@outerlayer/cli 0.33.0-next.20261022195547 → 0.33.0-next.20261023003700

package/skill-pack/maintained/outerlayer-build/SKILL.md

@@ -350,8 +350,10 @@ A session that names a work item holds a lease on it, and review stays closed
 until the lease is released. In a session this command releases the session's
 own lease and no one else's. A later tool call takes the lease again, so write
 the final report as plain text once this has run. Skip this step in a runner
-build, whose host releases its own lease. Then end the run with the final
-report. The report lists:
+build, whose host releases its own lease. A runner build is one whose
+command environment sets `OUTERLAYER_JOB_DIR`. When that variable is set, skip
+the command above: the gateway refuses it from a runner build. Then end the run
+with the final report. The report lists:
 
 - every candidate issue and every assumption;
 - the team's changes applied, by phase, and each overlap between a change and

package/dist/build-disk-6QAXMA2J.js

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-P5FC7VUO.js';
-import './chunk-YYYRBYWG.js';
-import './chunk-43PV5KDB.js';
-import './chunk-3Z3MPR55.js';
-import './chunk-TGHBOXKJ.js';
-import './chunk-YJLHUKYS.js';
-import './chunk-5DNCFOXA.js';
-import './chunk-AA6LYZC4.js';
-import './chunk-AGZNCIIJ.js';
-import './chunk-BCCI32ME.js';
-import './chunk-E6CO3MJE.js';
-import './chunk-HACGUL52.js';
-import './chunk-MESOOLF4.js';
-import './chunk-Z5GEFMRW.js';
-
-createRequire(import.meta.url);

package/dist/chunk-DNKUSXQU.js

@@ -1,241 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-WBZJWVT2.js';
-import { describeCallFailure } from './chunk-RBJG5MM4.js';
-import { checkFit } from './chunk-ZRRUWNJS.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-P5FC7VUO.js';
-import { builderDiskPinned } from './chunk-TGHBOXKJ.js';
-import { builtinKind, imageBuildOf } from './chunk-5BNWAIHN.js';
-import { WorkCommandError, getJson } from './chunk-CMKY36NV.js';
-import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
-import { signerFor } from './chunk-AA6LYZC4.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-BCCI32ME.js';
-import { closeSync, openSync, constants } from 'fs';
-import { totalmem } from 'os';
-
-createRequire(import.meta.url);
-
-// src/runner/host-setup.ts
-function placeholderQueues(config) {
-  return config.queues.filter((queue) => {
-    const command = config.commands[queue];
-    return command !== void 0 && isPlaceholderCommand(command);
-  });
-}
-function placeholderProblem(queues) {
-  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
-  return `${keys} ${queues.length === 1 ? "is" : "are"} still the placeholder \`runner init\` wrote, which fails every item. Edit ${queues.length === 1 ? "it" : "them"} to start your agent on item $OUTERLAYER_WORK`;
-}
-var CLAUDE_PERMISSION_MODES = ["acceptEdits", "auto", "bypassPermissions", "default", "dontAsk", "manual", "plan"];
-var CLAUDE_COMMAND = /(?:^|[;&|(])\s*(?:(?:exec|env|nohup|time)\s+)*(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:\S*\/)?claude\s/;
-var PERMISSION_MODE_FLAG = /--permission-mode(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s;&|()]+))/g;
-function permissionModeProblems(config) {
-  const problems = [];
-  for (const queue of config.queues) {
-    const command = config.commands[queue];
-    if (command === void 0 || !CLAUDE_COMMAND.test(command)) continue;
-    for (const match of command.matchAll(PERMISSION_MODE_FLAG)) {
-      const value = match[1] ?? match[2] ?? match[3] ?? "";
-      if (value.includes("$") || value.includes("`") || CLAUDE_PERMISSION_MODES.includes(value)) continue;
-      problems.push({ queue, command, value });
-    }
-  }
-  return problems;
-}
-function permissionModeProblem(problems) {
-  return problems.map(({ queue, command, value }) => `runner.commands.${queue} is \`${command}\`, and \`${value}\` is not a permission mode Claude Code accepts (${CLAUDE_PERMISSION_MODES.join(", ")}). The command would fail only when a build ran it`).join(". ");
-}
-var FORMER_AMEND_COMMAND = /(^|["'\s])\/amend(?=["'\s]|$)/g;
-function currentSkillCommand(command) {
-  return command.replace(FORMER_AMEND_COMMAND, "$1/outerlayer-amend");
-}
-function formerSkillQueues(config) {
-  return config.queues.filter((queue) => {
-    const command = config.commands[queue];
-    return command !== void 0 && currentSkillCommand(command) !== command;
-  });
-}
-function formerSkillProblem(queues) {
-  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
-  return `${keys} ${queues.length === 1 ? "starts" : "start"} /amend, which is now /outerlayer-amend. The runner runs /outerlayer-amend in its place; edit the config to say so`;
-}
-function needsClaudeCredential(hooks) {
-  return builtinKind(hooks.provision) !== "own";
-}
-var CREDENTIAL_FIX = "Run `claude setup-token`, then pipe the token it prints (or an Anthropic API key) to `outerlayer runner init --agent claude`, which stores it in the claude.env beside the config. Or start the runner with CLAUDE_CODE_OAUTH_TOKEN (or ANTHROPIC_API_KEY) set";
-function claudeCredentialCheck(env, options = {}) {
-  const name = "Claude credential";
-  if (options.service !== void 0) {
-    const { unit, variables } = options.service;
-    if (variables.length === 0) {
-      return {
-        name,
-        status: "fail",
-        detail: `the service ${unit} has no Claude credential: neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set in its claude.env or runner.env, so every build fails at provision as agent_credential_missing`,
-        fix: `${CREDENTIAL_FIX}, then restart the service: sudo systemctl restart ${unit}.`
-      };
-    }
-    return { name, status: "pass", detail: `${variables[0]} is set in the claude.env or runner.env of the service ${unit}` };
-  }
-  const held = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
-  if (held === void 0) {
-    return {
-      name,
-      status: "fail",
-      detail: `neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set, so every build fails at provision as agent_credential_missing`,
-      fix: `${CREDENTIAL_FIX}.`
-    };
-  }
-  const sameVariables = options.shell === true ? "; the runner must be started with the same variable" : "";
-  return { name, status: "pass", detail: `${held.variable} is set${sameVariables}` };
-}
-function missingPermissionOf(err) {
-  if (!(err instanceof WorkCommandError) || err.status !== 403) return void 0;
-  const permission = /missing required permission '([^']+)'/i.exec(err.message)?.[1];
-  return permission === void 0 ? void 0 : sanitizeTerminal(permission);
-}
-function missingPermissionFix(permission) {
-  return `use a key that holds ${permission}: create one with the Runner preset on the factory's API keys page, then run \`outerlayer login\` with it`;
-}
-async function claimPermissionProblem(config, fetchImpl = fetch) {
-  const unverified = (what, err) => ({
-    status: "unverified",
-    reason: sanitizeTerminal(`${what}: ${err instanceof Error ? describeCallFailure(err) : String(err)}`)
-  });
-  let signer;
-  try {
-    signer = await signerFor(config.configPath);
-  } catch (err) {
-    return unverified("this host's key could not be read, so whether the runner key can claim work was not checked", err);
-  }
-  try {
-    await getJson(config.url, "/v1/runner/host-key", config.apiKey, config.appId, fetchImpl, signer);
-    return { status: "ok" };
-  } catch (err) {
-    const permission = missingPermissionOf(err);
-    if (permission === void 0) return unverified("the host-key call did not say whether the runner key can claim work", err);
-    return { status: "lacks", problem: `the runner key lacks ${permission}, which a runner needs to claim work: ${missingPermissionFix(permission)}` };
-  }
-}
-function openKvm() {
-  try {
-    closeSync(openSync("/dev/kvm", constants.O_RDWR));
-    return "usable";
-  } catch (err) {
-    return err.code === "ENOENT" ? "absent" : "no-permission";
-  }
-}
-var sharedBuildDisk;
-function realBlockedProbes() {
-  sharedBuildDisk ??= realBuildDiskProbe();
-  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown", buildDisk: sharedBuildDisk };
-}
-var DEFAULT_BUILD_MEMORY = "8g";
-function managedProblems(facts) {
-  const problems = [];
-  if (builtinKind(facts.provision) !== "vm") {
-    problems.push({
-      condition: "jailer",
-      reason: `a managed runner needs builtin:vm hooks, and runner.hooks.provision is ${facts.provision}. Without them builds would run without the jailer. Set runner.hooks.provision and runner.hooks.cleanup to builtin:vm`
-    });
-  } else if (facts.jailer === "usable") ; else if (facts.jailer === "unknown") {
-    problems.push({ condition: "jailer", reason: "the runner has not yet asked the root helper whether builds run under the jailer, so builds would run without the jailer until it answers" });
-  } else {
-    const { problem } = facts.jailer;
-    const advice = problem.includes("pins no helper") || problem.includes("runner install") ? "" : ". Run `outerlayer runner install --service --replace` to install the root helper, then restart the service";
-    problems.push({ condition: "jailer", reason: `builds would run without the jailer, which a managed runner does not allow: ${problem}${advice}` });
-  }
-  if (facts.credentials.has("CLAUDE_CODE_OAUTH_TOKEN")) {
-    problems.push({
-      condition: "credential",
-      reason: "CLAUDE_CODE_OAUTH_TOKEN is set in the runner's environment or credentials directory, and a managed runner accepts only ANTHROPIC_API_KEY. Remove CLAUDE_CODE_OAUTH_TOKEN from the claude.env and runner.env beside the config, store ANTHROPIC_API_KEY, then restart the service"
-    });
-  } else if (!facts.credentials.has("ANTHROPIC_API_KEY")) {
-    problems.push({
-      condition: "credential",
-      reason: "there is no Claude credential in the runner's environment, and a managed runner needs ANTHROPIC_API_KEY. Store ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
-    });
-  }
-  if (facts.allowHosts === void 0) {
-    problems.push({
-      condition: "allowHosts",
-      reason: "runner.build.allowHosts is not set, and a managed runner needs it so that a build reaches only the public hosts it lists. List the hosts your builds need; an empty list allows none"
-    });
-  }
-  if (builtinKind(facts.provision) === "vm") {
-    if (facts.imageBuild === "host") {
-      problems.push({
-        condition: "imageBuild",
-        reason: "runner.build.imageBuild is host, and a managed runner builds its images in a builder microVM, because a recipe step on the host could reach the host's own services and network. Remove runner.build.imageBuild or set it to vm"
-      });
-    } else if (!facts.builderDiskPinned) {
-      problems.push({
-        condition: "imageBuild",
-        reason: "this release of the CLI pins no builder root disk, so it cannot build images in a builder microVM, which a managed runner needs for runner.build.imageBuild. Update the CLI to a release that pins one"
-      });
-    }
-  }
-  return problems;
-}
-function managedFactsOf(config, probes) {
-  return {
-    provision: config.hooks.provision,
-    jailer: probes.jailer ?? "unknown",
-    credentials: claudeCredentialVariablesSet(probes.env),
-    allowHosts: config.build?.allowHosts,
-    imageBuild: imageBuildOf(config),
-    builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
-  };
-}
-function checkBlocked(config, probes) {
-  const placeholders = placeholderQueues(config);
-  if (placeholders.length > 0) return { reason: `${placeholderProblem(placeholders)}. The runner takes work again once the config is edited` };
-  if (config.managed === true) {
-    const unmet = managedProblems(managedFactsOf(config, probes))[0];
-    if (unmet !== void 0) return { reason: unmet.reason };
-  }
-  const kind = builtinKind(config.hooks.provision);
-  if (kind === "container" || kind === "vm") {
-    const fit = checkFit({
-      concurrency: config.concurrency,
-      buildMemory: config.build?.memory ?? DEFAULT_BUILD_MEMORY,
-      usableBytes: probes.totalMemoryBytes()
-    });
-    if (!fit.fits) {
-      const advice = probes.inImage === true ? "Set OUTERLAYER_BUILD_MEMORY or OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more memory" : `Lower runner.concurrency or runner.build.memory in ${config.configPath}`;
-      return { reason: `${fit.message}. ${advice}` };
-    }
-    const facts = probes.buildDisk?.(kind, config.configPath);
-    if (facts !== void 0) {
-      const diskFit = checkDiskFit({ concurrency: config.concurrency, buildDisk: config.build?.disk ?? DEFAULT_BUILD_DISK, facts });
-      if (!diskFit.fits) {
-        const advice = probes.inImage === true ? "Set OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more disk" : `Lower runner.concurrency or runner.build.disk in ${config.configPath}`;
-        return { reason: `${diskFit.message}. ${advice}` };
-      }
-    }
-  }
-  const kvm = kind === "vm" ? probes.kvm() : "usable";
-  if (kvm === "absent") {
-    return { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" };
-  }
-  if (kvm !== "usable") {
-    return {
-      reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
-    };
-  }
-  if (kind === "container" || kind === "vm") {
-    const builder = probes.imageBuilder;
-    if (builder === "unknown") {
-      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
-    }
-    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
-  }
-  if (kind !== "own" && claudeCredential(probes.env) === void 0) {
-    return {
-      reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
-    };
-  }
-  return void 0;
-}
-
-export { checkBlocked, claimPermissionProblem, claudeCredentialCheck, currentSkillCommand, formerSkillProblem, formerSkillQueues, managedFactsOf, managedProblems, missingPermissionFix, missingPermissionOf, needsClaudeCredential, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, realBlockedProbes };

package/dist/chunk-I5LGKZ4M.js

@@ -1,107 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-D3HRAPNF.js';
-import { runnerImageVersion } from './chunk-SK4TWCN3.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-TGHBOXKJ.js';
-import { spawnSync } from 'child_process';
-import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
-
-createRequire(import.meta.url);
-function groupName(gid) {
-  try {
-    for (const line of readFileSync("/etc/group", "utf8").split("\n")) {
-      const [name, , id] = line.split(":");
-      if (name !== void 0 && Number(id) === gid) return name;
-    }
-  } catch {
-  }
-  return String(gid);
-}
-function detectKvm(device) {
-  if (!existsSync(device)) return { state: "absent" };
-  try {
-    accessSync(device, constants.R_OK | constants.W_OK);
-    return { state: "usable" };
-  } catch {
-    return { state: "no-permission", group: groupName(statSync(device).gid) };
-  }
-}
-function readProcVersion() {
-  try {
-    return readFileSync("/proc/version", "utf8");
-  } catch {
-    return void 0;
-  }
-}
-function docker(args) {
-  const result = spawnSync("docker", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
-  const out = result.status === 0 ? result.stdout.trim() : "";
-  return out === "" ? void 0 : out;
-}
-function dockerFailure() {
-  const result = spawnSync("docker", ["version", "--format", "{{.Server.Version}}"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 });
-  if (result.error?.code === "ENOENT") return void 0;
-  return /permission denied/i.test(result.stderr ?? "") ? "permission" : "daemon";
-}
-function platformOf(probes) {
-  const platform = probes.platform ?? process.platform;
-  if (platform === "win32") return "windows";
-  if (platform === "darwin") return "darwin";
-  if (platform !== "linux") return "other";
-  return /microsoft/i.test((probes.procVersion ?? readProcVersion)() ?? "") ? "wsl2" : "linux";
-}
-function detectMachine(probes = {}) {
-  const platform = platformOf(probes);
-  const kvm = (probes.kvm ?? (() => detectKvm(probes.kvmDevice ?? "/dev/kvm")))();
-  const arch = firecrackerArch(probes.nodeArch ?? process.arch);
-  const inImage = runnerImageVersion(probes.env ?? process.env) !== void 0 ? { inImage: true } : {};
-  const version = (probes.dockerVersion ?? (() => docker(["version", "--format", "{{.Server.Version}}"])))();
-  if (version === void 0) {
-    const failure = (probes.dockerFailure ?? (probes.dockerVersion === void 0 ? dockerFailure : () => void 0))();
-    return { platform, ...inImage, docker: failure === void 0 ? { kind: "none" } : { kind: "unreachable", reason: failure }, kvm, arch };
-  }
-  const system = (probes.dockerOperatingSystem ?? (() => docker(["info", "--format", "{{.OperatingSystem}}"])))() ?? "";
-  return { platform, ...inImage, docker: { kind: /docker desktop/i.test(system) ? "desktop" : "engine", version }, kvm, arch };
-}
-function supportsContainerBuilds(machine) {
-  if (machine.platform !== "linux" && machine.platform !== "wsl2") return false;
-  const { kind, version } = machine.docker;
-  if (kind !== "engine" && !(kind === "desktop" && machine.inImage === true)) return false;
-  return Number.parseInt(version ?? "", 10) >= MIN_ENGINE_MAJOR;
-}
-function supportsMicroVmBuilds(machine) {
-  return machine.platform === "linux" && machine.kvm?.state === "usable" && supportsContainerBuilds(machine) && microVmAssetsPinned(machine);
-}
-function microVmArchSupported(machine) {
-  return MICROVM_ARCHES.includes(machine.arch ?? "");
-}
-function microVmAssetsPinned(machine) {
-  return microVmArchSupported(machine) && guestAssetsPinned(machine.arch);
-}
-function reachDockerStep(machine) {
-  if (machine.docker.kind !== "unreachable") return void 0;
-  return machine.docker.reason === "permission" ? "give this user access to Docker Engine's socket (add it to the docker group, then log in again)" : "start Docker Engine's daemon (for example, sudo systemctl start docker)";
-}
-function describeMachineDocker(machine) {
-  const { kind, version, reason } = machine.docker;
-  const where = machine.platform === "windows" ? "Windows" : machine.platform === "darwin" ? "macOS" : machine.platform === "wsl2" ? "WSL2" : "Linux";
-  if (kind === "desktop") {
-    const engine = version === void 0 ? "" : ` with engine ${version}`;
-    if (machine.inImage === true && (machine.platform === "linux" || machine.platform === "wsl2")) {
-      const major = Number.parseInt(version ?? "", 10);
-      if (Number.isNaN(major)) return `Docker Desktop${engine}, whose engine version is not readable`;
-      if (major < MIN_ENGINE_MAJOR) return `Docker Desktop${engine}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
-      return `Docker Desktop${engine}`;
-    }
-    return `Docker Desktop${engine} on ${where}, which a runner accepts only in the runner image`;
-  }
-  if (kind === "none") return `no Docker on ${where}`;
-  if (kind === "unreachable") {
-    const problem = reason === "permission" ? "this user has no permission on its socket" : "its daemon is not running";
-    return `a docker command on ${where} that cannot reach Docker Engine (${problem})`;
-  }
-  if (machine.platform !== "linux" && machine.platform !== "wsl2") return `Docker Engine ${version ?? ""} on ${where}, which cannot isolate a build`.replace("  ", " ");
-  return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
-}
-
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds };

package/dist/chunk-P5FC7VUO.js

@@ -1,111 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { formatBytes, freeBytes } from './chunk-YYYRBYWG.js';
-import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-43PV5KDB.js';
-import { parseSize } from './chunk-YJLHUKYS.js';
-import { buildsDir, rootfsDir, runnerDir } from './chunk-AGZNCIIJ.js';
-import { spawnSync } from 'child_process';
-import { existsSync, statSync, readdirSync } from 'fs';
-import { join } from 'path';
-
-createRequire(import.meta.url);
-function checkDiskFit(input) {
-  const limit = parseSize(input.buildDisk);
-  if (limit === void 0) return { fits: true };
-  const { freeBytes: free, heldBytes: held, rootDiskBytes: root } = input.facts;
-  const neededBytes = input.concurrency * (limit + root);
-  const availableBytes = free + held;
-  if (neededBytes <= availableBytes) return { fits: true };
-  const oneBuild = root > 0 ? `runner.build.disk ${input.buildDisk} plus a root disk of ${formatBytes(root)}` : `runner.build.disk ${input.buildDisk}`;
-  return {
-    fits: false,
-    neededBytes,
-    availableBytes,
-    message: `the builds' disks do not fit: runner.concurrency ${input.concurrency} times the space one build can hold (${oneBuild}) needs ${formatBytes(neededBytes)}, and ${formatBytes(availableBytes)} is available (${formatBytes(free)} free plus ${formatBytes(held)} held by running builds)`
-  };
-}
-function allocatedBytes(path) {
-  try {
-    return statSync(path).blocks * 512;
-  } catch {
-    return 0;
-  }
-}
-function listDir(path) {
-  try {
-    return readdirSync(path);
-  } catch {
-    return void 0;
-  }
-}
-function microVmFacts(configPath) {
-  const builds = buildsDir(configPath);
-  const free = freeBytes(builds);
-  if (free === void 0) return void 0;
-  let held = 0;
-  if (existsSync(builds)) {
-    const entries = listDir(builds);
-    if (entries === void 0) return void 0;
-    for (const entry of entries) held += allocatedBytes(join(builds, entry, "build.ext4"));
-  }
-  let root = 0;
-  const roots = rootfsDir(runnerDir(configPath));
-  if (existsSync(roots)) {
-    const entries = listDir(roots);
-    if (entries === void 0) return void 0;
-    for (const entry of entries) {
-      if (!entry.endsWith(".ext4")) continue;
-      try {
-        root = Math.max(root, statSync(join(roots, entry)).size);
-      } catch {
-      }
-    }
-  }
-  return { freeBytes: free, heldBytes: held, rootDiskBytes: root };
-}
-var DOCKER_TIMEOUT_MS = 1e4;
-var DEFAULT_BUILD_DISK = "40g";
-var DOCKER_CACHE_MS = 6e4;
-var DEFAULT_VOLUMES_DIR = "/var/lib/docker/volumes";
-function runDocker(args, spawn = spawnSync) {
-  const result = spawn("docker", args, { encoding: "utf8", timeout: DOCKER_TIMEOUT_MS });
-  return result.status === 0 ? result.stdout : void 0;
-}
-var SIZE_UNITS = { b: 1, kb: 1e3, mb: 1e6, gb: 1e9, tb: 1e12 };
-function volumeBytes(dfOutput, names) {
-  let total = 0;
-  for (const line of dfOutput.split("\n")) {
-    const [name, , size] = line.trim().split(/\s+/);
-    if (name === void 0 || size === void 0 || !names.has(name)) continue;
-    const match = /^([\d.]+)([A-Za-z]+)$/.exec(size);
-    const unit = match === null ? void 0 : SIZE_UNITS[match[2].toLowerCase()];
-    if (match !== null && unit !== void 0) total += Number(match[1]) * unit;
-  }
-  return total;
-}
-function containerFacts(cache, configPath, docker, now) {
-  if (cache.reading === void 0 || cache.reading.configPath !== configPath || now - cache.reading.at > DOCKER_CACHE_MS) {
-    const root = docker(["info", "--format", "{{.DockerRootDir}}"])?.trim();
-    const listed = docker(["volume", "ls", "--quiet", "--filter", `label=${BUILD_LABEL}`, "--filter", `label=${RUNNER_LABEL}=${runnerLabelValue(configPath)}`]);
-    const names = new Set((listed ?? "").split("\n").map((n) => n.trim()).filter((n) => n !== ""));
-    const df = listed === void 0 || names.size === 0 ? void 0 : docker(["system", "df", "-v"]);
-    const held = listed === void 0 ? void 0 : names.size === 0 ? 0 : df === void 0 ? void 0 : volumeBytes(df, names);
-    cache.reading = {
-      at: now,
-      configPath,
-      held,
-      volumes: root === void 0 || root === "" ? DEFAULT_VOLUMES_DIR : join(root, "volumes")
-    };
-  }
-  if (cache.reading.held === void 0) return void 0;
-  const free = freeBytes(cache.reading.volumes);
-  return free === void 0 ? void 0 : { freeBytes: free, heldBytes: cache.reading.held, rootDiskBytes: 0 };
-}
-function realBuildDiskProbe(deps = {}) {
-  const cache = {};
-  const docker = deps.docker ?? ((args) => runDocker(args));
-  const now = deps.now ?? Date.now;
-  return (kind, configPath) => kind === "vm" ? microVmFacts(configPath) : containerFacts(cache, configPath, docker, now());
-}
-
-export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes };

package/dist/chunk-UXYLWVTQ.js

@@ -1,43 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-
-createRequire(import.meta.url);
-
-// src/runner/allow-hosts.ts
-var MAX_ALLOW_HOSTS = 500;
-var LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
-var IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
-function isAddress(text) {
-  if (IPV4.test(text)) return true;
-  try {
-    new URL(`http://[${text}]/`);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isHostName(text) {
-  const labels = text.split(".");
-  return text.length <= 253 && labels.every((label) => LABEL.test(label)) && !/^\d+$/.test(labels.at(-1));
-}
-function allowHostProblem(entry) {
-  if (typeof entry !== "string") return "is not a string";
-  const text = entry.toLowerCase();
-  if (isAddress(text)) return void 0;
-  if (text.startsWith("*.")) {
-    const domain = text.slice(2);
-    if (!isHostName(domain)) return "is not a host name after *.";
-    if (!domain.includes(".")) return "is too broad: a pattern needs a domain with at least two labels after *.";
-    return void 0;
-  }
-  return isHostName(text) ? void 0 : "is not a host name, a *. pattern or an IP address";
-}
-function hostAllowed(host, allowHosts) {
-  const name = host.toLowerCase().replace(/\.$/, "");
-  return allowHosts.some((entry) => {
-    const pattern = entry.toLowerCase();
-    return pattern.startsWith("*.") ? name.endsWith(pattern.slice(1)) : name === pattern;
-  });
-}
-
-export { MAX_ALLOW_HOSTS, allowHostProblem, hostAllowed };