@outerlayer/cli 0.34.0-next.20261025133402 → 0.34.0-next.20261025210240

package/dist/{chunk-HAEDLXHA.js → chunk-63IVRRIO.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-75KZUBHD.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-SI6WDF3U.js';
+import { EXEC_PORT } from './chunk-OGPEHSNW.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { EXEC_PORT } from './chunk-2RBIW2PD.js';
-import { RELAY_PORT } from './chunk-YOBQIXX6.js';
+import { RELAY_PORT } from './chunk-G4W4B33M.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-BTG5NZHN.js → chunk-6OLVVAOK.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-IW6Z337K.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-UN3SQTVL.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { defaultFetch } from './chunk-3N77LUQI.js';
 import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
-import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch } from './chunk-TVGLNHEB.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { inferArtifactKind, mediaTypeForArtifactPath, WORK_ITEM_COMMENT_MAX_BODY_LENGTH } from './chunk-EOTMDIYC.js';
@@ -130,7 +130,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-54GBEUJP.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-6OKAT3IC.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-3M6UYJSR.js → chunk-AVPLEFQR.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-XA6PGME5.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
-import { resolveGatewayCredentials } from './chunk-TVGLNHEB.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-FVCHHSHB.js';
+import { resolveGatewayCredentials } from './chunk-3N77LUQI.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-TVOZOOIW.js → chunk-BHSSGVOY.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-IW6Z337K.js';
+import { resolveCredentials, postJson, getJson } from './chunk-UN3SQTVL.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { defaultFetch } from './chunk-3N77LUQI.js';
 import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
-import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch } from './chunk-TVGLNHEB.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';

package/dist/{chunk-QOUR4CQ7.js → chunk-CAQCDYKF.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-JWNH4ZTF.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-TVGLNHEB.js';
-import { withTokenHeader } from './chunk-YOBQIXX6.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-FGXT5OXS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { withTokenHeader } from './chunk-G4W4B33M.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-SMMNU65K.js → chunk-DNZYXEMY.js}

@@ -1,12 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-POGPX7LI.js';
-import { checkFit } from './chunk-AABYHGVO.js';
-import { builtinKind, imageBuildOf } from './chunk-4XYC2663.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-UC2DKBMS.js';
-import { builderDiskPinned } from './chunk-ES4ULBAL.js';
-import { FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath } from './chunk-YOBQIXX6.js';
-import { parseRunnerEnv } from './chunk-HACGUL52.js';
+import { placeholderQueues, placeholderProblem } from './chunk-JQSZTQSK.js';
+import { checkFit } from './chunk-INOUUSYI.js';
+import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-2D6CKNR7.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-KM2HLQE3.js';
+import { builderDiskPinned } from './chunk-4UPET3R7.js';
+import { FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv, BUILD_SLICE_MEMORY_ENV } from './chunk-G4W4B33M.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem } from 'os';
@@ -26,6 +25,10 @@ function realBlockedProbes() {
   return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown", buildDisk: sharedBuildDisk };
 }
 var DEFAULT_BUILD_MEMORY = "8g";
+function sliceMemoryOf(env) {
+  const bytes = Number(env[BUILD_SLICE_MEMORY_ENV]);
+  return Number.isSafeInteger(bytes) && bytes > 0 ? bytes : void 0;
+}
 function managedProblems(facts) {
   const problems = [];
   if (builtinKind(facts.provision) !== "vm") {
@@ -93,9 +96,6 @@ function managedFactsOf(config, probes) {
     builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
   };
 }
-function keepsHostBuilder(config, builderDiskIsPinned) {
-  return !(builtinKind(config.hooks.provision) === "vm" && imageBuildOf(config) === "vm" && (builderDiskIsPinned ?? builderDiskPinned()));
-}
 function checkBlockedWithSlots(config, probes) {
   const blocked = (reason) => ({ blocked: { reason } });
   let slots;
@@ -110,7 +110,8 @@ function checkBlockedWithSlots(config, probes) {
     const fit = checkFit({
       concurrency: config.concurrency,
       buildMemory: config.build?.memory ?? DEFAULT_BUILD_MEMORY,
-      usableBytes: probes.totalMemoryBytes()
+      usableBytes: probes.totalMemoryBytes(),
+      sliceBytes: sliceMemoryOf(probes.env)
     });
     if (!fit.fits) {
       const advice = probes.inImage === true ? "Set OUTERLAYER_BUILD_MEMORY or OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more memory" : `Lower runner.concurrency or runner.build.memory in ${config.configPath}`;
@@ -156,4 +157,4 @@ function checkBlockedWithSlots(config, probes) {
   return { slots };
 }
 
-export { checkBlockedWithSlots, keepsHostBuilder, managedFactsOf, managedProblems, realBlockedProbes };
+export { checkBlockedWithSlots, managedFactsOf, managedProblems, realBlockedProbes };

package/dist/{chunk-LMICI7AY.js → chunk-EGVHFHY4.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-3M6UYJSR.js';
+import { autoConnect } from './chunk-AVPLEFQR.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { acquireSpoolLockAt } from './chunk-MECW77XP.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-3N77LUQI.js';
 import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
-import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-TVGLNHEB.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-EOTMDIYC.js';

package/dist/{chunk-RNVBSRZZ.js → chunk-FD5ASWTG.js}

@@ -1,35 +1,34 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HAEDLXHA.js';
-import { writeDockerClientConfig } from './chunk-75KZUBHD.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-63IVRRIO.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-KDLQGTN6.js';
-import { installScrubContext } from './chunk-WIK5KUGK.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, managedClaudeKeyValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-POGPX7LI.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-3NFZN7H6.js';
+import { senderPidfile } from './chunk-JBCOUY4M.js';
+import { installScrubContext } from './chunk-QANM5COC.js';
+import { writeDockerClientConfig } from './chunk-SI6WDF3U.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, managedClaudeKeyValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JQSZTQSK.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-UO4FQAOX.js';
+import { waitForAgent, vmExecArgs } from './chunk-2ILU7UAU.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-OGPEHSNW.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RFVIQLNB.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-2D6CKNR7.js';
+import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-KM2HLQE3.js';
+import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-5AFPP3GZ.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-4UPET3R7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { waitForAgent, vmExecArgs } from './chunk-IHY457PB.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-2RBIW2PD.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-AVLLJW5D.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-4XYC2663.js';
-import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-UC2DKBMS.js';
-import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-MPDLZCXM.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-ES4ULBAL.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-IW6Z337K.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-UN3SQTVL.js';
 import { planArtifactUpload } from './chunk-MECW77XP.js';
-import { scrubText } from './chunk-AJYZNISW.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-XLJLR7EK.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-N7LAEN3T.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, checkEnvironment, EVAL_INPUT_DIR } from './chunk-YOBQIXX6.js';
+import { signerFor } from './chunk-MOI2KDLH.js';
 import { resolvePackRoot } from './chunk-ZQSANKS4.js';
+import { scrubText } from './chunk-AJYZNISW.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-FGXT5OXS.js';
 import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { fdName } from './chunk-HACGUL52.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PXGU3GKY.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, checkEnvironment, EVAL_INPUT_DIR } from './chunk-G4W4B33M.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, openSync, readFileSync, closeSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, dirname, delimiter, sep } from 'path';

package/dist/{chunk-NW5PDZYA.js → chunk-FDJPDZSR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N7LAEN3T.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-XA6PGME5.js → chunk-FVCHHSHB.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { DEFAULT_DASHBOARD } from './chunk-Y5YCX6AL.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { remoteLookupFailed } from './chunk-AJYZNISW.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
-import { DEFAULT_DASHBOARD } from './chunk-Y5YCX6AL.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-TVGLNHEB.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { remoteLookupFailed } from './chunk-AJYZNISW.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { lstatSync } from 'fs';

package/dist/{chunk-YOBQIXX6.js → chunk-G4W4B33M.js}

@@ -1,14 +1,193 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseRunnerEnv } from './chunk-HACGUL52.js';
 import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-MESOOLF4.js';
-import { readFileSync, mkdirSync, writeFileSync, existsSync, unlinkSync, chmodSync } from 'fs';
+import { spawn, spawnSync } from 'child_process';
+import { statSync, readFileSync, mkdirSync, writeFileSync, existsSync, unlinkSync, chmodSync } from 'fs';
 import { join, dirname } from 'path';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
 import { createServer as createServer$1 } from 'net';
 
 createRequire(import.meta.url);
+var FD_STORE_ENV = "OUTERLAYER_FD_STORE";
+var MIN_SYSTEMD = 254;
+var LISTEN_FDS_START = 3;
+var FD_SLOTS_PER_BUILD = 64;
+function fdName(buildId, socket) {
+  return `ol-${buildId}-${socket}`;
+}
+function listenFdOf(server) {
+  const handle = server._handle;
+  return typeof handle?.fd === "number" && handle.fd >= 0 ? handle.fd : void 0;
+}
+function parseListenFds(env, pid) {
+  const found = /* @__PURE__ */ new Map();
+  if (env.LISTEN_PID !== String(pid)) return found;
+  const count = Number(env.LISTEN_FDS);
+  if (!Number.isInteger(count) || count <= 0) return found;
+  const names = (env.LISTEN_FDNAMES ?? "").split(":");
+  for (let index = 0; index < count; index++) {
+    const name = names[index];
+    if (name !== void 0 && name !== "" && name !== "stored") found.set(name, LISTEN_FDS_START + index);
+  }
+  return found;
+}
+function listenOnFd(server, fd) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen({ fd }, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+}
+function run(spawnFn, command, args, fd) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let child;
+    try {
+      child = spawnFn(command, args, { stdio: ["ignore", "pipe", "pipe", ...fd === void 0 ? [] : [fd]] });
+    } catch (err) {
+      resolve({ status: null, stdout, stderr: err instanceof Error ? err.message : String(err) });
+      return;
+    }
+    child.stdout?.on("data", (chunk) => stdout += chunk.toString("utf8"));
+    child.stderr?.on("data", (chunk) => stderr += chunk.toString("utf8"));
+    child.on("error", (err) => resolve({ status: null, stdout, stderr: err.message }));
+    child.on("close", (status) => resolve({ status, stdout, stderr }));
+  });
+}
+function systemdVersion(ran) {
+  const match = /^systemd (\d+)/.exec(ran.stdout);
+  return ran.status === 0 && match !== null ? Number(match[1]) : void 0;
+}
+function realFdStorePort(options = {}) {
+  const env = options.env ?? process.env;
+  const pid = options.pid ?? process.pid;
+  const command = options.command ?? "systemd-notify";
+  const spawnFn = options.spawn ?? spawn;
+  let inherited;
+  let held2;
+  let version;
+  const inheritedNames = () => inherited ??= parseListenFds(env, pid);
+  const heldNames = () => held2 ??= new Set(inheritedNames().keys());
+  return {
+    async status() {
+      if (env.NOTIFY_SOCKET === void 0 || env.NOTIFY_SOCKET === "") return { ok: false, reason: "NOTIFY_SOCKET is not set, so this runner was not started by a service that accepts descriptors" };
+      const size = Number(env[FD_STORE_ENV]);
+      if (!Number.isInteger(size) || size <= 0) return { ok: false, reason: `${FD_STORE_ENV} is not set, so the service's unit keeps no descriptor store` };
+      version ??= run(spawnFn, command, ["--version"]).then(systemdVersion);
+      const found = await version;
+      if (found === void 0) return { ok: false, reason: `${command} could not be run, so no descriptor can be stored` };
+      if (found < MIN_SYSTEMD) return { ok: false, reason: `systemd ${found} cannot store a descriptor sent from a child process: it needs systemd ${MIN_SYSTEMD} or later` };
+      return { ok: true };
+    },
+    async push(name, server) {
+      const fd = listenFdOf(server);
+      if (fd === void 0) throw new Error(`${name} has no descriptor to store`);
+      const size = Number(env[FD_STORE_ENV]);
+      const names = heldNames();
+      if (Number.isInteger(size) && names.size >= size) {
+        throw new Error(`the descriptor store is full: it holds ${names.size} descriptors, the size the service's unit sets (FileDescriptorStoreMax=${size})`);
+      }
+      const ran = await run(spawnFn, command, [`--fd=${LISTEN_FDS_START}`, `--fdname=${name}`, "FDSTORE=1"], fd);
+      if (ran.status !== 0) throw new Error(`storing ${name} failed${ran.status === null ? "" : ` (exit ${ran.status})`}: ${ran.stderr.trim().split("\n")[0] ?? ""}`);
+      names.add(name);
+    },
+    async remove(name) {
+      const ran = await run(spawnFn, command, ["FDSTOREREMOVE=1", `FDNAME=${name}`]);
+      if (ran.status !== 0) throw new Error(`removing ${name} from the store failed${ran.status === null ? "" : ` (exit ${ran.status})`}: ${ran.stderr.trim().split("\n")[0] ?? ""}`);
+      heldNames().delete(name);
+    },
+    inherited() {
+      return inheritedNames();
+    },
+    listenOn: listenOnFd
+  };
+}
+
+// src/runner/service/slice.ts
+var BUILD_SLICE_MEMORY_ENV = "OUTERLAYER_BUILD_SLICE_MEMORY";
+
+// src/runner/service/inspect.ts
+var CREDENTIAL_VARIABLES = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+function property(shown, name) {
+  return new RegExp(`^${name}=(.*)$`, "m").exec(shown)?.[1]?.trim();
+}
+function holdsGroup(status, gid) {
+  const primary = /^Gid:\s+(\d+)/m.exec(status)?.[1];
+  const supplementary = /^Groups:[ \t]*(.*)$/m.exec(status)?.[1]?.trim().split(/\s+/).filter((g) => g !== "") ?? [];
+  return [primary, ...supplementary].some((g) => g !== void 0 && Number(g) === gid);
+}
+function parseRunnerEnv(text) {
+  const env = {};
+  for (const line of text.split("\n")) {
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (match === null) continue;
+    env[match[1]] = match[2].trim().replace(/^(["'])(.*)\1$/, "$2");
+  }
+  return env;
+}
+function credentialNames(env) {
+  const set = parseRunnerEnv(env ?? "");
+  return CREDENTIAL_VARIABLES.filter((name) => (set[name] ?? "").trim() !== "");
+}
+function startedWithStore(environ) {
+  const vars = new Map(environ.split("\0").map((entry) => [entry.slice(0, entry.indexOf("=")), entry.slice(entry.indexOf("=") + 1)]));
+  return (vars.get("NOTIFY_SOCKET") ?? "") !== "" && Number(vars.get(FD_STORE_ENV)) > 0;
+}
+function inspectService(unit, configDir, probes) {
+  const shown = probes.show(unit);
+  if (shown === void 0 || property(shown, "LoadState") !== "loaded") return void 0;
+  const pid = Number(property(shown, "MainPID") ?? "0");
+  const mainPid = Number.isInteger(pid) && pid > 0 ? pid : void 0;
+  const delegate = property(shown, "Delegate");
+  const storeMax = Number(property(shown, "FileDescriptorStoreMax"));
+  const status = mainPid === void 0 ? void 0 : probes.readFile(`/proc/${mainPid}/status`);
+  const environ = mainPid === void 0 ? void 0 : probes.readFile(`/proc/${mainPid}/environ`);
+  const systemd = Number(/^systemd (\d+)/.exec(probes.systemctlVersion?.() ?? "")?.[1]);
+  const kvm = probes.kvmGid();
+  const sliceMemory = Number(new RegExp(`(?:^|\\s)${BUILD_SLICE_MEMORY_ENV}=(\\d+)(?:\\s|$)`).exec(property(shown, "Environment") ?? "")?.[1]);
+  return {
+    unit,
+    ...Number.isSafeInteger(sliceMemory) && sliceMemory > 0 ? { buildSliceMemory: sliceMemory } : {},
+    mainPid,
+    delegate: delegate === void 0 ? void 0 : delegate !== "no",
+    ...Number.isInteger(storeMax) && property(shown, "FileDescriptorStoreMax") !== void 0 ? { fdStoreMax: storeMax } : {},
+    hasKvmGroup: status === void 0 || kvm === void 0 ? void 0 : holdsGroup(status, kvm),
+    ...environ === void 0 ? {} : { startedWithStore: startedWithStore(environ) },
+    ...systemd > 0 ? { systemdVersion: systemd } : {},
+    // `claude.env` first, where the service loads the credential from; `runner.env` holds one that was never moved.
+    credentialVariables: [.../* @__PURE__ */ new Set([...credentialNames(probes.readFile(join(configDir, "claude.env"))), ...credentialNames(probes.readFile(join(configDir, "runner.env")))])]
+  };
+}
+function realInspectProbes() {
+  return {
+    show: (unit) => {
+      const result = spawnSync("systemctl", ["show", "--property=LoadState,MainPID,Delegate,FileDescriptorStoreMax,Environment", unit], { encoding: "utf8", timeout: 1e4 });
+      return result.status === 0 ? result.stdout : void 0;
+    },
+    readFile: (path) => {
+      try {
+        return readFileSync(path, "utf8");
+      } catch {
+        return void 0;
+      }
+    },
+    systemctlVersion: () => {
+      const result = spawnSync("systemctl", ["--version"], { encoding: "utf8", timeout: 1e4 });
+      return result.status === 0 ? result.stdout : void 0;
+    },
+    kvmGid: () => {
+      try {
+        return statSync("/dev/kvm").gid;
+      } catch {
+        return void 0;
+      }
+    }
+  };
+}
 var CLAUDE_CREDENTIAL_ID = "claude";
 var CLAUDE_ENV_FILE = "claude.env";
 function claudeEnvPath(configPath) {
@@ -871,4 +1050,4 @@ function routesOf(counts) {
   return routes.length === 0 ? {} : { routes };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };

package/dist/{chunk-T7N3BAOO.js → chunk-GC5PVMIJ.js}

@@ -1,13 +1,67 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-J246WRLZ.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-DUPM5LVJ.js';
+import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-OS7DJOQJ.js';
+import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-UMYYYF7B.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-N7LAEN3T.js';
-import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
+import { runnerDir, RUNNER_DIR_MODE } from './chunk-PXGU3GKY.js';
+import { lchownSync, lstatSync, realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync, readdirSync } from 'fs';
 import { dirname, sep, join } from 'path';
+import { spawnSync } from 'child_process';
+import { userInfo } from 'os';
 
 createRequire(import.meta.url);
+function idOf(flag, account) {
+  const result = spawnSync("id", [flag, account], { encoding: "utf8" });
+  const id = Number(result.stdout);
+  return result.status === 0 && result.stdout.trim() !== "" && Number.isInteger(id) ? id : void 0;
+}
+function accountIdentity(account) {
+  const self = userInfo();
+  const uid = account === self.username ? self.uid : idOf("-u", account);
+  const gid = account === self.username ? self.gid : idOf("-g", account);
+  return uid === void 0 || gid === void 0 || uid < 0 || gid < 0 ? void 0 : { uid, gid };
+}
+function realOwnership() {
+  return {
+    uid: () => process.getuid?.(),
+    ownerOf: (path) => {
+      const info = lstatSync(path, { throwIfNoEntry: false });
+      return info === void 0 ? void 0 : { uid: info.uid, gid: info.gid };
+    },
+    identity: accountIdentity,
+    lchown: (path, owner) => lchownSync(path, owner.uid, owner.gid)
+  };
+}
+function forAnother(find, deps) {
+  if (deps.uid() !== 0) return void 0;
+  const owner = find();
+  return owner !== void 0 && owner.uid !== 0 ? owner : void 0;
+}
+function accountNamed(account, deps) {
+  return forAnother(() => deps.identity(account), deps);
+}
+function accountOwning(dir, deps) {
+  return forAnother(() => deps.ownerOf(dir), deps);
+}
+function handOver(owner, paths, deps) {
+  if (owner === void 0) return void 0;
+  const give = (path, tree) => {
+    const info = lstatSync(path, { throwIfNoEntry: false });
+    if (info === void 0) return;
+    deps.lchown(path, owner);
+    if (tree && info.isDirectory()) for (const name of readdirSync(path)) give(join(path, name), true);
+  };
+  for (const entry of paths) {
+    try {
+      give(entry.path, entry.tree === true);
+    } catch (err) {
+      return `${entry.path} could not be given to user id ${owner.uid}, the account the runner runs as (${err instanceof Error ? err.message : String(err)}): run \`chown -hR ${owner.uid}:${owner.gid} ${entry.path}\` as root`;
+    }
+  }
+  return void 0;
+}
+
+// src/runner/update/install-cmd.ts
 var RunnerInstallError = class extends Error {
 };
 var RunnerDowngradeError = class extends RunnerInstallError {
@@ -42,20 +96,17 @@ function runRunnerInstall(args) {
       `this CLI is ${version}, older than ${installed}, the version the runner runs from ${currentLink(configPath)}. Installing it would move the runner back to ${version}. Run \`${launcherPath(args.home)} ${command}\` instead, which runs ${installed}. To install ${version} anyway, run \`outerlayer ${command} --allow-downgrade\``
     );
   }
-  if (!isInLayout(configPath, entry) && !sameBuildInstalled(packageRoot, packageRootIn(versionDir(configPath, version)))) {
-    const target = packageRootIn(versionDir(configPath, version));
-    mkdirSync(dirname(target), { recursive: true, mode: RUNNER_DIR_MODE });
-    rmSync(target, { recursive: true, force: true });
-    cpSync(packageRoot, target, { recursive: true });
-    carryHoistedDevcontainerCli(packageRoot, target);
-  }
-  switchCurrent(configPath, version);
+  const ownership = args.ownership ?? realOwnership();
+  const account = args.account === void 0 ? accountOwning(dirname(configPath), ownership) : accountNamed(args.account, ownership);
+  const homeAccount = accountOwning(args.home, ownership);
   let written;
   try {
-    written = writeLauncher({ home: args.home, configPath, nodePath, replace: args.replace });
-  } catch (error) {
-    if (error instanceof LauncherWriteError) throw new RunnerInstallError(error.message);
-    throw error;
+    written = placeInLayout({ configPath, nodePath, home: args.home, replace: args.replace, entry, packageRoot, version });
+  } finally {
+    const launcher = launcherPath(args.home);
+    const problem = handOver(account, [{ path: runnerDir(configPath) }, { path: dirname(versionDir(configPath, version)) }, { path: versionDir(configPath, version), tree: true }, { path: currentLink(configPath) }], ownership) ?? // A launcher file the runner did not write stays with its owner.
+    handOver(homeAccount, [{ path: join(args.home, ".local") }, { path: dirname(launcher) }, ...written === void 0 || written.state === "foreign" ? [] : [{ path: launcher }]], ownership);
+    if (problem !== void 0 && written !== void 0) throw new RunnerInstallError(problem);
   }
   return {
     version,
@@ -69,6 +120,23 @@ function runRunnerInstall(args) {
     }
   };
 }
+function placeInLayout(input) {
+  const { configPath, packageRoot, version } = input;
+  if (!isInLayout(configPath, input.entry) && !sameBuildInstalled(packageRoot, packageRootIn(versionDir(configPath, version)))) {
+    const target = packageRootIn(versionDir(configPath, version));
+    mkdirSync(dirname(target), { recursive: true, mode: RUNNER_DIR_MODE });
+    rmSync(target, { recursive: true, force: true });
+    cpSync(packageRoot, target, { recursive: true });
+    carryHoistedDevcontainerCli(packageRoot, target);
+  }
+  switchCurrent(configPath, version);
+  try {
+    return writeLauncher({ home: input.home, configPath, nodePath: input.nodePath, replace: input.replace });
+  } catch (error) {
+    if (error instanceof LauncherWriteError) throw new RunnerInstallError(error.message);
+    throw error;
+  }
+}
 function sameBuildInstalled(source, target) {
   try {
     const wanted = readFileSync(join(source, "dist", "build-info.json"), "utf8");
@@ -95,4 +163,4 @@ function restartNote(result) {
   return `current moved from ${result.previous} to ${result.version}: a runner its service started restarts on ${result.version} at once when its running builds are container builds that carry on through the restart. Otherwise it takes no new work and waits for them to finish. A runner started by hand keeps running until you restart it`;
 }
 
-export { RunnerDowngradeError, RunnerInstallError, launcherSummary, restartNote, runRunnerInstall };
+export { RunnerDowngradeError, RunnerInstallError, accountIdentity, accountNamed, handOver, launcherSummary, realOwnership, restartNote, runRunnerInstall };