@outerlayer/cli 0.27.1 → 0.28.2

package/dist/{chunk-R7SGBXUD.js → chunk-GLL4TN2M.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-WSYXLLA5.js';
-import { runnerImageVersion } from './chunk-M3MHHIUW.js';
-import { realFdStorePort } from './chunk-YB3CSYXX.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-HWDYLXHH.js';
+import { execCapture } from './chunk-MHAR6S7B.js';
+import { GUEST_CID } from './chunk-WWQVKFN6.js';
+import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-USJZ2LDK.js';
+import { runnerImageVersion } from './chunk-Z3ASAXVU.js';
+import { hostAllowed } from './chunk-UXYLWVTQ.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-T2QSWFSU.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-EX5MQYEF.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-2BTFKNTR.js';
-import { execCapture } from './chunk-XBPUTQ7E.js';
-import { GUEST_CID } from './chunk-GLUKDQS4.js';
-import { WorkCommandError } from './chunk-55GNQPO6.js';
-import { hostAllowed } from './chunk-UXYLWVTQ.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-VC5J7QPV.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { sharedSkillNames, skillConflictMessage } from './chunk-6TRNCUM4.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-SJZL5F3F.js';
+import { WorkCommandError } from './chunk-X52PMPOM.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-UHU7H57K.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-5K3KB4YR.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-HXAEQPZR.js';
+import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QE3UQAHK.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
 import { downconvertSession } from './chunk-QZBXLLTV.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-RHAGBUL5.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-2I3LIRZP.js';
+import { realFdStorePort } from './chunk-XD4ZCMA4.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-JGD5TWQ2.js';
-import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream } from 'fs';
-import { join, dirname, basename } from 'path';
+import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream, writeSync } from 'fs';
+import { join, dirname, resolve, basename } from 'path';
 import { isIP, createConnection, connect, createServer as createServer$1 } from 'net';
 import { spawnSync, spawn } from 'child_process';
 import { availableParallelism, networkInterfaces } from 'os';
@@ -51,7 +51,8 @@ function prepareRunnerCgroup(setup) {
   if (root === void 0) return void 0;
   const { fs } = setup;
   if (!fs.exists(root) || !fs.writable(join(root, "cgroup.procs"))) return void 0;
-  if (!(fs.read(join(root, "cgroup.controllers")) ?? "").split(/\s+/).includes("memory")) return void 0;
+  const controllers = (fs.read(join(root, "cgroup.controllers")) ?? "").split(/\s+/);
+  if (!controllers.includes("memory")) return void 0;
   for (const name of fs.list(root)) {
     if (!name.startsWith(BUILD_PREFIX)) continue;
     try {
@@ -61,7 +62,7 @@ function prepareRunnerCgroup(setup) {
   }
   if (!fs.exists(join(root, LEAF))) fs.mkdir(join(root, LEAF));
   fs.write(join(root, LEAF, "cgroup.procs"), String(setup.pid));
-  fs.write(join(root, "cgroup.subtree_control"), "+memory");
+  fs.write(join(root, "cgroup.subtree_control"), controllers.includes("io") ? "+memory +io" : "+memory");
   return { root };
 }
 var BUILD_RECLAIM_HEADROOM_BYTES = 256 * 1024 ** 2;
@@ -161,7 +162,7 @@ var START_TIMEOUT_MS = 12e4;
 var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
 var MAX_REPLY_BYTES = 1024 * 1024;
 function ask(socketPath, request, timeoutMs) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const conn = createConnection(socketPath);
     let text = "";
     let settled = false;
@@ -187,7 +188,7 @@ function ask(socketPath, request, timeoutMs) {
           return reject(new Error(`the helper at ${socketPath} sent a reply that is not JSON`));
         }
         if (reply.status === "refused") return reject(new HelperRefusal(String(reply.code ?? "refused"), String(reply.reason ?? "the helper refused the request")));
-        resolve(reply);
+        resolve2(reply);
       });
     });
     conn.on("error", (err) => settle(() => reject(new Error(`the helper at ${socketPath} did not answer: ${err.message}`))));
@@ -374,6 +375,10 @@ function formatCpuList(cores) {
   }
   return parts.join(",");
 }
+function capCpus(wanted, cpuset) {
+  const cores = cpuset === void 0 ? void 0 : parseCpuList(cpuset);
+  return cores === void 0 ? wanted : Math.min(wanted, cores.length);
+}
 function usableCpus(deps = {}) {
   try {
     const status = (deps.readStatus ?? (() => readFileSync("/proc/self/status", "utf8")))();
@@ -643,9 +648,9 @@ function createContainerHost(deps = {}) {
         stderr = (stderr + chunk.toString()).slice(-400);
       });
       child.stderr?.on("error", () => void 0);
-      const exited = new Promise((resolve) => {
-        child.once("error", () => resolve(-1));
-        child.once("close", (code) => resolve(code ?? -1));
+      const exited = new Promise((resolve2) => {
+        child.once("error", () => resolve2(-1));
+        child.once("close", (code) => resolve2(code ?? -1));
       });
       child.stdin.on("error", () => void 0);
       return { stdin: child.stdin, stdout: child.stdout, exited, kill: () => void child.kill("SIGKILL"), stderrTail: () => stderr };
@@ -717,7 +722,7 @@ function converterArgs(dest, memoryBytes, extra, script) {
 }
 var firstLine2 = (text) => text.trim().split("\n")[0] ?? "";
 function exportInto(container, converter) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const exporter = spawn("docker", ["export", container], { stdio: ["ignore", "pipe", "pipe"], env: childEnvironment(process.env) });
     const writer = spawn("docker", converter, { stdio: ["pipe", "ignore", "pipe"], env: childEnvironment(process.env) });
     const errors = [];
@@ -734,7 +739,7 @@ function exportInto(container, converter) {
       if (code !== 0 && failure2 === void 0) failure2 = `${name} exited ${code}`;
       exits += 1;
       if (exits < 2) return;
-      if (failure2 === void 0) resolve();
+      if (failure2 === void 0) resolve2();
       else reject(new Error(`${failure2}: ${firstLine2(errors.join("\n"))}`));
     };
     exporter.once("exit", (code) => done("docker export", code));
@@ -819,6 +824,46 @@ async function createBuildDisk(input) {
 function deleteBuildDisk(path) {
   rmSync(path, { force: true });
 }
+var CONSOLE_CUT_NOTE = "[outerlayer runner: cut the console at 8 MiB; the microVM keeps running]\n";
+function pumpConsole(fd, streams) {
+  const cap = 8 * 1024 ** 2;
+  let written = 0;
+  let lastByte = 10;
+  let cut = false;
+  const append = (data) => {
+    try {
+      writeSync(fd, data);
+    } catch {
+    }
+  };
+  const onData = (chunk) => {
+    if (cut) return;
+    const room = cap - written;
+    if (chunk.length <= room) {
+      append(chunk);
+      written += chunk.length;
+      lastByte = chunk[chunk.length - 1] ?? lastByte;
+      return;
+    }
+    const head = chunk.subarray(0, room);
+    append(head);
+    if (head.length > 0) lastByte = head[head.length - 1];
+    append(Buffer.from(`${lastByte === 10 ? "" : "\n"}${CONSOLE_CUT_NOTE}`));
+    written = cap;
+    cut = true;
+  };
+  let open = streams.length;
+  for (const stream of streams) {
+    stream.on("data", onData);
+    stream.on("error", () => void 0);
+    stream.once("close", () => {
+      open -= 1;
+      if (open === 0) closeSync(fd);
+    });
+  }
+}
+
+// src/runner/microvm/firecracker.ts
 var clearBit = (bit) => `0b${"x".repeat(31 - bit)}0${"x".repeat(bit)}`;
 var CPU_TEMPLATE = {
   cpuid_modifiers: [
@@ -859,8 +904,9 @@ function machineConfig(limits2, paths) {
 }
 function firecrackerCommand(input) {
   const args = ["--no-api", "--config-file", input.configPath];
-  if (input.cgroup === void 0) return { command: input.binary, args };
-  return { command: "sh", args: ["-c", 'echo $$ > "$1/cgroup.procs" && shift && exec "$@"', "sh", input.cgroup, input.binary, ...args] };
+  const binary = resolve(input.binary);
+  if (input.cgroup === void 0) return { command: binary, args };
+  return { command: "/bin/sh", args: ["-c", 'echo $$ > "$1/cgroup.procs" && shift && exec "$@"', "sh", input.cgroup, binary, ...args] };
 }
 var STOP_WAIT_MS = 1e4;
 var POLL_MS = 20;
@@ -874,6 +920,7 @@ function isZombie(pid) {
 }
 function createFirecrackerHost(options = {}) {
   const launch = options.launch ?? firecrackerCommand;
+  const spawnChild = options.spawnChild ?? spawn;
   const exits = /* @__PURE__ */ new Map();
   const alive = (vm) => isSameProcess(vm.pid, vm.start) && !isZombie(vm.pid);
   return {
@@ -881,18 +928,22 @@ function createFirecrackerHost(options = {}) {
       const { command, args } = launch(input);
       mkdirSync(dirname(input.consolePath), { recursive: true });
       const consoleFd = openSync(input.consolePath, "a", 384);
+      let pumping = false;
       try {
-        const child = spawn(command, args, { detached: true, stdio: ["ignore", consoleFd, consoleFd] });
+        const child = spawnChild(command, args, { detached: true, stdio: ["ignore", "pipe", "pipe"], env: {} });
+        pumpConsole(consoleFd, [child.stdout, child.stderr]);
+        pumping = true;
+        for (const stream of [child.stdout, child.stderr]) stream.unref?.();
         const failed = new Promise((_resolve, reject) => child.once("error", reject));
         const pid = child.pid;
         if (pid === void 0) return await failed;
-        exits.set(pid, new Promise((resolve) => child.once("exit", () => resolve())));
+        exits.set(pid, new Promise((resolve2) => child.once("exit", () => resolve2())));
         child.unref();
         const start = startTimeOf(pid);
         if (start === null) throw new Error(`${command} exited as soon as it started; its console is at ${input.consolePath}`);
         return { pid, start };
       } finally {
-        closeSync(consoleFd);
+        if (!pumping) closeSync(consoleFd);
       }
     },
     async stop(vm) {
@@ -903,8 +954,8 @@ function createFirecrackerHost(options = {}) {
       }
       const exited = exits.get(vm.pid);
       const deadline = Date.now() + STOP_WAIT_MS;
-      if (exited !== void 0) await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, STOP_WAIT_MS))]);
-      while (alive(vm) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+      if (exited !== void 0) await Promise.race([exited, new Promise((resolve2) => setTimeout(resolve2, STOP_WAIT_MS))]);
+      while (alive(vm) && Date.now() < deadline) await new Promise((resolve2) => setTimeout(resolve2, POLL_MS));
       exits.delete(vm.pid);
     },
     alive
@@ -1312,6 +1363,29 @@ async function resolveAgentUser(input) {
 var noop = () => void 0;
 var FRAME_HEADER_BYTES = 9;
 var GOAWAY_FRAME = 7;
+function describeGoawayCode(code) {
+  const names = [
+    "NO_ERROR",
+    "PROTOCOL_ERROR",
+    "INTERNAL_ERROR",
+    "FLOW_CONTROL_ERROR",
+    "SETTINGS_TIMEOUT",
+    "STREAM_CLOSED",
+    "FRAME_SIZE_ERROR",
+    "REFUSED_STREAM",
+    "CANCEL",
+    "COMPRESSION_ERROR",
+    "CONNECT_ERROR",
+    "ENHANCE_YOUR_CALM",
+    "INADEQUATE_SECURITY",
+    "HTTP_1_1_REQUIRED"
+  ];
+  const name = names[code];
+  return name === void 0 ? `error code ${code}` : `${name} (${code})`;
+}
+function goawayNote(label, code) {
+  return code === void 0 ? "" : ` \xB7 ${label} ${describeGoawayCode(code)}`;
+}
 function watchSentGoaway(onError) {
   let head = Buffer.alloc(0);
   let want = FRAME_HEADER_BYTES;
@@ -1334,7 +1408,10 @@ function watchSentGoaway(onError) {
         want = FRAME_HEADER_BYTES + 8;
         continue;
       }
-      if (want > FRAME_HEADER_BYTES && head.readUInt32BE(FRAME_HEADER_BYTES + 4) !== http2.constants.NGHTTP2_NO_ERROR) onError();
+      if (want > FRAME_HEADER_BYTES) {
+        const code = head.readUInt32BE(FRAME_HEADER_BYTES + 4);
+        if (code !== http2.constants.NGHTTP2_NO_ERROR) onError(code);
+      }
       skip = length - (want - FRAME_HEADER_BYTES);
       head = Buffer.alloc(0);
       want = FRAME_HEADER_BYTES;
@@ -1346,9 +1423,11 @@ function serveSession(transport, services, opts = {}) {
   let open = 0;
   let served = 0;
   let malformed = false;
+  let goawayCode;
   transport.on("error", noop);
-  const watch = watchSentGoaway(() => {
+  const watch = watchSentGoaway((code) => {
     malformed = true;
+    goawayCode ??= code;
     setImmediate(() => session.destroy());
   });
   const outbound = new Transform({
@@ -1366,11 +1445,14 @@ function serveSession(transport, services, opts = {}) {
     session.setLocalWindowSize(SESSION_WINDOW);
   } catch {
   }
-  const ended = new Promise((resolve) => {
+  const ended = new Promise((resolve2) => {
     session.on("error", (err) => {
       if (typeof err.code === "string" && err.code.startsWith("ERR_HTTP2_")) malformed = true;
     });
-    session.on("close", () => resolve({ malformed, served }));
+    session.on("goaway", (code) => {
+      if (code !== http2.constants.NGHTTP2_NO_ERROR) goawayCode ??= code;
+    });
+    session.on("close", () => resolve2({ malformed, served, goawayCode }));
   });
   session.on("stream", (stream, headers) => {
     stream.on("error", noop);
@@ -1404,14 +1486,14 @@ var JOINED_AFTER_MS = 2e3;
 var EXIT_WAIT_MS = 5e3;
 function exitedWithin(stream, ms) {
   let timer;
-  const late = new Promise((resolve) => {
-    timer = setTimeout(() => resolve(void 0), ms);
+  const late = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2(void 0), ms);
     timer.unref();
   });
   return Promise.race([stream.exited, late]).finally(() => clearTimeout(timer));
 }
 function superviseRelay(input) {
-  const sleep = input.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const exitWaitMs = input.exitWaitMs ?? EXIT_WAIT_MS;
   let closed = false;
   let fatal;
@@ -1444,14 +1526,14 @@ function superviseRelay(input) {
       if (joined) {
         backoff = FIRST_BACKOFF_MS;
         failing = false;
-        if (!closed) input.log?.(`the session with ${input.container} ended \xB7 joining again`);
+        if (!closed) input.log?.(`the session with ${input.container} ended \xB7 joining again${goawayNote("GOAWAY", end.goawayCode)}`);
       }
       if (!end.malformed && end.served > 0) malformedInARow = 0;
       if (end.malformed) {
         malformedInARow++;
         if (malformedInARow >= MAX_MALFORMED_SESSIONS) {
           fatal = MALFORMED_REASON;
-          input.log?.(`the session with ${input.container} broke HTTP/2 framing ${malformedInARow} times in a row \xB7 ending the build`);
+          input.log?.(`the session with ${input.container} broke HTTP/2 framing ${malformedInARow} times in a row${goawayNote("last GOAWAY", end.goawayCode)} \xB7 ending the build`);
           input.onFatal?.(fatal);
           return;
         }
@@ -1461,7 +1543,7 @@ function superviseRelay(input) {
         input.log?.(`could not join the relay in ${input.container}${status === 0 || status === void 0 ? "" : ` (exec exited ${status})`}${reason === "" ? "" : `: ${reason}`} \xB7 trying again`);
       }
       if (closed) return;
-      await Promise.race([sleep(backoff), new Promise((resolve) => wake = resolve)]);
+      await Promise.race([sleep(backoff), new Promise((resolve2) => wake = resolve2)]);
       backoff = Math.min(backoff * 2, LONGEST_BACKOFF_MS);
     }
   })();
@@ -1652,9 +1734,9 @@ async function git(args, cwd, env, input) {
     if (size < maxOutputBytes) out.push(chunk);
     size += chunk.length;
   });
-  const closed = new Promise((resolve, reject) => {
+  const closed = new Promise((resolve2, reject) => {
     child.once("error", reject);
-    child.once("close", (status) => resolve(status));
+    child.once("close", (status) => resolve2(status));
   });
   if (input !== void 0) {
     await pipeline(input, child.stdin).catch(() => void 0);
@@ -1851,14 +1933,14 @@ async function drain(req) {
   }
 }
 function readPrefix(req, gzip) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const held = [];
     const finish = (section) => {
       req.off("data", onData);
       req.off("end", onEnd);
       req.off("error", reject);
       req.pause();
-      resolve({ held, section });
+      resolve2({ held, section });
     };
     const onData = (chunk) => {
       held.push(chunk);
@@ -1872,19 +1954,19 @@ function readPrefix(req, gzip) {
   });
 }
 function readBody(req, limit) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     let size = 0;
     req.on("data", (chunk) => {
       size += chunk.length;
       if (size > limit) {
         req.pause();
-        resolve(void 0);
+        resolve2(void 0);
         return;
       }
       chunks.push(chunk);
     });
-    req.once("end", () => resolve(Buffer.concat(chunks)));
+    req.once("end", () => resolve2(Buffer.concat(chunks)));
     req.once("error", reject);
   });
 }
@@ -1898,7 +1980,7 @@ function createGitRemote(options) {
     const { route, res } = input;
     const url = new URL(`${gitUrl}/${route.owner}/${route.name}.git/${route.kind === "info-refs" ? "info/refs" : route.kind === "lfs-batch" ? "info/lfs/objects/batch" : `git-${route.kind}`}${route.search === "" ? "" : `?${route.search}`}`);
     const send = url.protocol === "https:" ? request$1 : request;
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const upstream = send(url, { method: input.method, headers: { ...input.headers, connection: "close" } }, (answer) => {
         const headers = {};
         for (const [name, value] of Object.entries(answer.headers)) {
@@ -1920,18 +2002,18 @@ function createGitRemote(options) {
         });
         answer.once("end", () => {
           res.end();
-          resolve();
+          resolve2();
         });
         answer.once("error", () => {
           res.destroy();
-          resolve();
+          resolve2();
         });
       });
       upstream.on("error", (err) => {
         log(`could not reach GitHub for ${route.kind}: ${err.message}`);
         if (res.headersSent) res.destroy();
         else plain(res, 502, "the runner could not reach GitHub\n");
-        resolve();
+        resolve2();
       });
       res.once("close", () => upstream.destroy());
       input.feed(upstream);
@@ -2228,6 +2310,9 @@ var CONNECT_TIMEOUT_MS = 3e4;
 var NOT_ALLOWED_RANGE = "not-allowed";
 var NOT_RESOLVED = "not resolved";
 var IDLE_TIMEOUT_MS = 10 * 6e4;
+var STALLED_RESPONSE_MS = 6e4;
+var MAX_BAD_GATEWAY_LINES = 10;
+var BAD_GATEWAY_WINDOW_MS = 1e4;
 async function systemResolve(host) {
   const found = await lookup(host, { all: true, verbatim: true });
   return found.map((a) => ({ address: a.address }));
@@ -2235,6 +2320,13 @@ async function systemResolve(host) {
 function systemHostAddresses() {
   return Object.values(networkInterfaces()).flatMap((list) => (list ?? []).map((i) => i.address));
 }
+function errorCode(err) {
+  const code = err?.code;
+  return typeof code === "string" ? code : "unknown";
+}
+function abortedError(message) {
+  return Object.assign(new Error(message), { code: "ECONNABORTED" });
+}
 function normalize(address) {
   const zone = address.indexOf("%");
   return (zone === -1 ? address : address.slice(0, zone)).toLowerCase();
@@ -2249,11 +2341,31 @@ async function startTunnel(socketPath, opts = {}) {
   if (Buffer.byteLength(socketPath) > MAX_SOCKET_PATH_BYTES) {
     throw new Error(`${socketPath} is too long for a Unix socket; keep the runner's config file nearer the root of the filesystem`);
   }
-  const resolve = opts.resolve ?? systemResolve;
+  const resolve2 = opts.resolve ?? systemResolve;
   const openConnection = opts.connect ?? ((t) => connect({ host: t.address, port: t.port }));
   const ownAddresses = opts.hostAddresses ?? systemHostAddresses;
   const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
   const idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
+  const stalledResponseMs = opts.stalledResponseMs ?? STALLED_RESPONSE_MS;
+  let windowStartedMs = 0;
+  let linesInWindow = 0;
+  let suppressed = 0;
+  const logBadGateway = (what) => {
+    if (opts.log === void 0) return;
+    const now = Date.now();
+    if (now - windowStartedMs >= BAD_GATEWAY_WINDOW_MS) {
+      windowStartedMs = now;
+      linesInWindow = 0;
+    }
+    if (linesInWindow >= MAX_BAD_GATEWAY_LINES) {
+      suppressed++;
+      return;
+    }
+    linesInWindow++;
+    const more = suppressed === 0 ? "" : ` (${suppressed} more 502 lines were not written)`;
+    suppressed = 0;
+    opts.log(`tunnel answered 502: ${what}${more}`);
+  };
   const hosts = [];
   const seen = /* @__PURE__ */ new Set();
   const extraHosts = /* @__PURE__ */ new Set();
@@ -2325,7 +2437,7 @@ async function startTunnel(socketPath, opts = {}) {
     }
     persist();
   };
-  async function decide(host) {
+  async function decide(host, port) {
     if (opts.allowHosts !== void 0 && !hostAllowed(host, opts.allowHosts)) {
       refused2(host, NOT_RESOLVED, NOT_ALLOWED_RANGE);
       return { ok: false, status: 403, body: `refused: ${host} is not in runner.build.allowHosts
@@ -2333,13 +2445,17 @@ async function startTunnel(socketPath, opts = {}) {
     }
     let addresses;
     try {
-      addresses = await resolve(host);
-    } catch {
+      addresses = await resolve2(host);
+    } catch (err) {
+      logBadGateway(`could not resolve ${host}:${port}, ${errorCode(err)}`);
       return { ok: false, status: 502, body: `could not resolve ${host}
 ` };
     }
-    if (addresses.length === 0) return { ok: false, status: 502, body: `${host} has no address
+    if (addresses.length === 0) {
+      logBadGateway(`${host}:${port} resolved to no address`);
+      return { ok: false, status: 502, body: `${host} has no address
 ` };
+    }
     const own = new Set(ownAddresses().map(normalize));
     let firstRefusal;
     for (const { address: address2 } of addresses) {
@@ -2381,36 +2497,70 @@ ${body}`);
       client.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
       return;
     }
-    const decision = await decide(target.host);
+    const decision = await decide(target.host, target.port);
     if (!decision.ok) {
       reply(client, decision.status, decision.body);
       return;
     }
     const upstream = openConnection({ address: decision.address, port: target.port });
     upstream.setTimeout(connectTimeoutMs);
-    const failed = () => {
+    const failed = (err) => {
       upstream.destroy();
+      logBadGateway(`could not connect to ${target.host}:${target.port}, ${err === void 0 ? "ETIMEDOUT" : errorCode(err)}`);
       reply(client, 502, `could not connect to ${target.host}
 `);
     };
+    const timedOut = () => failed();
     upstream.once("error", failed);
-    upstream.once("timeout", failed);
+    upstream.once("timeout", timedOut);
     client.on("close", () => upstream.destroy());
     const established = () => {
       upstream.removeListener("error", failed);
-      upstream.removeListener("timeout", failed);
+      upstream.removeListener("timeout", timedOut);
       upstream.setTimeout(idleTimeoutMs, () => upstream.destroy());
-      upstream.on("error", () => void 0);
-      upstream.on("close", () => client.destroy());
+      upstream.on("error", (err) => client.destroy(err));
+      upstream.on("close", () => {
+        if (!upstream.readableEnded && !client.writableEnded) client.destroy(abortedError("the tunnel closed the connection to the server before it ended"));
+      });
+      client.once("end", () => {
+        upstream.destroy();
+        client.end();
+      });
       reached(target.host);
       client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
       upstream.write(head);
+      releaseWhenStalled(client, upstream);
       upstream.pipe(client);
       client.pipe(upstream);
     };
     if (upstream.readyState === "open") established();
     else upstream.once("connect", established);
   }
+  function releaseWhenStalled(client, upstream) {
+    let delivered = 0;
+    upstream.on("data", (chunk) => delivered += chunk.length);
+    let read = delivered;
+    let timer;
+    const blocked = () => upstream.isPaused() || upstream.readableEnded;
+    const check = () => {
+      timer = void 0;
+      if (client.writableFinished || !blocked()) return;
+      if (delivered > read) {
+        read = delivered;
+        timer = setTimeout(check, stalledResponseMs);
+        return;
+      }
+      client.destroy(abortedError("the build stopped reading the response"));
+    };
+    const watch = () => {
+      if (timer !== void 0) return;
+      read = delivered;
+      timer = setTimeout(check, stalledResponseMs);
+    };
+    upstream.on("pause", watch);
+    upstream.on("end", watch);
+    client.once("close", () => clearTimeout(timer));
+  }
   async function proxyPlain(req, res) {
     if (opts.gitRemote !== void 0 && (req.url ?? "").startsWith("/")) {
       await opts.gitRemote(req, res);
@@ -2431,7 +2581,7 @@ ${body}`);
     }
     const host = url.hostname.replace(/^\[|\]$/g, "");
     const port = url.port === "" ? 80 : Number(url.port);
-    const decision = await decide(host);
+    const decision = await decide(host, port);
     if (!decision.ok) {
       res.writeHead(decision.status, { "Content-Type": "text/plain", Connection: "close" });
       res.end(decision.body);
@@ -2456,8 +2606,9 @@ ${body}`);
     );
     upstream.setTimeout(connectTimeoutMs, () => upstream.destroy());
     res.on("close", () => upstream.destroy());
-    upstream.on("error", () => {
+    upstream.on("error", (err) => {
       if (!res.headersSent) {
+        logBadGateway(`could not reach ${host}:${port}, ${errorCode(err)}`);
         res.writeHead(502, { "Content-Type": "text/plain", Connection: "close" });
         res.end(`could not reach ${host}
 `);
@@ -2510,6 +2661,9 @@ var RELAY_WAIT_MS = 500;
 var BUSY_IMAGE_WAIT_MS = 5e3;
 var VOLUME_REMOVE_ATTEMPTS = 4;
 var WORKFLOW_PERMISSION_REASON = "workflow_permission_required";
+function withTunnelLog(opts, log) {
+  return { ...opts, tunnelOptions: { log, ...opts?.tunnelOptions } };
+}
 function createContainerRuntime(opts = {}) {
   const { cli, remoteFor } = opts;
   return {
@@ -2534,7 +2688,7 @@ function createContainerRuntime(opts = {}) {
     )),
     startTunnel: opts.startTunnel ?? startTunnel,
     tunnelOptions: opts.tunnelOptions,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms))),
     hostEnv: opts.hostEnv ?? process.env,
     platform: opts.platform ?? process.platform,
     credentials: opts.credentials ?? /* @__PURE__ */ new Map(),
@@ -2835,7 +2989,7 @@ async function provisionContainer(input) {
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset: state.cpuset };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: capCpus(config.build?.cpus ?? 4, state.cpuset), pids: config.build?.pids ?? 4096, cpuset: state.cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
@@ -3017,8 +3171,8 @@ async function stopContainer(runtime, state) {
 var DISK_CHECK_MS = 12e4;
 async function measureDisk(runtime, state) {
   let timer;
-  const late = new Promise((resolve) => {
-    timer = setTimeout(() => resolve({ failure: "du ran past 2 minutes" }), DISK_CHECK_MS);
+  const late = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2({ failure: "du ran past 2 minutes" }), DISK_CHECK_MS);
   });
   try {
     const run = runtime.host.exec(
@@ -3306,7 +3460,7 @@ async function startCheckContainer(input) {
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: capCpus(config.build?.cpus ?? 4, cpuset), pids: config.build?.pids ?? 4096, cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the check environment's volume", volume);
@@ -3370,4 +3524,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, withTunnelLog, writeEvalInput };

package/dist/{chunk-MATUHHN4.js → chunk-GUXWQIEY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';