@outerlayer/cli 0.7.0 → 0.8.0

package/dist/{chunk-E4PIFIC3.js → chunk-CM5QTKM4.js}

@@ -1,24 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CEBIA5FD.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTNFGMHO.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-774HEQL6.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-U3GOI2B4.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-5TNS3PL7.js';
+import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { execCapture } from './chunk-ZOAEPWGL.js';
 import { GUEST_CID } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson } from './chunk-DGAIVMMN.js';
-import { parseDuKilobytes, hostAllowed } from './chunk-F6GFZXZ3.js';
-import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT } from './chunk-OD2VTIHN.js';
+import { WorkCommandError, postJson } from './chunk-5QLNZGAQ.js';
+import { hostAllowed } from './chunk-UXYLWVTQ.js';
+import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
+import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-OD2VTIHN.js';
 import { defaultGitRunner, materializeContext } from './chunk-5FWNEQNZ.js';
 import { readContextManifest, readSourceCache } from './chunk-ZZXLM64C.js';
 import { signingFetchFor } from './chunk-BCLJSQCV.js';
 import { signerFor } from './chunk-M5POMKKW.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, runnerDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
-import { relative, join, dirname, resolve, basename } from 'path';
-import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, realpathSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
+import { relative, join, dirname, basename } from 'path';
+import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { spawnSync, spawn } from 'child_process';
-import { createHash, randomBytes } from 'crypto';
+import { randomBytes, createHash } from 'crypto';
 import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
 import { Transform } from 'stream';
@@ -86,7 +89,7 @@ function isRetryable(err) {
 }
 async function retrySend(send, deps = {}) {
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const windowMs = deps.windowMs ?? RETRY_WINDOW_MS;
   const startedMs = now().getTime();
   let attempts = 0;
@@ -466,119 +469,6 @@ function lifecycleSteps(lifecycle) {
 function lifecycleFailureReason(step, exitCode) {
   return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
 }
-var BUILD_LABEL = "ai.outerlayer.build";
-var RUNNER_LABEL = "ai.outerlayer.runner";
-function resolvedRunnerDir(configPath) {
-  try {
-    return realpathSync(runnerDir(configPath));
-  } catch {
-    try {
-      return join(realpathSync(dirname(resolve(configPath))), "runner");
-    } catch {
-      return resolve(runnerDir(configPath));
-    }
-  }
-}
-function runnerLabelValue(configPath) {
-  return createHash("sha256").update(resolvedRunnerDir(configPath)).digest("hex").slice(0, 12);
-}
-function hardened(input) {
-  const { memory, cpus, pids } = input.limits;
-  return [
-    "--label",
-    `${BUILD_LABEL}=${input.buildId}`,
-    "--label",
-    `${RUNNER_LABEL}=${input.runnerId}`,
-    "--network",
-    "none",
-    "--cap-drop",
-    "ALL",
-    "--security-opt",
-    "no-new-privileges",
-    "--read-only",
-    "--user",
-    input.user,
-    // The same figure for swap as for memory leaves the container none.
-    "--memory",
-    memory,
-    "--memory-swap",
-    memory,
-    "--cpus",
-    String(cpus),
-    "--pids-limit",
-    String(pids)
-  ];
-}
-function mountPath(path) {
-  if (/[",]/.test(path)) throw new Error(`${path} holds a comma or a quote, which a Docker mount cannot carry; move the runner's config file`);
-  return path;
-}
-function containerRunArgs(input) {
-  return [
-    "--detach",
-    "--name",
-    input.container,
-    ...hardened(input),
-    "--mount",
-    `type=volume,src=${input.volume},dst=/build`,
-    // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
-    "--mount",
-    `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
-    "--mount",
-    `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
-    "--entrypoint",
-    "/opt/outerlayer/bin/tini",
-    input.image,
-    "--",
-    "/opt/outerlayer/bin/node",
-    "/opt/outerlayer/cli/dist/index.js",
-    "broker-relay",
-    "--port",
-    String(RELAY_PORT),
-    "--socket",
-    `${JOB_MOUNT}/tunnel.sock`,
-    ...Array.from({ length: input.destinations ?? 0 }, (_unused, index) => [
-      "--forward",
-      `${DESTINATION_BASE_PORT + index}=${JOB_MOUNT}/dest-${index}.sock`
-    ]).flat(),
-    ...input.builtIns === true ? [
-      "--forward",
-      `${GATEWAY_PORT}=${JOB_MOUNT}/${GATEWAY_SOCKET}`,
-      "--forward",
-      `${CLAUDE_PORT}=${JOB_MOUNT}/${CLAUDE_SOCKET}`
-    ] : []
-  ];
-}
-function prepareRunArgs(input) {
-  return [
-    "--rm",
-    ...hardened(input),
-    "--mount",
-    `type=volume,src=${input.volume},dst=/build`,
-    "--entrypoint",
-    "mkdir",
-    input.image,
-    "-p",
-    "-m",
-    "1777",
-    "/build/tmp",
-    "/build/home",
-    "/build/work"
-  ];
-}
-function containerExecArgs(input) {
-  const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
-  const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
-  return [
-    "-u",
-    input.user,
-    ...input.workdir === void 0 ? [] : ["-w", input.workdir],
-    ...literals,
-    ...passed,
-    input.container,
-    ...input.argv
-  ];
-}
 var AssetError = class extends Error {
   constructor(file, message) {
     super(message);
@@ -719,7 +609,7 @@ function converterArgs(dest, extra, script) {
 }
 var firstLine2 = (text) => text.trim().split("\n")[0] ?? "";
 function exportInto(container, converter) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const exporter = spawn("docker", ["export", container], { stdio: ["ignore", "pipe", "pipe"], env: childEnvironment(process.env) });
     const writer = spawn("docker", converter, { stdio: ["pipe", "ignore", "pipe"], env: childEnvironment(process.env) });
     const errors = [];
@@ -736,7 +626,7 @@ function exportInto(container, converter) {
       if (code !== 0 && failure === void 0) failure = `${name} exited ${code}`;
       exits += 1;
       if (exits < 2) return;
-      if (failure === void 0) resolve2();
+      if (failure === void 0) resolve();
       else reject(new Error(`${failure}: ${firstLine2(errors.join("\n"))}`));
     };
     exporter.once("exit", (code) => done("docker export", code));
@@ -885,7 +775,7 @@ function createFirecrackerHost(options = {}) {
         const failed = new Promise((_resolve, reject) => child.once("error", reject));
         const pid = child.pid;
         if (pid === void 0) return await failed;
-        exits.set(pid, new Promise((resolve2) => child.once("exit", () => resolve2())));
+        exits.set(pid, new Promise((resolve) => child.once("exit", () => resolve())));
         child.unref();
         const start = startTimeOf(pid);
         if (start === null) throw new Error(`${command} exited as soon as it started; its console is at ${input.consolePath}`);
@@ -902,8 +792,8 @@ function createFirecrackerHost(options = {}) {
       }
       const exited = exits.get(vm.pid);
       const deadline = Date.now() + STOP_WAIT_MS;
-      if (exited !== void 0) await Promise.race([exited, new Promise((resolve2) => setTimeout(resolve2, STOP_WAIT_MS))]);
-      while (alive(vm) && Date.now() < deadline) await new Promise((resolve2) => setTimeout(resolve2, POLL_MS));
+      if (exited !== void 0) await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, STOP_WAIT_MS))]);
+      while (alive(vm) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, POLL_MS));
       exits.delete(vm.pid);
     },
     alive
@@ -913,7 +803,7 @@ function createFirecrackerHost(options = {}) {
 // src/runner/microvm/host.ts
 function createMicroVmPorts(over = {}) {
   return {
-    assets: over.assets ?? ((runnerDir2) => ensureAssets({ runnerDir: runnerDir2 })),
+    assets: over.assets ?? ((runnerDir) => ensureAssets({ runnerDir })),
     rootfs: over.rootfs ?? createRootfsHost(),
     firecracker: over.firecracker ?? createFirecrackerHost(),
     cgroup: over.cgroup ?? realCgroupPort(),
@@ -926,6 +816,10 @@ var aborted = () => ({ ok: false, reason: "", aborted: true });
 function firstLine3(text) {
   return text.trim().split("\n")[0] ?? "";
 }
+function gitErrorLine(text) {
+  const lines = text.split("\n").map((line) => line.trim()).filter((line) => line !== "");
+  return lines.find((line) => /^(fatal|error):/.test(line)) ?? lines.at(-1) ?? "";
+}
 function adoptionFailureReason(result) {
   const line = result.stdout.trim().split("\n").at(-1) ?? "";
   try {
@@ -940,7 +834,10 @@ async function runBuildSteps(input) {
   const rewrite = await exec(["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"], "/build/work");
   if (rewrite.status !== 0) return { ok: false, reason: `configuring the build's git remote failed (exit ${rewrite.status})` };
   const clone = await exec(["git", "clone", "--filter=blob:none", "--single-branch", `https://github.com/${repository}.git`, CHECKOUT_DIR], "/build/work");
-  if (clone.status !== 0) return { ok: false, reason: `the clone of ${repository} failed (exit ${clone.status})` };
+  if (clone.status !== 0) {
+    const detail = gitErrorLine(clone.stderr);
+    return { ok: false, reason: `the clone of ${repository} failed (exit ${clone.status})${detail === "" ? "" : `: ${detail}`}` };
+  }
   try {
     const prepared = await prepareBranch({
       workdir: CHECKOUT_DIR,
@@ -1155,9 +1052,9 @@ async function git(args, cwd, env, input) {
     if (size < maxOutputBytes) out.push(chunk);
     size += chunk.length;
   });
-  const closed = new Promise((resolve2, reject) => {
+  const closed = new Promise((resolve, reject) => {
     child.once("error", reject);
-    child.once("close", (status) => resolve2(status));
+    child.once("close", (status) => resolve(status));
   });
   if (input !== void 0) {
     await pipeline(input, child.stdin).catch(() => void 0);
@@ -1354,14 +1251,14 @@ async function drain(req) {
   }
 }
 function readPrefix(req, gzip) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const held = [];
     const finish = (section) => {
       req.off("data", onData);
       req.off("end", onEnd);
       req.off("error", reject);
       req.pause();
-      resolve2({ held, section });
+      resolve({ held, section });
     };
     const onData = (chunk) => {
       held.push(chunk);
@@ -1375,19 +1272,19 @@ function readPrefix(req, gzip) {
   });
 }
 function readBody(req, limit) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const chunks = [];
     let size = 0;
     req.on("data", (chunk) => {
       size += chunk.length;
       if (size > limit) {
         req.pause();
-        resolve2(void 0);
+        resolve(void 0);
         return;
       }
       chunks.push(chunk);
     });
-    req.once("end", () => resolve2(Buffer.concat(chunks)));
+    req.once("end", () => resolve(Buffer.concat(chunks)));
     req.once("error", reject);
   });
 }
@@ -1400,7 +1297,7 @@ function createGitRemote(options) {
     const { route, res } = input;
     const url = new URL(`${gitUrl}/${route.owner}/${route.name}.git/${route.kind === "info-refs" ? "info/refs" : route.kind === "lfs-batch" ? "info/lfs/objects/batch" : `git-${route.kind}`}${route.search === "" ? "" : `?${route.search}`}`);
     const send = url.protocol === "https:" ? request$1 : request;
-    return new Promise((resolve2) => {
+    return new Promise((resolve) => {
       const upstream = send(url, { method: input.method, headers: { ...input.headers, connection: "close" } }, (answer) => {
         const headers = {};
         for (const [name, value] of Object.entries(answer.headers)) {
@@ -1422,18 +1319,18 @@ function createGitRemote(options) {
         });
         answer.once("end", () => {
           res.end();
-          resolve2();
+          resolve();
         });
         answer.once("error", () => {
           res.destroy();
-          resolve2();
+          resolve();
         });
       });
       upstream.on("error", (err) => {
         log(`could not reach GitHub for ${route.kind}: ${err.message}`);
         if (res.headersSent) res.destroy();
         else plain(res, 502, "the runner could not reach GitHub\n");
-        resolve2();
+        resolve();
       });
       res.once("close", () => upstream.destroy());
       input.feed(upstream);
@@ -1728,7 +1625,7 @@ async function startTunnel(socketPath, opts = {}) {
   if (Buffer.byteLength(socketPath) > MAX_SOCKET_PATH_BYTES) {
     throw new Error(`${socketPath} is too long for a Unix socket; keep the runner's config file nearer the root of the filesystem`);
   }
-  const resolve2 = opts.resolve ?? systemResolve;
+  const resolve = opts.resolve ?? systemResolve;
   const openConnection = opts.connect ?? ((t) => connect({ host: t.address, port: t.port }));
   const ownAddresses = opts.hostAddresses ?? systemHostAddresses;
   const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
@@ -1812,7 +1709,7 @@ async function startTunnel(socketPath, opts = {}) {
     }
     let addresses;
     try {
-      addresses = await resolve2(host);
+      addresses = await resolve(host);
     } catch {
       return { ok: false, status: 502, body: `could not resolve ${host}
 ` };
@@ -1991,13 +1888,14 @@ function createContainerRuntime(opts = {}) {
         configPath: build.configPath,
         cli: cli ?? currentCliBuild(),
         readToken: build.readToken,
-        guestHelper: build.guestHelper
+        guestHelper: build.guestHelper,
+        log: build.log
       },
-      { host: opts.imageHost ?? createDockerHost() }
+      { host: opts.imageHost ?? createDockerHost({ builder: builderSpec(build.configPath, build.buildMemory, opts.hostEnv ?? process.env) }) }
     )),
     startTunnel: opts.startTunnel ?? startTunnel,
     tunnelOptions: opts.tunnelOptions,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms))),
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
     hostEnv: opts.hostEnv ?? process.env,
     credentials: opts.credentials ?? /* @__PURE__ */ new Map(),
     github: { gitUrl: opts.github?.gitUrl ?? "https://github.com", apiUrl: opts.github?.apiUrl ?? "https://api.github.com" },
@@ -2068,7 +1966,17 @@ async function obtainImage(input) {
       };
     }
     try {
-      return { ok: true, built: await runtime.buildImage({ repository, configPath: config.configPath, readToken, guestHelper: input.guestHelper }) };
+      return {
+        ok: true,
+        built: await runtime.buildImage({
+          repository,
+          configPath: config.configPath,
+          buildMemory: config.build?.memory ?? "8g",
+          readToken,
+          guestHelper: input.guestHelper,
+          log: (line) => log.line(`${tag} ${line}`)
+        })
+      };
     } catch (err) {
       if (err instanceof RecipeError && err.code === "build_in_progress" && (input.now?.() ?? /* @__PURE__ */ new Date()).getTime() < input.deadlineMs) {
         log.line(`${tag} waiting for another build of ${repository}'s image`);
@@ -2077,7 +1985,8 @@ async function obtainImage(input) {
       }
       if (err instanceof RecipeError) {
         log.error(`${tag} image build for ${repository} failed: ${err.code}: ${err.message}`);
-        return { ok: false, reason: err.code };
+        const says = err.code === "image_build_out_of_memory" || err.code === "image_builder_unavailable";
+        return { ok: false, reason: says ? err.message : err.code };
       }
       return { ok: false, reason: `the image build failed: ${describeCallFailure(err)}` };
     }
@@ -2474,4 +2383,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BUILD_LABEL, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, RUNNER_LABEL, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, runnerLabelValue, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };

package/dist/chunk-CX22S5BA.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/image/pins.ts
+var CLAUDE_CODE_VERSION = "2.1.284";
+var DEFAULT_BASE_IMAGE = "ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3";
+var NODE_IMAGE = "node:22-bookworm-slim@sha256:43ac6c60b8f89723f746e8a92ce91abd5017e627ce1ddfe4238355d3a30b772c";
+var BUILDKIT_IMAGE = "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea";
+var GH_VERSION = "2.101.0";
+var GH_SHA256 = {
+  amd64: "9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8",
+  arm64: "b57e8063f18862647c9d22727c32e9da1b963f8bf9db648fe123a6975695640f"
+};
+var TINI_VERSION = "0.19.0";
+var TINI_SHA256 = {
+  amd64: "c5b0666b4cb676901f90dfcb37106783c5fe2077b04590973b885950611b30ee",
+  arm64: "eae1d3aa50c48fb23b8cbdf4e369d0910dfc538566bfd09df89a774aa84a48b9"
+};
+var MICROVM_ARCHES = ["x86_64"];
+function firecrackerArch(nodeArch) {
+  return nodeArch === "x64" ? "x86_64" : nodeArch === "arm64" ? "aarch64" : nodeArch;
+}
+var FIRECRACKER_VERSION = "1.13.1";
+var FIRECRACKER_SHA256 = {
+  x86_64: "59450b9171ff2ebdf2f9a25be3a248a7ba79fb6371aec51a9d6d8eefca7b4faf"
+};
+var FIRECRACKER_BINARY_SHA256 = {
+  x86_64: "7d3924e0c8761edafbf85cb2a94c268ffad249644a40fd02d4e15cde4c206f6e"
+};
+var GUEST_ASSETS_VERSION = "1";
+var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
+var GUEST_KERNEL_SHA256 = {
+  x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
+};
+var GUEST_HELPER_SHA256 = {
+  x86_64: "4175e89ae8cb633113b5f69ef8b6e206093954411fe53edf86357bc1b7e822f9"
+};
+function guestAssetsPinned(arch) {
+  const zero = "0".repeat(64);
+  return GUEST_KERNEL_SHA256[arch] !== zero && GUEST_HELPER_SHA256[arch] !== zero;
+}
+
+export { BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, MICROVM_ARCHES, NODE_IMAGE, TINI_SHA256, TINI_VERSION, firecrackerArch, guestAssetsPinned };

package/dist/{chunk-D6FXM5OW.js → chunk-GAYWY4GI.js}

@@ -21970,14 +21970,14 @@ var ModelRegistryImpl = class {
 };
 var models_default = {
   version: "1.0.0",
-  generatedAt: "2026-10-04T05:04:28.506Z",
+  generatedAt: "2026-10-05T04:49:52.578Z",
   sources: {
     litellm: {
-      fetchedAt: "2026-10-04T05:04:28.506Z",
+      fetchedAt: "2026-10-05T04:49:52.578Z",
       modelCount: 1887
     },
     openrouter: {
-      fetchedAt: "2026-10-04T05:04:28.506Z",
+      fetchedAt: "2026-10-05T04:49:52.578Z",
       modelCount: 198
     }
   },
@@ -43490,12 +43490,12 @@ var models_default = {
         "top_p"
       ],
       pricing: {
-        inputCostPerToken: 25e-8,
-        outputCostPerToken: 1e-6
+        inputCostPerToken: 29e-8,
+        outputCostPerToken: 114e-8
       },
       context: {
         maxInputTokens: 163840,
-        maxOutputTokens: 147456
+        maxOutputTokens: 115200
       },
       capabilities: {
         functionCalling: true,
@@ -52756,8 +52756,8 @@ var models_default = {
         "max_tokens"
       ],
       pricing: {
-        inputCostPerToken: 4e-6,
-        outputCostPerToken: 2e-5
+        inputCostPerToken: 2e-6,
+        outputCostPerToken: 1e-5
       },
       context: {
         maxInputTokens: 105e4,

package/dist/{chunk-AII7CKTH.js → chunk-IJBVPLZZ.js}

@@ -1,21 +1,22 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
-import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-TI7B7UEO.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-AJKEHABI.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-7VNURP6M.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
 import { RUNNER_PROTOCOL } from './chunk-AIW6GLET.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-6IYLDODX.js';
+import { placeholderQueues, placeholderProblem } from './chunk-IRCBTGWF.js';
+import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { checkFit } from './chunk-OUUINEYB.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock, runnerLabelValue, BUILD_LABEL, RUNNER_LABEL } from './chunk-E4PIFIC3.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-CM5QTKM4.js';
+import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-774HEQL6.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DGAIVMMN.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-DTXOJDEH.js';
-import { exceedsDisk } from './chunk-F6GFZXZ3.js';
+import { spawnRun } from './chunk-U3GOI2B4.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-5TNS3PL7.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-5QLNZGAQ.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-PWBILI5P.js';
+import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-OD2VTIHN.js';
 import { parseClaimIdentity } from './chunk-HKMPVPO7.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -37,7 +38,7 @@ function openKvm() {
   }
 }
 function realBlockedProbes() {
-  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem };
+  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown" };
 }
 var DEFAULT_BUILD_MEMORY = "8g";
 function checkBlocked(config, probes) {
@@ -61,6 +62,13 @@ function checkBlocked(config, probes) {
       reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
     };
   }
+  if (kind === "container" || kind === "vm") {
+    const builder = probes.imageBuilder;
+    if (builder === "unknown") {
+      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
+    }
+    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
+  }
   if (kind !== "own" && claudeCredential(probes.env) === void 0) {
     return {
       reason: "there is no Claude credential in the runner's environment. Put CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY in the runner.env beside the config, then restart the service"
@@ -671,8 +679,9 @@ function createHousekeepingDocker(deps) {
       if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
     },
     async builderPrune(keepBytes) {
-      const result = await run("docker", ["builder", "prune", "--force", "--keep-storage", String(keepBytes)]);
-      if (result.status !== 0) throw failure(result, "docker builder prune");
+      const result = await run("docker", ["buildx", "prune", "--builder", deps.builder, "--force", "--max-used-space", String(keepBytes)]);
+      if (result.status !== 0 && /no builder .* found/i.test(result.stderr)) return { freedBytes: 0 };
+      if (result.status !== 0) throw failure(result, "docker buildx prune");
       return { freedBytes: parsePrunedBytes(result.stdout) };
     }
   };
@@ -843,7 +852,7 @@ async function runHousekeeping(options) {
       try {
         const pruned = await docker.builderPrune(options.buildCacheMax);
         freed += pruned.freedBytes;
-        log.line(`housekeeping: pruned the build cache down to ${formatBytes(options.buildCacheMax)}, freed ${formatBytes(pruned.freedBytes)}`);
+        log.line(`housekeeping: pruned the image builder's build cache down to ${formatBytes(options.buildCacheMax)}, freed ${formatBytes(pruned.freedBytes)}`);
       } catch (err) {
         log.error(`housekeeping: the build cache could not be pruned: ${describeCallFailure(err)}`);
       }
@@ -1137,10 +1146,39 @@ async function tick(state) {
   }
   await sendTickHeartbeat(state, state.lastWorkRequest);
 }
+function imageBuilderState(state) {
+  const kind = builtinKind(state.config.hooks.provision);
+  if (kind !== "container" && kind !== "vm") return "usable";
+  if (state.deps.container?.buildImage !== void 0 || state.deps.container?.imageHost !== void 0) return "usable";
+  const memory = state.config.build?.memory ?? "8g";
+  let probe = state.imageBuilder;
+  if (probe === void 0 || probe.memory !== memory) probe = state.imageBuilder = { memory, at: 0, running: false };
+  if (probe.result?.ok === true && !probe.running && probe.failures !== void 0 && ensureFailureCount() !== probe.failures) probe.result = void 0;
+  const nowMs = nowOf(state).getTime();
+  const recheckMs = 10 * 6e4;
+  const due = !probe.running && (probe.result === void 0 || !probe.result.ok || nowMs - probe.at >= recheckMs);
+  if (due) {
+    const checking = probe;
+    checking.running = true;
+    const spec = builderSpec(state.config.configPath, memory, state.deps.container?.hostEnv ?? process.env);
+    const check = state.deps.builderProbe ?? ((s) => ensureBuilder(spawnRun, s, { bootstrap: true }));
+    void check(spec).catch((err) => ({ ok: false, problem: `the image builder could not be checked: ${describeCallFailure(err)}` })).then((result2) => {
+      checking.result = result2;
+      checking.failures = ensureFailureCount();
+      checking.at = nowOf(state).getTime();
+      checking.running = false;
+      if (result2.ok && state.blocked !== void 0 && state.pollTimerSeconds !== void 0) void tick(state);
+    });
+  }
+  const result = probe.result;
+  if (result === void 0) return "unknown";
+  return result.ok ? "usable" : { problem: result.problem };
+}
 function holdWhenBlocked(state) {
   const probes = {
     ...realBlockedProbes(),
     ...state.deps.container?.hostEnv === void 0 ? {} : { env: state.deps.container.hostEnv },
+    ...state.deps.blocked?.imageBuilder === void 0 ? { imageBuilder: imageBuilderState(state) } : {},
     ...state.deps.blocked
   };
   const blocked = checkBlocked(state.config, probes);
@@ -1194,7 +1232,7 @@ async function housekeepingPass(state) {
   state.housekeepingRunning = true;
   try {
     state.deps.housekeeping ??= {};
-    state.deps.housekeeping.docker ??= createHousekeepingDocker({ runnerId: runnerLabelValue(state.config.configPath) });
+    state.deps.housekeeping.docker ??= createHousekeepingDocker({ runnerId: runnerLabelValue(state.config.configPath), builder: builderName(state.config.configPath) });
     const result = await runHousekeeping({
       configPath: state.config.configPath,
       keepDays: config.jobsKeepDays,
@@ -1268,7 +1306,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-6UMCFTAW.js');
+  const { postJson: postJson2 } = await import('./work-cmd-B3FOXZAL.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1992,7 +2030,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-ASZL5BEO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-FOF3PUKI.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-SSU747O6.js → chunk-ILEA3YHM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { remoteLookupFailed } from './chunk-D6FXM5OW.js';
+import { remoteLookupFailed } from './chunk-GAYWY4GI.js';
 import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';

package/dist/{chunk-6IYLDODX.js → chunk-IRCBTGWF.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-6QWV3YDJ.js';
-import { describeCallFailure } from './chunk-E4PIFIC3.js';
-import { WorkCommandError, getJson } from './chunk-DGAIVMMN.js';
+import { isPlaceholderCommand } from './chunk-NALVDFIS.js';
+import { describeCallFailure } from './chunk-CM5QTKM4.js';
+import { WorkCommandError, getJson } from './chunk-5QLNZGAQ.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { builtinKind } from './chunk-DTXOJDEH.js';
+import { builtinKind } from './chunk-PWBILI5P.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-OD2VTIHN.js';
 import { signerFor } from './chunk-M5POMKKW.js';