@outerlayer/cli 0.34.0-next.20261027121359 → 0.34.0-next.20261027174501

package/dist/{chunk-ARPPH7VS.js → chunk-LSFP57LI.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, metadataFromLabels, writeRecord } from './chunk-SGT7YU3X.js';
-import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-UC4OSOQS.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, SHARED_OWNER, SHARED_NAME, metadataFromLabels, writeRecord } from './chunk-5FHBVV25.js';
+import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-CMMEJJTL.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { runExec, execCapture, waitForAgent } from './chunk-ZV6GOXYA.js';
-import { GUEST_CID, linkVsockSockets } from './chunk-RMJSYOSV.js';
-import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-66TKWWTX.js';
-import { runnerImageVersion } from './chunk-HO4XRLAZ.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-XSUM3E67.js';
-import { optionalEgress, runnerCredentialProblem, builtinKind, allowHostProblem, systemClock, emptyEgressCounts, hostAllowed } from './chunk-RO2NZJHZ.js';
-import { formatBytes, allocatedBytes } from './chunk-TS2YACAQ.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-UYWGR35C.js';
-import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-HDLON3RJ.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-QUOITPN7.js';
+import { runExec, execCapture, waitForAgent } from './chunk-JVNQNKHV.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-BS3OYFAD.js';
+import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-7Q7GQELE.js';
+import { runnerImageVersion } from './chunk-CFJOONWM.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-OP2L7OXA.js';
+import { optionalEgress, runnerCredentialProblem, builtinKind, allowHostProblem, systemClock, emptyEgressCounts, hostAllowed } from './chunk-JWMJMQRF.js';
+import { formatBytes, allocatedBytes } from './chunk-LYX2RRSF.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-FLHBUQ2W.js';
+import { RecipeError, DOCKER_FEATURE, universalImagePending, writeSanitizedRecipe, classifyProperties } from './chunk-X7M73LKT.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, universalImagePinned, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-WX2HW2G2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { postJson, WorkCommandError, getJson } from './chunk-NGZBVN6F.js';
+import { postJson, WorkCommandError, getJson } from './chunk-6IMQXBTZ.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { signerFor } from './chunk-KDSKFXPE.js';
+import { signerFor } from './chunk-RJZZFAXS.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-OOD5NDQA.js';
+import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-A6PJSNP6.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-XFJ7YOPD.js';
 import { downconvertSession } from './chunk-DINRXUQA.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-I2GHZ2VA.js';
-import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, JOB_MOUNT, realFdStorePort } from './chunk-Z7THNFUU.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-3VJYDWFV.js';
+import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, nodeAcceptsProxyWarningFlag, PROXY_WARNING_FLAG, JOB_MOUNT, realFdStorePort } from './chunk-GMKDAF37.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { spawn, spawnSync } from 'child_process';
 import { mkdirSync, existsSync, readFileSync, mkdtempSync, rmSync, chmodSync, truncateSync, statSync, accessSync, constants, readdirSync, writeFileSync, lstatSync, copyFileSync, renameSync, rmdirSync, unlinkSync, linkSync, openSync, closeSync, cpSync, writeSync, appendFileSync, createWriteStream, createReadStream } from 'fs';
@@ -726,9 +726,9 @@ function createFirecrackerHost(options = {}) {
 var BUILD_PREFIX = "build-";
 var LEAF = "runner";
 function serviceDirectory(selfCgroup, mount) {
-  const line = selfCgroup?.split("\n").find((l) => l.startsWith("0::"));
-  if (line === void 0) return void 0;
-  const path = line.slice(3).trim();
+  const line2 = selfCgroup?.split("\n").find((l) => l.startsWith("0::"));
+  if (line2 === void 0) return void 0;
+  const path = line2.slice(3).trim();
   if (!path.endsWith(".service")) return void 0;
   return join(mount, path);
 }
@@ -1781,14 +1781,14 @@ async function deliverExecMaven(build, workdir, base, run, note) {
 }
 function onceNote(write) {
   const seen = /* @__PURE__ */ new Set();
-  return (line) => {
-    if (seen.has(line)) return;
-    seen.add(line);
-    write(line);
+  return (line2) => {
+    if (seen.has(line2)) return;
+    seen.add(line2);
+    write(line2);
   };
 }
 function attemptNote(log, tag) {
-  return onceNote((line) => log.line(`${tag} ${line}`));
+  return onceNote((line2) => log.line(`${tag} ${line2}`));
 }
 function hostCommandEnvironment(base, build, config, hooksPath, note) {
   let env = { ...base };
@@ -1875,7 +1875,7 @@ function e2fsckRunner(run = runWithSpawn(), env = process.env) {
   };
 }
 function firstLine2(text) {
-  return text.split("\n").find((line) => line.trim() !== "")?.trim() ?? "";
+  return text.split("\n").find((line2) => line2.trim() !== "")?.trim() ?? "";
 }
 async function giveBackCacheSpace(input) {
   try {
@@ -2121,7 +2121,8 @@ function readStored(prepared) {
       toolsBuilt: false,
       checkedCommit: prepared.checkout.commit,
       recordDir: prepared.recordDir,
-      report: stored.report,
+      // On the universal image the stored report is shared by every repository, so the reused result names this build's repository and commit.
+      report: prepared.location.kind === "default" ? { ...stored.report, repository: prepared.repository, sourceCommit: prepared.checkout.commit, defaultBranch: prepared.checkout.defaultBranch } : stored.report,
       removed: [],
       rootfs: { path, env: stored.env, user: stored.user }
     };
@@ -2148,6 +2149,7 @@ async function buildRootDiskInMicroVm(opts, deps) {
   try {
     const stored = readStored(prepared);
     if (stored !== void 0) return stored;
+    if (prepared.location.kind === "default" && !(deps.universalPublished ?? universalImagePinned)()) throw universalImagePending();
     return await buildInBuilder(opts, deps, prepared);
   } finally {
     prepared.release();
@@ -2161,8 +2163,8 @@ async function buildInBuilder(opts, deps, prepared) {
   const { repository, owner, name, checkout, location, recipe, repoRecords, recordDir, logPath } = prepared;
   const rKey = prepared.recipeKey.slice(0, KEY_PREFIX);
   const tKey = prepared.toolsKey.slice(0, KEY_PREFIX);
-  const recipeTag = `${TAG_HOST}/recipe/${repository}:${rKey}`;
-  const buildTag = `${TAG_HOST}/build/${repository}:${rKey}-${tKey}`;
+  const recipeTag = `${TAG_HOST}/recipe/${prepared.tagName}:${rKey}`;
+  const buildTag = `${TAG_HOST}/build/${prepared.tagName}:${rKey}-${tKey}`;
   const runner = runnerDir(opts.configPath);
   const builderDisk = await ports.builderDisk(runner);
   const toolFilesDir = await ports.toolFiles(runner);
@@ -2173,7 +2175,7 @@ async function buildInBuilder(opts, deps, prepared) {
   const dir = buildDir(opts.configPath, id);
   const state = { buildId: id, buildDir: dir, vsockPath: vsockPath(dir) };
   const record = { owner, name, id };
-  const cachePath = builderCacheDiskPath(opts.configPath, owner, name);
+  const cachePath = location.kind === "default" ? builderCacheDiskPath(opts.configPath, SHARED_OWNER, SHARED_NAME) : builderCacheDiskPath(opts.configPath, owner, name);
   const diskPath = join(dir, "build.ext4");
   const partial = join(recordDir, "rootfs.ext4.partial");
   const scratchRoot = opts.tmpDir ?? tmpdir();
@@ -2216,12 +2218,12 @@ async function buildInBuilder(opts, deps, prepared) {
       lines.push(pending);
       pending = "";
     }
-    for (const line of lines) {
-      if (line.startsWith(RESULT_PREFIX)) result = line.slice(RESULT_PREFIX.length);
-      else if (line.startsWith(ENGINE_PANIC_PREFIX)) enginePanic ??= line.slice(ENGINE_PANIC_PREFIX.length);
-      else if (line === ENGINE_STOPPED_LINE) continue;
+    for (const line2 of lines) {
+      if (line2.startsWith(RESULT_PREFIX)) result = line2.slice(RESULT_PREFIX.length);
+      else if (line2.startsWith(ENGINE_PANIC_PREFIX)) enginePanic ??= line2.slice(ENGINE_PANIC_PREFIX.length);
+      else if (line2 === ENGINE_STOPPED_LINE) continue;
       else {
-        tail.push(line);
+        tail.push(line2);
         if (tail.length > LOG_TAIL_LINES) tail.shift();
       }
     }
@@ -2295,7 +2297,8 @@ async function buildInBuilder(opts, deps, prepared) {
     let recipeParts = { kind: "default" };
     const recipeDir = join(scratch, "recipe");
     mkdirSync(recipeDir);
-    if (location.kind === "default") writeFileSync(join(recipeDir, "Dockerfile"), prepared.defaultText);
+    if (location.kind === "default") writeFileSync(join(recipeDir, "Dockerfile"), `FROM ${UNIVERSAL_IMAGE}
+`);
     else {
       sanitized = writeSanitizedRecipe(checkout.dir, location, recipe);
       recipeParts = { kind: "file", config: relative(checkout.dir, sanitized) };
@@ -2310,7 +2313,15 @@ async function buildInBuilder(opts, deps, prepared) {
     mkdirSync(join(toolsDir, FETCHED_DIR));
     writeFileSync(
       join(toolsDir, "Dockerfile"),
-      toolsDockerfile({ recipeImage: recipeTag, nodeImage: prepared.nodeImage, claudeCodeVersion: prepared.claudeCodeVersion, buildId: opts.cli.buildId, guestHelper: true, fetched: true })
+      toolsDockerfile({
+        recipeImage: recipeTag,
+        nodeImage: prepared.nodeImage,
+        claudeCodeVersion: prepared.claudeCodeVersion,
+        buildId: opts.cli.buildId,
+        guestHelper: true,
+        fetched: true,
+        ...location.kind === "default" ? { universal: true } : {}
+      })
     );
     inputs = builderInput({ checkoutDir: checkout.dir, toolsDir, toolFilesDir, recipeDir }, archive);
     for (const { target, stream } of inputs) {
@@ -2360,6 +2371,7 @@ async function buildInBuilder(opts, deps, prepared) {
       sourceCommit: checkout.commit,
       defaultBranch: checkout.defaultBranch,
       recipe: location.kind === "default" ? "default" : location.path,
+      ...location.kind === "default" ? { base: { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST } } : {},
       recipeKey: prepared.recipeKey,
       toolsKey: prepared.toolsKey,
       imageId: `${ROOT_DISK_ID_PREFIX}${rKey}-${tKey}`,
@@ -2428,7 +2440,7 @@ async function buildInBuilder(opts, deps, prepared) {
     }
     const refusals = tunnel?.record().refusals ?? [];
     if (err instanceof StepFailed && refusals.length > 0) return new RecipeError("image_builder_failed", refusalReason(refusals, logPath), logPath);
-    const last = tail.filter((line) => line.trim() !== "").at(-1);
+    const last = tail.filter((line2) => line2.trim() !== "").at(-1);
     const why = err instanceof StepFailed ? err.message : `the builder microVM failed: ${describeCallFailure(err)}`;
     const panicNote = enginePanic === void 0 ? "" : `; the first panic in the Docker engine's log was: ${enginePanic}`;
     return new RecipeError("image_builder_failed", `${why}${panicNote}${last === void 0 ? "" : `; the last line was: ${last}`}. The build log is at ${logPath}`, logPath);
@@ -2882,14 +2894,156 @@ function lifecycleFailureReason(step, exitCode) {
   return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
 }
 
+// src/runner/runtimes.ts
+var RUNTIMES = ["node", "python", "go", "rust", "ruby", "java"];
+var MANIFESTS = {
+  "package.json": "node",
+  "pyproject.toml": "python",
+  "requirements.txt": "python",
+  "go.mod": "go",
+  "Cargo.toml": "rust",
+  Gemfile: "ruby",
+  "pom.xml": "java",
+  "build.gradle": "java",
+  "build.gradle.kts": "java"
+};
+var IMAGE_CONFIG = "/etc/mise/config.toml";
+var RUST_PIN_FILES = ["rust-toolchain.toml", "rust-toolchain"];
+var REFUSALS_NAMED2 = 3;
+var PLAIN = { withoutProxyWarning: true };
+function firstLine4(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+function toolFailure(stderr) {
+  for (const l of stderr.split("\n")) {
+    if (/^\S+@\S+: /.test(l)) return l;
+    const summary = /^\s*mise ✗ (\S+@\S+)\s+.*?· failed: (.+)$/.exec(l);
+    if (summary !== null) return `${summary[1]}: ${summary[2]}`;
+  }
+  return "";
+}
+function describeSource(source, path) {
+  if (source === void 0 || source === IMAGE_CONFIG) return "the image default";
+  return source.startsWith(`${path}/`) ? source.slice(path.length + 1) : source;
+}
+function parseListing(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    return Object.entries(parsed).flatMap(
+      ([tool, versions]) => (Array.isArray(versions) ? versions : []).flatMap(
+        (entry) => typeof entry.version === "string" ? [{ tool, version: entry.version, source: typeof entry.source?.path === "string" ? entry.source.path : void 0, installed: entry.installed !== false }] : []
+      )
+    );
+  } catch {
+    return void 0;
+  }
+}
+async function listing(context) {
+  const ran = await context.input.exec(["mise", "ls", "--current", "--json"], context.path, { quiet: true, ...PLAIN });
+  return ran.status === 0 ? parseListing(ran.stdout) : void 0;
+}
+function refusalNote(context) {
+  const named = context.input.refusals().slice(context.refusalsBefore).slice(0, REFUSALS_NAMED2).map((r) => r.range === "not-allowed" ? `${r.host} (not in runner.build.allowHosts)` : `${r.host} (${r.range})`);
+  return named.length === 0 ? "" : `; the build's tunnel refused ${named.join(", ")}`;
+}
+function line(context, text) {
+  context.input.log.line(`${context.input.tag} runtimes ${context.entry.repository}: ${text}`);
+}
+var installWithMise = async (context) => {
+  const { input, entry, path } = context;
+  context.before = await listing(context) ?? [];
+  const installed = await input.exec(["mise", "install"], path, PLAIN);
+  if (installed.status !== 0) {
+    const missing = context.before.filter((r) => !r.installed).map((r) => `${r.tool} ${r.version} (from ${describeSource(r.source, path)})`);
+    const what = missing.length === 0 ? `mise install failed in ${entry.repository} (exit ${installed.status})${firstLine4(installed.stderr) === "" ? "" : `: ${firstLine4(installed.stderr)}`}` : `mise could not install ${missing.join(", ")} in ${entry.repository} (exit ${installed.status})${toolFailure(installed.stderr) === "" ? "" : `: ${toolFailure(installed.stderr)}`}`;
+    return `runtime_install_failed: ${what}${refusalNote(context)}`;
+  }
+  const after = await listing(context);
+  if (after === void 0) return `runtime_install_failed: mise installed the tools but its listing failed in ${entry.repository}${refusalNote(context)}`;
+  context.resolved = after;
+  for (const r of context.resolved) line(context, `${r.tool} ${r.version} from ${describeSource(r.source, path)}`);
+  return void 0;
+};
+var goToolchain = async (context) => {
+  if (!context.files.has("go.mod")) return void 0;
+  const ran = await context.input.exec(["go", "version"], context.path);
+  if (ran.status !== 0) return `runtime_install_failed: go version failed in ${context.entry.repository} (exit ${ran.status})${firstLine4(ran.stderr) === "" ? "" : `: ${firstLine4(ran.stderr)}`}${refusalNote(context)}`;
+  const version = /\bgo(\d+\.\d+(?:\.\d+)?\S*)/.exec(ran.stdout)?.[1];
+  line(context, `go ${version ?? firstLine4(ran.stdout)} from go.mod`);
+  return void 0;
+};
+var rustToolchain = async (context) => {
+  const pin = RUST_PIN_FILES.find((file) => context.files.has(file));
+  if (pin === void 0) return void 0;
+  const ran = await context.input.exec(["rustc", "--version"], context.path);
+  if (ran.status !== 0) return `runtime_install_failed: rustc --version failed in ${context.entry.repository} (exit ${ran.status})${firstLine4(ran.stderr) === "" ? "" : `: ${firstLine4(ran.stderr)}`}${refusalNote(context)}`;
+  const version = /\brustc (\S+)/.exec(ran.stdout)?.[1];
+  line(context, `rust ${version ?? firstLine4(ran.stdout)} from ${pin}`);
+  return void 0;
+};
+var CHECKOUT_STEPS = [installWithMise, goToolchain, rustToolchain];
+function unpinnedIn(context) {
+  const used = new Set([...context.files].map((file) => MANIFESTS[file]));
+  const pinned = new Set(context.resolved.filter((r) => r.source?.startsWith(`${context.path}/`)).map((r) => r.tool));
+  pinned.add("go");
+  if (RUST_PIN_FILES.some((file) => context.files.has(file))) pinned.add("rust");
+  return RUNTIMES.filter((runtime) => used.has(runtime) && !pinned.has(runtime));
+}
+async function provisionRuntimes(input) {
+  const unpinned = {};
+  let dropProxyWarning = false;
+  for (const entry of input.repositories) {
+    if (input.aborted?.() === true) return { ok: false, reason: "", aborted: true };
+    const path = checkoutPath(entry);
+    const listed = await input.exec(["ls", "-1", "-A"], path, { quiet: true });
+    const context = {
+      input,
+      entry,
+      path,
+      files: new Set(listed.status === 0 ? listed.stdout.split("\n").map((name) => name.trim()) : []),
+      refusalsBefore: input.refusals().length,
+      before: [],
+      resolved: []
+    };
+    for (const step of CHECKOUT_STEPS) {
+      const reason = await step(context);
+      if (reason !== void 0) return { ok: false, reason };
+    }
+    unpinned[entry.repository] = unpinnedIn(context);
+    const old = context.resolved.find((r) => r.tool === "node" && !nodeAcceptsProxyWarningFlag(r.version));
+    if (old !== void 0) {
+      dropProxyWarning = true;
+      line(context, `leaving ${PROXY_WARNING_FLAG} out of NODE_OPTIONS because node ${old.version} does not accept it`);
+    }
+  }
+  return { ok: true, unpinned, dropProxyWarning };
+}
+function runtimeStepInput(report, services) {
+  return report.base === void 0 ? {} : { runtimes: { refusals: () => services.record().refusals } };
+}
+function keepUnpinnedRuntimes(state, steps) {
+  if (steps.unpinnedRuntimes !== void 0) state.unpinnedRuntimes = steps.unpinnedRuntimes;
+}
+
 // src/runner/build-steps.ts
 var aborted = () => ({ ok: false, reason: "", aborted: true });
-function firstLine4(text) {
+function firstLine5(text) {
   return text.trim().split("\n")[0] ?? "";
 }
+async function nodeRejectsProxyWarningFlag(repositories, exec, log, tag) {
+  for (const entry of repositories) {
+    const ran = await exec(["node", "--version"], checkoutPath(entry), { quiet: true, withoutProxyWarning: true });
+    if (ran.status !== 0) continue;
+    const version = firstLine5(ran.stdout);
+    if (nodeAcceptsProxyWarningFlag(version)) continue;
+    log.line(`${tag} ${entry.repository}: leaving ${PROXY_WARNING_FLAG} out of NODE_OPTIONS because node ${version} does not accept it`);
+    return true;
+  }
+  return false;
+}
 function gitErrorLine(text) {
-  const lines = text.split("\n").map((line) => line.trim()).filter((line) => line !== "");
-  return lines.find((line) => /^(fatal|error):/.test(line)) ?? lines.at(-1) ?? "";
+  const lines = text.split("\n").map((line2) => line2.trim()).filter((line2) => line2 !== "");
+  return lines.find((line2) => /^(fatal|error):/.test(line2)) ?? lines.at(-1) ?? "";
 }
 var STAGED_TREE = `${JOB_MOUNT}/context/tree`;
 var DELIVER_SCRIPT = [
@@ -2905,7 +3059,7 @@ var DELIVER_SCRIPT = [
 var RECORD_SCRIPT = 'd="$(git rev-parse --git-common-dir)" && mkdir -p "$d/outerlayer" && printf "%s" "$1" > "$d/outerlayer/delivery.json"';
 var WRITE_SHIM_SCRIPT = 'mkdir -p "$1" && printf "%s" "$2" > "$1/claude" && chmod 755 "$1/claude"';
 function failure(what, result) {
-  return `context_delivery_failed: ${what} (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`;
+  return `context_delivery_failed: ${what} (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`;
 }
 async function repositorySkills(input, folder) {
   const listed = await input.exec(["ls", "-1", folder], CHECKOUT_DIR, { quiet: true });
@@ -3007,6 +3161,16 @@ async function runBuildSteps(input) {
     if (!checked.ok) return checked;
   }
   if (input.governing !== void 0) await noteIgnoredDevcontainers(input, repositories, input.governing.repository);
+  let unpinnedRuntimes;
+  const ordered = [{ ...primary, primary: true }, ...repositories.filter((candidate) => candidate.repository !== primary.repository).map((entry) => ({ ...entry, primary: false }))];
+  if (input.runtimes !== void 0) {
+    const chosen = await provisionRuntimes({ repositories: ordered, exec, log, tag, refusals: input.runtimes.refusals, aborted: input.aborted });
+    if (!chosen.ok) return chosen.aborted === true ? aborted() : { ok: false, reason: chosen.reason };
+    unpinnedRuntimes = chosen.unpinned;
+    if (chosen.dropProxyWarning) input.dropProxyWarning?.();
+  } else if (input.dropProxyWarning !== void 0 && await nodeRejectsProxyWarningFlag(ordered, exec, log, tag)) {
+    input.dropProxyWarning();
+  }
   const lifecycleDir = lifecycleWorkdir(repositories, input.governing?.repository);
   for (const step of lifecycleSteps(input.lifecycle)) {
     if (input.aborted()) return aborted();
@@ -3051,7 +3215,7 @@ async function runBuildSteps(input) {
     }
     if (input.aborted()) return aborted();
   }
-  return { ok: true, startCommit, ...controlPlane === void 0 ? {} : { controlPlane } };
+  return { ok: true, startCommit, ...controlPlane === void 0 ? {} : { controlPlane }, ...unpinnedRuntimes === void 0 ? {} : { unpinnedRuntimes } };
 }
 var EVAL_INPUT_NAME = "eval-input";
 var TRANSCRIPT_ROOT = "/build/home/.claude/projects";
@@ -3060,7 +3224,7 @@ var MAX_TRANSCRIPTS = 500;
 var MAX_TOTAL_TRANSCRIPT_BYTES = 64 * 1024 * 1024;
 var TRANSCRIPT_COPY_MS = 2 * 60 * 1e3;
 var BUILD_HOME = "/build/home";
-function firstLine5(text) {
+function firstLine6(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 async function copyTranscripts(run, now = Date.now) {
@@ -3072,7 +3236,7 @@ async function copyTranscripts(run, now = Date.now) {
     return { ok: false, reason: describeCallFailure(err) };
   }
   if (listed.status !== 0 && !/No such file or directory/.test(listed.stderr)) {
-    return { ok: false, reason: `listing the transcripts failed (exit ${listed.status})${firstLine5(listed.stderr) === "" ? "" : `: ${firstLine5(listed.stderr)}`}` };
+    return { ok: false, reason: `listing the transcripts failed (exit ${listed.status})${firstLine6(listed.stderr) === "" ? "" : `: ${firstLine6(listed.stderr)}`}` };
   }
   const paths = listed.stdout.split("\0").filter((entry) => entry.startsWith(`${TRANSCRIPT_ROOT}/`) && !entry.includes("\n") && !entry.slice(TRANSCRIPT_ROOT.length + 1).split("/").includes("..")).map((entry) => entry.slice(TRANSCRIPT_ROOT.length + 1)).sort();
   const copied = [];
@@ -3089,7 +3253,7 @@ async function copyTranscripts(run, now = Date.now) {
     }
     try {
       const read = await run(["head", "-c", String(MAX_TRANSCRIPT_BYTES + 1), `${TRANSCRIPT_ROOT}/${path}`]);
-      if (read.status !== 0) missed.push({ path, reason: `reading it failed (exit ${read.status})${firstLine5(read.stderr) === "" ? "" : `: ${firstLine5(read.stderr)}`}` });
+      if (read.status !== 0) missed.push({ path, reason: `reading it failed (exit ${read.status})${firstLine6(read.stderr) === "" ? "" : `: ${firstLine6(read.stderr)}`}` });
       else if (Buffer.byteLength(read.stdout) > MAX_TRANSCRIPT_BYTES) missed.push({ path, reason: `it is larger than ${MAX_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
       else if (total + Buffer.byteLength(read.stdout) > MAX_TOTAL_TRANSCRIPT_BYTES) missed.push({ path, reason: `copying it would take the transcripts past ${MAX_TOTAL_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
       else {
@@ -3133,11 +3297,11 @@ function scrubbing(scrub, author, work) {
     setRepoRoot(void 0);
   }
 }
-function scrubLine(line) {
+function scrubLine(line2) {
   try {
-    return JSON.stringify(scrubDeep(JSON.parse(line)));
+    return JSON.stringify(scrubDeep(JSON.parse(line2)));
   } catch {
-    return scrubText(line);
+    return scrubText(line2);
   }
 }
 function writeReadOnly(path, text) {
@@ -3211,7 +3375,7 @@ async function writeEvalInput(request) {
           continue;
         }
         const file = `sessions/${traceId}.jsonl`;
-        const text = transcript.content.split("\n").filter((line) => line.trim() !== "").map(scrubLine).join("\n");
+        const text = transcript.content.split("\n").filter((line2) => line2.trim() !== "").map(scrubLine).join("\n");
         writeReadOnly(join(dir, file), `${text}
 `);
         scrubDeep(session);
@@ -3638,8 +3802,8 @@ async function deliverTar(runtime, state, input) {
       { timeoutMs: DELIVERY_TIMEOUT_MS }
     );
     if (result.status === 0) return { ok: true };
-    const line = scrubDelivery(result.stderr.trim().split("\n")[0] ?? "", input.secrets);
-    return { ok: false, reason: `${input.step} could not be delivered (exit ${result.status})${line === "" ? "" : `: ${line}`}` };
+    const line2 = scrubDelivery(result.stderr.trim().split("\n")[0] ?? "", input.secrets);
+    return { ok: false, reason: `${input.step} could not be delivered (exit ${result.status})${line2 === "" ? "" : `: ${line2}`}` };
   } catch (err) {
     return { ok: false, reason: `${input.step} could not be delivered: ${scrubDelivery(describeCallFailure(err), input.secrets)}` };
   }
@@ -3762,18 +3926,18 @@ function parse(data) {
     const length = Number.parseInt(header, 16);
     if (length === 0) return { kind: "commands", commands, capabilities };
     if (data.length - offset < length) return { kind: "need-more" };
-    const line = data.subarray(offset + 4, offset + length);
+    const line2 = data.subarray(offset + 4, offset + length);
     offset += length;
     if (offset > limits().sectionBytes) return refused(TOO_LONG);
     const first = commands.length === 0;
-    const nul = line.indexOf(0);
-    const decoded = decodeText(first && nul !== -1 ? line.subarray(0, nul) : line);
+    const nul = line2.indexOf(0);
+    const decoded = decodeText(first && nul !== -1 ? line2.subarray(0, nul) : line2);
     if (decoded === void 0) return refused(UNREADABLE);
     const text = decoded.replace(/\n$/, "");
     if (first && text.startsWith("shallow ")) continue;
     const match = COMMAND.exec(text);
     if (match === null) return refused(UNREADABLE);
-    if (first && nul !== -1) capabilities = line.subarray(nul + 1).toString("latin1").split(/\s+/).filter((word) => word !== "");
+    if (first && nul !== -1) capabilities = line2.subarray(nul + 1).toString("latin1").split(/\s+/).filter((word) => word !== "");
     commands.push({ oldId: match[1], newId: match[2], ref: match[3] });
   }
 }
@@ -3927,7 +4091,7 @@ function createGitRemote(options) {
   const claimed = options.repositories ?? (options.repository === void 0 || options.branch === void 0 || options.mirrorDir === void 0 ? [] : [{ repository: options.repository, branch: options.branch, mirrorDir: options.mirrorDir }]);
   const maxLfsBodyBytes = 1024 * 1024;
   const hopByHop = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "proxy-authenticate", "proxy-authorization", "te", "trailer", "set-cookie"]);
-  const log = (line) => options.log?.(line);
+  const log = (line2) => options.log?.(line2);
   function forward(input) {
     const { route, res } = input;
     const url = new URL(`${gitUrl}/${route.owner}/${route.name}.git/${route.kind === "info-refs" ? "info/refs" : route.kind === "lfs-batch" ? "info/lfs/objects/batch" : `git-${route.kind}`}${route.search === "" ? "" : `?${route.search}`}`);
@@ -4345,7 +4509,7 @@ function gitRemoteFor(runtime, input) {
     ...input.readOnly === true ? { readOnly: true } : {}
   });
 }
-function firstLine6(text) {
+function firstLine7(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 var NO_ENV = { literals: {}, passed: {} };
@@ -4409,7 +4573,7 @@ async function obtainImage(input) {
       };
     }
     try {
-      const common = { repository, configPath: config.configPath, readToken, pinned: input.pinned, log: (line) => log.line(`${tag} ${line}`) };
+      const common = { repository, configPath: config.configPath, readToken, pinned: input.pinned, log: (line2) => log.line(`${tag} ${line2}`) };
       if (input.inBuilder !== void 0) {
         return { ok: true, built: await runtime.buildRootDisk({ ...input.inBuilder, ...common, guestHelper: input.guestHelper, deadlineMs: input.deadlineMs }) };
       }
@@ -4547,7 +4711,7 @@ async function provisionContainer(input) {
     }
     return aborted2 ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(reason);
   };
-  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine6(result.stderr) === "" ? "" : `: ${firstLine6(result.stderr)}`}`);
+  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine7(result.stderr) === "" ? "" : `: ${firstLine7(result.stderr)}`}`);
   if (input.aborted()) return bail("", true);
   mkdirSync(buildDir2, { recursive: true });
   const ghDir = ghConfigDir(buildDir2);
@@ -4578,8 +4742,8 @@ async function provisionContainer(input) {
   environment.credentials = tokens.used();
   let services;
   try {
-    const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
-    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "stream", input.leaseExpiryMs === void 0 ? void 0 : leaseFor(runtime, buildId, input.leaseExpiryMs), void 0, (line) => log.line(`${tag} ${line}`));
+    const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line2) => log.line(`${tag} ${line2}`) });
+    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "stream", input.leaseExpiryMs === void 0 ? void 0 : leaseFor(runtime, buildId, input.leaseExpiryMs), void 0, (line2) => log.line(`${tag} ${line2}`));
     runtime.tunnels.set(buildId, services);
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
@@ -4606,7 +4770,7 @@ async function provisionContainer(input) {
   if (prepared.status !== 0) return dockerFailed("preparing the build's volume", prepared);
   const started = await host.run(containerRunArgs(runInput), { logPath });
   if (started.status !== 0) return dockerFailed("starting the build's container", started);
-  joinBuild(runtime, state, services, (line) => log.line(`${tag} ${line}`));
+  joinBuild(runtime, state, services, (line2) => log.line(`${tag} ${line2}`));
   if (input.aborted()) return bail("", true);
   if (!await waitForRelay(runtime, state)) return bail("the relay in the build's container did not start");
   const ghDelivered = await deliverJobFiles(runtime, state, ["gh", "maven"], secrets);
@@ -4643,9 +4807,10 @@ async function provisionContainer(input) {
   const hashed = program.status === 0 ? parseProgramHash(program.stdout) : void 0;
   if (hashed !== void 0) state.judgeProgram = { path: JUDGE_PROGRAM, sha256: hashed };
   input.save(state, environment);
-  const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  let execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
   for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
-  const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env: execEnv, argv }, opts?.quiet === true ? void 0 : { logPath });
+  const plainEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv, proxyWarning: false });
+  const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env: opts?.withoutProxyWarning === true ? plainEnv : execEnv, argv }, opts?.quiet === true ? void 0 : { logPath });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
@@ -4676,10 +4841,17 @@ async function provisionContainer(input) {
     },
     removeStagedContext: () => removeStagedContext(buildDir2),
     keepIn: jobDir,
-    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {}
+    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
+    // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
+    ...runtimeStepInput(report, services),
+    dropProxyWarning: () => {
+      state.proxyWarningDropped = true;
+      execEnv = plainEnv;
+    }
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
+  keepUnpinnedRuntimes(state, steps);
   if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
@@ -4705,9 +4877,11 @@ function containerCommandExec(input) {
     repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
+    unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
-    imageEnv: state.imageEnv
+    imageEnv: state.imageEnv,
+    proxyWarning: state.proxyWarningDropped !== true
   });
   return {
     container: state.container,
@@ -4729,9 +4903,11 @@ function containerSenderCommand(input) {
     repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
+    unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
-    imageEnv: state.imageEnv
+    imageEnv: state.imageEnv,
+    proxyWarning: state.proxyWarningDropped !== true
   });
   const args = containerExecArgs({
     container: state.container,
@@ -4860,9 +5036,11 @@ async function syncInContainer(input) {
       repositories: job.repositories,
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
+      unpinnedRuntimes: state.unpinnedRuntimes,
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,
-      imageEnv: state.imageEnv
+      imageEnv: state.imageEnv,
+      proxyWarning: state.proxyWarningDropped !== true
     });
     const result = await runtime.host.exec(
       { container: state.container, user: state.agentUser ?? ADDED_USER, workdir: job.workdir ?? CHECKOUT_DIR, env, argv: ["outerlayer", "sync"] },
@@ -4937,7 +5115,7 @@ function containerJudgeEnvironment(input) {
       env: NO_ENV,
       argv: ["/bin/sh", "-c", `[ -f ${file} ] && [ ! -L ${file} ] && head -c ${maxBytes + 1} ${file}`]
     }, { timeoutMs: REPORT_READ_TIMEOUT_MS });
-    if (read.status > 1) throw new Error(`reading the judge's ${name} exited ${read.status}: ${firstLine6(read.stderr)}`);
+    if (read.status > 1) throw new Error(`reading the judge's ${name} exited ${read.status}: ${firstLine7(read.stderr)}`);
     return read.status === 0 && Buffer.byteLength(read.stdout) <= maxBytes ? read.stdout : void 0;
   };
   return {
@@ -4955,7 +5133,7 @@ function containerJudgeEnvironment(input) {
     hashProgram: async () => {
       const ran = await runtime.host.exec({ container: state.container, user: ADDED_USER, env: NO_ENV, argv: [...HASH_ARGV] });
       const sha256 = ran.status === 0 ? parseProgramHash(ran.stdout) : void 0;
-      return sha256 === void 0 ? { ok: false, reason: firstLine6(ran.stderr) || `the hash could not be taken (exit ${ran.status})` } : { ok: true, sha256 };
+      return sha256 === void 0 ? { ok: false, reason: firstLine7(ran.stderr) || `the hash could not be taken (exit ${ran.status})` } : { ok: true, sha256 };
     },
     prepare: async (files, tree) => {
       if (filesAreCopied(state)) {
@@ -4988,7 +5166,7 @@ function containerJudgeEnvironment(input) {
     // host. Every capability is dropped in the container, so root there could not either; the build's user removes its own, and the runner removes the rest.
     clear: async () => {
       const removed = await runtime.host.exec({ container: state.container, user, env: NO_ENV, argv: ["find", JUDGE_DIR, "-mindepth", "1", "-user", user, "-delete"] });
-      if (removed.status !== 0) throw new Error(`find exited ${removed.status}: ${firstLine6(removed.stderr)}`);
+      if (removed.status !== 0) throw new Error(`find exited ${removed.status}: ${firstLine7(removed.stderr)}`);
       if (!filesAreCopied(state)) return;
       const emptied = await clearJudgeFolder(runtime, state, secretsOf(runtime, input.jobDir));
       if (!emptied.ok) throw new Error(emptied.reason);
@@ -5044,7 +5222,7 @@ async function startCheckContainer(input) {
     }
     return { ok: false, reason };
   };
-  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine6(result.stderr) === "" ? "" : `: ${firstLine6(result.stderr)}`}`);
+  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine7(result.stderr) === "" ? "" : `: ${firstLine7(result.stderr)}`}`);
   mkdirSync(buildDir2, { recursive: true });
   if (!filesAreCopied(state)) chmodSync(buildDir2, 493);
   let services;
@@ -5053,7 +5231,7 @@ async function startCheckContainer(input) {
       repositories: repositoriesOf({ repositories: job.repositories, repository, branch: job.branch }),
       tokens,
       buildDir: buildDir2,
-      log: (line) => log.line(`${tag} ${line}`),
+      log: (line2) => log.line(`${tag} ${line2}`),
       readOnly: true
     });
     services = await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote, transport === "exec" ? "stream" : "socket");
@@ -5082,7 +5260,7 @@ async function startCheckContainer(input) {
   if (prepared.status !== 0) return dockerFailed("preparing the check environment's volume", prepared);
   const started = await host.run(containerRunArgs(runInput), { logPath });
   if (started.status !== 0) return dockerFailed("starting the check environment's container", started);
-  if (transport === "exec") joinBuild(runtime, state, services, (line) => log.line(`${tag} ${line}`));
+  if (transport === "exec") joinBuild(runtime, state, services, (line2) => log.line(`${tag} ${line2}`));
   if (!await waitForRelay(runtime, state)) return fail("the relay in the check environment's container did not start");
   const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {}, imageEnv: built.imageEnv });
   const secrets = () => tokens.issuedTokens();
@@ -5111,7 +5289,7 @@ async function startCheckContainer(input) {
         await host.stop(name);
         const again = await host.start(name);
         if (again.status !== 0 || !await waitForRelay(runtime, state)) return false;
-        rejoinBuild(runtime, state, (line) => log.line(`${tag} ${line}`));
+        rejoinBuild(runtime, state, (line2) => log.line(`${tag} ${line2}`));
         if (delivered) {
           const again2 = await deliverInput();
           if (!again2.ok) {
@@ -5128,8 +5306,8 @@ async function startCheckContainer(input) {
 // src/runner/machine.ts
 function groupName(gid) {
   try {
-    for (const line of readFileSync("/etc/group", "utf8").split("\n")) {
-      const [name, , id] = line.split(":");
+    for (const line2 of readFileSync("/etc/group", "utf8").split("\n")) {
+      const [name, , id] = line2.split(":");
       if (name !== void 0 && Number(id) === gid) return name;
     }
   } catch {
@@ -5224,4 +5402,4 @@ function describeMachineDocker(machine) {
   return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
 }
 
-export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };
+export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, keepUnpinnedRuntimes, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, runtimeStepInput, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };