@outerlayer/cli 0.5.0 → 0.5.1

package/dist/{chunk-ZLB7GCTY.js → chunk-H4CK2YK4.js}

@@ -1004,7 +1004,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-XVJYZ4IQ.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-HL2AIR3K.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-J3GIMR7K.js');
+    const { runnerHostChecks } = await import('./doctor-MOA3RIEP.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1041,8 +1041,8 @@ async function gatherDoctorChecks() {
     })();
     const runner = (() => {
       try {
-        const { concurrency, build } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g" };
+        const { concurrency, build, housekeeping } = loadRunnerConfig(configPath);
+        return { concurrency, buildMemory: build?.memory ?? "8g", minFreeDisk: housekeeping?.minFreeDisk };
       } catch {
         return void 0;
       }

package/dist/{chunk-RJ467PDQ.js → chunk-RTXKYLCA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-4NMBDRBS.js';
+import { MIN_ENGINE_MAJOR } from './chunk-T52PKE2Y.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-Z62HNKEJ.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-4NMBDRBS.js → chunk-T52PKE2Y.js}

@@ -14,11 +14,11 @@ import { defaultGitRunner, materializeContext } from './chunk-XDDW4FRS.js';
 import { readContextManifest, readSourceCache } from './chunk-WIOZAJ2W.js';
 import { signingFetchFor } from './chunk-BCLJSQCV.js';
 import { signerFor } from './chunk-M5POMKKW.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
-import { relative, join, dirname, basename } from 'path';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, runnerDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
+import { relative, join, dirname, resolve, basename } from 'path';
 import { spawnSync, spawn } from 'child_process';
-import { randomBytes, createHash } from 'crypto';
-import { existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, renameSync, lstatSync, readFileSync, unlinkSync, readdirSync, openSync, closeSync, mkdtempSync, createWriteStream, statSync, createReadStream } from 'fs';
+import { createHash, randomBytes } from 'crypto';
+import { existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, realpathSync, renameSync, lstatSync, readFileSync, unlinkSync, readdirSync, openSync, closeSync, mkdtempSync, createWriteStream, statSync, createReadStream } from 'fs';
 import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
 import { Transform } from 'stream';
@@ -86,7 +86,7 @@ function isRetryable(err) {
 }
 async function retrySend(send, deps = {}) {
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const windowMs = deps.windowMs ?? RETRY_WINDOW_MS;
   const startedMs = now().getTime();
   let attempts = 0;
@@ -356,6 +356,119 @@ function lifecycleSteps(lifecycle) {
 function lifecycleFailureReason(step, exitCode) {
   return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
 }
+var BUILD_LABEL = "ai.outerlayer.build";
+var RUNNER_LABEL = "ai.outerlayer.runner";
+function resolvedRunnerDir(configPath) {
+  try {
+    return realpathSync(runnerDir(configPath));
+  } catch {
+    try {
+      return join(realpathSync(dirname(resolve(configPath))), "runner");
+    } catch {
+      return resolve(runnerDir(configPath));
+    }
+  }
+}
+function runnerLabelValue(configPath) {
+  return createHash("sha256").update(resolvedRunnerDir(configPath)).digest("hex").slice(0, 12);
+}
+function hardened(input) {
+  const { memory, cpus, pids } = input.limits;
+  return [
+    "--label",
+    `${BUILD_LABEL}=${input.buildId}`,
+    "--label",
+    `${RUNNER_LABEL}=${input.runnerId}`,
+    "--network",
+    "none",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--read-only",
+    "--user",
+    input.user,
+    // The same figure for swap as for memory leaves the container none.
+    "--memory",
+    memory,
+    "--memory-swap",
+    memory,
+    "--cpus",
+    String(cpus),
+    "--pids-limit",
+    String(pids)
+  ];
+}
+function mountPath(path) {
+  if (/[",]/.test(path)) throw new Error(`${path} holds a comma or a quote, which a Docker mount cannot carry; move the runner's config file`);
+  return path;
+}
+function containerRunArgs(input) {
+  return [
+    "--detach",
+    "--name",
+    input.container,
+    ...hardened(input),
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
+    "--mount",
+    `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
+    "--mount",
+    `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
+    "--entrypoint",
+    "/opt/outerlayer/bin/tini",
+    input.image,
+    "--",
+    "/opt/outerlayer/bin/node",
+    "/opt/outerlayer/cli/dist/index.js",
+    "broker-relay",
+    "--port",
+    String(RELAY_PORT),
+    "--socket",
+    `${JOB_MOUNT}/tunnel.sock`,
+    ...Array.from({ length: input.destinations ?? 0 }, (_unused, index) => [
+      "--forward",
+      `${DESTINATION_BASE_PORT + index}=${JOB_MOUNT}/dest-${index}.sock`
+    ]).flat(),
+    ...[
+      "--forward",
+      `${GATEWAY_PORT}=${JOB_MOUNT}/${GATEWAY_SOCKET}`,
+      "--forward",
+      `${CLAUDE_PORT}=${JOB_MOUNT}/${CLAUDE_SOCKET}`
+    ] 
+  ];
+}
+function prepareRunArgs(input) {
+  return [
+    "--rm",
+    ...hardened(input),
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    "--entrypoint",
+    "mkdir",
+    input.image,
+    "-p",
+    "-m",
+    "1777",
+    "/build/tmp",
+    "/build/home",
+    "/build/work"
+  ];
+}
+function containerExecArgs(input) {
+  const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
+  const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
+  return [
+    "-u",
+    input.user,
+    ...input.workdir === void 0 ? [] : ["-w", input.workdir],
+    ...literals,
+    ...passed,
+    input.container,
+    ...input.argv
+  ];
+}
 var AssetError = class extends Error {
   constructor(file, message) {
     super(message);
@@ -496,7 +609,7 @@ function converterArgs(dest, extra, script) {
 }
 var firstLine2 = (text) => text.trim().split("\n")[0] ?? "";
 function exportInto(container, converter) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const exporter = spawn("docker", ["export", container], { stdio: ["ignore", "pipe", "pipe"], env: childEnvironment(process.env) });
     const writer = spawn("docker", converter, { stdio: ["pipe", "ignore", "pipe"], env: childEnvironment(process.env) });
     const errors = [];
@@ -513,7 +626,7 @@ function exportInto(container, converter) {
       if (code !== 0 && failure === void 0) failure = `${name} exited ${code}`;
       exits += 1;
       if (exits < 2) return;
-      if (failure === void 0) resolve();
+      if (failure === void 0) resolve2();
       else reject(new Error(`${failure}: ${firstLine2(errors.join("\n"))}`));
     };
     exporter.once("exit", (code) => done("docker export", code));
@@ -660,7 +773,7 @@ function createFirecrackerHost(options = {}) {
         const failed = new Promise((_resolve, reject) => child.once("error", reject));
         const pid = child.pid;
         if (pid === void 0) return await failed;
-        exits.set(pid, new Promise((resolve) => child.once("exit", () => resolve())));
+        exits.set(pid, new Promise((resolve2) => child.once("exit", () => resolve2())));
         child.unref();
         const start = startTimeOf(pid);
         if (start === null) throw new Error(`${command} exited as soon as it started; its console is at ${input.consolePath}`);
@@ -677,8 +790,8 @@ function createFirecrackerHost(options = {}) {
       }
       const exited = exits.get(vm.pid);
       const deadline = Date.now() + STOP_WAIT_MS;
-      if (exited !== void 0) await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, STOP_WAIT_MS))]);
-      while (alive(vm) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+      if (exited !== void 0) await Promise.race([exited, new Promise((resolve2) => setTimeout(resolve2, STOP_WAIT_MS))]);
+      while (alive(vm) && Date.now() < deadline) await new Promise((resolve2) => setTimeout(resolve2, POLL_MS));
       exits.delete(vm.pid);
     },
     alive
@@ -688,7 +801,7 @@ function createFirecrackerHost(options = {}) {
 // src/runner/microvm/host.ts
 function createMicroVmPorts(over = {}) {
   return {
-    assets: over.assets ?? ((runnerDir) => ensureAssets({ runnerDir })),
+    assets: over.assets ?? ((runnerDir2) => ensureAssets({ runnerDir: runnerDir2 })),
     rootfs: over.rootfs ?? createRootfsHost(),
     firecracker: over.firecracker ?? createFirecrackerHost(),
     exec: over.exec ?? execCapture
@@ -845,104 +958,6 @@ function removeStagedContext(buildDir2) {
   rmSync(stagedContextDir(buildDir2), { recursive: true, force: true });
 }
 
-// src/runner/container/run-args.ts
-var BUILD_LABEL = "ai.outerlayer.build";
-function hardened(input) {
-  const { memory, cpus, pids } = input.limits;
-  return [
-    "--label",
-    `${BUILD_LABEL}=${input.buildId}`,
-    "--network",
-    "none",
-    "--cap-drop",
-    "ALL",
-    "--security-opt",
-    "no-new-privileges",
-    "--read-only",
-    "--user",
-    input.user,
-    // The same figure for swap as for memory leaves the container none.
-    "--memory",
-    memory,
-    "--memory-swap",
-    memory,
-    "--cpus",
-    String(cpus),
-    "--pids-limit",
-    String(pids)
-  ];
-}
-function mountPath(path) {
-  if (/[",]/.test(path)) throw new Error(`${path} holds a comma or a quote, which a Docker mount cannot carry; move the runner's config file`);
-  return path;
-}
-function containerRunArgs(input) {
-  return [
-    "--detach",
-    "--name",
-    input.container,
-    ...hardened(input),
-    "--mount",
-    `type=volume,src=${input.volume},dst=/build`,
-    // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
-    "--mount",
-    `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
-    "--mount",
-    `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
-    "--entrypoint",
-    "/opt/outerlayer/bin/tini",
-    input.image,
-    "--",
-    "/opt/outerlayer/bin/node",
-    "/opt/outerlayer/cli/dist/index.js",
-    "broker-relay",
-    "--port",
-    String(RELAY_PORT),
-    "--socket",
-    `${JOB_MOUNT}/tunnel.sock`,
-    ...Array.from({ length: input.destinations ?? 0 }, (_unused, index) => [
-      "--forward",
-      `${DESTINATION_BASE_PORT + index}=${JOB_MOUNT}/dest-${index}.sock`
-    ]).flat(),
-    ...[
-      "--forward",
-      `${GATEWAY_PORT}=${JOB_MOUNT}/${GATEWAY_SOCKET}`,
-      "--forward",
-      `${CLAUDE_PORT}=${JOB_MOUNT}/${CLAUDE_SOCKET}`
-    ] 
-  ];
-}
-function prepareRunArgs(input) {
-  return [
-    "--rm",
-    ...hardened(input),
-    "--mount",
-    `type=volume,src=${input.volume},dst=/build`,
-    "--entrypoint",
-    "mkdir",
-    input.image,
-    "-p",
-    "-m",
-    "1777",
-    "/build/tmp",
-    "/build/home",
-    "/build/work"
-  ];
-}
-function containerExecArgs(input) {
-  const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
-  const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
-  return [
-    "-u",
-    input.user,
-    ...input.workdir === void 0 ? [] : ["-w", input.workdir],
-    ...literals,
-    ...passed,
-    input.container,
-    ...input.argv
-  ];
-}
-
 // src/runner/container/docker.ts
 function createContainerHost(deps = {}) {
   const run = deps.run ?? spawnRun;
@@ -1027,9 +1042,9 @@ async function git(args, cwd, env, input) {
     if (size < maxOutputBytes) out.push(chunk);
     size += chunk.length;
   });
-  const closed = new Promise((resolve, reject) => {
+  const closed = new Promise((resolve2, reject) => {
     child.once("error", reject);
-    child.once("close", (status) => resolve(status));
+    child.once("close", (status) => resolve2(status));
   });
   if (input !== void 0) {
     await pipeline(input, child.stdin).catch(() => void 0);
@@ -1226,14 +1241,14 @@ async function drain(req) {
   }
 }
 function readPrefix(req, gzip) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const held = [];
     const finish = (section) => {
       req.off("data", onData);
       req.off("end", onEnd);
       req.off("error", reject);
       req.pause();
-      resolve({ held, section });
+      resolve2({ held, section });
     };
     const onData = (chunk) => {
       held.push(chunk);
@@ -1247,19 +1262,19 @@ function readPrefix(req, gzip) {
   });
 }
 function readBody(req, limit) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     let size = 0;
     req.on("data", (chunk) => {
       size += chunk.length;
       if (size > limit) {
         req.pause();
-        resolve(void 0);
+        resolve2(void 0);
         return;
       }
       chunks.push(chunk);
     });
-    req.once("end", () => resolve(Buffer.concat(chunks)));
+    req.once("end", () => resolve2(Buffer.concat(chunks)));
     req.once("error", reject);
   });
 }
@@ -1272,7 +1287,7 @@ function createGitRemote(options) {
     const { route, res } = input;
     const url = new URL(`${gitUrl}/${route.owner}/${route.name}.git/${route.kind === "info-refs" ? "info/refs" : route.kind === "lfs-batch" ? "info/lfs/objects/batch" : `git-${route.kind}`}${route.search === "" ? "" : `?${route.search}`}`);
     const send = url.protocol === "https:" ? request$1 : request;
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const upstream = send(url, { method: input.method, headers: { ...input.headers, connection: "close" } }, (answer) => {
         const headers = {};
         for (const [name, value] of Object.entries(answer.headers)) {
@@ -1294,18 +1309,18 @@ function createGitRemote(options) {
         });
         answer.once("end", () => {
           res.end();
-          resolve();
+          resolve2();
         });
         answer.once("error", () => {
           res.destroy();
-          resolve();
+          resolve2();
         });
       });
       upstream.on("error", (err) => {
         log(`could not reach GitHub for ${route.kind}: ${err.message}`);
         if (res.headersSent) res.destroy();
         else plain(res, 502, "the runner could not reach GitHub\n");
-        resolve();
+        resolve2();
       });
       res.once("close", () => upstream.destroy());
       input.feed(upstream);
@@ -1594,7 +1609,7 @@ async function startTunnel(socketPath, opts = {}) {
   if (Buffer.byteLength(socketPath) > MAX_SOCKET_PATH_BYTES) {
     throw new Error(`${socketPath} is too long for a Unix socket; keep the runner's config file nearer the root of the filesystem`);
   }
-  const resolve = opts.resolve ?? systemResolve;
+  const resolve2 = opts.resolve ?? systemResolve;
   const openConnection = opts.connect ?? ((t) => connect({ host: t.address, port: t.port }));
   const ownAddresses = opts.hostAddresses ?? systemHostAddresses;
   const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
@@ -1678,7 +1693,7 @@ async function startTunnel(socketPath, opts = {}) {
     }
     let addresses;
     try {
-      addresses = await resolve(host);
+      addresses = await resolve2(host);
     } catch {
       return { ok: false, status: 502, body: `could not resolve ${host}
 ` };
@@ -1863,7 +1878,7 @@ function createContainerRuntime(opts = {}) {
     )),
     startTunnel: opts.startTunnel ?? startTunnel,
     tunnelOptions: opts.tunnelOptions,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms))),
     hostEnv: opts.hostEnv ?? process.env,
     credentials: opts.credentials ?? /* @__PURE__ */ new Map(),
     github: { gitUrl: opts.github?.gitUrl ?? "https://github.com", apiUrl: opts.github?.apiUrl ?? "https://api.github.com" },
@@ -2035,11 +2050,13 @@ async function provisionContainer(input) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
   const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
-  const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId });
+  const runnerId = runnerLabelValue(config.configPath);
+  const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
   if (input.aborted()) return bail("", true);
   const runInput = {
     buildId,
+    runnerId,
     container: name,
     volume: name,
     buildDir: buildDir2,
@@ -2230,4 +2247,4 @@ async function cleanupContainer(runtime, state, jobDir) {
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, shellQuote, shortClaim, stageGovernedContext, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BUILD_LABEL, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, RUNNER_LABEL, classifyRefusal, cleanupContainer, containerCommandLine, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, runnerLabelValue, shellQuote, shortClaim, stageGovernedContext, startServicesFor, stopContainer, syncInContainer };

package/dist/chunk-UGP76IZ5.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var FILE = "housekeeping.json";
+function readHousekeepingRecord(runnerDirPath) {
+  const path = join(runnerDirPath, FILE);
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    const record = {};
+    if (typeof raw.lastRunAt === "string") record.lastRunAt = raw.lastRunAt;
+    if (typeof raw.freedBytes === "number") record.freedBytes = raw.freedBytes;
+    const holding = raw.holding;
+    if (typeof holding?.free === "number" && typeof holding.needed === "number" && typeof holding.since === "string") {
+      record.holding = { free: holding.free, needed: holding.needed, since: holding.since };
+    }
+    return record;
+  } catch {
+    return {};
+  }
+}
+function writeHousekeepingRecord(runnerDirPath, patch) {
+  const merged = { ...readHousekeepingRecord(runnerDirPath), ...patch };
+  mkdirSync(runnerDirPath, { recursive: true, mode: RUNNER_DIR_MODE });
+  const path = join(runnerDirPath, FILE);
+  const temp = `${path}.partial-${process.pid}`;
+  writeFileSync(temp, JSON.stringify(merged, null, 2), { mode: RUNNER_FILE_MODE });
+  renameSync(temp, path);
+}
+
+export { readHousekeepingRecord, writeHousekeepingRecord };

package/dist/{chunk-RWOTHXYE.js → chunk-UWH5DSUP.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { DOCKERD_LOG } from './chunk-CBPPJSAR.js';
 import { installScrubContext } from './chunk-ZOC7JSYC.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, ADDED_USER, createRunnerLog, createContainerRuntime, stopContainer, syncInContainer, formatDuration, cleanupContainer, retrySend, formatClock, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk } from './chunk-4NMBDRBS.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, ADDED_USER, createRunnerLog, createContainerRuntime, stopContainer, syncInContainer, formatDuration, cleanupContainer, retrySend, formatClock, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk } from './chunk-T52PKE2Y.js';
 import { CLAUDE_CODE_VERSION } from './chunk-Z62HNKEJ.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
 import { childEnvironment } from './chunk-774HEQL6.js';
@@ -11,7 +11,7 @@ import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-B2G7JHH
 import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-RMAZ2NWA.js';
 import { planArtifactUpload } from './chunk-WOBNRVQT.js';
 import { scrubText } from './chunk-EX6M5JPR.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm } from './chunk-5Y3QQRUH.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm } from './chunk-3DD6AOWC.js';
 import { parseSize } from './chunk-F6GFZXZ3.js';
 import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT } from './chunk-AUFG23AA.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
@@ -410,6 +410,8 @@ async function stopOrphanedMicroVms(input) {
         process.kill(-job.pid, "SIGKILL");
       } catch {
       }
+      const deadline = Date.now() + 2e3;
+      while (isSameProcess(job.pid, job.start) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 10));
     }
     if (state.firecracker !== void 0 && input.runtime.vm.firecracker.alive(state.firecracker)) {
       await input.runtime.vm.firecracker.stop(state.firecracker);
@@ -581,18 +583,6 @@ async function closeHostBuild(runtime, build) {
   rmSync(build.buildDir, { recursive: true, force: true });
   if (build.workDir !== void 0) rmSync(build.workDir, { recursive: true, force: true });
 }
-function readJobFile(path) {
-  if (!existsSync(path)) return null;
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeJobFile(path, job) {
-  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
-  writeFileSync(path, JSON.stringify(job, null, 2), { mode: RUNNER_FILE_MODE });
-}
 var ENDED = "ended before provision finished";
 async function provisionProcess(input) {
   const { config, runtime, item, jobDir } = input;
@@ -635,6 +625,28 @@ async function provisionProcess(input) {
 function cleanupProcess(runtime, state) {
   return closeHostBuild(runtime, state);
 }
+function readJobFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function readJobFileChecked(path) {
+  if (!existsSync(path)) return { kind: "missing" };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { kind: "unreadable" };
+    return { kind: "ok", job: parsed };
+  } catch {
+    return { kind: "unreadable" };
+  }
+}
+function writeJobFile(path, job) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  writeFileSync(path, JSON.stringify(job, null, 2), { mode: RUNNER_FILE_MODE });
+}
 
 // src/runner/verdict.ts
 var VERDICT_SETTLE_MS = 5 * 6e4;
@@ -1458,4 +1470,4 @@ async function recoverLostJobs(jobsDirPath, config, deps) {
   return recovered;
 }
 
-export { LEASE_SECONDS, RENEW_INTERVAL_SECONDS, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, isGroupAlive, isIdle, isTimedOut, isUnfinished, jobEnv, listAdoptableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readJobFile, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, retryFailedReleases, runCommand, runHook, setStage, startHostServices, stopOrphanedMicroVms, unfinishedJobs, workdirProblem, writeJobFile };
+export { ALREADY_RELEASED, LEASE_SECONDS, RENEW_INTERVAL_SECONDS, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, isGroupAlive, isIdle, isTimedOut, isUnfinished, jobEnv, listAdoptableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readJobFile, readJobFileChecked, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, retryFailedReleases, runCommand, runHook, setStage, startHostServices, stopOrphanedMicroVms, unfinishedJobs, workdirProblem, writeJobFile };

package/dist/{chunk-FC7TMRNA.js → chunk-W7UTFZDH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RJ467PDQ.js';
-import { MIN_ENGINE_MAJOR } from './chunk-4NMBDRBS.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RTXKYLCA.js';
+import { MIN_ENGINE_MAJOR } from './chunk-T52PKE2Y.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/chunk-YYYRBYWG.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { statfsSync } from 'fs';
+import { dirname } from 'path';
+
+createRequire(import.meta.url);
+function freeBytes(path, statfs = statfsSync) {
+  let at = path;
+  for (; ; ) {
+    try {
+      const stats = statfs(at);
+      return Number(stats.bavail) * Number(stats.bsize);
+    } catch (err) {
+      if (err.code !== "ENOENT") return void 0;
+      const parent = dirname(at);
+      if (parent === at) return void 0;
+      at = parent;
+    }
+  }
+}
+var UNITS = ["B", "KB", "MB", "GB", "TB"];
+function formatBytes(bytes) {
+  let value = Math.max(0, bytes);
+  let unit = 0;
+  while (value >= 1024 && unit < UNITS.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return unit === 0 ? `${Math.round(value)} B` : `${value.toFixed(1)} ${UNITS[unit]}`;
+}
+
+export { formatBytes, freeBytes };

package/dist/{chunk-QDQEUVUF.js → chunk-ZXBITXTS.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 12;
+var RUNNER_PROTOCOL = 13;
 
 export { RUNNER_PROTOCOL };