@outerlayer/cli 0.6.0 → 0.7.0

package/dist/{chunk-43J3M6KB.js → chunk-AII7CKTH.js}

@@ -1,22 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
-import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-YYYXRJUW.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, ALREADY_RELEASED } from './chunk-VMJ3MMBX.js';
+import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-TI7B7UEO.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-AJKEHABI.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
 import { RUNNER_PROTOCOL } from './chunk-AIW6GLET.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-MXB5VB4Y.js';
+import { placeholderQueues, placeholderProblem } from './chunk-6IYLDODX.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { checkFit } from './chunk-OUUINEYB.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, formatClock, measureDisk, createRunnerLog, setUpRunnerCgroup, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, runnerLabelValue, BUILD_LABEL, RUNNER_LABEL } from './chunk-RZSF5B46.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock, runnerLabelValue, BUILD_LABEL, RUNNER_LABEL } from './chunk-E4PIFIC3.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
 import { spawnRun } from './chunk-774HEQL6.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-BNMCXPG7.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-3DD6AOWC.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DGAIVMMN.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-DTXOJDEH.js';
 import { exceedsDisk } from './chunk-F6GFZXZ3.js';
-import { parseClaimIdentity, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-AUFG23AA.js';
+import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-OD2VTIHN.js';
+import { parseClaimIdentity } from './chunk-HKMPVPO7.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-M5POMKKW.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-ZM2IMMYN.js';
@@ -690,7 +691,7 @@ function selectJobDirs(entries, nowMs, keepDays) {
 function liveBuildIds(jobs) {
   const ids = /* @__PURE__ */ new Set();
   for (const job of jobs) {
-    for (const id of [job.container?.buildId, job.microvm?.buildId, job.build?.buildId]) if (id !== void 0) ids.add(id);
+    for (const id of [job.container?.buildId, job.microvm?.buildId, job.build?.buildId, job.checkContainer?.buildId]) if (id !== void 0) ids.add(id);
   }
   return ids;
 }
@@ -1267,7 +1268,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-OVNF44FY.js');
+  const { postJson: postJson2 } = await import('./work-cmd-6UMCFTAW.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1395,6 +1396,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
     itemKey,
     branch,
     commitIdentity: identity,
+    ...item.specRepository === void 0 || item.specRepository === null || item.specRepository === "" ? {} : { repository: item.specRepository },
     startedAt: startedAt.toISOString()
   };
   writeJobFile(jobFilePath, job);
@@ -1864,8 +1866,39 @@ async function endJob(state, active, outcome, ending) {
     state.jobs.delete(active.dirPath);
   }
 }
+async function renewLeaseIfDue(state, active, nowMs) {
+  const log = logOf(state);
+  const tag = `#${active.job.item}`;
+  if (!needsRenew(active.lastRenewAtMs, nowMs)) return true;
+  const renew = await retrySend(() => renewLease(state.config, active.job.item, state.deps.fetchImpl), {
+    now: state.deps.now,
+    sleep: state.deps.sleep
+  });
+  const result = renew.ok ? renew.value : "retry_later";
+  if (result === "lease_lost") {
+    if (active.ending) {
+      log.error(`${tag} lease lost while the checks ran`);
+      return false;
+    }
+    log.error(`${tag} lease lost \xB7 ending job as lease_lost`);
+    await endJob(state, active, "lease_lost");
+    return false;
+  }
+  if (result === "renewed") {
+    active.job.lastRenewAt = new Date(nowMs).toISOString();
+    writeJobFile(join(active.dirPath, "job.json"), active.job);
+    log.line(`${tag} lease renewed \xB7 expires ${formatClock(new Date(nowMs + LEASE_SECONDS * 1e3), new Date(nowMs))}`);
+  } else {
+    log.error(`${tag} renew did not land \xB7 retrying in ${RENEW_INTERVAL_SECONDS / 60}m`);
+  }
+  active.lastRenewAtMs = nowMs;
+  return true;
+}
 async function watchTick(state, active, nowMs, logMtimeMs) {
-  if (active.ending) return;
+  if (active.ending) {
+    if (active.job.stage === "checks") await renewLeaseIfDue(state, active, nowMs);
+    return;
+  }
   const log = logOf(state);
   const tag = `#${active.job.item}`;
   const pid = active.job.pid;
@@ -1883,26 +1916,7 @@ async function watchTick(state, active, nowMs, logMtimeMs) {
     }
     return;
   }
-  if (needsRenew(active.lastRenewAtMs, nowMs)) {
-    const renew = await retrySend(() => renewLease(state.config, active.job.item, state.deps.fetchImpl), {
-      now: state.deps.now,
-      sleep: state.deps.sleep
-    });
-    const result = renew.ok ? renew.value : "retry_later";
-    if (result === "lease_lost") {
-      log.error(`${tag} lease lost \xB7 ending job as lease_lost`);
-      await endJob(state, active, "lease_lost");
-      return;
-    }
-    if (result === "renewed") {
-      active.job.lastRenewAt = new Date(nowMs).toISOString();
-      writeJobFile(join(active.dirPath, "job.json"), active.job);
-      log.line(`${tag} lease renewed \xB7 expires ${formatClock(new Date(nowMs + LEASE_SECONDS * 1e3), new Date(nowMs))}`);
-    } else {
-      log.error(`${tag} renew did not land \xB7 retrying in ${RENEW_INTERVAL_SECONDS / 60}m`);
-    }
-    active.lastRenewAtMs = nowMs;
-  }
+  if (!await renewLeaseIfDue(state, active, nowMs)) return;
   const tokens = active.job.container === void 0 && active.job.microvm === void 0 ? void 0 : runtimeOf(state).credentials.get(active.dirPath);
   if (tokens !== void 0) {
     await tokens.renewReadIfDue();
@@ -1978,7 +1992,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-CCVPBN7A.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-ASZL5BEO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-VMJ3MMBX.js → chunk-AJKEHABI.js}

@@ -1,30 +1,32 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-ZILGTTY6.js';
-import { DOCKERD_LOG } from './chunk-CBPPJSAR.js';
-import { installScrubContext } from './chunk-UMFWVGJO.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, syncInContainer, formatDuration, cleanupContainer, retrySend, formatClock, containerSenderCommand, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, senderSignalScript } from './chunk-RZSF5B46.js';
-import { CLAUDE_CODE_VERSION } from './chunk-Z62HNKEJ.js';
+import { senderPidfile } from './chunk-2VO25HHO.js';
+import { DOCKERD_LOG } from './chunk-WVGSB3Z2.js';
+import { installScrubContext } from './chunk-6ZZHWY2Z.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, syncInContainer, formatDuration, retrySend, formatClock, containerSenderCommand, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, startCheckContainer, lifecycleSteps, lifecycleFailureReason, deleteBuildDisk, senderSignalScript } from './chunk-E4PIFIC3.js';
+import { CLAUDE_CODE_VERSION, readBranchHead, fetchCommit } from './chunk-CEBIA5FD.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
 import { childEnvironment } from './chunk-774HEQL6.js';
-import { waitForAgent, vmExecArgs } from './chunk-W4SQCOZU.js';
-import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-B2G7JHHB.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-BNMCXPG7.js';
-import { planArtifactUpload } from './chunk-3DEVYTNQ.js';
-import { scrubText } from './chunk-ANK2B36Y.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm } from './chunk-3DD6AOWC.js';
+import { waitForAgent, vmExecArgs } from './chunk-ZOAEPWGL.js';
+import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-R7STSBLC.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-DGAIVMMN.js';
+import { planArtifactUpload } from './chunk-ZYHKJKSU.js';
+import { scrubText } from './chunk-D6FXM5OW.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-DTXOJDEH.js';
 import { parseSize } from './chunk-F6GFZXZ3.js';
-import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT } from './chunk-AUFG23AA.js';
+import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT } from './chunk-OD2VTIHN.js';
+import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-HKMPVPO7.js';
+import { parsePolicy } from './chunk-7ZR5UPMB.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { signerFor } from './chunk-M5POMKKW.js';
 import { runnerDir, buildDir, vsockPath, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { spawn, spawnSync } from 'child_process';
-import { randomBytes } from 'crypto';
-import { mkdirSync, chmodSync, writeFileSync, appendFileSync, statSync, accessSync, constants, openSync, existsSync, readFileSync, closeSync, rmSync, readdirSync } from 'fs';
-import { join, isAbsolute, dirname, delimiter } from 'path';
+import { randomBytes, createHash } from 'crypto';
+import { mkdirSync, chmodSync, writeFileSync, appendFileSync, statSync, accessSync, constants, openSync, existsSync, readFileSync, closeSync, rmSync, readdirSync, lstatSync, realpathSync } from 'fs';
+import { join, isAbsolute, dirname, delimiter, sep } from 'path';
 
 createRequire(import.meta.url);
 var DEFAULT_MEMORY = "8g";
@@ -143,12 +145,20 @@ async function provisionMicroVm(input) {
   };
   input.save(state, environment);
   const bail = async (reason, aborted = false) => {
+    let why = reason;
+    if (!aborted && state.cgroup !== void 0) {
+      try {
+        if (runtime.vm.cgroup.oomKills(state.cgroup) > 0) why = outOfMemoryReason(config.build?.memory);
+      } catch (err) {
+        log.error(`${tag} could not read the build's memory events: ${describeCallFailure(err)} \xB7 continuing`);
+      }
+    }
     try {
       await cleanupMicroVm(runtime, state);
     } catch (err) {
       log.error(`${tag} cleanup failed: ${describeCallFailure(err)}`);
     }
-    return aborted ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(reason);
+    return aborted ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(why);
   };
   if (input.aborted()) return bail("", true);
   let imageConfig;
@@ -717,6 +727,266 @@ async function provisionProcess(input) {
 function cleanupProcess(runtime, state) {
   return closeHostBuild(runtime, state);
 }
+var MAX_VALIDATOR_FILES = 20;
+var VALIDATORS_DIR = ".outerlayer/validators";
+var POLICY_FILE = ".outerlayer/policy.yaml";
+var LIMIT_KEY_TAIL = " (runner.checks.timeLimitMinutes)";
+function lastLine(text2) {
+  return text2.split(/\r\n|\r|\n/).map((line) => line.trim()).filter((line) => line !== "").at(-1);
+}
+function readInside(root, rel) {
+  const path = join(root, rel);
+  try {
+    if (!lstatSync(path).isFile()) return void 0;
+    const inside = realpathSync(path);
+    const base = realpathSync(root);
+    return inside.startsWith(base + sep) ? readFileSync(inside, "utf8") : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function validatorFilesIn(root) {
+  const dir = join(root, VALIDATORS_DIR);
+  let names;
+  try {
+    if (!lstatSync(dir).isDirectory()) return [];
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const files = [];
+  for (const name of names.filter((entry) => /\.ya?ml$/.test(entry)).sort().slice(0, MAX_VALIDATOR_FILES)) {
+    const path = `${VALIDATORS_DIR}/${name}`;
+    const content = readInside(root, path);
+    if (content !== void 0) files.push({ path, content });
+  }
+  return files;
+}
+function checksIn(root, log, tag) {
+  const policy = readInside(root, POLICY_FILE);
+  const loaded = parsePolicy(policy === void 0 ? null : { path: POLICY_FILE, content: policy }, validatorFilesIn(root));
+  for (const problem of loaded.problems) log.error(`${tag} ${problem.file}: ${problem.problem}`);
+  const hostChecks = loaded.customs.filter((def) => def.runWhere === "host" && def.level !== "off" && def.declaresEmit !== null && def.command !== void 0);
+  return hostChecks.map((def) => ({ name: def.declaresEmit, command: def.command }));
+}
+async function readDefinitions(input, repository, scratch, token) {
+  const { config, job, deps } = input;
+  const tag = `#${job.item}`;
+  const stage = deps.stage ?? stageGovernedContext;
+  const controlPlaneUrl = (controlPlane) => deps.runtime.remoteFor?.(controlPlane) ?? `${deps.runtime.github.gitUrl}/${controlPlane}.git`;
+  const staged = await stage({
+    config,
+    repository,
+    buildId: `checks-${randomBytes(4).toString("hex")}`,
+    buildDir: scratch,
+    fetchImpl: deps.fetchImpl,
+    controlPlaneUrl
+  });
+  if (staged.kind === "refused") return { ok: false, reason: staged.reason };
+  if (staged.kind === "staged") {
+    try {
+      return { ok: true, checks: checksIn(join(staged.dir, "tree"), deps.log, tag) };
+    } finally {
+      rmSync(staged.dir, { recursive: true, force: true });
+    }
+  }
+  const repo = join(scratch, "repo");
+  const remote = deps.runtime.remoteFor?.(repository) ?? `${deps.runtime.github.gitUrl}/${repository}.git`;
+  const commit = job.environment?.recipe?.sourceCommit ?? await deps.runtime.readHead(remote, scratch);
+  if (commit === void 0) return { ok: false, reason: "the repository's default branch could not be read" };
+  const fetched = await (deps.fetchCommit ?? fetchCommit)({ remote, dir: repo, commit, token });
+  if (!fetched.ok) return { ok: false, reason: fetched.reason };
+  return { ok: true, checks: checksIn(repo, deps.log, tag) };
+}
+function timeoutAfter(ms, sleep) {
+  if (sleep !== void 0) return { done: sleep(ms).then(() => "timeout"), cancel: () => void 0 };
+  let timer;
+  const done = new Promise((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), ms);
+    timer.unref();
+  });
+  return { done, cancel: () => clearTimeout(timer) };
+}
+function noCleanEnvironment(job) {
+  const ran = job.microvm !== void 0 ? "builtin:vm" : job.build?.workDir !== void 0 ? "builtin:process" : "a provision hook of the host's own";
+  return `the host has no clean environment for checks: this build ran under ${ran}, and checks run only in a new container from a container build's image`;
+}
+async function runHostChecks(input) {
+  const { config, job, jobDir, deps } = input;
+  const { runtime, log } = deps;
+  const tag = `#${job.item}`;
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const repository = job.repository ?? job.container?.repository;
+  if (repository === void 0) return;
+  const jobFilePath = join(jobDir, "job.json");
+  const tokens = runtime.credentials.get(jobDir);
+  let readToken;
+  try {
+    readToken = await tokens?.token("read");
+  } catch (err) {
+    log.error(`${tag} no read token for the checks: ${describeCallFailure(err)}`);
+  }
+  const scratch = join(jobDir, "checks", "definitions");
+  rmSync(scratch, { recursive: true, force: true });
+  mkdirSync(scratch, { recursive: true });
+  let definitions;
+  try {
+    definitions = await readDefinitions(input, repository, scratch, readToken);
+  } catch (err) {
+    definitions = { ok: false, reason: describeCallFailure(err) };
+  } finally {
+    removeStagedContext(scratch);
+  }
+  if (!definitions.ok) {
+    log.line(`${tag} checks not run: the definitions could not be read: ${definitions.reason}`);
+    rmSync(scratch, { recursive: true, force: true });
+    return;
+  }
+  const checks = definitions.checks;
+  if (checks.length === 0) {
+    rmSync(scratch, { recursive: true, force: true });
+    return;
+  }
+  log.line(`${tag} checks started (${checks.map((check) => check.name).join(", ")})`);
+  const startedMs = now().getTime();
+  let signer;
+  const record = async (check, result, sentence, keyTail = "") => {
+    signer ??= await signerFor(config.configPath);
+    const body = sentence === void 0 ? void 0 : cutReasonLine(`${scrubReason(sentence, config) ?? "check failed"}${keyTail}`);
+    const clientEmitId = `host-${createHash("sha256").update(`${job.claimId}:${job.startedAt}:${check.name}`).digest("hex").slice(0, 40)}`;
+    const sent = await retrySend(
+      () => postJson(
+        config.url,
+        "/v1/emitted-results",
+        config.apiKey,
+        config.appId,
+        { schemaVersion: 1, emit: { clientEmitId, name: check.name, result, ...body === void 0 ? {} : { body }, emittedAt: now().toISOString(), item: { number: Number(job.item) } } },
+        deps.fetchImpl,
+        void 0,
+        signer
+      ),
+      { now: deps.now }
+    );
+    if (sent.ok) log.line(`${tag} check ${check.name} ${result}${body === void 0 ? "" : `: ${body}`}`);
+    else log.error(`${tag} check ${check.name} ${result} could not be recorded: ${sent.reason}`);
+  };
+  const failAll = async (reason, keyTail = "") => {
+    log.error(`${tag} checks failed: ${reason}${keyTail}`);
+    for (const check of checks) await record(check, "fail", reason, keyTail);
+  };
+  let container;
+  try {
+    if (job.container === void 0) return await failAll(noCleanEnvironment(job));
+    if (tokens === void 0) return await failAll("the build's repository tokens are no longer held, so the branch cannot be fetched");
+    const branch = job.branch;
+    if (branch === void 0) return await failAll("the build pushed no branch: the claim names none");
+    const remote = runtime.remoteFor?.(repository) ?? `${runtime.github.gitUrl}/${repository}.git`;
+    const read = await (deps.readBranch ?? readBranchHead)({ remote, dir: scratch, branch, token: readToken });
+    if (read.kind === "absent") return await failAll(`the build pushed no branch: ${branch} does not exist on ${repository}`);
+    if (read.kind === "unreadable") return await failAll(`the branch ${branch} could not be read: ${read.reason}`);
+    const limitMinutes = config.checks?.timeLimitMinutes ?? DEFAULT_CHECK_TIME_LIMIT_MINUTES;
+    const minutes = `${limitMinutes} ${limitMinutes === 1 ? "minute" : "minutes"}`;
+    const environmentLog = join(jobDir, "checks", "environment.log");
+    const setup = async () => {
+      const started = await startCheckContainer({
+        config,
+        runtime,
+        job,
+        jobDir,
+        tokens,
+        log,
+        save: (state) => {
+          job.checkContainer = state;
+          writeJobFile(jobFilePath, job);
+        }
+      });
+      if (!started.ok) return `the check environment could not be made: ${started.reason}`;
+      container = started.container;
+      const made = started.container;
+      const steps = [
+        {
+          argv: ["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"],
+          workdir: "/build/work",
+          failed: (status) => `configuring git failed (exit ${status})`
+        },
+        {
+          argv: ["git", "clone", "--filter=blob:none", "--single-branch", "--branch", branch, `https://github.com/${repository}.git`, CHECKOUT_DIR],
+          workdir: "/build/work",
+          failed: (status) => `the clone of ${branch} failed (exit ${status})`
+        }
+      ];
+      for (const step of steps) {
+        const ran = await made.exec(step.argv, step.workdir, { logPath: environmentLog });
+        if (ran.status !== 0) return `the check environment could not be prepared: ${step.failed(ran.status)}`;
+      }
+      for (const step of lifecycleSteps(job.container?.lifecycle ?? {})) {
+        log.line(`${tag} checks lifecycle ${step.name} (${step.source})`);
+        const ran = await made.exec(step.argv, CHECKOUT_DIR, { logPath: environmentLog });
+        if (ran.status !== 0) return `the check environment could not be prepared: ${lifecycleFailureReason(step, ran.status)}`;
+      }
+      return made;
+    };
+    const setupTimer = timeoutAfter(limitMinutes * 6e4, deps.sleep);
+    let settled;
+    try {
+      const outcome = await Promise.race([setup(), setupTimer.done]);
+      if (outcome === "timeout") return await failAll(`the check environment setup ran out of time after ${minutes}`, LIMIT_KEY_TAIL);
+      settled = outcome;
+    } finally {
+      setupTimer.cancel();
+    }
+    if (typeof settled === "string") return await failAll(settled);
+    const ready = settled;
+    let usable = true;
+    for (const check of checks) {
+      if (!usable) {
+        await record(check, "fail", "the check environment could not be restarted after an earlier check ran out of time");
+        continue;
+      }
+      const checkStartedMs = now().getTime();
+      const running = ready.exec(["/bin/sh", "-c", check.command], CHECKOUT_DIR, { logPath: join(jobDir, "checks", `${check.name}.log`) });
+      running.catch(() => void 0);
+      const timer = timeoutAfter(limitMinutes * 6e4, deps.sleep);
+      let outcome;
+      try {
+        outcome = await Promise.race([running, timer.done]);
+      } catch (err) {
+        timer.cancel();
+        await record(check, "fail", `the command could not be run: ${describeCallFailure(err)}`);
+        continue;
+      }
+      timer.cancel();
+      if (outcome === "timeout") {
+        await record(check, "fail", `ran out of time after ${minutes}`, LIMIT_KEY_TAIL);
+        const restarting = ready.restart().catch(() => false);
+        const restartTimer = timeoutAfter(limitMinutes * 6e4, deps.sleep);
+        usable = await Promise.race([restarting, restartTimer.done]) === true;
+        restartTimer.cancel();
+        continue;
+      }
+      if (outcome.status === 0) {
+        log.line(`${tag} check ${check.name} ran (${formatDuration(now().getTime() - checkStartedMs)})`);
+        await record(check, "pass");
+        continue;
+      }
+      const last = lastLine(outcome.stderr) ?? lastLine(outcome.stdout);
+      const scrubbed = last === void 0 ? void 0 : scrubReason(last, config);
+      await record(check, "fail", `exited ${outcome.status}${scrubbed === void 0 ? " with no output" : `: ${cutReasonLine(scrubbed, 140)}`}`);
+    }
+  } catch (err) {
+    log.error(`${tag} checks stopped: ${describeCallFailure(err)}`);
+  } finally {
+    if (container !== void 0 || job.checkContainer !== void 0) {
+      const state = container?.state ?? job.checkContainer;
+      await cleanupContainer(runtime, state).catch((err) => log.error(`${tag} removing the check environment failed: ${describeCallFailure(err)}`));
+      delete job.checkContainer;
+      writeJobFile(jobFilePath, job);
+    }
+    rmSync(scratch, { recursive: true, force: true });
+    if (existsSync(scratch)) log.error(`${tag} the checks' scratch directory could not be removed`);
+    log.line(`${tag} checks done (${formatDuration(now().getTime() - startedMs)})`);
+  }
+}
 
 // src/runner/job.ts
 var LEASE_SECONDS = 900;
@@ -1181,7 +1451,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     await stopProcessGroup(job.pid);
   }
   if (outcome !== void 0 && job.endStage === void 0) {
-    const TEARDOWN_STAGES = ["sync", "cleanup", "report"];
+    const TEARDOWN_STAGES = ["checks", "sync", "cleanup", "report"];
     const staleTeardownStage = job.stage !== void 0 && TEARDOWN_STAGES.includes(job.stage);
     job.endStage = ending?.stage ?? (staleTeardownStage ? job.exitCode !== void 0 ? "command" : void 0 : job.stage);
     job.endExitCode = ending?.exitCode ?? (outcome === "ok" || outcome === "failed" ? job.exitCode : void 0);
@@ -1191,11 +1461,35 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     job.reason = scrubReason(ending.reason, config);
     writeJobFile(jobFilePath, job);
   }
+  if (job.checkContainer !== void 0 && job.checksRan === true) {
+    try {
+      await cleanupContainer(deps.container ?? createContainerRuntime(), job.checkContainer);
+      delete job.checkContainer;
+      writeJobFile(jobFilePath, job);
+    } catch (err) {
+      log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
+    }
+  }
+  if (outcome === "ok" && !job.cleanupRan && job.checksRan !== true) {
+    setStage(job, jobDirPath, "checks");
+    job.checksRan = true;
+    writeJobFile(jobFilePath, job);
+    try {
+      await runHostChecks({
+        config,
+        job,
+        jobDir: jobDirPath,
+        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, ...deps.hostChecks }
+      });
+    } catch (err) {
+      log.error(`${tag} the host's checks stopped: ${describeCallFailure(err)} \xB7 continuing`);
+    }
+  }
   let outOfMemory;
   if (vmBuild?.state.cgroup !== void 0 && outcome !== void 0 && outcome !== "ok" && ending?.reason === void 0) {
     try {
       if (vmBuild.runtime.vm.cgroup.oomKills(vmBuild.state.cgroup) > 0) {
-        outOfMemory = `the build ran out of memory: the kernel killed its microVM at the limit of runner.build.memory (${config.build?.memory ?? "8g"}) plus 256 MiB for Firecracker. Raise runner.build.memory, or lower runner.concurrency`;
+        outOfMemory = outOfMemoryReason(config.build?.memory);
       }
     } catch (err) {
       log.error(`${tag} could not read the build's memory events: ${describeCallFailure(err)} \xB7 continuing`);

package/dist/{chunk-RBOMWNOG.js → chunk-AQ54MKSQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-RZSF5B46.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-Z62HNKEJ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E4PIFIC3.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CEBIA5FD.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-Z62HNKEJ.js → chunk-CEBIA5FD.js}

@@ -2,6 +2,7 @@
 import { createRequire } from 'node:module';
 import { startTimeOf, claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-N5FOE5PS.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-QOZKPLVJ.js';
+import { withGitConfig } from './chunk-HKMPVPO7.js';
 import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
@@ -20,10 +21,10 @@ function tokenHeader(token) {
   return `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
 }
 function tokenSettings(remote, token) {
-  return { GIT_CONFIG_COUNT: "1", GIT_CONFIG_KEY_0: `http.${remote}.extraHeader`, GIT_CONFIG_VALUE_0: tokenHeader(token) };
+  return (env) => withGitConfig(env, `http.${remote}.extraHeader`, tokenHeader(token));
 }
-function git(cwd, args, timeoutMs, extraEnv = {}) {
-  const env = { ...gitEnvironment(process.env), ...extraEnv };
+function git(cwd, args, timeoutMs, extend = (env) => env) {
+  const env = extend(gitEnvironment(process.env));
   return new Promise((resolve, reject) => {
     execFile(
       "git",
@@ -44,7 +45,7 @@ function defaultBranchOf(lsRemote) {
 async function fetchDefaultBranch(opts) {
   const created = !existsSync(opts.dir);
   mkdirSync(opts.dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const credential = opts.token === void 0 ? {} : tokenSettings(opts.remote, opts.token);
+  const credential = opts.token === void 0 ? void 0 : tokenSettings(opts.remote, opts.token);
   const over = (args) => git(opts.dir, args, void 0, credential);
   try {
     const defaultBranch = defaultBranchOf(await over(["ls-remote", "--symref", opts.remote, "HEAD"]));
@@ -84,6 +85,31 @@ async function readDefaultBranchHead(remote, dir) {
   }
   return out.match(/^([0-9a-f]{40}|[0-9a-f]{64})\tHEAD$/m)?.[1];
 }
+async function readBranchHead(input) {
+  const credential = input.token === void 0 ? void 0 : tokenSettings(input.remote, input.token);
+  mkdirSync(input.dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  let out;
+  try {
+    out = await git(input.dir, ["ls-remote", "--heads", input.remote, `refs/heads/${input.branch}`], HEAD_TIMEOUT_MS, credential);
+  } catch (err) {
+    return { kind: "unreadable", reason: (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n")[0] };
+  }
+  const sha = out.match(/^([0-9a-f]{40}|[0-9a-f]{64})\trefs\/heads\//m)?.[1];
+  return sha === void 0 ? { kind: "absent" } : { kind: "found", sha };
+}
+async function fetchCommit(input) {
+  const credential = input.token === void 0 ? void 0 : tokenSettings(input.remote, input.token);
+  try {
+    mkdirSync(input.dir, { recursive: true, mode: RUNNER_DIR_MODE });
+    await git(input.dir, ["init", "--quiet"]);
+    await git(input.dir, ["fetch", "--quiet", "--depth", "1", "--no-tags", input.remote, input.commit], CLONE_TIMEOUT_MS, credential);
+    await git(input.dir, ["checkout", "--quiet", "--detach", "--force", "FETCH_HEAD"]);
+    return { ok: true };
+  } catch (err) {
+    const detail = (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n")[0];
+    return { ok: false, reason: `the fetch of ${input.commit.slice(0, 8)} from ${input.remote} failed: ${detail}` };
+  }
+}
 var CLONE_TIMEOUT_MS = 6e5;
 async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
   mkdirSync(dirname(dest), { recursive: true, mode: RUNNER_DIR_MODE });
@@ -467,4 +493,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath) {
   return removed;
 }
 
-export { CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, MICROVM_ARCHES, buildRepositoryImage, cloneRepository, firecrackerArch, guestAssetsPinned, readDefaultBranchHead };
+export { CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, MICROVM_ARCHES, buildRepositoryImage, cloneRepository, fetchCommit, firecrackerArch, guestAssetsPinned, readBranchHead, readDefaultBranchHead };