@outerlayer/cli 0.6.0 → 0.8.0

package/dist/{chunk-JWOQNNN2.js → chunk-OEK4JEB3.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-YYYXRJUW.js';
+import { writeLauncher, LauncherWriteError, pathNotes, launcherPath } from './chunk-PTW6W5NR.js';
+import { isInLayout, packageRootIn, versionDir, switchCurrent, currentLink, execStartLine } from './chunk-TI7B7UEO.js';
 import { RUNNER_DIR_MODE } from './chunk-ZM2IMMYN.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
@@ -31,7 +32,7 @@ function runRunnerInstall(args) {
   if (manifest.name !== "@outerlayer/cli") throw new RunnerInstallError(`${packageRoot} is not the @outerlayer/cli package`);
   const version = manifest.version;
   if (typeof version !== "string" || version === "") throw new RunnerInstallError(`${packageRoot}/package.json has no version`);
-  if (!isInLayout(configPath, entry)) {
+  if (!isInLayout(configPath, entry) && !sameBuildInstalled(packageRoot, packageRootIn(versionDir(configPath, version)))) {
     const target = packageRootIn(versionDir(configPath, version));
     mkdirSync(dirname(target), { recursive: true, mode: RUNNER_DIR_MODE });
     rmSync(target, { recursive: true, force: true });
@@ -39,7 +40,31 @@ function runRunnerInstall(args) {
     carryHoistedDevcontainerCli(packageRoot, target);
   }
   switchCurrent(configPath, version);
-  return { version, execStart: execStartLine(configPath, nodePath) };
+  let written;
+  try {
+    written = writeLauncher({ home: args.home, configPath, nodePath, replace: args.replace });
+  } catch (error) {
+    if (error instanceof LauncherWriteError) throw new RunnerInstallError(error.message);
+    throw error;
+  }
+  return {
+    version,
+    execStart: execStartLine(configPath, nodePath),
+    launcher: {
+      path: launcherPath(args.home),
+      state: written.state,
+      follows: currentLink(configPath),
+      notes: pathNotes({ home: args.home, PATH: args.PATH, state: written.state, launcher: written.path })
+    }
+  };
+}
+function sameBuildInstalled(source, target) {
+  try {
+    const wanted = readFileSync(join(source, "dist", "build-info.json"), "utf8");
+    return wanted !== "" && wanted === readFileSync(join(target, "dist", "build-info.json"), "utf8");
+  } catch {
+    return false;
+  }
 }
 function carryHoistedDevcontainerCli(packageRoot, target) {
   const dependency = join("@devcontainers", "cli");
@@ -50,5 +75,9 @@ function carryHoistedDevcontainerCli(packageRoot, target) {
   mkdirSync(dirname(carried), { recursive: true, mode: RUNNER_DIR_MODE });
   cpSync(hoisted, carried, { recursive: true });
 }
+function launcherSummary(launcher) {
+  if (launcher.state === "foreign") return void 0;
+  return `${launcher.state === "unchanged" ? "outerlayer command already at" : "wrote the outerlayer command at"} ${launcher.path}, which runs the CLI that ${launcher.follows} names`;
+}
 
-export { RunnerInstallError, runRunnerInstall };
+export { RunnerInstallError, launcherSummary, runRunnerInstall };

package/dist/chunk-PTW6W5NR.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { currentLink } from './chunk-TI7B7UEO.js';
+import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
+import { randomBytes } from 'crypto';
+import { join, dirname, delimiter, resolve } from 'path';
+
+createRequire(import.meta.url);
+var LAUNCHER_MARKER = "# outerlayer-runner-launcher";
+var LauncherWriteError = class extends Error {
+};
+var PATH_LINE = 'export PATH="$HOME/.local/bin:$PATH"';
+var ADD_TO_PATH = `${PATH_LINE} (in ~/.profile, ~/.bashrc or your shell's startup file; the runner never edits those)`;
+function launcherPath(home) {
+  return join(home, ".local", "bin", "outerlayer");
+}
+function quoted(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function launcherText(configPath, nodePath) {
+  const entry = join(currentLink(configPath), "node_modules", "@outerlayer", "cli", "dist", "index.js");
+  return [
+    "#!/bin/sh",
+    LAUNCHER_MARKER,
+    "# Written by `outerlayer runner install`. Runs the CLI the runner's `current` link names, so a self-update changes",
+    "# what this runs without changing this file.",
+    `exec ${quoted(nodePath)} ${quoted(entry)} "$@"`,
+    ""
+  ].join("\n");
+}
+function ownerOf(path) {
+  try {
+    lstatSync(path);
+  } catch {
+    return "absent";
+  }
+  try {
+    return readFileSync(path, "utf8").includes(LAUNCHER_MARKER) ? "ours" : "foreign";
+  } catch {
+    return "foreign";
+  }
+}
+function writeLauncher(input) {
+  const path = launcherPath(input.home);
+  const text = launcherText(input.configPath, input.nodePath);
+  const owner = ownerOf(path);
+  if (owner === "foreign" && input.replace !== true) return { path, state: "foreign" };
+  if (owner === "ours" && readFileSync(path, "utf8") === text) {
+    if ((statSync(path).mode & 493) !== 493) chmodSync(path, 493);
+    return { path, state: "unchanged" };
+  }
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    const temporary = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.new`;
+    try {
+      writeFileSync(temporary, text, { mode: 493, flag: "wx" });
+      chmodSync(temporary, 493);
+      renameSync(temporary, path);
+    } catch (error) {
+      rmSync(temporary, { force: true });
+      throw error;
+    }
+  } catch (error) {
+    throw new LauncherWriteError(`cannot write the outerlayer command at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return { path, state: "written" };
+}
+function firstOnPath(PATH) {
+  for (const dir of (PATH ?? "").split(delimiter)) {
+    if (dir === "") continue;
+    const candidate = join(dir, "outerlayer");
+    try {
+      if (!statSync(candidate).isFile()) continue;
+      accessSync(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
+function sameFile(a, b) {
+  try {
+    return realpathSync(a) === realpathSync(b);
+  } catch {
+    return false;
+  }
+}
+function onPath(PATH, dir) {
+  return (PATH ?? "").split(delimiter).some((entry) => entry !== "" && resolve(entry) === resolve(dir));
+}
+function pathNotes(input) {
+  const notes = [];
+  if (input.state === "foreign") {
+    notes.push(`${input.launcher} exists and the runner did not write it, so it was left alone. Run \`outerlayer runner install --replace\` to replace it`);
+    return notes;
+  }
+  if (!onPath(input.PATH, dirname(input.launcher))) {
+    notes.push(`${dirname(input.launcher)} is not on PATH, so a shell will not find the launcher. Add it with: ${ADD_TO_PATH}`);
+    return notes;
+  }
+  const first = firstOnPath(input.PATH);
+  if (first !== void 0 && !sameFile(first, input.launcher)) {
+    notes.push(`${first} comes before ${input.launcher} on PATH, so a shell runs that one instead. Put the launcher's directory first with: ${ADD_TO_PATH}`);
+  }
+  return notes;
+}
+function launcherCheck(input) {
+  const name = "outerlayer on PATH";
+  const launcher = launcherPath(input.home);
+  if (!existsSync(launcher) || ownerOf(launcher) !== "ours") return void 0;
+  const first = firstOnPath(input.PATH);
+  if (first === void 0) {
+    return { name, status: "warn", detail: `no outerlayer is on PATH; the launcher is at ${launcher}`, fix: `add its directory to PATH: ${ADD_TO_PATH}` };
+  }
+  if (sameFile(first, launcher)) {
+    return { name, status: "pass", detail: `${launcher} is the first outerlayer on PATH, so it runs the version the runner runs` };
+  }
+  return {
+    name,
+    status: "warn",
+    detail: `${first} comes before ${launcher} on PATH, so a shell runs that one, which may not be the version the runner runs`,
+    fix: `remove ${first}, or put the launcher's directory first: ${ADD_TO_PATH}`
+  };
+}
+
+export { LauncherWriteError, launcherCheck, launcherPath, pathNotes, writeLauncher };

package/dist/{chunk-3DD6AOWC.js → chunk-PWBILI5P.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-F6GFZXZ3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-AUFG23AA.js';
+import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
+import { parseSize } from './chunk-7RQ73DLO.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-OD2VTIHN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
@@ -30,6 +31,9 @@ var DEFAULT_CONCURRENCY = 1;
 var DEFAULT_POLL_SECONDS = 60;
 var DEFAULT_TIME_LIMIT_MINUTES = 480;
 var DEFAULT_IDLE_LIMIT_MINUTES = 30;
+var DEFAULT_CHECK_TIME_LIMIT_MINUTES = 10;
+var CHECKS_KEYS = ["timeLimitMinutes"];
+var MAX_CHECK_TIME_LIMIT_MINUTES = 240;
 var DEFAULT_BUILD = { memory: "8g", cpus: 4, pids: 4096, disk: "40g", variables: [] };
 var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts"];
 var HOUSEKEEPING_KEYS = ["jobsKeepDays", "buildCacheMax", "minFreeDisk"];
@@ -81,6 +85,7 @@ var RUNNER_KEYS = [
   "hooks",
   "build",
   "housekeeping",
+  "checks",
   "autoUpdate"
 ];
 function runnerNumbers() {
@@ -199,6 +204,7 @@ function loadRunnerConfig(configPath) {
   checkBuiltinHooks(configPath, runner.hooks);
   const build = resolveBuild(configPath, runner.build);
   const housekeeping = resolveHousekeeping(configPath, runner.housekeeping, build.disk);
+  const checks = resolveChecks(configPath, runner.checks);
   if (config.scrub?.literals !== void 0 && !Array.isArray(config.scrub.literals)) {
     fail(configPath, "scrub.literals", "must be a list of strings");
   }
@@ -226,6 +232,7 @@ function loadRunnerConfig(configPath) {
     },
     build,
     housekeeping,
+    checks,
     // A host with executables of its own for provision and cleanup chose
     // its own environment, and an update could change what its hooks run
     // under; it opts in. The built-in hooks are the runner's own. Provision
@@ -275,6 +282,24 @@ function resolveHousekeeping(configPath, block, buildDisk) {
   if (minFreeDisk === void 0) fail(configPath, "runner.housekeeping.minFreeDisk", 'must be a size such as "40g"');
   return { jobsKeepDays: keys.jobsKeepDays ?? DEFAULT_JOBS_KEEP_DAYS, buildCacheMax, minFreeDisk };
 }
+function resolveChecks(configPath, block) {
+  const given = block ?? {};
+  if (typeof given !== "object" || Array.isArray(given)) fail(configPath, "runner.checks", "must be an object");
+  const keys = given;
+  for (const key of Object.keys(keys)) {
+    if (CHECKS_KEYS.includes(key)) continue;
+    const near = nearestKey(key, CHECKS_KEYS);
+    fail(configPath, `runner.checks.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+  }
+  const limit = keys.timeLimitMinutes === void 0 ? DEFAULT_CHECK_TIME_LIMIT_MINUTES : keys.timeLimitMinutes;
+  if (!Number.isInteger(limit) || limit < 1) {
+    fail(configPath, "runner.checks.timeLimitMinutes", "must be a whole number of at least 1");
+  }
+  if (limit > MAX_CHECK_TIME_LIMIT_MINUTES) {
+    fail(configPath, "runner.checks.timeLimitMinutes", `must be at most ${MAX_CHECK_TIME_LIMIT_MINUTES}`);
+  }
+  return { timeLimitMinutes: limit };
+}
 function wholeBytes(bytes) {
   if (bytes === void 0) return void 0;
   const whole = Math.floor(bytes);
@@ -334,4 +359,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };

package/dist/{chunk-B2G7JHHB.js → chunk-R7STSBLC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-AUFG23AA.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-OD2VTIHN.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-YYYXRJUW.js → chunk-TI7B7UEO.js}

@@ -98,4 +98,4 @@ function execStartLine(configPath, nodePath) {
   return `ExecStart=${execStartCommand(configPath, nodePath)}`;
 }
 
-export { cleanVersions, currentVersion, entryIn, execStartCommand, execStartLine, isInLayout, packageRootIn, readMarker, removeMarker, stagingDir, startedThroughCurrent, switchCurrent, versionDir, writeMarker };
+export { cleanVersions, currentLink, currentVersion, entryIn, execStartCommand, execStartLine, isInLayout, packageRootIn, readMarker, removeMarker, stagingDir, startedThroughCurrent, switchCurrent, versionDir, writeMarker };

package/dist/{chunk-Z62HNKEJ.js → chunk-TTNFGMHO.js}

@@ -2,6 +2,8 @@
 import { createRequire } from 'node:module';
 import { startTimeOf, claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-N5FOE5PS.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-QOZKPLVJ.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, TINI_VERSION, GH_VERSION, GH_SHA256, TINI_SHA256 } from './chunk-CX22S5BA.js';
+import { withGitConfig } from './chunk-HKMPVPO7.js';
 import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
@@ -20,10 +22,10 @@ function tokenHeader(token) {
   return `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
 }
 function tokenSettings(remote, token) {
-  return { GIT_CONFIG_COUNT: "1", GIT_CONFIG_KEY_0: `http.${remote}.extraHeader`, GIT_CONFIG_VALUE_0: tokenHeader(token) };
+  return (env) => withGitConfig(env, `http.${remote}.extraHeader`, tokenHeader(token));
 }
-function git(cwd, args, timeoutMs, extraEnv = {}) {
-  const env = { ...gitEnvironment(process.env), ...extraEnv };
+function git(cwd, args, timeoutMs, extend = (env) => env) {
+  const env = extend(gitEnvironment(process.env));
   return new Promise((resolve, reject) => {
     execFile(
       "git",
@@ -44,7 +46,7 @@ function defaultBranchOf(lsRemote) {
 async function fetchDefaultBranch(opts) {
   const created = !existsSync(opts.dir);
   mkdirSync(opts.dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const credential = opts.token === void 0 ? {} : tokenSettings(opts.remote, opts.token);
+  const credential = opts.token === void 0 ? void 0 : tokenSettings(opts.remote, opts.token);
   const over = (args) => git(opts.dir, args, void 0, credential);
   try {
     const defaultBranch = defaultBranchOf(await over(["ls-remote", "--symref", opts.remote, "HEAD"]));
@@ -84,6 +86,31 @@ async function readDefaultBranchHead(remote, dir) {
   }
   return out.match(/^([0-9a-f]{40}|[0-9a-f]{64})\tHEAD$/m)?.[1];
 }
+async function readBranchHead(input) {
+  const credential = input.token === void 0 ? void 0 : tokenSettings(input.remote, input.token);
+  mkdirSync(input.dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  let out;
+  try {
+    out = await git(input.dir, ["ls-remote", "--heads", input.remote, `refs/heads/${input.branch}`], HEAD_TIMEOUT_MS, credential);
+  } catch (err) {
+    return { kind: "unreadable", reason: (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n")[0] };
+  }
+  const sha = out.match(/^([0-9a-f]{40}|[0-9a-f]{64})\trefs\/heads\//m)?.[1];
+  return sha === void 0 ? { kind: "absent" } : { kind: "found", sha };
+}
+async function fetchCommit(input) {
+  const credential = input.token === void 0 ? void 0 : tokenSettings(input.remote, input.token);
+  try {
+    mkdirSync(input.dir, { recursive: true, mode: RUNNER_DIR_MODE });
+    await git(input.dir, ["init", "--quiet"]);
+    await git(input.dir, ["fetch", "--quiet", "--depth", "1", "--no-tags", input.remote, input.commit], CLONE_TIMEOUT_MS, credential);
+    await git(input.dir, ["checkout", "--quiet", "--detach", "--force", "FETCH_HEAD"]);
+    return { ok: true };
+  } catch (err) {
+    const detail = (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n")[0];
+    return { ok: false, reason: `the fetch of ${input.commit.slice(0, 8)} from ${input.remote} failed: ${detail}` };
+  }
+}
 var CLONE_TIMEOUT_MS = 6e5;
 async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
   mkdirSync(dirname(dest), { recursive: true, mode: RUNNER_DIR_MODE });
@@ -97,44 +124,6 @@ async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
   }
 }
 
-// src/runner/image/pins.ts
-var CLAUDE_CODE_VERSION = "2.1.284";
-var DEFAULT_BASE_IMAGE = "ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3";
-var NODE_IMAGE = "node:22-bookworm-slim@sha256:43ac6c60b8f89723f746e8a92ce91abd5017e627ce1ddfe4238355d3a30b772c";
-var GH_VERSION = "2.101.0";
-var GH_SHA256 = {
-  amd64: "9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8",
-  arm64: "b57e8063f18862647c9d22727c32e9da1b963f8bf9db648fe123a6975695640f"
-};
-var TINI_VERSION = "0.19.0";
-var TINI_SHA256 = {
-  amd64: "c5b0666b4cb676901f90dfcb37106783c5fe2077b04590973b885950611b30ee",
-  arm64: "eae1d3aa50c48fb23b8cbdf4e369d0910dfc538566bfd09df89a774aa84a48b9"
-};
-var MICROVM_ARCHES = ["x86_64"];
-function firecrackerArch(nodeArch) {
-  return nodeArch === "x64" ? "x86_64" : nodeArch === "arm64" ? "aarch64" : nodeArch;
-}
-var FIRECRACKER_VERSION = "1.13.1";
-var FIRECRACKER_SHA256 = {
-  x86_64: "59450b9171ff2ebdf2f9a25be3a248a7ba79fb6371aec51a9d6d8eefca7b4faf"
-};
-var FIRECRACKER_BINARY_SHA256 = {
-  x86_64: "7d3924e0c8761edafbf85cb2a94c268ffad249644a40fd02d4e15cde4c206f6e"
-};
-var GUEST_ASSETS_VERSION = "1";
-var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
-var GUEST_KERNEL_SHA256 = {
-  x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
-};
-var GUEST_HELPER_SHA256 = {
-  x86_64: "4175e89ae8cb633113b5f69ef8b6e206093954411fe53edf86357bc1b7e822f9"
-};
-function guestAssetsPinned(arch) {
-  const zero = "0".repeat(64);
-  return GUEST_KERNEL_SHA256[arch] !== zero && GUEST_HELPER_SHA256[arch] !== zero;
-}
-
 // src/runner/image/dockerfiles.ts
 function plain(name, value, allowed) {
   if (!allowed.test(value)) throw new Error(`${name} holds a character a Dockerfile line cannot carry safely: ${JSON.stringify(value)}`);
@@ -281,6 +270,7 @@ var KEEP_BUILD_IMAGES = 3;
 var TAG_HOST = "outerlayer.invalid";
 var KEY_PREFIX = 12;
 var LOCK_NAME = "build.lock";
+var LAYOUTS_DIR = "layouts";
 function splitRepository(repository) {
   const full = repository.toLowerCase();
   const parts = full.split("/");
@@ -362,33 +352,56 @@ async function buildRepositoryImage(opts, ports) {
       (i) => i.labels[KIND2] === "build" && i.labels[RECIPE_KEY2] === rKey && i.labels[TOOLS_KEY] === tKey
     );
     const failed = (what, status) => new RecipeError("build_failed", `${what} failed (exit ${status}); the build log is at ${logPath}`, logPath);
+    let builderReady = false;
+    const ensureBuilder = async () => {
+      if (builderReady) return;
+      const builder = await host.ensureBuilder();
+      opts.log?.(`image build in builder ${builder.name} at ${builder.memory}`);
+      builderReady = true;
+    };
+    const keptLayout = join(repoRecords, LAYOUTS_DIR, rKey.slice(0, KEY_PREFIX));
+    const layoutKept = () => existsSync(join(keptLayout, "index.json"));
     let recipeImage = recipeImageBefore;
     let recipeBuilt = false;
     if (recipeImage === void 0 && buildImageBefore === void 0) {
+      await ensureBuilder();
+      mkdirSync(join(repoRecords, LAYOUTS_DIR), { recursive: true, mode: RUNNER_DIR_MODE });
       const labels = { [REPOSITORY]: repository, [KIND2]: "recipe", [RECIPE_KEY2]: rKey };
       if (location.kind === "default") {
         const context = mkdtempSync(join(scratchRoot, "ol-image-default-"));
         try {
-          const status = await host.buildDockerfile({ dockerfile: defaultText, context, tag: recipeTag, labels, logPath });
+          const status = await host.buildDockerfile({ dockerfile: defaultText, context, tag: recipeTag, labels, logPath, layoutOut: keptLayout });
           if (status !== 0) throw failed("the docker build of the default image", status);
         } finally {
           rmSync(context, { recursive: true, force: true });
         }
       } else {
         const config = writeSanitizedRecipe(checkout.dir, location, recipe);
+        const scratchLayouts = mkdtempSync(join(scratchRoot, "ol-image-layout-"));
+        const scratchLayout = join(scratchLayouts, "layout");
         try {
-          const status = await host.devcontainerBuild({ workspace: checkout.dir, config, imageName: recipeTag, labels, logPath });
+          const status = await host.devcontainerBuild({ workspace: checkout.dir, config, imageName: recipeTag, labels, logPath, layoutOut: scratchLayout });
           if (status !== 0) throw failed("devcontainer build", status);
+          if (!existsSync(join(scratchLayout, "index.json"))) throw failed("devcontainer build, which left no image to label,", 0);
+          const context = mkdtempSync(join(scratchRoot, "ol-image-label-"));
+          try {
+            const relabel = await host.buildDockerfile({
+              dockerfile: `FROM ${recipeTag}
+`,
+              context,
+              tag: recipeTag,
+              labels,
+              logPath,
+              base: { ref: recipeTag, layout: scratchLayout },
+              layoutOut: keptLayout
+            });
+            if (relabel !== 0) throw failed("labelling the recipe image", relabel);
+          } finally {
+            rmSync(context, { recursive: true, force: true });
+          }
         } finally {
           rmSync(config, { force: true });
-        }
-        const context = mkdtempSync(join(scratchRoot, "ol-image-label-"));
-        try {
-          const status = await host.buildDockerfile({ dockerfile: `FROM ${recipeTag}
-`, context, tag: recipeTag, labels, logPath });
-          if (status !== 0) throw failed("labelling the recipe image", status);
-        } finally {
-          rmSync(context, { recursive: true, force: true });
+          rmSync(scratchLayouts, { recursive: true, force: true });
         }
       }
       recipeImage = await host.inspect(recipeTag) ?? void 0;
@@ -397,6 +410,8 @@ async function buildRepositoryImage(opts, ports) {
     }
     let buildImage = buildImageBefore;
     if (buildImage === void 0) {
+      await ensureBuilder();
+      if (!layoutKept()) await host.exportLayout(recipeTag, keptLayout);
       const context = mkdtempSync(join(scratchRoot, "ol-image-tools-"));
       try {
         cpSync(opts.cli.distDir, join(context, "dist"), { recursive: true });
@@ -407,7 +422,7 @@ async function buildRepositoryImage(opts, ports) {
         }
         const dockerfile = toolsDockerfile({ recipeImage: recipeTag, nodeImage, claudeCodeVersion, buildId: opts.cli.buildId, guestHelper: opts.guestHelper !== void 0 });
         const labels = { [REPOSITORY]: repository, [KIND2]: "build", [RECIPE_KEY2]: rKey, [TOOLS_KEY]: tKey };
-        const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath });
+        const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath, base: { ref: recipeTag, layout: keptLayout } });
         if (status !== 0) throw failed("the docker build of the tools layer", status);
       } finally {
         rmSync(context, { recursive: true, force: true });
@@ -460,6 +475,9 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath) {
     rmSync(rootfsPathFor(runnerDirPath, image.id), { force: true });
     const recipeKeyLabel = image.labels[RECIPE_KEY2];
     const toolsKeyLabel = image.labels[TOOLS_KEY];
+    if (image.labels[KIND2] === "recipe" && recipeKeyLabel !== void 0) {
+      rmSync(join(repoRecords, LAYOUTS_DIR, recipeKeyLabel.slice(0, KEY_PREFIX)), { recursive: true, force: true });
+    }
     if (image.labels[KIND2] === "build" && recipeKeyLabel !== void 0 && toolsKeyLabel !== void 0) {
       rmSync(join(repoRecords, `${recipeKeyLabel.slice(0, KEY_PREFIX)}-${toolsKeyLabel.slice(0, KEY_PREFIX)}`), { recursive: true, force: true });
     }
@@ -467,4 +485,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath) {
   return removed;
 }
 
-export { CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, MICROVM_ARCHES, buildRepositoryImage, cloneRepository, firecrackerArch, guestAssetsPinned, readDefaultBranchHead };
+export { buildRepositoryImage, cloneRepository, fetchCommit, readBranchHead, readDefaultBranchHead };

package/dist/{chunk-RBOMWNOG.js → chunk-TUUMW4TC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-RZSF5B46.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-Z62HNKEJ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-CM5QTKM4.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-774HEQL6.js → chunk-U3GOI2B4.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-5TNS3PL7.js';
 import { spawn } from 'child_process';
-import { existsSync, mkdirSync, createWriteStream, readFileSync } from 'fs';
+import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { createRequire as createRequire$1 } from 'module';
 import { fileURLToPath } from 'url';
@@ -48,7 +49,9 @@ function devcontainerBuildInvocation(cli, req) {
       req.imageName,
       ...Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
       "--log-format",
-      "text"
+      "text",
+      // Written as an OCI layout instead of loaded into Docker: the runner's builder cannot read Docker's image store, so the next layer starts FROM the layout.
+      ...req.layoutOut === void 0 ? [] : ["--output", `type=oci,dest=${req.layoutOut},tar=false`]
     ]
   };
 }
@@ -69,6 +72,14 @@ var CHILD_ENVIRONMENT_NAMES = [
   "DOCKER_TLS_VERIFY",
   "DOCKER_API_VERSION",
   "DOCKER_BUILDKIT",
+  // `docker buildx build` fetches registry tokens in the client and hands them to the builder, so a host that reaches
+  // registries through a proxy needs it here as well as in the builder.
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
   "XDG_RUNTIME_DIR",
   "XDG_CONFIG_HOME",
   "XDG_DATA_HOME",
@@ -103,6 +114,7 @@ var spawnRun = (command, args, opts = {}) => new Promise((resolve) => {
     if (extra) log.write(extra);
     log.end(() => resolve(result));
   };
+  let timer;
   const child = spawn(command, args, {
     env: { ...childEnvironment(process.env), ...opts.env },
     stdio: [opts.input === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
@@ -115,9 +127,20 @@ var spawnRun = (command, args, opts = {}) => new Promise((resolve) => {
     stderr += chunk.toString();
     log?.write(chunk);
   });
+  if (opts.timeoutMs !== void 0) {
+    timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(124, `${command}: no answer within ${Math.round(opts.timeoutMs / 1e3)}s
+`);
+    }, opts.timeoutMs);
+    timer.unref();
+  }
   child.on("error", (err) => finish(127, `${command}: ${err.message}
 `));
-  child.on("close", (code, signal) => finish(code ?? (signal ? 128 : 1)));
+  child.on("close", (code, signal) => {
+    if (timer !== void 0) clearTimeout(timer);
+    finish(code ?? (signal ? 128 : 1));
+  });
   if (opts.input !== void 0) {
     child.stdin.on("error", () => void 0);
     child.stdin.end(opts.input);
@@ -127,9 +150,28 @@ function toInfo(row) {
   return { id: row.Id, createdAt: row.Created, labels: row.Config?.Labels ?? {} };
 }
 var lines = (text) => [...new Set(text.split("\n").map((l) => l.trim()).filter(Boolean))];
+function layoutDigest(layout) {
+  const index = JSON.parse(readFileSync(join(layout, "index.json"), "utf8"));
+  const digest = index.manifests?.[0]?.digest;
+  if (digest === void 0) throw new Error(`${join(layout, "index.json")} lists no image`);
+  return digest;
+}
+function outOfMemory(builder, logPath) {
+  return new RecipeError(
+    "image_build_out_of_memory",
+    `the image build ran out of memory: the kernel stopped a build step at the limit of runner.build.memory (${builder.memory}). Raise runner.build.memory, or lower what the recipe's build steps use; the build log is at ${logPath}`,
+    logPath
+  );
+}
 function createDockerHost(deps = {}) {
   const run = deps.run ?? spawnRun;
   const cli = deps.cli ?? resolveDevcontainerCli;
+  const builderFor = () => {
+    if (deps.builder === void 0) {
+      throw new Error("no image builder is configured, so the image build was not started: every image build runs in the runner's builder, which carries runner.build.memory");
+    }
+    return deps.builder;
+  };
   const inspectMany = async (refs) => {
     const result = await run("docker", ["image", "inspect", ...refs]);
     return result.status === 0 ? JSON.parse(result.stdout).map(toInfo) : [];
@@ -156,17 +198,58 @@ function createDockerHost(deps = {}) {
       if (containers.length === 0) return [];
       return lines((await run("docker", ["inspect", "--format", "{{.Image}}", ...containers])).stdout);
     },
+    async ensureBuilder() {
+      const builder = builderFor();
+      const result = await ensureBuilder(run, builder, { waitForIdle: true, replaceStale: deps.replaceStaleBuilder });
+      if (!result.ok) throw new RecipeError("image_builder_unavailable", `the image builder is unavailable: ${result.problem}`);
+      return { name: builder.name, memory: builder.memory };
+    },
+    async exportLayout(ref, dir) {
+      rmSync(dir, { recursive: true, force: true });
+      mkdirSync(dir, { recursive: true });
+      const archive = join(dir, ".image.tar");
+      const saved = await run("docker", ["save", "--output", archive, ref]);
+      if (saved.status !== 0) throw new Error(saved.stderr.trim() || `docker save ${ref} exited ${saved.status}`);
+      const unpacked = await run("tar", ["-xf", archive, "-C", dir]);
+      rmSync(archive, { force: true });
+      if (unpacked.status !== 0) throw new Error(unpacked.stderr.trim() || `tar exited ${unpacked.status}`);
+    },
     async buildDockerfile(req) {
+      const builder = builderFor();
+      if (req.layoutOut !== void 0) {
+        rmSync(req.layoutOut, { recursive: true, force: true });
+      }
       const labels = Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
-      const result = await run("docker", ["build", "--tag", req.tag, ...labels, "--file", "-", req.context], {
-        logPath: req.logPath,
-        input: req.dockerfile
-      });
+      const args = [
+        "buildx",
+        "build",
+        "--builder",
+        builder.name,
+        "--load",
+        ...req.layoutOut === void 0 ? [] : ["--output", `type=oci,dest=${req.layoutOut},tar=false`],
+        ...req.base === void 0 ? [] : ["--build-context", `${req.base.ref}=oci-layout://${req.base.layout}@${layoutDigest(req.base.layout)}`],
+        "--tag",
+        req.tag,
+        ...labels,
+        "--file",
+        "-",
+        req.context
+      ];
+      const result = await trackImageBuild(() => run("docker", args, { logPath: req.logPath, input: req.dockerfile }));
+      if (result.status !== 0 && isOutOfMemory(`${result.stdout}
+${result.stderr}`)) throw outOfMemory(builder, req.logPath);
       return result.status;
     },
     async devcontainerBuild(req) {
+      const builder = builderFor();
       const { command, args } = devcontainerBuildInvocation(cli(), req);
-      return (await run(command, args, { logPath: req.logPath })).status;
+      if (req.layoutOut !== void 0) {
+        rmSync(req.layoutOut, { recursive: true, force: true });
+      }
+      const result = await trackImageBuild(() => run(command, args, { logPath: req.logPath, env: { BUILDX_BUILDER: builder.name } }));
+      if (result.status !== 0 && isOutOfMemory(`${result.stdout}
+${result.stderr}`)) throw outOfMemory(builder, req.logPath);
+      return result.status;
     },
     async remove(id) {
       const result = await run("docker", ["rmi", id]);