@outerlayer/cli 0.34.0-next.20261026232906 → 0.34.0-next.20261027013606

package/README.md

@@ -234,7 +234,8 @@ content:
   from GitHub, a pinned static `ffmpeg` build from GitHub, and the narration
   voice pack from Hugging Face and the npm registry, checking each against a
   digest. It also installs the CLI's pinned Playwright release from the npm
-  registry, with no browser. The image build runs outside
+  registry, and that release's headless Chromium and video encoder from
+  cdn.playwright.dev, checked against a digest. The image build runs outside
   any work item and sends nothing to your factory. `outerlayer runner start`
   builds each build's image the same way, before the build starts. That image
   build uses the host's network: the build's tunnel does not carry it, and
@@ -251,8 +252,8 @@ content:
   the host. An image build in a builder microVM also needs the files of the
   runner's tools layer, which the runner downloads on the host. It gets `gh`,
   `tini` and FFmpeg from github.com. It gets the narration voice pack from
-  huggingface.co and registry.npmjs.org. Each file is checked against a sha256
-  pinned in the CLI. The microVM reaches the network only
+  huggingface.co and registry.npmjs.org, and the demo browser from
+  cdn.playwright.dev. Each file is checked against a sha256 pinned in the CLI. The microVM reaches the network only
   through the same tunnel a container build uses, which the runner serves on
   Unix sockets and the guest reaches over vsock. In a build with Docker, the
   guest forwards the proxy connections of containers and `docker build` steps

package/dist/{build-M4UYZAFH.js → build-YSOVDTAN.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-XDJ376OP.js';
-import './chunk-KOZ6IBEI.js';
-import './chunk-4UPET3R7.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-7X2G463B.js';
+import './chunk-7GY3DVIL.js';
+import './chunk-GR7ZVGNI.js';
 export { RecipeError } from './chunk-HDLON3RJ.js';
+import './chunk-QUOITPN7.js';
 import './chunk-LQHCNXPK.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-L5VHGRQE.js';

package/dist/{build-disk-ZDVSSHO2.js → build-disk-RZ7AZKTY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-6NXBXWOP.js';
-import './chunk-KOZ6IBEI.js';
-import './chunk-4UPET3R7.js';
+export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-BLSEHKZ4.js';
+import './chunk-GR7ZVGNI.js';
 import './chunk-HDLON3RJ.js';
+import './chunk-QUOITPN7.js';
 import './chunk-L5VHGRQE.js';
 import './chunk-OOD5NDQA.js';
 import './chunk-DINRXUQA.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-26T23:31:14.294Z+386d50a","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-27T01:37:43.355Z+a8ae7a2","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-IORYS76D.js → builder-MQIL24HI.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-KOZ6IBEI.js';
-import './chunk-4UPET3R7.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-GR7ZVGNI.js';
 import './chunk-HDLON3RJ.js';
+import './chunk-QUOITPN7.js';
 import './chunk-L5VHGRQE.js';
 import './chunk-OOD5NDQA.js';
 import './chunk-DINRXUQA.js';

package/dist/{check-V66LZDNK.js → check-JD3GVQFP.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-IZVDQXTC.js';
+import { probeCredentials } from './chunk-EP3WBNMC.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-F5H3LVHR.js';
+import './chunk-DM4EEV73.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-MH6QLXUO.js';
 import './chunk-HOUFCUMH.js';
-import './chunk-PN7RMFPP.js';
+import './chunk-JM3YQ4LC.js';
 import './chunk-TS3EFB7S.js';
-import './chunk-TGBST2QL.js';
+import './chunk-FQOUIYBL.js';
 import './chunk-6CK2OC4Q.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-P3NPTFLF.js';
@@ -18,27 +18,28 @@ import './chunk-QRJIBTNQ.js';
 import './chunk-7DK2FOZ4.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-CFFVCI2I.js';
-import { managedProblems, managedFactsOf } from './chunk-XLJXO4QC.js';
+import { managedProblems, managedFactsOf } from './chunk-VUJURIPJ.js';
 import './chunk-YL3RWW7X.js';
 import './chunk-TBT347UY.js';
-import { findServiceUnit } from './chunk-JZLMFYFM.js';
+import { findServiceUnit } from './chunk-FQGC22IP.js';
 import './chunk-TZMDRHWB.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-DFBY6LX3.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-AHAYHJNN.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-XDJ376OP.js';
+import './chunk-7X2G463B.js';
+import './chunk-7GY3DVIL.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-3VZTNXK5.js';
 import './chunk-6KFJIU73.js';
 import './chunk-77VBS2RT.js';
 import './chunk-SDELQEG4.js';
 import './chunk-TQMI335S.js';
-import './chunk-63A6NUEZ.js';
-import './chunk-TLIZ7FY4.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-Q3L5AC75.js';
-import './chunk-6NXBXWOP.js';
-import './chunk-KOZ6IBEI.js';
-import './chunk-4UPET3R7.js';
+import './chunk-Q2KGDDUX.js';
+import './chunk-7QF2EXAN.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-DEJCZ43H.js';
+import './chunk-BLSEHKZ4.js';
+import './chunk-GR7ZVGNI.js';
 import './chunk-HDLON3RJ.js';
+import './chunk-QUOITPN7.js';
 import './chunk-LQHCNXPK.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-KT4CN6OU.js';

package/dist/chunk-7GY3DVIL.js

@@ -0,0 +1,255 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL_REVISION, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, HEADLESS_SHELL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_VERSION } from './chunk-QUOITPN7.js';
+import { PROXY_WARNING_FLAG } from './chunk-SDAEXUIX.js';
+import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
+
+createRequire(import.meta.url);
+
+// src/runner/image/dockerfiles.ts
+var FETCHED_DIR = "fetched";
+var FETCHED_VOICE_DIR = "voice";
+var FETCHED_FFMPEG = "ffmpeg.tar.xz";
+var FETCHED_GH = "gh.tgz";
+var FETCHED_TINI = "tini";
+var FETCHED_HEADLESS_SHELL = "headless-shell.zip";
+var FETCHED_PLAYWRIGHT_FFMPEG = "playwright-ffmpeg.zip";
+var IMAGE_BROWSER = {
+  dir: "/opt/outerlayer/browser",
+  playwright: "/opt/outerlayer/browser/playwright",
+  fontConfig: "/opt/outerlayer/browser/fonts.conf"
+};
+function plain(name, value, allowed) {
+  if (!allowed.test(value)) throw new Error(`${name} holds a character a Dockerfile line cannot carry safely: ${JSON.stringify(value)}`);
+  return value;
+}
+var DEFAULT_PACKAGES = ["git", "ca-certificates", "curl", "build-essential", "python3", "python3-pip", "python3-venv", "unzip", "jq"];
+function defaultDockerfile(baseImage, nodeImage) {
+  return [
+    ubuntuWithNode(baseImage, nodeImage, DEFAULT_PACKAGES),
+    // The browsers live in one shared folder so any user finds them. A build container's root filesystem is
+    // read-only, so the build user cannot add to this folder: a repository that needs another Playwright version
+    // installs that version's Chromium into a writable folder by setting PLAYWRIGHT_BROWSERS_PATH.
+    // `install --with-deps` runs apt-get as root and works on amd64 and arm64.
+    "ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright",
+    "RUN mkdir -p /ms-playwright \\",
+    ` && npx -y playwright@${plain("the Playwright version", PLAYWRIGHT_VERSION, /^[0-9.]+$/)} install --with-deps chromium \\`,
+    " && chmod -R a+rX /ms-playwright \\",
+    " && rm -rf /var/lib/apt/lists/* /root/.npm",
+    ""
+  ].join("\n");
+}
+function ubuntuWithNode(baseImage, nodeImage, packages) {
+  return [
+    `FROM ${baseImage}`,
+    "ENV DEBIAN_FRONTEND=noninteractive",
+    "RUN apt-get update \\",
+    ` && apt-get install -y --no-install-recommends ${packages.join(" ")} \\`,
+    " && rm -rf /var/lib/apt/lists/*",
+    `COPY --from=${nodeImage} /usr/local/bin/node /usr/local/bin/node`,
+    `COPY --from=${nodeImage} /usr/local/lib/node_modules /usr/local/lib/node_modules`,
+    "RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \\",
+    " && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \\",
+    " && ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack",
+    ""
+  ].join("\n");
+}
+function toolsDockerfile(parts) {
+  const recipeImage = plain("the recipe image", parts.recipeImage, /^[A-Za-z0-9_.:@/-]+$/);
+  const nodeImage = plain("the Node image", parts.nodeImage, /^[A-Za-z0-9_.:@/-]+$/);
+  const version = plain("the Claude Code version", parts.claudeCodeVersion, /^[A-Za-z0-9.+-]+$/);
+  const buildId = plain("the build id", parts.buildId, /^[A-Za-z0-9_.:+-]+$/);
+  const tools = JSON.stringify({ outerlayerBuildId: buildId, claudeCodeVersion: version, ghVersion: GH_VERSION });
+  const managedSettings = JSON.stringify({
+    hooks: Object.fromEntries(
+      ["SessionStart", "SessionEnd", "Stop", "PostToolUse"].map((event) => [event, [{ hooks: [{ type: "command", command: `outerlayer hook ${event}` }] }]])
+    )
+  });
+  const download = `NODE_USE_ENV_PROXY=1 node ${PROXY_WARNING_FLAG} -e 'fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return r.arrayBuffer()}).then((b)=>require("fs").writeFileSync(process.argv[2],Buffer.from(b)))'`;
+  const stream = `NODE_USE_ENV_PROXY=1 node ${PROXY_WARNING_FLAG} -e 'const{pipeline}=require("stream/promises"),{Readable}=require("stream"),fs=require("fs");fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return pipeline(Readable.fromWeb(r.body),fs.createWriteStream(process.argv[2]))})'`;
+  const voiceDir = `/out/opt/outerlayer/voice/${VOICE_PACK_VERSION}`;
+  const checks = VOICE_PACK_FILES.map((file) => `echo "${file.sha256}  ${voiceDir}/${file.name}" | sha256sum -c -`);
+  const fetched = parts.fetched === true;
+  const voice = fetched ? [`FROM ${nodeImage} AS voice`, `COPY ${FETCHED_DIR}/${FETCHED_VOICE_DIR}/ ${voiceDir}/`, `RUN ${checks.join(" \\\n && ")} \\`, " && chmod -R a+rX /out"] : [
+    // The voice pack streams to disk, one pinned file at a time, because a 300 MB model must not sit in a build's memory. Its own stage keeps it cached when the CLI changes.
+    `FROM ${nodeImage} AS voice`,
+    `RUN mkdir -p ${voiceDir} \\`,
+    ...VOICE_PACK_FILES.map((file) => ` && ${stream} ${file.url} ${voiceDir}/${file.name} \\`),
+    ...checks.map((check) => ` && ${check} \\`),
+    " && chmod -R a+rX /out"
+  ];
+  return [
+    ...voice,
+    // ffmpeg and ffprobe are static LGPL builds. espeak-ng comes from the stage image's own package, with the libraries and loader it needs, and runs as a separate program.
+    `FROM ${nodeImage} AS media`,
+    "ARG TARGETARCH",
+    "RUN apt-get update \\",
+    " && apt-get install -y --no-install-recommends ca-certificates espeak-ng xz-utils \\",
+    " && rm -rf /var/lib/apt/lists/*",
+    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_FFMPEG} /tmp/ffmpeg.tar.xz`] : [],
+    "RUN set -eu \\",
+    ` && case "$TARGETARCH" in \\`,
+    `      amd64) ffmpeg_file=${FFMPEG_STATIC.amd64.file}; ffmpeg_sha=${FFMPEG_STATIC.amd64.sha256} ;; \\`,
+    `      arm64) ffmpeg_file=${FFMPEG_STATIC.arm64.file}; ffmpeg_sha=${FFMPEG_STATIC.arm64.sha256} ;; \\`,
+    `      *) echo "no pinned ffmpeg for $TARGETARCH" >&2; exit 1 ;; \\`,
+    "    esac \\",
+    ...fetched ? [] : [` && ${download} https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/$ffmpeg_file /tmp/ffmpeg.tar.xz \\`],
+    ' && echo "$ffmpeg_sha  /tmp/ffmpeg.tar.xz" | sha256sum -c - \\',
+    " && tar -xJf /tmp/ffmpeg.tar.xz -C /tmp \\",
+    " && mkdir -p /out/usr/local/bin /out/opt/outerlayer/media/lib \\",
+    " && install -m 0755 /tmp/ffmpeg-*/bin/ffmpeg /tmp/ffmpeg-*/bin/ffprobe /out/usr/local/bin/ \\",
+    " && install -m 0755 /usr/bin/espeak-ng /out/opt/outerlayer/media/espeak-ng \\",
+    ` && for lib in $(ldd /usr/bin/espeak-ng | awk '$3 ~ /^\\// {print $3}'); do cp -L "$lib" /out/opt/outerlayer/media/lib/; done \\`,
+    " && cp -L $(ldd /usr/bin/espeak-ng | awk '$1 ~ /ld-linux/ {print $1}') /out/opt/outerlayer/media/lib/ld.so \\",
+    " && cp -r /usr/lib/*/espeak-ng-data /out/opt/outerlayer/media/espeak-ng-data \\",
+    ` && printf '%s\\n' '#!/bin/sh' 'ESPEAK_DATA_PATH=/opt/outerlayer/media' 'export ESPEAK_DATA_PATH' 'exec /opt/outerlayer/media/lib/ld.so --library-path /opt/outerlayer/media/lib /opt/outerlayer/media/espeak-ng "$@"' > /out/usr/local/bin/espeak-ng \\`,
+    " && chmod 0755 /out/usr/local/bin/espeak-ng \\",
+    " && chmod -R a+rX /out",
+    ...browserStage({ nodeImage, fetched, download, stream }),
+    `FROM ${recipeImage} AS recipe`,
+    `FROM ${nodeImage} AS stage`,
+    "ARG TARGETARCH",
+    `RUN npm install --global --prefix /out/opt/outerlayer/claude @anthropic-ai/claude-code@${version}`,
+    "COPY dist /out/opt/outerlayer/cli/dist",
+    "COPY package.json /out/opt/outerlayer/cli/package.json",
+    // `outerlayer demo record` runs a demo on the Playwright release this CLI depends on, found beside the CLI as an npm
+    // install puts it. Only the library, with no install scripts: its browser is the browser stage's, which no other
+    // Playwright in the image looks for.
+    "RUN mkdir -p /tmp/cli-deps && cd /tmp/cli-deps && echo '{}' > package.json \\",
+    ` && npm install --no-audit --no-fund --ignore-scripts @playwright/test@${plain("the Playwright version", PLAYWRIGHT_VERSION, /^[0-9.]+$/)} \\`,
+    " && mv node_modules /out/opt/outerlayer/cli/node_modules",
+    // `outerlayer claude` installs the maintained skills from this pack into the build's home folder before the agent starts.
+    "COPY skill-pack /out/opt/outerlayer/cli/skill-pack",
+    "RUN mkdir -p /out/opt/outerlayer/bin /out/usr/local/bin /out/etc/claude-code /out/build \\",
+    " && cp /usr/local/bin/node /out/opt/outerlayer/bin/node \\",
+    ` && printf '%s\\n' '#!/bin/sh' 'exec /opt/outerlayer/bin/node /opt/outerlayer/cli/dist/index.js "$@"' > /out/usr/local/bin/outerlayer \\`,
+    ` && printf '%s\\n' '#!/bin/sh' 'PATH=/opt/outerlayer/bin:$PATH' 'export PATH' 'exec /opt/outerlayer/claude/bin/claude "$@"' > /out/usr/local/bin/claude \\`,
+    ` && printf '%s\\n' '${tools}' > /out/opt/outerlayer/tools.json \\`,
+    ` && printf '%s\\n' '${managedSettings}' > /out/etc/claude-code/managed-settings.json \\`,
+    " && chmod 0755 /out/usr/local/bin/outerlayer /out/usr/local/bin/claude \\",
+    // Every build, whatever user runs it, writes here: the first mount of an empty volume copies this mode.
+    " && chmod 1777 /out/build",
+    ...parts.guestHelper === true ? [
+      "COPY guest/outerlayer-guest /out/opt/outerlayer/bin/outerlayer-guest",
+      // The guest mounts the build's tmpfs, the kernel's file systems and the run directory over these. The judge's tmpfs is mounted over its directory when the judge runs.
+      "RUN chmod 0755 /out/opt/outerlayer/bin/outerlayer-guest \\",
+      " && mkdir -p /out/outerlayer/job /out/outerlayer/judge /out/run /out/proc /out/sys /out/dev"
+    ] : [],
+    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_TINI} /tmp/tini`, `COPY ${FETCHED_DIR}/${FETCHED_GH} /tmp/gh.tgz`] : [],
+    `RUN set -eu \\`,
+    ` && case "$TARGETARCH" in \\`,
+    `      amd64) gh_sha=${GH_SHA256.amd64}; tini_sha=${TINI_SHA256.amd64} ;; \\`,
+    `      arm64) gh_sha=${GH_SHA256.arm64}; tini_sha=${TINI_SHA256.arm64} ;; \\`,
+    `      *) echo "no pinned gh and tini for $TARGETARCH" >&2; exit 1 ;; \\`,
+    "    esac \\",
+    ...fetched ? [] : [` && ${download} https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-$TARGETARCH /tmp/tini \\`],
+    ' && echo "$tini_sha  /tmp/tini" | sha256sum -c - \\',
+    " && install -m 0755 /tmp/tini /out/opt/outerlayer/bin/tini \\",
+    ...fetched ? [] : [` && ${download} https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_$TARGETARCH.tar.gz /tmp/gh.tgz \\`],
+    ' && echo "$gh_sha  /tmp/gh.tgz" | sha256sum -c - \\',
+    " && tar -xzf /tmp/gh.tgz -C /tmp \\",
+    ` && install -m 0755 /tmp/gh_${GH_VERSION}_linux_$TARGETARCH/bin/gh /out/usr/local/bin/gh`,
+    "COPY --from=recipe /etc/passwd /tmp/recipe-passwd",
+    "COPY --from=recipe /etc/group /tmp/recipe-group",
+    `RUN uid=$(awk -F: 'BEGIN{m=1499} $3>=1500 && $3<60000 && $3>m{m=$3} END{print m+1}' /tmp/recipe-passwd) \\`,
+    ` && gid=$(awk -F: 'BEGIN{m=1499} $3>=1500 && $3<60000 && $3>m{m=$3} END{print m+1}' /tmp/recipe-group) \\`,
+    " && { grep -v -e '^ol-agent:' -e '^ol-relay:' /tmp/recipe-passwd > /out/etc/passwd || true; } \\",
+    " && { grep -v -e '^ol-agent:' -e '^ol-relay:' /tmp/recipe-group > /out/etc/group || true; } \\",
+    // The relay's id is fixed because the runner names it in the container's `--tmpfs` options before the container exists.
+    ` && if awk -F: '$3==${RELAY_ID}{found=1} END{exit !found}' /out/etc/passwd; then echo "uid ${RELAY_ID} is taken by a user of the recipe image, and the relay needs it" >&2; exit 1; fi \\`,
+    ` && if awk -F: '$3==${RELAY_ID}{found=1} END{exit !found}' /out/etc/group; then echo "gid ${RELAY_ID} is taken by a group of the recipe image, and the relay needs it" >&2; exit 1; fi \\`,
+    ` && printf '%s\\n' "ol-agent:x:$uid:$gid::/build/home:/bin/sh" >> /out/etc/passwd \\`,
+    ` && printf '%s\\n' "ol-agent:x:$gid:" >> /out/etc/group \\`,
+    ` && printf '%s\\n' "${RELAY_USER}:x:${RELAY_ID}:${RELAY_ID}::/nonexistent:/usr/sbin/nologin" >> /out/etc/passwd \\`,
+    ` && printf '%s\\n' "${RELAY_USER}:x:${RELAY_ID}:" >> /out/etc/group \\`,
+    " && chmod 0644 /out/etc/passwd /out/etc/group \\",
+    " && chmod -R a+rX /out",
+    `FROM ${recipeImage}`,
+    "COPY --from=stage /out/ /",
+    "COPY --from=voice /out/ /",
+    "COPY --from=media /out/ /",
+    "COPY --from=browser /out/ /",
+    "ENV DISABLE_AUTOUPDATER=1",
+    // espeak-ng's audio library makes a private pulse-* folder for the user who runs it, in the temp folder unless XDG_RUNTIME_DIR names another.
+    // Made here, as root, it would ship in the image where the build user cannot read it, and the runner's disk check fails on it.
+    "RUN check=$(mktemp -d /tmp/ol-check.XXXXXX) \\",
+    " && outerlayer --version && claude --version && gh --version && ffmpeg -version && ffprobe -version \\",
+    ' && XDG_RUNTIME_DIR="$check" espeak-ng --version \\',
+    ` && ${IMAGE_BROWSER.playwright}/chromium_headless_shell-${HEADLESS_SHELL_REVISION}/chrome-headless-shell-linux*/chrome-headless-shell --version \\`,
+    ' && rm -rf "$check"',
+    ""
+  ].join("\n");
+}
+function browserStage(parts) {
+  const { fetched } = parts;
+  const libraries = [
+    "libasound2",
+    "libatk-bridge2.0-0",
+    "libatk1.0-0",
+    "libatspi2.0-0",
+    "libdbus-1-3",
+    "libexpat1",
+    "libgbm1",
+    "libglib2.0-0",
+    "libnspr4",
+    "libnss3",
+    "libudev1",
+    "libx11-6",
+    "libxcb1",
+    "libxcomposite1",
+    "libxdamage1",
+    "libxext6",
+    "libxfixes3",
+    "libxkbcommon0",
+    "libxrandr2"
+  ];
+  const fonts = ["fonts-liberation", "fonts-dejavu-core", "fonts-wqy-zenhei", "fonts-noto-color-emoji"];
+  const lib = `${IMAGE_BROWSER.dir}/lib`;
+  const browsers = `/out${IMAGE_BROWSER.playwright}`;
+  const fontSettings = [
+    '<?xml version="1.0"?>',
+    '<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">',
+    "<fontconfig>",
+    `  <dir>${IMAGE_BROWSER.dir}/fonts</dir>`,
+    "  <dir>/usr/share/fonts</dir>",
+    "  <dir>/usr/local/share/fonts</dir>",
+    '  <dir prefix="xdg">fonts</dir>',
+    `  <include ignore_missing="yes">${IMAGE_BROWSER.dir}/conf.d</include>`,
+    '  <cachedir prefix="xdg">fontconfig</cachedir>',
+    "</fontconfig>"
+  ];
+  const archive = (arch) => `      ${arch}) shell_file=${HEADLESS_SHELL[arch].file}; shell_sha=${HEADLESS_SHELL[arch].sha256}; encoder_file=${PLAYWRIGHT_FFMPEG[arch].file}; encoder_sha=${PLAYWRIGHT_FFMPEG[arch].sha256} ;; \\`;
+  return [
+    `FROM ${parts.nodeImage} AS browser`,
+    "ARG TARGETARCH",
+    "RUN apt-get update \\",
+    ` && apt-get install -y --no-install-recommends unzip patchelf fontconfig-config ${fonts.join(" ")} ${libraries.join(" ")} \\`,
+    " && rm -rf /var/lib/apt/lists/*",
+    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_HEADLESS_SHELL} /tmp/shell.zip`, `COPY ${FETCHED_DIR}/${FETCHED_PLAYWRIGHT_FFMPEG} /tmp/encoder.zip`] : [],
+    "RUN set -eu \\",
+    ` && case "$TARGETARCH" in \\`,
+    archive("amd64"),
+    archive("arm64"),
+    `      *) echo "no pinned browser for $TARGETARCH" >&2; exit 1 ;; \\`,
+    "    esac \\",
+    ...fetched ? [] : [` && ${parts.stream} ${HEADLESS_SHELL_BASE_URL}/$shell_file /tmp/shell.zip \\`, ` && ${parts.download} ${PLAYWRIGHT_FFMPEG_BASE_URL}/$encoder_file /tmp/encoder.zip \\`],
+    ' && echo "$shell_sha  /tmp/shell.zip" | sha256sum -c - \\',
+    ' && echo "$encoder_sha  /tmp/encoder.zip" | sha256sum -c - \\',
+    ` && mkdir -p ${browsers} /out${lib} /out${IMAGE_BROWSER.dir}/fonts /out${IMAGE_BROWSER.dir}/conf.d \\`,
+    ` && unzip -q /tmp/shell.zip -d ${browsers}/chromium_headless_shell-${HEADLESS_SHELL_REVISION} \\`,
+    ` && unzip -q /tmp/encoder.zip -d ${browsers}/ffmpeg-${PLAYWRIGHT_FFMPEG_REVISION} \\`,
+    ` && shell=$(echo ${browsers}/chromium_headless_shell-${HEADLESS_SHELL_REVISION}/chrome-headless-shell-linux*/chrome-headless-shell) \\`,
+    ' && find "$(dirname "$shell")/locales" -type f ! -name en-US.pak -delete \\',
+    " && nss=$(dpkg -L libnss3 | grep '\\.so$') \\",
+    ` && if ldd "$shell" $nss | grep 'not found'; then echo "the browser needs a library this stage does not install" >&2; exit 1; fi \\`,
+    ` && cp -L $(for file in "$shell" $nss; do ldd "$file" | awk '$3 ~ /^\\// {print $3}'; done | sort -u) $nss /out${lib}/ \\`,
+    ` && cp -L $(ldd "$shell" | awk '$1 ~ /ld-linux/ {print $1}') /out${lib}/ld.so \\`,
+    ` && patchelf --set-interpreter ${lib}/ld.so --force-rpath --set-rpath ${lib} "$shell" \\`,
+    ` && cp /usr/share/fonts/truetype/liberation/*.ttf /usr/share/fonts/truetype/dejavu/*.ttf /usr/share/fonts/truetype/wqy/wqy-zenhei.ttc /usr/share/fonts/truetype/noto/NotoColorEmoji.ttf /out${IMAGE_BROWSER.dir}/fonts/ \\`,
+    ` && cp -L /etc/fonts/conf.d/*.conf /out${IMAGE_BROWSER.dir}/conf.d/ \\`,
+    ` && printf '%s\\n' ${fontSettings.map((line) => `'${line}'`).join(" ")} > /out${IMAGE_BROWSER.fontConfig} \\`,
+    " && chmod -R a+rX /out"
+  ];
+}
+
+export { FETCHED_DIR, FETCHED_FFMPEG, FETCHED_GH, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_TINI, FETCHED_VOICE_DIR, IMAGE_BROWSER, defaultDockerfile, toolsDockerfile };

package/dist/{chunk-MIRCFK4X.js → chunk-7PCA37ZS.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { readNewestDemo } from './chunk-ER6KQCVJ.js';
 import { runEmitArtifact } from './chunk-QWXBWOVV.js';
 import { VoiceDownloadError, downloadPinned, sha256OfFile } from './chunk-2PGI6RDE.js';
-import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-4UPET3R7.js';
+import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-QUOITPN7.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { autoConnect } from './chunk-OKGHWCSK.js';
 import { C } from './chunk-ANPNT6PM.js';

package/dist/{chunk-TLIZ7FY4.js → chunk-7QF2EXAN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-Q3L5AC75.js';
-import { parseSize } from './chunk-KOZ6IBEI.js';
+import { builtinKind, keepsHostBuilder } from './chunk-DEJCZ43H.js';
+import { parseSize } from './chunk-GR7ZVGNI.js';
 import { runnerDir } from './chunk-GJ4KBHBD.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-SDAEXUIX.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';

package/dist/{chunk-XDJ376OP.js → chunk-7X2G463B.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerLabelValue } from './chunk-KOZ6IBEI.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-4UPET3R7.js';
+import { defaultDockerfile, toolsDockerfile } from './chunk-7GY3DVIL.js';
+import { runnerLabelValue } from './chunk-GR7ZVGNI.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-HDLON3RJ.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION } from './chunk-QUOITPN7.js';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-LQHCNXPK.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-GJ4KBHBD.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-SDAEXUIX.js';
-import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
+import { withGitConfig, tokenHeader } from './chunk-SDAEXUIX.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';
@@ -146,170 +146,6 @@ async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
     return { ok: false, reason: `the clone of ${remote} failed: ${detail}` };
   }
 }
-
-// src/runner/image/dockerfiles.ts
-var FETCHED_DIR = "fetched";
-var FETCHED_VOICE_DIR = "voice";
-var FETCHED_FFMPEG = "ffmpeg.tar.xz";
-var FETCHED_GH = "gh.tgz";
-var FETCHED_TINI = "tini";
-function plain(name, value, allowed) {
-  if (!allowed.test(value)) throw new Error(`${name} holds a character a Dockerfile line cannot carry safely: ${JSON.stringify(value)}`);
-  return value;
-}
-var DEFAULT_PACKAGES = ["git", "ca-certificates", "curl", "build-essential", "python3", "python3-pip", "python3-venv", "unzip", "jq"];
-function defaultDockerfile(baseImage, nodeImage) {
-  return [
-    ubuntuWithNode(baseImage, nodeImage, DEFAULT_PACKAGES),
-    // The browsers live in one shared folder so any user finds them. A build container's root filesystem is
-    // read-only, so the build user cannot add to this folder: a repository that needs another Playwright version
-    // installs that version's Chromium into a writable folder by setting PLAYWRIGHT_BROWSERS_PATH.
-    // `install --with-deps` runs apt-get as root and works on amd64 and arm64.
-    "ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright",
-    "RUN mkdir -p /ms-playwright \\",
-    ` && npx -y playwright@${plain("the Playwright version", PLAYWRIGHT_VERSION, /^[0-9.]+$/)} install --with-deps chromium \\`,
-    " && chmod -R a+rX /ms-playwright \\",
-    " && rm -rf /var/lib/apt/lists/* /root/.npm",
-    ""
-  ].join("\n");
-}
-function ubuntuWithNode(baseImage, nodeImage, packages) {
-  return [
-    `FROM ${baseImage}`,
-    "ENV DEBIAN_FRONTEND=noninteractive",
-    "RUN apt-get update \\",
-    ` && apt-get install -y --no-install-recommends ${packages.join(" ")} \\`,
-    " && rm -rf /var/lib/apt/lists/*",
-    `COPY --from=${nodeImage} /usr/local/bin/node /usr/local/bin/node`,
-    `COPY --from=${nodeImage} /usr/local/lib/node_modules /usr/local/lib/node_modules`,
-    "RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \\",
-    " && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \\",
-    " && ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack",
-    ""
-  ].join("\n");
-}
-function toolsDockerfile(parts) {
-  const recipeImage = plain("the recipe image", parts.recipeImage, /^[A-Za-z0-9_.:@/-]+$/);
-  const nodeImage = plain("the Node image", parts.nodeImage, /^[A-Za-z0-9_.:@/-]+$/);
-  const version = plain("the Claude Code version", parts.claudeCodeVersion, /^[A-Za-z0-9.+-]+$/);
-  const buildId = plain("the build id", parts.buildId, /^[A-Za-z0-9_.:+-]+$/);
-  const tools = JSON.stringify({ outerlayerBuildId: buildId, claudeCodeVersion: version, ghVersion: GH_VERSION });
-  const managedSettings = JSON.stringify({
-    hooks: Object.fromEntries(
-      ["SessionStart", "SessionEnd", "Stop", "PostToolUse"].map((event) => [event, [{ hooks: [{ type: "command", command: `outerlayer hook ${event}` }] }]])
-    )
-  });
-  const download = `NODE_USE_ENV_PROXY=1 node ${PROXY_WARNING_FLAG} -e 'fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return r.arrayBuffer()}).then((b)=>require("fs").writeFileSync(process.argv[2],Buffer.from(b)))'`;
-  const stream = `NODE_USE_ENV_PROXY=1 node ${PROXY_WARNING_FLAG} -e 'const{pipeline}=require("stream/promises"),{Readable}=require("stream"),fs=require("fs");fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return pipeline(Readable.fromWeb(r.body),fs.createWriteStream(process.argv[2]))})'`;
-  const voiceDir = `/out/opt/outerlayer/voice/${VOICE_PACK_VERSION}`;
-  const checks = VOICE_PACK_FILES.map((file) => `echo "${file.sha256}  ${voiceDir}/${file.name}" | sha256sum -c -`);
-  const fetched = parts.fetched === true;
-  const voice = fetched ? [`FROM ${nodeImage} AS voice`, `COPY ${FETCHED_DIR}/${FETCHED_VOICE_DIR}/ ${voiceDir}/`, `RUN ${checks.join(" \\\n && ")} \\`, " && chmod -R a+rX /out"] : [
-    // The voice pack streams to disk, one pinned file at a time, because a 300 MB model must not sit in a build's memory. Its own stage keeps it cached when the CLI changes.
-    `FROM ${nodeImage} AS voice`,
-    `RUN mkdir -p ${voiceDir} \\`,
-    ...VOICE_PACK_FILES.map((file) => ` && ${stream} ${file.url} ${voiceDir}/${file.name} \\`),
-    ...checks.map((check) => ` && ${check} \\`),
-    " && chmod -R a+rX /out"
-  ];
-  return [
-    ...voice,
-    // ffmpeg and ffprobe are static LGPL builds. espeak-ng comes from the stage image's own package, with the libraries and loader it needs, and runs as a separate program.
-    `FROM ${nodeImage} AS media`,
-    "ARG TARGETARCH",
-    "RUN apt-get update \\",
-    " && apt-get install -y --no-install-recommends ca-certificates espeak-ng xz-utils \\",
-    " && rm -rf /var/lib/apt/lists/*",
-    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_FFMPEG} /tmp/ffmpeg.tar.xz`] : [],
-    "RUN set -eu \\",
-    ` && case "$TARGETARCH" in \\`,
-    `      amd64) ffmpeg_file=${FFMPEG_STATIC.amd64.file}; ffmpeg_sha=${FFMPEG_STATIC.amd64.sha256} ;; \\`,
-    `      arm64) ffmpeg_file=${FFMPEG_STATIC.arm64.file}; ffmpeg_sha=${FFMPEG_STATIC.arm64.sha256} ;; \\`,
-    `      *) echo "no pinned ffmpeg for $TARGETARCH" >&2; exit 1 ;; \\`,
-    "    esac \\",
-    ...fetched ? [] : [` && ${download} https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/$ffmpeg_file /tmp/ffmpeg.tar.xz \\`],
-    ' && echo "$ffmpeg_sha  /tmp/ffmpeg.tar.xz" | sha256sum -c - \\',
-    " && tar -xJf /tmp/ffmpeg.tar.xz -C /tmp \\",
-    " && mkdir -p /out/usr/local/bin /out/opt/outerlayer/media/lib \\",
-    " && install -m 0755 /tmp/ffmpeg-*/bin/ffmpeg /tmp/ffmpeg-*/bin/ffprobe /out/usr/local/bin/ \\",
-    " && install -m 0755 /usr/bin/espeak-ng /out/opt/outerlayer/media/espeak-ng \\",
-    ` && for lib in $(ldd /usr/bin/espeak-ng | awk '$3 ~ /^\\// {print $3}'); do cp -L "$lib" /out/opt/outerlayer/media/lib/; done \\`,
-    " && cp -L $(ldd /usr/bin/espeak-ng | awk '$1 ~ /ld-linux/ {print $1}') /out/opt/outerlayer/media/lib/ld.so \\",
-    " && cp -r /usr/lib/*/espeak-ng-data /out/opt/outerlayer/media/espeak-ng-data \\",
-    ` && printf '%s\\n' '#!/bin/sh' 'ESPEAK_DATA_PATH=/opt/outerlayer/media' 'export ESPEAK_DATA_PATH' 'exec /opt/outerlayer/media/lib/ld.so --library-path /opt/outerlayer/media/lib /opt/outerlayer/media/espeak-ng "$@"' > /out/usr/local/bin/espeak-ng \\`,
-    " && chmod 0755 /out/usr/local/bin/espeak-ng \\",
-    " && chmod -R a+rX /out",
-    `FROM ${recipeImage} AS recipe`,
-    `FROM ${nodeImage} AS stage`,
-    "ARG TARGETARCH",
-    `RUN npm install --global --prefix /out/opt/outerlayer/claude @anthropic-ai/claude-code@${version}`,
-    "COPY dist /out/opt/outerlayer/cli/dist",
-    "COPY package.json /out/opt/outerlayer/cli/package.json",
-    // `outerlayer demo record` runs a demo on the Playwright release this CLI depends on, found beside the CLI as an npm
-    // install puts it. Only the library, with no install scripts: the layer adds no browser to a repository's own image.
-    "RUN mkdir -p /tmp/cli-deps && cd /tmp/cli-deps && echo '{}' > package.json \\",
-    ` && npm install --no-audit --no-fund --ignore-scripts @playwright/test@${plain("the Playwright version", PLAYWRIGHT_VERSION, /^[0-9.]+$/)} \\`,
-    " && mv node_modules /out/opt/outerlayer/cli/node_modules",
-    // `outerlayer claude` installs the maintained skills from this pack into the build's home folder before the agent starts.
-    "COPY skill-pack /out/opt/outerlayer/cli/skill-pack",
-    "RUN mkdir -p /out/opt/outerlayer/bin /out/usr/local/bin /out/etc/claude-code /out/build \\",
-    " && cp /usr/local/bin/node /out/opt/outerlayer/bin/node \\",
-    ` && printf '%s\\n' '#!/bin/sh' 'exec /opt/outerlayer/bin/node /opt/outerlayer/cli/dist/index.js "$@"' > /out/usr/local/bin/outerlayer \\`,
-    ` && printf '%s\\n' '#!/bin/sh' 'PATH=/opt/outerlayer/bin:$PATH' 'export PATH' 'exec /opt/outerlayer/claude/bin/claude "$@"' > /out/usr/local/bin/claude \\`,
-    ` && printf '%s\\n' '${tools}' > /out/opt/outerlayer/tools.json \\`,
-    ` && printf '%s\\n' '${managedSettings}' > /out/etc/claude-code/managed-settings.json \\`,
-    " && chmod 0755 /out/usr/local/bin/outerlayer /out/usr/local/bin/claude \\",
-    // Every build, whatever user runs it, writes here: the first mount of an empty volume copies this mode.
-    " && chmod 1777 /out/build",
-    ...parts.guestHelper === true ? [
-      "COPY guest/outerlayer-guest /out/opt/outerlayer/bin/outerlayer-guest",
-      // The guest mounts the build's tmpfs, the kernel's file systems and the run directory over these. The judge's tmpfs is mounted over its directory when the judge runs.
-      "RUN chmod 0755 /out/opt/outerlayer/bin/outerlayer-guest \\",
-      " && mkdir -p /out/outerlayer/job /out/outerlayer/judge /out/run /out/proc /out/sys /out/dev"
-    ] : [],
-    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_TINI} /tmp/tini`, `COPY ${FETCHED_DIR}/${FETCHED_GH} /tmp/gh.tgz`] : [],
-    `RUN set -eu \\`,
-    ` && case "$TARGETARCH" in \\`,
-    `      amd64) gh_sha=${GH_SHA256.amd64}; tini_sha=${TINI_SHA256.amd64} ;; \\`,
-    `      arm64) gh_sha=${GH_SHA256.arm64}; tini_sha=${TINI_SHA256.arm64} ;; \\`,
-    `      *) echo "no pinned gh and tini for $TARGETARCH" >&2; exit 1 ;; \\`,
-    "    esac \\",
-    ...fetched ? [] : [` && ${download} https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-$TARGETARCH /tmp/tini \\`],
-    ' && echo "$tini_sha  /tmp/tini" | sha256sum -c - \\',
-    " && install -m 0755 /tmp/tini /out/opt/outerlayer/bin/tini \\",
-    ...fetched ? [] : [` && ${download} https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_$TARGETARCH.tar.gz /tmp/gh.tgz \\`],
-    ' && echo "$gh_sha  /tmp/gh.tgz" | sha256sum -c - \\',
-    " && tar -xzf /tmp/gh.tgz -C /tmp \\",
-    ` && install -m 0755 /tmp/gh_${GH_VERSION}_linux_$TARGETARCH/bin/gh /out/usr/local/bin/gh`,
-    "COPY --from=recipe /etc/passwd /tmp/recipe-passwd",
-    "COPY --from=recipe /etc/group /tmp/recipe-group",
-    `RUN uid=$(awk -F: 'BEGIN{m=1499} $3>=1500 && $3<60000 && $3>m{m=$3} END{print m+1}' /tmp/recipe-passwd) \\`,
-    ` && gid=$(awk -F: 'BEGIN{m=1499} $3>=1500 && $3<60000 && $3>m{m=$3} END{print m+1}' /tmp/recipe-group) \\`,
-    " && { grep -v -e '^ol-agent:' -e '^ol-relay:' /tmp/recipe-passwd > /out/etc/passwd || true; } \\",
-    " && { grep -v -e '^ol-agent:' -e '^ol-relay:' /tmp/recipe-group > /out/etc/group || true; } \\",
-    // The relay's id is fixed because the runner names it in the container's `--tmpfs` options before the container exists.
-    ` && if awk -F: '$3==${RELAY_ID}{found=1} END{exit !found}' /out/etc/passwd; then echo "uid ${RELAY_ID} is taken by a user of the recipe image, and the relay needs it" >&2; exit 1; fi \\`,
-    ` && if awk -F: '$3==${RELAY_ID}{found=1} END{exit !found}' /out/etc/group; then echo "gid ${RELAY_ID} is taken by a group of the recipe image, and the relay needs it" >&2; exit 1; fi \\`,
-    ` && printf '%s\\n' "ol-agent:x:$uid:$gid::/build/home:/bin/sh" >> /out/etc/passwd \\`,
-    ` && printf '%s\\n' "ol-agent:x:$gid:" >> /out/etc/group \\`,
-    ` && printf '%s\\n' "${RELAY_USER}:x:${RELAY_ID}:${RELAY_ID}::/nonexistent:/usr/sbin/nologin" >> /out/etc/passwd \\`,
-    ` && printf '%s\\n' "${RELAY_USER}:x:${RELAY_ID}:" >> /out/etc/group \\`,
-    " && chmod 0644 /out/etc/passwd /out/etc/group \\",
-    " && chmod -R a+rX /out",
-    `FROM ${recipeImage}`,
-    "COPY --from=stage /out/ /",
-    "COPY --from=voice /out/ /",
-    "COPY --from=media /out/ /",
-    "ENV DISABLE_AUTOUPDATER=1",
-    // espeak-ng's audio library makes a private pulse-* folder for the user who runs it, in the temp folder unless XDG_RUNTIME_DIR names another.
-    // Made here, as root, it would ship in the image where the build user cannot read it, and the runner's disk check fails on it.
-    "RUN check=$(mktemp -d /tmp/ol-check.XXXXXX) \\",
-    " && outerlayer --version && claude --version && gh --version && ffmpeg -version && ffprobe -version \\",
-    ' && XDG_RUNTIME_DIR="$check" espeak-ng --version \\',
-    ' && rm -rf "$check"',
-    ""
-  ].join("\n");
-}
 function sha256(...chunks) {
   const hash = createHash("sha256");
   for (const chunk of chunks) hash.update(chunk);
@@ -612,4 +448,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath, runnerL
   return removed;
 }
 
-export { FETCHED_DIR, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR, KEY_PREFIX, TAG_HOST, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, toolsDockerfile, writeRecord };
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, writeRecord };