@outerlayer/cli 0.34.0-next.20261027023105 → 0.34.0-next.20261027162612

package/dist/{chunk-LKTH7PUH.js → chunk-J3Q3QCOF.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, metadataFromLabels, writeRecord } from './chunk-IYQPUGST.js';
-import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-GTBY7BTI.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, SHARED_OWNER, SHARED_NAME, metadataFromLabels, writeRecord } from './chunk-5FHBVV25.js';
+import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-CMMEJJTL.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { runExec, execCapture, waitForAgent } from './chunk-3VZTNXK5.js';
-import { GUEST_CID, linkVsockSockets } from './chunk-6KFJIU73.js';
-import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-77VBS2RT.js';
-import { runnerImageVersion } from './chunk-SDELQEG4.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-Q2KGDDUX.js';
-import { runnerCredentialProblem, builtinKind, allowHostProblem, hostAllowed } from './chunk-DEJCZ43H.js';
-import { formatBytes, allocatedBytes } from './chunk-BLSEHKZ4.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-GR7ZVGNI.js';
-import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-HDLON3RJ.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-QUOITPN7.js';
+import { runExec, execCapture, waitForAgent } from './chunk-JVNQNKHV.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-BS3OYFAD.js';
+import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-7Q7GQELE.js';
+import { runnerImageVersion } from './chunk-CFJOONWM.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-OP2L7OXA.js';
+import { optionalEgress, runnerCredentialProblem, builtinKind, allowHostProblem, systemClock, emptyEgressCounts, hostAllowed } from './chunk-JWMJMQRF.js';
+import { formatBytes, allocatedBytes } from './chunk-LYX2RRSF.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-FLHBUQ2W.js';
+import { RecipeError, DOCKER_FEATURE, universalImagePending, writeSanitizedRecipe, classifyProperties } from './chunk-X7M73LKT.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, universalImagePinned, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-WX2HW2G2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { postJson, WorkCommandError, getJson } from './chunk-QABXXQ67.js';
+import { postJson, WorkCommandError, getJson } from './chunk-6IMQXBTZ.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { signerFor } from './chunk-L5VHGRQE.js';
+import { signerFor } from './chunk-RJZZFAXS.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-OOD5NDQA.js';
+import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-A6PJSNP6.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-XFJ7YOPD.js';
 import { downconvertSession } from './chunk-DINRXUQA.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-GJ4KBHBD.js';
-import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, JOB_MOUNT, realFdStorePort } from './chunk-SDAEXUIX.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-3VJYDWFV.js';
+import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, nodeAcceptsProxyWarningFlag, PROXY_WARNING_FLAG, JOB_MOUNT, realFdStorePort } from './chunk-GMKDAF37.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { spawn, spawnSync } from 'child_process';
 import { mkdirSync, existsSync, readFileSync, mkdtempSync, rmSync, chmodSync, truncateSync, statSync, accessSync, constants, readdirSync, writeFileSync, lstatSync, copyFileSync, renameSync, rmdirSync, unlinkSync, linkSync, openSync, closeSync, cpSync, writeSync, appendFileSync, createWriteStream, createReadStream } from 'fs';
@@ -32,7 +32,7 @@ import { randomBytes, createHash } from 'crypto';
 import { join, dirname, isAbsolute, relative, resolve, basename } from 'path';
 import { createConnection, connect, createServer as createServer$1, isIP } from 'net';
 import { availableParallelism, networkInterfaces, tmpdir } from 'os';
-import { Duplex, PassThrough, Transform } from 'stream';
+import { Transform, Duplex, PassThrough } from 'stream';
 import { createServer, request } from 'http';
 import { lookup } from 'dns/promises';
 import http2 from 'http2';
@@ -726,9 +726,9 @@ function createFirecrackerHost(options = {}) {
 var BUILD_PREFIX = "build-";
 var LEAF = "runner";
 function serviceDirectory(selfCgroup, mount) {
-  const line = selfCgroup?.split("\n").find((l) => l.startsWith("0::"));
-  if (line === void 0) return void 0;
-  const path = line.slice(3).trim();
+  const line2 = selfCgroup?.split("\n").find((l) => l.startsWith("0::"));
+  if (line2 === void 0) return void 0;
+  const path = line2.slice(3).trim();
   if (!path.endsWith(".service")) return void 0;
   return join(mount, path);
 }
@@ -1111,6 +1111,9 @@ var IDLE_TIMEOUT_MS = 10 * 6e4;
 var STALLED_RESPONSE_MS = 6e4;
 var MAX_BAD_GATEWAY_LINES = 10;
 var BAD_GATEWAY_WINDOW_MS = 1e4;
+var CONNECTION_RATE_RANGE = "connection-rate";
+var OPEN_CONNECTIONS_RANGE = "open-connections";
+var COUNTS_SAVE_MS = 500;
 async function systemResolve(host) {
   const found = await lookup(host, { all: true, verbatim: true });
   return found.map((a) => ({ address: a.address }));
@@ -1145,6 +1148,8 @@ async function startTunnel(socketPath, opts = {}) {
   const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
   const idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
   const stalledResponseMs = opts.stalledResponseMs ?? STALLED_RESPONSE_MS;
+  const limits2 = opts.egress ?? { connectionsPerSecond: 0, connectionBurst: 1, openConnections: 0, sendBytesPerSecond: 0, flagHosts: 0 };
+  const clock = opts.clock ?? systemClock;
   let windowStartedMs = 0;
   let linesInWindow = 0;
   let suppressed = 0;
@@ -1173,6 +1178,15 @@ async function startTunnel(socketPath, opts = {}) {
   const extraRefusalKeys = /* @__PURE__ */ new Set();
   let refusalsMore = 0;
   const destinations = [];
+  const counts = emptyEgressCounts();
+  let openNow = 0;
+  let secondOf = 0;
+  let openedInSecond = 0;
+  let tokens = limits2.connectionBurst;
+  let refilledAt = clock.now();
+  let nextSendFree = 0;
+  let lastSendClock = 0;
+  const limitLogged = /* @__PURE__ */ new Set();
   const routes = /* @__PURE__ */ Object.create(null);
   if (opts.recordPath !== void 0 && existsSync(opts.recordPath)) {
     try {
@@ -1183,8 +1197,12 @@ async function startTunnel(socketPath, opts = {}) {
       }
       hostsMore = saved.hostsMore ?? 0;
       for (const name of saved.destinations ?? []) destinations.push(name);
-      for (const [name, counts] of Object.entries(saved.routes ?? {})) routes[name] = { requests: counts.requests, failures: counts.failures };
+      for (const [name, counts2] of Object.entries(saved.routes ?? {})) routes[name] = { requests: counts2.requests, failures: counts2.failures };
       refusalsMore = saved.refusalsMore ?? 0;
+      if (saved.egress !== void 0) {
+        const kept = saved.egress;
+        Object.assign(counts, kept, { refused: { ...counts.refused, ...kept.refused } });
+      }
       for (const refusal of saved.refusals ?? []) {
         refusals.push(refusal);
         refusalKeys.add(`${refusal.host}|${refusal.address}|${refusal.range}`);
@@ -1198,8 +1216,9 @@ async function startTunnel(socketPath, opts = {}) {
     refusalsMore,
     refusals: refusals.map((r) => ({ ...r })),
     destinations: [...destinations],
+    egress: { ...counts, refused: { ...counts.refused } },
     // Absent until a route is served, so a record of a tunnel that served none is the shape an older runner wrote.
-    ...Object.keys(routes).length === 0 ? {} : { routes: Object.fromEntries(Object.entries(routes).map(([name, counts]) => [name, { ...counts }])) }
+    ...Object.keys(routes).length === 0 ? {} : { routes: Object.fromEntries(Object.entries(routes).map(([name, counts2]) => [name, { ...counts2 }])) }
   });
   const persist = () => {
     if (opts.recordPath === void 0) return;
@@ -1208,6 +1227,15 @@ async function startTunnel(socketPath, opts = {}) {
     } catch {
     }
   };
+  let saveTimer;
+  const persistSoon = () => {
+    if (opts.recordPath === void 0 || saveTimer !== void 0) return;
+    saveTimer = setTimeout(() => {
+      saveTimer = void 0;
+      persist();
+    }, COUNTS_SAVE_MS);
+    saveTimer.unref();
+  };
   const destinationUsed = (name) => {
     if (destinations.includes(name)) return;
     destinations.push(name);
@@ -1219,9 +1247,9 @@ async function startTunnel(socketPath, opts = {}) {
     persist();
   };
   const routeFinished = (name, ok) => {
-    const counts = routes[name] ??= { requests: 0, failures: 0 };
-    counts.requests++;
-    if (!ok) counts.failures++;
+    const counts2 = routes[name] ??= { requests: 0, failures: 0 };
+    counts2.requests++;
+    if (!ok) counts2.failures++;
     persist();
   };
   const reached = (host) => {
@@ -1235,6 +1263,10 @@ async function startTunnel(socketPath, opts = {}) {
       hosts.push(name);
       seen.add(name);
     }
+    if (limits2.flagHosts > 0 && !counts.hostsFlagged && hosts.length + hostsMore > limits2.flagHosts) {
+      counts.hostsFlagged = true;
+      opts.log?.(`tunnel: this build reached more than ${limits2.flagHosts} distinct remote hosts`);
+    }
     persist();
   };
   const refused2 = (host, address, range) => {
@@ -1250,6 +1282,64 @@ async function startTunnel(socketPath, opts = {}) {
     }
     persist();
   };
+  const limitText = (range) => range === CONNECTION_RATE_RANGE ? `${limits2.connectionsPerSecond} new connections per second, burst ${limits2.connectionBurst}` : `${limits2.openConnections} open connections`;
+  const admit = () => {
+    const now = clock.now();
+    if (limits2.openConnections > 0 && openNow >= limits2.openConnections) return OPEN_CONNECTIONS_RANGE;
+    if (limits2.connectionsPerSecond > 0) {
+      tokens = Math.min(limits2.connectionBurst, tokens + Math.max(0, now - refilledAt) / 1e3 * limits2.connectionsPerSecond);
+      refilledAt = now;
+      if (tokens < 1) return CONNECTION_RATE_RANGE;
+      tokens -= 1;
+    }
+    counts.connectionsOpened++;
+    openNow++;
+    counts.peakOpenConnections = Math.max(counts.peakOpenConnections, openNow);
+    const second = Math.floor(now / 1e3);
+    if (second !== secondOf) {
+      secondOf = second;
+      openedInSecond = 0;
+    }
+    openedInSecond++;
+    counts.peakConnectionsPerSecond = Math.max(counts.peakConnectionsPerSecond, openedInSecond);
+    persistSoon();
+    return void 0;
+  };
+  const release = () => {
+    openNow--;
+  };
+  const refuseOverLimit = (host, range) => {
+    if (range === CONNECTION_RATE_RANGE) counts.refused.connectionRate++;
+    else counts.refused.openConnections++;
+    refused2(host, NOT_RESOLVED, range);
+    if (!limitLogged.has(range)) {
+      limitLogged.add(range);
+      opts.log?.(`tunnel refused ${host}: over the ${range} limit of ${limitText(range)}. Later refusals of this kind are counted when the build ends`);
+    }
+    persistSoon();
+    return { status: 429, body: `refused: this build is over the ${range} limit of ${limitText(range)}
+` };
+  };
+  const waitToSend = async (n) => {
+    const now = clock.now();
+    if (now < lastSendClock) nextSendFree = Math.max(0, nextSendFree - (lastSendClock - now));
+    lastSendClock = now;
+    nextSendFree = Math.max(nextSendFree, now) + n * 1e3 / limits2.sendBytesPerSecond;
+    await clock.sleep(nextSendFree - now);
+  };
+  const meter = () => new Transform({
+    highWaterMark: 64 * 1024,
+    transform(chunk, _encoding, done) {
+      waitToSend(chunk.length).then(
+        () => {
+          counts.bytesSent += chunk.length;
+          persistSoon();
+          done(null, chunk);
+        },
+        (err) => done(err)
+      );
+    }
+  });
   async function decide(host, port) {
     if (opts.allowHosts !== void 0 && !hostAllowed(host, opts.allowHosts)) {
       refused2(host, NOT_RESOLVED, NOT_ALLOWED_RANGE);
@@ -1294,7 +1384,7 @@ async function startTunnel(socketPath, opts = {}) {
   server.on("connect", (req, client, head) => {
     void tunnelConnect(req, client, head);
   });
-  const statusLine = (status) => `HTTP/1.1 ${status} ${status === 403 ? "Forbidden" : "Bad Gateway"}`;
+  const statusLine = (status) => `HTTP/1.1 ${status} ${status === 403 ? "Forbidden" : status === 429 ? "Too Many Requests" : "Bad Gateway"}`;
   const reply = (client, status, body) => {
     client.end(`${statusLine(status)}\r
 Content-Type: text/plain\r
@@ -1310,6 +1400,13 @@ ${body}`);
       client.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
       return;
     }
+    const over = admit();
+    if (over !== void 0) {
+      const refusal = refuseOverLimit(target.host, over);
+      reply(client, refusal.status, refusal.body);
+      return;
+    }
+    client.once("close", release);
     const decision = await decide(target.host, target.port);
     if (!decision.ok) {
       reply(client, decision.status, decision.body);
@@ -1336,16 +1433,33 @@ ${body}`);
         if (!upstream.readableEnded && !client.writableEnded) client.destroy(abortedError("the tunnel closed the connection to the server before it ended"));
         else client.resume();
       });
-      client.once("end", () => {
+      const buildEnded = () => {
         upstream.destroy();
         client.end();
-      });
+      };
+      const metered = limits2.sendBytesPerSecond > 0 ? meter() : void 0;
+      if (metered === void 0) client.once("end", buildEnded);
+      else metered.once("end", buildEnded);
       reached(target.host);
       client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-      upstream.write(head);
+      if (metered !== void 0) {
+        if (head.length > 0) metered.write(head);
+      } else {
+        counts.bytesSent += head.length;
+        upstream.write(head);
+      }
       releaseWhenStalled(client, upstream);
       upstream.pipe(client);
-      client.pipe(upstream);
+      if (metered === void 0) {
+        client.on("data", (chunk) => {
+          counts.bytesSent += chunk.length;
+          persistSoon();
+        });
+        client.pipe(upstream);
+      } else {
+        client.once("close", () => metered.destroy());
+        client.pipe(metered).pipe(upstream);
+      }
     };
     if (upstream.readyState === "open") established();
     else upstream.once("connect", established);
@@ -1395,6 +1509,14 @@ ${body}`);
     }
     const host = url.hostname.replace(/^\[|\]$/g, "");
     const port = url.port === "" ? 80 : Number(url.port);
+    const over = admit();
+    if (over !== void 0) {
+      const refusal = refuseOverLimit(host, over);
+      res.writeHead(refusal.status, { "Content-Type": "text/plain", Connection: "close" });
+      res.end(refusal.body);
+      return;
+    }
+    res.once("close", release);
     const decision = await decide(host, port);
     if (!decision.ok) {
       res.writeHead(decision.status, { "Content-Type": "text/plain", Connection: "close" });
@@ -1430,7 +1552,17 @@ ${body}`);
         res.destroy();
       }
     });
-    req.pipe(upstream);
+    if (limits2.sendBytesPerSecond > 0) {
+      const metered = meter();
+      res.once("close", () => metered.destroy());
+      req.pipe(metered).pipe(upstream);
+    } else {
+      req.on("data", (chunk) => {
+        counts.bytesSent += chunk.length;
+        persistSoon();
+      });
+      req.pipe(upstream);
+    }
   }
   if (opts.socket !== false) {
     if (opts.listenOn !== void 0) {
@@ -1463,6 +1595,9 @@ ${body}`);
       return { port: tcp.address().port };
     },
     close: () => new Promise((resolveClose) => {
+      clearTimeout(saveTimer);
+      saveTimer = void 0;
+      persist();
       for (const socket of sockets) socket.destroy();
       for (const tcp of tcpServers) tcp.close();
       server.close(() => resolveClose());
@@ -1646,14 +1781,14 @@ async function deliverExecMaven(build, workdir, base, run, note) {
 }
 function onceNote(write) {
   const seen = /* @__PURE__ */ new Set();
-  return (line) => {
-    if (seen.has(line)) return;
-    seen.add(line);
-    write(line);
+  return (line2) => {
+    if (seen.has(line2)) return;
+    seen.add(line2);
+    write(line2);
   };
 }
 function attemptNote(log, tag) {
-  return onceNote((line) => log.line(`${tag} ${line}`));
+  return onceNote((line2) => log.line(`${tag} ${line2}`));
 }
 function hostCommandEnvironment(base, build, config, hooksPath, note) {
   let env = { ...base };
@@ -1690,6 +1825,7 @@ async function startHostServices(input) {
     jobDir: input.jobDir,
     destinations,
     allowHosts: config.build?.allowHosts,
+    ...optionalEgress(config),
     serve: input.process ? "tcp" : "both",
     proxy: input.process,
     ...input.process ? { builtIns: { gatewayUrl: config.url, itemKey: input.itemKey, claudeUpstream: runtime.claudeUpstream } } : {},
@@ -1739,7 +1875,7 @@ function e2fsckRunner(run = runWithSpawn(), env = process.env) {
   };
 }
 function firstLine2(text) {
-  return text.split("\n").find((line) => line.trim() !== "")?.trim() ?? "";
+  return text.split("\n").find((line2) => line2.trim() !== "")?.trim() ?? "";
 }
 async function giveBackCacheSpace(input) {
   try {
@@ -1985,7 +2121,8 @@ function readStored(prepared) {
       toolsBuilt: false,
       checkedCommit: prepared.checkout.commit,
       recordDir: prepared.recordDir,
-      report: stored.report,
+      // On the universal image the stored report is shared by every repository, so the reused result names this build's repository and commit.
+      report: prepared.location.kind === "default" ? { ...stored.report, repository: prepared.repository, sourceCommit: prepared.checkout.commit, defaultBranch: prepared.checkout.defaultBranch } : stored.report,
       removed: [],
       rootfs: { path, env: stored.env, user: stored.user }
     };
@@ -2012,6 +2149,7 @@ async function buildRootDiskInMicroVm(opts, deps) {
   try {
     const stored = readStored(prepared);
     if (stored !== void 0) return stored;
+    if (prepared.location.kind === "default" && !(deps.universalPublished ?? universalImagePinned)()) throw universalImagePending();
     return await buildInBuilder(opts, deps, prepared);
   } finally {
     prepared.release();
@@ -2025,8 +2163,8 @@ async function buildInBuilder(opts, deps, prepared) {
   const { repository, owner, name, checkout, location, recipe, repoRecords, recordDir, logPath } = prepared;
   const rKey = prepared.recipeKey.slice(0, KEY_PREFIX);
   const tKey = prepared.toolsKey.slice(0, KEY_PREFIX);
-  const recipeTag = `${TAG_HOST}/recipe/${repository}:${rKey}`;
-  const buildTag = `${TAG_HOST}/build/${repository}:${rKey}-${tKey}`;
+  const recipeTag = `${TAG_HOST}/recipe/${prepared.tagName}:${rKey}`;
+  const buildTag = `${TAG_HOST}/build/${prepared.tagName}:${rKey}-${tKey}`;
   const runner = runnerDir(opts.configPath);
   const builderDisk = await ports.builderDisk(runner);
   const toolFilesDir = await ports.toolFiles(runner);
@@ -2037,7 +2175,7 @@ async function buildInBuilder(opts, deps, prepared) {
   const dir = buildDir(opts.configPath, id);
   const state = { buildId: id, buildDir: dir, vsockPath: vsockPath(dir) };
   const record = { owner, name, id };
-  const cachePath = builderCacheDiskPath(opts.configPath, owner, name);
+  const cachePath = location.kind === "default" ? builderCacheDiskPath(opts.configPath, SHARED_OWNER, SHARED_NAME) : builderCacheDiskPath(opts.configPath, owner, name);
   const diskPath = join(dir, "build.ext4");
   const partial = join(recordDir, "rootfs.ext4.partial");
   const scratchRoot = opts.tmpDir ?? tmpdir();
@@ -2080,12 +2218,12 @@ async function buildInBuilder(opts, deps, prepared) {
       lines.push(pending);
       pending = "";
     }
-    for (const line of lines) {
-      if (line.startsWith(RESULT_PREFIX)) result = line.slice(RESULT_PREFIX.length);
-      else if (line.startsWith(ENGINE_PANIC_PREFIX)) enginePanic ??= line.slice(ENGINE_PANIC_PREFIX.length);
-      else if (line === ENGINE_STOPPED_LINE) continue;
+    for (const line2 of lines) {
+      if (line2.startsWith(RESULT_PREFIX)) result = line2.slice(RESULT_PREFIX.length);
+      else if (line2.startsWith(ENGINE_PANIC_PREFIX)) enginePanic ??= line2.slice(ENGINE_PANIC_PREFIX.length);
+      else if (line2 === ENGINE_STOPPED_LINE) continue;
       else {
-        tail.push(line);
+        tail.push(line2);
         if (tail.length > LOG_TAIL_LINES) tail.shift();
       }
     }
@@ -2126,6 +2264,7 @@ async function buildInBuilder(opts, deps, prepared) {
     tunnel = await deps.startTunnel(join(dir, TUNNEL_SOCKET), {
       ...deps.tunnelOptions,
       ...opts.allowHosts === void 0 ? {} : { allowHosts: opts.allowHosts },
+      ...opts.egress === void 0 ? {} : { egress: opts.egress },
       recordPath: join(dir, "tunnel.json")
     });
     const configPath = join(dir, "vm.json");
@@ -2158,7 +2297,8 @@ async function buildInBuilder(opts, deps, prepared) {
     let recipeParts = { kind: "default" };
     const recipeDir = join(scratch, "recipe");
     mkdirSync(recipeDir);
-    if (location.kind === "default") writeFileSync(join(recipeDir, "Dockerfile"), prepared.defaultText);
+    if (location.kind === "default") writeFileSync(join(recipeDir, "Dockerfile"), `FROM ${UNIVERSAL_IMAGE}
+`);
     else {
       sanitized = writeSanitizedRecipe(checkout.dir, location, recipe);
       recipeParts = { kind: "file", config: relative(checkout.dir, sanitized) };
@@ -2173,7 +2313,15 @@ async function buildInBuilder(opts, deps, prepared) {
     mkdirSync(join(toolsDir, FETCHED_DIR));
     writeFileSync(
       join(toolsDir, "Dockerfile"),
-      toolsDockerfile({ recipeImage: recipeTag, nodeImage: prepared.nodeImage, claudeCodeVersion: prepared.claudeCodeVersion, buildId: opts.cli.buildId, guestHelper: true, fetched: true })
+      toolsDockerfile({
+        recipeImage: recipeTag,
+        nodeImage: prepared.nodeImage,
+        claudeCodeVersion: prepared.claudeCodeVersion,
+        buildId: opts.cli.buildId,
+        guestHelper: true,
+        fetched: true,
+        ...location.kind === "default" ? { universal: true } : {}
+      })
     );
     inputs = builderInput({ checkoutDir: checkout.dir, toolsDir, toolFilesDir, recipeDir }, archive);
     for (const { target, stream } of inputs) {
@@ -2223,6 +2371,7 @@ async function buildInBuilder(opts, deps, prepared) {
       sourceCommit: checkout.commit,
       defaultBranch: checkout.defaultBranch,
       recipe: location.kind === "default" ? "default" : location.path,
+      ...location.kind === "default" ? { base: { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST } } : {},
       recipeKey: prepared.recipeKey,
       toolsKey: prepared.toolsKey,
       imageId: `${ROOT_DISK_ID_PREFIX}${rKey}-${tKey}`,
@@ -2291,7 +2440,7 @@ async function buildInBuilder(opts, deps, prepared) {
     }
     const refusals = tunnel?.record().refusals ?? [];
     if (err instanceof StepFailed && refusals.length > 0) return new RecipeError("image_builder_failed", refusalReason(refusals, logPath), logPath);
-    const last = tail.filter((line) => line.trim() !== "").at(-1);
+    const last = tail.filter((line2) => line2.trim() !== "").at(-1);
     const why = err instanceof StepFailed ? err.message : `the builder microVM failed: ${describeCallFailure(err)}`;
     const panicNote = enginePanic === void 0 ? "" : `; the first panic in the Docker engine's log was: ${enginePanic}`;
     return new RecipeError("image_builder_failed", `${why}${panicNote}${last === void 0 ? "" : `; the last line was: ${last}`}. The build log is at ${logPath}`, logPath);
@@ -2745,14 +2894,145 @@ function lifecycleFailureReason(step, exitCode) {
   return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
 }
 
+// src/runner/runtimes.ts
+var RUNTIMES = ["node", "python", "go", "rust", "ruby", "java"];
+var MANIFESTS = {
+  "package.json": "node",
+  "pyproject.toml": "python",
+  "requirements.txt": "python",
+  "go.mod": "go",
+  "Cargo.toml": "rust",
+  Gemfile: "ruby",
+  "pom.xml": "java",
+  "build.gradle": "java",
+  "build.gradle.kts": "java"
+};
+var IMAGE_CONFIG = "/etc/mise/config.toml";
+var RUST_PIN_FILES = ["rust-toolchain.toml", "rust-toolchain"];
+var REFUSALS_NAMED2 = 3;
+var PLAIN = { withoutProxyWarning: true };
+function firstLine4(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+function toolFailure(stderr) {
+  for (const l of stderr.split("\n")) {
+    if (/^\S+@\S+: /.test(l)) return l;
+    const summary = /^\s*mise ✗ (\S+@\S+)\s+.*?· failed: (.+)$/.exec(l);
+    if (summary !== null) return `${summary[1]}: ${summary[2]}`;
+  }
+  return "";
+}
+function describeSource(source, path) {
+  if (source === void 0 || source === IMAGE_CONFIG) return "the image default";
+  return source.startsWith(`${path}/`) ? source.slice(path.length + 1) : source;
+}
+function parseListing(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    return Object.entries(parsed).flatMap(
+      ([tool, versions]) => (Array.isArray(versions) ? versions : []).flatMap(
+        (entry) => typeof entry.version === "string" ? [{ tool, version: entry.version, source: typeof entry.source?.path === "string" ? entry.source.path : void 0, installed: entry.installed !== false }] : []
+      )
+    );
+  } catch {
+    return void 0;
+  }
+}
+async function listing(context) {
+  const ran = await context.input.exec(["mise", "ls", "--current", "--json"], context.path, { quiet: true, ...PLAIN });
+  return ran.status === 0 ? parseListing(ran.stdout) : void 0;
+}
+function refusalNote(context) {
+  const named = context.input.refusals().slice(context.refusalsBefore).slice(0, REFUSALS_NAMED2).map((r) => r.range === "not-allowed" ? `${r.host} (not in runner.build.allowHosts)` : `${r.host} (${r.range})`);
+  return named.length === 0 ? "" : `; the build's tunnel refused ${named.join(", ")}`;
+}
+function line(context, text) {
+  context.input.log.line(`${context.input.tag} runtimes ${context.entry.repository}: ${text}`);
+}
+var installWithMise = async (context) => {
+  const { input, entry, path } = context;
+  context.before = await listing(context) ?? [];
+  const installed = await input.exec(["mise", "install"], path, PLAIN);
+  if (installed.status !== 0) {
+    const missing = context.before.filter((r) => !r.installed).map((r) => `${r.tool} ${r.version} (from ${describeSource(r.source, path)})`);
+    const what = missing.length === 0 ? `mise install failed in ${entry.repository} (exit ${installed.status})${firstLine4(installed.stderr) === "" ? "" : `: ${firstLine4(installed.stderr)}`}` : `mise could not install ${missing.join(", ")} in ${entry.repository} (exit ${installed.status})${toolFailure(installed.stderr) === "" ? "" : `: ${toolFailure(installed.stderr)}`}`;
+    return `runtime_install_failed: ${what}${refusalNote(context)}`;
+  }
+  const after = await listing(context);
+  if (after === void 0) return `runtime_install_failed: mise installed the tools but its listing failed in ${entry.repository}${refusalNote(context)}`;
+  context.resolved = after;
+  for (const r of context.resolved) line(context, `${r.tool} ${r.version} from ${describeSource(r.source, path)}`);
+  return void 0;
+};
+var goToolchain = async (context) => {
+  if (!context.files.has("go.mod")) return void 0;
+  const ran = await context.input.exec(["go", "version"], context.path);
+  if (ran.status !== 0) return `runtime_install_failed: go version failed in ${context.entry.repository} (exit ${ran.status})${firstLine4(ran.stderr) === "" ? "" : `: ${firstLine4(ran.stderr)}`}${refusalNote(context)}`;
+  const version = /\bgo(\d+\.\d+(?:\.\d+)?\S*)/.exec(ran.stdout)?.[1];
+  line(context, `go ${version ?? firstLine4(ran.stdout)} from go.mod`);
+  return void 0;
+};
+var rustToolchain = async (context) => {
+  const pin = RUST_PIN_FILES.find((file) => context.files.has(file));
+  if (pin === void 0) return void 0;
+  const ran = await context.input.exec(["rustc", "--version"], context.path);
+  if (ran.status !== 0) return `runtime_install_failed: rustc --version failed in ${context.entry.repository} (exit ${ran.status})${firstLine4(ran.stderr) === "" ? "" : `: ${firstLine4(ran.stderr)}`}${refusalNote(context)}`;
+  const version = /\brustc (\S+)/.exec(ran.stdout)?.[1];
+  line(context, `rust ${version ?? firstLine4(ran.stdout)} from ${pin}`);
+  return void 0;
+};
+var CHECKOUT_STEPS = [installWithMise, goToolchain, rustToolchain];
+function unpinnedIn(context) {
+  const used = new Set([...context.files].map((file) => MANIFESTS[file]));
+  const pinned = new Set(context.resolved.filter((r) => r.source?.startsWith(`${context.path}/`)).map((r) => r.tool));
+  pinned.add("go");
+  if (RUST_PIN_FILES.some((file) => context.files.has(file))) pinned.add("rust");
+  return RUNTIMES.filter((runtime) => used.has(runtime) && !pinned.has(runtime));
+}
+async function provisionRuntimes(input) {
+  const unpinned = {};
+  let dropProxyWarning = false;
+  for (const entry of input.repositories) {
+    if (input.aborted?.() === true) return { ok: false, reason: "", aborted: true };
+    const path = checkoutPath(entry);
+    const listed = await input.exec(["ls", "-1", "-A"], path, { quiet: true });
+    const context = {
+      input,
+      entry,
+      path,
+      files: new Set(listed.status === 0 ? listed.stdout.split("\n").map((name) => name.trim()) : []),
+      refusalsBefore: input.refusals().length,
+      before: [],
+      resolved: []
+    };
+    for (const step of CHECKOUT_STEPS) {
+      const reason = await step(context);
+      if (reason !== void 0) return { ok: false, reason };
+    }
+    unpinned[entry.repository] = unpinnedIn(context);
+    const old = context.resolved.find((r) => r.tool === "node" && !nodeAcceptsProxyWarningFlag(r.version));
+    if (old !== void 0) {
+      dropProxyWarning = true;
+      line(context, `leaving ${PROXY_WARNING_FLAG} out of NODE_OPTIONS because node ${old.version} does not accept it`);
+    }
+  }
+  return { ok: true, unpinned, dropProxyWarning };
+}
+function runtimeStepInput(report, services, dropProxyWarning) {
+  return report.base === void 0 ? {} : { runtimes: { refusals: () => services.record().refusals, dropProxyWarning } };
+}
+function keepUnpinnedRuntimes(state, steps) {
+  if (steps.unpinnedRuntimes !== void 0) state.unpinnedRuntimes = steps.unpinnedRuntimes;
+}
+
 // src/runner/build-steps.ts
 var aborted = () => ({ ok: false, reason: "", aborted: true });
-function firstLine4(text) {
+function firstLine5(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 function gitErrorLine(text) {
-  const lines = text.split("\n").map((line) => line.trim()).filter((line) => line !== "");
-  return lines.find((line) => /^(fatal|error):/.test(line)) ?? lines.at(-1) ?? "";
+  const lines = text.split("\n").map((line2) => line2.trim()).filter((line2) => line2 !== "");
+  return lines.find((line2) => /^(fatal|error):/.test(line2)) ?? lines.at(-1) ?? "";
 }
 var STAGED_TREE = `${JOB_MOUNT}/context/tree`;
 var DELIVER_SCRIPT = [
@@ -2768,7 +3048,7 @@ var DELIVER_SCRIPT = [
 var RECORD_SCRIPT = 'd="$(git rev-parse --git-common-dir)" && mkdir -p "$d/outerlayer" && printf "%s" "$1" > "$d/outerlayer/delivery.json"';
 var WRITE_SHIM_SCRIPT = 'mkdir -p "$1" && printf "%s" "$2" > "$1/claude" && chmod 755 "$1/claude"';
 function failure(what, result) {
-  return `context_delivery_failed: ${what} (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`;
+  return `context_delivery_failed: ${what} (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`;
 }
 async function repositorySkills(input, folder) {
   const listed = await input.exec(["ls", "-1", folder], CHECKOUT_DIR, { quiet: true });
@@ -2870,6 +3150,14 @@ async function runBuildSteps(input) {
     if (!checked.ok) return checked;
   }
   if (input.governing !== void 0) await noteIgnoredDevcontainers(input, repositories, input.governing.repository);
+  let unpinnedRuntimes;
+  if (input.runtimes !== void 0) {
+    const ordered = [{ ...primary, primary: true }, ...repositories.filter((candidate) => candidate.repository !== primary.repository).map((entry) => ({ ...entry, primary: false }))];
+    const chosen = await provisionRuntimes({ repositories: ordered, exec, log, tag, refusals: input.runtimes.refusals, aborted: input.aborted });
+    if (!chosen.ok) return chosen.aborted === true ? aborted() : { ok: false, reason: chosen.reason };
+    unpinnedRuntimes = chosen.unpinned;
+    if (chosen.dropProxyWarning) input.runtimes.dropProxyWarning();
+  }
   const lifecycleDir = lifecycleWorkdir(repositories, input.governing?.repository);
   for (const step of lifecycleSteps(input.lifecycle)) {
     if (input.aborted()) return aborted();
@@ -2914,7 +3202,7 @@ async function runBuildSteps(input) {
     }
     if (input.aborted()) return aborted();
   }
-  return { ok: true, startCommit, ...controlPlane === void 0 ? {} : { controlPlane } };
+  return { ok: true, startCommit, ...controlPlane === void 0 ? {} : { controlPlane }, ...unpinnedRuntimes === void 0 ? {} : { unpinnedRuntimes } };
 }
 var EVAL_INPUT_NAME = "eval-input";
 var TRANSCRIPT_ROOT = "/build/home/.claude/projects";
@@ -2923,7 +3211,7 @@ var MAX_TRANSCRIPTS = 500;
 var MAX_TOTAL_TRANSCRIPT_BYTES = 64 * 1024 * 1024;
 var TRANSCRIPT_COPY_MS = 2 * 60 * 1e3;
 var BUILD_HOME = "/build/home";
-function firstLine5(text) {
+function firstLine6(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 async function copyTranscripts(run, now = Date.now) {
@@ -2935,7 +3223,7 @@ async function copyTranscripts(run, now = Date.now) {
     return { ok: false, reason: describeCallFailure(err) };
   }
   if (listed.status !== 0 && !/No such file or directory/.test(listed.stderr)) {
-    return { ok: false, reason: `listing the transcripts failed (exit ${listed.status})${firstLine5(listed.stderr) === "" ? "" : `: ${firstLine5(listed.stderr)}`}` };
+    return { ok: false, reason: `listing the transcripts failed (exit ${listed.status})${firstLine6(listed.stderr) === "" ? "" : `: ${firstLine6(listed.stderr)}`}` };
   }
   const paths = listed.stdout.split("\0").filter((entry) => entry.startsWith(`${TRANSCRIPT_ROOT}/`) && !entry.includes("\n") && !entry.slice(TRANSCRIPT_ROOT.length + 1).split("/").includes("..")).map((entry) => entry.slice(TRANSCRIPT_ROOT.length + 1)).sort();
   const copied = [];
@@ -2952,7 +3240,7 @@ async function copyTranscripts(run, now = Date.now) {
     }
     try {
       const read = await run(["head", "-c", String(MAX_TRANSCRIPT_BYTES + 1), `${TRANSCRIPT_ROOT}/${path}`]);
-      if (read.status !== 0) missed.push({ path, reason: `reading it failed (exit ${read.status})${firstLine5(read.stderr) === "" ? "" : `: ${firstLine5(read.stderr)}`}` });
+      if (read.status !== 0) missed.push({ path, reason: `reading it failed (exit ${read.status})${firstLine6(read.stderr) === "" ? "" : `: ${firstLine6(read.stderr)}`}` });
       else if (Buffer.byteLength(read.stdout) > MAX_TRANSCRIPT_BYTES) missed.push({ path, reason: `it is larger than ${MAX_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
       else if (total + Buffer.byteLength(read.stdout) > MAX_TOTAL_TRANSCRIPT_BYTES) missed.push({ path, reason: `copying it would take the transcripts past ${MAX_TOTAL_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
       else {
@@ -2996,11 +3284,11 @@ function scrubbing(scrub, author, work) {
     setRepoRoot(void 0);
   }
 }
-function scrubLine(line) {
+function scrubLine(line2) {
   try {
-    return JSON.stringify(scrubDeep(JSON.parse(line)));
+    return JSON.stringify(scrubDeep(JSON.parse(line2)));
   } catch {
-    return scrubText(line);
+    return scrubText(line2);
   }
 }
 function writeReadOnly(path, text) {
@@ -3074,7 +3362,7 @@ async function writeEvalInput(request) {
           continue;
         }
         const file = `sessions/${traceId}.jsonl`;
-        const text = transcript.content.split("\n").filter((line) => line.trim() !== "").map(scrubLine).join("\n");
+        const text = transcript.content.split("\n").filter((line2) => line2.trim() !== "").map(scrubLine).join("\n");
         writeReadOnly(join(dir, file), `${text}
 `);
         scrubDeep(session);
@@ -3501,8 +3789,8 @@ async function deliverTar(runtime, state, input) {
       { timeoutMs: DELIVERY_TIMEOUT_MS }
     );
     if (result.status === 0) return { ok: true };
-    const line = scrubDelivery(result.stderr.trim().split("\n")[0] ?? "", input.secrets);
-    return { ok: false, reason: `${input.step} could not be delivered (exit ${result.status})${line === "" ? "" : `: ${line}`}` };
+    const line2 = scrubDelivery(result.stderr.trim().split("\n")[0] ?? "", input.secrets);
+    return { ok: false, reason: `${input.step} could not be delivered (exit ${result.status})${line2 === "" ? "" : `: ${line2}`}` };
   } catch (err) {
     return { ok: false, reason: `${input.step} could not be delivered: ${scrubDelivery(describeCallFailure(err), input.secrets)}` };
   }
@@ -3625,18 +3913,18 @@ function parse(data) {
     const length = Number.parseInt(header, 16);
     if (length === 0) return { kind: "commands", commands, capabilities };
     if (data.length - offset < length) return { kind: "need-more" };
-    const line = data.subarray(offset + 4, offset + length);
+    const line2 = data.subarray(offset + 4, offset + length);
     offset += length;
     if (offset > limits().sectionBytes) return refused(TOO_LONG);
     const first = commands.length === 0;
-    const nul = line.indexOf(0);
-    const decoded = decodeText(first && nul !== -1 ? line.subarray(0, nul) : line);
+    const nul = line2.indexOf(0);
+    const decoded = decodeText(first && nul !== -1 ? line2.subarray(0, nul) : line2);
     if (decoded === void 0) return refused(UNREADABLE);
     const text = decoded.replace(/\n$/, "");
     if (first && text.startsWith("shallow ")) continue;
     const match = COMMAND.exec(text);
     if (match === null) return refused(UNREADABLE);
-    if (first && nul !== -1) capabilities = line.subarray(nul + 1).toString("latin1").split(/\s+/).filter((word) => word !== "");
+    if (first && nul !== -1) capabilities = line2.subarray(nul + 1).toString("latin1").split(/\s+/).filter((word) => word !== "");
     commands.push({ oldId: match[1], newId: match[2], ref: match[3] });
   }
 }
@@ -3790,7 +4078,7 @@ function createGitRemote(options) {
   const claimed = options.repositories ?? (options.repository === void 0 || options.branch === void 0 || options.mirrorDir === void 0 ? [] : [{ repository: options.repository, branch: options.branch, mirrorDir: options.mirrorDir }]);
   const maxLfsBodyBytes = 1024 * 1024;
   const hopByHop = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "proxy-authenticate", "proxy-authorization", "te", "trailer", "set-cookie"]);
-  const log = (line) => options.log?.(line);
+  const log = (line2) => options.log?.(line2);
   function forward(input) {
     const { route, res } = input;
     const url = new URL(`${gitUrl}/${route.owner}/${route.name}.git/${route.kind === "info-refs" ? "info/refs" : route.kind === "lfs-batch" ? "info/lfs/objects/batch" : `git-${route.kind}`}${route.search === "" ? "" : `?${route.search}`}`);
@@ -4208,7 +4496,7 @@ function gitRemoteFor(runtime, input) {
     ...input.readOnly === true ? { readOnly: true } : {}
   });
 }
-function firstLine6(text) {
+function firstLine7(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 var NO_ENV = { literals: {}, passed: {} };
@@ -4272,7 +4560,7 @@ async function obtainImage(input) {
       };
     }
     try {
-      const common = { repository, configPath: config.configPath, readToken, pinned: input.pinned, log: (line) => log.line(`${tag} ${line}`) };
+      const common = { repository, configPath: config.configPath, readToken, pinned: input.pinned, log: (line2) => log.line(`${tag} ${line2}`) };
       if (input.inBuilder !== void 0) {
         return { ok: true, built: await runtime.buildRootDisk({ ...input.inBuilder, ...common, guestHelper: input.guestHelper, deadlineMs: input.deadlineMs }) };
       }
@@ -4410,7 +4698,7 @@ async function provisionContainer(input) {
     }
     return aborted2 ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(reason);
   };
-  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine6(result.stderr) === "" ? "" : `: ${firstLine6(result.stderr)}`}`);
+  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine7(result.stderr) === "" ? "" : `: ${firstLine7(result.stderr)}`}`);
   if (input.aborted()) return bail("", true);
   mkdirSync(buildDir2, { recursive: true });
   const ghDir = ghConfigDir(buildDir2);
@@ -4441,8 +4729,8 @@ async function provisionContainer(input) {
   environment.credentials = tokens.used();
   let services;
   try {
-    const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
-    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "stream", input.leaseExpiryMs === void 0 ? void 0 : leaseFor(runtime, buildId, input.leaseExpiryMs), void 0, (line) => log.line(`${tag} ${line}`));
+    const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line2) => log.line(`${tag} ${line2}`) });
+    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "stream", input.leaseExpiryMs === void 0 ? void 0 : leaseFor(runtime, buildId, input.leaseExpiryMs), void 0, (line2) => log.line(`${tag} ${line2}`));
     runtime.tunnels.set(buildId, services);
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
@@ -4469,7 +4757,7 @@ async function provisionContainer(input) {
   if (prepared.status !== 0) return dockerFailed("preparing the build's volume", prepared);
   const started = await host.run(containerRunArgs(runInput), { logPath });
   if (started.status !== 0) return dockerFailed("starting the build's container", started);
-  joinBuild(runtime, state, services, (line) => log.line(`${tag} ${line}`));
+  joinBuild(runtime, state, services, (line2) => log.line(`${tag} ${line2}`));
   if (input.aborted()) return bail("", true);
   if (!await waitForRelay(runtime, state)) return bail("the relay in the build's container did not start");
   const ghDelivered = await deliverJobFiles(runtime, state, ["gh", "maven"], secrets);
@@ -4506,9 +4794,10 @@ async function provisionContainer(input) {
   const hashed = program.status === 0 ? parseProgramHash(program.stdout) : void 0;
   if (hashed !== void 0) state.judgeProgram = { path: JUDGE_PROGRAM, sha256: hashed };
   input.save(state, environment);
-  const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  let execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
   for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
-  const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env: execEnv, argv }, opts?.quiet === true ? void 0 : { logPath });
+  const plainEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv, proxyWarning: false });
+  const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env: opts?.withoutProxyWarning === true ? plainEnv : execEnv, argv }, opts?.quiet === true ? void 0 : { logPath });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
@@ -4539,10 +4828,16 @@ async function provisionContainer(input) {
     },
     removeStagedContext: () => removeStagedContext(buildDir2),
     keepIn: jobDir,
-    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {}
+    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
+    // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
+    ...runtimeStepInput(report, services, () => {
+      state.proxyWarningDropped = true;
+      execEnv = plainEnv;
+    })
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
+  keepUnpinnedRuntimes(state, steps);
   if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
@@ -4568,9 +4863,11 @@ function containerCommandExec(input) {
     repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
+    unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
-    imageEnv: state.imageEnv
+    imageEnv: state.imageEnv,
+    proxyWarning: state.proxyWarningDropped !== true
   });
   return {
     container: state.container,
@@ -4592,9 +4889,11 @@ function containerSenderCommand(input) {
     repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
+    unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
-    imageEnv: state.imageEnv
+    imageEnv: state.imageEnv,
+    proxyWarning: state.proxyWarningDropped !== true
   });
   const args = containerExecArgs({
     container: state.container,
@@ -4658,6 +4957,7 @@ async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, bui
     destinations: config.build?.destinations ?? [],
     // A managed build's tunnel allows the factory's hosts beside the runner's own.
     allowHosts: withFactoryHosts(config.build?.allowHosts, managedBuildSettingsFor(settingsDir ?? jobDir)),
+    ...optionalEgress(config),
     serve,
     ...lease === void 0 ? {} : { lease },
     ...inherit === void 0 ? {} : { inherit },
@@ -4722,9 +5022,11 @@ async function syncInContainer(input) {
       repositories: job.repositories,
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
+      unpinnedRuntimes: state.unpinnedRuntimes,
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,
-      imageEnv: state.imageEnv
+      imageEnv: state.imageEnv,
+      proxyWarning: state.proxyWarningDropped !== true
     });
     const result = await runtime.host.exec(
       { container: state.container, user: state.agentUser ?? ADDED_USER, workdir: job.workdir ?? CHECKOUT_DIR, env, argv: ["outerlayer", "sync"] },
@@ -4799,7 +5101,7 @@ function containerJudgeEnvironment(input) {
       env: NO_ENV,
       argv: ["/bin/sh", "-c", `[ -f ${file} ] && [ ! -L ${file} ] && head -c ${maxBytes + 1} ${file}`]
     }, { timeoutMs: REPORT_READ_TIMEOUT_MS });
-    if (read.status > 1) throw new Error(`reading the judge's ${name} exited ${read.status}: ${firstLine6(read.stderr)}`);
+    if (read.status > 1) throw new Error(`reading the judge's ${name} exited ${read.status}: ${firstLine7(read.stderr)}`);
     return read.status === 0 && Buffer.byteLength(read.stdout) <= maxBytes ? read.stdout : void 0;
   };
   return {
@@ -4817,7 +5119,7 @@ function containerJudgeEnvironment(input) {
     hashProgram: async () => {
       const ran = await runtime.host.exec({ container: state.container, user: ADDED_USER, env: NO_ENV, argv: [...HASH_ARGV] });
       const sha256 = ran.status === 0 ? parseProgramHash(ran.stdout) : void 0;
-      return sha256 === void 0 ? { ok: false, reason: firstLine6(ran.stderr) || `the hash could not be taken (exit ${ran.status})` } : { ok: true, sha256 };
+      return sha256 === void 0 ? { ok: false, reason: firstLine7(ran.stderr) || `the hash could not be taken (exit ${ran.status})` } : { ok: true, sha256 };
     },
     prepare: async (files, tree) => {
       if (filesAreCopied(state)) {
@@ -4850,7 +5152,7 @@ function containerJudgeEnvironment(input) {
     // host. Every capability is dropped in the container, so root there could not either; the build's user removes its own, and the runner removes the rest.
     clear: async () => {
       const removed = await runtime.host.exec({ container: state.container, user, env: NO_ENV, argv: ["find", JUDGE_DIR, "-mindepth", "1", "-user", user, "-delete"] });
-      if (removed.status !== 0) throw new Error(`find exited ${removed.status}: ${firstLine6(removed.stderr)}`);
+      if (removed.status !== 0) throw new Error(`find exited ${removed.status}: ${firstLine7(removed.stderr)}`);
       if (!filesAreCopied(state)) return;
       const emptied = await clearJudgeFolder(runtime, state, secretsOf(runtime, input.jobDir));
       if (!emptied.ok) throw new Error(emptied.reason);
@@ -4906,7 +5208,7 @@ async function startCheckContainer(input) {
     }
     return { ok: false, reason };
   };
-  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine6(result.stderr) === "" ? "" : `: ${firstLine6(result.stderr)}`}`);
+  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine7(result.stderr) === "" ? "" : `: ${firstLine7(result.stderr)}`}`);
   mkdirSync(buildDir2, { recursive: true });
   if (!filesAreCopied(state)) chmodSync(buildDir2, 493);
   let services;
@@ -4915,7 +5217,7 @@ async function startCheckContainer(input) {
       repositories: repositoriesOf({ repositories: job.repositories, repository, branch: job.branch }),
       tokens,
       buildDir: buildDir2,
-      log: (line) => log.line(`${tag} ${line}`),
+      log: (line2) => log.line(`${tag} ${line2}`),
       readOnly: true
     });
     services = await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote, transport === "exec" ? "stream" : "socket");
@@ -4944,7 +5246,7 @@ async function startCheckContainer(input) {
   if (prepared.status !== 0) return dockerFailed("preparing the check environment's volume", prepared);
   const started = await host.run(containerRunArgs(runInput), { logPath });
   if (started.status !== 0) return dockerFailed("starting the check environment's container", started);
-  if (transport === "exec") joinBuild(runtime, state, services, (line) => log.line(`${tag} ${line}`));
+  if (transport === "exec") joinBuild(runtime, state, services, (line2) => log.line(`${tag} ${line2}`));
   if (!await waitForRelay(runtime, state)) return fail("the relay in the check environment's container did not start");
   const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {}, imageEnv: built.imageEnv });
   const secrets = () => tokens.issuedTokens();
@@ -4973,7 +5275,7 @@ async function startCheckContainer(input) {
         await host.stop(name);
         const again = await host.start(name);
         if (again.status !== 0 || !await waitForRelay(runtime, state)) return false;
-        rejoinBuild(runtime, state, (line) => log.line(`${tag} ${line}`));
+        rejoinBuild(runtime, state, (line2) => log.line(`${tag} ${line2}`));
         if (delivered) {
           const again2 = await deliverInput();
           if (!again2.ok) {
@@ -4990,8 +5292,8 @@ async function startCheckContainer(input) {
 // src/runner/machine.ts
 function groupName(gid) {
   try {
-    for (const line of readFileSync("/etc/group", "utf8").split("\n")) {
-      const [name, , id] = line.split(":");
+    for (const line2 of readFileSync("/etc/group", "utf8").split("\n")) {
+      const [name, , id] = line2.split(":");
       if (name !== void 0 && Number(id) === gid) return name;
     }
   } catch {
@@ -5086,4 +5388,4 @@ function describeMachineDocker(machine) {
   return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
 }
 
-export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };
+export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, keepUnpinnedRuntimes, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, runtimeStepInput, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };