@outerlayer/cli 0.33.0-next.20261023002325 → 0.33.0-next.20261023003700

package/dist/{chunk-LJUIG5K4.js → chunk-3RIFVLPO.js}

@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK } = await import('./build-disk-3GL3KKEB.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-LZSFW2O3.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-JHTMPRAA.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-QXMUWJAQ.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-GRCEYJXA.js');
+    const { runnerHostChecks } = await import('./doctor-GJAHI3KU.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1236,7 +1236,7 @@ async function gatherDoctorChecks() {
     const runner = (() => {
       try {
         const { concurrency, build, housekeeping, managed } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
+        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: build?.cacheDisk ?? DEFAULT_CACHE_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
       } catch {
         return void 0;
       }
@@ -1245,7 +1245,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-DNLXTXLA.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-GQUCHIGE.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-QPA7DQHO.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-QFQC5K4J.js → chunk-7HHNGZS5.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-JRZCRIEO.js';
-import { checkFit } from './chunk-LYE3KB6L.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-XWFSAOC7.js';
-import { builderDiskPinned } from './chunk-TGHBOXKJ.js';
-import { builtinKind, imageBuildOf } from './chunk-3DCB3GOV.js';
+import { placeholderQueues, placeholderProblem } from './chunk-2EGCI2VW.js';
+import { checkFit } from './chunk-HE4FBF4T.js';
+import { builtinKind, imageBuildOf } from './chunk-RQJMN5TJ.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-W2AEL4BJ.js';
+import { builderDiskPinned } from './chunk-NE63JADS.js';
 import { claudeCredentialVariablesSet, claudeCredential } from './chunk-BALIE3BA.js';
 import { closeSync, openSync, constants } from 'fs';
 import { totalmem } from 'os';
@@ -80,12 +80,17 @@ function managedFactsOf(config, probes) {
     builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
   };
 }
-function checkBlocked(config, probes) {
+function keepsHostBuilder(config, builderDiskIsPinned) {
+  return !(builtinKind(config.hooks.provision) === "vm" && imageBuildOf(config) === "vm" && (builderDiskIsPinned ?? builderDiskPinned()));
+}
+function checkBlockedWithSlots(config, probes) {
+  const blocked = (reason) => ({ blocked: { reason } });
+  let slots;
   const placeholders = placeholderQueues(config);
-  if (placeholders.length > 0) return { reason: `${placeholderProblem(placeholders)}. The runner takes work again once the config is edited` };
+  if (placeholders.length > 0) return blocked(`${placeholderProblem(placeholders)}. The runner takes work again once the config is edited`);
   if (config.managed === true) {
     const unmet = managedProblems(managedFactsOf(config, probes))[0];
-    if (unmet !== void 0) return { reason: unmet.reason };
+    if (unmet !== void 0) return blocked(unmet.reason);
   }
   const kind = builtinKind(config.hooks.provision);
   if (kind === "container" || kind === "vm") {
@@ -96,39 +101,46 @@ function checkBlocked(config, probes) {
     });
     if (!fit.fits) {
       const advice = probes.inImage === true ? "Set OUTERLAYER_BUILD_MEMORY or OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more memory" : `Lower runner.concurrency or runner.build.memory in ${config.configPath}`;
-      return { reason: `${fit.message}. ${advice}` };
+      return blocked(`${fit.message}. ${advice}`);
     }
     const facts = probes.buildDisk?.(kind, config.configPath);
     if (facts !== void 0) {
-      const diskFit = checkDiskFit({ concurrency: config.concurrency, buildDisk: config.build?.disk ?? DEFAULT_BUILD_DISK, facts });
-      if (!diskFit.fits) {
-        const advice = probes.inImage === true ? "Set OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more disk" : `Lower runner.concurrency or runner.build.disk in ${config.configPath}`;
-        return { reason: `${diskFit.message}. ${advice}` };
+      const diskFit = checkDiskFit({ concurrency: config.concurrency, buildDisk: config.build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: config.build?.cacheDisk ?? DEFAULT_CACHE_DISK, facts });
+      slots = diskFit.slots;
+      if (diskFit.slots < 1) {
+        const advice = probes.inImage === true ? "Set OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more disk" : `Lower runner.build.disk${kind === "vm" ? " or runner.build.cacheDisk" : ""} in ${config.configPath}, or give the machine more disk`;
+        return { blocked: { reason: `${diskFit.message}. ${advice}` }, slots };
       }
     }
   }
   const kvm = kind === "vm" ? probes.kvm() : "usable";
   if (kvm === "absent") {
-    return { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" };
+    return { blocked: { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" }, slots };
   }
   if (kvm !== "usable") {
     return {
-      reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
+      slots,
+      blocked: {
+        reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
+      }
     };
   }
-  if (kind === "container" || kind === "vm") {
+  if ((kind === "container" || kind === "vm") && keepsHostBuilder(config, probes.builderDiskPinned)) {
     const builder = probes.imageBuilder;
     if (builder === "unknown") {
-      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
+      return { blocked: { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" }, slots };
     }
-    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
+    if (builder !== "usable") return { blocked: { reason: `${builder.problem}. The runner takes work again once its image builder works` }, slots };
   }
   if (kind !== "own" && claudeCredential(probes.env) === void 0) {
     return {
-      reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+      slots,
+      blocked: {
+        reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+      }
     };
   }
-  return void 0;
+  return { slots };
 }
 
-export { checkBlocked, managedFactsOf, managedProblems, realBlockedProbes };
+export { checkBlockedWithSlots, keepsHostBuilder, managedFactsOf, managedProblems, realBlockedProbes };

package/dist/{chunk-YERR22SY.js → chunk-DISTLL2Q.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-LYE3KB6L.js';
+import { DEFAULT_UNIT_NAME } from './chunk-HE4FBF4T.js';
 import { RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { claudeEnvPath, withoutCredentialLines } from './chunk-BALIE3BA.js';
 import { parseRunnerEnv } from './chunk-HACGUL52.js';

package/dist/{chunk-GFVDC5S3.js → chunk-FR7HWWCF.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-3Z3MPR55.js';
-import { BUILDKIT_IMAGE } from './chunk-TGHBOXKJ.js';
-import { parseSize } from './chunk-YJLHUKYS.js';
+import { BUILDKIT_IMAGE } from './chunk-NE63JADS.js';
 import { compareVersions } from './chunk-5DNCFOXA.js';
 import { ensureHostKey } from './chunk-SOI6K5DY.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PA6CK6WQ.js';
@@ -17,6 +16,38 @@ import { createRequire as createRequire$1 } from 'module';
 import { fileURLToPath } from 'url';
 
 createRequire(import.meta.url);
+
+// src/runner/container/disk.ts
+var UNITS = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 };
+function parseSize(text) {
+  const match = /^(\d+(?:\.\d+)?)([kKmMgG]?)$/.exec(text);
+  if (match === null) return void 0;
+  const bytes = Number(match[1]) * UNITS[match[2].toLowerCase()];
+  return bytes > 0 ? bytes : void 0;
+}
+function exceedsDisk(usedKilobytes, limit) {
+  const bytes = parseSize(limit);
+  return usedKilobytes * 1024 > (bytes ?? Number.POSITIVE_INFINITY);
+}
+var TOTAL = /^(\d+)\t\/build$/;
+var GONE = /: No such file or directory$/;
+var LINE_MAX = 200;
+function readDu(result) {
+  const stdoutLines = result.stdout.split("\n");
+  const totalAt = stdoutLines.map((line) => TOTAL.test(line)).lastIndexOf(true);
+  const kib = totalAt === -1 ? void 0 : Number(TOTAL.exec(stdoutLines[totalAt])[1]);
+  const lines2 = [...result.stderr.split("\n"), ...stdoutLines.filter((_, index) => index !== totalAt)].map((line) => line.trim()).filter((line) => line !== "");
+  const other = lines2.find((line) => !GONE.test(line));
+  if (kib !== void 0 && result.status === 0) return { kib };
+  if (kib !== void 0 && other === void 0 && lines2.length > 0) return { kib };
+  const detail = other === void 0 ? "" : `: ${cut(other.replace(/[\u0000-\u001f\u007f]/g, " "))}`;
+  return { ...kib === void 0 ? {} : { kib }, failure: `docker exec exited ${result.status}${detail}` };
+}
+function cut(line) {
+  const head = line.slice(0, LINE_MAX);
+  const last = head.charCodeAt(head.length - 1);
+  return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
+}
 var PACKAGE = "@devcontainers/cli";
 function buildRootFromDist(moduleDir = dirname(fileURLToPath(import.meta.url))) {
   try {
@@ -732,4 +763,4 @@ function ensureBuilder(rawRun, spec, options = {}) {
   );
 }
 
-export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, isOutOfMemory, judgeCommand, parseProgramHash, pathLabelValue, prepareRunArgs, proxyEnvironment, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };
+export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, isOutOfMemory, judgeCommand, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };

package/dist/{chunk-LYE3KB6L.js → chunk-HE4FBF4T.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-3DCB3GOV.js';
-import { parseSize } from './chunk-YJLHUKYS.js';
+import { builtinKind } from './chunk-RQJMN5TJ.js';
+import { parseSize } from './chunk-FR7HWWCF.js';
 import { runnerDir } from './chunk-PA6CK6WQ.js';
 import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-BALIE3BA.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-HACGUL52.js';

package/dist/{chunk-TGHBOXKJ.js → chunk-NE63JADS.js}

@@ -44,10 +44,10 @@ function guestAssetsPinned(arch) {
 var JAILER_BINARY_SHA256 = {
   x86_64: "65ef226e96f0ceda55ba643f445801ef2cc0ea667ef67cad8ac4f406c9c8434f"
 };
-var HOST_HELPER_ASSETS_VERSION = "10";
+var HOST_HELPER_ASSETS_VERSION = "13";
 var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;
 var HOST_HELPER_SHA256 = {
-  x86_64: "caa06b7206cceae6d8fc569781b269817ca66cb2ccfe177740fda042ed46bfcc"
+  x86_64: "0d6cdbce1e5a5e084726b1d1b1cc0bc208f6662fe8d10a1d7a91e8573035505f"
 };
 function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
   return hashes[arch] !== "0".repeat(64);

package/dist/{chunk-DGI66PGY.js → chunk-PWH3BEZF.js}

@@ -6,23 +6,23 @@ import { writeDockerClientConfig } from './chunk-6LBSAW6I.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
 import { senderPidfile } from './chunk-Q2CMEQV7.js';
 import { installScrubContext } from './chunk-2N67C6IV.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JRZCRIEO.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-JPG43G6Y.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-2EGCI2VW.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-YXHKCHWG.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-5THSC6BD.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-L26V6ILJ.js';
 import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-T5REPMNL.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-GFVDC5S3.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TGHBOXKJ.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-3DCB3GOV.js';
-import { parseSize } from './chunk-YJLHUKYS.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-RQJMN5TJ.js';
+import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-W2AEL4BJ.js';
+import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-FR7HWWCF.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-NE63JADS.js';
 import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-VT4TTJPG.js';
 import { planArtifactUpload } from './chunk-EWVYQLD3.js';
 import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PA6CK6WQ.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
 import { resolvePackRoot } from './chunk-G63KT5I5.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -31,8 +31,8 @@ import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-E6CO3MJE
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
-import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
-import { join, isAbsolute, dirname, delimiter, sep } from 'path';
+import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, openSync, readFileSync, closeSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
+import { join, dirname, delimiter, sep } from 'path';
 import { once } from 'events';
 import { createServer } from 'net';
 import { spawn, spawnSync } from 'child_process';
@@ -355,7 +355,7 @@ async function provisionMicroVm(input) {
       inBuilder: {
         kernel: assets.kernel,
         firecracker: assets.firecracker,
-        limits,
+        limits: { ...limits, cacheDiskBytes: parseSize(config.build?.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK) },
         memory: config.build?.memory,
         allowHosts: config.build?.allowHosts,
         managed: config.managed === true,
@@ -1050,7 +1050,7 @@ async function stopBuildMicroVm(runtime, state, jobDir) {
   await runtime.vm.firecracker.stop(state.firecracker);
   if (runtime.vm.firecracker.alive(state.firecracker)) throw new Error(`the microVM (pid ${state.firecracker.pid}) is still running after it was stopped`);
 }
-async function cleanupMicroVm(runtime, state, jobDir, warn) {
+async function cleanupMicroVm(runtime, state, jobDir, warn, onBuildDisk) {
   const failures = [];
   if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
   if (state.jailed !== void 0) {
@@ -1074,6 +1074,13 @@ async function cleanupMicroVm(runtime, state, jobDir, warn) {
       failures.push(`the build's cgroup ${state.cgroup} was not removed: ${describeCallFailure(err)}`);
     }
   }
+  if (state.buildDisk !== void 0 && existsSync(state.buildDisk)) {
+    try {
+      onBuildDisk?.(allocatedBytes(state.buildDisk));
+    } catch (err) {
+      failures.push(`the build disk's peak size was not recorded: ${describeCallFailure(err)}`);
+    }
+  }
   if (state.buildDisk !== void 0) deleteBuildDisk(state.buildDisk);
   runtime.leases.get(state.buildId)?.close();
   runtime.leases.delete(state.buildId);
@@ -1217,263 +1224,6 @@ async function sampleGuest(runtime, state) {
     return void 0;
   }
 }
-function provisionEnvironment(base, input) {
-  return {
-    ...base,
-    OUTERLAYER_BUILD_DIR: input.buildDir,
-    ...input.repository === void 0 || input.repository === null || input.repository === "" ? {} : { OUTERLAYER_REPOSITORY: input.repository },
-    ...input.recipeCommit === void 0 ? {} : { OUTERLAYER_RECIPE_COMMIT: input.recipeCommit },
-    OUTERLAYER_MEMORY: input.limits.memory,
-    OUTERLAYER_CPUS: String(input.limits.cpus),
-    OUTERLAYER_PIDS: String(input.limits.pids),
-    OUTERLAYER_DISK: input.limits.disk
-  };
-}
-function unspecified(address) {
-  if (!address.includes(":")) return address === "0.0.0.0";
-  const normal = new URL(`http://[${address}]/`).hostname;
-  return normal === "[::]" || normal === "[::ffff:0:0]";
-}
-function parseBroker(text2) {
-  const match = /^(?:\[([0-9a-fA-F:.]+)\]|([0-9.]+)):(\d{1,5})$/.exec(text2);
-  if (match === null) return void 0;
-  const host = match[1] ?? match[2];
-  const port = Number(match[3]);
-  if (!isLiteralAddress(host) || unspecified(host) || port < 1 || port > 65535) return void 0;
-  return { host, port, text: text2 };
-}
-function readReport(path) {
-  const named = `provision.out names recipe ${path}`;
-  if (!isAbsolute(path)) return { problem: `${named}, which is not an absolute path` };
-  let text2;
-  try {
-    text2 = readFileSync(path, "utf8");
-  } catch {
-    return { problem: `${named}, which does not exist` };
-  }
-  try {
-    const parsed = JSON.parse(text2);
-    const lifecycle = parsed.apply?.lifecycle;
-    if (typeof parsed.sourceCommit === "string" && typeof parsed.recipeKey === "string" && typeof parsed.imageId === "string" && typeof lifecycle === "object" && lifecycle !== null && Object.values(lifecycle).every((entries) => Array.isArray(entries) && entries.every((entry) => typeof entry === "object" && entry !== null))) {
-      return { report: { ...parsed, ignored: Array.isArray(parsed.ignored) ? parsed.ignored : [] } };
-    }
-  } catch {
-  }
-  return { problem: `${named}, which is not a recipe report` };
-}
-function resolveHostBuild(keys) {
-  const build = { isolation: parseIsolation(keys.isolation) };
-  if (keys.exec !== void 0) {
-    const named = `provision.out names exec ${keys.exec}`;
-    if (!isAbsolute(keys.exec)) return { ok: false, reason: `${named}, which is not an absolute path` };
-    try {
-      if (!statSync(keys.exec).isFile()) return { ok: false, reason: `${named}, which is not an executable file` };
-      accessSync(keys.exec, constants.X_OK);
-    } catch {
-      return { ok: false, reason: `${named}, which is not an executable file` };
-    }
-    build.exec = keys.exec;
-  }
-  if (keys.broker !== void 0) {
-    const broker = parseBroker(keys.broker);
-    if (broker === void 0) {
-      return { ok: false, reason: `provision.out names broker ${keys.broker}, which is not <IP>:<port> with a literal address that is not 0.0.0.0 or ::` };
-    }
-    build.broker = broker;
-  }
-  if (keys.recipe !== void 0) {
-    const read = readReport(keys.recipe);
-    if ("problem" in read) return { ok: false, reason: read.problem };
-    build.recipe = read.report;
-    build.recipePath = keys.recipe;
-  }
-  return { ok: true, build };
-}
-function hostEnvironment(build, cliVersion) {
-  const report = build.recipe;
-  return {
-    isolation: build.isolation,
-    ...report === void 0 ? {} : {
-      recipe: { sourceCommit: report.sourceCommit, key: report.recipeKey, path: report.recipe },
-      imageId: report.imageId,
-      ignoredProperties: report.ignored.map(({ property, source }) => ({ property, source }))
-    },
-    cliVersion
-  };
-}
-var CD_INTO_WORKDIR = 'cd -- "$0" && exec "$@"';
-function execArgv(workdir, argv) {
-  return ["/bin/sh", "-c", CD_INTO_WORKDIR, workdir, ...argv];
-}
-function execCommandLine(exec, workdir, cmdline) {
-  return [exec, ...execArgv(workdir, ["/bin/sh", "-c", cmdline])].map(shellQuote).join(" ");
-}
-function proxyUrlFor(build) {
-  if (build.broker === void 0) return `http://127.0.0.1:${RELAY_PORT}`;
-  return `http://${build.broker}`;
-}
-function withMavenArgs(env, settingsFile, note) {
-  const team = env.MAVEN_ARGS;
-  if (team !== void 0 && namesGlobalSettings(team)) {
-    note?.(MAVEN_NO_PROXY_NOTE);
-    return;
-  }
-  if (settingsFile !== void 0) env.MAVEN_ARGS = mavenArgs(settingsFile, team).value;
-}
-function hostMavenSettings(env, buildDir2, note) {
-  if (/\s/.test(buildDir2)) {
-    note?.(MAVEN_SPACE_NOTE);
-    return void 0;
-  }
-  if (!existsSync(buildDir2)) return void 0;
-  try {
-    return writeMavenSettings(buildDir2, env.HTTPS_PROXY, env.NO_PROXY);
-  } catch (err) {
-    note?.(`the build's Maven settings could not be written, so its Maven gets no proxy from the runner: ${describeCallFailure(err)}`);
-    return void 0;
-  }
-}
-function execProxyEnvironment(build) {
-  const brokerHost = build.broker === void 0 ? void 0 : build.broker.slice(0, build.broker.lastIndexOf(":")).replace(/^\[|\]$/g, "");
-  return proxyEnvironment(proxyUrlFor(build), brokerHost);
-}
-var WRITE_MAVEN_SETTINGS = 'd=$(git rev-parse --absolute-git-dir) || exit 1; d="$d/outerlayer/maven"; mkdir -p "$d" && printf "%s" "$1" > "$d/settings.xml" && printf "%s\\n" "$d/settings.xml"';
-var MAVEN_WRITE_TIMEOUT_MS = 1e4;
-function runWithSpawn(spawnFn = spawn) {
-  return (file, args, env, timeoutMs) => new Promise((resolve) => {
-    let stdout = "";
-    let stderr = "";
-    let timer;
-    let settled = false;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      if (timer !== void 0) clearTimeout(timer);
-      resolve({ status: null, signal: null, stdout, stderr, ...result });
-    };
-    let child;
-    try {
-      child = spawnFn(file, args, { env, stdio: ["ignore", "pipe", "pipe"] });
-    } catch (err) {
-      finish({ error: err instanceof Error ? err : new Error(String(err)) });
-      return;
-    }
-    timer = setTimeout(() => {
-      child.kill("SIGKILL");
-      finish({ error: new Error(`it did not finish in ${timeoutMs / 1e3}s`) });
-    }, timeoutMs);
-    child.stdout?.on("data", (chunk) => {
-      stdout += String(chunk);
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderr += String(chunk);
-    });
-    child.on("error", (err) => finish({ error: err }));
-    child.on("close", (status, signal) => finish({ status, signal }));
-  });
-}
-async function deliverMavenSettings(build, workdir, base, run, timeoutMs = MAVEN_WRITE_TIMEOUT_MS) {
-  if (build.exec === void 0) return { reason: "the build has no exec" };
-  const env = { ...base, ...execProxyEnvironment(build) };
-  const ran = await run(build.exec, execArgv(workdir, ["/bin/sh", "-c", WRITE_MAVEN_SETTINGS, "sh", mavenSettingsXml(env.HTTPS_PROXY, env.NO_PROXY)]), env, timeoutMs);
-  if (ran.error !== void 0) return { reason: describeCallFailure(ran.error) };
-  const said = ran.stderr.trim().split("\n")[0];
-  if (ran.status !== 0) return { reason: `the write exited ${ran.status ?? ran.signal}${said === "" ? "" : `: ${said}`}` };
-  const lines = ran.stdout.trim().split("\n");
-  const path = lines[lines.length - 1].trim();
-  if (!isAbsolute(path)) return { reason: "the write did not report an absolute path" };
-  if (/\s/.test(path)) return { reason: MAVEN_SPACE_REASON };
-  return { path };
-}
-var MAVEN_SPACE_REASON = "the settings file's path has whitespace in it, which Maven cannot read from MAVEN_ARGS";
-async function deliverExecMaven(build, workdir, base, run, note) {
-  if (build?.exec === void 0) return;
-  const delivered = await deliverMavenSettings(build, workdir, base, run);
-  if ("path" in delivered) build.mavenSettings = delivered.path;
-  else note(`the build's Maven gets no proxy from the runner: ${delivered.reason}`);
-}
-function onceNote(write) {
-  const seen = /* @__PURE__ */ new Set();
-  return (line) => {
-    if (seen.has(line)) return;
-    seen.add(line);
-    write(line);
-  };
-}
-function attemptNote(log, tag) {
-  return onceNote((line) => log.line(`${tag} ${line}`));
-}
-function hostCommandEnvironment(base, build, config, hooksPath, note) {
-  let env = { ...base };
-  if (build.exec !== void 0) {
-    Object.assign(env, execProxyEnvironment(build));
-    withMavenArgs(env, build.mavenSettings, note);
-  } else if (build.proxyPort !== void 0) {
-    Object.assign(env, proxyEnvironment(`http://127.0.0.1:${build.proxyPort}`));
-    env.NODE_OPTIONS = withProxyWarningHidden(env.NODE_OPTIONS);
-    withMavenArgs(env, hostMavenSettings(env, build.buildDir, note), note);
-  }
-  const ports = build.destinations ?? [];
-  const portOf = (name) => ports.find((entry) => entry.name === name)?.port;
-  (config.build?.destinations ?? []).forEach((destination, index) => {
-    const port = portOf(destination.name);
-    const address = build.exec !== void 0 ? containerLocalAddress(index) : port === void 0 ? void 0 : `http://127.0.0.1:${port}/`;
-    if (address !== void 0) Object.assign(env, destinationEnvironment([destination], () => address));
-  });
-  if (build.builtIns === true) {
-    const credential = claudeCredential(base);
-    for (const name of CLAUDE_CREDENTIAL_VARIABLES) delete env[name];
-    Object.assign(env, builtInEnvironment((name) => `http://127.0.0.1:${portOf(name) ?? 0}`, credential));
-  }
-  if (build.exec === void 0 && hooksPath !== void 0) env = withHooksPath(env, hooksPath);
-  return env;
-}
-async function startHostServices(input) {
-  const { runtime, config, build } = input;
-  const destinations = config.build?.destinations ?? [];
-  const services = await startBuildServices({
-    startTunnel: runtime.startTunnel,
-    tunnelOptions: runtime.tunnelOptions,
-    buildDir: build.buildDir,
-    jobDir: input.jobDir,
-    destinations,
-    allowHosts: config.build?.allowHosts,
-    serve: input.process ? "tcp" : "both",
-    proxy: input.process,
-    ...input.process ? { builtIns: { gatewayUrl: config.url, itemKey: input.itemKey, claudeUpstream: runtime.claudeUpstream } } : {},
-    ports: {
-      proxy: build.proxyPort,
-      destinations: build.destinations?.filter((d) => !BUILT_IN_NAMES.includes(d.name)).map((d) => d.port),
-      builtIns: Object.fromEntries((build.destinations ?? []).filter((d) => BUILT_IN_NAMES.includes(d.name)).map((d) => [d.name, d.port]))
-    },
-    hostEnv: runtime.hostEnv,
-    destinationOptions: runtime.destinationOptions,
-    ...input.routeLog === void 0 ? {} : { log: input.routeLog }
-  });
-  build.proxyPort = services.proxyPort;
-  build.destinations = [
-    ...destinations.map((destination, index) => ({ name: destination.name, port: services.destinationPorts[index] })),
-    ...Object.entries(services.builtInPorts).map(([name, port]) => ({ name, port }))
-  ];
-  if (input.process) build.builtIns = true;
-  runtime.tunnels.set(build.buildId, services);
-  if (build.broker !== void 0) await listenOnBroker(services, build.broker);
-  return services;
-}
-async function listenOnBroker(tunnel, broker) {
-  const parsed = parseBroker(broker);
-  if (parsed === void 0) throw new Error(`${broker} is not a broker address`);
-  await tunnel.listenTcp({ host: parsed.host, port: parsed.port });
-}
-async function closeHostBuild(runtime, build) {
-  const tunnel = runtime.tunnels.get(build.buildId);
-  if (tunnel !== void 0) {
-    runtime.tunnels.delete(build.buildId);
-    await tunnel.close();
-  }
-  rmSync(build.buildDir, { recursive: true, force: true });
-  if (build.workDir !== void 0) rmSync(build.workDir, { recursive: true, force: true });
-}
 
 // src/runner/verdict.ts
 var VERDICT_SETTLE_MS = 5 * 6e4;
@@ -3336,7 +3086,17 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       let cleanedUp = true;
       tunnelRecord = vmBuild.runtime.tunnels.get(vmBuild.state.buildId)?.record();
       try {
-        await cleanupMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath, (text2) => log.error(`${tag} ${text2}`));
+        await cleanupMicroVm(
+          vmBuild.runtime,
+          vmBuild.state,
+          jobDirPath,
+          (text2) => log.error(`${tag} ${text2}`),
+          (bytes) => {
+            job.buildDiskPeakBytes = bytes;
+            writeJobFile(join(jobDirPath, "job.json"), job);
+            log.line(`${tag} build disk peak ${formatBytes(bytes)}`);
+          }
+        );
       } catch (err) {
         cleanedUp = false;
         log.error(`${tag} cleanup failed: ${describeCallFailure(err)} \xB7 continuing`);
@@ -3787,4 +3547,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, attemptNote, commandLogOffset, deliverCommitHooks, deliverExecMaven, describeHookEnd, execArgv, execCommandLine, finishJob, foldSample, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, runWithSpawn, sampleGuest, serveLease, setStage, startHostServices, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, finishJob, foldSample, hookLimitsFor, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, restartSender, retryFailedReleases, runCommand, runHook, sampleGuest, serveLease, setStage, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-3DCB3GOV.js → chunk-RQJMN5TJ.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize } from './chunk-YJLHUKYS.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-W2AEL4BJ.js';
+import { parseSize } from './chunk-FR7HWWCF.js';
 import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BALIE3BA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
@@ -72,12 +73,12 @@ var DEFAULT_IDLE_LIMIT_MINUTES = 30;
 var DEFAULT_CHECK_TIME_LIMIT_MINUTES = 10;
 var CHECKS_KEYS = ["timeLimitMinutes"];
 var MAX_CHECK_TIME_LIMIT_MINUTES = 240;
-var DEFAULT_BUILD = { memory: "8g", cpus: 4, pids: 4096, disk: "40g", variables: [] };
+var DEFAULT_BUILD = { memory: "8g", cpus: 4, pids: 4096, disk: DEFAULT_BUILD_DISK, cacheDisk: DEFAULT_CACHE_DISK, variables: [] };
 function imageBuildOf(config) {
   if (builtinKind(config.hooks.provision) !== "vm") return "host";
   return config.build?.imageBuild ?? "vm";
 }
-var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts", "imageBuild"];
+var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "cacheDisk", "variables", "destinations", "allowHosts", "imageBuild"];
 var HOUSEKEEPING_KEYS = ["jobsKeepDays", "buildCacheMax", "minFreeDisk"];
 var DEFAULT_JOBS_KEEP_DAYS = 30;
 var DEFAULT_BUILD_CACHE_MAX = "20g";
@@ -404,7 +405,7 @@ function resolveBuild(configPath, block) {
     const near = nearestKey(key, BUILD_KEYS);
     fail(configPath, `runner.build.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
   }
-  for (const key of ["memory", "disk"]) {
+  for (const key of ["memory", "disk", "cacheDisk"]) {
     const value = given[key];
     if (value === void 0) continue;
     if (typeof value !== "string" || parseSize(value) === void 0) fail(configPath, `runner.build.${key}`, 'must be a size such as "8g" or "512m"');
@@ -446,6 +447,7 @@ function resolveBuild(configPath, block) {
     cpus: given.cpus ?? DEFAULT_BUILD.cpus,
     pids: given.pids ?? DEFAULT_BUILD.pids,
     disk: given.disk ?? DEFAULT_BUILD.disk,
+    cacheDisk: given.cacheDisk ?? DEFAULT_BUILD.cacheDisk,
     variables,
     ...destinations.length === 0 ? {} : { destinations },
     ...allowHosts === void 0 ? {} : { allowHosts },