@outerlayer/cli 0.34.0-next.20261028152714 → 0.34.0-next.20261028164329

package/dist/{chunk-AJZWVXXA.js → chunk-IPWKT5J7.js}

@@ -2,26 +2,26 @@
 import { createRequire } from 'node:module';
 import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, testFileMatcher, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-UE2C4STC.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { HELPER_PATH, DOCKERD_LOG, HELPER_RECORD } from './chunk-XDCD4GD5.js';
+import { HELPER_PATH, DOCKERD_LOG, HELPER_RECORD } from './chunk-POND2SMT.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-6MLX26T4.js';
-import { installScrubContext } from './chunk-FG564H3C.js';
-import { writeDockerClientConfig } from './chunk-BUVDDPOM.js';
+import { senderPidfile } from './chunk-TDCHUEKY.js';
+import { installScrubContext } from './chunk-I2MFIT6X.js';
+import { writeDockerClientConfig } from './chunk-BBJ6BM5U.js';
 import { upgradedStarterText } from './chunk-IAVT7R6O.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepRuntimeStep, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, recordProofsInContainer, PROOFS_LOG, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, ranRuntimeStep, provisionRuntimes, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, RECORD_PROOFS_ARGV, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-I4V2YBMA.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-KY6H5L5O.js';
-import { waitForAgent, vmExecArgs } from './chunk-NPTEYMBW.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-DKIZDYUX.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, removeKeptContext, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-ZXQEBRCB.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-JDYBPAPP.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-47SFTQA5.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-HA46L5FG.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, provisionWithFreshFallback, hasClaudeCredential, AssetError, obtainImage, taggedLog, planSavedState, clockOf, savedStateBase, savedStatesDir, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, agentUidOf, userIdChangedReason, runBuildSteps, setupInputFor, runtimeStepInput, settleFailedSteps, keepRuntimeStep, keepMissingSetupScripts, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, recordProofsInContainer, PROOFS_LOG, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, ranRuntimeStep, provisionRuntimes, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, discardUnusableState, MANAGED_UNJAILED_REASON, uidFromProbe, saveAndPrune, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, RECORD_PROOFS_ARGV, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, writeRecord, containerJudgeEnvironment, deleteRecord, senderSignalScript, copyJudgeTree } from './chunk-WH3FPBPO.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-OYQVLQP3.js';
+import { waitForAgent, vmExecArgs } from './chunk-5W2YSWIW.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-ROQPDCRU.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, removeKeptContext, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-DCBFUUDL.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-YF7W7B7Y.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-RRXS4CWE.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-P2PNBDUT.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-D3CT6XQ4.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-T664NDNT.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-XDAMLX2L.js';
 import { planArtifactUpload } from './chunk-VEVNGDTP.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-VJQQVTCS.js';
+import { signerFor } from './chunk-5TXQFZHY.js';
 import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-HH3BQG65.js';
 import { scrubText } from './chunk-GH2HEEOH.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
@@ -29,17 +29,84 @@ import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-2EEW6FJN.js';
 import { CheckItemsSchema } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-2CW2QMSG.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, withMiseVariables, fdName, BUILD_HOME, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4N7BQBO4.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-S6UM3N4R.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, BUILD_HOME, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, withMiseVariables, EVAL_INPUT_DIR } from './chunk-YLPJOUVF.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
-import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, lstatSync, realpathSync, fstatSync, readSync } from 'fs';
+import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, createReadStream, lstatSync, realpathSync, writeSync, renameSync, fstatSync, readSync } from 'fs';
 import { join, dirname, delimiter, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
 import { once } from 'events';
 import { createServer } from 'net';
 
 createRequire(import.meta.url);
+var failureText = (status, stderr) => {
+  const line = stderr.trim().split("\n").at(-1) ?? "";
+  return `exit ${status}${line === "" ? "" : `: ${line}`}`;
+};
+async function saveMicroVmState(input) {
+  const id = randomBytes(6).toString("hex");
+  const path = join(input.dir, `${id}.tar`);
+  const partial = `${path}.partial`;
+  const record = {
+    id,
+    kind: "tar",
+    path,
+    savedAt: input.now.toISOString(),
+    bytes: 0,
+    baseKey: input.key.baseKey,
+    key: input.key.key,
+    fileHashes: input.key.fileHashes,
+    ...input.agentUid === void 0 ? {} : { agentUid: input.agentUid },
+    complete: false
+  };
+  const discard = (reason) => {
+    rmSync(partial, { force: true });
+    rmSync(path, { force: true });
+    deleteRecord(input.dir, id);
+    return { ok: false, reason };
+  };
+  try {
+    const stopped = await input.guest.run(["/bin/sh", "-c", guestStopScript()]);
+    if (stopped.status !== 0) return { ok: false, reason: `the guest's processes could not be stopped (${failureText(stopped.status, stopped.stderr)})` };
+    const flushed = await input.guest.run(["sync", "-f", "/build"]);
+    if (flushed.status !== 0) return { ok: false, reason: `the build disk could not be flushed (${failureText(flushed.status, flushed.stderr)})` };
+    mkdirSync(input.dir, { recursive: true, mode: 448 });
+    writeRecord(input.dir, record);
+    const fd = openSync(partial, "w", 384);
+    let stderr = "";
+    let result;
+    try {
+      result = await input.guest.stream(["tar", "--numeric-owner", "-C", "/build", "-cf", "-", "home", "work"], {
+        onStdout: (chunk) => void writeSync(fd, chunk),
+        onStderr: (chunk) => void (stderr = (stderr + chunk.toString()).slice(-400))
+      });
+    } finally {
+      closeSync(fd);
+    }
+    if (result.status !== 0) return discard(`the guest's tar failed (${failureText(result.status, stderr)})`);
+    renameSync(partial, path);
+    const done = { ...record, bytes: statSync(path).size, complete: true };
+    writeRecord(input.dir, done);
+    return { ok: true, record: done };
+  } catch (err) {
+    return discard(`the state could not be saved: ${describeCallFailure(err)}`);
+  }
+}
+async function restoreMicroVmState(input) {
+  const { path } = input.record;
+  if (path === void 0 || !existsSync(path)) return { ok: false, reason: "the saved tar file is gone" };
+  try {
+    let stderr = "";
+    const result = await input.guest.stream(["tar", "-x", "--numeric-owner", "-C", "/build"], {
+      stdin: createReadStream(path),
+      onStderr: (chunk) => void (stderr = (stderr + chunk.toString()).slice(-400))
+    });
+    return result.status === 0 ? { ok: true } : { ok: false, reason: `tar could not unpack the saved state (${failureText(result.status, stderr)})` };
+  } catch (err) {
+    return { ok: false, reason: `the saved state could not be unpacked: ${describeCallFailure(err)}` };
+  }
+}
 async function serveLease(socketPath, channel, makeServer = createServer, listenOn) {
   const server = makeServer((socket) => channel.accept(socket));
   if (listenOn === void 0) {
@@ -237,8 +304,23 @@ function tarOf(dir) {
   if (packed.status !== 0) throw new Error(`tar could not pack ${dir}: ${packed.stderr.toString("utf8").trim()}`);
   return packed.stdout;
 }
+var ROOT_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+function guestPortFor(runtime, state) {
+  return {
+    run: (argv) => asRoot(runtime, state, argv),
+    stream: (argv, io) => runtime.vm.execStream(state.vsockPath, { argv, user: "root", cwd: "/", env: { PATH: ROOT_PATH } }, io)
+  };
+}
+function stepExecFor(input) {
+  return async (argv, workdir, opts) => {
+    const signal = opts?.timeoutMs === void 0 ? void 0 : AbortSignal.timeout(opts.timeoutMs);
+    const ran = await input.vm.exec(input.vsockPath, input.request(argv, workdir, opts?.variables), signal === void 0 ? void 0 : { signal });
+    if (opts?.quiet !== true) appendFileSync(input.logPath, ran.stdout + ran.stderr);
+    return signal?.aborted === true ? { ...ran, timedOut: true } : ran;
+  };
+}
 function asRoot(runtime, state, argv, stdin) {
-  return runtime.vm.exec(state.vsockPath, { argv, user: "root", cwd: "/", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" } }, stdin === void 0 ? void 0 : { stdin });
+  return runtime.vm.exec(state.vsockPath, { argv, user: "root", cwd: "/", env: { PATH: ROOT_PATH } }, stdin === void 0 ? void 0 : { stdin });
 }
 async function writeGuestGhConfig(runtime, state, token) {
   const script = [
@@ -338,6 +420,12 @@ async function keepSockets(runtime, buildId, listeners, leaseServer, line, error
   return stored;
 }
 async function provisionMicroVm(input) {
+  return provisionWithFreshFallback({
+    attempt: (allowRestore) => provisionMicroVmOnce(input, allowRestore),
+    log: (line) => input.log.line(`#${input.item.number} ${line}`)
+  });
+}
+async function provisionMicroVmOnce(input, allowRestore) {
   const { config, runtime, item, itemKey, jobDir, log, tokens } = input;
   const { vm } = runtime;
   const tag = `#${item.number}`;
@@ -398,6 +486,18 @@ async function provisionMicroVm(input) {
   });
   if (!obtained.ok) return obtained.aborted === true ? { ok: false, reason: obtained.reason, aborted: true } : fail(obtained.reason);
   const { report } = obtained.built;
+  const tagged = taggedLog(log, tag);
+  const plan = await planSavedState({
+    config,
+    repositories,
+    base: savedStateBase(report),
+    runtime,
+    tokens,
+    now: clockOf(input.now)(),
+    allowRestore,
+    log: tagged
+  });
+  const savedStatesPath = savedStatesDir(runnerDirPath);
   const madeInBuilder = "rootfs" in obtained.built ? obtained.built.rootfs : void 0;
   const buildId = randomBytes(6).toString("hex");
   const buildDir2 = buildDir(config.configPath, buildId);
@@ -453,6 +553,10 @@ async function provisionMicroVm(input) {
     }
     return aborted ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(why);
   };
+  const giveUpState = async (reason) => {
+    await bail(reason);
+    return discardUnusableState({ record: plan.restore.record, reason, dir: savedStatesPath, removeVolume: async () => void 0, onError: (line) => log.error(`${tag} ${line}`) });
+  };
   if (input.aborted()) return bail("", true);
   let imageConfig;
   if (madeInBuilder !== void 0) {
@@ -595,8 +699,7 @@ async function provisionMicroVm(input) {
   environment.credentials = tokens.used();
   const uidOf = async (user) => {
     const probe = await asRoot(runtime, state, ["id", "-u", user]);
-    const uid = Number(probe.stdout);
-    return probe.status === 0 && Number.isInteger(uid) ? uid : null;
+    return uidFromProbe(probe);
   };
   let agentUser;
   try {
@@ -612,6 +715,14 @@ async function provisionMicroVm(input) {
   } catch (err) {
     return bail(describeCallFailure(err));
   }
+  const agentUid = agentUidOf(await asRoot(runtime, state, ["id", "-u", agentUser]));
+  const guest = guestPortFor(runtime, state);
+  if (plan.restore !== void 0) {
+    const changed = userIdChangedReason(plan.restore.record.agentUid, agentUid);
+    if (changed !== void 0) return giveUpState(changed);
+    const restored = await restoreMicroVmState({ guest, record: plan.restore.record });
+    if (!restored.ok) return giveUpState(restored.reason);
+  }
   const tools = await asRoot(runtime, state, ["cat", "/opt/outerlayer/tools.json"]);
   const agentVersion = agentVersionOf(tools.status === 0 ? tools.stdout : "");
   environment.agentVersion = agentVersion;
@@ -623,6 +734,12 @@ async function provisionMicroVm(input) {
     const failure = await waitForDocker(runtime, state, agentUser, input.now ?? (() => /* @__PURE__ */ new Date()));
     if (failure !== void 0) return bail(failure);
   }
+  const saveState = () => saveAndPrune({
+    save: () => saveMicroVmState({ guest, dir: savedStatesPath, key: plan.key, agentUid, now: clockOf(input.now)(), log: tagged }),
+    dir: savedStatesPath,
+    removeVolume: async () => void 0,
+    log: tagged
+  });
   const request = (argv, workdir, variables) => ({
     argv,
     user: agentUser,
@@ -636,11 +753,7 @@ async function provisionMicroVm(input) {
     ...governingSource.kind === "governed" ? { governing: { repository: governingSource.repository } } : {},
     agentVersion,
     lifecycle: report.apply.lifecycle,
-    exec: async (argv, workdir, opts) => {
-      const ran = await vm.exec(state.vsockPath, request(argv, workdir, opts?.variables));
-      if (opts?.quiet !== true) appendFileSync(logPath, ran.stdout + ran.stderr);
-      return ran;
-    },
+    exec: stepExecFor({ vm, vsockPath: state.vsockPath, request, logPath }),
     log,
     tag,
     aborted: input.aborted,
@@ -669,17 +782,19 @@ async function provisionMicroVm(input) {
     keepIn: jobDir,
     ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
     // A build on the universal image, or on an image built from it, chooses and installs its runtimes.
-    ...runtimeStepInput(report, services)
+    ...runtimeStepInput(report, services),
+    setup: setupInputFor({ setupMinutes: config.build?.setupMinutes, plan, saveState })
   });
-  if (!steps.ok) return bail(steps.reason, steps.aborted === true);
+  if (!steps.ok) return settleFailedSteps(steps, { giveUp: giveUpState, bail });
   state.startCommit = steps.startCommit;
   keepRuntimeStep(state, steps);
+  keepMissingSetupScripts(state, steps);
   if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
 async function waitForDocker(runtime, state, agentUser, now) {
   const grant = `[ -S ${DOCKER_SOCKET} ] && chgrp "$(id -g ${shellQuote(agentUser)})" ${DOCKER_SOCKET} && chmod 660 ${DOCKER_SOCKET}`;
-  const request = { argv: ["timeout", "5", "docker", "info"], user: agentUser, cwd: "/", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" } };
+  const request = { argv: ["timeout", "5", "docker", "info"], user: agentUser, cwd: "/", env: { PATH: ROOT_PATH } };
   const deadline = now().getTime() + DOCKER_WAIT_SECONDS * 1e3;
   let lastError = "";
   for (; ; ) {
@@ -719,6 +834,7 @@ function vmExecFor(input, argv) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     unpinnedRuntimes: state.unpinnedRuntimes,
+    missingSetupScripts: state.missingSetupScripts,
     miseVariables: state.miseVariables,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
@@ -750,6 +866,7 @@ async function startMicroVmCommand(input) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     unpinnedRuntimes: state.unpinnedRuntimes,
+    missingSetupScripts: state.missingSetupScripts,
     miseVariables: state.miseVariables,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
@@ -800,6 +917,7 @@ async function runCliInMicroVm(input, argv, logName, goneReason) {
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
       unpinnedRuntimes: state.unpinnedRuntimes,
+      missingSetupScripts: state.missingSetupScripts,
       miseVariables: state.miseVariables,
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,

package/dist/{chunk-E3GX4WVJ.js → chunk-KH4774QT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-2CW2QMSG.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-S6UM3N4R.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-UAINHP2C.js → chunk-KPEMNHVF.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-NYMDS542.js';
-import { RUNNER_FILE_MODE } from './chunk-2CW2QMSG.js';
-import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-4N7BQBO4.js';
+import { DEFAULT_UNIT_NAME } from './chunk-4YD7N6V3.js';
+import { RUNNER_FILE_MODE } from './chunk-S6UM3N4R.js';
+import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-YLPJOUVF.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-SH5JFBPO.js → chunk-KQDK4Q6A.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-54LIUIZL.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-ARL6X6Y4.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-X2ZJL7GA.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-UZEIBWTP.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-HH3BQG65.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-RQ3GCCHH.js';

package/dist/{chunk-7XDF7PNF.js → chunk-MCPCOKHN.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-BRBZKIZG.js';
+import { autoConnect } from './chunk-MRLJK4GZ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { acquireSpoolLockAt } from './chunk-VEVNGDTP.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-3KGXXTMN.js';
 import { resolveRepoIdentity } from './chunk-GH2HEEOH.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-JDQBJUXQ.js → chunk-MEIDQLXQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-2CW2QMSG.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-S6UM3N4R.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-BRBZKIZG.js → chunk-MRLJK4GZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-26WUFKYZ.js';
-import { resolveGatewayCredentials } from './chunk-IZKUPAXF.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-HFOZTCTN.js';
+import { resolveGatewayCredentials } from './chunk-3KGXXTMN.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-GH2HEEOH.js';

package/dist/{chunk-QGTJ5IJN.js → chunk-NCOL5RYI.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-E3GX4WVJ.js';
+import { currentLink } from './chunk-KH4774QT.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-KY6H5L5O.js → chunk-OYQVLQP3.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { toolsDockerfile } from './chunk-V64BEF6E.js';
-import { runnerLabelValue } from './chunk-HA46L5FG.js';
+import { toolsDockerfile } from './chunk-T3XPLCJG.js';
+import { runnerLabelValue } from './chunk-P2PNBDUT.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-CM4J53WZ.js';
 import { UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION } from './chunk-D3CT6XQ4.js';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-64LLUVJR.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-SAAVZ2BX.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-2CW2QMSG.js';
-import { withGitConfig, tokenHeader } from './chunk-4N7BQBO4.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-S6UM3N4R.js';
+import { withGitConfig, tokenHeader } from './chunk-YLPJOUVF.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';
@@ -24,7 +24,7 @@ function gitEnvironment(base) {
 function tokenSettings(remote, token) {
   return (env) => withGitConfig(env, `http.${remote}.extraHeader`, tokenHeader(token));
 }
-function git(cwd, args, timeoutMs, extend = (env) => env) {
+function git(cwd, args, timeoutMs, extend = (env) => env, raw = false) {
   const env = extend(gitEnvironment(process.env));
   return new Promise((resolve, reject) => {
     execFile(
@@ -34,7 +34,7 @@ function git(cwd, args, timeoutMs, extend = (env) => env) {
       (error, stdout, stderr) => {
         if (error && error.killed && timeoutMs !== void 0) reject(new Error(`git ${args[0]} failed: no answer within ${timeoutMs / 1e3}s`));
         else if (error) reject(new Error(`git ${args[0]} failed: ${stderr.trim() || error.message}`));
-        else resolve(stdout.trim());
+        else resolve(raw ? stdout : stdout.trim());
       }
     );
   });
@@ -146,6 +146,35 @@ async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
     return { ok: false, reason: `the clone of ${remote} failed: ${detail}` };
   }
 }
+async function readDefaultBranchFiles(input) {
+  const credential = input.token === void 0 ? void 0 : tokenSettings(input.remote, input.token);
+  const over = (args, timeoutMs = CLONE_TIMEOUT_MS, raw = false) => git(input.dir, args, timeoutMs, credential, raw);
+  try {
+    mkdirSync(input.dir, { recursive: true, mode: RUNNER_DIR_MODE });
+    const defaultBranch = defaultBranchOf(await over(["ls-remote", "--symref", input.remote, "HEAD"], HEAD_TIMEOUT_MS));
+    if (defaultBranch === null) return { ok: false, reason: `${input.remote} does not say which branch is its default; the runner will not guess one` };
+    await git(input.dir, ["init", "--quiet"]);
+    await git(input.dir, ["config", "remote.origin.url", input.remote]);
+    await git(input.dir, ["config", "remote.origin.promisor", "true"]);
+    await git(input.dir, ["config", "remote.origin.partialclonefilter", "blob:none"]);
+    await over(["fetch", "--quiet", "--depth", "1", "--no-tags", "--filter=blob:none", "--force", "origin", `refs/heads/${defaultBranch}`]);
+    const commit = await git(input.dir, ["rev-parse", "FETCH_HEAD"]);
+    const listed = input.paths.length === 0 ? "" : await git(input.dir, ["ls-tree", "-z", commit, "--", ...input.paths], void 0, void 0, true);
+    const blobs = /* @__PURE__ */ new Map();
+    for (const entry of listed.split("\0")) {
+      const match = /^\d+ blob ([0-9a-f]+)\t(.+)$/s.exec(entry);
+      if (match !== null) blobs.set(match[2], match[1]);
+    }
+    const files = {};
+    for (const path of input.paths) {
+      const blob = blobs.get(path);
+      files[path] = blob === void 0 ? null : await over(["cat-file", "blob", blob], CLONE_TIMEOUT_MS, true);
+    }
+    return { ok: true, defaultBranch, commit, files };
+  } catch (err) {
+    return { ok: false, reason: `the default branch of ${input.remote} could not be read: ${gitFailureLine(err)}` };
+  }
+}
 function sha256(...chunks) {
   const hash = createHash("sha256");
   for (const chunk of chunks) hash.update(chunk);
@@ -503,4 +532,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath, runnerL
   return removed;
 }
 
-export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, UNIVERSAL_SOURCE_LABEL, baseLines, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, universalBase, writeRecord };
+export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, UNIVERSAL_SOURCE_LABEL, baseLines, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchFiles, readDefaultBranchHead, universalBase, writeRecord };

package/dist/{chunk-HA46L5FG.js → chunk-P2PNBDUT.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { resolveDevcontainerCli, devcontainerBuildInvocation, universalImagePending, RecipeError } from './chunk-CM4J53WZ.js';
 import { universalImagePinned, UNIVERSAL_IMAGE, BUILDKIT_IMAGE } from './chunk-D3CT6XQ4.js';
-import { ensureHostKey } from './chunk-VJQQVTCS.js';
+import { ensureHostKey } from './chunk-5TXQFZHY.js';
 import { compareVersions } from './chunk-GH2HEEOH.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-2CW2QMSG.js';
-import { CLAUDE_PORT, BUILD_HOME, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4N7BQBO4.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-S6UM3N4R.js';
+import { CLAUDE_PORT, BUILD_HOME, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-YLPJOUVF.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { mkdirSync, createWriteStream, rmSync, existsSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';
@@ -517,6 +517,7 @@ function homeCopyArgs(home) {
 // src/runner/container/run-args.ts
 var COMMAND_DIR = "/build/.command";
 var BUILD_LABEL = "ai.outerlayer.build";
+var SAVED_STATE_LABEL = "ai.outerlayer.saved-state";
 function runnerLabelValue(configPath) {
   return readRunnerIdentity(configPath)?.label ?? pathLabelValue(configPath);
 }
@@ -862,4 +863,4 @@ function ensureBuilder(rawRun, spec, options = {}) {
   );
 }
 
-export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, NETWORK_HELPER_MEMORY, NETWORK_READY_FILE, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, homeCopyArgs, homeCopyRunArgs, homeCopyScript, identityArgs, identityDockerFor, identityRunArgs, identityScript, isOutOfMemory, judgeCommand, mountableHome, networkHelperName, networkHelperRunArgs, parseIdentity, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRunnerIdentity, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };
+export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, NETWORK_HELPER_MEMORY, NETWORK_READY_FILE, RUNNER_LABEL, SAVED_STATE_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, homeCopyArgs, homeCopyRunArgs, homeCopyScript, identityArgs, identityDockerFor, identityRunArgs, identityScript, isOutOfMemory, judgeCommand, mountableHome, networkHelperName, networkHelperRunArgs, parseIdentity, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRunnerIdentity, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };

package/dist/{chunk-XDCD4GD5.js → chunk-POND2SMT.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-BUVDDPOM.js';
-import { EXEC_PORT } from './chunk-DKIZDYUX.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-BBJ6BM5U.js';
+import { EXEC_PORT } from './chunk-ROQPDCRU.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-4N7BQBO4.js';
+import { RELAY_PORT } from './chunk-YLPJOUVF.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-265SXBQ5.js → chunk-QGDGGLSD.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-QGTJ5IJN.js';
-import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-E3GX4WVJ.js';
+import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-NCOL5RYI.js';
+import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-KH4774QT.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { runnerDir, RUNNER_DIR_MODE } from './chunk-2CW2QMSG.js';
+import { runnerDir, RUNNER_DIR_MODE } from './chunk-S6UM3N4R.js';
 import { lchownSync, lstatSync, realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync, readdirSync } from 'fs';
 import { dirname, sep, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-RIKXE3T5.js → chunk-QGEGLZSY.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-I4V2YBMA.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-NYMDS542.js';
-import { builtinKind, EGRESS_SWITCHABLE_KEYS, imageBuildOf, keepsHostBuilder } from './chunk-JDYBPAPP.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK, volumeBytes } from './chunk-47SFTQA5.js';
-import { spawnRun, RUNNER_LABEL, BUILD_LABEL } from './chunk-HA46L5FG.js';
+import { placeholderQueues, placeholderProblem } from './chunk-WH3FPBPO.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-4YD7N6V3.js';
+import { builtinKind, EGRESS_SWITCHABLE_KEYS, imageBuildOf, keepsHostBuilder } from './chunk-YF7W7B7Y.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK, volumeBytes } from './chunk-RRXS4CWE.js';
+import { spawnRun, RUNNER_LABEL, BUILD_LABEL } from './chunk-P2PNBDUT.js';
 import { builderDiskPinned } from './chunk-D3CT6XQ4.js';
-import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-4N7BQBO4.js';
+import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-YLPJOUVF.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem } from 'os';