@outerlayer/cli 0.34.0-next.20261027193835 → 0.34.0-next.20261028010245

package/dist/{chunk-S5U6RKQX.js → chunk-HFMK2R7O.js}

@@ -1,35 +1,35 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-Y4WJ4BLX.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-GMEXR6PY.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
-import { writePendingUpdate } from './chunk-UZIAZXXO.js';
-import { renderUpdateSteps } from './chunk-SKAML7GB.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-BS4CZMT6.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-Y7MF32DM.js';
+import { writePendingUpdate } from './chunk-77D5ENBA.js';
+import { renderUpdateSteps } from './chunk-SYMBXSAT.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-GET5HKLM.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-PBI4CM4M.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-4HA4S3U2.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-WR2GRWK3.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf, createHousekeepingDocker, housekeepingDockerIfReachable, KIND_LABEL, RECIPE_KEY_LABEL } from './chunk-3E7QAXUW.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-I4YOWQH7.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-LSFP57LI.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-7Q7GQELE.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-CFJOONWM.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, HELPER_ENV, setUpRunnerCgroup, sweepImageBuilders, stoppedHelperReason, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ensureNetworkReady, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-VB4QD4WN.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-PPQTTJSW.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-LBKCYEJT.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWMJMQRF.js';
-import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-LYX2RRSF.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-FLHBUQ2W.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-3FTIUB7I.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-GXMMILQ4.js';
+import { freeBytes, formatBytes, allocatedBytes } from './chunk-EGJY6MBC.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, readJobFileChecked } from './chunk-AHWMY3MS.js';
+import { claimPidFile, releasePidFile, writePidFile, readPidFile } from './chunk-3X6OSXSB.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6IMQXBTZ.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-RJZZFAXS.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-GJYGOFF3.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-VKYU4HHW.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-3VJYDWFV.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-GMKDAF37.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AJTGTSNA.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-L2OARQKP.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
-import { randomBytes } from 'crypto';
-import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
-import { totalmem, constants } from 'os';
+import { randomBytes, createHash } from 'crypto';
+import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, rmSync, closeSync, lstatSync } from 'fs';
+import { totalmem, userInfo, constants } from 'os';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -369,9 +369,9 @@ function retryFailure(version, err) {
   }
   return { outcome: "retrying", reason: messageOf(err) };
 }
-function finish(args, failure2) {
-  let update = { from: args.own, to: args.version, outcome: failure2.outcome, reason: failure2.reason, at: isoAt(args.now) };
-  if (failure2.outcome === "retrying") {
+function finish(args, failure) {
+  let update = { from: args.own, to: args.version, outcome: failure.outcome, reason: failure.reason, at: isoAt(args.now) };
+  if (failure.outcome === "retrying") {
     const previous = readLastUpdate(args.configPath);
     const attempts = previous?.to === args.version && previous.outcome === "retrying" ? (previous.attempts ?? 1) + 1 : 1;
     update = { ...update, attempts };
@@ -381,16 +381,16 @@ function finish(args, failure2) {
   } catch (err) {
     args.log.error(`could not record the update attempt: ${messageOf(err)}`);
   }
-  if (failure2.outcome === "retrying") {
+  if (failure.outcome === "retrying") {
     return {
       kind: "retrying",
-      reason: failure2.reason,
-      detail: failure2.detail ?? failure2.reason,
+      reason: failure.reason,
+      detail: failure.detail ?? failure.reason,
       attempts: update.attempts ?? 1,
       retryAtMs: retryAfterMs(update)
     };
   }
-  return { kind: "failed", outcome: failure2.outcome, reason: failure2.reason };
+  return { kind: "failed", outcome: failure.outcome, reason: failure.reason };
 }
 async function earlyFailure(args) {
   const current = currentVersion(args.configPath);
@@ -421,8 +421,8 @@ async function earlyFailure(args) {
   return void 0;
 }
 async function preflightUpdate(args) {
-  const failure2 = await earlyFailure(args);
-  return failure2 === void 0 ? void 0 : finish(args, failure2);
+  const failure = await earlyFailure(args);
+  return failure === void 0 ? void 0 : finish(args, failure);
 }
 async function prepareUpdate(args) {
   const { configPath, version, deps } = args;
@@ -536,150 +536,6 @@ function settleUpdate(args) {
   }
 }
 
-// src/runner/housekeeping/docker.ts
-var KIND_LABEL = "ai.outerlayer.kind";
-var RECIPE_KEY_LABEL = "ai.outerlayer.recipe-key";
-var NO_BUILDER = /no builder .* found/i;
-function failure(result, what) {
-  return new Error(`${what}: ${result.stderr.trim() || `docker exited ${result.status}`}`);
-}
-function labelled(stdout, runnerId) {
-  const found = [];
-  for (const line of stdout.split("\n")) {
-    const [key = "", build = "", runner = ""] = line.replace(/\r?\n$/, "").split("	");
-    if (key.trim() === "" || build === "") continue;
-    if (runner !== "" && runner !== runnerId) continue;
-    found.push({ key: key.trim(), build, owned: runner === runnerId });
-  }
-  return found;
-}
-function decimalUnits() {
-  return { b: 1, kb: 1e3, mb: 1e6, gb: 1e9, tb: 1e12, pb: 1e15 };
-}
-function parsePrunedBytes(stdout) {
-  const match = /^Total(?: reclaimed space)?:\s*([\d.]+)\s*([A-Za-z]*)\s*$/im.exec(stdout);
-  if (match === null) return 0;
-  const unit = decimalUnits()[match[2].toLowerCase() || "b"];
-  return unit === void 0 ? 0 : Math.round(Number(match[1]) * unit);
-}
-function createHousekeepingDocker(deps) {
-  const run = deps.run ?? spawnRun;
-  return {
-    async listBuildContainers() {
-      const result = await run("docker", [
-        "ps",
-        "--all",
-        "--no-trunc",
-        "--filter",
-        `label=${BUILD_LABEL}`,
-        "--format",
-        `{{.ID}}	{{.Label "${BUILD_LABEL}"}}	{{.Label "${RUNNER_LABEL}"}}`
-      ]);
-      if (result.status !== 0) throw failure(result, "docker ps");
-      return labelled(result.stdout, deps.runnerId).map(({ key, build, owned }) => ({ id: key, build, owned }));
-    },
-    async listBuildVolumes() {
-      const result = await run("docker", [
-        "volume",
-        "ls",
-        "--filter",
-        `label=${BUILD_LABEL}`,
-        "--format",
-        `{{.Name}}	{{.Label "${BUILD_LABEL}"}}	{{.Label "${RUNNER_LABEL}"}}`
-      ]);
-      if (result.status !== 0) throw failure(result, "docker volume ls");
-      return labelled(result.stdout, deps.runnerId).map(({ key, build, owned }) => ({ name: key, build, owned }));
-    },
-    async removeContainer(id) {
-      const result = await run("docker", ["rm", "--force", "--volumes", id]);
-      if (result.status !== 0) throw failure(result, `docker rm ${id}`);
-    },
-    async removeVolume(name) {
-      const result = await run("docker", ["volume", "rm", "--force", name]);
-      if (result.status !== 0) throw failure(result, `docker volume rm ${name}`);
-    },
-    async imageState(ref) {
-      const result = await run("docker", ["image", "inspect", "--format", "{{.Id}}", ref]);
-      if (result.status === 0) return "present";
-      return /no such image|not found/i.test(result.stderr) ? "missing" : "unknown";
-    },
-    async listDanglingImages() {
-      const listed = await run("docker", [
-        "image",
-        "ls",
-        "--all",
-        "--no-trunc",
-        "--quiet",
-        "--filter",
-        "dangling=true",
-        "--filter",
-        `label=${KIND_LABEL}`,
-        "--filter",
-        `label=${RUNNER_LABEL}=${deps.runnerId}`
-      ]);
-      if (listed.status !== 0) throw failure(listed, "docker image ls");
-      const ids = [...new Set(listed.stdout.split("\n").map((l) => l.trim()).filter(Boolean))];
-      if (ids.length === 0) return [];
-      const inspected = await run("docker", ["image", "inspect", ...ids]);
-      if (inspected.status !== 0) throw failure(inspected, "docker image inspect");
-      return JSON.parse(inspected.stdout).map((row) => ({
-        id: row.Id,
-        size: row.Size ?? 0,
-        labels: row.Config?.Labels ?? {}
-      }));
-    },
-    async listLabelledImages() {
-      const listed = await run("docker", ["image", "ls", "--all", "--no-trunc", "--quiet", "--filter", `label=${KIND_LABEL}`, "--filter", `label=${RUNNER_LABEL}=${deps.runnerId}`]);
-      if (listed.status !== 0) throw failure(listed, "docker image ls");
-      const ids = [...new Set(listed.stdout.split("\n").map((l) => l.trim()).filter(Boolean))];
-      if (ids.length === 0) return [];
-      const inspected = await run("docker", ["image", "inspect", ...ids]);
-      if (inspected.status !== 0) throw failure(inspected, "docker image inspect");
-      return JSON.parse(inspected.stdout).map((row) => ({
-        id: row.Id,
-        size: row.Size ?? 0,
-        labels: row.Config?.Labels ?? {},
-        tags: (row.RepoTags ?? []).filter((tag) => tag !== "<none>:<none>"),
-        createdMs: Date.parse(row.Created ?? "")
-      }));
-    },
-    async removeImage(id) {
-      const result = await run("docker", ["rmi", id]);
-      if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
-    },
-    async removeBuilder() {
-      const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
-      if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
-      const df = await run("docker", ["system", "df", "-v"]);
-      const freedBytes = df.status === 0 ? volumeBytes(df.stdout, /* @__PURE__ */ new Set([`buildx_buildkit_${deps.builder}0_state`])) : 0;
-      const result = await run("docker", ["buildx", "rm", deps.builder]);
-      if (result.status !== 0 && NO_BUILDER.test(result.stderr)) return void 0;
-      if (result.status !== 0) throw failure(result, "docker buildx rm");
-      return { freedBytes };
-    },
-    async builderPrune(keepBytes) {
-      const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
-      if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
-      const status = inspected.status === 0 ? /^Status:\s*(\S+)/m.exec(inspected.stdout)?.[1] : void 0;
-      if (status !== void 0 && status !== "running") return void 0;
-      const result = await run("docker", ["buildx", "prune", "--builder", deps.builder, "--force", "--max-used-space", String(keepBytes)]);
-      if (result.status !== 0 && (NO_BUILDER.test(result.stderr) || /driver not running/i.test(result.stderr))) return void 0;
-      if (result.status !== 0) throw failure(result, "docker buildx prune");
-      return { freedBytes: parsePrunedBytes(result.stdout) };
-    }
-  };
-}
-async function housekeepingDockerIfReachable(deps) {
-  const run = deps.run ?? spawnRun;
-  try {
-    const answered = await run("docker", ["version", "--format", "{{.Server.Version}}"]);
-    if (answered.status !== 0) return void 0;
-  } catch {
-    return void 0;
-  }
-  return createHousekeepingDocker(deps);
-}
-
 // src/runner/housekeeping/select.ts
 var DAY_MS = 864e5;
 function spoolMaxAgeMs() {
@@ -1140,6 +996,45 @@ function notEndedByRunnerReason(exit, isolated) {
 function jobNotEndedByRunnerReason(exit, job) {
   return notEndedByRunnerReason(exit, job.container !== void 0 || job.microvm !== void 0);
 }
+var HelperInUseError = class extends Error {
+  constructor(socketPath, holder) {
+    super(
+      `another runner already uses the root helper at ${socketPath} (pid ${holder.pid}, config ${holder.config}). A runner stops every microVM build its helper lists that it did not start, so two runners on one helper end each other's builds. Give this runner a service and a helper of its own: outerlayer runner install --service --unit-name <name>.`
+    );
+    this.socketPath = socketPath;
+    this.holder = holder;
+  }
+};
+function helperClaimPath(socketPath, home = userInfo().homedir) {
+  const key = createHash("sha256").update(socketPath).digest("hex").slice(0, 16);
+  return join(home, ".outerlayer", "helper-runners", `${key}.json`);
+}
+function readClaim(path) {
+  if (!existsSync(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed.pid !== "number" || typeof parsed.start !== "string") return void 0;
+    return { pid: parsed.pid, start: parsed.start, config: typeof parsed.config === "string" ? parsed.config : "unknown" };
+  } catch {
+    return void 0;
+  }
+}
+function claimHelper(socketPath, self, options = {}) {
+  const path = helperClaimPath(socketPath, options.home);
+  const alive = options.isSameProcessFn ?? isSameProcess;
+  const holder = readClaim(path);
+  if (holder !== void 0 && !(holder.pid === self.pid && holder.start === self.start) && alive(holder.pid, holder.start)) {
+    throw new HelperInUseError(socketPath, holder);
+  }
+  mkdirSync(join(path, ".."), { recursive: true, mode: RUNNER_DIR_MODE });
+  writeFileSync(path, JSON.stringify(self), { mode: RUNNER_FILE_MODE });
+}
+function releaseHelper(socketPath, self, options = {}) {
+  const path = helperClaimPath(socketPath, options.home);
+  const holder = readClaim(path);
+  if (holder === void 0 || holder.pid !== self.pid || holder.start !== self.start) return;
+  rmSync(path, { force: true });
+}
 
 // src/runner/loop.ts
 var QUEUE_ORDER = ["amend", "implement"];
@@ -1961,7 +1856,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-LUKJHAMH.js');
+  const { postJson: postJson2 } = await import('./work-cmd-77GUT7LY.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2761,6 +2656,18 @@ async function endStoppedBuild(state, active, where) {
   );
   void endJob(state, active, "interrupted", { stage: "command", reason: COMMAND_LOST_REASON });
 }
+async function endWithoutNetwork(state, active, container, tag) {
+  if (container.network === void 0) return false;
+  const runtime = runtimeOf(state);
+  const helper = await runtime.host.state(container.network);
+  if (helper !== "stopped" && helper !== "missing") return false;
+  if (await runtime.host.state(container.container) !== "running" || active.ending) return false;
+  const reason = helper === "missing" ? `the build's network helper container ${container.network} is gone` : await stoppedHelperReason(runtime, container.network);
+  if (active.ending) return false;
+  logOf(state).error(`${tag} ${reason} \xB7 ending job as failed`);
+  await endJob(state, active, "failed", { stage: "command", reason });
+  return true;
+}
 var DISK_FAILURES_LIMIT = 2;
 async function checkDisk(state, active, container, tag) {
   const log = logOf(state);
@@ -2930,6 +2837,7 @@ async function watchTick(state, active, nowMs, logMtimeMs) {
     return;
   }
   if (!started) return;
+  if (active.job.container !== void 0 && await endWithoutNetwork(state, active, active.job.container, tag)) return;
   if (active.job.container !== void 0 && active.diskChecking !== true) {
     active.diskChecking = true;
     try {
@@ -3186,9 +3094,11 @@ async function readStoppedBuild(state, dirPath, job) {
   const container = job.container;
   runtime.leases.get(container.buildId)?.stop();
   try {
+    let network;
     for (let attempt = 1; attempt <= STOPPED_READ_ATTEMPTS; attempt++) {
-      const started = await runtime.host.start(container.container);
-      if (started.status === 0) {
+      network = await ensureNetworkReady(runtime, container);
+      const started = network === void 0 ? await runtime.host.start(container.container) : void 0;
+      if (started?.status === 0) {
         const code = await readVolumeExitCode(runtime, dirPath, container);
         if (code !== "unreadable") {
           await runtime.host.stop(container.container);
@@ -3198,7 +3108,7 @@ async function readStoppedBuild(state, dirPath, job) {
       }
       if (attempt < STOPPED_READ_ATTEMPTS) await (state.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))))(STOPPED_READ_RETRY_MS);
     }
-    logOf(state).error(`#${job.item} the stopped build's volume could not be read after ${STOPPED_READ_ATTEMPTS} tries`);
+    logOf(state).error(`#${job.item} the stopped build's volume could not be read after ${STOPPED_READ_ATTEMPTS} tries${network === void 0 ? "" : `: ${network}`}`);
     return { code: void 0, readable: false };
   } catch (err) {
     logOf(state).error(`#${job.item} the stopped build's volume could not be read: ${describeCallFailure(err)}`);
@@ -3279,7 +3189,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-IFHLERRX.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-C7UKLYZQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -3320,6 +3230,15 @@ async function startRunner(configPath, deps, startup) {
   mkdirSync(jobsDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
   const self = { pid: process.pid, start: startTimeOf(process.pid) ?? "" };
   claimPidFile(pidFilePath(configPath), self);
+  const helperSocket = process.env[HELPER_ENV];
+  if (helperSocket !== void 0 && helperSocket !== "") {
+    try {
+      claimHelper(helperSocket, { ...self, config: configPath }, deps.helperClaim);
+    } catch (err) {
+      releasePidFile(pidFilePath(configPath), self);
+      throw err instanceof HelperInUseError ? new RunnerStartError(err.message) : err;
+    }
+  }
   check = "cgroup";
   const { delegated, refusal } = setUpRunnerCgroup();
   if (refusal !== void 0) log.error(`the kernel refused a cgroup step for the runner's service: ${refusal}`);
@@ -3482,6 +3401,7 @@ async function startRunner(configPath, deps, startup) {
     close();
     for (const relay of state.containerRuntime?.relays.values() ?? []) void relay.close();
     releasePidFile(pidFilePath(configPath), self);
+    if (helperSocket !== void 0 && helperSocket !== "") releaseHelper(helperSocket, self, deps.helperClaim);
     log.line("runner exited");
   };
   const drain = async (onWaiting) => {

package/dist/{chunk-WR2GRWK3.js → chunk-I4YOWQH7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-QRIE4JZE.js → chunk-JXY66VYX.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-7SJNVGVC.js';
-import { spoolDir } from './chunk-4QQJTJUN.js';
+import { LiveUploader } from './chunk-32FAPJFD.js';
+import { spoolDir } from './chunk-57WFXHCB.js';
 import { CaptureDaemon } from './chunk-A6PJSNP6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-CMMEJJTL.js → chunk-KTVZ7TZY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL_REVISION, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, HEADLESS_SHELL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_VERSION } from './chunk-WX2HW2G2.js';
-import { PROXY_WARNING_FLAG } from './chunk-GMKDAF37.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL_REVISION, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, HEADLESS_SHELL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_VERSION } from './chunk-D3CT6XQ4.js';
+import { PROXY_WARNING_FLAG } from './chunk-L2OARQKP.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-GMKDAF37.js → chunk-L2OARQKP.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-MESOOLF4.js';
 import { spawn, spawnSync } from 'child_process';
-import { statSync, readFileSync, mkdirSync, writeFileSync, existsSync, unlinkSync, chmodSync } from 'fs';
+import { statSync, readFileSync, existsSync, unlinkSync, chmodSync } from 'fs';
 import { join, dirname } from 'path';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
@@ -780,61 +780,8 @@ function primaryOf(repositories) {
 
 // src/scrub-env.ts
 var SCRUB_ENV_VARIABLE = "OUTERLAYER_SCRUB_ENV";
-var MAVEN_DIR = "maven";
-var MAVEN_SETTINGS_FILE = "settings.xml";
-var MAVEN_NO_PROXY_NOTE = "MAVEN_ARGS names its own global settings file, so the build's Maven gets no proxy from the runner";
-var MAVEN_SPACE_NOTE = "the build's directory has whitespace in its path, which Maven cannot read from MAVEN_ARGS, so its Maven gets no proxy from the runner";
-function namesGlobalSettings(args) {
-  return args.split(/\s+/).some((token) => token === "--global-settings" || token.startsWith("--global-settings=") || token === "-gs" || token.startsWith("-gs="));
-}
-function escapeXml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function mavenSettingsXml(proxyUrl, noProxy) {
-  const url = new URL(proxyUrl);
-  const host = escapeXml(url.hostname.replace(/^\[|\]$/g, ""));
-  const nonProxyHosts = escapeXml(noProxy.split(",").filter((entry) => entry !== "").join("|"));
-  const proxy = (protocol) => [
-    "    <proxy>",
-    `      <id>outerlayer-${protocol}</id>`,
-    "      <active>true</active>",
-    `      <protocol>${protocol}</protocol>`,
-    `      <host>${host}</host>`,
-    `      <port>${url.port}</port>`,
-    `      <nonProxyHosts>${nonProxyHosts}</nonProxyHosts>`,
-    "    </proxy>"
-  ].join("\n");
-  return [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    '<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0">',
-    "  <proxies>",
-    proxy("http"),
-    proxy("https"),
-    "  </proxies>",
-    "</settings>",
-    ""
-  ].join("\n");
-}
-function writeMavenSettings(buildDir, proxyUrl, noProxy) {
-  const dir = join(buildDir, MAVEN_DIR);
-  mkdirSync(dir, { recursive: true });
-  const file = join(dir, MAVEN_SETTINGS_FILE);
-  writeFileSync(file, mavenSettingsXml(proxyUrl, noProxy));
-  return file;
-}
-function mavenArgs(settingsFile, team) {
-  const own = team?.trim() ?? "";
-  if (own !== "" && namesGlobalSettings(own)) return { value: team, skipped: true };
-  return { value: own === "" ? `--global-settings ${settingsFile}` : `--global-settings ${settingsFile} ${own}`, skipped: false };
-}
 
 // src/runner/container/environment.ts
-function buildMavenSettingsXml() {
-  return mavenSettingsXml(PROXY_URL, proxyEnvironment(PROXY_URL).NO_PROXY);
-}
-function writeBuildMavenSettings(buildDir) {
-  writeMavenSettings(buildDir, PROXY_URL, proxyEnvironment(PROXY_URL).NO_PROXY);
-}
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
 var EVAL_INPUT_DIR = `${JOB_MOUNT}/eval-input`;
@@ -854,7 +801,6 @@ function lifecycleWorkdir(repositories, governingRepository) {
   return entry === void 0 ? CHECKOUT_DIR : checkoutPath(entry);
 }
 var MAX_HOSTS = 200;
-var MAVEN_SETTINGS_IN_BUILD = `${JOB_MOUNT}/${MAVEN_DIR}/${MAVEN_SETTINGS_FILE}`;
 function tokenVariables() {
   return ["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GITHUB_ENTERPRISE_TOKEN"];
 }
@@ -863,7 +809,7 @@ function githubVariables() {
 }
 var PROXY_URL = `http://127.0.0.1:${RELAY_PORT}`;
 var NO_LOCAL = "localhost,127.0.0.1";
-function proxyEnvironment(proxyUrl, alsoNoProxy) {
+function standardProxyEnvironment(proxyUrl, alsoNoProxy) {
   const NO_PROXY = alsoNoProxy === void 0 || NO_LOCAL.split(",").includes(alsoNoProxy) ? NO_LOCAL : `${NO_LOCAL},${alsoNoProxy}`;
   return {
     HTTPS_PROXY: proxyUrl,
@@ -872,7 +818,15 @@ function proxyEnvironment(proxyUrl, alsoNoProxy) {
     https_proxy: proxyUrl,
     http_proxy: proxyUrl,
     NO_PROXY,
-    no_proxy: NO_PROXY,
+    no_proxy: NO_PROXY
+  };
+}
+function toolProxyVariables() {
+  return ["NODE_USE_ENV_PROXY", "YARN_HTTPS_PROXY", "YARN_HTTP_PROXY"];
+}
+function proxyEnvironment(proxyUrl, alsoNoProxy) {
+  return {
+    ...standardProxyEnvironment(proxyUrl, alsoNoProxy),
     NODE_USE_ENV_PROXY: "1",
     // Yarn 2 and later ignore the variables above and read only their own.
     // Without these, `yarn install` resolves registry names itself, which a
@@ -887,24 +841,12 @@ function withProxyWarningHidden(options) {
   if (given.split(/\s+/).includes(PROXY_WARNING_FLAG)) return given;
   return given === "" ? PROXY_WARNING_FLAG : `${given} ${PROXY_WARNING_FLAG}`;
 }
-function withoutProxyWarningFlag(options) {
-  return options.split(/\s+/).filter((option) => option !== "" && option !== PROXY_WARNING_FLAG).join(" ");
-}
-function nodeAcceptsProxyWarningFlag(version) {
-  const match = /^v?(\d+)\.(\d+)/.exec(version.trim());
-  if (match === null) return true;
-  const major = Number(match[1]);
-  const minor = Number(match[2]);
-  if (major === 20) return minor >= 11;
-  if (major === 21) return minor >= 3;
-  return major >= 22;
-}
 function runnerLiterals(repository, repositories = [], unpinnedRuntimes) {
   return {
     OUTERLAYER_JOB_DIR: JOB_MOUNT,
     HOME: BUILD_HOME,
     TMPDIR: "/tmp",
-    ...proxyEnvironment(PROXY_URL),
+    ...standardProxyEnvironment(PROXY_URL),
     GIT_TERMINAL_PROMPT: "0",
     GH_CONFIG_DIR: `${JOB_MOUNT}/gh`,
     GH_NO_UPDATE_NOTIFIER: "1",
@@ -927,7 +869,8 @@ function reservedNames() {
     ...Object.keys(runnerLiterals("owner/name")),
     ...Object.keys(builtInEnvironment(containerBuiltInAddress, void 0)),
     "PATH",
-    ...tokenVariables()
+    ...tokenVariables(),
+    ...toolProxyVariables()
   ]);
 }
 function isReservedVariable(name) {
@@ -974,24 +917,6 @@ function buildEnvironment(input) {
       variables.push(name);
     }
   }
-  const nodeOptions = {};
-  if (input.imageEnv !== void 0) {
-    const hide = input.proxyWarning !== false;
-    const apply = (value) => hide ? withProxyWarningHidden(value) : value === void 0 ? void 0 : withoutProxyWarningFlag(value);
-    if (passed.NODE_OPTIONS !== void 0) passed.NODE_OPTIONS = apply(passed.NODE_OPTIONS);
-    else {
-      const value = apply(recipe.NODE_OPTIONS ?? input.imageEnv.NODE_OPTIONS);
-      if (value !== void 0) nodeOptions.NODE_OPTIONS = value;
-    }
-  }
-  const mavenLiterals = {};
-  const notices = [];
-  if (input.imageEnv !== void 0 && input.mavenProxy !== false) {
-    const { value, skipped } = mavenArgs(MAVEN_SETTINGS_IN_BUILD, passed.MAVEN_ARGS ?? recipe.MAVEN_ARGS ?? input.imageEnv.MAVEN_ARGS);
-    if (passed.MAVEN_ARGS !== void 0) passed.MAVEN_ARGS = value;
-    else mavenLiterals.MAVEN_ARGS = value;
-    if (skipped) notices.push(MAVEN_NO_PROXY_NOTE);
-  }
   const destinations = destinationEnvironment(input.config.build?.destinations, containerLocalAddress);
   const builtInLiterals = builtIns ? builtInEnvironment(containerBuiltInAddress, input.config.managed === true ? managedClaudeCredential() : claudeCredential(input.hostEnv)) : {};
   const hooksPath = input.identity?.hooksPath;
@@ -1009,8 +934,6 @@ function buildEnvironment(input) {
   return {
     literals: {
       ...recipe,
-      ...nodeOptions,
-      ...mavenLiterals,
       ...destinations,
       ...runnerLiterals(input.repository, repositoriesOf({ repositories: input.repositories, repository: input.repository, branch: input.branch }), input.unpinnedRuntimes),
       ...builtInLiterals,
@@ -1019,8 +942,7 @@ function buildEnvironment(input) {
     },
     passed,
     variables,
-    skippedTokenVariables,
-    notices
+    skippedTokenVariables
   };
 }
 function checkEnvironment(input) {
@@ -1032,10 +954,7 @@ function checkEnvironment(input) {
     hostEnv: input.hostEnv,
     containerEnv: input.containerEnv,
     builtIns: false,
-    imageEnv: input.imageEnv,
-    factoryVariables: input.factoryVariables,
-    // A check container is given no settings file, so a `MAVEN_ARGS` naming one would break the check's Maven.
-    mavenProxy: false
+    factoryVariables: input.factoryVariables
   });
   const withheld = /* @__PURE__ */ new Set(["OUTERLAYER_URL", "OUTERLAYER_API_KEY", ...CLAUDE_CREDENTIAL_VARIABLES]);
   const literals = { OUTERLAYER_EVAL_INPUT: EVAL_INPUT_DIR, OUTERLAYER_CHECK_ITEMS: CHECK_ITEMS_FILE };
@@ -1085,4 +1004,4 @@ function routesOf(counts) {
   return routes.length === 0 ? {} : { routes };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, SCRUB_ENV_VARIABLE, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, nodeAcceptsProxyWarningFlag, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, SCRUB_ENV_VARIABLE, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };

package/dist/{chunk-CFJOONWM.js → chunk-LBKCYEJT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-OHTMTMFX.js → chunk-NBETYM32.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-JWMJMQRF.js';
-import { parseSize } from './chunk-FLHBUQ2W.js';
-import { runnerDir } from './chunk-3VJYDWFV.js';
-import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-GMKDAF37.js';
+import { builtinKind, keepsHostBuilder } from './chunk-GXMMILQ4.js';
+import { parseSize } from './chunk-AHWMY3MS.js';
+import { runnerDir } from './chunk-AJTGTSNA.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-L2OARQKP.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';
 import { spawnSync } from 'child_process';