@outerlayer/cli 0.28.1 → 0.28.3

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @outerlayer/cli
 
+## 0.28.3
+
+### Patch Changes
+
+- 556dd93: A container build that drops many connections at once, as package installs and test suites do, keeps its link to the runner. The runner no longer ends the build's relay session after about a thousand dropped connections.
+
+## 0.28.2
+
+### Patch Changes
+
+- b61b6ba: `outerlayer sync` uploads a helper agent as finished once its parent session was told it stopped, even while the parent still runs. Before, each `sync` uploaded every helper of a running session as open, so finished helpers read as running until the whole session ended.
+- fc2ba91: A container build's downloads arrive whole, so package installs no longer fail with aborted requests. A burst of connections no longer drops the build's link to the runner.
+
 ## 0.28.1
 
 ### Patch Changes

package/dist/{agent-setup-YVR5RO56.js → agent-setup-IDF3EXM4.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-QJFDAKRF.js';
+export { keepHandWritten, runAgentSetup } from './chunk-UXLLWIA2.js';
 import './chunk-QKXF7CLR.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-SATUCMAJ.js';
 import './chunk-5B7BEQPR.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-4XN5FRRJ.js';
+import './chunk-TG7FAHRP.js';
 import './chunk-P2RWZCV7.js';
-import './chunk-7CK2TJFB.js';
+import './chunk-KJIUFOC4.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-YL2VDSNF.js';
-import './chunk-5K3KB4YR.js';
-import './chunk-HXAEQPZR.js';
+import './chunk-R7TMTFJP.js';
+import './chunk-DWVAG73B.js';
+import './chunk-N5EEEKT6.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-JGML2VUN.js';
@@ -27,7 +27,7 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-XD4ZCMA4.js';
-import './chunk-JGD5TWQ2.js';
+import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{bridge-WW2V7DTB.js → bridge-JN3VJ23L.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-ZTY7HHYB.js';
-import './chunk-HXAEQPZR.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-RXFKXZJS.js';
+import './chunk-N5EEEKT6.js';
 import './chunk-XD4ZCMA4.js';
-import './chunk-JGD5TWQ2.js';
+import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{build-5FRC3RKM.js → build-JCYOHPLL.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-T2QSWFSU.js';
-import './chunk-NUHZV3A4.js';
+export { buildRepositoryImage } from './chunk-TCBVV2JK.js';
+import './chunk-M6NNXKRM.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-SJZL5F3F.js';
-import './chunk-5K3KB4YR.js';
-import './chunk-HXAEQPZR.js';
+import './chunk-DWVAG73B.js';
+import './chunk-N5EEEKT6.js';
 import './chunk-XD4ZCMA4.js';
-import './chunk-JGD5TWQ2.js';
+import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-17T13:49:00.892Z+55dd868","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-17T16:34:27.736Z+686145e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-4F2XNSFC.js → builder-HCTVP2O7.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-VC5J7QPV.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-MFI55TNI.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
 import './chunk-UHU7H57K.js';
-import './chunk-YL2VDSNF.js';
-import './chunk-5K3KB4YR.js';
-import './chunk-HXAEQPZR.js';
+import './chunk-R7TMTFJP.js';
+import './chunk-DWVAG73B.js';
+import './chunk-N5EEEKT6.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-XD4ZCMA4.js';
-import './chunk-JGD5TWQ2.js';
+import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{check-NDDOASVO.js → check-F2TJCQ7S.js}

@@ -1,59 +1,59 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-7UGFIWIW.js';
-import './chunk-KVDVNOUK.js';
+import { probeCredentials } from './chunk-LRFU6RPD.js';
+import './chunk-ILU6664L.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
-import './chunk-IVX3U7KV.js';
+import './chunk-HWOU2HDH.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-66T6XJAB.js';
-import './chunk-N7WAEEIU.js';
-import './chunk-QWAYRAUX.js';
-import './chunk-2YSCKEL2.js';
-import './chunk-TVZAC2NP.js';
+import './chunk-QBF462QH.js';
+import './chunk-OO6OADZN.js';
+import './chunk-YTR435DO.js';
+import './chunk-2BZTGJII.js';
+import './chunk-VM6BX2WJ.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-ZTY7HHYB.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-W3FSGH2M.js';
+import './chunk-RXFKXZJS.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-SVODOMYC.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-GUXWQIEY.js';
+import './chunk-6NFXOQKZ.js';
 import './chunk-TBT347UY.js';
-import './chunk-R7SS5RLJ.js';
-import './chunk-T57XUI6N.js';
-import './chunk-IKXY47R5.js';
-import './chunk-MHAR6S7B.js';
-import './chunk-WWQVKFN6.js';
-import './chunk-USJZ2LDK.js';
-import './chunk-Z3ASAXVU.js';
+import './chunk-T7LJ6AIC.js';
+import './chunk-EPGMCEVP.js';
+import './chunk-4SJ57DH7.js';
+import './chunk-WL3QF3QF.js';
+import './chunk-DIQN5SEL.js';
+import './chunk-JZJLKTZT.js';
+import './chunk-O47BTZSN.js';
 import './chunk-TQMI335S.js';
-import './chunk-F4FA3ZUT.js';
-import './chunk-MQHTM4YJ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-55XLX5PA.js';
+import './chunk-AV5MJY45.js';
+import './chunk-JYVBEWBC.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-YYGXCRIW.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-T2QSWFSU.js';
-import './chunk-NUHZV3A4.js';
+import './chunk-TCBVV2JK.js';
+import './chunk-M6NNXKRM.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-VC5J7QPV.js';
+import './chunk-MFI55TNI.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-X52PMPOM.js';
-import './chunk-LNIFYSNK.js';
-import './chunk-VU7ZJPIR.js';
+import './chunk-X7SFJZIG.js';
+import './chunk-NMIYK2G2.js';
+import './chunk-QFNFBQCG.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-UHU7H57K.js';
 import './chunk-5B7BEQPR.js';
 import './chunk-HOU33DW5.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-4XN5FRRJ.js';
+import './chunk-TG7FAHRP.js';
 import './chunk-P2RWZCV7.js';
-import './chunk-7CK2TJFB.js';
+import './chunk-KJIUFOC4.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-YL2VDSNF.js';
-import './chunk-5K3KB4YR.js';
-import { claudeEnvPath } from './chunk-HXAEQPZR.js';
-import './chunk-DKWQMPSL.js';
+import './chunk-R7TMTFJP.js';
+import './chunk-DWVAG73B.js';
+import { claudeEnvPath } from './chunk-N5EEEKT6.js';
+import './chunk-OOUHNKKX.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -74,7 +74,7 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
-import './chunk-JGD5TWQ2.js';
+import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-2YSCKEL2.js → chunk-2BZTGJII.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-TVZAC2NP.js';
+import { uploadSpooledSteps } from './chunk-VM6BX2WJ.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-UHU7H57K.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7CK2TJFB.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-KJIUFOC4.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-YL2VDSNF.js';
-import { writeSyncStatus, spoolDir } from './chunk-DKWQMPSL.js';
+import { signerFor, signRunnerRequest } from './chunk-R7TMTFJP.js';
+import { writeSyncStatus, spoolDir } from './chunk-OOUHNKKX.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
@@ -19,7 +19,7 @@ import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { dirname, basename, join } from 'path';
+import { dirname, basename, join, sep } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';
 import { hostname, userInfo } from 'os';
@@ -834,6 +834,49 @@ var LiveUploader = class {
     }
   }
 };
+var NOTICE = /<task-id>(?:\s|\\n)*([\w-]+)(?:\s|\\n)*<\/task-id>(?:(?!<task-notification>)[\s\S])*?<status>(?:\s|\\n)*(completed|failed|killed|stopped|cancelled|canceled|error)(?:\s|\\n)*<\/status>/gi;
+var cache = /* @__PURE__ */ new Map();
+function parentTranscriptOf(subagentFile) {
+  const segments = subagentFile.split(sep);
+  const at = segments.lastIndexOf("subagents");
+  if (at < 2) return void 0;
+  return join(segments.slice(0, at - 1).join(sep), `${segments[at - 1]}.jsonl`);
+}
+function endNotices(text) {
+  const endedAt = /* @__PURE__ */ new Map();
+  for (const raw of text.split("\n")) {
+    if (!raw.includes("<task-notification>")) continue;
+    let line;
+    try {
+      line = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (line.type !== "user" || typeof line.timestamp !== "string") continue;
+    for (const [, id] of raw.matchAll(NOTICE)) endedAt.set(id, [...endedAt.get(id) ?? [], line.timestamp]);
+  }
+  return endedAt;
+}
+function noticesIn(parentFile) {
+  try {
+    const { size, mtimeMs } = statSync(parentFile);
+    const key = `${parentFile}\0${size}\0${mtimeMs}`;
+    const known = cache.get(key) ?? endNotices(readFileSync(parentFile, "utf8"));
+    cache.set(key, known);
+    return known;
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+function subagentEndedInParent(subagentFile, lastActivityAt) {
+  const parent = parentTranscriptOf(subagentFile);
+  if (parent === void 0) return false;
+  const notices = noticesIn(parent).get(basename(subagentFile, ".jsonl").replace(/^agent-/, "")) ?? [];
+  return notices.some((at) => lastActivityAt === void 0 || Date.parse(at) >= Date.parse(lastActivityAt));
+}
+function runningForParent(entry, lastActivityAt) {
+  return !entry.isSubagent || !subagentEndedInParent(entry.file, lastActivityAt);
+}
 
 // src/skip-verdict.ts
 var RESUME_WINDOW_MS = 14 * 24 * 60 * 60 * 1e3;
@@ -1206,7 +1249,7 @@ async function runSyncInner(opts, stats) {
         applyContextProvenance(session, contextSourceBySessionId.get(session.id));
         applyReportedCost(session, home);
         const gated = prepareSessionForUpload(session, tier, envVars);
-        const liveEntry = liveUploads[gated.id];
+        const liveEntry = runningForParent(entry, gated.endedAt) ? liveUploads[gated.id] : void 0;
         const daemonIsStreaming = liveEntry !== void 0 && !liveEntry.ended && !liveEntry.failed;
         if (daemonIsStreaming && !sessionHasEnded(home, gated.subagent?.parentSessionId ?? gated.id)) {
           const gatedTurns = gated.turns ?? [];

package/dist/{chunk-IKXY47R5.js → chunk-4SJ57DH7.js}

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { execCapture } from './chunk-MHAR6S7B.js';
-import { GUEST_CID } from './chunk-WWQVKFN6.js';
-import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-USJZ2LDK.js';
-import { runnerImageVersion } from './chunk-Z3ASAXVU.js';
+import { execCapture } from './chunk-WL3QF3QF.js';
+import { GUEST_CID } from './chunk-DIQN5SEL.js';
+import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-JZJLKTZT.js';
+import { runnerImageVersion } from './chunk-O47BTZSN.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-T2QSWFSU.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TCBVV2JK.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-VC5J7QPV.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-MFI55TNI.js';
 import { readDu } from './chunk-YJLHUKYS.js';
 import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-SJZL5F3F.js';
-import { WorkCommandError } from './chunk-X52PMPOM.js';
+import { WorkCommandError } from './chunk-X7SFJZIG.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-UHU7H57K.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-5K3KB4YR.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-HXAEQPZR.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-DWVAG73B.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-N5EEEKT6.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
 import { downconvertSession } from './chunk-QZBXLLTV.js';
 import { realFdStorePort } from './chunk-XD4ZCMA4.js';
-import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-JGD5TWQ2.js';
+import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream, writeSync } from 'fs';
 import { join, dirname, resolve, basename } from 'path';
 import { isIP, createConnection, connect, createServer as createServer$1 } from 'net';
@@ -1363,6 +1363,29 @@ async function resolveAgentUser(input) {
 var noop = () => void 0;
 var FRAME_HEADER_BYTES = 9;
 var GOAWAY_FRAME = 7;
+function describeGoawayCode(code) {
+  const names = [
+    "NO_ERROR",
+    "PROTOCOL_ERROR",
+    "INTERNAL_ERROR",
+    "FLOW_CONTROL_ERROR",
+    "SETTINGS_TIMEOUT",
+    "STREAM_CLOSED",
+    "FRAME_SIZE_ERROR",
+    "REFUSED_STREAM",
+    "CANCEL",
+    "COMPRESSION_ERROR",
+    "CONNECT_ERROR",
+    "ENHANCE_YOUR_CALM",
+    "INADEQUATE_SECURITY",
+    "HTTP_1_1_REQUIRED"
+  ];
+  const name = names[code];
+  return name === void 0 ? `error code ${code}` : `${name} (${code})`;
+}
+function goawayNote(label, code) {
+  return code === void 0 ? "" : ` \xB7 ${label} ${describeGoawayCode(code)}`;
+}
 function watchSentGoaway(onError) {
   let head = Buffer.alloc(0);
   let want = FRAME_HEADER_BYTES;
@@ -1385,7 +1408,10 @@ function watchSentGoaway(onError) {
         want = FRAME_HEADER_BYTES + 8;
         continue;
       }
-      if (want > FRAME_HEADER_BYTES && head.readUInt32BE(FRAME_HEADER_BYTES + 4) !== http2.constants.NGHTTP2_NO_ERROR) onError();
+      if (want > FRAME_HEADER_BYTES) {
+        const code = head.readUInt32BE(FRAME_HEADER_BYTES + 4);
+        if (code !== http2.constants.NGHTTP2_NO_ERROR) onError(code);
+      }
       skip = length - (want - FRAME_HEADER_BYTES);
       head = Buffer.alloc(0);
       want = FRAME_HEADER_BYTES;
@@ -1397,9 +1423,11 @@ function serveSession(transport, services, opts = {}) {
   let open = 0;
   let served = 0;
   let malformed = false;
+  let goawayCode;
   transport.on("error", noop);
-  const watch = watchSentGoaway(() => {
+  const watch = watchSentGoaway((code) => {
     malformed = true;
+    goawayCode ??= code;
     setImmediate(() => session.destroy());
   });
   const outbound = new Transform({
@@ -1412,7 +1440,11 @@ function serveSession(transport, services, opts = {}) {
   outbound.pipe(transport);
   const wire = Duplex.from({ readable: transport, writable: outbound });
   wire.on("error", noop);
-  const session = http2.performServerHandshake(wire, { settings: { initialWindowSize: STREAM_WINDOW, enablePush: false } });
+  const session = http2.performServerHandshake(wire, {
+    settings: { initialWindowSize: STREAM_WINDOW, enablePush: false },
+    streamResetBurst: STREAM_RESET_BURST,
+    streamResetRate: STREAM_RESET_RATE
+  });
   try {
     session.setLocalWindowSize(SESSION_WINDOW);
   } catch {
@@ -1421,7 +1453,10 @@ function serveSession(transport, services, opts = {}) {
     session.on("error", (err) => {
       if (typeof err.code === "string" && err.code.startsWith("ERR_HTTP2_")) malformed = true;
     });
-    session.on("close", () => resolve2({ malformed, served }));
+    session.on("goaway", (code) => {
+      if (code !== http2.constants.NGHTTP2_NO_ERROR) goawayCode ??= code;
+    });
+    session.on("close", () => resolve2({ malformed, served, goawayCode }));
   });
   session.on("stream", (stream, headers) => {
     stream.on("error", noop);
@@ -1495,14 +1530,14 @@ function superviseRelay(input) {
       if (joined) {
         backoff = FIRST_BACKOFF_MS;
         failing = false;
-        if (!closed) input.log?.(`the session with ${input.container} ended \xB7 joining again`);
+        if (!closed) input.log?.(`the session with ${input.container} ended \xB7 joining again${goawayNote("GOAWAY", end.goawayCode)}`);
       }
       if (!end.malformed && end.served > 0) malformedInARow = 0;
       if (end.malformed) {
         malformedInARow++;
         if (malformedInARow >= MAX_MALFORMED_SESSIONS) {
           fatal = MALFORMED_REASON;
-          input.log?.(`the session with ${input.container} broke HTTP/2 framing ${malformedInARow} times in a row \xB7 ending the build`);
+          input.log?.(`the session with ${input.container} broke HTTP/2 framing ${malformedInARow} times in a row${goawayNote("last GOAWAY", end.goawayCode)} \xB7 ending the build`);
           input.onFatal?.(fatal);
           return;
         }
@@ -2279,6 +2314,9 @@ var CONNECT_TIMEOUT_MS = 3e4;
 var NOT_ALLOWED_RANGE = "not-allowed";
 var NOT_RESOLVED = "not resolved";
 var IDLE_TIMEOUT_MS = 10 * 6e4;
+var STALLED_RESPONSE_MS = 6e4;
+var MAX_BAD_GATEWAY_LINES = 10;
+var BAD_GATEWAY_WINDOW_MS = 1e4;
 async function systemResolve(host) {
   const found = await lookup(host, { all: true, verbatim: true });
   return found.map((a) => ({ address: a.address }));
@@ -2286,6 +2324,13 @@ async function systemResolve(host) {
 function systemHostAddresses() {
   return Object.values(networkInterfaces()).flatMap((list) => (list ?? []).map((i) => i.address));
 }
+function errorCode(err) {
+  const code = err?.code;
+  return typeof code === "string" ? code : "unknown";
+}
+function abortedError(message) {
+  return Object.assign(new Error(message), { code: "ECONNABORTED" });
+}
 function normalize(address) {
   const zone = address.indexOf("%");
   return (zone === -1 ? address : address.slice(0, zone)).toLowerCase();
@@ -2305,6 +2350,26 @@ async function startTunnel(socketPath, opts = {}) {
   const ownAddresses = opts.hostAddresses ?? systemHostAddresses;
   const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
   const idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
+  const stalledResponseMs = opts.stalledResponseMs ?? STALLED_RESPONSE_MS;
+  let windowStartedMs = 0;
+  let linesInWindow = 0;
+  let suppressed = 0;
+  const logBadGateway = (what) => {
+    if (opts.log === void 0) return;
+    const now = Date.now();
+    if (now - windowStartedMs >= BAD_GATEWAY_WINDOW_MS) {
+      windowStartedMs = now;
+      linesInWindow = 0;
+    }
+    if (linesInWindow >= MAX_BAD_GATEWAY_LINES) {
+      suppressed++;
+      return;
+    }
+    linesInWindow++;
+    const more = suppressed === 0 ? "" : ` (${suppressed} more 502 lines were not written)`;
+    suppressed = 0;
+    opts.log(`tunnel answered 502: ${what}${more}`);
+  };
   const hosts = [];
   const seen = /* @__PURE__ */ new Set();
   const extraHosts = /* @__PURE__ */ new Set();
@@ -2376,7 +2441,7 @@ async function startTunnel(socketPath, opts = {}) {
     }
     persist();
   };
-  async function decide(host) {
+  async function decide(host, port) {
     if (opts.allowHosts !== void 0 && !hostAllowed(host, opts.allowHosts)) {
       refused2(host, NOT_RESOLVED, NOT_ALLOWED_RANGE);
       return { ok: false, status: 403, body: `refused: ${host} is not in runner.build.allowHosts
@@ -2385,12 +2450,16 @@ async function startTunnel(socketPath, opts = {}) {
     let addresses;
     try {
       addresses = await resolve2(host);
-    } catch {
+    } catch (err) {
+      logBadGateway(`could not resolve ${host}:${port}, ${errorCode(err)}`);
       return { ok: false, status: 502, body: `could not resolve ${host}
 ` };
     }
-    if (addresses.length === 0) return { ok: false, status: 502, body: `${host} has no address
+    if (addresses.length === 0) {
+      logBadGateway(`${host}:${port} resolved to no address`);
+      return { ok: false, status: 502, body: `${host} has no address
 ` };
+    }
     const own = new Set(ownAddresses().map(normalize));
     let firstRefusal;
     for (const { address: address2 } of addresses) {
@@ -2432,36 +2501,70 @@ ${body}`);
       client.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
       return;
     }
-    const decision = await decide(target.host);
+    const decision = await decide(target.host, target.port);
     if (!decision.ok) {
       reply(client, decision.status, decision.body);
       return;
     }
     const upstream = openConnection({ address: decision.address, port: target.port });
     upstream.setTimeout(connectTimeoutMs);
-    const failed = () => {
+    const failed = (err) => {
       upstream.destroy();
+      logBadGateway(`could not connect to ${target.host}:${target.port}, ${err === void 0 ? "ETIMEDOUT" : errorCode(err)}`);
       reply(client, 502, `could not connect to ${target.host}
 `);
     };
+    const timedOut = () => failed();
     upstream.once("error", failed);
-    upstream.once("timeout", failed);
+    upstream.once("timeout", timedOut);
     client.on("close", () => upstream.destroy());
     const established = () => {
       upstream.removeListener("error", failed);
-      upstream.removeListener("timeout", failed);
+      upstream.removeListener("timeout", timedOut);
       upstream.setTimeout(idleTimeoutMs, () => upstream.destroy());
-      upstream.on("error", () => void 0);
-      upstream.on("close", () => client.destroy());
+      upstream.on("error", (err) => client.destroy(err));
+      upstream.on("close", () => {
+        if (!upstream.readableEnded && !client.writableEnded) client.destroy(abortedError("the tunnel closed the connection to the server before it ended"));
+      });
+      client.once("end", () => {
+        upstream.destroy();
+        client.end();
+      });
       reached(target.host);
       client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
       upstream.write(head);
+      releaseWhenStalled(client, upstream);
       upstream.pipe(client);
       client.pipe(upstream);
     };
     if (upstream.readyState === "open") established();
     else upstream.once("connect", established);
   }
+  function releaseWhenStalled(client, upstream) {
+    let delivered = 0;
+    upstream.on("data", (chunk) => delivered += chunk.length);
+    let read = delivered;
+    let timer;
+    const blocked = () => upstream.isPaused() || upstream.readableEnded;
+    const check = () => {
+      timer = void 0;
+      if (client.writableFinished || !blocked()) return;
+      if (delivered > read) {
+        read = delivered;
+        timer = setTimeout(check, stalledResponseMs);
+        return;
+      }
+      client.destroy(abortedError("the build stopped reading the response"));
+    };
+    const watch = () => {
+      if (timer !== void 0) return;
+      read = delivered;
+      timer = setTimeout(check, stalledResponseMs);
+    };
+    upstream.on("pause", watch);
+    upstream.on("end", watch);
+    client.once("close", () => clearTimeout(timer));
+  }
   async function proxyPlain(req, res) {
     if (opts.gitRemote !== void 0 && (req.url ?? "").startsWith("/")) {
       await opts.gitRemote(req, res);
@@ -2482,7 +2585,7 @@ ${body}`);
     }
     const host = url.hostname.replace(/^\[|\]$/g, "");
     const port = url.port === "" ? 80 : Number(url.port);
-    const decision = await decide(host);
+    const decision = await decide(host, port);
     if (!decision.ok) {
       res.writeHead(decision.status, { "Content-Type": "text/plain", Connection: "close" });
       res.end(decision.body);
@@ -2507,8 +2610,9 @@ ${body}`);
     );
     upstream.setTimeout(connectTimeoutMs, () => upstream.destroy());
     res.on("close", () => upstream.destroy());
-    upstream.on("error", () => {
+    upstream.on("error", (err) => {
       if (!res.headersSent) {
+        logBadGateway(`could not reach ${host}:${port}, ${errorCode(err)}`);
         res.writeHead(502, { "Content-Type": "text/plain", Connection: "close" });
         res.end(`could not reach ${host}
 `);
@@ -2561,6 +2665,9 @@ var RELAY_WAIT_MS = 500;
 var BUSY_IMAGE_WAIT_MS = 5e3;
 var VOLUME_REMOVE_ATTEMPTS = 4;
 var WORKFLOW_PERMISSION_REASON = "workflow_permission_required";
+function withTunnelLog(opts, log) {
+  return { ...opts, tunnelOptions: { log, ...opts?.tunnelOptions } };
+}
 function createContainerRuntime(opts = {}) {
   const { cli, remoteFor } = opts;
   return {
@@ -3421,4 +3528,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, withTunnelLog, writeEvalInput };

package/dist/{chunk-GUXWQIEY.js → chunk-6NFXOQKZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-F4FA3ZUT.js → chunk-AV5MJY45.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-MQHTM4YJ.js';
-import { RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
-import { claudeEnvPath, withoutCredentialLines } from './chunk-HXAEQPZR.js';
+import { DEFAULT_UNIT_NAME } from './chunk-JYVBEWBC.js';
+import { RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { claudeEnvPath, withoutCredentialLines } from './chunk-N5EEEKT6.js';
 import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';