@outerlayer/cli 0.34.0-next.20261026232906 → 0.34.0-next.20261027023105

package/dist/{chunk-XDJ376OP.js → chunk-IYQPUGST.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerLabelValue } from './chunk-KOZ6IBEI.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-4UPET3R7.js';
+import { defaultDockerfile, toolsDockerfile } from './chunk-GTBY7BTI.js';
+import { runnerLabelValue } from './chunk-GR7ZVGNI.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-HDLON3RJ.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION } from './chunk-QUOITPN7.js';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-LQHCNXPK.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-GJ4KBHBD.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-SDAEXUIX.js';
-import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
+import { withGitConfig, tokenHeader } from './chunk-SDAEXUIX.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';
@@ -146,170 +146,6 @@ async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
     return { ok: false, reason: `the clone of ${remote} failed: ${detail}` };
   }
 }
-
-// src/runner/image/dockerfiles.ts
-var FETCHED_DIR = "fetched";
-var FETCHED_VOICE_DIR = "voice";
-var FETCHED_FFMPEG = "ffmpeg.tar.xz";
-var FETCHED_GH = "gh.tgz";
-var FETCHED_TINI = "tini";
-function plain(name, value, allowed) {
-  if (!allowed.test(value)) throw new Error(`${name} holds a character a Dockerfile line cannot carry safely: ${JSON.stringify(value)}`);
-  return value;
-}
-var DEFAULT_PACKAGES = ["git", "ca-certificates", "curl", "build-essential", "python3", "python3-pip", "python3-venv", "unzip", "jq"];
-function defaultDockerfile(baseImage, nodeImage) {
-  return [
-    ubuntuWithNode(baseImage, nodeImage, DEFAULT_PACKAGES),
-    // The browsers live in one shared folder so any user finds them. A build container's root filesystem is
-    // read-only, so the build user cannot add to this folder: a repository that needs another Playwright version
-    // installs that version's Chromium into a writable folder by setting PLAYWRIGHT_BROWSERS_PATH.
-    // `install --with-deps` runs apt-get as root and works on amd64 and arm64.
-    "ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright",
-    "RUN mkdir -p /ms-playwright \\",
-    ` && npx -y playwright@${plain("the Playwright version", PLAYWRIGHT_VERSION, /^[0-9.]+$/)} install --with-deps chromium \\`,
-    " && chmod -R a+rX /ms-playwright \\",
-    " && rm -rf /var/lib/apt/lists/* /root/.npm",
-    ""
-  ].join("\n");
-}
-function ubuntuWithNode(baseImage, nodeImage, packages) {
-  return [
-    `FROM ${baseImage}`,
-    "ENV DEBIAN_FRONTEND=noninteractive",
-    "RUN apt-get update \\",
-    ` && apt-get install -y --no-install-recommends ${packages.join(" ")} \\`,
-    " && rm -rf /var/lib/apt/lists/*",
-    `COPY --from=${nodeImage} /usr/local/bin/node /usr/local/bin/node`,
-    `COPY --from=${nodeImage} /usr/local/lib/node_modules /usr/local/lib/node_modules`,
-    "RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \\",
-    " && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \\",
-    " && ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack",
-    ""
-  ].join("\n");
-}
-function toolsDockerfile(parts) {
-  const recipeImage = plain("the recipe image", parts.recipeImage, /^[A-Za-z0-9_.:@/-]+$/);
-  const nodeImage = plain("the Node image", parts.nodeImage, /^[A-Za-z0-9_.:@/-]+$/);
-  const version = plain("the Claude Code version", parts.claudeCodeVersion, /^[A-Za-z0-9.+-]+$/);
-  const buildId = plain("the build id", parts.buildId, /^[A-Za-z0-9_.:+-]+$/);
-  const tools = JSON.stringify({ outerlayerBuildId: buildId, claudeCodeVersion: version, ghVersion: GH_VERSION });
-  const managedSettings = JSON.stringify({
-    hooks: Object.fromEntries(
-      ["SessionStart", "SessionEnd", "Stop", "PostToolUse"].map((event) => [event, [{ hooks: [{ type: "command", command: `outerlayer hook ${event}` }] }]])
-    )
-  });
-  const download = `NODE_USE_ENV_PROXY=1 node ${PROXY_WARNING_FLAG} -e 'fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return r.arrayBuffer()}).then((b)=>require("fs").writeFileSync(process.argv[2],Buffer.from(b)))'`;
-  const stream = `NODE_USE_ENV_PROXY=1 node ${PROXY_WARNING_FLAG} -e 'const{pipeline}=require("stream/promises"),{Readable}=require("stream"),fs=require("fs");fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return pipeline(Readable.fromWeb(r.body),fs.createWriteStream(process.argv[2]))})'`;
-  const voiceDir = `/out/opt/outerlayer/voice/${VOICE_PACK_VERSION}`;
-  const checks = VOICE_PACK_FILES.map((file) => `echo "${file.sha256}  ${voiceDir}/${file.name}" | sha256sum -c -`);
-  const fetched = parts.fetched === true;
-  const voice = fetched ? [`FROM ${nodeImage} AS voice`, `COPY ${FETCHED_DIR}/${FETCHED_VOICE_DIR}/ ${voiceDir}/`, `RUN ${checks.join(" \\\n && ")} \\`, " && chmod -R a+rX /out"] : [
-    // The voice pack streams to disk, one pinned file at a time, because a 300 MB model must not sit in a build's memory. Its own stage keeps it cached when the CLI changes.
-    `FROM ${nodeImage} AS voice`,
-    `RUN mkdir -p ${voiceDir} \\`,
-    ...VOICE_PACK_FILES.map((file) => ` && ${stream} ${file.url} ${voiceDir}/${file.name} \\`),
-    ...checks.map((check) => ` && ${check} \\`),
-    " && chmod -R a+rX /out"
-  ];
-  return [
-    ...voice,
-    // ffmpeg and ffprobe are static LGPL builds. espeak-ng comes from the stage image's own package, with the libraries and loader it needs, and runs as a separate program.
-    `FROM ${nodeImage} AS media`,
-    "ARG TARGETARCH",
-    "RUN apt-get update \\",
-    " && apt-get install -y --no-install-recommends ca-certificates espeak-ng xz-utils \\",
-    " && rm -rf /var/lib/apt/lists/*",
-    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_FFMPEG} /tmp/ffmpeg.tar.xz`] : [],
-    "RUN set -eu \\",
-    ` && case "$TARGETARCH" in \\`,
-    `      amd64) ffmpeg_file=${FFMPEG_STATIC.amd64.file}; ffmpeg_sha=${FFMPEG_STATIC.amd64.sha256} ;; \\`,
-    `      arm64) ffmpeg_file=${FFMPEG_STATIC.arm64.file}; ffmpeg_sha=${FFMPEG_STATIC.arm64.sha256} ;; \\`,
-    `      *) echo "no pinned ffmpeg for $TARGETARCH" >&2; exit 1 ;; \\`,
-    "    esac \\",
-    ...fetched ? [] : [` && ${download} https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/$ffmpeg_file /tmp/ffmpeg.tar.xz \\`],
-    ' && echo "$ffmpeg_sha  /tmp/ffmpeg.tar.xz" | sha256sum -c - \\',
-    " && tar -xJf /tmp/ffmpeg.tar.xz -C /tmp \\",
-    " && mkdir -p /out/usr/local/bin /out/opt/outerlayer/media/lib \\",
-    " && install -m 0755 /tmp/ffmpeg-*/bin/ffmpeg /tmp/ffmpeg-*/bin/ffprobe /out/usr/local/bin/ \\",
-    " && install -m 0755 /usr/bin/espeak-ng /out/opt/outerlayer/media/espeak-ng \\",
-    ` && for lib in $(ldd /usr/bin/espeak-ng | awk '$3 ~ /^\\// {print $3}'); do cp -L "$lib" /out/opt/outerlayer/media/lib/; done \\`,
-    " && cp -L $(ldd /usr/bin/espeak-ng | awk '$1 ~ /ld-linux/ {print $1}') /out/opt/outerlayer/media/lib/ld.so \\",
-    " && cp -r /usr/lib/*/espeak-ng-data /out/opt/outerlayer/media/espeak-ng-data \\",
-    ` && printf '%s\\n' '#!/bin/sh' 'ESPEAK_DATA_PATH=/opt/outerlayer/media' 'export ESPEAK_DATA_PATH' 'exec /opt/outerlayer/media/lib/ld.so --library-path /opt/outerlayer/media/lib /opt/outerlayer/media/espeak-ng "$@"' > /out/usr/local/bin/espeak-ng \\`,
-    " && chmod 0755 /out/usr/local/bin/espeak-ng \\",
-    " && chmod -R a+rX /out",
-    `FROM ${recipeImage} AS recipe`,
-    `FROM ${nodeImage} AS stage`,
-    "ARG TARGETARCH",
-    `RUN npm install --global --prefix /out/opt/outerlayer/claude @anthropic-ai/claude-code@${version}`,
-    "COPY dist /out/opt/outerlayer/cli/dist",
-    "COPY package.json /out/opt/outerlayer/cli/package.json",
-    // `outerlayer demo record` runs a demo on the Playwright release this CLI depends on, found beside the CLI as an npm
-    // install puts it. Only the library, with no install scripts: the layer adds no browser to a repository's own image.
-    "RUN mkdir -p /tmp/cli-deps && cd /tmp/cli-deps && echo '{}' > package.json \\",
-    ` && npm install --no-audit --no-fund --ignore-scripts @playwright/test@${plain("the Playwright version", PLAYWRIGHT_VERSION, /^[0-9.]+$/)} \\`,
-    " && mv node_modules /out/opt/outerlayer/cli/node_modules",
-    // `outerlayer claude` installs the maintained skills from this pack into the build's home folder before the agent starts.
-    "COPY skill-pack /out/opt/outerlayer/cli/skill-pack",
-    "RUN mkdir -p /out/opt/outerlayer/bin /out/usr/local/bin /out/etc/claude-code /out/build \\",
-    " && cp /usr/local/bin/node /out/opt/outerlayer/bin/node \\",
-    ` && printf '%s\\n' '#!/bin/sh' 'exec /opt/outerlayer/bin/node /opt/outerlayer/cli/dist/index.js "$@"' > /out/usr/local/bin/outerlayer \\`,
-    ` && printf '%s\\n' '#!/bin/sh' 'PATH=/opt/outerlayer/bin:$PATH' 'export PATH' 'exec /opt/outerlayer/claude/bin/claude "$@"' > /out/usr/local/bin/claude \\`,
-    ` && printf '%s\\n' '${tools}' > /out/opt/outerlayer/tools.json \\`,
-    ` && printf '%s\\n' '${managedSettings}' > /out/etc/claude-code/managed-settings.json \\`,
-    " && chmod 0755 /out/usr/local/bin/outerlayer /out/usr/local/bin/claude \\",
-    // Every build, whatever user runs it, writes here: the first mount of an empty volume copies this mode.
-    " && chmod 1777 /out/build",
-    ...parts.guestHelper === true ? [
-      "COPY guest/outerlayer-guest /out/opt/outerlayer/bin/outerlayer-guest",
-      // The guest mounts the build's tmpfs, the kernel's file systems and the run directory over these. The judge's tmpfs is mounted over its directory when the judge runs.
-      "RUN chmod 0755 /out/opt/outerlayer/bin/outerlayer-guest \\",
-      " && mkdir -p /out/outerlayer/job /out/outerlayer/judge /out/run /out/proc /out/sys /out/dev"
-    ] : [],
-    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_TINI} /tmp/tini`, `COPY ${FETCHED_DIR}/${FETCHED_GH} /tmp/gh.tgz`] : [],
-    `RUN set -eu \\`,
-    ` && case "$TARGETARCH" in \\`,
-    `      amd64) gh_sha=${GH_SHA256.amd64}; tini_sha=${TINI_SHA256.amd64} ;; \\`,
-    `      arm64) gh_sha=${GH_SHA256.arm64}; tini_sha=${TINI_SHA256.arm64} ;; \\`,
-    `      *) echo "no pinned gh and tini for $TARGETARCH" >&2; exit 1 ;; \\`,
-    "    esac \\",
-    ...fetched ? [] : [` && ${download} https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-$TARGETARCH /tmp/tini \\`],
-    ' && echo "$tini_sha  /tmp/tini" | sha256sum -c - \\',
-    " && install -m 0755 /tmp/tini /out/opt/outerlayer/bin/tini \\",
-    ...fetched ? [] : [` && ${download} https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_$TARGETARCH.tar.gz /tmp/gh.tgz \\`],
-    ' && echo "$gh_sha  /tmp/gh.tgz" | sha256sum -c - \\',
-    " && tar -xzf /tmp/gh.tgz -C /tmp \\",
-    ` && install -m 0755 /tmp/gh_${GH_VERSION}_linux_$TARGETARCH/bin/gh /out/usr/local/bin/gh`,
-    "COPY --from=recipe /etc/passwd /tmp/recipe-passwd",
-    "COPY --from=recipe /etc/group /tmp/recipe-group",
-    `RUN uid=$(awk -F: 'BEGIN{m=1499} $3>=1500 && $3<60000 && $3>m{m=$3} END{print m+1}' /tmp/recipe-passwd) \\`,
-    ` && gid=$(awk -F: 'BEGIN{m=1499} $3>=1500 && $3<60000 && $3>m{m=$3} END{print m+1}' /tmp/recipe-group) \\`,
-    " && { grep -v -e '^ol-agent:' -e '^ol-relay:' /tmp/recipe-passwd > /out/etc/passwd || true; } \\",
-    " && { grep -v -e '^ol-agent:' -e '^ol-relay:' /tmp/recipe-group > /out/etc/group || true; } \\",
-    // The relay's id is fixed because the runner names it in the container's `--tmpfs` options before the container exists.
-    ` && if awk -F: '$3==${RELAY_ID}{found=1} END{exit !found}' /out/etc/passwd; then echo "uid ${RELAY_ID} is taken by a user of the recipe image, and the relay needs it" >&2; exit 1; fi \\`,
-    ` && if awk -F: '$3==${RELAY_ID}{found=1} END{exit !found}' /out/etc/group; then echo "gid ${RELAY_ID} is taken by a group of the recipe image, and the relay needs it" >&2; exit 1; fi \\`,
-    ` && printf '%s\\n' "ol-agent:x:$uid:$gid::/build/home:/bin/sh" >> /out/etc/passwd \\`,
-    ` && printf '%s\\n' "ol-agent:x:$gid:" >> /out/etc/group \\`,
-    ` && printf '%s\\n' "${RELAY_USER}:x:${RELAY_ID}:${RELAY_ID}::/nonexistent:/usr/sbin/nologin" >> /out/etc/passwd \\`,
-    ` && printf '%s\\n' "${RELAY_USER}:x:${RELAY_ID}:" >> /out/etc/group \\`,
-    " && chmod 0644 /out/etc/passwd /out/etc/group \\",
-    " && chmod -R a+rX /out",
-    `FROM ${recipeImage}`,
-    "COPY --from=stage /out/ /",
-    "COPY --from=voice /out/ /",
-    "COPY --from=media /out/ /",
-    "ENV DISABLE_AUTOUPDATER=1",
-    // espeak-ng's audio library makes a private pulse-* folder for the user who runs it, in the temp folder unless XDG_RUNTIME_DIR names another.
-    // Made here, as root, it would ship in the image where the build user cannot read it, and the runner's disk check fails on it.
-    "RUN check=$(mktemp -d /tmp/ol-check.XXXXXX) \\",
-    " && outerlayer --version && claude --version && gh --version && ffmpeg -version && ffprobe -version \\",
-    ' && XDG_RUNTIME_DIR="$check" espeak-ng --version \\',
-    ' && rm -rf "$check"',
-    ""
-  ].join("\n");
-}
 function sha256(...chunks) {
   const hash = createHash("sha256");
   for (const chunk of chunks) hash.update(chunk);
@@ -612,4 +448,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath, runnerL
   return removed;
 }
 
-export { FETCHED_DIR, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR, KEY_PREFIX, TAG_HOST, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, toolsDockerfile, writeRecord };
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, writeRecord };

package/dist/{chunk-F5H3LVHR.js → chunk-JL4GSPGD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-TGBST2QL.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-TLIZ7FY4.js';
+import { scrubReason, stripTerminalControls } from './chunk-DX4FF5P5.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-7QF2EXAN.js';
 import { RunnerAlreadyRunningError, readPidFile } from './chunk-LQHCNXPK.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
 import { isSignatureRefusal, postJson } from './chunk-QABXXQ67.js';

package/dist/{chunk-DFBY6LX3.js → chunk-LKTH7PUH.js}

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-XDJ376OP.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, metadataFromLabels, writeRecord } from './chunk-IYQPUGST.js';
+import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-GTBY7BTI.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-3VZTNXK5.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-6KFJIU73.js';
 import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-77VBS2RT.js';
 import { runnerImageVersion } from './chunk-SDELQEG4.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-63A6NUEZ.js';
-import { runnerCredentialProblem, builtinKind, allowHostProblem, hostAllowed } from './chunk-Q3L5AC75.js';
-import { formatBytes, allocatedBytes } from './chunk-6NXBXWOP.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-KOZ6IBEI.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-4UPET3R7.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-Q2KGDDUX.js';
+import { runnerCredentialProblem, builtinKind, allowHostProblem, hostAllowed } from './chunk-DEJCZ43H.js';
+import { formatBytes, allocatedBytes } from './chunk-BLSEHKZ4.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-GR7ZVGNI.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-HDLON3RJ.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-QUOITPN7.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { postJson, WorkCommandError, getJson } from './chunk-QABXXQ67.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
@@ -539,7 +540,9 @@ function toolFilePins(arch) {
     ...VOICE_PACK_FILES.map((file) => ({ path: `${FETCHED_VOICE_DIR}/${file.name}`, url: file.url, sha256: file.sha256 })),
     { path: FETCHED_FFMPEG, url: `https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/${FFMPEG_STATIC[arch].file}`, sha256: FFMPEG_STATIC[arch].sha256 },
     { path: FETCHED_GH, url: `https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${arch}.tar.gz`, sha256: GH_SHA256[arch] },
-    { path: FETCHED_TINI, url: `https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-${arch}`, sha256: TINI_SHA256[arch] }
+    { path: FETCHED_TINI, url: `https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-${arch}`, sha256: TINI_SHA256[arch] },
+    { path: FETCHED_HEADLESS_SHELL, url: `${HEADLESS_SHELL_BASE_URL}/${HEADLESS_SHELL[arch].file}`, sha256: HEADLESS_SHELL[arch].sha256 },
+    { path: FETCHED_PLAYWRIGHT_FFMPEG, url: `${PLAYWRIGHT_FFMPEG_BASE_URL}/${PLAYWRIGHT_FFMPEG[arch].file}`, sha256: PLAYWRIGHT_FFMPEG[arch].sha256 }
   ];
 }
 function pinsDir(runnerDir2, pins) {

package/dist/{chunk-63A6NUEZ.js → chunk-Q2KGDDUX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-TLIZ7FY4.js';
+import { DEFAULT_UNIT_NAME } from './chunk-7QF2EXAN.js';
 import { RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-SDAEXUIX.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';

package/dist/{chunk-4UPET3R7.js → chunk-QUOITPN7.js}

@@ -106,7 +106,26 @@ var FFMPEG_STATIC = {
     sha256: "8463881ca7a25015ca6e00f5c91dd2f1637eb73d33c8230413cb74db760a86b3"
   }
 };
-var MEDIA_PINS = `${VOICE_PACK_VERSION}+${FFMPEG_BUILD_TAG}`;
 var PLAYWRIGHT_VERSION = "1.64.1";
+var HEADLESS_SHELL_VERSION = "156.0.8078.4";
+var HEADLESS_SHELL_REVISION = "1248";
+var HEADLESS_SHELL_BASE_URL = `https://cdn.playwright.dev/builds/cft/${HEADLESS_SHELL_VERSION}`;
+var HEADLESS_SHELL = {
+  amd64: {
+    file: "linux64/chrome-headless-shell-linux64.zip",
+    sha256: "c3e50596aef52c58f8fda3c6b3411c33d34c88b177b3ed1c2243359fd3b8ba20"
+  },
+  arm64: {
+    file: "linux-arm64/chrome-headless-shell-linux-arm64.zip",
+    sha256: "81ab9d4d3c301dc5fdfb6c541b9e6632b16fc819a6a854460f40a76fe2b2c476"
+  }
+};
+var PLAYWRIGHT_FFMPEG_REVISION = "1013";
+var PLAYWRIGHT_FFMPEG_BASE_URL = `https://cdn.playwright.dev/dbazure/download/playwright/builds/ffmpeg/${PLAYWRIGHT_FFMPEG_REVISION}`;
+var PLAYWRIGHT_FFMPEG = {
+  amd64: { file: "ffmpeg-linux.zip", sha256: "ee986434d158f74fb5d9c5ff1092026ceedb63f324fe90b5be89460926b7b679" },
+  arm64: { file: "ffmpeg-linux-arm64.zip", sha256: "457360e803a7d8d5f8f7f5ecf562b2d338f6b4f7f86339d0c31938a451e8878b" }
+};
+var MEDIA_PINS = `${VOICE_PACK_VERSION}+${FFMPEG_BUILD_TAG}+${HEADLESS_SHELL_VERSION}+${PLAYWRIGHT_FFMPEG_REVISION}`;
 
-export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice };
+export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, HEADLESS_SHELL_REVISION, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice };

package/dist/{chunk-T6HSNQAT.js → chunk-SSRB5HEL.js}

@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-ZDVSSHO2.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-4K6OG2SZ.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-RZ7AZKTY.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-NGCQD6SN.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-SF4GAWAO.js');
+    const { runnerHostChecks } = await import('./doctor-NEO7NXJJ.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-I4GWKY4T.js');
+      const { inspectRunnerService } = await import('./find-unit-IOCVYPNW.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-IZVDQXTC.js → chunk-UWDFA6WW.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-F5H3LVHR.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-JL4GSPGD.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
 import { writePendingUpdate } from './chunk-HOUFCUMH.js';
-import { renderUpdateSteps } from './chunk-PN7RMFPP.js';
+import { renderUpdateSteps } from './chunk-WPDL7MBC.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-TS3EFB7S.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-TGBST2QL.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-DX4FF5P5.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-XLJXO4QC.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-ZK3A4W3I.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-YL3RWW7X.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-DFBY6LX3.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-LKTH7PUH.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-77VBS2RT.js';
 import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SDELQEG4.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-Q3L5AC75.js';
-import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-6NXBXWOP.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-KOZ6IBEI.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-DEJCZ43H.js';
+import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-BLSEHKZ4.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-GR7ZVGNI.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-LQHCNXPK.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-QABXXQ67.js';
@@ -3279,7 +3279,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-V66LZDNK.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-YIUZ3UX3.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-PN7RMFPP.js → chunk-WPDL7MBC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-TGBST2QL.js';
+import { stripTerminalControls } from './chunk-DX4FF5P5.js';
 import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SDELQEG4.js';
 import { readFileSync } from 'fs';
 
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-XWQM4F7B.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-TRGA5QRL.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-XLJXO4QC.js → chunk-ZK3A4W3I.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-DFBY6LX3.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-TLIZ7FY4.js';
-import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-Q3L5AC75.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-6NXBXWOP.js';
-import { builderDiskPinned } from './chunk-4UPET3R7.js';
+import { placeholderQueues, placeholderProblem } from './chunk-LKTH7PUH.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-7QF2EXAN.js';
+import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-DEJCZ43H.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-BLSEHKZ4.js';
+import { builderDiskPinned } from './chunk-QUOITPN7.js';
 import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-SDAEXUIX.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';