@outerlayer/cli 0.33.0-next.20261022195547 → 0.33.0-next.20261023002325

package/dist/{chunk-D3HRAPNF.js → chunk-JRZCRIEO.js}

@@ -1,34 +1,37 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-KLXWS5Z7.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-YERR22SY.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-JPG43G6Y.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { runExec, execCapture, waitForAgent } from './chunk-6NWS455T.js';
-import { GUEST_CID, linkVsockSockets } from './chunk-LWTBE5J6.js';
-import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-RBJG5MM4.js';
-import { runnerImageVersion } from './chunk-SK4TWCN3.js';
+import { runExec, execCapture, waitForAgent } from './chunk-5THSC6BD.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-L26V6ILJ.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-T5REPMNL.js';
+import { runnerImageVersion } from './chunk-MZBQTVFG.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-43PV5KDB.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-GFVDC5S3.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-TGHBOXKJ.js';
-import { hostAllowed } from './chunk-UXYLWVTQ.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-TGHBOXKJ.js';
+import { runnerCredentialProblem, builtinKind, hostAllowed } from './chunk-3DCB3GOV.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { WorkCommandError } from './chunk-CMKY36NV.js';
+import { WorkCommandError, getJson } from './chunk-VT4TTJPG.js';
+import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-5DNCFOXA.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-AGZNCIIJ.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, writeBuildMavenSettings, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BCCI32ME.js';
+import { signerFor } from './chunk-SOI6K5DY.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-PA6CK6WQ.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BALIE3BA.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-LJG6EMLJ.js';
 import { downconvertSession } from './chunk-E6CO3MJE.js';
 import { realFdStorePort } from './chunk-HACGUL52.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
-import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, statSync, readdirSync, mkdtempSync, writeFileSync, lstatSync, copyFileSync, accessSync, constants, rmdirSync, renameSync, unlinkSync, linkSync, openSync, closeSync, cpSync, writeSync, appendFileSync, createWriteStream, createReadStream } from 'fs';
-import { join, dirname, relative, resolve, basename } from 'path';
-import { isIP, createConnection, connect, createServer as createServer$1 } from 'net';
 import { spawnSync, spawn } from 'child_process';
+import { mkdirSync, existsSync, readFileSync, mkdtempSync, rmSync, chmodSync, truncateSync, statSync, readdirSync, writeFileSync, lstatSync, copyFileSync, renameSync, accessSync, constants, rmdirSync, unlinkSync, linkSync, openSync, closeSync, cpSync, writeSync, appendFileSync, createWriteStream, createReadStream } from 'fs';
 import { randomBytes, createHash } from 'crypto';
+import { join, dirname, relative, resolve, basename } from 'path';
+import { isIP, createConnection, connect, createServer as createServer$1 } from 'net';
 import { availableParallelism, networkInterfaces, tmpdir } from 'os';
 import { Duplex, PassThrough, Transform } from 'stream';
 import http2 from 'http2';
@@ -39,227 +42,168 @@ import { createGunzip, gunzipSync, constants as constants$1 } from 'zlib';
 import { lookup } from 'dns/promises';
 
 createRequire(import.meta.url);
-var BUILD_PREFIX = "build-";
-var LEAF = "runner";
-function serviceDirectory(selfCgroup, mount) {
-  const line = selfCgroup?.split("\n").find((l) => l.startsWith("0::"));
-  if (line === void 0) return void 0;
-  const path = line.slice(3).trim();
-  if (!path.endsWith(".service")) return void 0;
-  return join(mount, path);
-}
-function prepareRunnerCgroup(setup) {
-  if (setup.invocationId === void 0 || setup.invocationId === "") return void 0;
-  const root = serviceDirectory(setup.selfCgroup, setup.mount);
-  if (root === void 0) return void 0;
-  const { fs } = setup;
-  if (!fs.exists(root) || !fs.writable(join(root, "cgroup.procs"))) return void 0;
-  const controllers = (fs.read(join(root, "cgroup.controllers")) ?? "").split(/\s+/);
-  if (!controllers.includes("memory")) return void 0;
-  for (const name of fs.list(root)) {
-    if (!name.startsWith(BUILD_PREFIX)) continue;
-    try {
-      fs.rmdir(join(root, name));
-    } catch {
-    }
+var AssetError = class extends Error {
+  constructor(file, message) {
+    super(message);
+    this.file = file;
   }
-  if (!fs.exists(join(root, LEAF))) fs.mkdir(join(root, LEAF));
-  fs.write(join(root, LEAF, "cgroup.procs"), String(setup.pid));
-  fs.write(join(root, "cgroup.subtree_control"), controllers.includes("io") ? "+memory +io" : "+memory");
-  return { root };
+};
+var FIRECRACKER_RELEASES = "https://github.com/firecracker-microvm/firecracker/releases/download";
+var DOWNLOAD_TIMEOUT_MS = 10 * 6e4;
+function pinnedAssets(arch) {
+  const version = FIRECRACKER_VERSION;
+  return {
+    firecracker: {
+      url: `${FIRECRACKER_RELEASES}/v${version}/firecracker-v${version}-${arch}.tgz`,
+      sha256: FIRECRACKER_SHA256[arch],
+      binarySha256: FIRECRACKER_BINARY_SHA256[arch],
+      jailerSha256: JAILER_BINARY_SHA256[arch]
+    },
+    kernel: { url: `${GUEST_ASSETS_BASE_URL}/vmlinux-${arch}`, sha256: GUEST_KERNEL_SHA256[arch] },
+    helper: { url: `${GUEST_ASSETS_BASE_URL}/outerlayer-guest-${arch}`, sha256: GUEST_HELPER_SHA256[arch] }
+  };
 }
-var BUILD_RECLAIM_HEADROOM_BYTES = 256 * 1024 ** 2;
-var BUILD_KILL_HEADROOM_BYTES = 1024 ** 3;
-function createBuildCgroup(fs, root, buildId, buildMemoryBytes) {
-  const path = join(root, `${BUILD_PREFIX}${buildId}`);
-  fs.mkdir(path);
-  try {
-    fs.write(join(path, "memory.high"), String(buildMemoryBytes + BUILD_RECLAIM_HEADROOM_BYTES));
-    fs.write(join(path, "memory.max"), String(buildMemoryBytes + BUILD_KILL_HEADROOM_BYTES));
-    fs.write(join(path, "memory.swap.max"), "0");
-  } catch (err) {
-    removeBuildCgroup(fs, path);
-    throw err;
-  }
-  return path;
+function builderDiskPin(arch) {
+  return { url: `${BUILDER_DISK_BASE_URL}/builder-rootfs-${arch}.ext4`, sha256: BUILDER_DISK_SHA256[arch] };
 }
-function outOfMemoryReason(memory) {
-  return `the build ran out of memory: the kernel killed its microVM at the limit of runner.build.memory (${memory ?? "8g"}) plus 1 GiB for Firecracker and its disks' page cache. Raise runner.build.memory, or lower runner.concurrency`;
+var sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function pinProblem(file, expected, actual, where) {
+  const release = file.startsWith("vmlinux-") || file.startsWith("outerlayer-guest-") ? ` (guest assets release ${GUEST_ASSETS_VERSION})` : file.startsWith("builder-rootfs-") ? ` (builder root disk release ${BUILDER_DISK_VERSION})` : "";
+  return new AssetError(file, `${file} ${where} has sha256 ${actual}, not the ${expected} this release pins${release}, so no microVM build starts`);
 }
-function oomKills(fs, path) {
-  const match = /^oom_kill (\d+)$/m.exec(fs.read(join(path, "memory.events")) ?? "");
-  return match === null ? 0 : Number(match[1]);
+function writeAtomic(path, bytes, mode) {
+  const temp = `${path}.${process.pid}.tmp`;
+  writeFileSync(temp, bytes, { mode });
+  renameSync(temp, path);
 }
-function removeBuildCgroup(fs, path) {
+async function download(file, url, fetchImpl) {
+  let response;
   try {
-    fs.rmdir(path);
+    response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
   } catch (err) {
-    if (err.code !== "ENOENT") throw err;
+    throw new AssetError(file, `${file} could not be downloaded from ${url}: ${err instanceof Error ? err.message : String(err)}`);
   }
+  if (!response.ok) throw new AssetError(file, `${file} could not be downloaded from ${url}: the server answered ${response.status}`);
+  return Buffer.from(await response.arrayBuffer());
 }
-function realCgroupFs() {
-  return {
-    exists: (path) => existsSync(path),
-    read: (path) => {
-      try {
-        return readFileSync(path, "utf8");
-      } catch {
-        return void 0;
-      }
-    },
-    write: (path, data) => writeFileSync(path, data),
-    mkdir: (path) => mkdirSync(path),
-    rmdir: (path) => rmdirSync(path),
-    list: (path) => readdirSync(path).filter((name) => statSync(join(path, name)).isDirectory()),
-    writable: (path) => {
-      try {
-        accessSync(path, constants.W_OK);
-        return true;
-      } catch {
-        return false;
-      }
-    }
+function keptPath(dir, sha256, name) {
+  mkdirSync(join(dir, sha256), { recursive: true, mode: RUNNER_DIR_MODE });
+  return join(dir, sha256, name);
+}
+async function ensureFile(dir, file, pin, fetchImpl, mode) {
+  const path = keptPath(dir, pin.sha256, file);
+  if (existsSync(path)) {
+    const actual2 = sha256Of(readFileSync(path));
+    if (actual2 !== pin.sha256) throw pinProblem(file, pin.sha256, actual2, `at ${path}`);
+    return path;
+  }
+  const bytes = await download(file, pin.url, fetchImpl);
+  const actual = sha256Of(bytes);
+  if (actual !== pin.sha256) throw pinProblem(file, pin.sha256, actual, `downloaded from ${pin.url}`);
+  writeAtomic(path, bytes, mode);
+  return path;
+}
+function extractWithTar(arch, program = "firecracker") {
+  const name = `${program}-v${FIRECRACKER_VERSION}-${arch}`;
+  return async (tarball, destDir) => {
+    const result = spawnSync("tar", ["-xzf", tarball, "-C", destDir, "--strip-components=1", `release-v${FIRECRACKER_VERSION}-${arch}/${name}`], { encoding: "utf8" });
+    if (result.status !== 0) throw new Error(`tar could not unpack ${tarball}: ${result.stderr.trim()}`);
+    return join(destDir, name);
   };
 }
-var delegatedRoot;
-function setUpRunnerCgroup(over = {}) {
-  let selfCgroup;
+async function ensureFirecracker(input) {
+  const { dir, arch, pins, fetchImpl } = input;
+  const firecracker = keptPath(dir, pins.firecracker.binarySha256, "firecracker");
+  if (existsSync(firecracker)) {
+    const actual = sha256Of(readFileSync(firecracker));
+    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `at ${firecracker}`);
+    return firecracker;
+  }
+  const tarballName = `firecracker-${arch}.tgz`;
+  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
+  const scratch = mkdtempSync(join(dir, ".extract-"));
   try {
-    selfCgroup = readFileSync("/proc/self/cgroup", "utf8");
-  } catch {
-    selfCgroup = void 0;
+    const extracted = await (input.extract ?? extractWithTar(arch))(tarball, scratch);
+    const bytes = readFileSync(extracted);
+    const actual = sha256Of(bytes);
+    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `unpacked from ${tarballName}`);
+    writeAtomic(firecracker, bytes, 493);
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
   }
-  let refusal;
+  return firecracker;
+}
+async function ensureFirecrackerAndJailer(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl: options.fetchImpl ?? fetch, extract: options.extractFirecracker });
+  return { firecracker, jailer: await ensureJailer(options) };
+}
+async function ensureAssets(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker or guest assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl, extract: options.extractFirecracker });
+  const kernel = await ensureFile(dir, `vmlinux-${arch}`, pins.kernel, fetchImpl, RUNNER_FILE_MODE);
+  const helper = await ensureFile(dir, `outerlayer-guest-${arch}`, pins.helper, fetchImpl, 493);
+  return { firecracker, kernel, helper, helperSha256: pins.helper.sha256 };
+}
+async function ensureJailer(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("jailer", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const expected = pins.firecracker.jailerSha256;
+  if (expected === void 0) throw new AssetError("jailer", "this release pins no hash for the jailer, so it cannot be had");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const jailer = keptPath(dir, expected, "jailer");
+  if (existsSync(jailer)) {
+    const actual = sha256Of(readFileSync(jailer));
+    if (actual !== expected) throw pinProblem("jailer", expected, actual, `at ${jailer}`);
+    return jailer;
+  }
+  const tarballName = `firecracker-${arch}.tgz`;
+  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
+  const scratch = mkdtempSync(join(dir, ".extract-"));
   try {
-    const prepared = prepareRunnerCgroup({ fs: realCgroupFs(), selfCgroup, pid: process.pid, invocationId: process.env.INVOCATION_ID, mount: "/sys/fs/cgroup", ...over });
-    delegatedRoot = prepared?.root;
-  } catch (err) {
-    delegatedRoot = void 0;
-    refusal = err instanceof Error ? err.message : String(err);
+    const extracted = await (options.extractJailer ?? extractWithTar(arch, "jailer"))(tarball, scratch);
+    const bytes = readFileSync(extracted);
+    const actual = sha256Of(bytes);
+    if (actual !== expected) throw pinProblem("jailer", expected, actual, `unpacked from ${tarballName}`);
+    writeAtomic(jailer, bytes, 493);
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
   }
-  return { delegated: delegatedRoot !== void 0, ...refusal === void 0 ? {} : { refusal } };
+  return jailer;
 }
-function realCgroupPort() {
-  const fs = realCgroupFs();
-  return {
-    create: (buildId, bytes) => {
-      if (delegatedRoot === void 0) return void 0;
-      return createBuildCgroup(fs, delegatedRoot, buildId, bytes);
-    },
-    oomKills: (path) => oomKills(fs, path),
-    remove: (path) => removeBuildCgroup(fs, path)
-  };
+async function ensureBuilderDisk(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("builder-rootfs", `no builder root disk is pinned for ${arch}, so microVM image builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const file = `builder-rootfs-${arch}.ext4`;
+  const pin = options.pin ?? builderDiskPin(arch);
+  if (options.pin === void 0 && !builderDiskPinned(arch)) {
+    throw new AssetError(file, `${file} is not published for this release of the CLI, so the image cannot be built in a builder microVM. Update the CLI, or set runner.build.imageBuild to host`);
+  }
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  return ensureFile(dir, file, pin, options.fetchImpl ?? fetch, RUNNER_FILE_MODE);
 }
-var SUPPORTED_HELPER_PROTOCOLS = [1];
-var HELPER_ENV = "OUTERLAYER_HELPER_SOCKET";
-var HelperRefusal = class extends Error {
-  constructor(code, reason) {
-    super(reason);
-    this.code = code;
+var STOP_GRACE_SECONDS = 15;
+function parseImageConfig(json) {
+  const config = JSON.parse(json);
+  const env = {};
+  for (const entry of config.Env ?? []) {
+    const eq = entry.indexOf("=");
+    if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
   }
-};
-function helperSocketPath(unitName) {
-  return `/run/${unitName}-helper/helper.sock`;
-}
-var START_TIMEOUT_MS = 12e4;
-var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
-var MAX_REPLY_BYTES = 1024 * 1024;
-function ask(socketPath, request, timeoutMs) {
-  return new Promise((resolve2, reject) => {
-    const conn = createConnection(socketPath);
-    let text = "";
-    let settled = false;
-    const settle = (finish) => {
-      if (settled) return;
-      settled = true;
-      conn.destroy();
-      finish();
-    };
-    conn.setTimeout(timeoutMs, () => settle(() => reject(new Error(`the helper at ${socketPath} did not answer within ${Math.round(timeoutMs / 1e3)} seconds`))));
-    conn.on("connect", () => conn.write(`${JSON.stringify(request)}
-`));
-    conn.on("data", (chunk) => {
-      text += chunk.toString("utf8");
-      if (text.length > MAX_REPLY_BYTES) return settle(() => reject(new Error(`the helper at ${socketPath} sent a reply that is too long`)));
-      const end = text.indexOf("\n");
-      if (end === -1) return;
-      settle(() => {
-        let reply;
-        try {
-          reply = JSON.parse(text.slice(0, end));
-        } catch {
-          return reject(new Error(`the helper at ${socketPath} sent a reply that is not JSON`));
-        }
-        if (reply.status === "refused") return reject(new HelperRefusal(String(reply.code ?? "refused"), String(reply.reason ?? "the helper refused the request")));
-        resolve2(reply);
-      });
-    });
-    conn.on("error", (err) => settle(() => reject(new Error(`the helper at ${socketPath} did not answer: ${err.message}`))));
-    conn.on("close", () => settle(() => reject(new Error(`the helper at ${socketPath} closed the connection without a reply`))));
-  });
-}
-function helperClient(socketPath, options = {}) {
-  const REQUEST_TIMEOUT_MS = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-  return {
-    async start({ build, kind, timeLimitMinutes }) {
-      const reply = await ask(socketPath, { v: 1, op: "start", build, kind, timeLimitMinutes }, START_TIMEOUT_MS);
-      return { unit: String(reply.unit), chroot: String(reply.chroot), vsock: String(reply.vsock) };
-    },
-    async stop(build) {
-      await ask(socketPath, { v: 1, op: "stop", build }, REQUEST_TIMEOUT_MS);
-    },
-    async state(build) {
-      const reply = await ask(socketPath, { v: 1, op: "state", build }, REQUEST_TIMEOUT_MS);
-      return { active: reply.active === true, oomKills: typeof reply.oomKills === "number" ? reply.oomKills : 0 };
-    },
-    async list() {
-      const reply = await ask(socketPath, { v: 1, op: "list" }, REQUEST_TIMEOUT_MS);
-      return Array.isArray(reply.builds) ? reply.builds.map(String) : [];
-    },
-    async relink(build) {
-      await ask(socketPath, { v: 1, op: "relink", build }, REQUEST_TIMEOUT_MS);
-    }
-  };
-}
-function helperFirecrackerNote(helperFirecracker) {
-  return `the root helper runs Firecracker ${helperFirecracker}, not the ${FIRECRACKER_VERSION} this release pins, so microVM builds run under the jailer with Firecracker ${helperFirecracker}`;
-}
-function reinstallMessage(protocol) {
-  const spoken = protocol === void 0 ? "a protocol it does not name" : `protocol ${protocol}`;
-  return `the root helper speaks ${spoken}, which this runner does not support, so microVM builds run without the jailer; run \`outerlayer runner install --service --replace\` to install the helper that goes with this release`;
-}
-async function probeHelper(socketPath, options = {}) {
-  if (socketPath === void 0 || socketPath === "") return { ok: false, reason: "absent", detail: `${HELPER_ENV} is not set, so this runner was not started by a service that has a helper` };
-  if (!(options.pinned ?? hostHelperPinned())) return { ok: false, reason: "unpinned", detail: "this release of the CLI pins no helper, so builds run without the jailer" };
-  try {
-    const reply = await ask(socketPath, { v: 1, op: "hello" }, options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS);
-    const protocol = typeof reply.protocol === "number" ? reply.protocol : void 0;
-    if (protocol === void 0 || !SUPPORTED_HELPER_PROTOCOLS.includes(protocol)) return { ok: false, reason: "unsupported", detail: reinstallMessage(protocol) };
-    return { ok: true, client: helperClient(socketPath, { requestTimeoutMs: options.requestTimeoutMs }), firecracker: String(reply.firecracker ?? "") };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { ok: false, reason: "absent", unreachable: true, detail: message.includes(socketPath) ? message : `the helper at ${socketPath} did not answer: ${message}` };
-  }
-}
-function jailedAlive(unit, cgroupRoot = "/sys/fs/cgroup") {
-  try {
-    return /^populated 1$/m.test(readFileSync(join(cgroupRoot, "system.slice", `${unit}.service`, "cgroup.events"), "utf8"));
-  } catch {
-    return false;
-  }
-}
-function realHelperPort(env = process.env) {
-  return { probe: () => probeHelper(env[HELPER_ENV]), alive: (unit) => jailedAlive(unit) };
-}
-var STOP_GRACE_SECONDS = 15;
-function parseImageConfig(json) {
-  const config = JSON.parse(json);
-  const env = {};
-  for (const entry of config.Env ?? []) {
-    const eq = entry.indexOf("=");
-    if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
-  }
-  return { user: config.User ?? "", env };
+  return { user: config.User ?? "", env };
 }
 function createContainerHost(deps = {}) {
   const run = deps.run ?? spawnRun;
@@ -329,6 +273,8 @@ function createContainerHost(deps = {}) {
     }
   };
 }
+
+// src/runner/microvm/disks.ts
 function converterScript(workDir = "/tmp/rootfs") {
   return [
     "set -eu",
@@ -490,6 +436,56 @@ async function createBuildDisk(input) {
 function deleteBuildDisk(path) {
   rmSync(path, { force: true });
 }
+function dockerArch(nodeArch) {
+  if (nodeArch === "x64") return "amd64";
+  if (nodeArch === "arm64") return "arm64";
+  throw new AssetError("tool files", `no tool files are pinned for ${nodeArch}`);
+}
+function toolFilePins(arch) {
+  return [
+    ...VOICE_PACK_FILES.map((file) => ({ path: `${FETCHED_VOICE_DIR}/${file.name}`, url: file.url, sha256: file.sha256 })),
+    { path: FETCHED_FFMPEG, url: `https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/${FFMPEG_STATIC[arch].file}`, sha256: FFMPEG_STATIC[arch].sha256 },
+    { path: FETCHED_GH, url: `https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${arch}.tar.gz`, sha256: GH_SHA256[arch] },
+    { path: FETCHED_TINI, url: `https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-${arch}`, sha256: TINI_SHA256[arch] }
+  ];
+}
+function pinsDir(runnerDir2, pins) {
+  const key = createHash("sha256").update(pins.map((pin) => `${pin.path} ${pin.sha256}`).join("\n")).digest("hex").slice(0, 16);
+  const root = join(vmAssetsDir(runnerDir2), "tool-files");
+  return { root, dir: join(root, key) };
+}
+var inFlight = /* @__PURE__ */ new Map();
+async function ensureToolFiles(options) {
+  const pins = options.pins ?? toolFilePins(options.arch ?? dockerArch(process.arch));
+  const { root, dir } = pinsDir(options.runnerDir, pins);
+  const running = inFlight.get(dir);
+  if (running !== void 0) return running;
+  const fetching = fetchAll(root, dir, pins, options.fetchImpl ?? fetch).finally(() => inFlight.delete(dir));
+  inFlight.set(dir, fetching);
+  return fetching;
+}
+async function fetchAll(root, dir, pins, fetchImpl) {
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  for (const pin of pins) {
+    const path = join(dir, pin.path);
+    if (existsSync(path)) {
+      const actual = await sha256OfFile(path);
+      if (actual !== pin.sha256) {
+        throw new AssetError(pin.path, `the tool file ${path} has sha256 ${actual}, not the ${pin.sha256} this release pins, so no image build starts. Delete it to download it again`);
+      }
+      continue;
+    }
+    try {
+      await downloadPinned({ url: pin.url, dest: path, sha256: pin.sha256, name: pin.path, fetchImpl, stopped: "no image build started" });
+    } catch (err) {
+      throw new AssetError(pin.path, `the tool file ${pin.path} could not be had: ${err instanceof VoiceDownloadError ? err.message : String(err)}`);
+    }
+  }
+  for (const name of readdirSync(root)) {
+    if (join(root, name) !== dir) rmSync(join(root, name), { recursive: true, force: true });
+  }
+  return dir;
+}
 var CONSOLE_CUT_NOTE = "[outerlayer runner: cut the console at 8 MiB; the microVM keeps running]\n";
 function pumpConsole(fd, streams) {
   const cap = 8 * 1024 ** 2;
@@ -631,63 +627,292 @@ function createFirecrackerHost(options = {}) {
     alive
   };
 }
-function unitNameFor(buildId) {
-  return `outerlayer-build-${buildId}`;
-}
-function linkIn(buildDir2, name, source) {
-  const target = join(buildDir2, name);
-  rmSync(target, { force: true });
-  try {
-    linkSync(source, target);
-  } catch (err) {
-    if (err.code === "EXDEV") {
-      throw new Error(`${source} and ${buildDir2} are on different file systems, so the build's files cannot be linked into its jail`);
-    }
-    throw err;
-  }
-  chmodSync(source, 292);
+var BUILD_PREFIX = "build-";
+var LEAF = "runner";
+function serviceDirectory(selfCgroup, mount) {
+  const line = selfCgroup?.split("\n").find((l) => l.startsWith("0::"));
+  if (line === void 0) return void 0;
+  const path = line.slice(3).trim();
+  if (!path.endsWith(".service")) return void 0;
+  return join(mount, path);
 }
-async function startJailed(input) {
-  linkIn(input.buildDir, "kernel", input.kernel);
-  linkIn(input.buildDir, "rootfs.ext4", input.rootfs);
-  for (const name of input.sockets) {
+function prepareRunnerCgroup(setup) {
+  if (setup.invocationId === void 0 || setup.invocationId === "") return void 0;
+  const root = serviceDirectory(setup.selfCgroup, setup.mount);
+  if (root === void 0) return void 0;
+  const { fs } = setup;
+  if (!fs.exists(root) || !fs.writable(join(root, "cgroup.procs"))) return void 0;
+  const controllers = (fs.read(join(root, "cgroup.controllers")) ?? "").split(/\s+/);
+  if (!controllers.includes("memory")) return void 0;
+  for (const name of fs.list(root)) {
+    if (!name.startsWith(BUILD_PREFIX)) continue;
     try {
-      chmodSync(join(input.buildDir, name), 438);
-    } catch (err) {
-      if (err.code !== "ENOENT") throw err;
+      fs.rmdir(join(root, name));
+    } catch {
     }
   }
-  return input.client.start({ build: input.buildId, kind: input.kind, ...input.timeLimitMinutes === void 0 ? {} : { timeLimitMinutes: input.timeLimitMinutes } });
+  if (!fs.exists(join(root, LEAF))) fs.mkdir(join(root, LEAF));
+  fs.write(join(root, LEAF, "cgroup.procs"), String(setup.pid));
+  fs.write(join(root, "cgroup.subtree_control"), controllers.includes("io") ? "+memory +io" : "+memory");
+  return { root };
 }
-async function startJailedInto(state, input, save) {
-  state.jailed = { unit: unitNameFor(state.buildId), chroot: "" };
-  save();
+var BUILD_RECLAIM_HEADROOM_BYTES = 256 * 1024 ** 2;
+var BUILD_KILL_HEADROOM_BYTES = 1024 ** 3;
+function createBuildCgroup(fs, root, buildId, buildMemoryBytes) {
+  const path = join(root, `${BUILD_PREFIX}${buildId}`);
+  fs.mkdir(path);
   try {
-    const started = await startJailed({ ...input, buildId: state.buildId, buildDir: state.buildDir });
-    state.jailed = { unit: started.unit, chroot: started.chroot };
-    state.vsockPath = started.vsock;
+    fs.write(join(path, "memory.high"), String(buildMemoryBytes + BUILD_RECLAIM_HEADROOM_BYTES));
+    fs.write(join(path, "memory.max"), String(buildMemoryBytes + BUILD_KILL_HEADROOM_BYTES));
+    fs.write(join(path, "memory.swap.max"), "0");
   } catch (err) {
-    if (err instanceof HelperRefusal) {
-      delete state.jailed;
-      save();
-    }
+    removeBuildCgroup(fs, path);
     throw err;
   }
-  save();
+  return path;
 }
-async function stopJailed(helper, state) {
-  const probe = await helper.probe();
-  if (!probe.ok) throw new Error(`the build's unit ${state.jailed?.unit ?? unitNameFor(state.buildId)} could not be stopped, because there is no helper to ask: ${probe.detail}`);
+function outOfMemoryReason(memory) {
+  return `the build ran out of memory: the kernel killed its microVM at the limit of runner.build.memory (${memory ?? "8g"}) plus 1 GiB for Firecracker and its disks' page cache. Raise runner.build.memory, or lower runner.concurrency`;
+}
+function oomKills(fs, path) {
+  const match = /^oom_kill (\d+)$/m.exec(fs.read(join(path, "memory.events")) ?? "");
+  return match === null ? 0 : Number(match[1]);
+}
+function removeBuildCgroup(fs, path) {
   try {
-    await probe.client.stop(state.buildId);
+    fs.rmdir(path);
   } catch (err) {
-    throw new Error(`the build's unit ${state.jailed?.unit ?? unitNameFor(state.buildId)} was not stopped: ${describeCallFailure(err)}`);
+    if (err.code !== "ENOENT") throw err;
   }
 }
-function makeBuildsDirPrivate(buildDir2) {
-  const builds = dirname(buildDir2);
-  const stat = statSync(builds);
-  if (stat.uid === process.getuid?.() && (stat.mode & 18) !== 0) chmodSync(builds, 448);
+function realCgroupFs() {
+  return {
+    exists: (path) => existsSync(path),
+    read: (path) => {
+      try {
+        return readFileSync(path, "utf8");
+      } catch {
+        return void 0;
+      }
+    },
+    write: (path, data) => writeFileSync(path, data),
+    mkdir: (path) => mkdirSync(path),
+    rmdir: (path) => rmdirSync(path),
+    list: (path) => readdirSync(path).filter((name) => statSync(join(path, name)).isDirectory()),
+    writable: (path) => {
+      try {
+        accessSync(path, constants.W_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+var delegatedRoot;
+function setUpRunnerCgroup(over = {}) {
+  let selfCgroup;
+  try {
+    selfCgroup = readFileSync("/proc/self/cgroup", "utf8");
+  } catch {
+    selfCgroup = void 0;
+  }
+  let refusal;
+  try {
+    const prepared = prepareRunnerCgroup({ fs: realCgroupFs(), selfCgroup, pid: process.pid, invocationId: process.env.INVOCATION_ID, mount: "/sys/fs/cgroup", ...over });
+    delegatedRoot = prepared?.root;
+  } catch (err) {
+    delegatedRoot = void 0;
+    refusal = err instanceof Error ? err.message : String(err);
+  }
+  return { delegated: delegatedRoot !== void 0, ...refusal === void 0 ? {} : { refusal } };
+}
+function realCgroupPort() {
+  const fs = realCgroupFs();
+  return {
+    create: (buildId, bytes) => {
+      if (delegatedRoot === void 0) return void 0;
+      return createBuildCgroup(fs, delegatedRoot, buildId, bytes);
+    },
+    oomKills: (path) => oomKills(fs, path),
+    remove: (path) => removeBuildCgroup(fs, path)
+  };
+}
+var SUPPORTED_HELPER_PROTOCOLS = [1];
+var HELPER_ENV = "OUTERLAYER_HELPER_SOCKET";
+var HelperRefusal = class extends Error {
+  constructor(code, reason) {
+    super(reason);
+    this.code = code;
+  }
+};
+function helperSocketPath(unitName) {
+  return `/run/${unitName}-helper/helper.sock`;
+}
+var START_TIMEOUT_MS = 12e4;
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var MAX_REPLY_BYTES = 1024 * 1024;
+function ask(socketPath, request, timeoutMs) {
+  return new Promise((resolve2, reject) => {
+    const conn = createConnection(socketPath);
+    let text = "";
+    let settled = false;
+    const settle = (finish) => {
+      if (settled) return;
+      settled = true;
+      conn.destroy();
+      finish();
+    };
+    conn.setTimeout(timeoutMs, () => settle(() => reject(new Error(`the helper at ${socketPath} did not answer within ${Math.round(timeoutMs / 1e3)} seconds`))));
+    conn.on("connect", () => conn.write(`${JSON.stringify(request)}
+`));
+    conn.on("data", (chunk) => {
+      text += chunk.toString("utf8");
+      if (text.length > MAX_REPLY_BYTES) return settle(() => reject(new Error(`the helper at ${socketPath} sent a reply that is too long`)));
+      const end = text.indexOf("\n");
+      if (end === -1) return;
+      settle(() => {
+        let reply;
+        try {
+          reply = JSON.parse(text.slice(0, end));
+        } catch {
+          return reject(new Error(`the helper at ${socketPath} sent a reply that is not JSON`));
+        }
+        if (reply.status === "refused") return reject(new HelperRefusal(String(reply.code ?? "refused"), String(reply.reason ?? "the helper refused the request")));
+        resolve2(reply);
+      });
+    });
+    conn.on("error", (err) => settle(() => reject(new Error(`the helper at ${socketPath} did not answer: ${err.message}`))));
+    conn.on("close", () => settle(() => reject(new Error(`the helper at ${socketPath} closed the connection without a reply`))));
+  });
+}
+function helperClient(socketPath, options = {}) {
+  const REQUEST_TIMEOUT_MS = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  return {
+    async start({ build, kind, timeLimitMinutes }) {
+      const reply = await ask(socketPath, { v: 1, op: "start", build, kind, timeLimitMinutes }, START_TIMEOUT_MS);
+      return { unit: String(reply.unit), chroot: String(reply.chroot), vsock: String(reply.vsock) };
+    },
+    async stop(build) {
+      await ask(socketPath, { v: 1, op: "stop", build }, REQUEST_TIMEOUT_MS);
+    },
+    async state(build) {
+      const reply = await ask(socketPath, { v: 1, op: "state", build }, REQUEST_TIMEOUT_MS);
+      return { active: reply.active === true, oomKills: typeof reply.oomKills === "number" ? reply.oomKills : 0 };
+    },
+    async list() {
+      const reply = await ask(socketPath, { v: 1, op: "list" }, REQUEST_TIMEOUT_MS);
+      return Array.isArray(reply.builds) ? reply.builds.map(String) : [];
+    },
+    async relink(build) {
+      await ask(socketPath, { v: 1, op: "relink", build }, REQUEST_TIMEOUT_MS);
+    }
+  };
+}
+function helperFirecrackerNote(helperFirecracker) {
+  return `the root helper runs Firecracker ${helperFirecracker}, not the ${FIRECRACKER_VERSION} this release pins, so microVM builds run under the jailer with Firecracker ${helperFirecracker}`;
+}
+function reinstallMessage(protocol) {
+  const spoken = protocol === void 0 ? "a protocol it does not name" : `protocol ${protocol}`;
+  return `the root helper speaks ${spoken}, which this runner does not support, so microVM builds run without the jailer; run \`outerlayer runner install --service --replace\` to install the helper that goes with this release`;
+}
+async function probeHelper(socketPath, options = {}) {
+  if (socketPath === void 0 || socketPath === "") return { ok: false, reason: "absent", detail: `${HELPER_ENV} is not set, so this runner was not started by a service that has a helper` };
+  if (!(options.pinned ?? hostHelperPinned())) return { ok: false, reason: "unpinned", detail: "this release of the CLI pins no helper, so builds run without the jailer" };
+  try {
+    const reply = await ask(socketPath, { v: 1, op: "hello" }, options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS);
+    const protocol = typeof reply.protocol === "number" ? reply.protocol : void 0;
+    if (protocol === void 0 || !SUPPORTED_HELPER_PROTOCOLS.includes(protocol)) return { ok: false, reason: "unsupported", detail: reinstallMessage(protocol) };
+    return { ok: true, client: helperClient(socketPath, { requestTimeoutMs: options.requestTimeoutMs }), firecracker: String(reply.firecracker ?? "") };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: "absent", unreachable: true, detail: message.includes(socketPath) ? message : `the helper at ${socketPath} did not answer: ${message}` };
+  }
+}
+function jailedAlive(unit, cgroupRoot = "/sys/fs/cgroup") {
+  try {
+    return /^populated 1$/m.test(readFileSync(join(cgroupRoot, "system.slice", `${unit}.service`, "cgroup.events"), "utf8"));
+  } catch {
+    return false;
+  }
+}
+function realHelperPort(env = process.env) {
+  return { probe: () => probeHelper(env[HELPER_ENV]), alive: (unit) => jailedAlive(unit) };
+}
+
+// src/runner/microvm/host.ts
+function createMicroVmPorts(over = {}) {
+  return {
+    assets: over.assets ?? ((runnerDir2) => ensureAssets({ runnerDir: runnerDir2 })),
+    rootfs: over.rootfs ?? createRootfsHost(),
+    firecracker: over.firecracker ?? createFirecrackerHost(),
+    cgroup: over.cgroup ?? realCgroupPort(),
+    helper: over.helper ?? realHelperPort(),
+    fdStore: over.fdStore ?? realFdStorePort(),
+    exec: over.exec ?? execCapture,
+    execStream: over.execStream ?? runExec,
+    builderDisk: over.builderDisk ?? ((runnerDir2) => ensureBuilderDisk({ runnerDir: runnerDir2 })),
+    builderDiskPinned: over.builderDiskPinned ?? (() => builderDiskPinned()),
+    toolFiles: over.toolFiles ?? ((runnerDir2) => ensureToolFiles({ runnerDir: runnerDir2 }))
+  };
+}
+function unitNameFor(buildId) {
+  return `outerlayer-build-${buildId}`;
+}
+function linkIn(buildDir2, name, source) {
+  const target = join(buildDir2, name);
+  rmSync(target, { force: true });
+  try {
+    linkSync(source, target);
+  } catch (err) {
+    if (err.code === "EXDEV") {
+      throw new Error(`${source} and ${buildDir2} are on different file systems, so the build's files cannot be linked into its jail`);
+    }
+    throw err;
+  }
+  chmodSync(source, 292);
+}
+async function startJailed(input) {
+  linkIn(input.buildDir, "kernel", input.kernel);
+  linkIn(input.buildDir, "rootfs.ext4", input.rootfs);
+  for (const name of input.sockets) {
+    try {
+      chmodSync(join(input.buildDir, name), 438);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+  return input.client.start({ build: input.buildId, kind: input.kind, ...input.timeLimitMinutes === void 0 ? {} : { timeLimitMinutes: input.timeLimitMinutes } });
+}
+async function startJailedInto(state, input, save) {
+  state.jailed = { unit: unitNameFor(state.buildId), chroot: "" };
+  save();
+  try {
+    const started = await startJailed({ ...input, buildId: state.buildId, buildDir: state.buildDir });
+    state.jailed = { unit: started.unit, chroot: started.chroot };
+    state.vsockPath = started.vsock;
+  } catch (err) {
+    if (err instanceof HelperRefusal) {
+      delete state.jailed;
+      save();
+    }
+    throw err;
+  }
+  save();
+}
+async function stopJailed(helper, state) {
+  const probe = await helper.probe();
+  if (!probe.ok) throw new Error(`the build's unit ${state.jailed?.unit ?? unitNameFor(state.buildId)} could not be stopped, because there is no helper to ask: ${probe.detail}`);
+  try {
+    await probe.client.stop(state.buildId);
+  } catch (err) {
+    throw new Error(`the build's unit ${state.jailed?.unit ?? unitNameFor(state.buildId)} was not stopped: ${describeCallFailure(err)}`);
+  }
+}
+function makeBuildsDirPrivate(buildDir2) {
+  const builds = dirname(buildDir2);
+  const stat = statSync(builds);
+  if (stat.uid === process.getuid?.() && (stat.mode & 18) !== 0) chmodSync(builds, 448);
 }
 var MANAGED_UNJAILED_REASON = "the root helper does not answer, and a managed runner starts no build without the jailer. The build did not start; restore the helper with `outerlayer runner install --service --replace`";
 
@@ -1224,428 +1449,374 @@ async function sweepImageBuilders(configPath, ports, onError) {
   }
   return swept;
 }
-var BranchPrepareError = class extends Error {
+var RunnerInitError = class extends Error {
 };
-var OWN_PREFIX = "outerlayer/";
-var GIT_TIMEOUT_MS = 12e4;
-var REPO_BINDING_GIT_VARS = new Set(
-  `GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_OBJECT_DIRECTORY GIT_DIR GIT_WORK_TREE GIT_IMPLICIT_WORK_TREE
-   GIT_GRAFT_FILE GIT_INDEX_FILE GIT_NO_REPLACE_OBJECTS GIT_REPLACE_REF_BASE GIT_PREFIX
-   GIT_INTERNAL_SUPER_PREFIX GIT_SHALLOW_FILE GIT_COMMON_DIR GIT_NAMESPACE`.split(/\s+/)
-);
-function localGit(cwd, args) {
-  const env = {};
-  for (const [key, value] of Object.entries(process.env)) {
-    if (!REPO_BINDING_GIT_VARS.has(key)) env[key] = value;
+var UNMARKED_PLACEHOLDER_COMMAND = "echo 'edit runner.commands in this config file: it must start your agent on item $OUTERLAYER_WORK' >&2; exit 1";
+var PLACEHOLDER_MARKER = "outerlayer-placeholder";
+var PLACEHOLDER_COMMAND = `${UNMARKED_PLACEHOLDER_COMMAND} # ${PLACEHOLDER_MARKER}`;
+function isolationNote(machine) {
+  const has = describeMachineDocker(machine);
+  const reach = reachDockerStep(machine);
+  const needs = reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, run the runner from a WSL2 shell, and set both hooks to builtin:container.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2. Once it is installed, set both hooks to builtin:container.`;
+  return `This machine has ${has}, so builds run as processes under this user (isolation: shared-user), through the tunnel. ${needs}`;
+}
+function processRefusal(machine) {
+  const reach = reachDockerStep(machine);
+  const needs = machine.platform === "darwin" ? "Isolated builds on a Mac run in the runner image on Docker Desktop (https://docs.outerlayer.ai/run-the-runner-in-a-container) or in a Linux VM: run this again with --vm." : reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then run this again.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, then run this again from a WSL2 shell.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it, then run this again.`;
+  return `This machine has ${describeMachineDocker(machine)}, so it cannot isolate a build. ${needs} To run builds as processes under this user instead, where a build can read this user's files and the runner's Claude credential, run this again with --allow-process-builds.`;
+}
+function isPlaceholderCommand(command) {
+  return command === UNMARKED_PLACEHOLDER_COMMAND || command.includes(PLACEHOLDER_MARKER);
+}
+function readConfigObject(configPath) {
+  if (!existsSync(configPath)) {
+    throw new RunnerInitError(
+      `${configPath}: no config file. Run \`outerlayer login\` first, then this command.`
+    );
   }
-  env.GIT_TERMINAL_PROMPT = "0";
-  const result = spawnSync("git", args, { cwd, env, encoding: "utf8", timeout: GIT_TIMEOUT_MS });
-  if (result.error !== void 0) {
-    return Promise.resolve({ status: null, stdout: "", stderr: result.error.message });
+  try {
+    return JSON.parse(readFileSync(configPath, "utf8"));
+  } catch (err) {
+    throw new RunnerInitError(`${configPath}: not valid JSON (${err instanceof Error ? err.message : String(err)})`);
   }
-  return Promise.resolve({ status: result.status, stdout: result.stdout.trim(), stderr: result.stderr.trim() });
 }
-function firstLine2(stderr) {
-  return (stderr.split("\n")[0] ?? "").replace(/\/\/[^/@\s]+@/g, "//");
+function handedCredential(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") throw new RunnerInitError("the config on stdin carries a claudeCredential that is not text.");
+  return credentialFromStdin(value);
 }
-async function mustGit(git2, cwd, step, args) {
-  const result = await git2(cwd, args);
-  if (result.status !== 0) {
-    const detail = firstLine2(result.stderr);
-    throw new BranchPrepareError(`${step} failed${detail === "" ? "" : `: ${detail}`}`);
-  }
-  return result.stdout;
+function handedAgent(value) {
+  if (value === void 0) return void 0;
+  if (!isAgentName(value)) throw new RunnerInitError("the config on stdin names an agent runner init does not know.");
+  return value;
 }
-async function remoteDefaultBranch(git2, workdir) {
-  const out = await mustGit(git2, workdir, "reading the remote's default branch", ["ls-remote", "--symref", "origin", "HEAD"]);
-  const match = /^ref: refs\/heads\/(\S+)\s+HEAD$/m.exec(out);
-  if (match === null) {
-    throw new BranchPrepareError("reading the remote's default branch failed: the remote names none");
+function parseStdinConfig(configPath, text) {
+  if (existsSync(configPath)) {
+    throw new RunnerInitError(
+      `${configPath}: a config file is already here, so the runner key in it is not replaced. Remove it, or delete the VM and start again.`
+    );
   }
-  return match[1];
+  let config;
+  try {
+    config = JSON.parse(text);
+  } catch (err) {
+    throw new RunnerInitError(`the config on stdin is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+  const problem = runnerCredentialProblem(config);
+  if (problem !== void 0) throw new RunnerInitError(`the config on stdin: ${problem.field} ${problem.reason}.`);
+  const carried = config.runner;
+  const credential = handedCredential(config.claudeCredential);
+  const agent = handedAgent(config.agent);
+  delete config.runner;
+  delete config.claudeCredential;
+  delete config.agent;
+  return { config, carried, credential, agent };
+}
+function runRunnerInit(configPath, opts = {}) {
+  return writeRunnerInit(prepareRunnerInit(configPath, opts));
+}
+function prepareRunnerInit(configPath, opts = {}) {
+  let config;
+  let carried;
+  let credential = opts.credential;
+  let agent = opts.agent;
+  let needsKey = false;
+  if (opts.configFromStdin === void 0) {
+    config = opts.keyFromLogin === true && !existsSync(configPath) ? {} : readConfigObject(configPath);
+    if (config.runner !== void 0) {
+      throw new RunnerInitError(`${configPath}: a runner block is already here. Edit it, or remove it and run this again.`);
+    }
+    needsKey = opts.keyFromLogin === true && config.apiKey === void 0;
+    const problem = needsKey ? void 0 : runnerCredentialProblem(config);
+    if (problem !== void 0) throw new RunnerInitError(`${configPath}: ${problem.field} ${problem.reason}.`);
+  } else {
+    const handed = parseStdinConfig(configPath, opts.configFromStdin);
+    ({ config, carried } = handed);
+    credential ??= handed.credential;
+    agent ??= handed.agent;
+  }
+  const machine = opts.machine ?? detectMachine();
+  if (opts.requireContainer === true && !supportsContainerBuilds(machine)) {
+    const fix = reachDockerStep(machine) ?? `install Docker Engine ${MIN_ENGINE_MAJOR} or later in the VM`;
+    throw new RunnerInitError(`the VM has ${describeMachineDocker(machine)}, but the runner in it needs container builds: ${fix}, then run this again.`);
+  }
+  const hooks = opts.requireContainer !== true && supportsMicroVmBuilds(machine) ? "builtin:vm" : supportsContainerBuilds(machine) ? "builtin:container" : "builtin:process";
+  if (hooks === "builtin:process" && opts.allowProcess !== true) throw new RunnerInitError(processRefusal(machine));
+  if (agent === "claude" && credential === void 0 && opts.credentialInEnvironment !== true && !hasStoredCredential(configPath)) {
+    throw new RunnerInitError(
+      "--agent claude needs Claude's credential, and none was piped on stdin or is in the claude.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
+    );
+  }
+  return { configPath, config, carried, credential, agent, machine, hooks, needsKey, host: opts.host };
 }
-async function remoteHasBranch(git2, workdir, branch) {
-  return await mustGit(git2, workdir, `looking for ${branch} on the remote`, ["ls-remote", "--heads", "origin", `refs/heads/${branch}`]) !== "";
-}
-async function fetchBranch(git2, workdir, branch) {
-  await mustGit(git2, workdir, `fetching ${branch}`, ["fetch", "--quiet", "origin", `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
-}
-async function prepareBranch(opts) {
-  const { workdir, branch } = opts;
-  const git2 = opts.git ?? localGit;
-  const defaultBranch = await remoteDefaultBranch(git2, workdir);
-  const exists = await remoteHasBranch(git2, workdir, branch);
-  await fetchBranch(git2, workdir, defaultBranch);
-  if (exists) await fetchBranch(git2, workdir, branch);
-  let start;
-  if (exists && !(branch.startsWith(OWN_PREFIX) && await isMerged(git2, workdir, branch, defaultBranch))) {
-    start = `origin/${branch}`;
-  } else if (branch.startsWith(OWN_PREFIX)) {
-    start = `origin/${defaultBranch}`;
-  } else {
-    throw new BranchPrepareError(`the pull request's branch ${branch} is not on the remote`);
-  }
-  await mustGit(git2, workdir, `checking out ${branch}`, ["checkout", "--quiet", "-B", branch, start]);
-  return {
-    branch,
-    head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]),
-    startCommit: await mustGit(git2, workdir, `reading the commit of ${defaultBranch}`, ["rev-parse", `origin/${defaultBranch}`])
-  };
-}
-async function isMerged(git2, workdir, branch, defaultBranch) {
-  const result = await git2(workdir, ["merge-base", "--is-ancestor", `origin/${branch}`, `origin/${defaultBranch}`]);
-  if (result.status === 0) return true;
-  if (result.status === 1) return false;
-  const detail = firstLine2(result.stderr);
-  throw new BranchPrepareError(`comparing ${branch} with ${defaultBranch} failed${detail === "" ? "" : `: ${detail}`}`);
+function writeRunnerInit(prepared, runnerKey) {
+  const { configPath, config, carried, credential, agent, machine, hooks, host } = prepared;
+  if (prepared.needsKey && runnerKey === void 0) {
+    throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was pasted.`);
+  }
+  if (runnerKey !== void 0) Object.assign(config, { url: runnerKey.url, apiKey: runnerKey.apiKey, appId: runnerKey.appId });
+  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  config.runner = {
+    queues: ["implement", "amend"],
+    concurrency: 1,
+    pollSeconds: 60,
+    timeLimitMinutes: 480,
+    idleLimitMinutes: 30,
+    // A placeholder that fails loudly. A command line that quietly did
+    // nothing would claim an item, run, exit zero, and record `ok` —
+    // every attempt reading as a success that produced nothing.
+    commands: {
+      implement: PLACEHOLDER_COMMAND,
+      amend: PLACEHOLDER_COMMAND
+    },
+    ...carried,
+    ...host === void 0 ? {} : { name: host },
+    // The agent was named on this command line, so its commands win over any the hand-off carried.
+    ...agent === void 0 ? {} : { commands: { ...AGENT_COMMANDS[agent] } },
+    hooks: { provision: hooks, cleanup: hooks }
+  };
+  if (host !== void 0) delete config.runner.host;
+  mkdirSync(dirname(configPath), { recursive: true });
+  const stored = credential === void 0 ? void 0 : { variable: credential.variable, path: storeClaudeCredential(configPath, credential) };
+  writeFileSync(configPath, `${JSON.stringify(config, null, 2)}
+`, { mode: RUNNER_FILE_MODE });
+  return { configPath, hooks, ...hooks === "builtin:process" ? { note: isolationNote(machine) } : {}, credential: stored };
 }
 
-// src/runner/container/lifecycle.ts
-var ORDER = ["onCreateCommand", "updateContentCommand", "postCreateCommand", "postStartCommand"];
-function commandArgv(command) {
-  if (typeof command === "string") return command === "" ? void 0 : ["/bin/sh", "-c", command];
-  if (Array.isArray(command) && command.length > 0 && command.every((part) => typeof part === "string")) return command;
-  return void 0;
+// src/runner/host-setup.ts
+function placeholderQueues(config) {
+  return config.queues.filter((queue) => {
+    const command = config.commands[queue];
+    return command !== void 0 && isPlaceholderCommand(command);
+  });
 }
-function lifecycleSteps(lifecycle) {
-  const steps = [];
-  for (const name of ORDER) {
-    const entries = lifecycle[name];
-    if (entries === void 0) continue;
-    for (const { source, command } of entries) {
-      if (typeof command === "object" && command !== null && !Array.isArray(command)) {
-        for (const [key, value] of Object.entries(command)) {
-          const argv2 = commandArgv(value);
-          if (argv2 !== void 0) steps.push({ name: `${name}[${key}]`, source, argv: argv2 });
-        }
-        continue;
-      }
-      const argv = commandArgv(command);
-      if (argv !== void 0) steps.push({ name, source, argv });
+function placeholderProblem(queues) {
+  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
+  return `${keys} ${queues.length === 1 ? "is" : "are"} still the placeholder \`runner init\` wrote, which fails every item. Edit ${queues.length === 1 ? "it" : "them"} to start your agent on item $OUTERLAYER_WORK`;
+}
+var CLAUDE_PERMISSION_MODES = ["acceptEdits", "auto", "bypassPermissions", "default", "dontAsk", "manual", "plan"];
+var CLAUDE_COMMAND = /(?:^|[;&|(])\s*(?:(?:exec|env|nohup|time)\s+)*(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:\S*\/)?claude\s/;
+var PERMISSION_MODE_FLAG = /--permission-mode(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s;&|()]+))/g;
+function permissionModeProblems(config) {
+  const problems = [];
+  for (const queue of config.queues) {
+    const command = config.commands[queue];
+    if (command === void 0 || !CLAUDE_COMMAND.test(command)) continue;
+    for (const match of command.matchAll(PERMISSION_MODE_FLAG)) {
+      const value = match[1] ?? match[2] ?? match[3] ?? "";
+      if (value.includes("$") || value.includes("`") || CLAUDE_PERMISSION_MODES.includes(value)) continue;
+      problems.push({ queue, command, value });
     }
   }
-  return steps;
+  return problems;
 }
-function lifecycleFailureReason(step, exitCode) {
-  return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
+function permissionModeProblem(problems) {
+  return problems.map(({ queue, command, value }) => `runner.commands.${queue} is \`${command}\`, and \`${value}\` is not a permission mode Claude Code accepts (${CLAUDE_PERMISSION_MODES.join(", ")}). The command would fail only when a build ran it`).join(". ");
 }
-function parseCpuList(text) {
-  const cores = /* @__PURE__ */ new Set();
-  for (const part of text.trim().split(",")) {
-    const match = /^(\d+)(?:-(\d+))?$/.exec(part.trim());
-    if (match === null) return void 0;
-    const low = Number(match[1]);
-    const high = match[2] === void 0 ? low : Number(match[2]);
-    if (high < low) return void 0;
-    for (let core = low; core <= high; core++) cores.add(core);
-  }
-  return [...cores].sort((a, b) => a - b);
+var FORMER_AMEND_COMMAND = /(^|["'\s])\/amend(?=["'\s]|$)/g;
+function currentSkillCommand(command) {
+  return command.replace(FORMER_AMEND_COMMAND, "$1/outerlayer-amend");
 }
-function formatCpuList(cores) {
-  const sorted = [...new Set(cores)].sort((a, b) => a - b);
-  const parts = [];
-  for (let i = 0; i < sorted.length; i++) {
-    const start = sorted[i];
-    while (sorted[i + 1] === sorted[i] + 1) i++;
-    parts.push(start === sorted[i] ? String(start) : `${start}-${sorted[i]}`);
-  }
-  return parts.join(",");
-}
-function capCpus(wanted, cpuset) {
-  const cores = cpuset === void 0 ? void 0 : parseCpuList(cpuset);
-  return cores === void 0 ? wanted : Math.min(wanted, cores.length);
-}
-function usableCpus(deps = {}) {
-  try {
-    const status = (deps.readStatus ?? (() => readFileSync("/proc/self/status", "utf8")))();
-    const cores = parseCpuList(/^Cpus_allowed_list:\s*(.+)$/m.exec(status)?.[1] ?? "");
-    if (cores !== void 0) return cores;
-  } catch {
-  }
-  return Array.from({ length: Math.max(1, (deps.parallelism ?? availableParallelism)()) }, (_unused, core) => core);
-}
-function createCpuAllocator(cores) {
-  const usable = [...new Set(cores)].sort((a, b) => a - b);
-  const held = /* @__PURE__ */ new Map();
-  const holders = (core) => {
-    let count = 0;
-    for (const set of held.values()) if (set.includes(core)) count++;
-    return count;
-  };
-  return {
-    acquire(buildId, cpus) {
-      const existing = held.get(buildId);
-      if (existing !== void 0) return existing;
-      const wanted = Math.min(Math.ceil(cpus), usable.length);
-      const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
-      const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
-      held.set(buildId, chosen);
-      return chosen;
-    },
-    hold(buildId, set) {
-      held.set(buildId, [...set]);
-    },
-    release(buildId) {
-      held.delete(buildId);
-    }
-  };
+function formerSkillQueues(config) {
+  return config.queues.filter((queue) => {
+    const command = config.commands[queue];
+    return command !== void 0 && currentSkillCommand(command) !== command;
+  });
 }
-
-// src/runner/container/lease-channel.ts
-var LEASE_SECONDS = 900;
-function leaseExpiresAtMs(job) {
-  const base = Date.parse(job.lastRenewAt ?? job.startedAt);
-  return (Number.isFinite(base) ? base : Date.now()) + LEASE_SECONDS * 1e3;
+function formerSkillProblem(queues) {
+  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
+  return `${keys} ${queues.length === 1 ? "starts" : "start"} /amend, which is now /outerlayer-amend. The runner runs /outerlayer-amend in its place; edit the config to say so`;
 }
-function leaseTimeLeftMs(job, nowMs) {
-  return Math.max(0, leaseExpiresAtMs(job) - nowMs);
+function needsClaudeCredential(hooks) {
+  return builtinKind(hooks.provision) !== "own";
 }
-function createLeaseChannel(valueMs) {
-  const open = /* @__PURE__ */ new Set();
-  let stopped = false;
-  const write = (stream) => {
-    if (!stopped && !stream.destroyed && stream.writable) stream.write(`${Math.floor(valueMs())}
-`);
-  };
-  return {
-    accept(stream) {
-      stream.on("error", () => void 0);
-      open.add(stream);
-      stream.once("close", () => open.delete(stream));
-      queueMicrotask(() => write(stream));
-    },
-    publish() {
-      for (const stream of open) write(stream);
-    },
-    stop() {
-      stopped = true;
-    },
-    close() {
-      for (const stream of [...open]) stream.destroy();
-      open.clear();
+var CREDENTIAL_FIX = "Run `claude setup-token`, then pipe the token it prints (or an Anthropic API key) to `outerlayer runner init --agent claude`, which stores it in the claude.env beside the config. Or start the runner with CLAUDE_CODE_OAUTH_TOKEN (or ANTHROPIC_API_KEY) set";
+function claudeCredentialCheck(env, options = {}) {
+  const name = "Claude credential";
+  if (options.service !== void 0) {
+    const { unit, variables } = options.service;
+    if (variables.length === 0) {
+      return {
+        name,
+        status: "fail",
+        detail: `the service ${unit} has no Claude credential: neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set in its claude.env or runner.env, so every build fails at provision as agent_credential_missing`,
+        fix: `${CREDENTIAL_FIX}, then restart the service: sudo systemctl restart ${unit}.`
+      };
     }
-  };
-}
-var AssetError = class extends Error {
-  constructor(file, message) {
-    super(message);
-    this.file = file;
+    return { name, status: "pass", detail: `${variables[0]} is set in the claude.env or runner.env of the service ${unit}` };
   }
-};
-var FIRECRACKER_RELEASES = "https://github.com/firecracker-microvm/firecracker/releases/download";
-var DOWNLOAD_TIMEOUT_MS = 10 * 6e4;
-function pinnedAssets(arch) {
-  const version = FIRECRACKER_VERSION;
-  return {
-    firecracker: {
-      url: `${FIRECRACKER_RELEASES}/v${version}/firecracker-v${version}-${arch}.tgz`,
-      sha256: FIRECRACKER_SHA256[arch],
-      binarySha256: FIRECRACKER_BINARY_SHA256[arch],
-      jailerSha256: JAILER_BINARY_SHA256[arch]
-    },
-    kernel: { url: `${GUEST_ASSETS_BASE_URL}/vmlinux-${arch}`, sha256: GUEST_KERNEL_SHA256[arch] },
-    helper: { url: `${GUEST_ASSETS_BASE_URL}/outerlayer-guest-${arch}`, sha256: GUEST_HELPER_SHA256[arch] }
-  };
+  const held = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
+  if (held === void 0) {
+    return {
+      name,
+      status: "fail",
+      detail: `neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set, so every build fails at provision as agent_credential_missing`,
+      fix: `${CREDENTIAL_FIX}.`
+    };
+  }
+  const sameVariables = options.shell === true ? "; the runner must be started with the same variable" : "";
+  return { name, status: "pass", detail: `${held.variable} is set${sameVariables}` };
 }
-function builderDiskPin(arch) {
-  return { url: `${BUILDER_DISK_BASE_URL}/builder-rootfs-${arch}.ext4`, sha256: BUILDER_DISK_SHA256[arch] };
+function missingPermissionOf(err) {
+  if (!(err instanceof WorkCommandError) || err.status !== 403) return void 0;
+  const permission = /missing required permission '([^']+)'/i.exec(err.message)?.[1];
+  return permission === void 0 ? void 0 : sanitizeTerminal(permission);
 }
-var sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function pinProblem(file, expected, actual, where) {
-  const release = file.startsWith("vmlinux-") || file.startsWith("outerlayer-guest-") ? ` (guest assets release ${GUEST_ASSETS_VERSION})` : file.startsWith("builder-rootfs-") ? ` (builder root disk release ${BUILDER_DISK_VERSION})` : "";
-  return new AssetError(file, `${file} ${where} has sha256 ${actual}, not the ${expected} this release pins${release}, so no microVM build starts`);
-}
-function writeAtomic(path, bytes, mode) {
-  const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync(temp, bytes, { mode });
-  renameSync(temp, path);
+function missingPermissionFix(permission) {
+  return `use a key that holds ${permission}: create one with the Runner preset on the factory's API keys page, then run \`outerlayer login\` with it`;
 }
-async function download(file, url, fetchImpl) {
-  let response;
+async function claimPermissionProblem(config, fetchImpl = fetch) {
+  const unverified = (what, err) => ({
+    status: "unverified",
+    reason: sanitizeTerminal(`${what}: ${err instanceof Error ? describeCallFailure(err) : String(err)}`)
+  });
+  let signer;
   try {
-    response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+    signer = await signerFor(config.configPath);
   } catch (err) {
-    throw new AssetError(file, `${file} could not be downloaded from ${url}: ${err instanceof Error ? err.message : String(err)}`);
+    return unverified("this host's key could not be read, so whether the runner key can claim work was not checked", err);
   }
-  if (!response.ok) throw new AssetError(file, `${file} could not be downloaded from ${url}: the server answered ${response.status}`);
-  return Buffer.from(await response.arrayBuffer());
-}
-function keptPath(dir, sha256, name) {
-  mkdirSync(join(dir, sha256), { recursive: true, mode: RUNNER_DIR_MODE });
-  return join(dir, sha256, name);
-}
-async function ensureFile(dir, file, pin, fetchImpl, mode) {
-  const path = keptPath(dir, pin.sha256, file);
-  if (existsSync(path)) {
-    const actual2 = sha256Of(readFileSync(path));
-    if (actual2 !== pin.sha256) throw pinProblem(file, pin.sha256, actual2, `at ${path}`);
-    return path;
+  try {
+    await getJson(config.url, "/v1/runner/host-key", config.apiKey, config.appId, fetchImpl, signer);
+    return { status: "ok" };
+  } catch (err) {
+    const permission = missingPermissionOf(err);
+    if (permission === void 0) return unverified("the host-key call did not say whether the runner key can claim work", err);
+    return { status: "lacks", problem: `the runner key lacks ${permission}, which a runner needs to claim work: ${missingPermissionFix(permission)}` };
   }
-  const bytes = await download(file, pin.url, fetchImpl);
-  const actual = sha256Of(bytes);
-  if (actual !== pin.sha256) throw pinProblem(file, pin.sha256, actual, `downloaded from ${pin.url}`);
-  writeAtomic(path, bytes, mode);
-  return path;
 }
-function extractWithTar(arch, program = "firecracker") {
-  const name = `${program}-v${FIRECRACKER_VERSION}-${arch}`;
-  return async (tarball, destDir) => {
-    const result = spawnSync("tar", ["-xzf", tarball, "-C", destDir, "--strip-components=1", `release-v${FIRECRACKER_VERSION}-${arch}/${name}`], { encoding: "utf8" });
-    if (result.status !== 0) throw new Error(`tar could not unpack ${tarball}: ${result.stderr.trim()}`);
-    return join(destDir, name);
-  };
+
+// src/runner/build-skill-check.ts
+var BUILD_SKILL_PATHS = [".agents/skills/build/SKILL.md", ".claude/skills/build/SKILL.md"];
+var BUILD_COMMAND = /(?:^|["']|(?:^|\s)(?:claude|-p|--print)\s+)\/build(?=["'\s]|$)/;
+var BUILD_DIRECTORY_USE = /(?:^|[\s;&|])(?:cd|pushd|--add-dir|--cwd|-C)\s+["']?\/build(?=["'\s;&|]|$)/g;
+function needsBuildSkill(queue, command) {
+  if (queue !== "implement" || command === void 0) return false;
+  return BUILD_COMMAND.test(currentSkillCommand(command).replace(BUILD_DIRECTORY_USE, " "));
+}
+function missingBuildSkillReason(governed, lookupFailure) {
+  const checked = governed === void 0 ? BUILD_SKILL_PATHS.join(" and ") : `${BUILD_SKILL_PATHS.join(", ")} and the governed context from ${governed.repository}@${governed.commit.slice(0, 7)}`;
+  const lookup2 = lookupFailure === void 0 ? "" : `, and the lookup of the governing repository failed (${lookupFailure})`;
+  return `the build has no \`build\` skill, so /build would load nothing${lookup2}: checked ${checked}`;
+}
+function cloneHasBuildSkill(checkout) {
+  return BUILD_SKILL_PATHS.some((path) => existsSync(join(checkout, path)));
+}
+async function decideHostBuildSkill(input) {
+  const { requireBuildSkill, containerMode, vmMode, workdir, repository } = input;
+  if (!requireBuildSkill || containerMode || vmMode || !existsSync(join(workdir, ".git")) || cloneHasBuildSkill(workdir)) return { kind: "start" };
+  const governing = repository === void 0 ? void 0 : await input.lookup(repository);
+  if (governing?.ok === true && governing.source.kind !== "self") return { kind: "warn" };
+  const reason = missingBuildSkillReason(void 0, governing?.ok === false ? governing.reason : void 0);
+  return { kind: "refuse", reason };
 }
-async function ensureFirecracker(input) {
-  const { dir, arch, pins, fetchImpl } = input;
-  const firecracker = keptPath(dir, pins.firecracker.binarySha256, "firecracker");
-  if (existsSync(firecracker)) {
-    const actual = sha256Of(readFileSync(firecracker));
-    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `at ${firecracker}`);
-    return firecracker;
+var BranchPrepareError = class extends Error {
+};
+var OWN_PREFIX = "outerlayer/";
+var GIT_TIMEOUT_MS = 12e4;
+var REPO_BINDING_GIT_VARS = new Set(
+  `GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_OBJECT_DIRECTORY GIT_DIR GIT_WORK_TREE GIT_IMPLICIT_WORK_TREE
+   GIT_GRAFT_FILE GIT_INDEX_FILE GIT_NO_REPLACE_OBJECTS GIT_REPLACE_REF_BASE GIT_PREFIX
+   GIT_INTERNAL_SUPER_PREFIX GIT_SHALLOW_FILE GIT_COMMON_DIR GIT_NAMESPACE`.split(/\s+/)
+);
+function localGit(cwd, args) {
+  const env = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!REPO_BINDING_GIT_VARS.has(key)) env[key] = value;
   }
-  const tarballName = `firecracker-${arch}.tgz`;
-  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
-  const scratch = mkdtempSync(join(dir, ".extract-"));
-  try {
-    const extracted = await (input.extract ?? extractWithTar(arch))(tarball, scratch);
-    const bytes = readFileSync(extracted);
-    const actual = sha256Of(bytes);
-    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `unpacked from ${tarballName}`);
-    writeAtomic(firecracker, bytes, 493);
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
+  env.GIT_TERMINAL_PROMPT = "0";
+  const result = spawnSync("git", args, { cwd, env, encoding: "utf8", timeout: GIT_TIMEOUT_MS });
+  if (result.error !== void 0) {
+    return Promise.resolve({ status: null, stdout: "", stderr: result.error.message });
   }
-  return firecracker;
-}
-async function ensureFirecrackerAndJailer(options) {
-  const arch = options.arch ?? firecrackerArch(process.arch);
-  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
-  const pins = options.pins ?? pinnedAssets(arch);
-  const dir = vmAssetsDir(options.runnerDir);
-  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl: options.fetchImpl ?? fetch, extract: options.extractFirecracker });
-  return { firecracker, jailer: await ensureJailer(options) };
+  return Promise.resolve({ status: result.status, stdout: result.stdout.trim(), stderr: result.stderr.trim() });
 }
-async function ensureAssets(options) {
-  const arch = options.arch ?? firecrackerArch(process.arch);
-  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker or guest assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
-  const pins = options.pins ?? pinnedAssets(arch);
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const dir = vmAssetsDir(options.runnerDir);
-  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl, extract: options.extractFirecracker });
-  const kernel = await ensureFile(dir, `vmlinux-${arch}`, pins.kernel, fetchImpl, RUNNER_FILE_MODE);
-  const helper = await ensureFile(dir, `outerlayer-guest-${arch}`, pins.helper, fetchImpl, 493);
-  return { firecracker, kernel, helper, helperSha256: pins.helper.sha256 };
+function firstLine2(stderr) {
+  return (stderr.split("\n")[0] ?? "").replace(/\/\/[^/@\s]+@/g, "//");
 }
-async function ensureJailer(options) {
-  const arch = options.arch ?? firecrackerArch(process.arch);
-  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("jailer", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
-  const pins = options.pins ?? pinnedAssets(arch);
-  const expected = pins.firecracker.jailerSha256;
-  if (expected === void 0) throw new AssetError("jailer", "this release pins no hash for the jailer, so it cannot be had");
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const dir = vmAssetsDir(options.runnerDir);
-  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const jailer = keptPath(dir, expected, "jailer");
-  if (existsSync(jailer)) {
-    const actual = sha256Of(readFileSync(jailer));
-    if (actual !== expected) throw pinProblem("jailer", expected, actual, `at ${jailer}`);
-    return jailer;
+async function mustGit(git2, cwd, step, args) {
+  const result = await git2(cwd, args);
+  if (result.status !== 0) {
+    const detail = firstLine2(result.stderr);
+    throw new BranchPrepareError(`${step} failed${detail === "" ? "" : `: ${detail}`}`);
   }
-  const tarballName = `firecracker-${arch}.tgz`;
-  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
-  const scratch = mkdtempSync(join(dir, ".extract-"));
-  try {
-    const extracted = await (options.extractJailer ?? extractWithTar(arch, "jailer"))(tarball, scratch);
-    const bytes = readFileSync(extracted);
-    const actual = sha256Of(bytes);
-    if (actual !== expected) throw pinProblem("jailer", expected, actual, `unpacked from ${tarballName}`);
-    writeAtomic(jailer, bytes, 493);
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
+  return result.stdout;
+}
+async function remoteDefaultBranch(git2, workdir) {
+  const out = await mustGit(git2, workdir, "reading the remote's default branch", ["ls-remote", "--symref", "origin", "HEAD"]);
+  const match = /^ref: refs\/heads\/(\S+)\s+HEAD$/m.exec(out);
+  if (match === null) {
+    throw new BranchPrepareError("reading the remote's default branch failed: the remote names none");
   }
-  return jailer;
+  return match[1];
 }
-async function ensureBuilderDisk(options) {
-  const arch = options.arch ?? firecrackerArch(process.arch);
-  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("builder-rootfs", `no builder root disk is pinned for ${arch}, so microVM image builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
-  const file = `builder-rootfs-${arch}.ext4`;
-  const pin = options.pin ?? builderDiskPin(arch);
-  if (options.pin === void 0 && !builderDiskPinned(arch)) {
-    throw new AssetError(file, `${file} is not published for this release of the CLI, so the image cannot be built in a builder microVM. Update the CLI, or set runner.build.imageBuild to host`);
-  }
-  const dir = vmAssetsDir(options.runnerDir);
-  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  return ensureFile(dir, file, pin, options.fetchImpl ?? fetch, RUNNER_FILE_MODE);
+async function remoteHasBranch(git2, workdir, branch) {
+  return await mustGit(git2, workdir, `looking for ${branch} on the remote`, ["ls-remote", "--heads", "origin", `refs/heads/${branch}`]) !== "";
 }
-function dockerArch(nodeArch) {
-  if (nodeArch === "x64") return "amd64";
-  if (nodeArch === "arm64") return "arm64";
-  throw new AssetError("tool files", `no tool files are pinned for ${nodeArch}`);
+async function fetchBranch(git2, workdir, branch) {
+  await mustGit(git2, workdir, `fetching ${branch}`, ["fetch", "--quiet", "origin", `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
 }
-function toolFilePins(arch) {
-  return [
-    ...VOICE_PACK_FILES.map((file) => ({ path: `${FETCHED_VOICE_DIR}/${file.name}`, url: file.url, sha256: file.sha256 })),
-    { path: FETCHED_FFMPEG, url: `https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/${FFMPEG_STATIC[arch].file}`, sha256: FFMPEG_STATIC[arch].sha256 },
-    { path: FETCHED_GH, url: `https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${arch}.tar.gz`, sha256: GH_SHA256[arch] },
-    { path: FETCHED_TINI, url: `https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-${arch}`, sha256: TINI_SHA256[arch] }
-  ];
+async function prepareBranch(opts) {
+  const { workdir, branch } = opts;
+  const git2 = opts.git ?? localGit;
+  const defaultBranch = await remoteDefaultBranch(git2, workdir);
+  const exists = await remoteHasBranch(git2, workdir, branch);
+  await fetchBranch(git2, workdir, defaultBranch);
+  if (exists) await fetchBranch(git2, workdir, branch);
+  let start;
+  if (exists && !(branch.startsWith(OWN_PREFIX) && await isMerged(git2, workdir, branch, defaultBranch))) {
+    start = `origin/${branch}`;
+  } else if (branch.startsWith(OWN_PREFIX)) {
+    start = `origin/${defaultBranch}`;
+  } else {
+    throw new BranchPrepareError(`the pull request's branch ${branch} is not on the remote`);
+  }
+  await mustGit(git2, workdir, `checking out ${branch}`, ["checkout", "--quiet", "-B", branch, start]);
+  return {
+    branch,
+    head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]),
+    startCommit: await mustGit(git2, workdir, `reading the commit of ${defaultBranch}`, ["rev-parse", `origin/${defaultBranch}`])
+  };
 }
-function pinsDir(runnerDir2, pins) {
-  const key = createHash("sha256").update(pins.map((pin) => `${pin.path} ${pin.sha256}`).join("\n")).digest("hex").slice(0, 16);
-  const root = join(vmAssetsDir(runnerDir2), "tool-files");
-  return { root, dir: join(root, key) };
+async function isMerged(git2, workdir, branch, defaultBranch) {
+  const result = await git2(workdir, ["merge-base", "--is-ancestor", `origin/${branch}`, `origin/${defaultBranch}`]);
+  if (result.status === 0) return true;
+  if (result.status === 1) return false;
+  const detail = firstLine2(result.stderr);
+  throw new BranchPrepareError(`comparing ${branch} with ${defaultBranch} failed${detail === "" ? "" : `: ${detail}`}`);
 }
-var inFlight = /* @__PURE__ */ new Map();
-async function ensureToolFiles(options) {
-  const pins = options.pins ?? toolFilePins(options.arch ?? dockerArch(process.arch));
-  const { root, dir } = pinsDir(options.runnerDir, pins);
-  const running = inFlight.get(dir);
-  if (running !== void 0) return running;
-  const fetching = fetchAll(root, dir, pins, options.fetchImpl ?? fetch).finally(() => inFlight.delete(dir));
-  inFlight.set(dir, fetching);
-  return fetching;
+
+// src/runner/container/lifecycle.ts
+var ORDER = ["onCreateCommand", "updateContentCommand", "postCreateCommand", "postStartCommand"];
+function commandArgv(command) {
+  if (typeof command === "string") return command === "" ? void 0 : ["/bin/sh", "-c", command];
+  if (Array.isArray(command) && command.length > 0 && command.every((part) => typeof part === "string")) return command;
+  return void 0;
 }
-async function fetchAll(root, dir, pins, fetchImpl) {
-  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  for (const pin of pins) {
-    const path = join(dir, pin.path);
-    if (existsSync(path)) {
-      const actual = await sha256OfFile(path);
-      if (actual !== pin.sha256) {
-        throw new AssetError(pin.path, `the tool file ${path} has sha256 ${actual}, not the ${pin.sha256} this release pins, so no image build starts. Delete it to download it again`);
+function lifecycleSteps(lifecycle) {
+  const steps = [];
+  for (const name of ORDER) {
+    const entries = lifecycle[name];
+    if (entries === void 0) continue;
+    for (const { source, command } of entries) {
+      if (typeof command === "object" && command !== null && !Array.isArray(command)) {
+        for (const [key, value] of Object.entries(command)) {
+          const argv2 = commandArgv(value);
+          if (argv2 !== void 0) steps.push({ name: `${name}[${key}]`, source, argv: argv2 });
+        }
+        continue;
       }
-      continue;
-    }
-    try {
-      await downloadPinned({ url: pin.url, dest: path, sha256: pin.sha256, name: pin.path, fetchImpl, stopped: "no image build started" });
-    } catch (err) {
-      throw new AssetError(pin.path, `the tool file ${pin.path} could not be had: ${err instanceof VoiceDownloadError ? err.message : String(err)}`);
+      const argv = commandArgv(command);
+      if (argv !== void 0) steps.push({ name, source, argv });
     }
   }
-  for (const name of readdirSync(root)) {
-    if (join(root, name) !== dir) rmSync(join(root, name), { recursive: true, force: true });
-  }
-  return dir;
+  return steps;
 }
-
-// src/runner/microvm/host.ts
-function createMicroVmPorts(over = {}) {
-  return {
-    assets: over.assets ?? ((runnerDir2) => ensureAssets({ runnerDir: runnerDir2 })),
-    rootfs: over.rootfs ?? createRootfsHost(),
-    firecracker: over.firecracker ?? createFirecrackerHost(),
-    cgroup: over.cgroup ?? realCgroupPort(),
-    helper: over.helper ?? realHelperPort(),
-    fdStore: over.fdStore ?? realFdStorePort(),
-    exec: over.exec ?? execCapture,
-    execStream: over.execStream ?? runExec,
-    builderDisk: over.builderDisk ?? ((runnerDir2) => ensureBuilderDisk({ runnerDir: runnerDir2 })),
-    builderDiskPinned: over.builderDiskPinned ?? (() => builderDiskPinned()),
-    toolFiles: over.toolFiles ?? ((runnerDir2) => ensureToolFiles({ runnerDir: runnerDir2 }))
-  };
+function lifecycleFailureReason(step, exitCode) {
+  return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
 }
+
+// src/runner/build-steps.ts
 var aborted = () => ({ ok: false, reason: "", aborted: true });
 function firstLine3(text) {
   return text.trim().split("\n")[0] ?? "";
@@ -1688,6 +1859,17 @@ async function deliveryRefusal(input, staged) {
   const folder = own.get(".claude/skills").has(clash) ? ".claude/skills" : ".agents/skills";
   return `context_skill_conflict: ${skillConflictMessage({ skill: clash, folder, repository: input.repository, controlPlane: staged.repository })}, and would replace it in this build; rename or remove it from the repository`;
 }
+async function checkoutHasBuildSkill(input) {
+  for (const path of BUILD_SKILL_PATHS) {
+    const probe = await input.exec(["test", "-f", path], CHECKOUT_DIR, { quiet: true });
+    if (probe.status === 0) return true;
+    if (probe.status !== 1) return { failed: failure(`checking for ${path} failed`, probe) };
+  }
+  return false;
+}
+function stagedHasBuildSkill(staged) {
+  return existsSync(join(staged.dir, "tree", ".claude/skills/build/SKILL.md"));
+}
 async function writeShim(input) {
   const shim = await input.exec(["sh", "-c", WRITE_SHIM_SCRIPT, "shim", SHIM_DIR, shimScript()], "/build/work");
   if (shim.status !== 0) return { ok: false, reason: failure("writing the claude shim failed", shim) };
@@ -1770,6 +1952,14 @@ async function runBuildSteps(input) {
   const staged = await input.stageContext();
   if (staged.kind === "refused") return { ok: false, reason: staged.reason };
   let controlPlane;
+  if (input.requireBuildSkill === true && !(staged.kind === "staged" && stagedHasBuildSkill(staged))) {
+    const held = await checkoutHasBuildSkill(input);
+    if (held !== true) {
+      if (staged.kind === "staged") input.removeStagedContext();
+      if (held !== false) return { ok: false, reason: held.failed };
+      return { ok: false, reason: missingBuildSkillReason(staged.kind === "staged" ? { repository: staged.repository, commit: staged.sha } : void 0) };
+    }
+  }
   const shimmed = await writeShim(input);
   if (!shimmed.ok) {
     if (staged.kind === "staged") input.removeStagedContext();
@@ -2878,6 +3068,103 @@ function isLfsUpload(body) {
     return false;
   }
 }
+function parseCpuList(text) {
+  const cores = /* @__PURE__ */ new Set();
+  for (const part of text.trim().split(",")) {
+    const match = /^(\d+)(?:-(\d+))?$/.exec(part.trim());
+    if (match === null) return void 0;
+    const low = Number(match[1]);
+    const high = match[2] === void 0 ? low : Number(match[2]);
+    if (high < low) return void 0;
+    for (let core = low; core <= high; core++) cores.add(core);
+  }
+  return [...cores].sort((a, b) => a - b);
+}
+function formatCpuList(cores) {
+  const sorted = [...new Set(cores)].sort((a, b) => a - b);
+  const parts = [];
+  for (let i = 0; i < sorted.length; i++) {
+    const start = sorted[i];
+    while (sorted[i + 1] === sorted[i] + 1) i++;
+    parts.push(start === sorted[i] ? String(start) : `${start}-${sorted[i]}`);
+  }
+  return parts.join(",");
+}
+function capCpus(wanted, cpuset) {
+  const cores = cpuset === void 0 ? void 0 : parseCpuList(cpuset);
+  return cores === void 0 ? wanted : Math.min(wanted, cores.length);
+}
+function usableCpus(deps = {}) {
+  try {
+    const status = (deps.readStatus ?? (() => readFileSync("/proc/self/status", "utf8")))();
+    const cores = parseCpuList(/^Cpus_allowed_list:\s*(.+)$/m.exec(status)?.[1] ?? "");
+    if (cores !== void 0) return cores;
+  } catch {
+  }
+  return Array.from({ length: Math.max(1, (deps.parallelism ?? availableParallelism)()) }, (_unused, core) => core);
+}
+function createCpuAllocator(cores) {
+  const usable = [...new Set(cores)].sort((a, b) => a - b);
+  const held = /* @__PURE__ */ new Map();
+  const holders = (core) => {
+    let count = 0;
+    for (const set of held.values()) if (set.includes(core)) count++;
+    return count;
+  };
+  return {
+    acquire(buildId, cpus) {
+      const existing = held.get(buildId);
+      if (existing !== void 0) return existing;
+      const wanted = Math.min(Math.ceil(cpus), usable.length);
+      const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
+      const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
+      held.set(buildId, chosen);
+      return chosen;
+    },
+    hold(buildId, set) {
+      held.set(buildId, [...set]);
+    },
+    release(buildId) {
+      held.delete(buildId);
+    }
+  };
+}
+
+// src/runner/container/lease-channel.ts
+var LEASE_SECONDS = 900;
+function leaseExpiresAtMs(job) {
+  const base = Date.parse(job.lastRenewAt ?? job.startedAt);
+  return (Number.isFinite(base) ? base : Date.now()) + LEASE_SECONDS * 1e3;
+}
+function leaseTimeLeftMs(job, nowMs) {
+  return Math.max(0, leaseExpiresAtMs(job) - nowMs);
+}
+function createLeaseChannel(valueMs) {
+  const open = /* @__PURE__ */ new Set();
+  let stopped = false;
+  const write = (stream) => {
+    if (!stopped && !stream.destroyed && stream.writable) stream.write(`${Math.floor(valueMs())}
+`);
+  };
+  return {
+    accept(stream) {
+      stream.on("error", () => void 0);
+      open.add(stream);
+      stream.once("close", () => open.delete(stream));
+      queueMicrotask(() => write(stream));
+    },
+    publish() {
+      for (const stream of open) write(stream);
+    },
+    stop() {
+      stopped = true;
+    },
+    close() {
+      for (const stream of [...open]) stream.destroy();
+      open.clear();
+    }
+  };
+}
 
 // src/runner/container/ranges.ts
 var V4 = [
@@ -3071,6 +3358,7 @@ async function startTunnel(socketPath, opts = {}) {
   const extraRefusalKeys = /* @__PURE__ */ new Set();
   let refusalsMore = 0;
   const destinations = [];
+  const routes = /* @__PURE__ */ Object.create(null);
   if (opts.recordPath !== void 0 && existsSync(opts.recordPath)) {
     try {
       const saved = JSON.parse(readFileSync(opts.recordPath, "utf8"));
@@ -3080,6 +3368,7 @@ async function startTunnel(socketPath, opts = {}) {
       }
       hostsMore = saved.hostsMore ?? 0;
       for (const name of saved.destinations ?? []) destinations.push(name);
+      for (const [name, counts] of Object.entries(saved.routes ?? {})) routes[name] = { requests: counts.requests, failures: counts.failures };
       refusalsMore = saved.refusalsMore ?? 0;
       for (const refusal of saved.refusals ?? []) {
         refusals.push(refusal);
@@ -3093,7 +3382,9 @@ async function startTunnel(socketPath, opts = {}) {
     hostsMore,
     refusalsMore,
     refusals: refusals.map((r) => ({ ...r })),
-    destinations: [...destinations]
+    destinations: [...destinations],
+    // Absent until a route is served, so a record of a tunnel that served none is the shape an older runner wrote.
+    ...Object.keys(routes).length === 0 ? {} : { routes: Object.fromEntries(Object.entries(routes).map(([name, counts]) => [name, { ...counts }])) }
   });
   const persist = () => {
     if (opts.recordPath === void 0) return;
@@ -3107,6 +3398,17 @@ async function startTunnel(socketPath, opts = {}) {
     destinations.push(name);
     persist();
   };
+  const routeServed = (name) => {
+    if (routes[name] !== void 0) return;
+    routes[name] = { requests: 0, failures: 0 };
+    persist();
+  };
+  const routeFinished = (name, ok) => {
+    const counts = routes[name] ??= { requests: 0, failures: 0 };
+    counts.requests++;
+    if (!ok) counts.failures++;
+    persist();
+  };
   const reached = (host) => {
     const name = host.toLowerCase();
     if (seen.has(name)) return;
@@ -3332,6 +3634,8 @@ ${body}`);
     socketPath,
     record,
     destinationUsed,
+    routeServed,
+    routeFinished,
     acceptStream: (stream) => void server.emit("connection", stream),
     listener: () => opts.socket === false ? void 0 : server,
     async listenTcp(address) {
@@ -3698,7 +4002,7 @@ async function provisionContainer(input) {
   let services;
   try {
     const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
-    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "stream", input.leaseExpiryMs === void 0 ? void 0 : leaseFor(runtime, buildId, input.leaseExpiryMs));
+    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "stream", input.leaseExpiryMs === void 0 ? void 0 : leaseFor(runtime, buildId, input.leaseExpiryMs), void 0, (line) => log.line(`${tag} ${line}`));
     runtime.tunnels.set(buildId, services);
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
@@ -3794,7 +4098,8 @@ async function provisionContainer(input) {
       return delivered.ok ? delivered : { ok: false, reason: `context_unavailable: ${delivered.reason}` };
     },
     removeStagedContext: () => removeStagedContext(buildDir2),
-    keepIn: jobDir
+    keepIn: jobDir,
+    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {}
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
@@ -3904,7 +4209,7 @@ async function measureDisk(runtime, state) {
     clearTimeout(timer);
   }
 }
-async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote, serve = "socket", lease, inherit) {
+async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote, serve = "socket", lease, inherit, routeLog) {
   return startBuildServices({
     startTunnel: runtime.startTunnel,
     tunnelOptions: { ...runtime.tunnelOptions, ...gitRemote === void 0 ? {} : { gitRemote } },
@@ -3915,6 +4220,7 @@ async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, bui
     serve,
     ...lease === void 0 ? {} : { lease },
     ...inherit === void 0 ? {} : { inherit },
+    ...routeLog === void 0 ? {} : { log: routeLog },
     ...builtIns ? { builtIns: { gatewayUrl: config.url, itemKey, claudeUpstream: runtime.claudeUpstream } } : {},
     hostEnv: runtime.hostEnv,
     destinationOptions: runtime.destinationOptions
@@ -4240,4 +4546,102 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, ROOT_DISK_ID_PREFIX, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, makeBuildsDirPrivate, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startJailedInto, startServicesFor, stopContainer, stopJailed, sweepImageBuilders, syncInContainer, withTunnelLog, writeEvalInput };
+// src/runner/machine.ts
+function groupName(gid) {
+  try {
+    for (const line of readFileSync("/etc/group", "utf8").split("\n")) {
+      const [name, , id] = line.split(":");
+      if (name !== void 0 && Number(id) === gid) return name;
+    }
+  } catch {
+  }
+  return String(gid);
+}
+function detectKvm(device) {
+  if (!existsSync(device)) return { state: "absent" };
+  try {
+    accessSync(device, constants.R_OK | constants.W_OK);
+    return { state: "usable" };
+  } catch {
+    return { state: "no-permission", group: groupName(statSync(device).gid) };
+  }
+}
+function readProcVersion() {
+  try {
+    return readFileSync("/proc/version", "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function docker(args) {
+  const result = spawnSync("docker", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
+  const out = result.status === 0 ? result.stdout.trim() : "";
+  return out === "" ? void 0 : out;
+}
+function dockerFailure() {
+  const result = spawnSync("docker", ["version", "--format", "{{.Server.Version}}"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 });
+  if (result.error?.code === "ENOENT") return void 0;
+  return /permission denied/i.test(result.stderr ?? "") ? "permission" : "daemon";
+}
+function platformOf(probes) {
+  const platform = probes.platform ?? process.platform;
+  if (platform === "win32") return "windows";
+  if (platform === "darwin") return "darwin";
+  if (platform !== "linux") return "other";
+  return /microsoft/i.test((probes.procVersion ?? readProcVersion)() ?? "") ? "wsl2" : "linux";
+}
+function detectMachine(probes = {}) {
+  const platform = platformOf(probes);
+  const kvm = (probes.kvm ?? (() => detectKvm(probes.kvmDevice ?? "/dev/kvm")))();
+  const arch = firecrackerArch(probes.nodeArch ?? process.arch);
+  const inImage = runnerImageVersion(probes.env ?? process.env) !== void 0 ? { inImage: true } : {};
+  const version = (probes.dockerVersion ?? (() => docker(["version", "--format", "{{.Server.Version}}"])))();
+  if (version === void 0) {
+    const failure2 = (probes.dockerFailure ?? (probes.dockerVersion === void 0 ? dockerFailure : () => void 0))();
+    return { platform, ...inImage, docker: failure2 === void 0 ? { kind: "none" } : { kind: "unreachable", reason: failure2 }, kvm, arch };
+  }
+  const system = (probes.dockerOperatingSystem ?? (() => docker(["info", "--format", "{{.OperatingSystem}}"])))() ?? "";
+  return { platform, ...inImage, docker: { kind: /docker desktop/i.test(system) ? "desktop" : "engine", version }, kvm, arch };
+}
+function supportsContainerBuilds(machine) {
+  if (machine.platform !== "linux" && machine.platform !== "wsl2") return false;
+  const { kind, version } = machine.docker;
+  if (kind !== "engine" && !(kind === "desktop" && machine.inImage === true)) return false;
+  return Number.parseInt(version ?? "", 10) >= MIN_ENGINE_MAJOR;
+}
+function supportsMicroVmBuilds(machine) {
+  return machine.platform === "linux" && machine.kvm?.state === "usable" && supportsContainerBuilds(machine) && microVmAssetsPinned(machine);
+}
+function microVmArchSupported(machine) {
+  return MICROVM_ARCHES.includes(machine.arch ?? "");
+}
+function microVmAssetsPinned(machine) {
+  return microVmArchSupported(machine) && guestAssetsPinned(machine.arch);
+}
+function reachDockerStep(machine) {
+  if (machine.docker.kind !== "unreachable") return void 0;
+  return machine.docker.reason === "permission" ? "give this user access to Docker Engine's socket (add it to the docker group, then log in again)" : "start Docker Engine's daemon (for example, sudo systemctl start docker)";
+}
+function describeMachineDocker(machine) {
+  const { kind, version, reason } = machine.docker;
+  const where = machine.platform === "windows" ? "Windows" : machine.platform === "darwin" ? "macOS" : machine.platform === "wsl2" ? "WSL2" : "Linux";
+  if (kind === "desktop") {
+    const engine = version === void 0 ? "" : ` with engine ${version}`;
+    if (machine.inImage === true && (machine.platform === "linux" || machine.platform === "wsl2")) {
+      const major = Number.parseInt(version ?? "", 10);
+      if (Number.isNaN(major)) return `Docker Desktop${engine}, whose engine version is not readable`;
+      if (major < MIN_ENGINE_MAJOR) return `Docker Desktop${engine}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
+      return `Docker Desktop${engine}`;
+    }
+    return `Docker Desktop${engine} on ${where}, which a runner accepts only in the runner image`;
+  }
+  if (kind === "none") return `no Docker on ${where}`;
+  if (kind === "unreachable") {
+    const problem = reason === "permission" ? "this user has no permission on its socket" : "its daemon is not running";
+    return `a docker command on ${where} that cannot reach Docker Engine (${problem})`;
+  }
+  if (machine.platform !== "linux" && machine.platform !== "wsl2") return `Docker Engine ${version ?? ""} on ${where}, which cannot isolate a build`.replace("  ", " ");
+  return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
+}
+
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, describeMachineDocker, detectMachine, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, isPlaceholderCommand, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, makeBuildsDirPrivate, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, reachDockerStep, readConfigObject, resolveAgentUser, runBuildSteps, runRunnerInit, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withTunnelLog, writeEvalInput, writeRunnerInit };