@outerlayer/cli 0.34.0-next.20261025132734 → 0.34.0-next.20261025180645

package/dist/{chunk-NBZ7XBT6.js → chunk-UMYYYF7B.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-Z4KWHSO4.js → chunk-UN3SQTVL.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-6NUPXDAA.js';
-import { workPageUrl } from './chunk-EE2ZZGQV.js';
-import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
+import { autoConnect } from './chunk-AVPLEFQR.js';
+import { workPageUrl } from './chunk-FVCHHSHB.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-6RKD7YZ6.js';
-import { signRunnerRequest } from './chunk-SOI6K5DY.js';
+import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-3N77LUQI.js';
+import { signRunnerRequest } from './chunk-MOI2KDLH.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
@@ -446,7 +446,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-VQXRDS6E.js');
+      const { logHookError } = await import('./hook-fast-GPUL7T77.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-ZVLSYWDF.js → chunk-UO4FQAOX.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-F5UL23I2.js';
+import { RecipeError, locateRecipe, readRecipe, assertBuildable, runnerLabelValue, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-5AFPP3GZ.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-4UPET3R7.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-YNMVVQOQ.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-ES4ULBAL.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PA6CK6WQ.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BALIE3BA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PXGU3GKY.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-G4W4B33M.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
@@ -346,16 +346,18 @@ function toolsKey(parts) {
 
 // src/runner/image/prune.ts
 var KIND = "ai.outerlayer.kind";
+var RUNNER = "ai.outerlayer.runner";
 var RECIPE_KEY = "ai.outerlayer.recipe-key";
 var newestFirst = (a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt);
 function selectPrunable(opts) {
   const used = new Set(opts.inUse);
-  const builds = opts.images.filter((i) => i.labels[KIND] === "build").sort(newestFirst);
+  const images = opts.runner === void 0 ? opts.images : opts.images.filter((i) => i.labels[RUNNER] === opts.runner);
+  const builds = images.filter((i) => i.labels[KIND] === "build").sort(newestFirst);
   const kept = builds.filter((image, index) => index < opts.keep || used.has(image.id));
   const keptKeys = new Set(kept.map((i) => i.labels[RECIPE_KEY]));
   return {
     builds: builds.filter((i) => !kept.includes(i)),
-    recipes: opts.images.filter(
+    recipes: images.filter(
       (i) => i.labels[KIND] === "recipe" && !used.has(i.id) && !keptKeys.has(i.labels[RECIPE_KEY])
     )
   };
@@ -363,6 +365,7 @@ function selectPrunable(opts) {
 
 // src/runner/image/build.ts
 var KIND2 = "ai.outerlayer.kind";
+var RUNNER2 = "ai.outerlayer.runner";
 var REPOSITORY = "ai.outerlayer.repository";
 var RECIPE_KEY2 = "ai.outerlayer.recipe-key";
 var TOOLS_KEY = "ai.outerlayer.tools-key";
@@ -458,6 +461,7 @@ async function buildRepositoryImage(opts, ports) {
   const scratchRoot = opts.tmpDir ?? tmpdir();
   const prepared = await prepareImageBuild(opts);
   const { repository, repoRecords, checkout, location, recipe, recipeKey: rKey, toolsKey: tKey, defaultText, claudeCodeVersion, nodeImage, recordDir, logPath } = prepared;
+  const runnerLabel = runnerLabelValue(opts.configPath);
   const buildTag = `${TAG_HOST}/build/${repository}:${rKey.slice(0, KEY_PREFIX)}-${tKey.slice(0, KEY_PREFIX)}`;
   const recipeTag = `${TAG_HOST}/recipe/${repository}:${rKey.slice(0, KEY_PREFIX)}`;
   try {
@@ -482,7 +486,7 @@ async function buildRepositoryImage(opts, ports) {
     if (recipeImage === void 0 && buildImageBefore === void 0) {
       await ensureBuilder();
       mkdirSync(join(repoRecords, LAYOUTS_DIR), { recursive: true, mode: RUNNER_DIR_MODE });
-      const labels = { [REPOSITORY]: repository, [KIND2]: "recipe", [RECIPE_KEY2]: rKey };
+      const labels = { [REPOSITORY]: repository, [KIND2]: "recipe", [RUNNER2]: runnerLabel, [RECIPE_KEY2]: rKey };
       if (location.kind === "default") {
         const context = mkdtempSync(join(scratchRoot, "ol-image-default-"));
         try {
@@ -538,7 +542,7 @@ async function buildRepositoryImage(opts, ports) {
           cpSync(opts.guestHelper.path, join(context, "guest", "outerlayer-guest"));
         }
         const dockerfile = toolsDockerfile({ recipeImage: recipeTag, nodeImage, claudeCodeVersion, buildId: opts.cli.buildId, guestHelper: opts.guestHelper !== void 0 });
-        const labels = { [REPOSITORY]: repository, [KIND2]: "build", [RECIPE_KEY2]: rKey, [TOOLS_KEY]: tKey };
+        const labels = { [REPOSITORY]: repository, [KIND2]: "build", [RUNNER2]: runnerLabel, [RECIPE_KEY2]: rKey, [TOOLS_KEY]: tKey };
         const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath, base: { ref: recipeTag, layout: keptLayout } });
         if (status !== 0) throw failed("the docker build of the tools layer", status);
       } finally {
@@ -565,7 +569,7 @@ async function buildRepositoryImage(opts, ports) {
       writeRecord(recordDir, report, now().toISOString());
     }
     const removed = [];
-    if (toolsBuilt) removed.push(...await prune(host, repository, repoRecords, opts.keep ?? KEEP_BUILD_IMAGES, runnerDir(opts.configPath)));
+    if (toolsBuilt) removed.push(...await prune(host, repository, repoRecords, opts.keep ?? KEEP_BUILD_IMAGES, runnerDir(opts.configPath), runnerLabel));
     return {
       reused: !recipeBuilt && !toolsBuilt,
       recipeBuilt,
@@ -579,8 +583,8 @@ async function buildRepositoryImage(opts, ports) {
     prepared.release();
   }
 }
-async function prune(host, repository, repoRecords, keep, runnerDirPath) {
-  const { builds, recipes } = selectPrunable({ images: await host.list(repository), inUse: await host.inUse(), keep });
+async function prune(host, repository, repoRecords, keep, runnerDirPath, runnerLabel) {
+  const { builds, recipes } = selectPrunable({ images: await host.list(repository), inUse: await host.inUse(), keep, runner: runnerLabel });
   const removed = [];
   for (const image of [...builds, ...recipes]) {
     try {

package/dist/{chunk-4Y54SQXH.js → chunk-VJ34F55N.js}

@@ -1,32 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-O4Z2MNNL.js';
+import { writePendingUpdate } from './chunk-TFPNPS4Q.js';
+import { renderUpdateSteps } from './chunk-RHV5SRI2.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-FD5ASWTG.js';
+import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-FDJPDZSR.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-YIBFGAYI.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { writePendingUpdate } from './chunk-GH246BGV.js';
-import { renderUpdateSteps } from './chunk-E4ASIOVL.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-ACRRO3MB.js';
-import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
-import { RUNNER_PROTOCOL } from './chunk-DA3PLB5N.js';
-import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-7WM7K2DY.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
+import { RUNNER_PROTOCOL } from './chunk-PAK5P2ND.js';
+import { realBlockedProbes, checkBlockedWithSlots } from './chunk-DNZYXEMY.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-UMYYYF7B.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-YEVPRO7L.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
-import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-62LXQM7U.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-MZBQTVFG.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JQSZTQSK.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RFVIQLNB.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SYVRBBLW.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3CKMB2UK.js';
-import { freeBytes, formatBytes, volumeBytes } from './chunk-ZYKFYNES.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43I7PXDP.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-Z4KWHSO4.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-2D6CKNR7.js';
+import { freeBytes, formatBytes, volumeBytes } from './chunk-KM2HLQE3.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-5AFPP3GZ.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-YNMVVQOQ.js';
+import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-UN3SQTVL.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-MOI2KDLH.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { fdName } from './chunk-HACGUL52.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PXGU3GKY.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-G4W4B33M.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
@@ -614,7 +613,9 @@ function createHousekeepingDocker(deps) {
         "--filter",
         "dangling=true",
         "--filter",
-        `label=${KIND_LABEL}`
+        `label=${KIND_LABEL}`,
+        "--filter",
+        `label=${RUNNER_LABEL}=${deps.runnerId}`
       ]);
       if (listed.status !== 0) throw failure(listed, "docker image ls");
       const ids = [...new Set(listed.stdout.split("\n").map((l) => l.trim()).filter(Boolean))];
@@ -628,7 +629,7 @@ function createHousekeepingDocker(deps) {
       }));
     },
     async listLabelledImages() {
-      const listed = await run("docker", ["image", "ls", "--all", "--no-trunc", "--quiet", "--filter", `label=${KIND_LABEL}`]);
+      const listed = await run("docker", ["image", "ls", "--all", "--no-trunc", "--quiet", "--filter", `label=${KIND_LABEL}`, "--filter", `label=${RUNNER_LABEL}=${deps.runnerId}`]);
       if (listed.status !== 0) throw failure(listed, "docker image ls");
       const ids = [...new Set(listed.stdout.split("\n").map((l) => l.trim()).filter(Boolean))];
       if (ids.length === 0) return [];
@@ -668,6 +669,16 @@ function createHousekeepingDocker(deps) {
     }
   };
 }
+async function housekeepingDockerIfReachable(deps) {
+  const run = deps.run ?? spawnRun;
+  try {
+    const answered = await run("docker", ["version", "--format", "{{.Server.Version}}"]);
+    if (answered.status !== 0) return void 0;
+  } catch {
+    return void 0;
+  }
+  return createHousekeepingDocker(deps);
+}
 
 // src/runner/housekeeping/select.ts
 var DAY_MS = 864e5;
@@ -821,11 +832,13 @@ async function runHousekeeping(options) {
   const root = runnerDir(options.configPath);
   let freed = 0;
   let listed;
-  try {
-    const containers = await docker.listBuildContainers();
-    listed = { containers, volumes: await docker.listBuildVolumes() };
-  } catch (err) {
-    log.error(`housekeeping: Docker could not be asked, so nothing in Docker is removed this pass: ${describeCallFailure(err)}`);
+  if (docker !== void 0) {
+    try {
+      const containers = await docker.listBuildContainers();
+      listed = { containers, volumes: await docker.listBuildVolumes() };
+    } catch (err) {
+      log.error(`housekeeping: Docker could not be asked, so nothing in Docker is removed this pass: ${describeCallFailure(err)}`);
+    }
   }
   const jobs = readJobs(jobsDir(options.configPath));
   for (const name of jobs.unreadable) {
@@ -845,7 +858,7 @@ async function runHousekeeping(options) {
   }
   const live = liveBuildIds(jobs.unfinished);
   const finished = finishedBuildIds(jobs.finished);
-  if (canTell && listed !== void 0) {
+  if (docker !== void 0 && canTell && listed !== void 0) {
     for (const container of selectOrphans(listed.containers, live, finished)) {
       try {
         await docker.removeContainer(container.id);
@@ -863,7 +876,7 @@ async function runHousekeeping(options) {
       }
     }
   }
-  if (canTell && listed !== void 0) {
+  if (docker !== void 0 && canTell && listed !== void 0) {
     const recorded = recordedImages(options.configPath);
     if (recorded === void 0) {
       log.error("housekeeping: an image record does not parse, so no tagged image is removed this pass");
@@ -874,7 +887,7 @@ async function runHousekeeping(options) {
         log.error(`housekeeping: the runner's images could not be listed: ${describeCallFailure(err)}`);
       }
     }
-    freed += await removeStaleRootDisks(root, jobs.unfinished, options);
+    freed += await removeStaleRootDisks(root, jobs.unfinished, options, docker);
     try {
       freed += await removeDanglingImages(docker, log, liveImageIds(jobs.unfinished));
     } catch (err) {
@@ -924,7 +937,7 @@ async function runHousekeeping(options) {
   log.line(`housekeeping: pass finished, freed ${formatBytes(freed)}`);
   return { freedBytes: freed };
 }
-async function removeStaleRootDisks(root, unfinished, options) {
+async function removeStaleRootDisks(root, unfinished, options, docker) {
   const dir = rootfsDir(root);
   const inUse = new Set(unfinished.flatMap((job) => job.microvm?.rootfs === void 0 ? [] : [job.microvm.rootfs]));
   let freed = 0;
@@ -933,7 +946,7 @@ async function removeStaleRootDisks(root, unfinished, options) {
     if (imageId === void 0) continue;
     const path = join(dir, name);
     if (inUse.has(path)) continue;
-    if (await options.docker.imageState(`sha256:${imageId}`) !== "missing") continue;
+    if (await docker.imageState(`sha256:${imageId}`) !== "missing") continue;
     const size = sizeOf(path);
     try {
       rmSync(path, { force: true });
@@ -1813,13 +1826,16 @@ async function housekeepingPass(state) {
   state.housekeepingRunning = true;
   try {
     state.deps.housekeeping ??= {};
-    state.deps.housekeeping.docker ??= createHousekeepingDocker({ run: state.deps.housekeeping.run, runnerId: runnerLabelValue(state.config.configPath), builder: builderName(state.config.configPath) });
+    const hostBuilder = keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned);
+    const names = { run: state.deps.housekeeping.run, runnerId: runnerLabelValue(state.config.configPath), builder: builderName(state.config.configPath) };
+    const docker = state.deps.housekeeping.docker ?? (hostBuilder ? createHousekeepingDocker(names) : await housekeepingDockerIfReachable(names));
+    if (hostBuilder) state.deps.housekeeping.docker ??= docker;
     const result = await runHousekeeping({
       configPath: state.config.configPath,
       keepDays: config.jobsKeepDays,
       buildCacheMax: config.buildCacheMax,
-      removeHostBuilder: !keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned),
-      docker: state.deps.housekeeping.docker,
+      removeHostBuilder: !hostBuilder,
+      docker,
       now: state.deps.now ?? (() => /* @__PURE__ */ new Date()),
       log: logOf(state)
     });
@@ -1881,7 +1897,7 @@ async function runTick(state) {
             claimed = true;
             break;
           }
-          if (attempt.kind === "outdated" || attempt.kind === "read_only" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch" || attempt.kind === "unreadable_repositories") {
+          if (attempt.kind === "outdated" || attempt.kind === "read_only" || attempt.kind === "managed_refused" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch" || attempt.kind === "unreadable_repositories") {
             return;
           }
           if (attempt.kind === "error") {
@@ -1905,7 +1921,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-LTZXOPPN.js');
+  const { postJson: postJson2 } = await import('./work-cmd-3MKUIE2C.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1942,6 +1958,10 @@ async function tryClaimAndStart(state, item, queue) {
       reportRepeating(state, "the request signature", claim.message ?? claim.reason);
       return { kind: "signature" };
     }
+    if (claim.code === "managed_credential_missing" || claim.code === "managed_builds_off") {
+      reportRepeating(state, "the managed build", claim.message ?? claim.reason);
+      return { kind: "managed_refused" };
+    }
     if (claim.code === "billing_read_only") {
       reportRepeating(state, "the organization's billing", claim.message ?? claim.reason);
       return { kind: "read_only" };
@@ -1970,6 +1990,7 @@ async function tryClaimAndStart(state, item, queue) {
     return { kind: "error", reason: `${claim.reason} (${claim.attempts} attempt(s))` };
   }
   reportRepeating(state, "the organization's billing", void 0);
+  reportRepeating(state, "the managed build", void 0);
   reportRepeating(state, "the runner protocol", void 0);
   state.upgradeRefused = false;
   state.versionRefusalLogged = void 0;
@@ -2120,6 +2141,15 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       return;
     }
     if (active.ending) return;
+    if (state.config.managed === true) {
+      const fetched = await fetchManagedClaudeKey(state.config, item.number, { fetchImpl: state.deps.fetchImpl, now: state.deps.now, sleep: state.deps.sleep });
+      if (active.ending) return;
+      if (!fetched.ok) {
+        await endOnManagedKeyRefusal(state, active, fetched);
+        return;
+      }
+      holdManagedClaudeKey(dirPath, fetched.apiKey);
+    }
   }
   if (state.config.hooks.report) {
     setStage(job, dirPath, "report");
@@ -2532,6 +2562,21 @@ function buildTokensFor(state, active, item) {
     }
   });
 }
+async function endOnManagedKeyRefusal(state, active, refused) {
+  const log = logOf(state);
+  const tag = `#${active.job.item}`;
+  const code = refused.code ?? "unavailable";
+  if (refused.code === "claim_expired" || refused.code === "claim_not_held") {
+    log.error(`${tag} the build's Anthropic key was refused: ${code} \xB7 ending job as lease_lost`);
+    await endJob(state, active, "lease_lost");
+  } else if (refused.retryable || refused.code === "managed_credential_missing" || refused.code === "managed_builds_off") {
+    log.error(`${tag} the build's Anthropic key could not be had (${code}) \xB7 releasing the claim to try again`);
+    await endJob(state, active, void 0);
+  } else {
+    log.error(`${tag} the build's Anthropic key was refused: ${code} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason: code });
+  }
+}
 async function endOnTokenRefusal(state, active, err, repository) {
   const log = logOf(state);
   const tag = `#${active.job.item}`;
@@ -2963,6 +3008,21 @@ async function rejoinMicroVmBuild(state, adopted) {
     const fd = inherited.get(fdName(microvm.buildId, socket.replace(/\.sock$/, "")));
     return fd === void 0 ? void 0 : (server) => runtime.vm.fdStore.listenOn(server, fd);
   };
+  if (config.managed === true) {
+    const fetched = await fetchManagedClaudeKey(config, job.item, {
+      fetchImpl: state.deps.fetchImpl,
+      now: state.deps.now,
+      sleep: state.deps.sleep,
+      windowMs: ADOPTED_FETCH_RETRY_WINDOW_MS
+    });
+    if (!fetched.ok) {
+      const code = fetched.code ?? "unavailable";
+      log.error(`${tag} the adopted build's Anthropic key could not be had: ${code}`);
+      const cause = fetched.retryable ? "the gateway could not be reached for it" : `the gateway refused it (${code})`;
+      return { reason: `the adopted build's Anthropic key could not be had after the runner restarted: ${cause}`, why: "the gateway did not give its Anthropic key again" };
+    }
+    holdManagedClaudeKey(dirPath, fetched.apiKey);
+  }
   const tokens = buildTokensFor(state, adopted, job.item);
   runtime.credentials.set(dirPath, tokens);
   let servicesServed = false;
@@ -2995,7 +3055,7 @@ async function rejoinMicroVmBuild(state, adopted) {
     }).catch((err) => log.error(`${tag} the read token could not be written for gh in the guest: ${describeCallFailure(err)}`));
   });
   await pushes;
-  return servicesServed && leaseServed;
+  return servicesServed && leaseServed ? true : { reason: MICROVM_SOCKETS_LOST_REASON, why: "the sockets it reaches the runner on could not be served again" };
 }
 async function adoptTrackedMicroVms(state, plan) {
   const log = logOf(state);
@@ -3008,9 +3068,10 @@ async function adoptTrackedMicroVms(state, plan) {
     const adopted = { job, dirPath, lastRenewAtMs: 0, cmd: null, cpuSample: null, ending: false };
     state.jobs.set(dirPath, adopted);
     attemptLogs.open(job.item, dirPath);
-    if (!await rejoinMicroVmBuild(state, adopted)) {
+    const rejoined = await rejoinMicroVmBuild(state, adopted);
+    if (rejoined !== true) {
       state.jobs.delete(dirPath);
-      await finishMicroVmWhileAway(state, dirPath, job, MICROVM_SOCKETS_LOST_REASON, "the sockets it reaches the runner on could not be served again");
+      await finishMicroVmWhileAway(state, dirPath, job, rejoined.reason, rejoined.why);
       continue;
     }
     if (!await renewLeaseIfDue(state, adopted, nowOf(state).getTime())) continue;
@@ -3150,7 +3211,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-OOUGS65D.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-QULEN437.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -3176,7 +3237,7 @@ async function startRunner(configPath, deps, startup) {
   check = "identity";
   if (builtinKind(config.hooks.provision) === "container" || builtinKind(config.hooks.provision) === "vm") {
     await ensureRunnerIdentity(configPath, {
-      docker: deps.runnerIdentity ?? (deps.container?.host === void 0 ? void 0 : { holdsObjects: async () => false }),
+      docker: deps.runnerIdentity ?? identityDockerFor({ keepsHostBuilder: keepsHostBuilder(config, deps.blocked?.builderDiskPinned) }) ?? (deps.container?.host === void 0 ? void 0 : { holdsObjects: async () => false }),
       log: (line) => log.error(line)
     }).catch((err) => log.error(`the runner's Docker identity could not be stored: ${describeCallFailure(err)} \xB7 using the names its folder's path gives`));
   }

package/dist/{chunk-272AKVRP.js → chunk-YHKU2NOZ.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-6RKD7YZ6.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-3N77LUQI.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-RCRE42V6.js';

package/dist/{chunk-F5UL23I2.js → chunk-YNMVVQOQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{claude-launcher-MORG66PJ.js → claude-launcher-OQZNW7XJ.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-QSBWTA2V.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-XBGHM7DB.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);