@outerlayer/cli 0.33.0-next.20261023002325 → 0.33.0-next.20261023030517

package/dist/{chunk-DGI66PGY.js → chunk-AXIK6F52.js}

@@ -4,35 +4,35 @@ import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HVRQQOMH.js';
 import { writeDockerClientConfig } from './chunk-6LBSAW6I.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-Q2CMEQV7.js';
-import { installScrubContext } from './chunk-2N67C6IV.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JRZCRIEO.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-JPG43G6Y.js';
+import { senderPidfile } from './chunk-4NKHOCTF.js';
+import { installScrubContext } from './chunk-T4S2DVOA.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-GFTWZSOW.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-YXHKCHWG.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-5THSC6BD.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-L26V6ILJ.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-T5REPMNL.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-GFVDC5S3.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TGHBOXKJ.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-3DCB3GOV.js';
-import { parseSize } from './chunk-YJLHUKYS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-VT4TTJPG.js';
-import { planArtifactUpload } from './chunk-EWVYQLD3.js';
-import { scrubText } from './chunk-5DNCFOXA.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-Z4GLZTDF.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ONUACB5C.js';
+import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-LHKWWEQZ.js';
+import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-QKEOAQ2W.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-NE63JADS.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-5FSVA3CO.js';
+import { planArtifactUpload } from './chunk-E4F7YE7P.js';
+import { scrubText } from './chunk-QQXNS4G2.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PA6CK6WQ.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
-import { resolvePackRoot } from './chunk-G63KT5I5.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
+import { resolvePackRoot } from './chunk-M24H6JQW.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { parsePolicy } from './chunk-LJG6EMLJ.js';
-import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-E6CO3MJE.js';
+import { parsePolicy } from './chunk-PNIFQX73.js';
+import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-V7Q5OKN7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
-import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
-import { join, isAbsolute, dirname, delimiter, sep } from 'path';
+import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, openSync, readFileSync, closeSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
+import { join, dirname, delimiter, sep } from 'path';
 import { once } from 'events';
 import { createServer } from 'net';
 import { spawn, spawnSync } from 'child_process';
@@ -355,7 +355,7 @@ async function provisionMicroVm(input) {
       inBuilder: {
         kernel: assets.kernel,
         firecracker: assets.firecracker,
-        limits,
+        limits: { ...limits, cacheDiskBytes: parseSize(config.build?.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK) },
         memory: config.build?.memory,
         allowHosts: config.build?.allowHosts,
         managed: config.managed === true,
@@ -1050,7 +1050,7 @@ async function stopBuildMicroVm(runtime, state, jobDir) {
   await runtime.vm.firecracker.stop(state.firecracker);
   if (runtime.vm.firecracker.alive(state.firecracker)) throw new Error(`the microVM (pid ${state.firecracker.pid}) is still running after it was stopped`);
 }
-async function cleanupMicroVm(runtime, state, jobDir, warn) {
+async function cleanupMicroVm(runtime, state, jobDir, warn, onBuildDisk) {
   const failures = [];
   if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
   if (state.jailed !== void 0) {
@@ -1074,6 +1074,13 @@ async function cleanupMicroVm(runtime, state, jobDir, warn) {
       failures.push(`the build's cgroup ${state.cgroup} was not removed: ${describeCallFailure(err)}`);
     }
   }
+  if (state.buildDisk !== void 0 && existsSync(state.buildDisk)) {
+    try {
+      onBuildDisk?.(allocatedBytes(state.buildDisk));
+    } catch (err) {
+      failures.push(`the build disk's peak size was not recorded: ${describeCallFailure(err)}`);
+    }
+  }
   if (state.buildDisk !== void 0) deleteBuildDisk(state.buildDisk);
   runtime.leases.get(state.buildId)?.close();
   runtime.leases.delete(state.buildId);
@@ -1217,263 +1224,6 @@ async function sampleGuest(runtime, state) {
     return void 0;
   }
 }
-function provisionEnvironment(base, input) {
-  return {
-    ...base,
-    OUTERLAYER_BUILD_DIR: input.buildDir,
-    ...input.repository === void 0 || input.repository === null || input.repository === "" ? {} : { OUTERLAYER_REPOSITORY: input.repository },
-    ...input.recipeCommit === void 0 ? {} : { OUTERLAYER_RECIPE_COMMIT: input.recipeCommit },
-    OUTERLAYER_MEMORY: input.limits.memory,
-    OUTERLAYER_CPUS: String(input.limits.cpus),
-    OUTERLAYER_PIDS: String(input.limits.pids),
-    OUTERLAYER_DISK: input.limits.disk
-  };
-}
-function unspecified(address) {
-  if (!address.includes(":")) return address === "0.0.0.0";
-  const normal = new URL(`http://[${address}]/`).hostname;
-  return normal === "[::]" || normal === "[::ffff:0:0]";
-}
-function parseBroker(text2) {
-  const match = /^(?:\[([0-9a-fA-F:.]+)\]|([0-9.]+)):(\d{1,5})$/.exec(text2);
-  if (match === null) return void 0;
-  const host = match[1] ?? match[2];
-  const port = Number(match[3]);
-  if (!isLiteralAddress(host) || unspecified(host) || port < 1 || port > 65535) return void 0;
-  return { host, port, text: text2 };
-}
-function readReport(path) {
-  const named = `provision.out names recipe ${path}`;
-  if (!isAbsolute(path)) return { problem: `${named}, which is not an absolute path` };
-  let text2;
-  try {
-    text2 = readFileSync(path, "utf8");
-  } catch {
-    return { problem: `${named}, which does not exist` };
-  }
-  try {
-    const parsed = JSON.parse(text2);
-    const lifecycle = parsed.apply?.lifecycle;
-    if (typeof parsed.sourceCommit === "string" && typeof parsed.recipeKey === "string" && typeof parsed.imageId === "string" && typeof lifecycle === "object" && lifecycle !== null && Object.values(lifecycle).every((entries) => Array.isArray(entries) && entries.every((entry) => typeof entry === "object" && entry !== null))) {
-      return { report: { ...parsed, ignored: Array.isArray(parsed.ignored) ? parsed.ignored : [] } };
-    }
-  } catch {
-  }
-  return { problem: `${named}, which is not a recipe report` };
-}
-function resolveHostBuild(keys) {
-  const build = { isolation: parseIsolation(keys.isolation) };
-  if (keys.exec !== void 0) {
-    const named = `provision.out names exec ${keys.exec}`;
-    if (!isAbsolute(keys.exec)) return { ok: false, reason: `${named}, which is not an absolute path` };
-    try {
-      if (!statSync(keys.exec).isFile()) return { ok: false, reason: `${named}, which is not an executable file` };
-      accessSync(keys.exec, constants.X_OK);
-    } catch {
-      return { ok: false, reason: `${named}, which is not an executable file` };
-    }
-    build.exec = keys.exec;
-  }
-  if (keys.broker !== void 0) {
-    const broker = parseBroker(keys.broker);
-    if (broker === void 0) {
-      return { ok: false, reason: `provision.out names broker ${keys.broker}, which is not <IP>:<port> with a literal address that is not 0.0.0.0 or ::` };
-    }
-    build.broker = broker;
-  }
-  if (keys.recipe !== void 0) {
-    const read = readReport(keys.recipe);
-    if ("problem" in read) return { ok: false, reason: read.problem };
-    build.recipe = read.report;
-    build.recipePath = keys.recipe;
-  }
-  return { ok: true, build };
-}
-function hostEnvironment(build, cliVersion) {
-  const report = build.recipe;
-  return {
-    isolation: build.isolation,
-    ...report === void 0 ? {} : {
-      recipe: { sourceCommit: report.sourceCommit, key: report.recipeKey, path: report.recipe },
-      imageId: report.imageId,
-      ignoredProperties: report.ignored.map(({ property, source }) => ({ property, source }))
-    },
-    cliVersion
-  };
-}
-var CD_INTO_WORKDIR = 'cd -- "$0" && exec "$@"';
-function execArgv(workdir, argv) {
-  return ["/bin/sh", "-c", CD_INTO_WORKDIR, workdir, ...argv];
-}
-function execCommandLine(exec, workdir, cmdline) {
-  return [exec, ...execArgv(workdir, ["/bin/sh", "-c", cmdline])].map(shellQuote).join(" ");
-}
-function proxyUrlFor(build) {
-  if (build.broker === void 0) return `http://127.0.0.1:${RELAY_PORT}`;
-  return `http://${build.broker}`;
-}
-function withMavenArgs(env, settingsFile, note) {
-  const team = env.MAVEN_ARGS;
-  if (team !== void 0 && namesGlobalSettings(team)) {
-    note?.(MAVEN_NO_PROXY_NOTE);
-    return;
-  }
-  if (settingsFile !== void 0) env.MAVEN_ARGS = mavenArgs(settingsFile, team).value;
-}
-function hostMavenSettings(env, buildDir2, note) {
-  if (/\s/.test(buildDir2)) {
-    note?.(MAVEN_SPACE_NOTE);
-    return void 0;
-  }
-  if (!existsSync(buildDir2)) return void 0;
-  try {
-    return writeMavenSettings(buildDir2, env.HTTPS_PROXY, env.NO_PROXY);
-  } catch (err) {
-    note?.(`the build's Maven settings could not be written, so its Maven gets no proxy from the runner: ${describeCallFailure(err)}`);
-    return void 0;
-  }
-}
-function execProxyEnvironment(build) {
-  const brokerHost = build.broker === void 0 ? void 0 : build.broker.slice(0, build.broker.lastIndexOf(":")).replace(/^\[|\]$/g, "");
-  return proxyEnvironment(proxyUrlFor(build), brokerHost);
-}
-var WRITE_MAVEN_SETTINGS = 'd=$(git rev-parse --absolute-git-dir) || exit 1; d="$d/outerlayer/maven"; mkdir -p "$d" && printf "%s" "$1" > "$d/settings.xml" && printf "%s\\n" "$d/settings.xml"';
-var MAVEN_WRITE_TIMEOUT_MS = 1e4;
-function runWithSpawn(spawnFn = spawn) {
-  return (file, args, env, timeoutMs) => new Promise((resolve) => {
-    let stdout = "";
-    let stderr = "";
-    let timer;
-    let settled = false;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      if (timer !== void 0) clearTimeout(timer);
-      resolve({ status: null, signal: null, stdout, stderr, ...result });
-    };
-    let child;
-    try {
-      child = spawnFn(file, args, { env, stdio: ["ignore", "pipe", "pipe"] });
-    } catch (err) {
-      finish({ error: err instanceof Error ? err : new Error(String(err)) });
-      return;
-    }
-    timer = setTimeout(() => {
-      child.kill("SIGKILL");
-      finish({ error: new Error(`it did not finish in ${timeoutMs / 1e3}s`) });
-    }, timeoutMs);
-    child.stdout?.on("data", (chunk) => {
-      stdout += String(chunk);
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderr += String(chunk);
-    });
-    child.on("error", (err) => finish({ error: err }));
-    child.on("close", (status, signal) => finish({ status, signal }));
-  });
-}
-async function deliverMavenSettings(build, workdir, base, run, timeoutMs = MAVEN_WRITE_TIMEOUT_MS) {
-  if (build.exec === void 0) return { reason: "the build has no exec" };
-  const env = { ...base, ...execProxyEnvironment(build) };
-  const ran = await run(build.exec, execArgv(workdir, ["/bin/sh", "-c", WRITE_MAVEN_SETTINGS, "sh", mavenSettingsXml(env.HTTPS_PROXY, env.NO_PROXY)]), env, timeoutMs);
-  if (ran.error !== void 0) return { reason: describeCallFailure(ran.error) };
-  const said = ran.stderr.trim().split("\n")[0];
-  if (ran.status !== 0) return { reason: `the write exited ${ran.status ?? ran.signal}${said === "" ? "" : `: ${said}`}` };
-  const lines = ran.stdout.trim().split("\n");
-  const path = lines[lines.length - 1].trim();
-  if (!isAbsolute(path)) return { reason: "the write did not report an absolute path" };
-  if (/\s/.test(path)) return { reason: MAVEN_SPACE_REASON };
-  return { path };
-}
-var MAVEN_SPACE_REASON = "the settings file's path has whitespace in it, which Maven cannot read from MAVEN_ARGS";
-async function deliverExecMaven(build, workdir, base, run, note) {
-  if (build?.exec === void 0) return;
-  const delivered = await deliverMavenSettings(build, workdir, base, run);
-  if ("path" in delivered) build.mavenSettings = delivered.path;
-  else note(`the build's Maven gets no proxy from the runner: ${delivered.reason}`);
-}
-function onceNote(write) {
-  const seen = /* @__PURE__ */ new Set();
-  return (line) => {
-    if (seen.has(line)) return;
-    seen.add(line);
-    write(line);
-  };
-}
-function attemptNote(log, tag) {
-  return onceNote((line) => log.line(`${tag} ${line}`));
-}
-function hostCommandEnvironment(base, build, config, hooksPath, note) {
-  let env = { ...base };
-  if (build.exec !== void 0) {
-    Object.assign(env, execProxyEnvironment(build));
-    withMavenArgs(env, build.mavenSettings, note);
-  } else if (build.proxyPort !== void 0) {
-    Object.assign(env, proxyEnvironment(`http://127.0.0.1:${build.proxyPort}`));
-    env.NODE_OPTIONS = withProxyWarningHidden(env.NODE_OPTIONS);
-    withMavenArgs(env, hostMavenSettings(env, build.buildDir, note), note);
-  }
-  const ports = build.destinations ?? [];
-  const portOf = (name) => ports.find((entry) => entry.name === name)?.port;
-  (config.build?.destinations ?? []).forEach((destination, index) => {
-    const port = portOf(destination.name);
-    const address = build.exec !== void 0 ? containerLocalAddress(index) : port === void 0 ? void 0 : `http://127.0.0.1:${port}/`;
-    if (address !== void 0) Object.assign(env, destinationEnvironment([destination], () => address));
-  });
-  if (build.builtIns === true) {
-    const credential = claudeCredential(base);
-    for (const name of CLAUDE_CREDENTIAL_VARIABLES) delete env[name];
-    Object.assign(env, builtInEnvironment((name) => `http://127.0.0.1:${portOf(name) ?? 0}`, credential));
-  }
-  if (build.exec === void 0 && hooksPath !== void 0) env = withHooksPath(env, hooksPath);
-  return env;
-}
-async function startHostServices(input) {
-  const { runtime, config, build } = input;
-  const destinations = config.build?.destinations ?? [];
-  const services = await startBuildServices({
-    startTunnel: runtime.startTunnel,
-    tunnelOptions: runtime.tunnelOptions,
-    buildDir: build.buildDir,
-    jobDir: input.jobDir,
-    destinations,
-    allowHosts: config.build?.allowHosts,
-    serve: input.process ? "tcp" : "both",
-    proxy: input.process,
-    ...input.process ? { builtIns: { gatewayUrl: config.url, itemKey: input.itemKey, claudeUpstream: runtime.claudeUpstream } } : {},
-    ports: {
-      proxy: build.proxyPort,
-      destinations: build.destinations?.filter((d) => !BUILT_IN_NAMES.includes(d.name)).map((d) => d.port),
-      builtIns: Object.fromEntries((build.destinations ?? []).filter((d) => BUILT_IN_NAMES.includes(d.name)).map((d) => [d.name, d.port]))
-    },
-    hostEnv: runtime.hostEnv,
-    destinationOptions: runtime.destinationOptions,
-    ...input.routeLog === void 0 ? {} : { log: input.routeLog }
-  });
-  build.proxyPort = services.proxyPort;
-  build.destinations = [
-    ...destinations.map((destination, index) => ({ name: destination.name, port: services.destinationPorts[index] })),
-    ...Object.entries(services.builtInPorts).map(([name, port]) => ({ name, port }))
-  ];
-  if (input.process) build.builtIns = true;
-  runtime.tunnels.set(build.buildId, services);
-  if (build.broker !== void 0) await listenOnBroker(services, build.broker);
-  return services;
-}
-async function listenOnBroker(tunnel, broker) {
-  const parsed = parseBroker(broker);
-  if (parsed === void 0) throw new Error(`${broker} is not a broker address`);
-  await tunnel.listenTcp({ host: parsed.host, port: parsed.port });
-}
-async function closeHostBuild(runtime, build) {
-  const tunnel = runtime.tunnels.get(build.buildId);
-  if (tunnel !== void 0) {
-    runtime.tunnels.delete(build.buildId);
-    await tunnel.close();
-  }
-  rmSync(build.buildDir, { recursive: true, force: true });
-  if (build.workDir !== void 0) rmSync(build.workDir, { recursive: true, force: true });
-}
 
 // src/runner/verdict.ts
 var VERDICT_SETTLE_MS = 5 * 6e4;
@@ -3336,7 +3086,17 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       let cleanedUp = true;
       tunnelRecord = vmBuild.runtime.tunnels.get(vmBuild.state.buildId)?.record();
       try {
-        await cleanupMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath, (text2) => log.error(`${tag} ${text2}`));
+        await cleanupMicroVm(
+          vmBuild.runtime,
+          vmBuild.state,
+          jobDirPath,
+          (text2) => log.error(`${tag} ${text2}`),
+          (bytes) => {
+            job.buildDiskPeakBytes = bytes;
+            writeJobFile(join(jobDirPath, "job.json"), job);
+            log.line(`${tag} build disk peak ${formatBytes(bytes)}`);
+          }
+        );
       } catch (err) {
         cleanedUp = false;
         log.error(`${tag} cleanup failed: ${describeCallFailure(err)} \xB7 continuing`);
@@ -3787,4 +3547,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, attemptNote, commandLogOffset, deliverCommitHooks, deliverExecMaven, describeHookEnd, execArgv, execCommandLine, finishJob, foldSample, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, runWithSpawn, sampleGuest, serveLease, setStage, startHostServices, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, finishJob, foldSample, hookLimitsFor, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, restartSender, retryFailedReleases, runCommand, runHook, sampleGuest, serveLease, setStage, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-QFQC5K4J.js → chunk-B6WW6AKO.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-JRZCRIEO.js';
-import { checkFit } from './chunk-LYE3KB6L.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-XWFSAOC7.js';
-import { builderDiskPinned } from './chunk-TGHBOXKJ.js';
-import { builtinKind, imageBuildOf } from './chunk-3DCB3GOV.js';
+import { placeholderQueues, placeholderProblem } from './chunk-GFTWZSOW.js';
+import { checkFit } from './chunk-7HZH5D7H.js';
+import { builtinKind, imageBuildOf } from './chunk-ONUACB5C.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-LHKWWEQZ.js';
+import { builderDiskPinned } from './chunk-NE63JADS.js';
 import { claudeCredentialVariablesSet, claudeCredential } from './chunk-BALIE3BA.js';
 import { closeSync, openSync, constants } from 'fs';
 import { totalmem } from 'os';
@@ -80,12 +80,17 @@ function managedFactsOf(config, probes) {
     builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
   };
 }
-function checkBlocked(config, probes) {
+function keepsHostBuilder(config, builderDiskIsPinned) {
+  return !(builtinKind(config.hooks.provision) === "vm" && imageBuildOf(config) === "vm" && (builderDiskIsPinned ?? builderDiskPinned()));
+}
+function checkBlockedWithSlots(config, probes) {
+  const blocked = (reason) => ({ blocked: { reason } });
+  let slots;
   const placeholders = placeholderQueues(config);
-  if (placeholders.length > 0) return { reason: `${placeholderProblem(placeholders)}. The runner takes work again once the config is edited` };
+  if (placeholders.length > 0) return blocked(`${placeholderProblem(placeholders)}. The runner takes work again once the config is edited`);
   if (config.managed === true) {
     const unmet = managedProblems(managedFactsOf(config, probes))[0];
-    if (unmet !== void 0) return { reason: unmet.reason };
+    if (unmet !== void 0) return blocked(unmet.reason);
   }
   const kind = builtinKind(config.hooks.provision);
   if (kind === "container" || kind === "vm") {
@@ -96,39 +101,46 @@ function checkBlocked(config, probes) {
     });
     if (!fit.fits) {
       const advice = probes.inImage === true ? "Set OUTERLAYER_BUILD_MEMORY or OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more memory" : `Lower runner.concurrency or runner.build.memory in ${config.configPath}`;
-      return { reason: `${fit.message}. ${advice}` };
+      return blocked(`${fit.message}. ${advice}`);
     }
     const facts = probes.buildDisk?.(kind, config.configPath);
     if (facts !== void 0) {
-      const diskFit = checkDiskFit({ concurrency: config.concurrency, buildDisk: config.build?.disk ?? DEFAULT_BUILD_DISK, facts });
-      if (!diskFit.fits) {
-        const advice = probes.inImage === true ? "Set OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more disk" : `Lower runner.concurrency or runner.build.disk in ${config.configPath}`;
-        return { reason: `${diskFit.message}. ${advice}` };
+      const diskFit = checkDiskFit({ concurrency: config.concurrency, buildDisk: config.build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: config.build?.cacheDisk ?? DEFAULT_CACHE_DISK, facts });
+      slots = diskFit.slots;
+      if (diskFit.slots < 1) {
+        const advice = probes.inImage === true ? "Set OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more disk" : `Lower runner.build.disk${kind === "vm" ? " or runner.build.cacheDisk" : ""} in ${config.configPath}, or give the machine more disk`;
+        return { blocked: { reason: `${diskFit.message}. ${advice}` }, slots };
       }
     }
   }
   const kvm = kind === "vm" ? probes.kvm() : "usable";
   if (kvm === "absent") {
-    return { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" };
+    return { blocked: { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" }, slots };
   }
   if (kvm !== "usable") {
     return {
-      reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
+      slots,
+      blocked: {
+        reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
+      }
     };
   }
-  if (kind === "container" || kind === "vm") {
+  if ((kind === "container" || kind === "vm") && keepsHostBuilder(config, probes.builderDiskPinned)) {
     const builder = probes.imageBuilder;
     if (builder === "unknown") {
-      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
+      return { blocked: { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" }, slots };
     }
-    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
+    if (builder !== "usable") return { blocked: { reason: `${builder.problem}. The runner takes work again once its image builder works` }, slots };
   }
   if (kind !== "own" && claudeCredential(probes.env) === void 0) {
     return {
-      reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+      slots,
+      blocked: {
+        reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+      }
     };
   }
-  return void 0;
+  return { slots };
 }
 
-export { checkBlocked, managedFactsOf, managedProblems, realBlockedProbes };
+export { checkBlockedWithSlots, keepsHostBuilder, managedFactsOf, managedProblems, realBlockedProbes };

package/dist/{chunk-ULBNTSAD.js → chunk-C66Q2CLW.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-B2JURP6A.js';
-import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
+import { autoConnect } from './chunk-CCOU4NXE.js';
+import { resolveRepoIdentity } from './chunk-QQXNS4G2.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-UIUGTW5C.js → chunk-C7WGCI77.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-G63KT5I5.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-M24H6JQW.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-LJG6EMLJ.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-PNIFQX73.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-B2JURP6A.js → chunk-CCOU4NXE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-2WMZPJVE.js';
-import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-VJGQEASF.js';
+import { resolveRepoIdentity } from './chunk-QQXNS4G2.js';
 import { resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';

package/dist/{chunk-SVDOA4W2.js → chunk-DHUHQPRQ.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-JHTJPQSL.js';
+import { runEmit } from './chunk-PILHDNHX.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { installStarterPack } from './chunk-DY7Y7UT4.js';
-import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-HJYBWJAS.js';
+import { installStarterPack } from './chunk-XMPE5TT4.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-PJI5D2XT.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-EUVE2EAE.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-G63KT5I5.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-2WZ66FXA.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-M24H6JQW.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-AVTI3FL5.js';
+import { linkedAgentsPath } from './chunk-6ZLI652Y.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { generatedHeaderSource } from './chunk-LJG6EMLJ.js';
+import { generatedHeaderSource } from './chunk-PNIFQX73.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-EWVYQLD3.js → chunk-E4F7YE7P.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-E6CO3MJE.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-V7Q5OKN7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/chunk-ER6KQCVJ.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/demo/previous.ts
+async function readNewestDemo(params) {
+  const endpoint = new URL(`/v1/work-items/${params.item}/demo`, params.url).toString();
+  const response = await params.fetchImpl(endpoint, {
+    method: "GET",
+    headers: { authorization: `Bearer ${params.apiKey}`, "x-outerlayer-app-id": params.appId }
+  });
+  if (!response.ok) throw new Error(`reading the demo of item ${params.item} failed (${response.status})`);
+  const body = await response.json();
+  return body.data?.demo ?? null;
+}
+
+export { readNewestDemo };