`copying the end of the command's log failed: ${describeCallFailure(err)} \xB7 continuing`));
+  await stopMicroVmCommand(runtime, state).catch((err) => onError(`ending the command in the microVM failed: ${describeCallFailure(err)} \xB7 continuing`));
+}
 function microVmSenderCommand(input) {
   const { options, env } = vmExecFor(input, ["outerlayer", "session-sender"]);
   return { command: process.execPath, args: [input.cli, "vm-exec", ...vmExecArgs(options)], env };
@@ -954,6 +1079,7 @@ async function cleanupMicroVm(runtime, state, jobDir) {
     runtime.tunnels.delete(state.buildId);
     await tunnel.close();
   }
+  for (const name of state.fdStore ?? []) await runtime.vm.fdStore.remove(name).catch(() => void 0);
   rmSync(state.buildDir, { recursive: true, force: true });
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
@@ -961,7 +1087,9 @@ async function stopOrphanedMicroVms(input) {
   const stopped = [];
   const report = (line) => input.onError?.(line);
   const jailedByJobs = [];
+  const kept = input.keep ?? /* @__PURE__ */ new Set();
   for (const { job } of input.jobs) {
+    if (job.microvm !== void 0 && kept.has(job.microvm.buildId)) continue;
     const states = [job.microvm, job.checkMicrovm].filter((state) => state !== void 0);
     if (states.length === 0) continue;
     if (job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start)) {
@@ -997,6 +1125,7 @@ async function stopOrphanedMicroVms(input) {
     return stopped;
   }
   for (const build of builds) {
+    if (kept.has(build)) continue;
     try {
       await probe.client.stop(build);
     } catch (err) {
@@ -1429,6 +1558,18 @@ function readInside(root, rel) {
     return void 0;
   }
 }
+var MAINTAINED_BRIEF = /^\.(?:agents|outerlayer)\/skills\/(outerlayer-[a-z]+)\/([A-Za-z0-9_./-]+)$/;
+function readBrief(root, brief) {
+  const own = readInside(root, brief);
+  if (own !== void 0) return own;
+  const match = MAINTAINED_BRIEF.exec(brief);
+  if (match === null || match[2].split("/").includes("..") || !MAINTAINED_SKILLS.includes(match[1])) return void 0;
+  try {
+    return readFileSync(join(resolvePackRoot(), "maintained", match[1], match[2]), "utf8");
+  } catch {
+    return void 0;
+  }
+}
 function validatorFilesIn(root) {
   const dir = join(root, VALIDATORS_DIR);
   let names;
@@ -1453,7 +1594,7 @@ function checksIn(root, log, tag) {
   const hostChecks = loaded.customs.filter((def) => def.runWhere === "host" && def.level !== "off" && def.declaresEmit !== null);
   const checks = [];
   for (const def of hostChecks) {
-    if (def.judge !== void 0) checks.push({ name: def.declaresEmit, judge: { brief: def.judge.brief, text: readInside(root, def.judge.brief) } });
+    if (def.judge !== void 0) checks.push({ name: def.declaresEmit, judge: { brief: def.judge.brief, text: readBrief(root, def.judge.brief) } });
     else if (def.command !== void 0) checks.push({ name: def.declaresEmit, command: def.command });
   }
   return checks;
@@ -2564,6 +2705,9 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   const build = job.container === void 0 ? void 0 : { state: job.container, runtime: deps.container ?? createContainerRuntime() };
   const vmBuild = job.microvm === void 0 ? void 0 : { state: job.microvm, runtime: deps.container ?? createContainerRuntime() };
   const commandMayRun = job.pid !== void 0 && isGroupAlive(job.pid) || isContainerTracked(job) && job.exitCode === void 0;
+  if (vmBuild !== void 0 && isMicroVmTracked(job) && job.exitCode === void 0) {
+    await endMicroVmCommand(vmBuild.runtime, vmBuild.state, jobDirPath, (line) => log.error(`${tag} ${line}`));
+  }
   if (build !== void 0 && commandMayRun) {
     if (isContainerTracked(job) && build.state.stopped !== true) {
       await copyCommandLogTail(build.runtime, build.state, jobDirPath).catch((err) => {
@@ -2637,8 +2781,11 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   }
   if (job.checkMicrovm !== void 0 && job.checksRan === true) {
     try {
-      await cleanupMicroVm(deps.container ?? createContainerRuntime(), job.checkMicrovm);
+      const runtime = deps.container ?? createContainerRuntime();
+      const again = isMicroVmTracked(job) && outcome === "ok" && !job.cleanupRan;
+      await cleanupMicroVm(runtime, job.checkMicrovm);
       delete job.checkMicrovm;
+      if (again) job.checksRan = false;
       writeJobFile(jobFilePath, job);
     } catch (err) {
       log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
@@ -2947,6 +3094,15 @@ function unfinishedJobs(jobsDirPath) {
 function isContainerTracked(job) {
   return job.container?.tracking === "container";
 }
+function isMicroVmTracked(job) {
+  return job.microvm?.tracking === "microvm";
+}
+function isTracked(job) {
+  return isContainerTracked(job) || isMicroVmTracked(job);
+}
+function trackingOf(job) {
+  return job.container?.tracking ?? job.microvm?.tracking;
+}
 function isReadable(job) {
   return readsJobState(job, READ_JOB_STATE_FORMATS);
 }
@@ -2956,10 +3112,10 @@ function listUnreadableJobs(jobsDirPath) {
 function listTrackedJobs(jobsDirPath) {
   return unfinishedJobs(jobsDirPath).flatMap(({ dirPath, job }) => {
     if (!isReadable(job)) return [];
-    const tracking = job.container?.tracking;
+    const tracking = trackingOf(job);
     if (tracking === void 0) return [];
-    if (tracking === "container" && inTeardown(job)) return [];
-    return [{ dirPath, job, known: tracking === "container" }];
+    if ((tracking === "container" || tracking === "microvm") && inTeardown(job)) return [];
+    return [{ dirPath, job, known: tracking === "container" || tracking === "microvm" }];
   });
 }
 function listAdoptableJobs(jobsDirPath) {
@@ -2971,12 +3127,12 @@ async function recoverLostJobs(jobsDirPath, config, deps) {
   const recovered = [];
   for (const { dirPath, job } of unfinishedJobs(jobsDirPath)) {
     if (!isReadable(job)) continue;
-    const tracking = job.container?.tracking;
-    if (tracking !== void 0 && tracking !== "container") {
+    const tracking = trackingOf(job);
+    if (tracking !== void 0 && tracking !== "container" && tracking !== "microvm") {
       recovered.push(await finishJob(job, dirPath, "interrupted", config, deps, { reason: UNKNOWN_TRACKING_REASON }));
       continue;
     }
-    if (tracking === "container" && !inTeardown(job)) continue;
+    if ((tracking === "container" || tracking === "microvm") && !inTeardown(job)) continue;
     const alive = job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start);
     if (alive) continue;
     const recorded = outcomeFromExitCode(dirPath);
@@ -3144,4 +3300,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isReadable, isTimedOut, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, probeCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, setStage, startHostServices, startSender, stopOrphanedMicroVms, unfinishedJobs, workdirProblem };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, serveLease, setStage, startHostServices, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-6SPXKRQR.js → chunk-7AQ5AM7U.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-JWRX5ZTT.js';
-import { parseSize } from './chunk-7RQ73DLO.js';
-import { runnerDir } from './chunk-F3BBEBPL.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-YB3CSYXX.js';
+import { builtinKind } from './chunk-EPPIISRD.js';
+import { parseSize } from './chunk-YJLHUKYS.js';
+import { runnerDir } from './chunk-RHAGBUL5.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 
@@ -28,6 +29,7 @@ ${helperService === void 0 ? "" : `Wants=${helperService}
 User=${unit.user}
 ExecStart=${unit.execStart}
 ${unit.helper === void 0 ? "" : `Environment=OUTERLAYER_HELPER_SOCKET=${unit.helper.socket}
+`}${unit.fdStore === void 0 ? "" : `Environment=${FD_STORE_ENV}=${unit.fdStore}
 `}EnvironmentFile=-${escapeUnitPath(`${unit.configDir}/runner.env`)}
 Restart=on-failure
 RestartForceExitStatus=75
@@ -37,7 +39,10 @@ KillMode=mixed
 TimeoutStopSec=${unit.timeLimitMinutes + STOP_MARGIN_MINUTES}min
 OOMPolicy=continue
 Delegate=yes
-
+${unit.fdStore === void 0 ? "" : `NotifyAccess=all
+FileDescriptorStoreMax=${unit.fdStore}
+FileDescriptorStorePreserve=yes
+`}
 [Install]
 WantedBy=multi-user.target
 `;
@@ -147,7 +152,9 @@ function installService(request, deps) {
     execStart: request.execStart,
     timeLimitMinutes: request.timeLimitMinutes,
     docker: kind === "container" || kind === "vm" || builtinKind(request.hooks.cleanup) === "container" || builtinKind(request.hooks.cleanup) === "vm",
-    ...request.helperSocket !== void 0 && request.helperUnit !== void 0 ? { helper: { unit: request.helperUnit, socket: request.helperSocket } } : {}
+    ...request.helperSocket !== void 0 && request.helperUnit !== void 0 ? { helper: { unit: request.helperUnit, socket: request.helperSocket } } : {},
+    // A microVM build under the helper keeps its sockets in the descriptor store, so the runner can restart and the build goes on.
+    ...kind === "vm" && request.helperSocket !== void 0 && request.helperUnit !== void 0 ? { fdStore: Math.max(1, request.concurrency) * FD_SLOTS_PER_BUILD } : {}
   });
   if (request.print === true) return outcome(true, "printed", [], unit);
   if (own) return outcome(false, "refused", [OWN_HOOKS]);

package/dist/{chunk-HBISTTG3.js → chunk-7OUOLGUV.js}

@@ -13,13 +13,20 @@ function templateClassLine(version) {
   return `<!-- yours to edit. Copied once from the default template by outerlayer init ${version}; never overwritten. -->`;
 }
 function maintainedClassLine(version, base) {
+  if (base === MACHINE_SKILL_PATH) return `<!-- maintained by OuterLayer ${version}. Edits are overwritten by the next outerlayer command. -->`;
   const command = base === AGENTS_SKILLS_BASE ? "outerlayer init --update" : "outerlayer context emit";
   return `<!-- maintained by OuterLayer ${version}. Edits are overwritten on the next ${command}. -->`;
 }
 var OUTERLAYER_SKILLS_BASE = ".outerlayer/skills";
 var AGENTS_SKILLS_BASE = ".agents/skills";
+var MACHINE_SKILL_PATH = "~/.agents/skills";
+var MAINTAINED_SKILL_PATH_IN_PACK = new RegExp(`${OUTERLAYER_SKILLS_BASE.replace(".", "\\.")}/(outerlayer-[a-z]+)/`, "g");
 function rewriteSkillPaths(content, base) {
-  return base === OUTERLAYER_SKILLS_BASE ? content : content.split(`${OUTERLAYER_SKILLS_BASE}/`).join(`${base}/`);
+  if (base === OUTERLAYER_SKILLS_BASE) return content;
+  if (base === MACHINE_SKILL_PATH) {
+    return content.replace(MAINTAINED_SKILL_PATH_IN_PACK, `${MACHINE_SKILL_PATH}/$1/`).split(`${OUTERLAYER_SKILLS_BASE}/`).join(`${AGENTS_SKILLS_BASE}/`);
+  }
+  return content.split(`${OUTERLAYER_SKILLS_BASE}/`).join(`${base}/`);
 }
 function restoreSkillPaths(content, base) {
   return base === OUTERLAYER_SKILLS_BASE ? content : content.split(`${base}/`).join(`${OUTERLAYER_SKILLS_BASE}/`);
@@ -74,6 +81,9 @@ function loadTemplateFiles(packRoot = resolvePackRoot(), version = resolvePackag
 function loadMaintainedFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion(), base = OUTERLAYER_SKILLS_BASE) {
   return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version, base);
 }
+function loadMachineSkillFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion()) {
+  return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version, MACHINE_SKILL_PATH).map((file) => ({ ...file, path: file.path.slice(skillDir(file.skill, MACHINE_SKILL_PATH).length + 1) }));
+}
 function writeMaintainedFiles(repoRoot, files) {
   const created = [];
   const rewritten = [];
@@ -92,19 +102,20 @@ function maintainedFilesForExistingSkills(repoRoot, files, base = OUTERLAYER_SKI
     (file) => existsSync(join(repoRoot, skillDir(file.skill, base))) || formerNameExists(repoRoot, file.skill, base) || requiredByBuild(repoRoot, file.skill, base)
   );
 }
+var RELATIVE_CORE = "../outerlayer-build/SKILL.md";
 function namesCore(text) {
   return text.includes("outerlayer-build");
 }
 function requiredByBuild(repoRoot, skill, base) {
   if (skill !== "outerlayer-build") return false;
-  const named = (file) => {
+  const named = (file, pattern = "outerlayer-build") => {
     try {
-      return namesCore(readFileSync(file, "utf8"));
+      return readFileSync(file, "utf8").includes(pattern);
     } catch {
       return false;
     }
   };
-  if (named(join(repoRoot, skillDir("build", base), "SKILL.md"))) return true;
+  if (named(join(repoRoot, skillDir("build", base), "SKILL.md"), RELATIVE_CORE)) return true;
   const dir = join(repoRoot, ".outerlayer", "validators");
   try {
     return readdirSync(dir).some((name) => name.endsWith(".yaml") && named(join(dir, name)));
@@ -119,6 +130,10 @@ var FORMER_MAINTAINED_NAMES = {
   outerlayer: "outerlayer-cli"
 };
 var MAINTAINED_LINE = /^<!-- maintained by OuterLayer \S+?\. /m;
+var MAINTAINED_LINE_VERSION = /^<!-- maintained by OuterLayer (\S+?)\. /m;
+function maintainedLineVersion(text) {
+  return MAINTAINED_LINE_VERSION.exec(text)?.[1];
+}
 function isMaintainedCopy(repoRoot, skill, base = OUTERLAYER_SKILLS_BASE) {
   try {
     return MAINTAINED_LINE.test(readFileSync(join(repoRoot, skillDir(skill, base), "SKILL.md"), "utf8"));
@@ -130,4 +145,4 @@ function formerNameExists(repoRoot, skill, base) {
   return Object.entries(FORMER_MAINTAINED_NAMES).some(([former, current]) => current === skill && isMaintainedCopy(repoRoot, former, base));
 }
 
-export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MAINTAINED_SKILLS, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };
+export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MACHINE_SKILL_PATH, MAINTAINED_SKILLS, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMachineSkillFiles, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, maintainedLineVersion, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };

package/dist/{chunk-NWPRNKZ5.js → chunk-ABXQBEYK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-EHBDYLM6.js → chunk-B7DJVG25.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-SBW4K3XZ.js';
-import { runnerImageVersion } from './chunk-2J46BQ5Y.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-B6K7R5UY.js';
+import { MIN_ENGINE_MAJOR } from './chunk-R7SGBXUD.js';
+import { runnerImageVersion } from './chunk-M3MHHIUW.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-2BTFKNTR.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-4UFSTKE5.js → chunk-BPKO76QR.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-MQ743JX3.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-MCSINUVC.js';
+import { removeRetiredSkills } from './chunk-MHX7YX7Y.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-BWH36FOC.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-7OUOLGUV.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-2K3TCQHW.js';
+import { withTokenHeader } from './chunk-2I3LIRZP.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-MCSINUVC.js → chunk-BWH36FOC.js}

@@ -5,7 +5,7 @@ import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { signRunnerRequest, signerFor } from './chunk-GWRDL75D.js';
+import { signRunnerRequest, signerFor } from './chunk-Y4OKEFAX.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-IZAOO5AR.js → chunk-D7ECMB7B.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
-import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -11,7 +11,7 @@ function readPidFile(path) {
   try {
     const parsed = JSON.parse(readFileSync(path, "utf8"));
     if (typeof parsed.pid !== "number" || typeof parsed.start !== "string") return null;
-    return { pid: parsed.pid, start: parsed.start };
+    return { pid: parsed.pid, start: parsed.start, ...parsed.leaves === true ? { leaves: true } : {} };
   } catch {
     return null;
   }
@@ -39,4 +39,4 @@ function claimPidFile(path, self, isSameProcessFn = isSameProcess) {
   writePidFile(path, self);
 }
 
-export { RunnerAlreadyRunningError, claimPidFile, readPidFile, releasePidFile };
+export { RunnerAlreadyRunningError, claimPidFile, readPidFile, releasePidFile, writePidFile };