@outerlayer/cli 0.8.0 → 0.8.2

package/dist/{chunk-CM5QTKM4.js → chunk-EQG7L6LM.js}

@@ -1,26 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTNFGMHO.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-Y7UQHKFY.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-U3GOI2B4.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-NPBLDMSD.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-5TNS3PL7.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-CLURXEWV.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
-import { execCapture } from './chunk-ZOAEPWGL.js';
-import { GUEST_CID } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson } from './chunk-5QLNZGAQ.js';
+import { execCapture } from './chunk-HWMYGAKF.js';
+import { GUEST_CID } from './chunk-2E2MG3KW.js';
+import { WorkCommandError, postJson } from './chunk-R5SPFO6F.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-HN2JBGSI.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
-import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-OD2VTIHN.js';
-import { defaultGitRunner, materializeContext } from './chunk-5FWNEQNZ.js';
-import { readContextManifest, readSourceCache } from './chunk-ZZXLM64C.js';
-import { signingFetchFor } from './chunk-BCLJSQCV.js';
-import { signerFor } from './chunk-M5POMKKW.js';
+import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-2FWL7CE2.js';
+import { defaultGitRunner, materializeContext } from './chunk-NACLOOXP.js';
+import { readContextManifest, readSourceCache } from './chunk-ZJ3WRVRG.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-CMFCCIQN.js';
+import { signingFetchFor } from './chunk-YO4PSLVB.js';
+import { downconvertSession } from './chunk-YNJEOGDL.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, basename } from 'path';
 import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { spawnSync, spawn } from 'child_process';
+import { availableParallelism, networkInterfaces } from 'os';
 import { randomBytes, createHash } from 'crypto';
 import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
@@ -29,7 +33,6 @@ import { pipeline, finished } from 'stream/promises';
 import { createGunzip, gunzipSync, constants as constants$1 } from 'zlib';
 import { isIP, connect, createServer as createServer$1 } from 'net';
 import { lookup } from 'dns/promises';
-import { networkInterfaces } from 'os';
 
 createRequire(import.meta.url);
 function logStamp(at) {
@@ -430,7 +433,11 @@ async function prepareBranch(opts) {
     throw new BranchPrepareError(`the pull request's branch ${branch} is not on the remote`);
   }
   await mustGit(git2, workdir, `checking out ${branch}`, ["checkout", "--quiet", "-B", branch, start]);
-  return { branch, head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]) };
+  return {
+    branch,
+    head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]),
+    startCommit: await mustGit(git2, workdir, `reading the commit of ${defaultBranch}`, ["rev-parse", `origin/${defaultBranch}`])
+  };
 }
 async function isMerged(git2, workdir, branch, defaultBranch) {
   const result = await git2(workdir, ["merge-base", "--is-ancestor", `origin/${branch}`, `origin/${defaultBranch}`]);
@@ -469,6 +476,63 @@ function lifecycleSteps(lifecycle) {
 function lifecycleFailureReason(step, exitCode) {
   return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
 }
+function parseCpuList(text) {
+  const cores = /* @__PURE__ */ new Set();
+  for (const part of text.trim().split(",")) {
+    const match = /^(\d+)(?:-(\d+))?$/.exec(part.trim());
+    if (match === null) return void 0;
+    const low = Number(match[1]);
+    const high = match[2] === void 0 ? low : Number(match[2]);
+    if (high < low) return void 0;
+    for (let core = low; core <= high; core++) cores.add(core);
+  }
+  return [...cores].sort((a, b) => a - b);
+}
+function formatCpuList(cores) {
+  const sorted = [...new Set(cores)].sort((a, b) => a - b);
+  const parts = [];
+  for (let i = 0; i < sorted.length; i++) {
+    const start = sorted[i];
+    while (sorted[i + 1] === sorted[i] + 1) i++;
+    parts.push(start === sorted[i] ? String(start) : `${start}-${sorted[i]}`);
+  }
+  return parts.join(",");
+}
+function usableCpus(deps = {}) {
+  try {
+    const status = (deps.readStatus ?? (() => readFileSync("/proc/self/status", "utf8")))();
+    const cores = parseCpuList(/^Cpus_allowed_list:\s*(.+)$/m.exec(status)?.[1] ?? "");
+    if (cores !== void 0) return cores;
+  } catch {
+  }
+  return Array.from({ length: Math.max(1, (deps.parallelism ?? availableParallelism)()) }, (_unused, core) => core);
+}
+function createCpuAllocator(cores) {
+  const usable = [...new Set(cores)].sort((a, b) => a - b);
+  const held = /* @__PURE__ */ new Map();
+  const holders = (core) => {
+    let count = 0;
+    for (const set of held.values()) if (set.includes(core)) count++;
+    return count;
+  };
+  return {
+    acquire(buildId, cpus) {
+      const existing = held.get(buildId);
+      if (existing !== void 0) return existing;
+      const wanted = Math.min(Math.ceil(cpus), usable.length);
+      const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
+      const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
+      held.set(buildId, chosen);
+      return chosen;
+    },
+    hold(buildId, set) {
+      held.set(buildId, [...set]);
+    },
+    release(buildId) {
+      held.delete(buildId);
+    }
+  };
+}
 var AssetError = class extends Error {
   constructor(file, message) {
     super(message);
@@ -583,7 +647,7 @@ function templateScript() {
   ].join("\n");
 }
 var ids = () => ({ uid: String(process.getuid?.() ?? 0), gid: String(process.getgid?.() ?? 0) });
-function converterArgs(dest, extra, script) {
+function converterArgs(dest, memoryBytes, extra, script) {
   const { uid, gid } = ids();
   return [
     "run",
@@ -591,6 +655,10 @@ function converterArgs(dest, extra, script) {
     "-i",
     "--network",
     "none",
+    "--memory",
+    String(memoryBytes),
+    "--memory-swap",
+    String(memoryBytes),
     "--mount",
     `type=bind,src=${dirname(dest)},dst=/out`,
     "-e",
@@ -636,18 +704,18 @@ function exportInto(container, converter) {
 function createRootfsHost() {
   const env = () => childEnvironment(process.env);
   return {
-    async convert({ imageId, dest }) {
+    async convert({ imageId, dest, memoryBytes }) {
       const created = await spawnRun("docker", ["create", imageId, "none"], { env: env() });
       if (created.status !== 0) throw new Error(`docker create ${imageId} failed: ${firstLine2(created.stderr)}`);
       const container = created.stdout.trim();
       try {
-        await exportInto(container, converterArgs(dest, [], converterScript()));
+        await exportInto(container, converterArgs(dest, memoryBytes, [], converterScript()));
       } finally {
         await spawnRun("docker", ["rm", "--force", "--volumes", container], { env: env() });
       }
     },
-    async makeTemplate({ bytes, dest }) {
-      const made = await spawnRun("docker", converterArgs(dest, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
+    async makeTemplate({ bytes, dest, memoryBytes }) {
+      const made = await spawnRun("docker", converterArgs(dest, memoryBytes, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
       if (made.status !== 0) throw new Error(`making the empty build disk failed: ${firstLine2(made.stderr)}`);
     },
     async imageConfig(imageId) {
@@ -696,14 +764,14 @@ async function ensureRootfs(input) {
   const path = rootfsPathFor(input.runnerDir, input.imageId);
   if (existsSync(path)) return path;
   const { uid, gid } = ids();
-  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid) }));
+  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
   return path;
 }
 async function createBuildDisk(input) {
   const template = join(diskTemplatesDir(input.runnerDir), `${input.bytes}.ext4`);
   if (!existsSync(template)) {
     const { uid, gid } = ids();
-    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid) }));
+    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
   }
   mkdirSync(dirname(input.dest), { recursive: true });
   if (input.host.copyTemplate) input.host.copyTemplate(template, input.dest);
@@ -831,6 +899,7 @@ function adoptionFailureReason(result) {
 }
 async function runBuildSteps(input) {
   const { exec, log, tag, repository } = input;
+  let startCommit = "";
   const rewrite = await exec(["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"], "/build/work");
   if (rewrite.status !== 0) return { ok: false, reason: `configuring the build's git remote failed (exit ${rewrite.status})` };
   const clone = await exec(["git", "clone", "--filter=blob:none", "--single-branch", `https://github.com/${repository}.git`, CHECKOUT_DIR], "/build/work");
@@ -847,6 +916,7 @@ async function runBuildSteps(input) {
         return { status: ran.status, stdout: ran.stdout.trim(), stderr: ran.stderr.trim() };
       }
     });
+    startCommit = prepared.startCommit;
     log.line(`${tag} on ${prepared.branch} at ${prepared.head.slice(0, 8)}`);
   } catch (err) {
     if (err instanceof BranchPrepareError) return { ok: false, reason: err.message };
@@ -873,7 +943,200 @@ async function runBuildSteps(input) {
     }
     if (input.aborted()) return aborted();
   }
-  return { ok: true };
+  return { ok: true, startCommit };
+}
+var EVAL_INPUT_NAME = "eval-input";
+var TRANSCRIPT_ROOT = "/build/home/.claude/projects";
+var MAX_TRANSCRIPT_BYTES = 7 * 1024 * 1024;
+var MAX_TRANSCRIPTS = 500;
+var MAX_TOTAL_TRANSCRIPT_BYTES = 64 * 1024 * 1024;
+var TRANSCRIPT_COPY_MS = 2 * 60 * 1e3;
+var BUILD_HOME = "/build/home";
+function firstLine4(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+async function copyTranscripts(run, now = Date.now) {
+  const deadline = now() + TRANSCRIPT_COPY_MS;
+  let listed;
+  try {
+    listed = await run(["find", TRANSCRIPT_ROOT, "-type", "f", "-name", "*.jsonl", "-print0"]);
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+  if (listed.status !== 0 && !/No such file or directory/.test(listed.stderr)) {
+    return { ok: false, reason: `listing the transcripts failed (exit ${listed.status})${firstLine4(listed.stderr) === "" ? "" : `: ${firstLine4(listed.stderr)}`}` };
+  }
+  const paths = listed.stdout.split("\0").filter((entry) => entry.startsWith(`${TRANSCRIPT_ROOT}/`) && !entry.includes("\n") && !entry.slice(TRANSCRIPT_ROOT.length + 1).split("/").includes("..")).map((entry) => entry.slice(TRANSCRIPT_ROOT.length + 1)).sort();
+  const copied = [];
+  const missed = [];
+  let total = 0;
+  for (const [index, path] of paths.entries()) {
+    if (index >= MAX_TRANSCRIPTS) {
+      missed.push({ path, reason: `the build wrote more than ${MAX_TRANSCRIPTS} transcripts` });
+      continue;
+    }
+    if (now() >= deadline) {
+      missed.push({ path, reason: `copying the transcripts took longer than ${TRANSCRIPT_COPY_MS / 1e3} seconds` });
+      continue;
+    }
+    try {
+      const read = await run(["head", "-c", String(MAX_TRANSCRIPT_BYTES + 1), `${TRANSCRIPT_ROOT}/${path}`]);
+      if (read.status !== 0) missed.push({ path, reason: `reading it failed (exit ${read.status})${firstLine4(read.stderr) === "" ? "" : `: ${firstLine4(read.stderr)}`}` });
+      else if (Buffer.byteLength(read.stdout) > MAX_TRANSCRIPT_BYTES) missed.push({ path, reason: `it is larger than ${MAX_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
+      else if (total + Buffer.byteLength(read.stdout) > MAX_TOTAL_TRANSCRIPT_BYTES) missed.push({ path, reason: `copying it would take the transcripts past ${MAX_TOTAL_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
+      else {
+        total += Buffer.byteLength(read.stdout);
+        copied.push({ path, content: read.stdout });
+      }
+    } catch (err) {
+      missed.push({ path, reason: describeCallFailure(err) });
+    }
+  }
+  return { ok: true, copied, missed };
+}
+function traceIdForSession(sessionId) {
+  const stripped = sessionId.replace(/-/g, "").toLowerCase();
+  if (/^[0-9a-f]{32}$/.test(stripped)) return stripped;
+  return createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
+}
+function sessionOptionsOf(path) {
+  const segments = path.split("/");
+  const stem = (segments.at(-1) ?? path).replace(/\.jsonl$/, "");
+  const at = segments.lastIndexOf("subagents");
+  if (at <= 0) return { fallbackId: stem };
+  const parent = segments[at - 1];
+  return {
+    fallbackId: stem,
+    isSubagent: true,
+    ...parent ? { parentSessionId: parent } : {},
+    ownId: stem,
+    ...segments[at + 1] === "workflows" && segments[at + 2] ? { workflowRunId: segments[at + 2] } : {}
+  };
+}
+function scrubbing(scrub, author, work) {
+  setCustomScrubbers(scrub, () => void 0);
+  setLocalIdentity({ home: BUILD_HOME, ...author?.name === void 0 ? {} : { name: author.name }, ...author?.email === void 0 ? {} : { email: author.email } });
+  setRepoRoot(CHECKOUT_DIR);
+  try {
+    return work();
+  } finally {
+    setCustomScrubbers(void 0, () => void 0);
+    setLocalIdentity({});
+    setRepoRoot(void 0);
+  }
+}
+function scrubLine(line) {
+  try {
+    return JSON.stringify(scrubDeep(JSON.parse(line)));
+  } catch {
+    return scrubText(line);
+  }
+}
+function writeReadOnly(path, text) {
+  writeFileSync(path, text);
+  chmodSync(path, 292);
+}
+function diffBase(job) {
+  const recorded = (job.container ?? job.microvm)?.startCommit;
+  if (recorded !== void 0 && recorded !== "") return { commit: recorded, source: "build" };
+  const recipe = job.environment?.recipe?.sourceCommit;
+  return recipe === void 0 || recipe === "" ? void 0 : { commit: recipe, source: "recipe" };
+}
+async function writeEvalInput(request) {
+  const { job, dir, log } = request;
+  const tag = `#${job.item}`;
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(join(dir, "sessions"), { recursive: true });
+  chmodSync(dir, 493);
+  chmodSync(join(dir, "sessions"), 493);
+  let workItem;
+  try {
+    const data = await request.readWorkItem();
+    writeReadOnly(join(dir, "work-item.json"), `${JSON.stringify(data, null, 2)}
+`);
+    workItem = { status: "written" };
+  } catch (err) {
+    workItem = { status: "unavailable", reason: describeCallFailure(err) };
+    log.error(`${tag} the work item could not be read for the checks' input: ${workItem.reason}`);
+  }
+  const patch = join(dir, "diff.patch");
+  const base = diffBase(job);
+  let diff;
+  if (base === void 0) {
+    diff = { status: "unavailable", reason: "the build recorded no commit it started from" };
+  } else {
+    const fetched = await request.fetchDiff({ remote: request.remote, dir: join(request.scratch, "diff"), base: base.commit, head: request.branchHead, token: request.readToken, output: patch });
+    diff = fetched.ok ? { status: "written", base: base.commit, head: request.branchHead, baseSource: base.source } : { status: "unavailable", base: base.commit, head: request.branchHead, baseSource: base.source, reason: fetched.reason };
+    if (!fetched.ok) log.error(`${tag} the diff could not be read for the checks' input: ${fetched.reason}`);
+  }
+  if (diff.status === "unavailable") writeFileSync(patch, "");
+  chmodSync(patch, 292);
+  const sessions = [];
+  const parsed = [];
+  const copiedByTrace = /* @__PURE__ */ new Map();
+  let sessionsUnavailable;
+  if (!request.transcripts.ok) {
+    sessionsUnavailable = request.transcripts.reason;
+    log.error(`${tag} the sessions could not be copied for the checks' input: ${sessionsUnavailable}`);
+  } else {
+    const { copied, missed } = request.transcripts;
+    scrubbing(request.scrub, request.job.commitIdentity?.author, () => {
+      for (const transcript of copied) {
+        const options = sessionOptionsOf(transcript.path);
+        const subagent = options.isSubagent === true;
+        const stem = options.fallbackId ?? transcript.path;
+        let session = null;
+        try {
+          session = parseTranscript(transcript.content, options).session;
+        } catch {
+        }
+        const traceId = traceIdForSession(session?.id ?? stem);
+        if (session === null) {
+          sessions.push({ traceId, subagent, status: "missing", reason: "the transcript holds no session" });
+          log.error(`${tag} the transcript ${transcript.path} holds no session, so the checks' input leaves it out`);
+          continue;
+        }
+        const kept = copiedByTrace.get(traceId);
+        if (kept !== void 0) {
+          kept.duplicates = (kept.duplicates ?? 0) + 1;
+          log.error(`${tag} the transcript ${transcript.path} repeats session ${traceId}, so the checks' input leaves it out`);
+          continue;
+        }
+        const file = `sessions/${traceId}.jsonl`;
+        const text = transcript.content.split("\n").filter((line) => line.trim() !== "").map(scrubLine).join("\n");
+        writeReadOnly(join(dir, file), `${text}
+`);
+        scrubDeep(session);
+        parsed.push({ session: downconvertSession(session, "full"), traceId, subagent });
+        const entry = { traceId, subagent, file, status: "copied" };
+        copiedByTrace.set(traceId, entry);
+        sessions.push(entry);
+      }
+      for (const miss of missed) {
+        const options = sessionOptionsOf(miss.path);
+        sessions.push({ traceId: traceIdForSession(options.fallbackId ?? miss.path), subagent: options.isSubagent === true, status: "missing", reason: miss.reason });
+        log.error(`${tag} the transcript ${miss.path} could not be copied for the checks' input: ${miss.reason}`);
+      }
+    });
+  }
+  const ordered = orderSessions(parsed.map((entry) => entry.session));
+  const traceOf = new Map(parsed.map((entry) => [entry.session.id, entry.traceId]));
+  const facts = extractFacts(sessionsToTimeline(parsed.map((entry) => entry.session)));
+  const traceAt = (index) => traceOf.get(ordered[index].id);
+  const recorded = { commands: facts.coverage.has("commands"), edits: facts.coverage.has("edits") };
+  const activity = {
+    schemaVersion: 1,
+    sessions: sessions.sort((a, b) => a.traceId.localeCompare(b.traceId)),
+    // Left out of the file when undefined.
+    sessionsUnavailable,
+    workItem,
+    diff,
+    recorded,
+    commands: recorded.commands ? facts.runs.map((run) => ({ seq: run.seq, traceId: traceAt(run.sessionIndex), turn: run.turnIndex, command: run.normalized, kind: run.kind, status: run.status })) : null,
+    edits: recorded.edits ? facts.edits.map((edit) => ({ seq: edit.seq, traceId: traceAt(edit.sessionIndex), turn: edit.turnIndex, file: edit.file, status: edit.status })) : null
+  };
+  writeReadOnly(join(dir, "activity.json"), `${JSON.stringify(activity, null, 2)}
+`);
 }
 
 // src/runner/container/agent-user.ts
@@ -1880,6 +2143,7 @@ function createContainerRuntime(opts = {}) {
   const { cli, remoteFor } = opts;
   return {
     host: opts.host ?? createContainerHost(),
+    cpus: opts.cpus ?? createCpuAllocator(usableCpus()),
     tunnels: opts.tunnels ?? /* @__PURE__ */ new Map(),
     buildImage: opts.buildImage ?? ((build) => buildRepositoryImage(
       {
@@ -1934,7 +2198,7 @@ function gitRemoteFor(runtime, input) {
     ...input.readOnly === true ? { readOnly: true } : {}
   });
 }
-function firstLine4(text) {
+function firstLine5(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 var NO_ENV = { literals: {}, passed: {} };
@@ -2027,7 +2291,8 @@ async function provisionContainer(input) {
     imageId: report.imageId,
     containerEnv: report.apply.containerEnv,
     builtIns: true,
-    lifecycle: report.apply.lifecycle
+    lifecycle: report.apply.lifecycle,
+    cpuset: formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4))
   };
   const env = buildEnvironment({
     config,
@@ -2058,7 +2323,7 @@ async function provisionContainer(input) {
     }
     return aborted2 ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(reason);
   };
-  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`);
+  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`);
   if (input.aborted()) return bail("", true);
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
@@ -2079,7 +2344,7 @@ async function provisionContainer(input) {
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset: state.cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
@@ -2143,6 +2408,7 @@ async function provisionContainer(input) {
     removeStagedContext: () => removeStagedContext(buildDir2)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
+  state.startCommit = steps.startCommit;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
 function agentVersionOf(toolsJson) {
@@ -2278,6 +2544,18 @@ async function syncInContainer(input) {
     return { ok: false, reason: describeCallFailure(err) };
   }
 }
+async function copyTranscriptsFromContainer(runtime, state) {
+  try {
+    if (state.stopped) {
+      const started = await runtime.host.start(state.container);
+      if (started.status !== 0) return { ok: false, reason: `the build's container could not be started again (exit ${started.status})` };
+      state.stopped = false;
+    }
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+  return copyTranscripts((argv) => runtime.host.exec({ container: state.container, user: state.agentUser ?? ADDED_USER, env: NO_ENV, argv }));
+}
 var HOOK_ERRORS_IN_CONTAINER = "/build/home/.outerlayer/spool/hook-errors.log";
 async function copyHookErrors(runtime, state, jobDir) {
   try {
@@ -2310,6 +2588,7 @@ async function cleanupContainer(runtime, state, jobDir) {
     await tunnel.close();
   }
   rmSync(state.buildDir, { recursive: true, force: true });
+  runtime.cpus.release(state.buildId);
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 async function startCheckContainer(input) {
@@ -2325,7 +2604,8 @@ async function startCheckContainer(input) {
   const name = `outerlayer-check-${buildId}`;
   const buildDir2 = buildDir(config.configPath, buildId);
   const agentUser = built.agentUser ?? ADDED_USER;
-  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, agentUser };
+  const cpuset = built.cpuset ?? formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4));
+  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, agentUser, cpuset };
   const checksDir = join(jobDir, "checks");
   mkdirSync(checksDir, { recursive: true });
   const logPath = join(checksDir, "environment.log");
@@ -2338,7 +2618,7 @@ async function startCheckContainer(input) {
     }
     return { ok: false, reason };
   };
-  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`);
+  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`);
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
   try {
@@ -2347,7 +2627,7 @@ async function startCheckContainer(input) {
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the check environment's volume", volume);
@@ -2373,6 +2653,8 @@ async function startCheckContainer(input) {
     ok: true,
     container: {
       state,
+      // The directory the container sees read-only at `JOB_MOUNT` is the build's directory on the host, so a folder written there is already in place.
+      evalInput: { dir: join(buildDir2, EVAL_INPUT_NAME), deliver: async () => void 0 },
       exec: (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env, argv }, opts?.logPath === void 0 ? void 0 : { logPath: opts.logPath }),
       restart: async () => {
         await host.stop(name);
@@ -2383,4 +2665,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BuildTokens, EVAL_INPUT_NAME, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };

package/dist/{chunk-OEK4JEB3.js → chunk-ERI5GBNI.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { writeLauncher, LauncherWriteError, pathNotes, launcherPath } from './chunk-PTW6W5NR.js';
-import { isInLayout, packageRootIn, versionDir, switchCurrent, currentLink, execStartLine } from './chunk-TI7B7UEO.js';
+import { compareVersions } from './chunk-I2UOAV7X.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-PTW6W5NR.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-TI7B7UEO.js';
 import { RUNNER_DIR_MODE } from './chunk-ZM2IMMYN.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
@@ -9,6 +10,8 @@ import { dirname, sep, join } from 'path';
 createRequire(import.meta.url);
 var RunnerInstallError = class extends Error {
 };
+var RunnerDowngradeError = class extends RunnerInstallError {
+};
 function runRunnerInstall(args) {
   const { configPath, nodePath } = args;
   let entry;
@@ -32,6 +35,13 @@ function runRunnerInstall(args) {
   if (manifest.name !== "@outerlayer/cli") throw new RunnerInstallError(`${packageRoot} is not the @outerlayer/cli package`);
   const version = manifest.version;
   if (typeof version !== "string" || version === "") throw new RunnerInstallError(`${packageRoot}/package.json has no version`);
+  const installed = currentVersion(configPath);
+  if (args.allowDowngrade !== true && installed !== void 0 && (compareVersions(version, installed) ?? 0) < 0) {
+    const command = args.command ?? "runner install";
+    throw new RunnerDowngradeError(
+      `this CLI is ${version}, older than ${installed}, the version the runner runs from ${currentLink(configPath)}. Installing it would move the runner back to ${version}. Run \`${launcherPath(args.home)} ${command}\` instead, which runs ${installed}. To install ${version} anyway, run \`outerlayer ${command} --allow-downgrade\``
+    );
+  }
   if (!isInLayout(configPath, entry) && !sameBuildInstalled(packageRoot, packageRootIn(versionDir(configPath, version)))) {
     const target = packageRootIn(versionDir(configPath, version));
     mkdirSync(dirname(target), { recursive: true, mode: RUNNER_DIR_MODE });
@@ -49,6 +59,7 @@ function runRunnerInstall(args) {
   }
   return {
     version,
+    previous: installed,
     execStart: execStartLine(configPath, nodePath),
     launcher: {
       path: launcherPath(args.home),
@@ -79,5 +90,9 @@ function launcherSummary(launcher) {
   if (launcher.state === "foreign") return void 0;
   return `${launcher.state === "unchanged" ? "outerlayer command already at" : "wrote the outerlayer command at"} ${launcher.path}, which runs the CLI that ${launcher.follows} names`;
 }
+function restartNote(result) {
+  if (result.previous === void 0 || result.previous === result.version) return void 0;
+  return `current moved from ${result.previous} to ${result.version}: a runner its service started takes no new work, waits for its running builds to finish, then restarts on ${result.version}. A runner started by hand keeps running until you restart it`;
+}
 
-export { RunnerInstallError, launcherSummary, runRunnerInstall };
+export { RunnerDowngradeError, RunnerInstallError, launcherSummary, restartNote, runRunnerInstall };

package/dist/{chunk-ILEA3YHM.js → chunk-EWBM2USM.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { remoteLookupFailed } from './chunk-GAYWY4GI.js';
+import { remoteLookupFailed } from './chunk-HN2JBGSI.js';
 import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
-import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { createInterface } from 'readline/promises';

package/dist/{chunk-EV3M3EH7.js → chunk-G54QHBTI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-7ZR5UPMB.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-JXH6LEEH.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-CMFCCIQN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-M3SQ4YGD.js → chunk-GXSMDL4M.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-VXLJORHL.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-JXH6LEEH.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-GAYWY4GI.js → chunk-HN2JBGSI.js}

@@ -21663,6 +21663,7 @@ function buildTokenPricingDictionary(models) {
 }
 var CACHE_CREATE_1H_INPUT_MULTIPLIER = 2;
 var isCount = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
+var tokensOf = (n) => isCount(n) ? n : 0;
 var hasTokens = (usage) => isCount(usage.in) || isCount(usage.out) || isCount(usage.cacheRead) || isCount(usage.cacheCreate5m) || isCount(usage.cacheCreate1h);
 function selectRates(price, context = {}) {
   var _a5, _b, _c;
@@ -21704,7 +21705,7 @@ function priceUsage(usage, price, context = {}) {
   if (isCount(usage.cacheCreate5m) && rates.cacheCreate === void 0) unpriced.push("cacheCreate5m");
   if (unpriced.length > 0) return { costUsd: null, unpricedClasses: unpriced };
   return {
-    costUsd: rates.in * usage.in + rates.out * usage.out + ((_a5 = rates.cacheRead) != null ? _a5 : 0) * usage.cacheRead + ((_b = rates.cacheCreate) != null ? _b : 0) * usage.cacheCreate5m + ((_c = rates.cacheCreate1h) != null ? _c : rates.in * CACHE_CREATE_1H_INPUT_MULTIPLIER) * usage.cacheCreate1h
+    costUsd: rates.in * tokensOf(usage.in) + rates.out * tokensOf(usage.out) + ((_a5 = rates.cacheRead) != null ? _a5 : 0) * tokensOf(usage.cacheRead) + ((_b = rates.cacheCreate) != null ? _b : 0) * tokensOf(usage.cacheCreate5m) + ((_c = rates.cacheCreate1h) != null ? _c : rates.in * CACHE_CREATE_1H_INPUT_MULTIPLIER) * tokensOf(usage.cacheCreate1h)
   };
 }
 function priceBuckets(buckets, dict) {

package/dist/{chunk-ZOAEPWGL.js → chunk-HWMYGAKF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-R7STSBLC.js';
+import { EXEC_PORT } from './chunk-2E2MG3KW.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);