@outerlayer/cli 0.7.0 → 0.8.1

package/dist/chunk-PTW6W5NR.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { currentLink } from './chunk-TI7B7UEO.js';
+import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
+import { randomBytes } from 'crypto';
+import { join, dirname, delimiter, resolve } from 'path';
+
+createRequire(import.meta.url);
+var LAUNCHER_MARKER = "# outerlayer-runner-launcher";
+var LauncherWriteError = class extends Error {
+};
+var PATH_LINE = 'export PATH="$HOME/.local/bin:$PATH"';
+var ADD_TO_PATH = `${PATH_LINE} (in ~/.profile, ~/.bashrc or your shell's startup file; the runner never edits those)`;
+function launcherPath(home) {
+  return join(home, ".local", "bin", "outerlayer");
+}
+function quoted(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function launcherText(configPath, nodePath) {
+  const entry = join(currentLink(configPath), "node_modules", "@outerlayer", "cli", "dist", "index.js");
+  return [
+    "#!/bin/sh",
+    LAUNCHER_MARKER,
+    "# Written by `outerlayer runner install`. Runs the CLI the runner's `current` link names, so a self-update changes",
+    "# what this runs without changing this file.",
+    `exec ${quoted(nodePath)} ${quoted(entry)} "$@"`,
+    ""
+  ].join("\n");
+}
+function ownerOf(path) {
+  try {
+    lstatSync(path);
+  } catch {
+    return "absent";
+  }
+  try {
+    return readFileSync(path, "utf8").includes(LAUNCHER_MARKER) ? "ours" : "foreign";
+  } catch {
+    return "foreign";
+  }
+}
+function writeLauncher(input) {
+  const path = launcherPath(input.home);
+  const text = launcherText(input.configPath, input.nodePath);
+  const owner = ownerOf(path);
+  if (owner === "foreign" && input.replace !== true) return { path, state: "foreign" };
+  if (owner === "ours" && readFileSync(path, "utf8") === text) {
+    if ((statSync(path).mode & 493) !== 493) chmodSync(path, 493);
+    return { path, state: "unchanged" };
+  }
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    const temporary = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.new`;
+    try {
+      writeFileSync(temporary, text, { mode: 493, flag: "wx" });
+      chmodSync(temporary, 493);
+      renameSync(temporary, path);
+    } catch (error) {
+      rmSync(temporary, { force: true });
+      throw error;
+    }
+  } catch (error) {
+    throw new LauncherWriteError(`cannot write the outerlayer command at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return { path, state: "written" };
+}
+function firstOnPath(PATH) {
+  for (const dir of (PATH ?? "").split(delimiter)) {
+    if (dir === "") continue;
+    const candidate = join(dir, "outerlayer");
+    try {
+      if (!statSync(candidate).isFile()) continue;
+      accessSync(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
+function sameFile(a, b) {
+  try {
+    return realpathSync(a) === realpathSync(b);
+  } catch {
+    return false;
+  }
+}
+function onPath(PATH, dir) {
+  return (PATH ?? "").split(delimiter).some((entry) => entry !== "" && resolve(entry) === resolve(dir));
+}
+function pathNotes(input) {
+  const notes = [];
+  if (input.state === "foreign") {
+    notes.push(`${input.launcher} exists and the runner did not write it, so it was left alone. Run \`outerlayer runner install --replace\` to replace it`);
+    return notes;
+  }
+  if (!onPath(input.PATH, dirname(input.launcher))) {
+    notes.push(`${dirname(input.launcher)} is not on PATH, so a shell will not find the launcher. Add it with: ${ADD_TO_PATH}`);
+    return notes;
+  }
+  const first = firstOnPath(input.PATH);
+  if (first !== void 0 && !sameFile(first, input.launcher)) {
+    notes.push(`${first} comes before ${input.launcher} on PATH, so a shell runs that one instead. Put the launcher's directory first with: ${ADD_TO_PATH}`);
+  }
+  return notes;
+}
+function launcherCheck(input) {
+  const name = "outerlayer on PATH";
+  const launcher = launcherPath(input.home);
+  if (!existsSync(launcher) || ownerOf(launcher) !== "ours") return void 0;
+  const first = firstOnPath(input.PATH);
+  if (first === void 0) {
+    return { name, status: "warn", detail: `no outerlayer is on PATH; the launcher is at ${launcher}`, fix: `add its directory to PATH: ${ADD_TO_PATH}` };
+  }
+  if (sameFile(first, launcher)) {
+    return { name, status: "pass", detail: `${launcher} is the first outerlayer on PATH, so it runs the version the runner runs` };
+  }
+  return {
+    name,
+    status: "warn",
+    detail: `${first} comes before ${launcher} on PATH, so a shell runs that one, which may not be the version the runner runs`,
+    fix: `remove ${first}, or put the launcher's directory first: ${ADD_TO_PATH}`
+  };
+}
+
+export { LauncherWriteError, launcherCheck, launcherPath, pathNotes, writeLauncher };

package/dist/{chunk-DTXOJDEH.js → chunk-PWBILI5P.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-F6GFZXZ3.js';
+import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
+import { parseSize } from './chunk-7RQ73DLO.js';
 import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-OD2VTIHN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
@@ -358,4 +359,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };

package/dist/{chunk-X2FSFU4C.js → chunk-PXFEYBDE.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-PUN7LMNS.js';
+import { autoConnect } from './chunk-4ACZCY4I.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { resolveRepoIdentity } from './chunk-D6FXM5OW.js';
+import { resolveRepoIdentity } from './chunk-GAYWY4GI.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-6IYLDODX.js → chunk-Q4432IZT.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-6QWV3YDJ.js';
-import { describeCallFailure } from './chunk-E4PIFIC3.js';
-import { WorkCommandError, getJson } from './chunk-DGAIVMMN.js';
+import { isPlaceholderCommand } from './chunk-Z2THOHPP.js';
+import { describeCallFailure } from './chunk-M4ERCYDB.js';
+import { WorkCommandError, getJson } from './chunk-KV47VQJZ.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { builtinKind } from './chunk-DTXOJDEH.js';
+import { builtinKind } from './chunk-PWBILI5P.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-OD2VTIHN.js';
-import { signerFor } from './chunk-M5POMKKW.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-AJKEHABI.js → chunk-QB5JQH5V.js}

@@ -1,26 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-2VO25HHO.js';
+import { senderPidfile } from './chunk-4FPWKV7L.js';
 import { DOCKERD_LOG } from './chunk-WVGSB3Z2.js';
-import { installScrubContext } from './chunk-6ZZHWY2Z.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, syncInContainer, formatDuration, retrySend, formatClock, containerSenderCommand, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, startCheckContainer, lifecycleSteps, lifecycleFailureReason, deleteBuildDisk, senderSignalScript } from './chunk-E4PIFIC3.js';
-import { CLAUDE_CODE_VERSION, readBranchHead, fetchCommit } from './chunk-CEBIA5FD.js';
+import { installScrubContext } from './chunk-BF4KKEFY.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, senderSignalScript } from './chunk-M4ERCYDB.js';
+import { readBranchHead, fetchCommit } from './chunk-TTNFGMHO.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-774HEQL6.js';
+import { childEnvironment } from './chunk-TEKZRTM3.js';
+import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import { waitForAgent, vmExecArgs } from './chunk-ZOAEPWGL.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-DGAIVMMN.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-KV47VQJZ.js';
 import { planArtifactUpload } from './chunk-ZYHKJKSU.js';
-import { scrubText } from './chunk-D6FXM5OW.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-DTXOJDEH.js';
-import { parseSize } from './chunk-F6GFZXZ3.js';
-import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT } from './chunk-OD2VTIHN.js';
+import { scrubText } from './chunk-GAYWY4GI.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-PWBILI5P.js';
+import { parseSize } from './chunk-7RQ73DLO.js';
+import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment } from './chunk-OD2VTIHN.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-HKMPVPO7.js';
 import { parsePolicy } from './chunk-7ZR5UPMB.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-M5POMKKW.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
 import { runnerDir, buildDir, vsockPath, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { spawn, spawnSync } from 'child_process';
@@ -42,6 +43,9 @@ var DOCKER_LOG_LINES = 20;
 var GUEST_GH_DIR = `${JOB_MOUNT}/gh`;
 var GUEST_HOOKS_DIR = `${JOB_MOUNT}/git-hooks`;
 var GUEST_CONTEXT_DIR = `${JOB_MOUNT}/context`;
+function buildMemoryBytes(config) {
+  return parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY);
+}
 function firstLine(text2) {
   return text2.trim().split("\n")[0] ?? "";
 }
@@ -121,7 +125,9 @@ async function provisionMicroVm(input) {
     repository,
     imageId: report.imageId,
     containerEnv: report.apply.containerEnv,
-    builtIns: true
+    builtIns: true,
+    lifecycle: report.apply.lifecycle,
+    ...report.docker === true ? { docker: true } : {}
   };
   const env = buildEnvironment({
     config,
@@ -163,7 +169,7 @@ async function provisionMicroVm(input) {
   if (input.aborted()) return bail("", true);
   let imageConfig;
   try {
-    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId });
+    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId, memoryBytes: buildMemoryBytes(config) });
     imageConfig = await vm.rootfs.imageConfig(report.imageId);
   } catch (err) {
     return bail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
@@ -183,14 +189,14 @@ async function provisionMicroVm(input) {
   }
   const limits = {
     cpus: config.build?.cpus ?? DEFAULT_CPUS,
-    memoryBytes: parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY),
+    memoryBytes: buildMemoryBytes(config),
     diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: true });
   const configPath = join(buildDir2, "vm.json");
   try {
     linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
-    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk });
+    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
     writeFileSync(
       configPath,
       JSON.stringify(
@@ -403,6 +409,147 @@ async function copyHookErrors(runtime, state, jobDir) {
   } catch {
   }
 }
+async function startCheckMicroVm(input) {
+  const { config, runtime, job, jobDir, tokens, log } = input;
+  const { vm } = runtime;
+  const tag = `#${job.item}`;
+  const built = job.microvm;
+  const repository = built?.repository ?? job.repository;
+  if (built === void 0 || built.imageId === void 0 || repository === void 0 || job.branch === void 0) {
+    return { ok: false, reason: "the build's image, repository or branch is not recorded" };
+  }
+  const branch = job.branch;
+  const runnerDirPath = runnerDir(config.configPath);
+  const tooDeep = socketPathProblem(buildDir(config.configPath, "0".repeat(12)));
+  if (tooDeep !== void 0) return { ok: false, reason: tooDeep };
+  const buildId = randomBytes(6).toString("hex");
+  const buildDir2 = buildDir(config.configPath, buildId);
+  const agentUser = built.agentUser ?? ADDED_USER;
+  const state = {
+    buildId,
+    buildDir: buildDir2,
+    repository,
+    imageId: built.imageId,
+    agentUser,
+    containerEnv: built.containerEnv,
+    imageEnv: built.imageEnv,
+    lifecycle: built.lifecycle,
+    ...built.docker === true ? { docker: true } : {}
+  };
+  const checksDir = join(jobDir, "checks");
+  mkdirSync(checksDir, { recursive: true });
+  const consolePath = join(checksDir, "vm-console.log");
+  input.save(state);
+  const fail = async (reason) => {
+    try {
+      await cleanupMicroVm(runtime, state);
+    } catch (err) {
+      log.error(`${tag} cleanup of the check environment failed: ${describeCallFailure(err)}`);
+    }
+    return { ok: false, reason };
+  };
+  const abandoned = () => input.aborted?.() === true;
+  const ABANDONED = "the check environment was abandoned before it was ready";
+  let assets;
+  try {
+    assets = await vm.assets(runnerDirPath);
+  } catch (err) {
+    return fail(err instanceof AssetError ? err.message : `the microVM's assets could not be had: ${describeCallFailure(err)}`);
+  }
+  if (abandoned()) return fail(ABANDONED);
+  try {
+    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: built.imageId, memoryBytes: buildMemoryBytes(config) });
+  } catch (err) {
+    return fail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
+  }
+  if (abandoned()) return fail(ABANDONED);
+  state.buildDisk = join(buildDir2, "build.ext4");
+  state.vsockPath = vsockPath(buildDir2);
+  input.save(state);
+  mkdirSync(buildDir2, { recursive: true, mode: 448 });
+  try {
+    const gitRemote = gitRemoteFor(runtime, { repository, branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`), readOnly: true });
+    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote));
+  } catch (err) {
+    return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
+  }
+  if (abandoned()) return fail(ABANDONED);
+  const limits = {
+    cpus: config.build?.cpus ?? DEFAULT_CPUS,
+    memoryBytes: buildMemoryBytes(config),
+    diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
+  };
+  const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: false });
+  const configPath = join(buildDir2, "vm.json");
+  try {
+    linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
+    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
+    writeFileSync(
+      configPath,
+      JSON.stringify(
+        machineConfig(limits, { kernel: assets.kernel, rootfs: state.rootfs, buildDisk: state.buildDisk, vsock: state.vsockPath, relayPorts: links.map((link) => link.port), docker: built.docker }),
+        null,
+        2
+      ),
+      { mode: 384 }
+    );
+  } catch (err) {
+    return fail(`the check environment's disk and machine could not be made: ${describeCallFailure(err)}`);
+  }
+  if (abandoned()) return fail(ABANDONED);
+  try {
+    state.cgroup = vm.cgroup.create(buildId, limits.memoryBytes);
+  } catch (err) {
+    return fail(`the check environment's memory limit could not be set: ${describeCallFailure(err)}`);
+  }
+  if (state.cgroup !== void 0) input.save(state);
+  const boot = async () => {
+    try {
+      state.firecracker = await vm.firecracker.spawn({ binary: assets.firecracker, configPath, consolePath, cgroup: state.cgroup });
+    } catch (err) {
+      return `Firecracker did not start: ${describeCallFailure(err)}`;
+    }
+    input.save(state);
+    if (abandoned()) return ABANDONED;
+    const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep });
+    if (!ready) {
+      const why = vm.firecracker.alive(state.firecracker) ? "its exec agent did not answer" : "it exited before its exec agent answered";
+      return `the microVM did not start: ${why}; its console is in ${consolePath}`;
+    }
+    if (built.docker === true) return waitForDocker(runtime, state, agentUser, () => /* @__PURE__ */ new Date());
+    return void 0;
+  };
+  const failed = await boot();
+  if (failed !== void 0) return fail(failed);
+  if (abandoned()) return fail(ABANDONED);
+  const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {} });
+  return {
+    ok: true,
+    environment: {
+      state,
+      exec: async (argv, workdir, opts) => {
+        const ran = await vm.exec(state.vsockPath, { argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
+        if (opts?.logPath !== void 0) appendFileSync(opts.logPath, ran.stdout + ran.stderr);
+        return ran;
+      },
+      restart: async () => {
+        try {
+          await vm.firecracker.stop(state.firecracker);
+          rmSync(state.vsockPath, { force: true });
+          return await boot() === void 0;
+        } catch {
+          return false;
+        }
+      }
+    }
+  };
+}
+async function stopBuildMicroVm(runtime, state, jobDir) {
+  await copyHookErrors(runtime, state, jobDir);
+  if (state.firecracker === void 0) return;
+  await runtime.vm.firecracker.stop(state.firecracker);
+  if (runtime.vm.firecracker.alive(state.firecracker)) throw new Error(`the microVM (pid ${state.firecracker.pid}) is still running after it was stopped`);
+}
 async function cleanupMicroVm(runtime, state, jobDir) {
   const failures = [];
   if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
@@ -432,8 +579,8 @@ async function cleanupMicroVm(runtime, state, jobDir) {
 async function stopOrphanedMicroVms(input) {
   const stopped = [];
   for (const { job } of input.jobs) {
-    const state = job.microvm;
-    if (state === void 0) continue;
+    const states = [job.microvm, job.checkMicrovm].filter((state) => state !== void 0);
+    if (states.length === 0) continue;
     if (job.pid !== void 0 && job.start !== void 0 && isSameProcess(job.pid, job.start)) {
       try {
         process.kill(-job.pid, "SIGKILL");
@@ -442,9 +589,11 @@ async function stopOrphanedMicroVms(input) {
       const deadline = Date.now() + 2e3;
       while (isSameProcess(job.pid, job.start) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 10));
     }
-    if (state.firecracker !== void 0 && input.runtime.vm.firecracker.alive(state.firecracker)) {
-      await input.runtime.vm.firecracker.stop(state.firecracker);
-      stopped.push(state.buildId);
+    for (const state of states) {
+      if (state.firecracker !== void 0 && input.runtime.vm.firecracker.alive(state.firecracker)) {
+        await input.runtime.vm.firecracker.stop(state.firecracker);
+        stopped.push(state.buildId);
+      }
     }
   }
   return stopped;
@@ -808,8 +957,8 @@ function timeoutAfter(ms, sleep) {
   return { done, cancel: () => clearTimeout(timer) };
 }
 function noCleanEnvironment(job) {
-  const ran = job.microvm !== void 0 ? "builtin:vm" : job.build?.workDir !== void 0 ? "builtin:process" : "a provision hook of the host's own";
-  return `the host has no clean environment for checks: this build ran under ${ran}, and checks run only in a new container from a container build's image`;
+  const ran = job.build?.workDir !== void 0 ? "builtin:process" : "a provision hook of the host's own";
+  return `the host has no clean environment for checks: this build ran under ${ran}, and checks run only in a new container or microVM from a build's image`;
 }
 async function runHostChecks(input) {
   const { config, job, jobDir, deps } = input;
@@ -874,9 +1023,8 @@ async function runHostChecks(input) {
     log.error(`${tag} checks failed: ${reason}${keyTail}`);
     for (const check of checks) await record(check, "fail", reason, keyTail);
   };
-  let container;
   try {
-    if (job.container === void 0) return await failAll(noCleanEnvironment(job));
+    if (job.container === void 0 && job.microvm === void 0) return await failAll(noCleanEnvironment(job));
     if (tokens === void 0) return await failAll("the build's repository tokens are no longer held, so the branch cannot be fetched");
     const branch = job.branch;
     if (branch === void 0) return await failAll("the build pushed no branch: the claim names none");
@@ -887,8 +1035,30 @@ async function runHostChecks(input) {
     const limitMinutes = config.checks?.timeLimitMinutes ?? DEFAULT_CHECK_TIME_LIMIT_MINUTES;
     const minutes = `${limitMinutes} ${limitMinutes === 1 ? "minute" : "minutes"}`;
     const environmentLog = join(jobDir, "checks", "environment.log");
+    if (job.microvm !== void 0) {
+      if (deps.endBuildMicroVm === void 0) return await failAll("the runner has no way to stop the build's microVM, so no check environment was made");
+      try {
+        await deps.endBuildMicroVm();
+      } catch (err) {
+        return await failAll(`the build's microVM could not be stopped, so no check environment was made: ${describeCallFailure(err)}`);
+      }
+    }
+    let abandoned = false;
     const setup = async () => {
-      const started = await startCheckContainer({
+      const started = job.microvm !== void 0 ? await startCheckMicroVm({
+        config,
+        runtime,
+        job,
+        jobDir,
+        tokens,
+        log,
+        aborted: () => abandoned,
+        save: (state) => {
+          if (abandoned) return;
+          job.checkMicrovm = state;
+          writeJobFile(jobFilePath, job);
+        }
+      }) : await startCheckContainer({
         config,
         runtime,
         job,
@@ -901,8 +1071,7 @@ async function runHostChecks(input) {
         }
       });
       if (!started.ok) return `the check environment could not be made: ${started.reason}`;
-      container = started.container;
-      const made = started.container;
+      const made = "container" in started ? started.container : started.environment;
       const steps = [
         {
           argv: ["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"],
@@ -916,10 +1085,11 @@ async function runHostChecks(input) {
         }
       ];
       for (const step of steps) {
+        if (abandoned) return "the check environment setup ran out of time";
         const ran = await made.exec(step.argv, step.workdir, { logPath: environmentLog });
         if (ran.status !== 0) return `the check environment could not be prepared: ${step.failed(ran.status)}`;
       }
-      for (const step of lifecycleSteps(job.container?.lifecycle ?? {})) {
+      for (const step of lifecycleSteps((job.container ?? job.microvm)?.lifecycle ?? {})) {
         log.line(`${tag} checks lifecycle ${step.name} (${step.source})`);
         const ran = await made.exec(step.argv, CHECKOUT_DIR, { logPath: environmentLog });
         if (ran.status !== 0) return `the check environment could not be prepared: ${lifecycleFailureReason(step, ran.status)}`;
@@ -929,8 +1099,14 @@ async function runHostChecks(input) {
     const setupTimer = timeoutAfter(limitMinutes * 6e4, deps.sleep);
     let settled;
     try {
-      const outcome = await Promise.race([setup(), setupTimer.done]);
-      if (outcome === "timeout") return await failAll(`the check environment setup ran out of time after ${minutes}`, LIMIT_KEY_TAIL);
+      const outcome = await Promise.race([
+        setup().catch((err) => `the check environment could not be made: ${describeCallFailure(err)}`),
+        setupTimer.done
+      ]);
+      if (outcome === "timeout") {
+        abandoned = true;
+        return await failAll(`the check environment setup ran out of time after ${minutes}`, LIMIT_KEY_TAIL);
+      }
       settled = outcome;
     } finally {
       setupTimer.cancel();
@@ -976,12 +1152,16 @@ async function runHostChecks(input) {
   } catch (err) {
     log.error(`${tag} checks stopped: ${describeCallFailure(err)}`);
   } finally {
-    if (container !== void 0 || job.checkContainer !== void 0) {
-      const state = container?.state ?? job.checkContainer;
-      await cleanupContainer(runtime, state).catch((err) => log.error(`${tag} removing the check environment failed: ${describeCallFailure(err)}`));
+    if (job.checkContainer !== void 0) {
+      await cleanupContainer(runtime, job.checkContainer).catch((err) => log.error(`${tag} removing the check environment failed: ${describeCallFailure(err)}`));
       delete job.checkContainer;
       writeJobFile(jobFilePath, job);
     }
+    if (job.checkMicrovm !== void 0) {
+      await cleanupMicroVm(runtime, job.checkMicrovm).catch((err) => log.error(`${tag} removing the check environment failed: ${describeCallFailure(err)}`));
+      delete job.checkMicrovm;
+      writeJobFile(jobFilePath, job);
+    }
     rmSync(scratch, { recursive: true, force: true });
     if (existsSync(scratch)) log.error(`${tag} the checks' scratch directory could not be removed`);
     log.line(`${tag} checks done (${formatDuration(now().getTime() - startedMs)})`);
@@ -1461,6 +1641,36 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     job.reason = scrubReason(ending.reason, config);
     writeJobFile(jobFilePath, job);
   }
+  const uploadSessions = async (workdir) => {
+    if (job.container === void 0 && job.microvm === void 0 && job.build?.exec === void 0 && workdirProblem(workdir) !== void 0) {
+      log.line(`${tag} sync skipped: workdir ${workdir} is gone`);
+    } else if (job.itemKey === void 0) {
+      log.line(`${tag} sync skipped: the job file holds no item key`);
+    } else {
+      log.line(`${tag} sync started`);
+      const startedMs = now().getTime();
+      const sync = build !== void 0 ? await syncInContainer({ config, runtime: build.runtime, job, jobDir: jobDirPath }) : vmBuild !== void 0 ? await syncInMicroVm({ config, runtime: vmBuild.runtime, job, jobDir: jobDirPath }) : job.build?.exec !== void 0 ? await runSyncViaExec(config, job, jobDirPath, spawnFn) : await runSync(config, job.item, job.itemKey, workdir, jobDirPath, spawnFn, job.branch, job.commitIdentity?.author);
+      const took = formatDuration(now().getTime() - startedMs);
+      if (sync.ok) log.line(`${tag} sync ok (${took})`);
+      else log.error(`${tag} sync failed: ${sync.reason ?? "no reason given"} \xB7 continuing`);
+      const left = spooledArtifactIds(deps.home ?? homeFromEnv());
+      if (left.length > 0) {
+        job.spooledArtifacts = left.slice(0, MAX_NAMED_SPOOLED);
+        const named = job.spooledArtifacts.join(", ");
+        log.error(
+          `${tag} ${left.length} spooled artifact(s) not uploaded: ${named}${left.length > MAX_NAMED_SPOOLED ? `, and ${left.length - MAX_NAMED_SPOOLED} more` : ""}`
+        );
+      }
+    }
+  };
+  const endBuildMicroVm = vmBuild === void 0 ? void 0 : async () => {
+    if (job.workdir && job.sessionsSynced !== true) {
+      await uploadSessions(job.workdir);
+      job.sessionsSynced = true;
+      writeJobFile(jobFilePath, job);
+    }
+    await stopBuildMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath);
+  };
   if (job.checkContainer !== void 0 && job.checksRan === true) {
     try {
       await cleanupContainer(deps.container ?? createContainerRuntime(), job.checkContainer);
@@ -1470,6 +1680,15 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
     }
   }
+  if (job.checkMicrovm !== void 0 && job.checksRan === true) {
+    try {
+      await cleanupMicroVm(deps.container ?? createContainerRuntime(), job.checkMicrovm);
+      delete job.checkMicrovm;
+      writeJobFile(jobFilePath, job);
+    } catch (err) {
+      log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
+    }
+  }
   if (outcome === "ok" && !job.cleanupRan && job.checksRan !== true) {
     setStage(job, jobDirPath, "checks");
     job.checksRan = true;
@@ -1479,7 +1698,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
         config,
         job,
         jobDir: jobDirPath,
-        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, ...deps.hostChecks }
+        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, endBuildMicroVm, ...deps.hostChecks }
       });
     } catch (err) {
       log.error(`${tag} the host's checks stopped: ${describeCallFailure(err)} \xB7 continuing`);
@@ -1504,26 +1723,8 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   if (!job.cleanupRan) {
     if (job.workdir) {
       setStage(job, jobDirPath, "sync");
-      if (job.container === void 0 && job.microvm === void 0 && job.build?.exec === void 0 && workdirProblem(job.workdir) !== void 0) {
-        log.line(`${tag} sync skipped: workdir ${job.workdir} is gone`);
-      } else if (job.itemKey === void 0) {
-        log.line(`${tag} sync skipped: the job file holds no item key`);
-      } else {
-        log.line(`${tag} sync started`);
-        const startedMs = now().getTime();
-        const sync = build !== void 0 ? await syncInContainer({ config, runtime: build.runtime, job, jobDir: jobDirPath }) : vmBuild !== void 0 ? await syncInMicroVm({ config, runtime: vmBuild.runtime, job, jobDir: jobDirPath }) : job.build?.exec !== void 0 ? await runSyncViaExec(config, job, jobDirPath, spawnFn) : await runSync(config, job.item, job.itemKey, job.workdir, jobDirPath, spawnFn, job.branch, job.commitIdentity?.author);
-        const took = formatDuration(now().getTime() - startedMs);
-        if (sync.ok) log.line(`${tag} sync ok (${took})`);
-        else log.error(`${tag} sync failed: ${sync.reason ?? "no reason given"} \xB7 continuing`);
-        const left = spooledArtifactIds(deps.home ?? homeFromEnv());
-        if (left.length > 0) {
-          job.spooledArtifacts = left.slice(0, MAX_NAMED_SPOOLED);
-          const named = job.spooledArtifacts.join(", ");
-          log.error(
-            `${tag} ${left.length} spooled artifact(s) not uploaded: ${named}${left.length > MAX_NAMED_SPOOLED ? `, and ${left.length - MAX_NAMED_SPOOLED} more` : ""}`
-          );
-        }
-      }
+      if (job.sessionsSynced === true) log.line(`${tag} sync done before the build's microVM stopped`);
+      else await uploadSessions(job.workdir);
     }
     setStage(job, jobDirPath, "cleanup");
     try {

package/dist/{chunk-AQ54MKSQ.js → chunk-QNRSFEGY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-E4PIFIC3.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CEBIA5FD.js';
+import { MIN_ENGINE_MAJOR } from './chunk-M4ERCYDB.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';