@outerlayer/cli 0.7.0 → 0.8.1

package/dist/{chunk-774HEQL6.js → chunk-TEKZRTM3.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-2BRSMBBB.js';
 import { spawn } from 'child_process';
-import { existsSync, mkdirSync, createWriteStream, readFileSync } from 'fs';
+import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { createRequire as createRequire$1 } from 'module';
 import { fileURLToPath } from 'url';
@@ -48,7 +49,9 @@ function devcontainerBuildInvocation(cli, req) {
       req.imageName,
       ...Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
       "--log-format",
-      "text"
+      "text",
+      // Written as an OCI layout instead of loaded into Docker: the runner's builder cannot read Docker's image store, so the next layer starts FROM the layout.
+      ...req.layoutOut === void 0 ? [] : ["--output", `type=oci,dest=${req.layoutOut},tar=false`]
     ]
   };
 }
@@ -69,6 +72,14 @@ var CHILD_ENVIRONMENT_NAMES = [
   "DOCKER_TLS_VERIFY",
   "DOCKER_API_VERSION",
   "DOCKER_BUILDKIT",
+  // `docker buildx build` fetches registry tokens in the client and hands them to the builder, so a host that reaches
+  // registries through a proxy needs it here as well as in the builder.
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
   "XDG_RUNTIME_DIR",
   "XDG_CONFIG_HOME",
   "XDG_DATA_HOME",
@@ -103,6 +114,7 @@ var spawnRun = (command, args, opts = {}) => new Promise((resolve) => {
     if (extra) log.write(extra);
     log.end(() => resolve(result));
   };
+  let timer;
   const child = spawn(command, args, {
     env: { ...childEnvironment(process.env), ...opts.env },
     stdio: [opts.input === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
@@ -115,9 +127,20 @@ var spawnRun = (command, args, opts = {}) => new Promise((resolve) => {
     stderr += chunk.toString();
     log?.write(chunk);
   });
+  if (opts.timeoutMs !== void 0) {
+    timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish(124, `${command}: no answer within ${Math.round(opts.timeoutMs / 1e3)}s
+`);
+    }, opts.timeoutMs);
+    timer.unref();
+  }
   child.on("error", (err) => finish(127, `${command}: ${err.message}
 `));
-  child.on("close", (code, signal) => finish(code ?? (signal ? 128 : 1)));
+  child.on("close", (code, signal) => {
+    if (timer !== void 0) clearTimeout(timer);
+    finish(code ?? (signal ? 128 : 1));
+  });
   if (opts.input !== void 0) {
     child.stdin.on("error", () => void 0);
     child.stdin.end(opts.input);
@@ -127,9 +150,28 @@ function toInfo(row) {
   return { id: row.Id, createdAt: row.Created, labels: row.Config?.Labels ?? {} };
 }
 var lines = (text) => [...new Set(text.split("\n").map((l) => l.trim()).filter(Boolean))];
+function layoutDigest(layout) {
+  const index = JSON.parse(readFileSync(join(layout, "index.json"), "utf8"));
+  const digest = index.manifests?.[0]?.digest;
+  if (digest === void 0) throw new Error(`${join(layout, "index.json")} lists no image`);
+  return digest;
+}
+function outOfMemory(builder, logPath) {
+  return new RecipeError(
+    "image_build_out_of_memory",
+    `the image build ran out of memory: the kernel stopped a build step at the limit of runner.build.memory (${builder.memory}). Raise runner.build.memory, or lower what the recipe's build steps use; the build log is at ${logPath}`,
+    logPath
+  );
+}
 function createDockerHost(deps = {}) {
   const run = deps.run ?? spawnRun;
   const cli = deps.cli ?? resolveDevcontainerCli;
+  const builderFor = () => {
+    if (deps.builder === void 0) {
+      throw new Error("no image builder is configured, so the image build was not started: every image build runs in the runner's builder, which carries runner.build.memory");
+    }
+    return deps.builder;
+  };
   const inspectMany = async (refs) => {
     const result = await run("docker", ["image", "inspect", ...refs]);
     return result.status === 0 ? JSON.parse(result.stdout).map(toInfo) : [];
@@ -156,17 +198,58 @@ function createDockerHost(deps = {}) {
       if (containers.length === 0) return [];
       return lines((await run("docker", ["inspect", "--format", "{{.Image}}", ...containers])).stdout);
     },
+    async ensureBuilder() {
+      const builder = builderFor();
+      const result = await ensureBuilder(run, builder, { waitForIdle: true, replaceStale: deps.replaceStaleBuilder });
+      if (!result.ok) throw new RecipeError("image_builder_unavailable", `the image builder is unavailable: ${result.problem}`);
+      return { name: builder.name, memory: builder.memory };
+    },
+    async exportLayout(ref, dir) {
+      rmSync(dir, { recursive: true, force: true });
+      mkdirSync(dir, { recursive: true });
+      const archive = join(dir, ".image.tar");
+      const saved = await run("docker", ["save", "--output", archive, ref]);
+      if (saved.status !== 0) throw new Error(saved.stderr.trim() || `docker save ${ref} exited ${saved.status}`);
+      const unpacked = await run("tar", ["-xf", archive, "-C", dir]);
+      rmSync(archive, { force: true });
+      if (unpacked.status !== 0) throw new Error(unpacked.stderr.trim() || `tar exited ${unpacked.status}`);
+    },
     async buildDockerfile(req) {
+      const builder = builderFor();
+      if (req.layoutOut !== void 0) {
+        rmSync(req.layoutOut, { recursive: true, force: true });
+      }
       const labels = Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
-      const result = await run("docker", ["build", "--tag", req.tag, ...labels, "--file", "-", req.context], {
-        logPath: req.logPath,
-        input: req.dockerfile
-      });
+      const args = [
+        "buildx",
+        "build",
+        "--builder",
+        builder.name,
+        "--load",
+        ...req.layoutOut === void 0 ? [] : ["--output", `type=oci,dest=${req.layoutOut},tar=false`],
+        ...req.base === void 0 ? [] : ["--build-context", `${req.base.ref}=oci-layout://${req.base.layout}@${layoutDigest(req.base.layout)}`],
+        "--tag",
+        req.tag,
+        ...labels,
+        "--file",
+        "-",
+        req.context
+      ];
+      const result = await trackImageBuild(() => run("docker", args, { logPath: req.logPath, input: req.dockerfile }));
+      if (result.status !== 0 && isOutOfMemory(`${result.stdout}
+${result.stderr}`)) throw outOfMemory(builder, req.logPath);
       return result.status;
     },
     async devcontainerBuild(req) {
+      const builder = builderFor();
       const { command, args } = devcontainerBuildInvocation(cli(), req);
-      return (await run(command, args, { logPath: req.logPath })).status;
+      if (req.layoutOut !== void 0) {
+        rmSync(req.layoutOut, { recursive: true, force: true });
+      }
+      const result = await trackImageBuild(() => run(command, args, { logPath: req.logPath, env: { BUILDX_BUILDER: builder.name } }));
+      if (result.status !== 0 && isOutOfMemory(`${result.stdout}
+${result.stderr}`)) throw outOfMemory(builder, req.logPath);
+      return result.status;
     },
     async remove(id) {
       const result = await run("docker", ["rmi", id]);

package/dist/{chunk-CEBIA5FD.js → chunk-TTNFGMHO.js}

@@ -2,6 +2,7 @@
 import { createRequire } from 'node:module';
 import { startTimeOf, claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-N5FOE5PS.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-QOZKPLVJ.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, TINI_VERSION, GH_VERSION, GH_SHA256, TINI_SHA256 } from './chunk-CX22S5BA.js';
 import { withGitConfig } from './chunk-HKMPVPO7.js';
 import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
@@ -123,44 +124,6 @@ async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
   }
 }
 
-// src/runner/image/pins.ts
-var CLAUDE_CODE_VERSION = "2.1.284";
-var DEFAULT_BASE_IMAGE = "ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3";
-var NODE_IMAGE = "node:22-bookworm-slim@sha256:43ac6c60b8f89723f746e8a92ce91abd5017e627ce1ddfe4238355d3a30b772c";
-var GH_VERSION = "2.101.0";
-var GH_SHA256 = {
-  amd64: "9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8",
-  arm64: "b57e8063f18862647c9d22727c32e9da1b963f8bf9db648fe123a6975695640f"
-};
-var TINI_VERSION = "0.19.0";
-var TINI_SHA256 = {
-  amd64: "c5b0666b4cb676901f90dfcb37106783c5fe2077b04590973b885950611b30ee",
-  arm64: "eae1d3aa50c48fb23b8cbdf4e369d0910dfc538566bfd09df89a774aa84a48b9"
-};
-var MICROVM_ARCHES = ["x86_64"];
-function firecrackerArch(nodeArch) {
-  return nodeArch === "x64" ? "x86_64" : nodeArch === "arm64" ? "aarch64" : nodeArch;
-}
-var FIRECRACKER_VERSION = "1.13.1";
-var FIRECRACKER_SHA256 = {
-  x86_64: "59450b9171ff2ebdf2f9a25be3a248a7ba79fb6371aec51a9d6d8eefca7b4faf"
-};
-var FIRECRACKER_BINARY_SHA256 = {
-  x86_64: "7d3924e0c8761edafbf85cb2a94c268ffad249644a40fd02d4e15cde4c206f6e"
-};
-var GUEST_ASSETS_VERSION = "1";
-var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
-var GUEST_KERNEL_SHA256 = {
-  x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
-};
-var GUEST_HELPER_SHA256 = {
-  x86_64: "4175e89ae8cb633113b5f69ef8b6e206093954411fe53edf86357bc1b7e822f9"
-};
-function guestAssetsPinned(arch) {
-  const zero = "0".repeat(64);
-  return GUEST_KERNEL_SHA256[arch] !== zero && GUEST_HELPER_SHA256[arch] !== zero;
-}
-
 // src/runner/image/dockerfiles.ts
 function plain(name, value, allowed) {
   if (!allowed.test(value)) throw new Error(`${name} holds a character a Dockerfile line cannot carry safely: ${JSON.stringify(value)}`);
@@ -307,6 +270,7 @@ var KEEP_BUILD_IMAGES = 3;
 var TAG_HOST = "outerlayer.invalid";
 var KEY_PREFIX = 12;
 var LOCK_NAME = "build.lock";
+var LAYOUTS_DIR = "layouts";
 function splitRepository(repository) {
   const full = repository.toLowerCase();
   const parts = full.split("/");
@@ -388,33 +352,56 @@ async function buildRepositoryImage(opts, ports) {
       (i) => i.labels[KIND2] === "build" && i.labels[RECIPE_KEY2] === rKey && i.labels[TOOLS_KEY] === tKey
     );
     const failed = (what, status) => new RecipeError("build_failed", `${what} failed (exit ${status}); the build log is at ${logPath}`, logPath);
+    let builderReady = false;
+    const ensureBuilder = async () => {
+      if (builderReady) return;
+      const builder = await host.ensureBuilder();
+      opts.log?.(`image build in builder ${builder.name} at ${builder.memory}`);
+      builderReady = true;
+    };
+    const keptLayout = join(repoRecords, LAYOUTS_DIR, rKey.slice(0, KEY_PREFIX));
+    const layoutKept = () => existsSync(join(keptLayout, "index.json"));
     let recipeImage = recipeImageBefore;
     let recipeBuilt = false;
     if (recipeImage === void 0 && buildImageBefore === void 0) {
+      await ensureBuilder();
+      mkdirSync(join(repoRecords, LAYOUTS_DIR), { recursive: true, mode: RUNNER_DIR_MODE });
       const labels = { [REPOSITORY]: repository, [KIND2]: "recipe", [RECIPE_KEY2]: rKey };
       if (location.kind === "default") {
         const context = mkdtempSync(join(scratchRoot, "ol-image-default-"));
         try {
-          const status = await host.buildDockerfile({ dockerfile: defaultText, context, tag: recipeTag, labels, logPath });
+          const status = await host.buildDockerfile({ dockerfile: defaultText, context, tag: recipeTag, labels, logPath, layoutOut: keptLayout });
           if (status !== 0) throw failed("the docker build of the default image", status);
         } finally {
           rmSync(context, { recursive: true, force: true });
         }
       } else {
         const config = writeSanitizedRecipe(checkout.dir, location, recipe);
+        const scratchLayouts = mkdtempSync(join(scratchRoot, "ol-image-layout-"));
+        const scratchLayout = join(scratchLayouts, "layout");
         try {
-          const status = await host.devcontainerBuild({ workspace: checkout.dir, config, imageName: recipeTag, labels, logPath });
+          const status = await host.devcontainerBuild({ workspace: checkout.dir, config, imageName: recipeTag, labels, logPath, layoutOut: scratchLayout });
           if (status !== 0) throw failed("devcontainer build", status);
+          if (!existsSync(join(scratchLayout, "index.json"))) throw failed("devcontainer build, which left no image to label,", 0);
+          const context = mkdtempSync(join(scratchRoot, "ol-image-label-"));
+          try {
+            const relabel = await host.buildDockerfile({
+              dockerfile: `FROM ${recipeTag}
+`,
+              context,
+              tag: recipeTag,
+              labels,
+              logPath,
+              base: { ref: recipeTag, layout: scratchLayout },
+              layoutOut: keptLayout
+            });
+            if (relabel !== 0) throw failed("labelling the recipe image", relabel);
+          } finally {
+            rmSync(context, { recursive: true, force: true });
+          }
         } finally {
           rmSync(config, { force: true });
-        }
-        const context = mkdtempSync(join(scratchRoot, "ol-image-label-"));
-        try {
-          const status = await host.buildDockerfile({ dockerfile: `FROM ${recipeTag}
-`, context, tag: recipeTag, labels, logPath });
-          if (status !== 0) throw failed("labelling the recipe image", status);
-        } finally {
-          rmSync(context, { recursive: true, force: true });
+          rmSync(scratchLayouts, { recursive: true, force: true });
         }
       }
       recipeImage = await host.inspect(recipeTag) ?? void 0;
@@ -423,6 +410,8 @@ async function buildRepositoryImage(opts, ports) {
     }
     let buildImage = buildImageBefore;
     if (buildImage === void 0) {
+      await ensureBuilder();
+      if (!layoutKept()) await host.exportLayout(recipeTag, keptLayout);
       const context = mkdtempSync(join(scratchRoot, "ol-image-tools-"));
       try {
         cpSync(opts.cli.distDir, join(context, "dist"), { recursive: true });
@@ -433,7 +422,7 @@ async function buildRepositoryImage(opts, ports) {
         }
         const dockerfile = toolsDockerfile({ recipeImage: recipeTag, nodeImage, claudeCodeVersion, buildId: opts.cli.buildId, guestHelper: opts.guestHelper !== void 0 });
         const labels = { [REPOSITORY]: repository, [KIND2]: "build", [RECIPE_KEY2]: rKey, [TOOLS_KEY]: tKey };
-        const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath });
+        const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath, base: { ref: recipeTag, layout: keptLayout } });
         if (status !== 0) throw failed("the docker build of the tools layer", status);
       } finally {
         rmSync(context, { recursive: true, force: true });
@@ -486,6 +475,9 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath) {
     rmSync(rootfsPathFor(runnerDirPath, image.id), { force: true });
     const recipeKeyLabel = image.labels[RECIPE_KEY2];
     const toolsKeyLabel = image.labels[TOOLS_KEY];
+    if (image.labels[KIND2] === "recipe" && recipeKeyLabel !== void 0) {
+      rmSync(join(repoRecords, LAYOUTS_DIR, recipeKeyLabel.slice(0, KEY_PREFIX)), { recursive: true, force: true });
+    }
     if (image.labels[KIND2] === "build" && recipeKeyLabel !== void 0 && toolsKeyLabel !== void 0) {
       rmSync(join(repoRecords, `${recipeKeyLabel.slice(0, KEY_PREFIX)}-${toolsKeyLabel.slice(0, KEY_PREFIX)}`), { recursive: true, force: true });
     }
@@ -493,4 +485,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath) {
   return removed;
 }
 
-export { CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, MICROVM_ARCHES, buildRepositoryImage, cloneRepository, fetchCommit, firecrackerArch, guestAssetsPinned, readBranchHead, readDefaultBranchHead };
+export { buildRepositoryImage, cloneRepository, fetchCommit, readBranchHead, readDefaultBranchHead };

package/dist/{chunk-F6GFZXZ3.js → chunk-UXYLWVTQ.js}

@@ -3,23 +3,6 @@ import { createRequire } from 'node:module';
 
 createRequire(import.meta.url);
 
-// src/runner/container/disk.ts
-var UNITS = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 };
-function parseSize(text) {
-  const match = /^(\d+(?:\.\d+)?)([kKmMgG]?)$/.exec(text);
-  if (match === null) return void 0;
-  const bytes = Number(match[1]) * UNITS[match[2].toLowerCase()];
-  return bytes > 0 ? bytes : void 0;
-}
-function parseDuKilobytes(output) {
-  const match = /^(\d+)\s/.exec(output);
-  return match === null ? void 0 : Number(match[1]);
-}
-function exceedsDisk(usedKilobytes, limit) {
-  const bytes = parseSize(limit);
-  return usedKilobytes * 1024 > (bytes ?? Number.POSITIVE_INFINITY);
-}
-
 // src/runner/allow-hosts.ts
 var MAX_ALLOW_HOSTS = 500;
 var LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
@@ -57,4 +40,4 @@ function hostAllowed(host, allowHosts) {
   });
 }
 
-export { MAX_ALLOW_HOSTS, allowHostProblem, exceedsDisk, hostAllowed, parseDuKilobytes, parseSize };
+export { MAX_ALLOW_HOSTS, allowHostProblem, hostAllowed };

package/dist/{chunk-M5POMKKW.js → chunk-V7NIVOFD.js}

@@ -6,7 +6,7 @@ import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 
 createRequire(import.meta.url);
 
-// ../../node_modules/structured-headers/dist/util.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/util.js
 var asciiRe = /^[\x20-\x7E]*$/;
 var tokenRe = /^[a-zA-Z*][:/!#$%&'*+\-.^_`|~A-Za-z0-9]*$/;
 var keyRe = /^[a-z*][*\-_.a-z0-9]*$/;
@@ -40,7 +40,7 @@ function base64ToArrayBuffer(b64) {
   return bytes.buffer;
 }
 
-// ../../node_modules/structured-headers/dist/token.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/token.js
 var Token = class {
   constructor(value) {
     if (!isValidTokenStr(value)) {
@@ -53,7 +53,7 @@ var Token = class {
   }
 };
 
-// ../../node_modules/structured-headers/dist/displaystring.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/displaystring.js
 var DisplayString = class {
   constructor(value) {
     this.value = value;
@@ -63,7 +63,7 @@ var DisplayString = class {
   }
 };
 
-// ../../node_modules/structured-headers/dist/serializer.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/serializer.js
 var SerializeError = class extends Error {
 };
 function serializeDictionary(input) {
@@ -186,7 +186,7 @@ function serializeKey(input) {
   return input;
 }
 
-// ../../node_modules/structured-headers/dist/parser.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/parser.js
 function parseDictionary(input) {
   const parser = new Parser(input);
   return parser.parseDictionary();

package/dist/{chunk-BCLJSQCV.js → chunk-YO4PSLVB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
-import { signRunnerRequest, signerFor } from './chunk-M5POMKKW.js';
+import { signRunnerRequest, signerFor } from './chunk-V7NIVOFD.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-6QWV3YDJ.js → chunk-Z2THOHPP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-AQ54MKSQ.js';
-import { MIN_ENGINE_MAJOR } from './chunk-E4PIFIC3.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-QNRSFEGY.js';
+import { MIN_ENGINE_MAJOR } from './chunk-M4ERCYDB.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';