@outerlayer/cli 0.33.0-next.20261021171323 → 0.33.0-next.20261021194303

package/dist/{chunk-G7QBSH3X.js → chunk-BBK62GXM.js}

@@ -1,20 +1,21 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { execCapture } from './chunk-QQGZ5THT.js';
-import { GUEST_CID } from './chunk-HIGJTX5U.js';
-import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-BXA6JLHQ.js';
-import { runnerImageVersion } from './chunk-IWYS4ERC.js';
+import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
+import { runExec, execCapture, waitForAgent } from './chunk-QQGZ5THT.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-HIGJTX5U.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-LTZVMKQS.js';
+import { runnerImageVersion } from './chunk-533QGXGZ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-BSHUTMXV.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-TPGHCH2H.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-ZZWWKBLL.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-KUOY5UIR.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { RecipeError, DOCKER_FEATURE } from './chunk-3Z3MPR55.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-LK2S5XZH.js';
-import { WorkCommandError } from './chunk-SOTJ2V3A.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-GKNF4D62.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-KP6R7CV3.js';
+import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-LHYO4RDP.js';
+import { WorkCommandError } from './chunk-XRZGT54P.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-XT5SOJRC.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath } from './chunk-ESP5VZBD.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-HDSDUTX4.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
@@ -22,14 +23,14 @@ import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-JUXATN4
 import { downconvertSession } from './chunk-3WW2TL7V.js';
 import { realFdStorePort } from './chunk-XD4ZCMA4.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
-import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream, writeSync } from 'fs';
-import { join, dirname, resolve, basename } from 'path';
+import { statfsSync, readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, statSync, readdirSync, mkdtempSync, writeFileSync, lstatSync, copyFileSync, accessSync, constants, rmdirSync, renameSync, unlinkSync, linkSync, openSync, closeSync, cpSync, writeSync, appendFileSync, createWriteStream, createReadStream } from 'fs';
+import { dirname, join, relative, resolve, basename } from 'path';
 import { isIP, createConnection, connect, createServer as createServer$1 } from 'net';
 import { spawnSync, spawn } from 'child_process';
-import { availableParallelism, networkInterfaces } from 'os';
 import { randomBytes, createHash } from 'crypto';
+import { availableParallelism, networkInterfaces, tmpdir } from 'os';
+import { Duplex, PassThrough, Transform } from 'stream';
 import http2 from 'http2';
-import { Duplex, Transform } from 'stream';
 import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
 import { pipeline, finished } from 'stream/promises';
@@ -249,6 +250,978 @@ function jailedAlive(unit, cgroupRoot = "/sys/fs/cgroup") {
 function realHelperPort(env = process.env) {
   return { probe: () => probeHelper(env[HELPER_ENV]), alive: (unit) => jailedAlive(unit) };
 }
+function freeBytes(path, statfs = statfsSync) {
+  let at = path;
+  for (; ; ) {
+    try {
+      const stats = statfs(at);
+      return Number(stats.bavail) * Number(stats.bsize);
+    } catch (err) {
+      if (err.code !== "ENOENT") return void 0;
+      const parent = dirname(at);
+      if (parent === at) return void 0;
+      at = parent;
+    }
+  }
+}
+var UNITS = ["B", "KB", "MB", "GB", "TB"];
+function formatBytes(bytes) {
+  let value = Math.max(0, bytes);
+  let unit = 0;
+  while (value >= 1024 && unit < UNITS.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return unit === 0 ? `${Math.round(value)} B` : `${value.toFixed(1)} ${UNITS[unit]}`;
+}
+var STOP_GRACE_SECONDS = 15;
+function parseImageConfig(json) {
+  const config = JSON.parse(json);
+  const env = {};
+  for (const entry of config.Env ?? []) {
+    const eq = entry.indexOf("=");
+    if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return { user: config.User ?? "", env };
+}
+function createContainerHost(deps = {}) {
+  const run = deps.run ?? spawnRun;
+  return {
+    async version() {
+      const result = await run("docker", ["version", "--format", "{{.Server.Version}}"]);
+      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
+    },
+    async operatingSystem() {
+      const result = await run("docker", ["info", "--format", "{{.OperatingSystem}}"]);
+      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
+    },
+    async imageConfig(imageId) {
+      const result = await run("docker", ["image", "inspect", "--format", "{{json .Config}}", imageId]);
+      return result.status === 0 ? parseImageConfig(result.stdout) : { user: "", env: {} };
+    },
+    createVolume(name, labels) {
+      const flags = Object.entries(labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+      return run("docker", ["volume", "create", ...flags, name]);
+    },
+    removeVolume(name) {
+      return run("docker", ["volume", "rm", "--force", name]);
+    },
+    run(args, opts) {
+      return run("docker", ["run", ...args], opts);
+    },
+    exec(input, opts) {
+      const env = {};
+      for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
+      return run("docker", ["exec", ...containerExecArgs(input)], { ...opts, env, ...input.stdin === void 0 ? {} : { input: input.stdin } });
+    },
+    execDetached(input) {
+      const env = {};
+      for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
+      return run("docker", ["exec", ...containerExecArgs({ ...input, detached: true })], { env });
+    },
+    async state(container) {
+      const result = await run("docker", ["inspect", "--format", "{{.State.Running}}", container]);
+      if (result.status !== 0) return /no such (object|container)/i.test(result.stderr) ? "missing" : "unknown";
+      return result.stdout.trim() === "true" ? "running" : "stopped";
+    },
+    execStream(input) {
+      const child = (deps.spawn ?? spawn)("docker", ["exec", ...containerExecArgs({ ...input, interactive: true })], {
+        env: childEnvironment(process.env),
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      let stderr = "";
+      child.stderr?.on("data", (chunk) => {
+        stderr = (stderr + chunk.toString()).slice(-400);
+      });
+      child.stderr?.on("error", () => void 0);
+      const exited = new Promise((resolve2) => {
+        child.once("error", () => resolve2(-1));
+        child.once("close", (code) => resolve2(code ?? -1));
+      });
+      child.stdin.on("error", () => void 0);
+      return { stdin: child.stdin, stdout: child.stdout, exited, kill: () => void child.kill("SIGKILL"), stderrTail: () => stderr };
+    },
+    stop(container) {
+      return run("docker", ["stop", "--time", String(STOP_GRACE_SECONDS), container]);
+    },
+    start(container) {
+      return run("docker", ["start", container]);
+    },
+    remove(container) {
+      return run("docker", ["rm", "--force", "--volumes", container]);
+    }
+  };
+}
+function converterScript(workDir = "/tmp/rootfs") {
+  return [
+    "set -eu",
+    `rootfs=${workDir}`,
+    'mkdir -p "$rootfs"',
+    'tar -xf - -C "$rootfs"',
+    'used_kb=$(du -sk "$rootfs" | cut -f1)',
+    'files=$(find "$rootfs" | wc -l)',
+    // The file is made roomy and sparse, so that populating it cannot run out of space, and is shrunk to the smallest size that holds the files afterwards.
+    "total_kb=$(( used_kb * 2 + 262144 ))",
+    'truncate -s "${total_kb}K" "/out/$OUT_NAME"',
+    'mke2fs -q -F -t ext4 -m 0 -N $(( files + files / 4 + 4096 )) -d "$rootfs" "/out/$OUT_NAME"',
+    // e2fsck exits 1 when it repaired something; resize2fs -M needs the check to have run.
+    'e2fsck -f -y "/out/$OUT_NAME" > /dev/null || [ $? -lt 4 ]',
+    'resize2fs -M "/out/$OUT_NAME" > /dev/null 2>&1',
+    'chown "$HOST_UID:$HOST_GID" "/out/$OUT_NAME"',
+    // In the builder microVM the extracted file system sits on the cache disk, which the next builder reuses.
+    ...workDir === "/tmp/rootfs" ? [] : ['rm -rf "$rootfs"']
+  ].join("\n");
+}
+function templateScript() {
+  return [
+    "set -eu",
+    'truncate -s "$BYTES" "/out/$OUT_NAME"',
+    'mke2fs -q -F -t ext4 -m 0 -E lazy_itable_init=1,lazy_journal_init=1,nodiscard "/out/$OUT_NAME"',
+    'chown "$HOST_UID:$HOST_GID" "/out/$OUT_NAME"'
+  ].join("\n");
+}
+var ids = () => ({ uid: String(process.getuid?.() ?? 0), gid: String(process.getgid?.() ?? 0) });
+function converterArgs(dest, memoryBytes, extra, script) {
+  const { uid, gid } = ids();
+  return [
+    "run",
+    "--rm",
+    "-i",
+    "--network",
+    "none",
+    "--memory",
+    String(memoryBytes),
+    "--memory-swap",
+    String(memoryBytes),
+    "--mount",
+    `type=bind,src=${dirname(dest)},dst=/out`,
+    "-e",
+    `OUT_NAME=${basename(dest)}`,
+    "-e",
+    `HOST_UID=${uid}`,
+    "-e",
+    `HOST_GID=${gid}`,
+    ...extra,
+    // The image that runs `mke2fs` as root is the default base image: Ubuntu holds e2fsprogs.
+    DEFAULT_BASE_IMAGE,
+    "sh",
+    "-c",
+    script
+  ];
+}
+var firstLine = (text) => text.trim().split("\n")[0] ?? "";
+function exportInto(container, converter) {
+  return new Promise((resolve2, reject) => {
+    const exporter = spawn("docker", ["export", container], { stdio: ["ignore", "pipe", "pipe"], env: childEnvironment(process.env) });
+    const writer = spawn("docker", converter, { stdio: ["pipe", "ignore", "pipe"], env: childEnvironment(process.env) });
+    const errors = [];
+    exporter.stderr.on("data", (chunk) => errors.push(`docker export: ${chunk.toString("utf8")}`));
+    writer.stderr.on("data", (chunk) => errors.push(`converter: ${chunk.toString("utf8")}`));
+    writer.stdin.on("error", () => void 0);
+    exporter.stdout.on("error", () => void 0);
+    exporter.stdout.pipe(writer.stdin);
+    exporter.once("error", reject);
+    writer.once("error", reject);
+    let exits = 0;
+    let failure2;
+    const done = (name, code) => {
+      if (code !== 0 && failure2 === void 0) failure2 = `${name} exited ${code}`;
+      exits += 1;
+      if (exits < 2) return;
+      if (failure2 === void 0) resolve2();
+      else reject(new Error(`${failure2}: ${firstLine(errors.join("\n"))}`));
+    };
+    exporter.once("exit", (code) => done("docker export", code));
+    writer.once("exit", (code) => done("the converter", code));
+  });
+}
+function createRootfsHost() {
+  const env = () => childEnvironment(process.env);
+  return {
+    async convert({ imageId, dest, memoryBytes }) {
+      const created = await spawnRun("docker", ["create", imageId, "none"], { env: env() });
+      if (created.status !== 0) throw new Error(`docker create ${imageId} failed: ${firstLine(created.stderr)}`);
+      const container = created.stdout.trim();
+      try {
+        await exportInto(container, converterArgs(dest, memoryBytes, [], converterScript()));
+      } finally {
+        await spawnRun("docker", ["rm", "--force", "--volumes", container], { env: env() });
+      }
+    },
+    async makeTemplate({ bytes, dest, memoryBytes }) {
+      const made = await spawnRun("docker", converterArgs(dest, memoryBytes, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
+      if (made.status !== 0) throw new Error(`making the empty build disk failed: ${firstLine(made.stderr)}`);
+    },
+    async imageConfig(imageId) {
+      const inspected = await spawnRun("docker", ["image", "inspect", "--format", "{{json .Config}}", imageId], { env: env() });
+      if (inspected.status !== 0) throw new Error(`docker image inspect ${imageId} failed: ${firstLine(inspected.stderr)}`);
+      return parseImageConfig(inspected.stdout);
+    }
+  };
+}
+function sweepStalePartials(dir) {
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const pid = /\.partial-(\d+)-[0-9a-f]+$/.exec(name)?.[1];
+    if (pid === void 0 || Number(pid) === process.pid) continue;
+    try {
+      process.kill(Number(pid), 0);
+    } catch (err) {
+      if (err.code === "ESRCH") rmSync(join(dir, name), { force: true });
+    }
+  }
+}
+async function madeAtomically(path, make) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  const temp = `${path}.partial-${process.pid}-${randomBytes(3).toString("hex")}`;
+  sweepStalePartials(dirname(path));
+  try {
+    await make(temp);
+    renameSync(temp, path);
+  } catch (err) {
+    rmSync(temp, { force: true });
+    throw err;
+  }
+}
+async function ensureRootfs(input) {
+  const path = rootfsPathFor(input.runnerDir, input.imageId);
+  if (existsSync(path)) return path;
+  const { uid, gid } = ids();
+  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
+  return path;
+}
+async function createBuildDisk(input) {
+  const template = join(diskTemplatesDir(input.runnerDir), `${input.bytes}.ext4`);
+  if (!existsSync(template)) {
+    const { uid, gid } = ids();
+    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
+  }
+  mkdirSync(dirname(input.dest), { recursive: true });
+  if (input.host.copyTemplate) input.host.copyTemplate(template, input.dest);
+  else {
+    const copied = spawnSync("cp", ["--sparse=always", template, input.dest], { encoding: "utf8" });
+    if (copied.status !== 0) throw new Error(`copying the empty build disk failed: ${firstLine(copied.stderr)}`);
+  }
+  chmodSync(input.dest, RUNNER_FILE_MODE);
+  truncateSync(input.dest, input.bytes);
+}
+function deleteBuildDisk(path) {
+  rmSync(path, { force: true });
+}
+var CONSOLE_CUT_NOTE = "[outerlayer runner: cut the console at 8 MiB; the microVM keeps running]\n";
+function pumpConsole(fd, streams) {
+  const cap = 8 * 1024 ** 2;
+  let written = 0;
+  let lastByte = 10;
+  let cut = false;
+  const append = (data) => {
+    try {
+      writeSync(fd, data);
+    } catch {
+    }
+  };
+  const onData = (chunk) => {
+    if (cut) return;
+    const room = cap - written;
+    if (chunk.length <= room) {
+      append(chunk);
+      written += chunk.length;
+      lastByte = chunk[chunk.length - 1] ?? lastByte;
+      return;
+    }
+    const head = chunk.subarray(0, room);
+    append(head);
+    if (head.length > 0) lastByte = head[head.length - 1];
+    append(Buffer.from(`${lastByte === 10 ? "" : "\n"}${CONSOLE_CUT_NOTE}`));
+    written = cap;
+    cut = true;
+  };
+  let open = streams.length;
+  for (const stream of streams) {
+    stream.on("data", onData);
+    stream.on("error", () => void 0);
+    stream.once("close", () => {
+      open -= 1;
+      if (open === 0) closeSync(fd);
+    });
+  }
+}
+
+// src/runner/microvm/firecracker.ts
+var clearBit = (bit) => `0b${"x".repeat(31 - bit)}0${"x".repeat(bit)}`;
+var CPU_TEMPLATE = {
+  cpuid_modifiers: [
+    { leaf: "0x1", subleaf: "0x0", flags: 0, modifiers: [{ register: "ecx", bitmap: clearBit(5) }] },
+    { leaf: "0x80000001", subleaf: "0x0", flags: 0, modifiers: [{ register: "ecx", bitmap: clearBit(2) }] }
+  ]
+};
+var MIB = 1024 ** 2;
+var INIT = "/opt/outerlayer/bin/outerlayer-guest";
+function machineConfig(limits2, paths) {
+  const bootArgs = [
+    "console=ttyS0",
+    "reboot=k",
+    "panic=1",
+    "pci=off",
+    "i8042.noaux",
+    "i8042.nomux",
+    "i8042.nopnp",
+    "i8042.dumbkbd",
+    // The pinned guest kernel builds pressure stall information default-disabled; the guest usage record reads it.
+    "psi=1",
+    "ro",
+    "root=/dev/vda",
+    "rootfstype=ext4",
+    `init=${INIT}`,
+    ...paths.relayPorts.length === 0 ? [] : [`outerlayer.relay=${paths.relayPorts.join(",")}`],
+    ...paths.leasePort === void 0 ? [] : [`outerlayer.lease=${paths.leasePort}`],
+    ...paths.docker === true ? ["outerlayer.docker=1"] : [],
+    // The kernel passes an argument of this form on to the init process as an environment variable.
+    ...paths.guestInit === void 0 ? [] : [`OUTERLAYER_GUEST_VM_INIT=${paths.guestInit}`]
+  ];
+  return {
+    "boot-source": { kernel_image_path: paths.kernel, boot_args: bootArgs.join(" ") },
+    drives: [
+      { drive_id: "rootfs", path_on_host: paths.rootfs, is_root_device: true, is_read_only: true },
+      { drive_id: "build", path_on_host: paths.buildDisk, is_root_device: false, is_read_only: false }
+    ],
+    "machine-config": { vcpu_count: limits2.cpus, mem_size_mib: Math.max(1, Math.floor(limits2.memoryBytes / MIB)), smt: false },
+    vsock: { guest_cid: GUEST_CID, uds_path: paths.vsock },
+    "cpu-config": CPU_TEMPLATE
+  };
+}
+function firecrackerCommand(input) {
+  const args = ["--no-api", "--config-file", input.configPath];
+  const binary = resolve(input.binary);
+  if (input.cgroup === void 0) return { command: binary, args };
+  return { command: "/bin/sh", args: ["-c", 'echo $$ > "$1/cgroup.procs" && shift && exec "$@"', "sh", input.cgroup, binary, ...args] };
+}
+var STOP_WAIT_MS = 1e4;
+var POLL_MS = 20;
+function isZombie(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    return stat.slice(stat.lastIndexOf(")") + 2, stat.lastIndexOf(")") + 3) === "Z";
+  } catch {
+    return false;
+  }
+}
+function createFirecrackerHost(options = {}) {
+  const launch = options.launch ?? firecrackerCommand;
+  const spawnChild = options.spawnChild ?? spawn;
+  const exits = /* @__PURE__ */ new Map();
+  const alive = (vm) => isSameProcess(vm.pid, vm.start) && !isZombie(vm.pid);
+  return {
+    async spawn(input) {
+      const { command, args } = launch(input);
+      mkdirSync(dirname(input.consolePath), { recursive: true });
+      const consoleFd = openSync(input.consolePath, "a", 384);
+      let pumping = false;
+      try {
+        const child = spawnChild(command, args, { detached: true, stdio: ["ignore", "pipe", "pipe"], env: {} });
+        pumpConsole(consoleFd, [child.stdout, child.stderr]);
+        pumping = true;
+        for (const stream of [child.stdout, child.stderr]) stream.unref?.();
+        const failed = new Promise((_resolve, reject) => child.once("error", reject));
+        const pid = child.pid;
+        if (pid === void 0) return await failed;
+        exits.set(pid, new Promise((resolve2) => child.once("exit", () => resolve2())));
+        child.unref();
+        const start = startTimeOf(pid);
+        if (start === null) throw new Error(`${command} exited as soon as it started; its console is at ${input.consolePath}`);
+        return { pid, start };
+      } finally {
+        if (!pumping) closeSync(consoleFd);
+      }
+    },
+    async stop(vm) {
+      if (!alive(vm)) return;
+      try {
+        process.kill(vm.pid, "SIGKILL");
+      } catch {
+      }
+      const exited = exits.get(vm.pid);
+      const deadline = Date.now() + STOP_WAIT_MS;
+      if (exited !== void 0) await Promise.race([exited, new Promise((resolve2) => setTimeout(resolve2, STOP_WAIT_MS))]);
+      while (alive(vm) && Date.now() < deadline) await new Promise((resolve2) => setTimeout(resolve2, POLL_MS));
+      exits.delete(vm.pid);
+    },
+    alive
+  };
+}
+function unitNameFor(buildId) {
+  return `outerlayer-build-${buildId}`;
+}
+function linkIn(buildDir2, name, source) {
+  const target = join(buildDir2, name);
+  rmSync(target, { force: true });
+  try {
+    linkSync(source, target);
+  } catch (err) {
+    if (err.code === "EXDEV") {
+      throw new Error(`${source} and ${buildDir2} are on different file systems, so the build's files cannot be linked into its jail`);
+    }
+    throw err;
+  }
+  chmodSync(source, 292);
+}
+async function startJailed(input) {
+  linkIn(input.buildDir, "kernel", input.kernel);
+  linkIn(input.buildDir, "rootfs.ext4", input.rootfs);
+  for (const name of input.sockets) {
+    try {
+      chmodSync(join(input.buildDir, name), 438);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+  return input.client.start({ build: input.buildId, kind: input.kind, ...input.timeLimitMinutes === void 0 ? {} : { timeLimitMinutes: input.timeLimitMinutes } });
+}
+async function startJailedInto(state, input, save) {
+  state.jailed = { unit: unitNameFor(state.buildId), chroot: "" };
+  save();
+  try {
+    const started = await startJailed({ ...input, buildId: state.buildId, buildDir: state.buildDir });
+    state.jailed = { unit: started.unit, chroot: started.chroot };
+    state.vsockPath = started.vsock;
+  } catch (err) {
+    if (err instanceof HelperRefusal) {
+      delete state.jailed;
+      save();
+    }
+    throw err;
+  }
+  save();
+}
+async function stopJailed(helper, state) {
+  const probe = await helper.probe();
+  if (!probe.ok) throw new Error(`the build's unit ${state.jailed?.unit ?? unitNameFor(state.buildId)} could not be stopped, because there is no helper to ask: ${probe.detail}`);
+  try {
+    await probe.client.stop(state.buildId);
+  } catch (err) {
+    throw new Error(`the build's unit ${state.jailed?.unit ?? unitNameFor(state.buildId)} was not stopped: ${describeCallFailure(err)}`);
+  }
+}
+function makeBuildsDirPrivate(buildDir2) {
+  const builds = dirname(buildDir2);
+  const stat = statSync(builds);
+  if (stat.uid === process.getuid?.() && (stat.mode & 18) !== 0) chmodSync(builds, 448);
+}
+var MANAGED_UNJAILED_REASON = "the root helper does not answer, and a managed runner starts no build without the jailer. The build did not start; restore the helper with `outerlayer runner install --service --replace`";
+
+// src/runner/microvm/image-builder.ts
+var ROOT_DISK_ID_PREFIX = "rootdisk:";
+var BUILDER_INIT = "/opt/outerlayer/builder-init";
+var TUNNEL_PORT = RELAY_PORT;
+var ENGINE_PROXY = `http://127.0.0.1:${TUNNEL_PORT}`;
+var BRIDGE_ADDRESS = "172.17.0.1";
+var STEP_PROXY = `http://${BRIDGE_ADDRESS}:${TUNNEL_PORT}`;
+var NO_PROXY = "localhost,127.0.0.1,::1";
+var TUNNEL_SOCKET = "tunnel.sock";
+var RECORD_FILE = "image-builder.json";
+var BOOT_ATTEMPTS = 120;
+var BOOT_POLL_MS = 500;
+var ROOT_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var KEEP_RECORDS = 3;
+var LOG_TAIL_LINES = 30;
+var MAX_PENDING_BYTES = 64 * 1024;
+var MAX_LOG_BYTES = 64 * 1024 * 1024;
+var RESULT_PREFIX = "OL-RESULT ";
+var REFUSALS_NAMED = 5;
+var GUEST_OUTPUT = "/out/rootfs.ext4";
+var DOCKER_WAIT_SECONDS = 90;
+var BUILD_CACHE_KEEP = "2GB";
+function builderMachineConfig(limits2, paths) {
+  return machineConfig(limits2, { ...paths, guestInit: BUILDER_INIT });
+}
+function daemonConfig() {
+  return { "data-root": "/cache/docker", bip: `${BRIDGE_ADDRESS}/16`, proxies: { "http-proxy": ENGINE_PROXY, "https-proxy": ENGINE_PROXY, "no-proxy": NO_PROXY } };
+}
+function clientConfig() {
+  return { proxies: { default: { httpProxy: STEP_PROXY, httpsProxy: STEP_PROXY, noProxy: NO_PROXY } } };
+}
+function plain(name, value, allowed) {
+  if (!allowed.test(value)) throw new Error(`${name} holds a character the builder's script cannot carry safely: ${JSON.stringify(value)}`);
+  return value;
+}
+function builderGuestScript(parts) {
+  const recipeTag = plain("the recipe tag", parts.recipeTag, /^[A-Za-z0-9_.:@/-]+$/);
+  const buildTag = plain("the image tag", parts.buildTag, /^[A-Za-z0-9_.:@/-]+$/);
+  const build = parts.recipe.kind === "default" ? `docker build --progress plain --tag ${recipeTag} --file /work/recipe/Dockerfile /work/recipe` : `devcontainer build --workspace-folder /work/repo --config /work/repo/${plain("the recipe path", parts.recipe.config, /^[A-Za-z0-9_./-]+$/)} --image-name ${recipeTag} --log-format text`;
+  return [
+    "set -eu",
+    `export PATH=${ROOT_PATH}`,
+    // The devcontainer CLI, BuildKit and the engine read the environment; Node's fetch reads it only when asked.
+    `export HTTP_PROXY=${ENGINE_PROXY}`,
+    `export HTTPS_PROXY=${ENGINE_PROXY}`,
+    `export http_proxy=${ENGINE_PROXY}`,
+    `export https_proxy=${ENGINE_PROXY}`,
+    `export NO_PROXY=${NO_PROXY}`,
+    `export no_proxy=${NO_PROXY}`,
+    "export NODE_USE_ENV_PROXY=1",
+    "export DOCKER_CONFIG=/run/builder/docker DOCKER_BUILDKIT=1",
+    "mkdir -p /run/builder/docker /cache/docker",
+    // Whatever way the script ends, the cache keeps the recipe image and a bounded build cache, so a repository's cache disk cannot fill with the images of old recipes.
+    "trim() {",
+    `  docker image ls --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -vxF -e '<none>:<none>' -e ${recipeTag} | xargs -r docker rmi > /dev/null 2>&1 || true`,
+    "  docker image prune --force > /dev/null 2>&1 || true",
+    `  docker builder prune --force --keep-storage ${BUILD_CACHE_KEEP} > /dev/null 2>&1 || true`,
+    "}",
+    "trap trim EXIT",
+    "cat > /run/builder/daemon.json <<'OL_DAEMON_JSON'",
+    JSON.stringify(daemonConfig(), null, 2),
+    "OL_DAEMON_JSON",
+    "cat > /run/builder/docker/config.json <<'OL_CLIENT_JSON'",
+    JSON.stringify(clientConfig(), null, 2),
+    "OL_CLIENT_JSON",
+    "cat > /run/builder/convert.sh <<'OL_CONVERT'",
+    converterScript("/cache/rootfs"),
+    "OL_CONVERT",
+    // The forwarder binds the bridge address before the engine makes the bridge.
+    "echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind",
+    "mount -t cgroup2 cgroup2 /sys/fs/cgroup 2>/dev/null || true",
+    `node /work/tools/dist/index.js vm-forward --listen ${BRIDGE_ADDRESS}:${TUNNEL_PORT} --to 127.0.0.1:${TUNNEL_PORT} > /run/builder/forward.log 2>&1 &`,
+    "dockerd --config-file /run/builder/daemon.json > /run/builder/dockerd.log 2>&1 &",
+    "waited=0",
+    "until docker info > /dev/null 2>&1; do",
+    "  waited=$((waited + 1))",
+    `  if [ "$waited" -gt ${DOCKER_WAIT_SECONDS} ]; then echo "the Docker engine in the builder did not start:"; tail -n 20 /run/builder/dockerd.log; exit 1; fi`,
+    "  sleep 1",
+    "done",
+    build,
+    `docker build --progress plain --tag ${buildTag} --file /work/tools/Dockerfile /work/tools`,
+    `docker image inspect --format '{{json .Config}}' ${buildTag} > /run/builder/config.json`,
+    // The conversion puts the extracted file system and the root disk beside the layers. The inputs and Docker's copies
+    // of the build contexts are not needed for it, and the tool files in them are large, so they go first.
+    "rm -rf /work/repo /work/recipe /work/tools/fetched",
+    "docker builder prune --force --filter type=source.local > /dev/null 2>&1 || true",
+    `container=$(docker create ${buildTag} none)`,
+    'docker export "$container" | OUT_NAME=rootfs.ext4 HOST_UID=0 HOST_GID=0 sh /run/builder/convert.sh',
+    'docker rm --force --volumes "$container" > /dev/null',
+    `printf '${RESULT_PREFIX}{"config":%s,"bytes":%s}\\n' "$(cat /run/builder/config.json)" "$(stat -c %s ${GUEST_OUTPUT})"`,
+    ""
+  ].join("\n");
+}
+function tarArchive(dir, exclude) {
+  const child = spawn("tar", ["-C", dir, ...exclude.map((name) => `--exclude=${name}`), "-cf", "-", "."], { stdio: ["ignore", "pipe", "pipe"] });
+  const errors = [];
+  child.stderr.on("data", (chunk) => errors.push(chunk));
+  const out = new PassThrough();
+  child.stdout.pipe(out, { end: false });
+  child.once("error", (err) => out.destroy(err));
+  out.once("close", () => child.kill());
+  child.once("close", (code) => {
+    if (code === 0) out.end();
+    else out.destroy(new Error(`tar could not pack ${dir}: ${Buffer.concat(errors).toString("utf8").trim().split("\n")[0] ?? `exit ${code}`}`));
+  });
+  return out;
+}
+function builderInput(parts, archive = tarArchive) {
+  return [
+    { target: "/work/repo", stream: archive(parts.checkoutDir, [".git"]) },
+    { target: "/work/tools", stream: archive(parts.toolsDir, []) },
+    ...parts.toolFilesDir === void 0 ? [] : [{ target: `/work/tools/${FETCHED_DIR}`, stream: archive(parts.toolFilesDir, []) }],
+    ...parts.recipeDir === void 0 ? [] : [{ target: "/work/recipe", stream: archive(parts.recipeDir, []) }]
+  ];
+}
+function parseCacheSpace(stdout) {
+  const fields = stdout.trim().split("\n").at(-1)?.trim().split(/\s+/) ?? [];
+  if (fields.length < 6 || fields[5] !== "/cache") return void 0;
+  const total = Number(fields[1]) * 1024;
+  const free = Number(fields[3]) * 1024;
+  return Number.isFinite(total) && Number.isFinite(free) && total > 0 ? { free, total } : void 0;
+}
+var StepFailed = class extends Error {
+};
+function readStored(prepared) {
+  const path = join(prepared.recordDir, "rootfs.ext4");
+  const recordPath = join(prepared.recordDir, "rootdisk.json");
+  if (!existsSync(path) || !existsSync(recordPath)) return void 0;
+  try {
+    const stored = JSON.parse(readFileSync(recordPath, "utf8"));
+    if (typeof stored.user !== "string" || typeof stored.env !== "object" || stored.env === null || typeof stored.report !== "object" || stored.report === null) return void 0;
+    if (statSync(path).size !== stored.bytes) return void 0;
+    return {
+      reused: true,
+      recipeBuilt: false,
+      toolsBuilt: false,
+      checkedCommit: prepared.checkout.commit,
+      recordDir: prepared.recordDir,
+      report: stored.report,
+      removed: [],
+      rootfs: { path, env: stored.env, user: stored.user }
+    };
+  } catch {
+    return void 0;
+  }
+}
+function writeBuilderRecord(dir, record) {
+  writeFileSync(join(dir, RECORD_FILE), `${JSON.stringify(record)}
+`, { mode: 384 });
+}
+function refusalReason(refusals, logPath) {
+  const named = refusals.slice(0, REFUSALS_NAMED).map((r) => r.range === "not-allowed" ? `${r.host} (not in runner.build.allowHosts)` : `${r.host} (${r.range})`);
+  const more = refusals.length > REFUSALS_NAMED ? ` and ${refusals.length - REFUSALS_NAMED} more` : "";
+  return `the image build called ${named.join(", ")}${more}, which the tunnel refuses. An image build reaches only the public hosts in runner.build.allowHosts, and no private address. The build log is at ${logPath}`;
+}
+function pruneRecords(repoRecords, current) {
+  const recordNames = readdirSync(repoRecords).filter((name) => /^[0-9a-f]{12}-[0-9a-f]{12}$/.test(name) && join(repoRecords, name) !== current);
+  const aged = recordNames.map((name) => ({ name, at: statSync(join(repoRecords, name)).mtimeMs })).sort((a, b) => b.at - a.at);
+  for (const { name } of aged.slice(KEEP_RECORDS - 1)) rmSync(join(repoRecords, name), { recursive: true, force: true });
+}
+async function buildRootDiskInMicroVm(opts, deps) {
+  const prepared = await (deps.prepare ?? prepareImageBuild)(opts);
+  try {
+    const stored = readStored(prepared);
+    if (stored !== void 0) return stored;
+    return await buildInBuilder(opts, deps, prepared);
+  } finally {
+    prepared.release();
+  }
+}
+async function buildInBuilder(opts, deps, prepared) {
+  const { ports } = deps;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const archive = deps.archive ?? tarArchive;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const { repository, owner, name, checkout, location, recipe, repoRecords, recordDir, logPath } = prepared;
+  const rKey = prepared.recipeKey.slice(0, KEY_PREFIX);
+  const tKey = prepared.toolsKey.slice(0, KEY_PREFIX);
+  const recipeTag = `${TAG_HOST}/recipe/${repository}:${rKey}`;
+  const buildTag = `${TAG_HOST}/build/${repository}:${rKey}-${tKey}`;
+  const runner = runnerDir(opts.configPath);
+  const builderDisk = await ports.builderDisk(runner);
+  const toolFilesDir = await ports.toolFiles(runner);
+  const probe = await ports.helper.probe();
+  const helper = probe.ok ? probe.client : void 0;
+  if (helper === void 0 && opts.managed === true) throw new RecipeError("image_builder_unavailable", MANAGED_UNJAILED_REASON);
+  const id = randomBytes(6).toString("hex");
+  const dir = buildDir(opts.configPath, id);
+  const state = { buildId: id, buildDir: dir, vsockPath: vsockPath(dir) };
+  const record = { owner, name, id };
+  const cachePath = builderCacheDiskPath(opts.configPath, owner, name);
+  const diskPath = join(dir, "build.ext4");
+  const partial = join(recordDir, "rootfs.ext4.partial");
+  const scratchRoot = opts.tmpDir ?? tmpdir();
+  let scratch;
+  let tunnel;
+  let sanitized;
+  let timedOut = false;
+  const controller = new AbortController();
+  const timer = opts.deadlineMs === void 0 ? void 0 : setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, Math.max(0, opts.deadlineMs - Date.now()));
+  const tail = [];
+  let result;
+  let pending = "";
+  let logged = 0;
+  let hostFailure;
+  const failOnHost = (what, err) => {
+    hostFailure ??= `${what}: ${describeCallFailure(err)}`;
+    controller.abort();
+  };
+  const onOutput = (chunk) => {
+    if (hostFailure !== void 0) return;
+    if (logged < MAX_LOG_BYTES) {
+      const kept = chunk.subarray(0, MAX_LOG_BYTES - logged);
+      try {
+        appendFileSync(logPath, kept);
+        if (logged + kept.length >= MAX_LOG_BYTES) appendFileSync(logPath, "\n[the build log is cut here: it reached its size limit]\n");
+      } catch (err) {
+        failOnHost(`the build log ${logPath} could not be written`, err);
+        return;
+      }
+      logged += kept.length;
+    }
+    pending += chunk.toString("utf8");
+    const lines = pending.split("\n");
+    pending = lines.pop() ?? "";
+    if (pending.length > MAX_PENDING_BYTES) {
+      lines.push(pending);
+      pending = "";
+    }
+    for (const line of lines) {
+      if (line.startsWith(RESULT_PREFIX)) result = line.slice(RESULT_PREFIX.length);
+      else {
+        tail.push(line);
+        if (tail.length > LOG_TAIL_LINES) tail.shift();
+      }
+    }
+  };
+  const exec = (argv) => ({ argv, user: "root", cwd: "/", env: { PATH: ROOT_PATH } });
+  const check = (status, what) => {
+    if (hostFailure !== void 0) throw new StepFailed(`${what} stopped: ${hostFailure}`);
+    if (controller.signal.aborted) throw new StepFailed(`${what} was stopped at the time limit`);
+    if (status !== 0) throw new StepFailed(`${what} failed (exit ${status})`);
+  };
+  const cacheSpace = async () => {
+    try {
+      const df = await ports.exec(state.vsockPath, exec(["df", "-P", "-k", "/cache"]), { signal: controller.signal });
+      return df.status === 0 ? parseCacheSpace(df.stdout) : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+  const spaceNote = async () => {
+    const space = await cacheSpace();
+    return space === void 0 ? "" : `; the builder's cache disk had ${formatBytes(space.free)} of ${formatBytes(space.total)} free (runner.build.disk)`;
+  };
+  let inputs = [];
+  let built;
+  let failure2;
+  try {
+    scratch = mkdtempSync(join(scratchRoot, "ol-builder-"));
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    chmodSync(dir, 448);
+    makeBuildsDirPrivate(dir);
+    writeBuilderRecord(dir, record);
+    mkdirSync(dirname(logPath), { recursive: true, mode: RUNNER_DIR_MODE });
+    opts.log?.(`building the image in a builder microVM at ${opts.memory ?? "the default memory"}`);
+    mkdirSync(dirname(cachePath), { recursive: true, mode: RUNNER_DIR_MODE });
+    if (existsSync(cachePath) && statSync(cachePath).size !== opts.limits.diskBytes) rmSync(cachePath, { force: true });
+    if (existsSync(cachePath)) renameSync(cachePath, diskPath);
+    else await createBuildDisk({ host: ports.rootfs, runnerDir: runner, bytes: opts.limits.diskBytes, dest: diskPath, memoryBytes: opts.limits.memoryBytes });
+    tunnel = await deps.startTunnel(join(dir, TUNNEL_SOCKET), {
+      ...deps.tunnelOptions,
+      ...opts.allowHosts === void 0 ? {} : { allowHosts: opts.allowHosts },
+      recordPath: join(dir, "tunnel.json")
+    });
+    const configPath = join(dir, "vm.json");
+    if (helper === void 0) linkVsockSockets({ buildDir: dir, vsockPath: state.vsockPath, links: [{ port: TUNNEL_PORT, socket: TUNNEL_SOCKET }] });
+    writeFileSync(
+      configPath,
+      JSON.stringify(builderMachineConfig(opts.limits, { kernel: opts.kernel, rootfs: builderDisk, buildDisk: diskPath, vsock: state.vsockPath, relayPorts: [TUNNEL_PORT] }), null, 2),
+      { mode: 384 }
+    );
+    if (helper !== void 0) {
+      record.jailed = true;
+      writeBuilderRecord(dir, record);
+      await startJailedInto(state, { client: helper, kind: "build", kernel: opts.kernel, rootfs: builderDisk, sockets: [TUNNEL_SOCKET], timeLimitMinutes: opts.timeLimitMinutes }, () => void 0);
+    } else {
+      state.cgroup = ports.cgroup.create(id, opts.limits.memoryBytes);
+      if (state.cgroup !== void 0) record.cgroup = state.cgroup;
+      state.firecracker = await ports.firecracker.spawn({ binary: opts.firecracker, configPath, consolePath: join(dir, "console.log"), cgroup: state.cgroup });
+      record.firecracker = state.firecracker;
+      writeBuilderRecord(dir, record);
+    }
+    if (!await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep, onFailure: () => void 0 })) {
+      throw new StepFailed(`the builder microVM did not start: its exec agent did not answer${state.jailed === void 0 ? ` (console in ${join(dir, "console.log")})` : `; its console output is in the journal of the unit ${state.jailed.unit}`}`);
+    }
+    const space = await cacheSpace();
+    check(0, "checking the builder's cache disk");
+    if (space !== void 0 && space.free * 2 < space.total) {
+      check((await ports.exec(state.vsockPath, exec(["rm", "-rf", "/cache/docker"]), { signal: controller.signal })).status, "emptying the builder's layer cache");
+      opts.log?.(`emptied the builder's layer cache: ${formatBytes(space.free)} of ${formatBytes(space.total)} was free`);
+    }
+    let recipeParts = { kind: "default" };
+    const recipeDir = join(scratch, "recipe");
+    mkdirSync(recipeDir);
+    if (location.kind === "default") writeFileSync(join(recipeDir, "Dockerfile"), prepared.defaultText);
+    else {
+      sanitized = writeSanitizedRecipe(checkout.dir, location, recipe);
+      recipeParts = { kind: "file", config: relative(checkout.dir, sanitized) };
+    }
+    const toolsDir = join(scratch, "tools");
+    mkdirSync(toolsDir);
+    cpSync(opts.cli.distDir, join(toolsDir, "dist"), { recursive: true });
+    cpSync(join(opts.cli.distDir, "..", "package.json"), join(toolsDir, "package.json"));
+    cpSync(join(opts.cli.distDir, "..", "skill-pack"), join(toolsDir, "skill-pack"), { recursive: true });
+    mkdirSync(join(toolsDir, "guest"));
+    cpSync(opts.guestHelper.path, join(toolsDir, "guest", "outerlayer-guest"));
+    mkdirSync(join(toolsDir, FETCHED_DIR));
+    writeFileSync(
+      join(toolsDir, "Dockerfile"),
+      toolsDockerfile({ recipeImage: recipeTag, nodeImage: prepared.nodeImage, claudeCodeVersion: prepared.claudeCodeVersion, buildId: opts.cli.buildId, guestHelper: true, fetched: true })
+    );
+    inputs = builderInput({ checkoutDir: checkout.dir, toolsDir, toolFilesDir, recipeDir }, archive);
+    for (const { target, stream } of inputs) {
+      let status;
+      try {
+        status = (await ports.exec(state.vsockPath, exec(["tar", "-x", "--no-same-owner", "-C", target]), { stdin: stream, signal: controller.signal })).status;
+      } catch (err) {
+        if (hostFailure !== void 0 || controller.signal.aborted) throw err;
+        throw new StepFailed(`unpacking ${target} in the builder failed: ${err instanceof Error ? err.message : String(err)}${await spaceNote()}`);
+      }
+      if (status !== 0 && hostFailure === void 0 && !controller.signal.aborted) throw new StepFailed(`unpacking ${target} in the builder failed (exit ${status})${await spaceNote()}`);
+      check(status, `unpacking ${target} in the builder`);
+    }
+    const script = builderGuestScript({ recipe: recipeParts, recipeTag, buildTag });
+    const ran = await ports.execStream(state.vsockPath, exec(["/bin/sh", "-c", script]), { signal: controller.signal, onStdout: onOutput, onStderr: onOutput });
+    check(ran.status, "the image build in the builder microVM");
+    if (result === void 0) throw new StepFailed("the image build in the builder microVM ended without describing the image");
+    const described = JSON.parse(result);
+    const imageConfig = parseImageConfig(JSON.stringify(described.config));
+    const labels = described.config.Labels ?? {};
+    mkdirSync(recordDir, { recursive: true, mode: RUNNER_DIR_MODE });
+    const fd = openSync(partial, "w", 384);
+    let received = 0;
+    try {
+      const copied = await ports.execStream(state.vsockPath, exec(["cat", GUEST_OUTPUT]), {
+        signal: controller.signal,
+        onStdout: (chunk) => {
+          if (hostFailure !== void 0) return;
+          if (received + chunk.length > opts.limits.diskBytes) return failOnHost("the root disk is larger than build.disk", new Error(`more than ${opts.limits.diskBytes} bytes`));
+          try {
+            writeSync(fd, chunk);
+          } catch (err) {
+            return failOnHost(`the root disk ${partial} could not be written`, err);
+          }
+          received += chunk.length;
+        },
+        onStderr: onOutput
+      });
+      check(copied.status, "reading the root disk out of the builder microVM");
+    } finally {
+      closeSync(fd);
+    }
+    if (received !== described.bytes) throw new StepFailed(`the root disk arrived with ${received} bytes, and the builder made ${described.bytes}`);
+    const report = {
+      repository,
+      sourceCommit: checkout.commit,
+      defaultBranch: checkout.defaultBranch,
+      recipe: location.kind === "default" ? "default" : location.path,
+      recipeKey: prepared.recipeKey,
+      toolsKey: prepared.toolsKey,
+      imageId: `${ROOT_DISK_ID_PREFIX}${rKey}-${tKey}`,
+      tag: buildTag,
+      ...classifyProperties(recipe, metadataFromLabels(labels))
+    };
+    const path = join(recordDir, "rootfs.ext4");
+    chmodSync(partial, 292);
+    renameSync(partial, path);
+    const stored = { env: imageConfig.env, user: imageConfig.user, bytes: received, report };
+    writeFileSync(join(recordDir, "rootdisk.json"), `${JSON.stringify(stored, null, 2)}
+`, { mode: 384 });
+    writeRecord(recordDir, report, now().toISOString());
+    pruneRecords(repoRecords, recordDir);
+    opts.log?.("root disk built in a builder microVM");
+    built = { reused: false, recipeBuilt: true, toolsBuilt: true, checkedCommit: checkout.commit, recordDir, report, removed: [], rootfs: { path, env: imageConfig.env, user: imageConfig.user } };
+  } catch (err) {
+    failure2 = await explain(err);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    for (const { stream } of inputs) stream.destroy();
+    const stopped = await stopBuilder();
+    await tunnel?.close().catch(() => void 0);
+    if (sanitized !== void 0) rmSync(sanitized, { force: true });
+    if (scratch !== void 0) rmSync(scratch, { recursive: true, force: true });
+    rmSync(partial, { force: true });
+    if (stopped) {
+      if (existsSync(diskPath)) renameSync(diskPath, cachePath);
+      rmSync(dir, { recursive: true, force: true });
+    } else {
+      opts.log?.(`the builder microVM ${id} was not stopped, so its directory ${dir} stays for the runner's next start to remove`);
+    }
+  }
+  if (failure2 !== void 0) throw failure2;
+  return built;
+  async function explain(err) {
+    if (err instanceof RecipeError) return err;
+    if (hostFailure !== void 0) return new RecipeError("image_builder_failed", `the image build stopped: ${hostFailure}`, logPath);
+    if (timedOut) {
+      const limit = opts.timeLimitMinutes === void 0 ? "runner.timeLimitMinutes" : `runner.timeLimitMinutes (${opts.timeLimitMinutes} minutes)`;
+      return new RecipeError("image_builder_failed", `the image build ran past ${limit} and the builder microVM was stopped. The build log is at ${logPath}`, logPath);
+    }
+    try {
+      if (state.cgroup !== void 0 && ports.cgroup.oomKills(state.cgroup) > 0 || helper !== void 0 && (await helper.state(id)).oomKills > 0) {
+        return new RecipeError("image_build_out_of_memory", outOfMemoryReason(opts.memory), logPath);
+      }
+    } catch {
+    }
+    const refusals = tunnel?.record().refusals ?? [];
+    if (err instanceof StepFailed && refusals.length > 0) return new RecipeError("image_builder_failed", refusalReason(refusals, logPath), logPath);
+    const last = tail.filter((line) => line.trim() !== "").at(-1);
+    const why = err instanceof StepFailed ? err.message : `the builder microVM failed: ${describeCallFailure(err)}`;
+    return new RecipeError("image_builder_failed", `${why}${last === void 0 ? "" : `; the last line was: ${last}`}. The build log is at ${logPath}`, logPath);
+  }
+  async function stopBuilder() {
+    let ok = true;
+    if (state.jailed !== void 0) {
+      try {
+        await stopJailed(ports.helper, state);
+      } catch (err) {
+        ok = false;
+        opts.log?.(describeCallFailure(err));
+      }
+    }
+    if (state.firecracker !== void 0) {
+      try {
+        await ports.firecracker.stop(state.firecracker);
+        if (ports.firecracker.alive(state.firecracker)) ok = false;
+      } catch (err) {
+        ok = false;
+        opts.log?.(`the builder microVM (pid ${state.firecracker.pid}) was not stopped: ${describeCallFailure(err)}`);
+      }
+    }
+    if (ok && state.cgroup !== void 0) {
+      try {
+        ports.cgroup.remove(state.cgroup);
+      } catch (err) {
+        opts.log?.(`the builder's cgroup ${state.cgroup} was not removed: ${describeCallFailure(err)}`);
+      }
+    }
+    return ok;
+  }
+}
+async function sweepImageBuilders(configPath, ports, onError) {
+  const root = buildsDir(configPath);
+  let names;
+  try {
+    names = readdirSync(root);
+  } catch {
+    return [];
+  }
+  const swept = [];
+  for (const id of names) {
+    const dir = buildDir(configPath, id);
+    let record;
+    try {
+      record = JSON.parse(readFileSync(join(dir, RECORD_FILE), "utf8"));
+    } catch {
+      continue;
+    }
+    let stopped = true;
+    if (record.jailed === true) {
+      const probe = await ports.helper.probe();
+      if (!probe.ok) {
+        onError?.(`the builder microVM ${id} could not be stopped, because there is no helper to ask: ${probe.detail}`);
+        continue;
+      }
+      try {
+        if ((await probe.client.list()).includes(id)) await probe.client.stop(id);
+      } catch (err) {
+        onError?.(`the builder microVM ${id} was not stopped: ${describeCallFailure(err)}`);
+        stopped = false;
+      }
+    }
+    if (record.firecracker !== void 0) {
+      try {
+        if (ports.firecracker.alive(record.firecracker)) await ports.firecracker.stop(record.firecracker);
+        if (ports.firecracker.alive(record.firecracker)) stopped = false;
+      } catch (err) {
+        onError?.(`the builder microVM ${id} (pid ${record.firecracker.pid}) was not stopped: ${describeCallFailure(err)}`);
+        stopped = false;
+      }
+    }
+    if (!stopped) continue;
+    if (record.cgroup !== void 0) {
+      try {
+        ports.cgroup.remove(record.cgroup);
+      } catch (err) {
+        onError?.(`the builder's cgroup ${record.cgroup} was not removed: ${describeCallFailure(err)}`);
+      }
+    }
+    rmSync(dir, { recursive: true, force: true });
+    swept.push(id);
+  }
+  return swept;
+}
 var BranchPrepareError = class extends Error {
 };
 var OWN_PREFIX = "outerlayer/";
@@ -270,13 +1243,13 @@ function localGit(cwd, args) {
   }
   return Promise.resolve({ status: result.status, stdout: result.stdout.trim(), stderr: result.stderr.trim() });
 }
-function firstLine(stderr) {
+function firstLine2(stderr) {
   return (stderr.split("\n")[0] ?? "").replace(/\/\/[^/@\s]+@/g, "//");
 }
 async function mustGit(git2, cwd, step, args) {
   const result = await git2(cwd, args);
   if (result.status !== 0) {
-    const detail = firstLine(result.stderr);
+    const detail = firstLine2(result.stderr);
     throw new BranchPrepareError(`${step} failed${detail === "" ? "" : `: ${detail}`}`);
   }
   return result.stdout;
@@ -321,7 +1294,7 @@ async function isMerged(git2, workdir, branch, defaultBranch) {
   const result = await git2(workdir, ["merge-base", "--is-ancestor", `origin/${branch}`, `origin/${defaultBranch}`]);
   if (result.status === 0) return true;
   if (result.status === 1) return false;
-  const detail = firstLine(result.stderr);
+  const detail = firstLine2(result.stderr);
   throw new BranchPrepareError(`comparing ${branch} with ${defaultBranch} failed${detail === "" ? "" : `: ${detail}`}`);
 }
 
@@ -389,592 +1362,286 @@ function usableCpus(deps = {}) {
   }
   return Array.from({ length: Math.max(1, (deps.parallelism ?? availableParallelism)()) }, (_unused, core) => core);
 }
-function createCpuAllocator(cores) {
-  const usable = [...new Set(cores)].sort((a, b) => a - b);
-  const held = /* @__PURE__ */ new Map();
-  const holders = (core) => {
-    let count = 0;
-    for (const set of held.values()) if (set.includes(core)) count++;
-    return count;
-  };
-  return {
-    acquire(buildId, cpus) {
-      const existing = held.get(buildId);
-      if (existing !== void 0) return existing;
-      const wanted = Math.min(Math.ceil(cpus), usable.length);
-      const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
-      const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
-      held.set(buildId, chosen);
-      return chosen;
-    },
-    hold(buildId, set) {
-      held.set(buildId, [...set]);
-    },
-    release(buildId) {
-      held.delete(buildId);
-    }
-  };
-}
-
-// src/runner/container/lease-channel.ts
-var LEASE_SECONDS = 900;
-function leaseExpiresAtMs(job) {
-  const base = Date.parse(job.lastRenewAt ?? job.startedAt);
-  return (Number.isFinite(base) ? base : Date.now()) + LEASE_SECONDS * 1e3;
-}
-function leaseTimeLeftMs(job, nowMs) {
-  return Math.max(0, leaseExpiresAtMs(job) - nowMs);
-}
-function createLeaseChannel(valueMs) {
-  const open = /* @__PURE__ */ new Set();
-  let stopped = false;
-  const write = (stream) => {
-    if (!stopped && !stream.destroyed && stream.writable) stream.write(`${Math.floor(valueMs())}
-`);
-  };
-  return {
-    accept(stream) {
-      stream.on("error", () => void 0);
-      open.add(stream);
-      stream.once("close", () => open.delete(stream));
-      queueMicrotask(() => write(stream));
-    },
-    publish() {
-      for (const stream of open) write(stream);
-    },
-    stop() {
-      stopped = true;
-    },
-    close() {
-      for (const stream of [...open]) stream.destroy();
-      open.clear();
-    }
-  };
-}
-var AssetError = class extends Error {
-  constructor(file, message) {
-    super(message);
-    this.file = file;
-  }
-};
-var FIRECRACKER_RELEASES = "https://github.com/firecracker-microvm/firecracker/releases/download";
-var DOWNLOAD_TIMEOUT_MS = 10 * 6e4;
-function pinnedAssets(arch) {
-  const version = FIRECRACKER_VERSION;
-  return {
-    firecracker: {
-      url: `${FIRECRACKER_RELEASES}/v${version}/firecracker-v${version}-${arch}.tgz`,
-      sha256: FIRECRACKER_SHA256[arch],
-      binarySha256: FIRECRACKER_BINARY_SHA256[arch],
-      jailerSha256: JAILER_BINARY_SHA256[arch]
-    },
-    kernel: { url: `${GUEST_ASSETS_BASE_URL}/vmlinux-${arch}`, sha256: GUEST_KERNEL_SHA256[arch] },
-    helper: { url: `${GUEST_ASSETS_BASE_URL}/outerlayer-guest-${arch}`, sha256: GUEST_HELPER_SHA256[arch] }
-  };
-}
-var sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function pinProblem(file, expected, actual, where) {
-  const release = file.startsWith("vmlinux-") || file.startsWith("outerlayer-guest-") ? ` (guest assets release ${GUEST_ASSETS_VERSION})` : "";
-  return new AssetError(file, `${file} ${where} has sha256 ${actual}, not the ${expected} this release pins${release}, so no microVM build starts`);
-}
-function writeAtomic(path, bytes, mode) {
-  const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync(temp, bytes, { mode });
-  renameSync(temp, path);
-}
-async function download(file, url, fetchImpl) {
-  let response;
-  try {
-    response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
-  } catch (err) {
-    throw new AssetError(file, `${file} could not be downloaded from ${url}: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  if (!response.ok) throw new AssetError(file, `${file} could not be downloaded from ${url}: the server answered ${response.status}`);
-  return Buffer.from(await response.arrayBuffer());
-}
-function keptPath(dir, sha256, name) {
-  mkdirSync(join(dir, sha256), { recursive: true, mode: RUNNER_DIR_MODE });
-  return join(dir, sha256, name);
-}
-async function ensureFile(dir, file, pin, fetchImpl, mode) {
-  const path = keptPath(dir, pin.sha256, file);
-  if (existsSync(path)) {
-    const actual2 = sha256Of(readFileSync(path));
-    if (actual2 !== pin.sha256) throw pinProblem(file, pin.sha256, actual2, `at ${path}`);
-    return path;
-  }
-  const bytes = await download(file, pin.url, fetchImpl);
-  const actual = sha256Of(bytes);
-  if (actual !== pin.sha256) throw pinProblem(file, pin.sha256, actual, `downloaded from ${pin.url}`);
-  writeAtomic(path, bytes, mode);
-  return path;
-}
-function extractWithTar(arch, program = "firecracker") {
-  const name = `${program}-v${FIRECRACKER_VERSION}-${arch}`;
-  return async (tarball, destDir) => {
-    const result = spawnSync("tar", ["-xzf", tarball, "-C", destDir, "--strip-components=1", `release-v${FIRECRACKER_VERSION}-${arch}/${name}`], { encoding: "utf8" });
-    if (result.status !== 0) throw new Error(`tar could not unpack ${tarball}: ${result.stderr.trim()}`);
-    return join(destDir, name);
-  };
-}
-async function ensureFirecracker(input) {
-  const { dir, arch, pins, fetchImpl } = input;
-  const firecracker = keptPath(dir, pins.firecracker.binarySha256, "firecracker");
-  if (existsSync(firecracker)) {
-    const actual = sha256Of(readFileSync(firecracker));
-    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `at ${firecracker}`);
-    return firecracker;
-  }
-  const tarballName = `firecracker-${arch}.tgz`;
-  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
-  const scratch = mkdtempSync(join(dir, ".extract-"));
-  try {
-    const extracted = await (input.extract ?? extractWithTar(arch))(tarball, scratch);
-    const bytes = readFileSync(extracted);
-    const actual = sha256Of(bytes);
-    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `unpacked from ${tarballName}`);
-    writeAtomic(firecracker, bytes, 493);
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
-  }
-  return firecracker;
-}
-async function ensureFirecrackerAndJailer(options) {
-  const arch = options.arch ?? firecrackerArch(process.arch);
-  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
-  const pins = options.pins ?? pinnedAssets(arch);
-  const dir = vmAssetsDir(options.runnerDir);
-  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl: options.fetchImpl ?? fetch, extract: options.extractFirecracker });
-  return { firecracker, jailer: await ensureJailer(options) };
-}
-async function ensureAssets(options) {
-  const arch = options.arch ?? firecrackerArch(process.arch);
-  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker or guest assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
-  const pins = options.pins ?? pinnedAssets(arch);
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const dir = vmAssetsDir(options.runnerDir);
-  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl, extract: options.extractFirecracker });
-  const kernel = await ensureFile(dir, `vmlinux-${arch}`, pins.kernel, fetchImpl, RUNNER_FILE_MODE);
-  const helper = await ensureFile(dir, `outerlayer-guest-${arch}`, pins.helper, fetchImpl, 493);
-  return { firecracker, kernel, helper, helperSha256: pins.helper.sha256 };
-}
-async function ensureJailer(options) {
-  const arch = options.arch ?? firecrackerArch(process.arch);
-  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("jailer", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
-  const pins = options.pins ?? pinnedAssets(arch);
-  const expected = pins.firecracker.jailerSha256;
-  if (expected === void 0) throw new AssetError("jailer", "this release pins no hash for the jailer, so it cannot be had");
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const dir = vmAssetsDir(options.runnerDir);
-  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const jailer = keptPath(dir, expected, "jailer");
-  if (existsSync(jailer)) {
-    const actual = sha256Of(readFileSync(jailer));
-    if (actual !== expected) throw pinProblem("jailer", expected, actual, `at ${jailer}`);
-    return jailer;
-  }
-  const tarballName = `firecracker-${arch}.tgz`;
-  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
-  const scratch = mkdtempSync(join(dir, ".extract-"));
-  try {
-    const extracted = await (options.extractJailer ?? extractWithTar(arch, "jailer"))(tarball, scratch);
-    const bytes = readFileSync(extracted);
-    const actual = sha256Of(bytes);
-    if (actual !== expected) throw pinProblem("jailer", expected, actual, `unpacked from ${tarballName}`);
-    writeAtomic(jailer, bytes, 493);
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
-  }
-  return jailer;
-}
-var STOP_GRACE_SECONDS = 15;
-function parseImageConfig(json) {
-  const config = JSON.parse(json);
-  const env = {};
-  for (const entry of config.Env ?? []) {
-    const eq = entry.indexOf("=");
-    if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
-  }
-  return { user: config.User ?? "", env };
-}
-function createContainerHost(deps = {}) {
-  const run = deps.run ?? spawnRun;
+function createCpuAllocator(cores) {
+  const usable = [...new Set(cores)].sort((a, b) => a - b);
+  const held = /* @__PURE__ */ new Map();
+  const holders = (core) => {
+    let count = 0;
+    for (const set of held.values()) if (set.includes(core)) count++;
+    return count;
+  };
   return {
-    async version() {
-      const result = await run("docker", ["version", "--format", "{{.Server.Version}}"]);
-      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
-    },
-    async operatingSystem() {
-      const result = await run("docker", ["info", "--format", "{{.OperatingSystem}}"]);
-      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
-    },
-    async imageConfig(imageId) {
-      const result = await run("docker", ["image", "inspect", "--format", "{{json .Config}}", imageId]);
-      return result.status === 0 ? parseImageConfig(result.stdout) : { user: "", env: {} };
-    },
-    createVolume(name, labels) {
-      const flags = Object.entries(labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
-      return run("docker", ["volume", "create", ...flags, name]);
-    },
-    removeVolume(name) {
-      return run("docker", ["volume", "rm", "--force", name]);
-    },
-    run(args, opts) {
-      return run("docker", ["run", ...args], opts);
-    },
-    exec(input, opts) {
-      const env = {};
-      for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
-      return run("docker", ["exec", ...containerExecArgs(input)], { ...opts, env, ...input.stdin === void 0 ? {} : { input: input.stdin } });
-    },
-    execDetached(input) {
-      const env = {};
-      for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
-      return run("docker", ["exec", ...containerExecArgs({ ...input, detached: true })], { env });
-    },
-    async state(container) {
-      const result = await run("docker", ["inspect", "--format", "{{.State.Running}}", container]);
-      if (result.status !== 0) return /no such (object|container)/i.test(result.stderr) ? "missing" : "unknown";
-      return result.stdout.trim() === "true" ? "running" : "stopped";
-    },
-    execStream(input) {
-      const child = (deps.spawn ?? spawn)("docker", ["exec", ...containerExecArgs({ ...input, interactive: true })], {
-        env: childEnvironment(process.env),
-        stdio: ["pipe", "pipe", "pipe"]
-      });
-      let stderr = "";
-      child.stderr?.on("data", (chunk) => {
-        stderr = (stderr + chunk.toString()).slice(-400);
-      });
-      child.stderr?.on("error", () => void 0);
-      const exited = new Promise((resolve2) => {
-        child.once("error", () => resolve2(-1));
-        child.once("close", (code) => resolve2(code ?? -1));
-      });
-      child.stdin.on("error", () => void 0);
-      return { stdin: child.stdin, stdout: child.stdout, exited, kill: () => void child.kill("SIGKILL"), stderrTail: () => stderr };
-    },
-    stop(container) {
-      return run("docker", ["stop", "--time", String(STOP_GRACE_SECONDS), container]);
+    acquire(buildId, cpus) {
+      const existing = held.get(buildId);
+      if (existing !== void 0) return existing;
+      const wanted = Math.min(Math.ceil(cpus), usable.length);
+      const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
+      const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
+      held.set(buildId, chosen);
+      return chosen;
     },
-    start(container) {
-      return run("docker", ["start", container]);
+    hold(buildId, set) {
+      held.set(buildId, [...set]);
     },
-    remove(container) {
-      return run("docker", ["rm", "--force", "--volumes", container]);
+    release(buildId) {
+      held.delete(buildId);
     }
   };
 }
 
-// src/runner/microvm/disks.ts
-function converterScript() {
-  return [
-    "set -eu",
-    "rootfs=/tmp/rootfs",
-    'mkdir -p "$rootfs"',
-    'tar -xf - -C "$rootfs"',
-    'used_kb=$(du -sk "$rootfs" | cut -f1)',
-    'files=$(find "$rootfs" | wc -l)',
-    // Room for the file system's own metadata, and for an inode per file with some to spare.
-    "total_kb=$(( used_kb + used_kb / 4 + 65536 ))",
-    'truncate -s "${total_kb}K" "/out/$OUT_NAME"',
-    'mke2fs -q -F -t ext4 -m 0 -N $(( files + files / 4 + 4096 )) -d "$rootfs" "/out/$OUT_NAME"',
-    'chown "$HOST_UID:$HOST_GID" "/out/$OUT_NAME"'
-  ].join("\n");
-}
-function templateScript() {
-  return [
-    "set -eu",
-    'truncate -s "$BYTES" "/out/$OUT_NAME"',
-    'mke2fs -q -F -t ext4 -m 0 -E lazy_itable_init=1,lazy_journal_init=1,nodiscard "/out/$OUT_NAME"',
-    'chown "$HOST_UID:$HOST_GID" "/out/$OUT_NAME"'
-  ].join("\n");
-}
-var ids = () => ({ uid: String(process.getuid?.() ?? 0), gid: String(process.getgid?.() ?? 0) });
-function converterArgs(dest, memoryBytes, extra, script) {
-  const { uid, gid } = ids();
-  return [
-    "run",
-    "--rm",
-    "-i",
-    "--network",
-    "none",
-    "--memory",
-    String(memoryBytes),
-    "--memory-swap",
-    String(memoryBytes),
-    "--mount",
-    `type=bind,src=${dirname(dest)},dst=/out`,
-    "-e",
-    `OUT_NAME=${basename(dest)}`,
-    "-e",
-    `HOST_UID=${uid}`,
-    "-e",
-    `HOST_GID=${gid}`,
-    ...extra,
-    // The image that runs `mke2fs` as root is the default base image: Ubuntu holds e2fsprogs.
-    DEFAULT_BASE_IMAGE,
-    "sh",
-    "-c",
-    script
-  ];
+// src/runner/container/lease-channel.ts
+var LEASE_SECONDS = 900;
+function leaseExpiresAtMs(job) {
+  const base = Date.parse(job.lastRenewAt ?? job.startedAt);
+  return (Number.isFinite(base) ? base : Date.now()) + LEASE_SECONDS * 1e3;
 }
-var firstLine2 = (text) => text.trim().split("\n")[0] ?? "";
-function exportInto(container, converter) {
-  return new Promise((resolve2, reject) => {
-    const exporter = spawn("docker", ["export", container], { stdio: ["ignore", "pipe", "pipe"], env: childEnvironment(process.env) });
-    const writer = spawn("docker", converter, { stdio: ["pipe", "ignore", "pipe"], env: childEnvironment(process.env) });
-    const errors = [];
-    exporter.stderr.on("data", (chunk) => errors.push(`docker export: ${chunk.toString("utf8")}`));
-    writer.stderr.on("data", (chunk) => errors.push(`converter: ${chunk.toString("utf8")}`));
-    writer.stdin.on("error", () => void 0);
-    exporter.stdout.on("error", () => void 0);
-    exporter.stdout.pipe(writer.stdin);
-    exporter.once("error", reject);
-    writer.once("error", reject);
-    let exits = 0;
-    let failure2;
-    const done = (name, code) => {
-      if (code !== 0 && failure2 === void 0) failure2 = `${name} exited ${code}`;
-      exits += 1;
-      if (exits < 2) return;
-      if (failure2 === void 0) resolve2();
-      else reject(new Error(`${failure2}: ${firstLine2(errors.join("\n"))}`));
-    };
-    exporter.once("exit", (code) => done("docker export", code));
-    writer.once("exit", (code) => done("the converter", code));
-  });
+function leaseTimeLeftMs(job, nowMs) {
+  return Math.max(0, leaseExpiresAtMs(job) - nowMs);
 }
-function createRootfsHost() {
-  const env = () => childEnvironment(process.env);
+function createLeaseChannel(valueMs) {
+  const open = /* @__PURE__ */ new Set();
+  let stopped = false;
+  const write = (stream) => {
+    if (!stopped && !stream.destroyed && stream.writable) stream.write(`${Math.floor(valueMs())}
+`);
+  };
   return {
-    async convert({ imageId, dest, memoryBytes }) {
-      const created = await spawnRun("docker", ["create", imageId, "none"], { env: env() });
-      if (created.status !== 0) throw new Error(`docker create ${imageId} failed: ${firstLine2(created.stderr)}`);
-      const container = created.stdout.trim();
-      try {
-        await exportInto(container, converterArgs(dest, memoryBytes, [], converterScript()));
-      } finally {
-        await spawnRun("docker", ["rm", "--force", "--volumes", container], { env: env() });
-      }
+    accept(stream) {
+      stream.on("error", () => void 0);
+      open.add(stream);
+      stream.once("close", () => open.delete(stream));
+      queueMicrotask(() => write(stream));
     },
-    async makeTemplate({ bytes, dest, memoryBytes }) {
-      const made = await spawnRun("docker", converterArgs(dest, memoryBytes, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
-      if (made.status !== 0) throw new Error(`making the empty build disk failed: ${firstLine2(made.stderr)}`);
+    publish() {
+      for (const stream of open) write(stream);
     },
-    async imageConfig(imageId) {
-      const inspected = await spawnRun("docker", ["image", "inspect", "--format", "{{json .Config}}", imageId], { env: env() });
-      if (inspected.status !== 0) throw new Error(`docker image inspect ${imageId} failed: ${firstLine2(inspected.stderr)}`);
-      return parseImageConfig(inspected.stdout);
+    stop() {
+      stopped = true;
+    },
+    close() {
+      for (const stream of [...open]) stream.destroy();
+      open.clear();
     }
   };
 }
-function sweepStalePartials(dir) {
-  let names;
+var AssetError = class extends Error {
+  constructor(file, message) {
+    super(message);
+    this.file = file;
+  }
+};
+var FIRECRACKER_RELEASES = "https://github.com/firecracker-microvm/firecracker/releases/download";
+var DOWNLOAD_TIMEOUT_MS = 10 * 6e4;
+function pinnedAssets(arch) {
+  const version = FIRECRACKER_VERSION;
+  return {
+    firecracker: {
+      url: `${FIRECRACKER_RELEASES}/v${version}/firecracker-v${version}-${arch}.tgz`,
+      sha256: FIRECRACKER_SHA256[arch],
+      binarySha256: FIRECRACKER_BINARY_SHA256[arch],
+      jailerSha256: JAILER_BINARY_SHA256[arch]
+    },
+    kernel: { url: `${GUEST_ASSETS_BASE_URL}/vmlinux-${arch}`, sha256: GUEST_KERNEL_SHA256[arch] },
+    helper: { url: `${GUEST_ASSETS_BASE_URL}/outerlayer-guest-${arch}`, sha256: GUEST_HELPER_SHA256[arch] }
+  };
+}
+function builderDiskPin(arch) {
+  return { url: `${BUILDER_DISK_BASE_URL}/builder-rootfs-${arch}.ext4`, sha256: BUILDER_DISK_SHA256[arch] };
+}
+var sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function pinProblem(file, expected, actual, where) {
+  const release = file.startsWith("vmlinux-") || file.startsWith("outerlayer-guest-") ? ` (guest assets release ${GUEST_ASSETS_VERSION})` : file.startsWith("builder-rootfs-") ? ` (builder root disk release ${BUILDER_DISK_VERSION})` : "";
+  return new AssetError(file, `${file} ${where} has sha256 ${actual}, not the ${expected} this release pins${release}, so no microVM build starts`);
+}
+function writeAtomic(path, bytes, mode) {
+  const temp = `${path}.${process.pid}.tmp`;
+  writeFileSync(temp, bytes, { mode });
+  renameSync(temp, path);
+}
+async function download(file, url, fetchImpl) {
+  let response;
   try {
-    names = readdirSync(dir);
-  } catch {
-    return;
+    response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+  } catch (err) {
+    throw new AssetError(file, `${file} could not be downloaded from ${url}: ${err instanceof Error ? err.message : String(err)}`);
   }
-  for (const name of names) {
-    const pid = /\.partial-(\d+)-[0-9a-f]+$/.exec(name)?.[1];
-    if (pid === void 0 || Number(pid) === process.pid) continue;
-    try {
-      process.kill(Number(pid), 0);
-    } catch (err) {
-      if (err.code === "ESRCH") rmSync(join(dir, name), { force: true });
-    }
+  if (!response.ok) throw new AssetError(file, `${file} could not be downloaded from ${url}: the server answered ${response.status}`);
+  return Buffer.from(await response.arrayBuffer());
+}
+function keptPath(dir, sha256, name) {
+  mkdirSync(join(dir, sha256), { recursive: true, mode: RUNNER_DIR_MODE });
+  return join(dir, sha256, name);
+}
+async function ensureFile(dir, file, pin, fetchImpl, mode) {
+  const path = keptPath(dir, pin.sha256, file);
+  if (existsSync(path)) {
+    const actual2 = sha256Of(readFileSync(path));
+    if (actual2 !== pin.sha256) throw pinProblem(file, pin.sha256, actual2, `at ${path}`);
+    return path;
   }
+  const bytes = await download(file, pin.url, fetchImpl);
+  const actual = sha256Of(bytes);
+  if (actual !== pin.sha256) throw pinProblem(file, pin.sha256, actual, `downloaded from ${pin.url}`);
+  writeAtomic(path, bytes, mode);
+  return path;
 }
-async function madeAtomically(path, make) {
-  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
-  const temp = `${path}.partial-${process.pid}-${randomBytes(3).toString("hex")}`;
-  sweepStalePartials(dirname(path));
+function extractWithTar(arch, program = "firecracker") {
+  const name = `${program}-v${FIRECRACKER_VERSION}-${arch}`;
+  return async (tarball, destDir) => {
+    const result = spawnSync("tar", ["-xzf", tarball, "-C", destDir, "--strip-components=1", `release-v${FIRECRACKER_VERSION}-${arch}/${name}`], { encoding: "utf8" });
+    if (result.status !== 0) throw new Error(`tar could not unpack ${tarball}: ${result.stderr.trim()}`);
+    return join(destDir, name);
+  };
+}
+async function ensureFirecracker(input) {
+  const { dir, arch, pins, fetchImpl } = input;
+  const firecracker = keptPath(dir, pins.firecracker.binarySha256, "firecracker");
+  if (existsSync(firecracker)) {
+    const actual = sha256Of(readFileSync(firecracker));
+    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `at ${firecracker}`);
+    return firecracker;
+  }
+  const tarballName = `firecracker-${arch}.tgz`;
+  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
+  const scratch = mkdtempSync(join(dir, ".extract-"));
   try {
-    await make(temp);
-    renameSync(temp, path);
-  } catch (err) {
-    rmSync(temp, { force: true });
-    throw err;
+    const extracted = await (input.extract ?? extractWithTar(arch))(tarball, scratch);
+    const bytes = readFileSync(extracted);
+    const actual = sha256Of(bytes);
+    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `unpacked from ${tarballName}`);
+    writeAtomic(firecracker, bytes, 493);
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
   }
+  return firecracker;
 }
-async function ensureRootfs(input) {
-  const path = rootfsPathFor(input.runnerDir, input.imageId);
-  if (existsSync(path)) return path;
-  const { uid, gid } = ids();
-  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
-  return path;
+async function ensureFirecrackerAndJailer(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl: options.fetchImpl ?? fetch, extract: options.extractFirecracker });
+  return { firecracker, jailer: await ensureJailer(options) };
 }
-async function createBuildDisk(input) {
-  const template = join(diskTemplatesDir(input.runnerDir), `${input.bytes}.ext4`);
-  if (!existsSync(template)) {
-    const { uid, gid } = ids();
-    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
+async function ensureAssets(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker or guest assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl, extract: options.extractFirecracker });
+  const kernel = await ensureFile(dir, `vmlinux-${arch}`, pins.kernel, fetchImpl, RUNNER_FILE_MODE);
+  const helper = await ensureFile(dir, `outerlayer-guest-${arch}`, pins.helper, fetchImpl, 493);
+  return { firecracker, kernel, helper, helperSha256: pins.helper.sha256 };
+}
+async function ensureJailer(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("jailer", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const expected = pins.firecracker.jailerSha256;
+  if (expected === void 0) throw new AssetError("jailer", "this release pins no hash for the jailer, so it cannot be had");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const jailer = keptPath(dir, expected, "jailer");
+  if (existsSync(jailer)) {
+    const actual = sha256Of(readFileSync(jailer));
+    if (actual !== expected) throw pinProblem("jailer", expected, actual, `at ${jailer}`);
+    return jailer;
   }
-  mkdirSync(dirname(input.dest), { recursive: true });
-  if (input.host.copyTemplate) input.host.copyTemplate(template, input.dest);
-  else {
-    const copied = spawnSync("cp", ["--sparse=always", template, input.dest], { encoding: "utf8" });
-    if (copied.status !== 0) throw new Error(`copying the empty build disk failed: ${firstLine2(copied.stderr)}`);
+  const tarballName = `firecracker-${arch}.tgz`;
+  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
+  const scratch = mkdtempSync(join(dir, ".extract-"));
+  try {
+    const extracted = await (options.extractJailer ?? extractWithTar(arch, "jailer"))(tarball, scratch);
+    const bytes = readFileSync(extracted);
+    const actual = sha256Of(bytes);
+    if (actual !== expected) throw pinProblem("jailer", expected, actual, `unpacked from ${tarballName}`);
+    writeAtomic(jailer, bytes, 493);
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
   }
-  chmodSync(input.dest, RUNNER_FILE_MODE);
-  truncateSync(input.dest, input.bytes);
-}
-function deleteBuildDisk(path) {
-  rmSync(path, { force: true });
+  return jailer;
 }
-var CONSOLE_CUT_NOTE = "[outerlayer runner: cut the console at 8 MiB; the microVM keeps running]\n";
-function pumpConsole(fd, streams) {
-  const cap = 8 * 1024 ** 2;
-  let written = 0;
-  let lastByte = 10;
-  let cut = false;
-  const append = (data) => {
-    try {
-      writeSync(fd, data);
-    } catch {
-    }
-  };
-  const onData = (chunk) => {
-    if (cut) return;
-    const room = cap - written;
-    if (chunk.length <= room) {
-      append(chunk);
-      written += chunk.length;
-      lastByte = chunk[chunk.length - 1] ?? lastByte;
-      return;
-    }
-    const head = chunk.subarray(0, room);
-    append(head);
-    if (head.length > 0) lastByte = head[head.length - 1];
-    append(Buffer.from(`${lastByte === 10 ? "" : "\n"}${CONSOLE_CUT_NOTE}`));
-    written = cap;
-    cut = true;
-  };
-  let open = streams.length;
-  for (const stream of streams) {
-    stream.on("data", onData);
-    stream.on("error", () => void 0);
-    stream.once("close", () => {
-      open -= 1;
-      if (open === 0) closeSync(fd);
-    });
+async function ensureBuilderDisk(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("builder-rootfs", `no builder root disk is pinned for ${arch}, so microVM image builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const file = `builder-rootfs-${arch}.ext4`;
+  const pin = options.pin ?? builderDiskPin(arch);
+  if (options.pin === void 0 && !builderDiskPinned(arch)) {
+    throw new AssetError(file, `${file} is not published for this release of the CLI, so the image cannot be built in a builder microVM. Update the CLI, or set runner.build.imageBuild to host`);
   }
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  return ensureFile(dir, file, pin, options.fetchImpl ?? fetch, RUNNER_FILE_MODE);
 }
-
-// src/runner/microvm/firecracker.ts
-var clearBit = (bit) => `0b${"x".repeat(31 - bit)}0${"x".repeat(bit)}`;
-var CPU_TEMPLATE = {
-  cpuid_modifiers: [
-    { leaf: "0x1", subleaf: "0x0", flags: 0, modifiers: [{ register: "ecx", bitmap: clearBit(5) }] },
-    { leaf: "0x80000001", subleaf: "0x0", flags: 0, modifiers: [{ register: "ecx", bitmap: clearBit(2) }] }
-  ]
-};
-var MIB = 1024 ** 2;
-var INIT = "/opt/outerlayer/bin/outerlayer-guest";
-function machineConfig(limits2, paths) {
-  const bootArgs = [
-    "console=ttyS0",
-    "reboot=k",
-    "panic=1",
-    "pci=off",
-    "i8042.noaux",
-    "i8042.nomux",
-    "i8042.nopnp",
-    "i8042.dumbkbd",
-    // The pinned guest kernel builds pressure stall information default-disabled; the guest usage record reads it.
-    "psi=1",
-    "ro",
-    "root=/dev/vda",
-    "rootfstype=ext4",
-    `init=${INIT}`,
-    ...paths.relayPorts.length === 0 ? [] : [`outerlayer.relay=${paths.relayPorts.join(",")}`],
-    ...paths.leasePort === void 0 ? [] : [`outerlayer.lease=${paths.leasePort}`],
-    ...paths.docker === true ? ["outerlayer.docker=1"] : []
-  ];
-  return {
-    "boot-source": { kernel_image_path: paths.kernel, boot_args: bootArgs.join(" ") },
-    drives: [
-      { drive_id: "rootfs", path_on_host: paths.rootfs, is_root_device: true, is_read_only: true },
-      { drive_id: "build", path_on_host: paths.buildDisk, is_root_device: false, is_read_only: false }
-    ],
-    "machine-config": { vcpu_count: limits2.cpus, mem_size_mib: Math.max(1, Math.floor(limits2.memoryBytes / MIB)), smt: false },
-    vsock: { guest_cid: GUEST_CID, uds_path: paths.vsock },
-    "cpu-config": CPU_TEMPLATE
-  };
-}
-function firecrackerCommand(input) {
-  const args = ["--no-api", "--config-file", input.configPath];
-  const binary = resolve(input.binary);
-  if (input.cgroup === void 0) return { command: binary, args };
-  return { command: "/bin/sh", args: ["-c", 'echo $$ > "$1/cgroup.procs" && shift && exec "$@"', "sh", input.cgroup, binary, ...args] };
+function dockerArch(nodeArch) {
+  if (nodeArch === "x64") return "amd64";
+  if (nodeArch === "arm64") return "arm64";
+  throw new AssetError("tool files", `no tool files are pinned for ${nodeArch}`);
 }
-var STOP_WAIT_MS = 1e4;
-var POLL_MS = 20;
-function isZombie(pid) {
-  try {
-    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
-    return stat.slice(stat.lastIndexOf(")") + 2, stat.lastIndexOf(")") + 3) === "Z";
-  } catch {
-    return false;
-  }
+function toolFilePins(arch) {
+  return [
+    ...VOICE_PACK_FILES.map((file) => ({ path: `${FETCHED_VOICE_DIR}/${file.name}`, url: file.url, sha256: file.sha256 })),
+    { path: FETCHED_FFMPEG, url: `https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/${FFMPEG_STATIC[arch].file}`, sha256: FFMPEG_STATIC[arch].sha256 },
+    { path: FETCHED_GH, url: `https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${arch}.tar.gz`, sha256: GH_SHA256[arch] },
+    { path: FETCHED_TINI, url: `https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-${arch}`, sha256: TINI_SHA256[arch] }
+  ];
 }
-function createFirecrackerHost(options = {}) {
-  const launch = options.launch ?? firecrackerCommand;
-  const spawnChild = options.spawnChild ?? spawn;
-  const exits = /* @__PURE__ */ new Map();
-  const alive = (vm) => isSameProcess(vm.pid, vm.start) && !isZombie(vm.pid);
-  return {
-    async spawn(input) {
-      const { command, args } = launch(input);
-      mkdirSync(dirname(input.consolePath), { recursive: true });
-      const consoleFd = openSync(input.consolePath, "a", 384);
-      let pumping = false;
-      try {
-        const child = spawnChild(command, args, { detached: true, stdio: ["ignore", "pipe", "pipe"], env: {} });
-        pumpConsole(consoleFd, [child.stdout, child.stderr]);
-        pumping = true;
-        for (const stream of [child.stdout, child.stderr]) stream.unref?.();
-        const failed = new Promise((_resolve, reject) => child.once("error", reject));
-        const pid = child.pid;
-        if (pid === void 0) return await failed;
-        exits.set(pid, new Promise((resolve2) => child.once("exit", () => resolve2())));
-        child.unref();
-        const start = startTimeOf(pid);
-        if (start === null) throw new Error(`${command} exited as soon as it started; its console is at ${input.consolePath}`);
-        return { pid, start };
-      } finally {
-        if (!pumping) closeSync(consoleFd);
-      }
-    },
-    async stop(vm) {
-      if (!alive(vm)) return;
-      try {
-        process.kill(vm.pid, "SIGKILL");
-      } catch {
+function pinsDir(runnerDir2, pins) {
+  const key = createHash("sha256").update(pins.map((pin) => `${pin.path} ${pin.sha256}`).join("\n")).digest("hex").slice(0, 16);
+  const root = join(vmAssetsDir(runnerDir2), "tool-files");
+  return { root, dir: join(root, key) };
+}
+var inFlight = /* @__PURE__ */ new Map();
+async function ensureToolFiles(options) {
+  const pins = options.pins ?? toolFilePins(options.arch ?? dockerArch(process.arch));
+  const { root, dir } = pinsDir(options.runnerDir, pins);
+  const running = inFlight.get(dir);
+  if (running !== void 0) return running;
+  const fetching = fetchAll(root, dir, pins, options.fetchImpl ?? fetch).finally(() => inFlight.delete(dir));
+  inFlight.set(dir, fetching);
+  return fetching;
+}
+async function fetchAll(root, dir, pins, fetchImpl) {
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  for (const pin of pins) {
+    const path = join(dir, pin.path);
+    if (existsSync(path)) {
+      const actual = await sha256OfFile(path);
+      if (actual !== pin.sha256) {
+        throw new AssetError(pin.path, `the tool file ${path} has sha256 ${actual}, not the ${pin.sha256} this release pins, so no image build starts. Delete it to download it again`);
       }
-      const exited = exits.get(vm.pid);
-      const deadline = Date.now() + STOP_WAIT_MS;
-      if (exited !== void 0) await Promise.race([exited, new Promise((resolve2) => setTimeout(resolve2, STOP_WAIT_MS))]);
-      while (alive(vm) && Date.now() < deadline) await new Promise((resolve2) => setTimeout(resolve2, POLL_MS));
-      exits.delete(vm.pid);
-    },
-    alive
-  };
+      continue;
+    }
+    try {
+      await downloadPinned({ url: pin.url, dest: path, sha256: pin.sha256, name: pin.path, fetchImpl, stopped: "no image build started" });
+    } catch (err) {
+      throw new AssetError(pin.path, `the tool file ${pin.path} could not be had: ${err instanceof VoiceDownloadError ? err.message : String(err)}`);
+    }
+  }
+  for (const name of readdirSync(root)) {
+    if (join(root, name) !== dir) rmSync(join(root, name), { recursive: true, force: true });
+  }
+  return dir;
 }
 
 // src/runner/microvm/host.ts
 function createMicroVmPorts(over = {}) {
   return {
-    assets: over.assets ?? ((runnerDir) => ensureAssets({ runnerDir })),
+    assets: over.assets ?? ((runnerDir2) => ensureAssets({ runnerDir: runnerDir2 })),
     rootfs: over.rootfs ?? createRootfsHost(),
     firecracker: over.firecracker ?? createFirecrackerHost(),
     cgroup: over.cgroup ?? realCgroupPort(),
     helper: over.helper ?? realHelperPort(),
     fdStore: over.fdStore ?? realFdStorePort(),
-    exec: over.exec ?? execCapture
+    exec: over.exec ?? execCapture,
+    execStream: over.execStream ?? runExec,
+    builderDisk: over.builderDisk ?? ((runnerDir2) => ensureBuilderDisk({ runnerDir: runnerDir2 })),
+    builderDiskPinned: over.builderDiskPinned ?? (() => builderDiskPinned()),
+    toolFiles: over.toolFiles ?? ((runnerDir2) => ensureToolFiles({ runnerDir: runnerDir2 }))
   };
 }
 var aborted = () => ({ ok: false, reason: "", aborted: true });
@@ -1947,7 +2614,7 @@ function upstreamHeaders(incoming, authorization) {
 function isWorkflowRefusal(text) {
   return WORKFLOW_REFUSAL.test(text);
 }
-function plain(res, status, text) {
+function plain2(res, status, text) {
   res.writeHead(status, { "content-type": "text/plain", "content-length": Buffer.byteLength(text), connection: "close" });
   res.end(text);
 }
@@ -2038,7 +2705,7 @@ function createGitRemote(options) {
       upstream.on("error", (err) => {
         log(`could not reach GitHub for ${route.kind}: ${err.message}`);
         if (res.headersSent) res.destroy();
-        else plain(res, 502, "the runner could not reach GitHub\n");
+        else plain2(res, 502, "the runner could not reach GitHub\n");
         resolve2();
       });
       res.once("close", () => upstream.destroy());
@@ -2050,7 +2717,7 @@ function createGitRemote(options) {
       return await options.tokens.token(kind, repository);
     } catch (err) {
       log(`could not get a ${kind} token: ${refusalCode(err)}`);
-      plain(res, 502, `the runner could not get a ${kind} token: ${refusalCode(err)}
+      plain2(res, 502, `the runner could not get a ${kind} token: ${refusalCode(err)}
 `);
       return void 0;
     }
@@ -2062,7 +2729,7 @@ function createGitRemote(options) {
     const refuse = async (reason) => {
       log(`push refused: ${reason}`);
       await drain(req);
-      plain(res, 400, `the runner refused this push: ${reason}
+      plain2(res, 400, `the runner refused this push: ${reason}
 `);
     };
     if (encoding !== void 0 && encoding !== "gzip" && encoding !== "identity") {
@@ -2146,19 +2813,19 @@ function createGitRemote(options) {
     const route = classifyRequest(req.method ?? "", req.url ?? "");
     if (route === void 0) {
       req.resume();
-      return plain(res, 404, "not found\n");
+      return plain2(res, 404, "not found\n");
     }
     if (options.readOnly === true && (route.kind === "receive-pack" || route.kind === "info-refs" && route.service === "git-receive-pack")) {
       log(`push refused: this remote is read-only`);
       req.resume();
-      return plain(res, 403, "this remote is read-only: a check cannot push\n");
+      return plain2(res, 403, "this remote is read-only: a check cannot push\n");
     }
     const target = claimed.find((entry) => isOwnRepository(entry.repository, route.owner, route.name));
     const pushing = route.kind === "receive-pack" || route.kind === "info-refs" && route.service === "git-receive-pack";
     if (target === void 0 && pushing) {
       log(`push refused: ${route.owner}/${route.name} is not a repository of this build's claim`);
       req.resume();
-      return plain(res, 403, `the runner refused this push: ${route.owner}/${route.name} is not a repository of this build's claim
+      return plain2(res, 403, `the runner refused this push: ${route.owner}/${route.name} is not a repository of this build's claim
 `);
     }
     if (target !== void 0 && route.kind === "receive-pack") return push(req, res, route, target);
@@ -2166,9 +2833,9 @@ function createGitRemote(options) {
     let body;
     if (route.kind === "lfs-batch") {
       body = await readBody(req, maxLfsBodyBytes);
-      if (body === void 0) return plain(res, 413, "the request is too large\n");
+      if (body === void 0) return plain2(res, 413, "the request is too large\n");
       kind = isLfsUpload(body) ? "push" : "read";
-      if (options.readOnly === true && kind === "push") return plain(res, 403, "this remote is read-only: a check cannot upload\n");
+      if (options.readOnly === true && kind === "push") return plain2(res, 403, "this remote is read-only: a check cannot upload\n");
     }
     let authorization;
     if (target !== void 0) {
@@ -2197,7 +2864,7 @@ function createGitRemote(options) {
     } catch (err) {
       log(`could not serve a request: ${err instanceof Error ? err.message : String(err)}`);
       if (res.headersSent) res.destroy();
-      else plain(res, 502, "the runner could not serve this request\n");
+      else plain2(res, 502, "the runner could not serve this request\n");
     }
   };
 }
@@ -2692,6 +3359,8 @@ function withTunnelLog(opts, log) {
 }
 function createContainerRuntime(opts = {}) {
   const { cli, remoteFor } = opts;
+  const vm = createMicroVmPorts(opts.vm);
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   return {
     host: opts.host ?? createContainerHost(),
     cpus: opts.cpus ?? createCpuAllocator(usableCpus()),
@@ -2712,9 +3381,13 @@ function createContainerRuntime(opts = {}) {
       },
       { host: opts.imageHost ?? createDockerHost({ builder: builderSpec(build.configPath, build.buildMemory, opts.hostEnv ?? process.env) }) }
     )),
+    buildRootDisk: opts.buildRootDisk ?? ((build) => buildRootDiskInMicroVm(
+      { ...build, remote: remoteFor?.(build.repository), cli: cli ?? currentCliBuild() },
+      { ports: vm, startTunnel: opts.startTunnel ?? startTunnel, tunnelOptions: opts.tunnelOptions, sleep }
+    )),
     startTunnel: opts.startTunnel ?? startTunnel,
     tunnelOptions: opts.tunnelOptions,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms))),
+    sleep,
     hostEnv: opts.hostEnv ?? process.env,
     platform: opts.platform ?? process.platform,
     credentials: opts.credentials ?? /* @__PURE__ */ new Map(),
@@ -2724,7 +3397,7 @@ function createContainerRuntime(opts = {}) {
     clone: opts.clone ?? ((input) => cloneRepository(input.remote, input.dest)),
     destinationOptions: opts.destinationOptions,
     claudeUpstream: opts.claudeUpstream,
-    vm: createMicroVmPorts(opts.vm),
+    vm,
     cliBuild: () => cli ?? currentCliBuild()
   };
 }
@@ -2852,27 +3525,21 @@ async function obtainImage(input) {
       };
     }
     try {
-      return {
-        ok: true,
-        built: await runtime.buildImage({
-          repository,
-          configPath: config.configPath,
-          buildMemory: config.build?.memory ?? "8g",
-          readToken,
-          pinned: input.pinned,
-          guestHelper: input.guestHelper,
-          log: (line) => log.line(`${tag} ${line}`)
-        })
-      };
+      const common = { repository, configPath: config.configPath, readToken, pinned: input.pinned, log: (line) => log.line(`${tag} ${line}`) };
+      if (input.inBuilder !== void 0) {
+        return { ok: true, built: await runtime.buildRootDisk({ ...input.inBuilder, ...common, guestHelper: input.guestHelper, deadlineMs: input.deadlineMs }) };
+      }
+      return { ok: true, built: await runtime.buildImage({ ...common, buildMemory: config.build?.memory ?? "8g", guestHelper: input.guestHelper }) };
     } catch (err) {
       if (err instanceof RecipeError && err.code === "build_in_progress" && (input.now?.() ?? /* @__PURE__ */ new Date()).getTime() < input.deadlineMs) {
         log.line(`${tag} waiting for another build of ${repository}'s image`);
         await runtime.sleep(BUSY_IMAGE_WAIT_MS);
         continue;
       }
+      if (err instanceof AssetError) return { ok: false, reason: err.message };
       if (err instanceof RecipeError) {
         log.error(`${tag} image build for ${repository} failed: ${err.code}: ${err.message}`);
-        const says = err.code === "image_build_out_of_memory" || err.code === "image_builder_unavailable";
+        const says = err.code === "image_build_out_of_memory" || err.code === "image_builder_unavailable" || err.code === "image_builder_failed";
         return { ok: false, reason: says ? err.message : err.code };
       }
       return { ok: false, reason: `the image build failed: ${describeCallFailure(err)}` };
@@ -3551,4 +4218,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, withTunnelLog, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, ROOT_DISK_ID_PREFIX, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, formatBytes, freeBytes, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, makeBuildsDirPrivate, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startJailedInto, startServicesFor, stopContainer, stopJailed, sweepImageBuilders, syncInContainer, withTunnelLog, writeEvalInput };