@outerlayer/cli 0.7.0 → 0.8.0

package/dist/{chunk-AJKEHABI.js → chunk-7VNURP6M.js}

@@ -1,21 +1,22 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-2VO25HHO.js';
+import { senderPidfile } from './chunk-3S4P55NE.js';
 import { DOCKERD_LOG } from './chunk-WVGSB3Z2.js';
-import { installScrubContext } from './chunk-6ZZHWY2Z.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, syncInContainer, formatDuration, retrySend, formatClock, containerSenderCommand, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, startCheckContainer, lifecycleSteps, lifecycleFailureReason, deleteBuildDisk, senderSignalScript } from './chunk-E4PIFIC3.js';
-import { CLAUDE_CODE_VERSION, readBranchHead, fetchCommit } from './chunk-CEBIA5FD.js';
+import { installScrubContext } from './chunk-AIL2R4SI.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, senderSignalScript } from './chunk-CM5QTKM4.js';
+import { readBranchHead, fetchCommit } from './chunk-TTNFGMHO.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-774HEQL6.js';
+import { childEnvironment } from './chunk-U3GOI2B4.js';
+import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import { waitForAgent, vmExecArgs } from './chunk-ZOAEPWGL.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-DGAIVMMN.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-5QLNZGAQ.js';
 import { planArtifactUpload } from './chunk-ZYHKJKSU.js';
-import { scrubText } from './chunk-D6FXM5OW.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-DTXOJDEH.js';
-import { parseSize } from './chunk-F6GFZXZ3.js';
-import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT } from './chunk-OD2VTIHN.js';
+import { scrubText } from './chunk-GAYWY4GI.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-PWBILI5P.js';
+import { parseSize } from './chunk-7RQ73DLO.js';
+import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment } from './chunk-OD2VTIHN.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-HKMPVPO7.js';
 import { parsePolicy } from './chunk-7ZR5UPMB.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
@@ -121,7 +122,9 @@ async function provisionMicroVm(input) {
     repository,
     imageId: report.imageId,
     containerEnv: report.apply.containerEnv,
-    builtIns: true
+    builtIns: true,
+    lifecycle: report.apply.lifecycle,
+    ...report.docker === true ? { docker: true } : {}
   };
   const env = buildEnvironment({
     config,
@@ -403,6 +406,147 @@ async function copyHookErrors(runtime, state, jobDir) {
   } catch {
   }
 }
+async function startCheckMicroVm(input) {
+  const { config, runtime, job, jobDir, tokens, log } = input;
+  const { vm } = runtime;
+  const tag = `#${job.item}`;
+  const built = job.microvm;
+  const repository = built?.repository ?? job.repository;
+  if (built === void 0 || built.imageId === void 0 || repository === void 0 || job.branch === void 0) {
+    return { ok: false, reason: "the build's image, repository or branch is not recorded" };
+  }
+  const branch = job.branch;
+  const runnerDirPath = runnerDir(config.configPath);
+  const tooDeep = socketPathProblem(buildDir(config.configPath, "0".repeat(12)));
+  if (tooDeep !== void 0) return { ok: false, reason: tooDeep };
+  const buildId = randomBytes(6).toString("hex");
+  const buildDir2 = buildDir(config.configPath, buildId);
+  const agentUser = built.agentUser ?? ADDED_USER;
+  const state = {
+    buildId,
+    buildDir: buildDir2,
+    repository,
+    imageId: built.imageId,
+    agentUser,
+    containerEnv: built.containerEnv,
+    imageEnv: built.imageEnv,
+    lifecycle: built.lifecycle,
+    ...built.docker === true ? { docker: true } : {}
+  };
+  const checksDir = join(jobDir, "checks");
+  mkdirSync(checksDir, { recursive: true });
+  const consolePath = join(checksDir, "vm-console.log");
+  input.save(state);
+  const fail = async (reason) => {
+    try {
+      await cleanupMicroVm(runtime, state);
+    } catch (err) {
+      log.error(`${tag} cleanup of the check environment failed: ${describeCallFailure(err)}`);
+    }
+    return { ok: false, reason };
+  };
+  const abandoned = () => input.aborted?.() === true;
+  const ABANDONED = "the check environment was abandoned before it was ready";
+  let assets;
+  try {
+    assets = await vm.assets(runnerDirPath);
+  } catch (err) {
+    return fail(err instanceof AssetError ? err.message : `the microVM's assets could not be had: ${describeCallFailure(err)}`);
+  }
+  if (abandoned()) return fail(ABANDONED);
+  try {
+    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: built.imageId });
+  } catch (err) {
+    return fail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
+  }
+  if (abandoned()) return fail(ABANDONED);
+  state.buildDisk = join(buildDir2, "build.ext4");
+  state.vsockPath = vsockPath(buildDir2);
+  input.save(state);
+  mkdirSync(buildDir2, { recursive: true, mode: 448 });
+  try {
+    const gitRemote = gitRemoteFor(runtime, { repository, branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`), readOnly: true });
+    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote));
+  } catch (err) {
+    return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
+  }
+  if (abandoned()) return fail(ABANDONED);
+  const limits = {
+    cpus: config.build?.cpus ?? DEFAULT_CPUS,
+    memoryBytes: parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY),
+    diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
+  };
+  const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: false });
+  const configPath = join(buildDir2, "vm.json");
+  try {
+    linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
+    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk });
+    writeFileSync(
+      configPath,
+      JSON.stringify(
+        machineConfig(limits, { kernel: assets.kernel, rootfs: state.rootfs, buildDisk: state.buildDisk, vsock: state.vsockPath, relayPorts: links.map((link) => link.port), docker: built.docker }),
+        null,
+        2
+      ),
+      { mode: 384 }
+    );
+  } catch (err) {
+    return fail(`the check environment's disk and machine could not be made: ${describeCallFailure(err)}`);
+  }
+  if (abandoned()) return fail(ABANDONED);
+  try {
+    state.cgroup = vm.cgroup.create(buildId, limits.memoryBytes);
+  } catch (err) {
+    return fail(`the check environment's memory limit could not be set: ${describeCallFailure(err)}`);
+  }
+  if (state.cgroup !== void 0) input.save(state);
+  const boot = async () => {
+    try {
+      state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath, cgroup: state.cgroup });
+    } catch (err) {
+      return `Firecracker did not start: ${describeCallFailure(err)}`;
+    }
+    input.save(state);
+    if (abandoned()) return ABANDONED;
+    const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep });
+    if (!ready) {
+      const why = vm.firecracker.alive(state.firecracker) ? "its exec agent did not answer" : "it exited before its exec agent answered";
+      return `the microVM did not start: ${why}; its console is in ${consolePath}`;
+    }
+    if (built.docker === true) return waitForDocker(runtime, state, agentUser, () => /* @__PURE__ */ new Date());
+    return void 0;
+  };
+  const failed = await boot();
+  if (failed !== void 0) return fail(failed);
+  if (abandoned()) return fail(ABANDONED);
+  const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {} });
+  return {
+    ok: true,
+    environment: {
+      state,
+      exec: async (argv, workdir, opts) => {
+        const ran = await vm.exec(state.vsockPath, { argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
+        if (opts?.logPath !== void 0) appendFileSync(opts.logPath, ran.stdout + ran.stderr);
+        return ran;
+      },
+      restart: async () => {
+        try {
+          await vm.firecracker.stop(state.firecracker);
+          rmSync(state.vsockPath, { force: true });
+          return await boot() === void 0;
+        } catch {
+          return false;
+        }
+      }
+    }
+  };
+}
+async function stopBuildMicroVm(runtime, state, jobDir) {
+  await copyHookErrors(runtime, state, jobDir);
+  if (state.firecracker === void 0) return;
+  await runtime.vm.firecracker.stop(state.firecracker);
+  if (runtime.vm.firecracker.alive(state.firecracker)) throw new Error(`the microVM (pid ${state.firecracker.pid}) is still running after it was stopped`);
+}
 async function cleanupMicroVm(runtime, state, jobDir) {
   const failures = [];
   if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
@@ -432,8 +576,8 @@ async function cleanupMicroVm(runtime, state, jobDir) {
 async function stopOrphanedMicroVms(input) {
   const stopped = [];
   for (const { job } of input.jobs) {
-    const state = job.microvm;
-    if (state === void 0) continue;
+    const states = [job.microvm, job.checkMicrovm].filter((state) => state !== void 0);
+    if (states.length === 0) continue;
     if (job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start)) {
       try {
         process.kill(-job.pid, "SIGKILL");
@@ -442,9 +586,11 @@ async function stopOrphanedMicroVms(input) {
       const deadline = Date.now() + 2e3;
       while (isSameProcess(job.pid, job.start) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 10));
     }
-    if (state.firecracker !== void 0 && input.runtime.vm.firecracker.alive(state.firecracker)) {
-      await input.runtime.vm.firecracker.stop(state.firecracker);
-      stopped.push(state.buildId);
+    for (const state of states) {
+      if (state.firecracker !== void 0 && input.runtime.vm.firecracker.alive(state.firecracker)) {
+        await input.runtime.vm.firecracker.stop(state.firecracker);
+        stopped.push(state.buildId);
+      }
     }
   }
   return stopped;
@@ -808,8 +954,8 @@ function timeoutAfter(ms, sleep) {
   return { done, cancel: () => clearTimeout(timer) };
 }
 function noCleanEnvironment(job) {
-  const ran = job.microvm !== void 0 ? "builtin:vm" : job.build?.workDir !== void 0 ? "builtin:process" : "a provision hook of the host's own";
-  return `the host has no clean environment for checks: this build ran under ${ran}, and checks run only in a new container from a container build's image`;
+  const ran = job.build?.workDir !== void 0 ? "builtin:process" : "a provision hook of the host's own";
+  return `the host has no clean environment for checks: this build ran under ${ran}, and checks run only in a new container or microVM from a build's image`;
 }
 async function runHostChecks(input) {
   const { config, job, jobDir, deps } = input;
@@ -874,9 +1020,8 @@ async function runHostChecks(input) {
     log.error(`${tag} checks failed: ${reason}${keyTail}`);
     for (const check of checks) await record(check, "fail", reason, keyTail);
   };
-  let container;
   try {
-    if (job.container === void 0) return await failAll(noCleanEnvironment(job));
+    if (job.container === void 0 && job.microvm === void 0) return await failAll(noCleanEnvironment(job));
     if (tokens === void 0) return await failAll("the build's repository tokens are no longer held, so the branch cannot be fetched");
     const branch = job.branch;
     if (branch === void 0) return await failAll("the build pushed no branch: the claim names none");
@@ -887,8 +1032,30 @@ async function runHostChecks(input) {
     const limitMinutes = config.checks?.timeLimitMinutes ?? DEFAULT_CHECK_TIME_LIMIT_MINUTES;
     const minutes = `${limitMinutes} ${limitMinutes === 1 ? "minute" : "minutes"}`;
     const environmentLog = join(jobDir, "checks", "environment.log");
+    if (job.microvm !== void 0) {
+      if (deps.endBuildMicroVm === void 0) return await failAll("the runner has no way to stop the build's microVM, so no check environment was made");
+      try {
+        await deps.endBuildMicroVm();
+      } catch (err) {
+        return await failAll(`the build's microVM could not be stopped, so no check environment was made: ${describeCallFailure(err)}`);
+      }
+    }
+    let abandoned = false;
     const setup = async () => {
-      const started = await startCheckContainer({
+      const started = job.microvm !== void 0 ? await startCheckMicroVm({
+        config,
+        runtime,
+        job,
+        jobDir,
+        tokens,
+        log,
+        aborted: () => abandoned,
+        save: (state) => {
+          if (abandoned) return;
+          job.checkMicrovm = state;
+          writeJobFile(jobFilePath, job);
+        }
+      }) : await startCheckContainer({
         config,
         runtime,
         job,
@@ -901,8 +1068,7 @@ async function runHostChecks(input) {
         }
       });
       if (!started.ok) return `the check environment could not be made: ${started.reason}`;
-      container = started.container;
-      const made = started.container;
+      const made = "container" in started ? started.container : started.environment;
       const steps = [
         {
           argv: ["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"],
@@ -916,10 +1082,11 @@ async function runHostChecks(input) {
         }
       ];
       for (const step of steps) {
+        if (abandoned) return "the check environment setup ran out of time";
         const ran = await made.exec(step.argv, step.workdir, { logPath: environmentLog });
         if (ran.status !== 0) return `the check environment could not be prepared: ${step.failed(ran.status)}`;
       }
-      for (const step of lifecycleSteps(job.container?.lifecycle ?? {})) {
+      for (const step of lifecycleSteps((job.container ?? job.microvm)?.lifecycle ?? {})) {
         log.line(`${tag} checks lifecycle ${step.name} (${step.source})`);
         const ran = await made.exec(step.argv, CHECKOUT_DIR, { logPath: environmentLog });
         if (ran.status !== 0) return `the check environment could not be prepared: ${lifecycleFailureReason(step, ran.status)}`;
@@ -929,8 +1096,14 @@ async function runHostChecks(input) {
     const setupTimer = timeoutAfter(limitMinutes * 6e4, deps.sleep);
     let settled;
     try {
-      const outcome = await Promise.race([setup(), setupTimer.done]);
-      if (outcome === "timeout") return await failAll(`the check environment setup ran out of time after ${minutes}`, LIMIT_KEY_TAIL);
+      const outcome = await Promise.race([
+        setup().catch((err) => `the check environment could not be made: ${describeCallFailure(err)}`),
+        setupTimer.done
+      ]);
+      if (outcome === "timeout") {
+        abandoned = true;
+        return await failAll(`the check environment setup ran out of time after ${minutes}`, LIMIT_KEY_TAIL);
+      }
       settled = outcome;
     } finally {
       setupTimer.cancel();
@@ -976,12 +1149,16 @@ async function runHostChecks(input) {
   } catch (err) {
     log.error(`${tag} checks stopped: ${describeCallFailure(err)}`);
   } finally {
-    if (container !== void 0 || job.checkContainer !== void 0) {
-      const state = container?.state ?? job.checkContainer;
-      await cleanupContainer(runtime, state).catch((err) => log.error(`${tag} removing the check environment failed: ${describeCallFailure(err)}`));
+    if (job.checkContainer !== void 0) {
+      await cleanupContainer(runtime, job.checkContainer).catch((err) => log.error(`${tag} removing the check environment failed: ${describeCallFailure(err)}`));
       delete job.checkContainer;
       writeJobFile(jobFilePath, job);
     }
+    if (job.checkMicrovm !== void 0) {
+      await cleanupMicroVm(runtime, job.checkMicrovm).catch((err) => log.error(`${tag} removing the check environment failed: ${describeCallFailure(err)}`));
+      delete job.checkMicrovm;
+      writeJobFile(jobFilePath, job);
+    }
     rmSync(scratch, { recursive: true, force: true });
     if (existsSync(scratch)) log.error(`${tag} the checks' scratch directory could not be removed`);
     log.line(`${tag} checks done (${formatDuration(now().getTime() - startedMs)})`);
@@ -1461,6 +1638,36 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     job.reason = scrubReason(ending.reason, config);
     writeJobFile(jobFilePath, job);
   }
+  const uploadSessions = async (workdir) => {
+    if (job.container === void 0 && job.microvm === void 0 && job.build?.exec === void 0 && workdirProblem(workdir) !== void 0) {
+      log.line(`${tag} sync skipped: workdir ${workdir} is gone`);
+    } else if (job.itemKey === void 0) {
+      log.line(`${tag} sync skipped: the job file holds no item key`);
+    } else {
+      log.line(`${tag} sync started`);
+      const startedMs = now().getTime();
+      const sync = build !== void 0 ? await syncInContainer({ config, runtime: build.runtime, job, jobDir: jobDirPath }) : vmBuild !== void 0 ? await syncInMicroVm({ config, runtime: vmBuild.runtime, job, jobDir: jobDirPath }) : job.build?.exec !== void 0 ? await runSyncViaExec(config, job, jobDirPath, spawnFn) : await runSync(config, job.item, job.itemKey, workdir, jobDirPath, spawnFn, job.branch, job.commitIdentity?.author);
+      const took = formatDuration(now().getTime() - startedMs);
+      if (sync.ok) log.line(`${tag} sync ok (${took})`);
+      else log.error(`${tag} sync failed: ${sync.reason ?? "no reason given"} \xB7 continuing`);
+      const left = spooledArtifactIds(deps.home ?? homeFromEnv());
+      if (left.length > 0) {
+        job.spooledArtifacts = left.slice(0, MAX_NAMED_SPOOLED);
+        const named = job.spooledArtifacts.join(", ");
+        log.error(
+          `${tag} ${left.length} spooled artifact(s) not uploaded: ${named}${left.length > MAX_NAMED_SPOOLED ? `, and ${left.length - MAX_NAMED_SPOOLED} more` : ""}`
+        );
+      }
+    }
+  };
+  const endBuildMicroVm = vmBuild === void 0 ? void 0 : async () => {
+    if (job.workdir && job.sessionsSynced !== true) {
+      await uploadSessions(job.workdir);
+      job.sessionsSynced = true;
+      writeJobFile(jobFilePath, job);
+    }
+    await stopBuildMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath);
+  };
   if (job.checkContainer !== void 0 && job.checksRan === true) {
     try {
       await cleanupContainer(deps.container ?? createContainerRuntime(), job.checkContainer);
@@ -1470,6 +1677,15 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
     }
   }
+  if (job.checkMicrovm !== void 0 && job.checksRan === true) {
+    try {
+      await cleanupMicroVm(deps.container ?? createContainerRuntime(), job.checkMicrovm);
+      delete job.checkMicrovm;
+      writeJobFile(jobFilePath, job);
+    } catch (err) {
+      log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
+    }
+  }
   if (outcome === "ok" && !job.cleanupRan && job.checksRan !== true) {
     setStage(job, jobDirPath, "checks");
     job.checksRan = true;
@@ -1479,7 +1695,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
         config,
         job,
         jobDir: jobDirPath,
-        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, ...deps.hostChecks }
+        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, endBuildMicroVm, ...deps.hostChecks }
       });
     } catch (err) {
       log.error(`${tag} the host's checks stopped: ${describeCallFailure(err)} \xB7 continuing`);
@@ -1504,26 +1720,8 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   if (!job.cleanupRan) {
     if (job.workdir) {
       setStage(job, jobDirPath, "sync");
-      if (job.container === void 0 && job.microvm === void 0 && job.build?.exec === void 0 && workdirProblem(job.workdir) !== void 0) {
-        log.line(`${tag} sync skipped: workdir ${job.workdir} is gone`);
-      } else if (job.itemKey === void 0) {
-        log.line(`${tag} sync skipped: the job file holds no item key`);
-      } else {
-        log.line(`${tag} sync started`);
-        const startedMs = now().getTime();
-        const sync = build !== void 0 ? await syncInContainer({ config, runtime: build.runtime, job, jobDir: jobDirPath }) : vmBuild !== void 0 ? await syncInMicroVm({ config, runtime: vmBuild.runtime, job, jobDir: jobDirPath }) : job.build?.exec !== void 0 ? await runSyncViaExec(config, job, jobDirPath, spawnFn) : await runSync(config, job.item, job.itemKey, job.workdir, jobDirPath, spawnFn, job.branch, job.commitIdentity?.author);
-        const took = formatDuration(now().getTime() - startedMs);
-        if (sync.ok) log.line(`${tag} sync ok (${took})`);
-        else log.error(`${tag} sync failed: ${sync.reason ?? "no reason given"} \xB7 continuing`);
-        const left = spooledArtifactIds(deps.home ?? homeFromEnv());
-        if (left.length > 0) {
-          job.spooledArtifacts = left.slice(0, MAX_NAMED_SPOOLED);
-          const named = job.spooledArtifacts.join(", ");
-          log.error(
-            `${tag} ${left.length} spooled artifact(s) not uploaded: ${named}${left.length > MAX_NAMED_SPOOLED ? `, and ${left.length - MAX_NAMED_SPOOLED} more` : ""}`
-          );
-        }
-      }
+      if (job.sessionsSynced === true) log.line(`${tag} sync done before the build's microVM stopped`);
+      else await uploadSessions(job.workdir);
     }
     setStage(job, jobDirPath, "cleanup");
     try {

package/dist/{chunk-6ZZHWY2Z.js → chunk-AIL2R4SI.js}

@@ -5,7 +5,7 @@ import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-ZYHKJKSU.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-D6FXM5OW.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-GAYWY4GI.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';

package/dist/{chunk-7FTNIAHS.js → chunk-AX23QKHS.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { runnerUnit, UNIT_MARKER } from './chunk-FBTE2A2X.js';
-import { checkFit } from './chunk-OUUINEYB.js';
-import { builtinKind } from './chunk-DTXOJDEH.js';
+import { checkFit } from './chunk-JKIWMRFH.js';
+import { builtinKind } from './chunk-PWBILI5P.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
@@ -165,7 +165,11 @@ function installService(request, deps) {
 function ensureLoginTask(deps, unitName) {
   const tasks = deps.tasks;
   const name = taskNameFor(unitName);
-  const command = taskCommand(deps.distro ?? "Ubuntu");
+  if (deps.distro === void 0 || deps.distro === "") {
+    const manual2 = `from Windows, run: schtasks /Create /F /TN ${name} /SC ONLOGON /TR "${taskCommand("<distribution>")}", with the name \`wsl -l\` shows`;
+    return [`WSL_DISTRO_NAME is not set, as under sudo, so the scheduled task that starts WSL2 at login was not made: ${manual2}`];
+  }
+  const command = taskCommand(deps.distro);
   const manual = `from Windows, run: schtasks /Create /F /TN ${name} /SC ONLOGON /TR "${command}"`;
   if (tasks === void 0 || !tasks.available()) {
     return [`Windows interop is off, so the scheduled task that starts WSL2 at login was not made: ${manual}`];