@redwoodjs/agent-ci 0.5.0 → 0.7.0

package/README.md

@@ -42,6 +42,24 @@ Agent CI connects to Docker via the `DOCKER_HOST` environment variable. By defau
 DOCKER_HOST=ssh://user@remote-server npx agent-ci run --workflow .github/workflows/ci.yml
 ```
 
+### Docker host resolution for job containers
+
+By default, Agent CI uses `host.docker.internal` for container-to-host DTU traffic and adds a default Docker host mapping:
+
+- `host.docker.internal:host-gateway`
+
+This keeps behavior OS-agnostic and works on Docker Desktop and modern native Docker.
+
+If your setup is custom, use environment overrides:
+
+- `AGENT_CI_DTU_HOST` - override the hostname/IP used by runner containers to reach DTU
+- `AGENT_CI_DOCKER_EXTRA_HOSTS` - comma-separated `host:ip` entries passed to Docker `ExtraHosts` (full replacement for defaults)
+- `AGENT_CI_DOCKER_HOST_GATEWAY` - override the default `host-gateway` token/IP for automatic mapping
+- `AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS=1` - disable the default `host.docker.internal` mapping
+- `AGENT_CI_DOCKER_BRIDGE_GATEWAY` - fallback gateway IP used when Agent CI runs inside Docker and cannot detect its container IP, and as an explicit DTU host override outside Docker when `AGENT_CI_DTU_HOST` is not set
+
+When using a remote daemon (`DOCKER_HOST=ssh://...`), `host-gateway` resolves relative to the remote Docker host. If DTU is not reachable from that host, set `AGENT_CI_DTU_HOST` and `AGENT_CI_DOCKER_EXTRA_HOSTS` explicitly for your network.
+
 ### `agent-ci run`
 
 Run GitHub Actions workflow jobs locally.

package/dist/cli.js

@@ -21,6 +21,7 @@ import { renderRunState } from "./output/state-renderer.js";
 import { isAgentMode, setQuietMode } from "./output/agent-mode.js";
 import logUpdate from "log-update";
 import { createFailedJobResult, wrapJobError, isJobError } from "./runner/job-result.js";
+import { postCommitStatus } from "./commit-status.js";
 function findSignalsDir(runnerName) {
     const workDir = getWorkingDirectory();
     const runsDir = path.resolve(workDir, "runs");
@@ -129,8 +130,11 @@ async function run() {
                 pauseOnFailure,
                 noMatrix,
             });
-            printSummary(results);
-            const anyFailed = results.some((r) => !r.succeeded);
+            if (results.length > 0) {
+                printSummary(results);
+            }
+            postCommitStatus(results, sha);
+            const anyFailed = results.length === 0 || results.some((r) => !r.succeeded);
             process.exit(anyFailed ? 1 : 0);
         }
         if (!workflow) {
@@ -161,8 +165,11 @@ async function run() {
             pauseOnFailure,
             noMatrix,
         });
-        printSummary(results);
-        if (results.some((r) => !r.succeeded)) {
+        if (results.length > 0) {
+            printSummary(results);
+        }
+        postCommitStatus(results, sha);
+        if (results.length === 0 || results.some((r) => !r.succeeded)) {
             process.exit(1);
         }
         process.exit(0);

package/dist/commit-status.js

@@ -0,0 +1,48 @@
+import { execSync } from "child_process";
+import { config } from "./config.js";
+/**
+ * Post a GitHub commit status via the `gh` CLI.
+ * Silently skips if `gh` is not available on PATH.
+ */
+export function postCommitStatus(results, sha) {
+    // Check if gh CLI is available
+    try {
+        execSync("which gh", { stdio: "ignore" });
+    }
+    catch {
+        return;
+    }
+    const resolvedSha = sha ||
+        (() => {
+            try {
+                return execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
+            }
+            catch {
+                return undefined;
+            }
+        })();
+    if (!resolvedSha) {
+        return;
+    }
+    const repo = config.GITHUB_REPO;
+    if (repo === "unknown/unknown") {
+        return;
+    }
+    const passed = results.filter((r) => r.succeeded).length;
+    const total = results.length;
+    const allPassed = passed === total;
+    const state = allPassed ? "success" : "failure";
+    const description = allPassed
+        ? `"It works on my machine!"`
+        : `${passed}/${total} jobs passed, ${total - passed} failed`;
+    try {
+        execSync(`gh api repos/${repo}/statuses/${resolvedSha} ` +
+            `-f state=${state} ` +
+            `-f context=agent-ci ` +
+            `-f description=${JSON.stringify(description)} ` +
+            `-f target_url=https://agent-ci.dev`, { stdio: "ignore" });
+    }
+    catch {
+        // gh command failed (e.g. no auth, no network) — skip silently
+    }
+}

package/dist/docker/container-config.js

@@ -44,10 +44,10 @@ export function buildContainerBinds(opts) {
         ...(signalsDir ? [`${h(signalsDir)}:/tmp/agent-ci-signals`] : []),
         `${h(diagDir)}:/home/runner/_diag`,
         `${h(toolCacheDir)}:/opt/hostedtoolcache`,
-        // Package manager caches (persist across runs)
-        `${h(pnpmStoreDir)}:/home/runner/_work/.pnpm-store`,
-        `${h(npmCacheDir)}:/home/runner/.npm`,
-        `${h(bunCacheDir)}:/home/runner/.bun/install/cache`,
+        // Package manager caches (persist across runs, only for detected PM)
+        ...(pnpmStoreDir ? [`${h(pnpmStoreDir)}:/home/runner/_work/.pnpm-store`] : []),
+        ...(npmCacheDir ? [`${h(npmCacheDir)}:/home/runner/.npm`] : []),
+        ...(bunCacheDir ? [`${h(bunCacheDir)}:/home/runner/.bun/install/cache`] : []),
         `${h(playwrightCacheDir)}:/home/runner/.cache/ms-playwright`,
         // Warm node_modules: mounted outside the workspace so actions/checkout can
         // delete the symlink without EBUSY. A symlink in the entrypoint points
@@ -97,32 +97,74 @@ export function buildContainerCmd(opts) {
 // ─── DTU host resolution ──────────────────────────────────────────────────────
 import fs from "fs";
 import { execSync } from "child_process";
-/**
- * Resolve the DTU host address that nested Docker containers can reach.
- * Inside Docker: use the container's own bridge IP.
- * On host: use `host.docker.internal`.
- */
-export function resolveDtuHost() {
-    const isInsideDocker = fs.existsSync("/.dockerenv");
-    if (!isInsideDocker) {
-        return "host.docker.internal";
+import { debugRunner } from "../output/debug.js";
+const DEFAULT_DTU_HOST_ALIAS = "host.docker.internal";
+const DEFAULT_DOCKER_BRIDGE_GATEWAY = "172.17.0.1";
+const DEFAULT_DOCKER_HOST_GATEWAY = "host-gateway";
+function isLoopbackHostname(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function parseCsvEnv(value) {
+    return value
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+export async function resolveDtuHost() {
+    const configuredHost = process.env.AGENT_CI_DTU_HOST?.trim();
+    if (configuredHost) {
+        return configuredHost;
     }
-    try {
-        const ip = execSync("hostname -I 2>/dev/null | awk '{print $1}'", {
-            encoding: "utf8",
-        }).trim();
-        if (ip) {
-            return ip;
+    const isInsideDocker = fs.existsSync("/.dockerenv");
+    if (isInsideDocker) {
+        try {
+            const ip = execSync("hostname -I 2>/dev/null | awk '{print $1}'", {
+                encoding: "utf8",
+            }).trim();
+            if (ip) {
+                return ip;
+            }
         }
+        catch (error) {
+            debugRunner(`Failed to resolve Docker bridge IP via hostname -I: ${String(error)}`);
+        }
+        return process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY?.trim() || DEFAULT_DOCKER_BRIDGE_GATEWAY;
+    }
+    const configuredGateway = process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY?.trim();
+    if (configuredGateway) {
+        debugRunner(`Using configured bridge gateway '${configuredGateway}' for DTU host outside Docker`);
+        return configuredGateway;
+    }
+    return DEFAULT_DTU_HOST_ALIAS;
+}
+export function resolveDockerExtraHosts(dtuHost) {
+    const configuredExtraHosts = process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+    if (configuredExtraHosts !== undefined) {
+        const parsed = parseCsvEnv(configuredExtraHosts);
+        return parsed.length > 0 ? parsed : undefined;
     }
-    catch { }
-    return "172.17.0.1"; // fallback to bridge gateway
+    if (process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS === "1") {
+        return undefined;
+    }
+    if (dtuHost !== DEFAULT_DTU_HOST_ALIAS) {
+        return undefined;
+    }
+    const gateway = process.env.AGENT_CI_DOCKER_HOST_GATEWAY?.trim() || DEFAULT_DOCKER_HOST_GATEWAY;
+    return [`${DEFAULT_DTU_HOST_ALIAS}:${gateway}`];
 }
 /**
  * Rewrite a DTU URL to be reachable from inside Docker containers.
  */
 export function resolveDockerApiUrl(dtuUrl, dtuHost) {
-    return dtuUrl.replace("localhost", dtuHost).replace("127.0.0.1", dtuHost);
+    const parsed = new URL(dtuUrl);
+    if (isLoopbackHostname(parsed.hostname)) {
+        parsed.hostname = dtuHost;
+    }
+    const serialized = parsed.toString();
+    if (parsed.pathname === "/" && !parsed.search && !parsed.hash && serialized.endsWith("/")) {
+        return serialized.slice(0, -1);
+    }
+    return serialized;
 }
 let _mountMappings = null;
 /**

package/dist/docker/container-config.test.js

@@ -1,4 +1,8 @@
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, afterEach, vi } from "vitest";
+import fs from "node:fs";
+afterEach(() => {
+    vi.restoreAllMocks();
+});
 // ── buildContainerEnv ─────────────────────────────────────────────────────────
 describe("buildContainerEnv", () => {
     it("builds the standard env array", async () => {
@@ -37,7 +41,7 @@ describe("buildContainerEnv", () => {
 });
 // ── buildContainerBinds ───────────────────────────────────────────────────────
 describe("buildContainerBinds", () => {
-    it("builds standard bind mounts", async () => {
+    it("builds standard bind mounts with all PM caches", async () => {
         const { buildContainerBinds } = await import("./container-config.js");
         const binds = buildContainerBinds({
             hostWorkDir: "/tmp/work",
@@ -56,9 +60,46 @@ describe("buildContainerBinds", () => {
         expect(binds).toContain("/var/run/docker.sock:/var/run/docker.sock");
         expect(binds).toContain("/tmp/shims:/tmp/agent-ci-shims");
         expect(binds).toContain("/tmp/warm:/tmp/warm-modules");
+        expect(binds).toContain("/tmp/pnpm:/home/runner/_work/.pnpm-store");
+        expect(binds).toContain("/tmp/npm:/home/runner/.npm");
+        expect(binds).toContain("/tmp/bun:/home/runner/.bun/install/cache");
         // Standard mode should NOT include runner home bind (but _work bind is expected)
         expect(binds.some((b) => b.endsWith(":/home/runner"))).toBe(false);
     });
+    it("omits PM bind mounts when cache dirs are not provided", async () => {
+        const { buildContainerBinds } = await import("./container-config.js");
+        const binds = buildContainerBinds({
+            hostWorkDir: "/tmp/work",
+            shimsDir: "/tmp/shims",
+            diagDir: "/tmp/diag",
+            toolCacheDir: "/tmp/toolcache",
+            playwrightCacheDir: "/tmp/playwright",
+            warmModulesDir: "/tmp/warm",
+            hostRunnerDir: "/tmp/runner",
+            useDirectContainer: false,
+        });
+        expect(binds).toContain("/tmp/work:/home/runner/_work");
+        expect(binds.some((b) => b.includes(".pnpm-store"))).toBe(false);
+        expect(binds.some((b) => b.includes("/.npm"))).toBe(false);
+        expect(binds.some((b) => b.includes(".bun"))).toBe(false);
+    });
+    it("includes only the npm bind mount when only npmCacheDir is provided", async () => {
+        const { buildContainerBinds } = await import("./container-config.js");
+        const binds = buildContainerBinds({
+            hostWorkDir: "/tmp/work",
+            shimsDir: "/tmp/shims",
+            diagDir: "/tmp/diag",
+            toolCacheDir: "/tmp/toolcache",
+            npmCacheDir: "/tmp/npm",
+            playwrightCacheDir: "/tmp/playwright",
+            warmModulesDir: "/tmp/warm",
+            hostRunnerDir: "/tmp/runner",
+            useDirectContainer: false,
+        });
+        expect(binds).toContain("/tmp/npm:/home/runner/.npm");
+        expect(binds.some((b) => b.includes(".pnpm-store"))).toBe(false);
+        expect(binds.some((b) => b.includes(".bun"))).toBe(false);
+    });
     it("includes runner bind mount for direct container", async () => {
         const { buildContainerBinds } = await import("./container-config.js");
         const binds = buildContainerBinds({
@@ -127,6 +168,118 @@ describe("resolveDockerApiUrl", () => {
         const { resolveDockerApiUrl } = await import("./container-config.js");
         expect(resolveDockerApiUrl("http://127.0.0.1:3000", "host.docker.internal")).toBe("http://host.docker.internal:3000");
     });
+    it("preserves path and query components", async () => {
+        const { resolveDockerApiUrl } = await import("./container-config.js");
+        expect(resolveDockerApiUrl("http://localhost:8910/api/v1?foo=bar", "10.0.0.8")).toBe("http://10.0.0.8:8910/api/v1?foo=bar");
+    });
+    it("keeps implicit https default port behavior", async () => {
+        const { resolveDockerApiUrl } = await import("./container-config.js");
+        expect(resolveDockerApiUrl("https://localhost", "host.docker.internal")).toBe("https://host.docker.internal");
+    });
+    it("does not rewrite non-loopback hosts", async () => {
+        const { resolveDockerApiUrl } = await import("./container-config.js");
+        expect(resolveDockerApiUrl("https://dtu.internal.example.com:8910", "host.docker.internal")).toBe("https://dtu.internal.example.com:8910");
+    });
+});
+describe("resolveDtuHost", () => {
+    const originalBridgeGateway = process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY;
+    afterEach(() => {
+        if (originalBridgeGateway === undefined) {
+            delete process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY = originalBridgeGateway;
+        }
+    });
+    it("uses host alias when available outside Docker", async () => {
+        const { resolveDtuHost } = await import("./container-config.js");
+        const originalExistsSync = fs.existsSync;
+        vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
+            if (filePath === "/.dockerenv") {
+                return false;
+            }
+            return originalExistsSync(filePath);
+        });
+        await expect(resolveDtuHost()).resolves.toBe("host.docker.internal");
+    });
+    it("uses configured bridge gateway outside Docker when provided", async () => {
+        const { resolveDtuHost } = await import("./container-config.js");
+        const originalExistsSync = fs.existsSync;
+        vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
+            if (filePath === "/.dockerenv") {
+                return false;
+            }
+            return originalExistsSync(filePath);
+        });
+        process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY = "10.10.0.1";
+        await expect(resolveDtuHost()).resolves.toBe("10.10.0.1");
+    });
+    it("uses host alias outside Docker when no gateway override is configured", async () => {
+        const { resolveDtuHost } = await import("./container-config.js");
+        const originalExistsSync = fs.existsSync;
+        vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
+            if (filePath === "/.dockerenv") {
+                return false;
+            }
+            return originalExistsSync(filePath);
+        });
+        await expect(resolveDtuHost()).resolves.toBe("host.docker.internal");
+    });
+});
+describe("resolveDockerExtraHosts", () => {
+    const originalExtraHosts = process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+    const originalDisable = process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+    const originalGateway = process.env.AGENT_CI_DOCKER_HOST_GATEWAY;
+    afterEach(() => {
+        if (originalExtraHosts === undefined) {
+            delete process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_EXTRA_HOSTS = originalExtraHosts;
+        }
+        if (originalDisable === undefined) {
+            delete process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS = originalDisable;
+        }
+        if (originalGateway === undefined) {
+            delete process.env.AGENT_CI_DOCKER_HOST_GATEWAY;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_HOST_GATEWAY = originalGateway;
+        }
+    });
+    it("maps host.docker.internal to host-gateway by default", async () => {
+        delete process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+        delete process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+        delete process.env.AGENT_CI_DOCKER_HOST_GATEWAY;
+        const { resolveDockerExtraHosts } = await import("./container-config.js");
+        expect(resolveDockerExtraHosts("host.docker.internal")).toEqual([
+            "host.docker.internal:host-gateway",
+        ]);
+    });
+    it("uses AGENT_CI_DOCKER_EXTRA_HOSTS when provided", async () => {
+        process.env.AGENT_CI_DOCKER_EXTRA_HOSTS = "host.docker.internal:172.17.0.1,api.local:10.0.0.2";
+        delete process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+        const { resolveDockerExtraHosts } = await import("./container-config.js");
+        expect(resolveDockerExtraHosts("host.docker.internal")).toEqual([
+            "host.docker.internal:172.17.0.1",
+            "api.local:10.0.0.2",
+        ]);
+    });
+    it("returns undefined when defaults are disabled", async () => {
+        delete process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+        process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS = "1";
+        const { resolveDockerExtraHosts } = await import("./container-config.js");
+        expect(resolveDockerExtraHosts("host.docker.internal")).toBeUndefined();
+    });
+    it("does not add default mapping for non-host.docker.internal hosts", async () => {
+        delete process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+        delete process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+        const { resolveDockerExtraHosts } = await import("./container-config.js");
+        expect(resolveDockerExtraHosts("10.10.10.10")).toBeUndefined();
+    });
 });
 // ── signalsDir bind-mount ─────────────────────────────────────────────────────
 describe("buildContainerBinds with signalsDir", () => {

package/dist/output/cleanup.js

@@ -18,6 +18,7 @@ export function copyWorkspace(repoRoot, dest) {
     const files = execSync("git ls-files --cached --others --exclude-standard -z", {
         stdio: "pipe",
         cwd: repoRoot,
+        maxBuffer: 100 * 1024 * 1024, // 100MB — default 1MB overflows in large monorepos
     })
         .toString()
         .split("\0")
@@ -82,6 +83,25 @@ const LOCKFILE_NAMES = [
     "bun.lock",
     "bun.lockb",
 ];
+const LOCKFILE_TO_PM = {
+    "pnpm-lock.yaml": "pnpm",
+    "package-lock.json": "npm",
+    "yarn.lock": "yarn",
+    "bun.lock": "bun",
+    "bun.lockb": "bun",
+};
+/**
+ * Detect the project's package manager by looking for lockfiles in the repo root.
+ * Returns the first match in priority order, or null if no lockfile is found.
+ */
+export function detectPackageManager(repoRoot) {
+    for (const name of LOCKFILE_NAMES) {
+        if (fs.existsSync(path.join(repoRoot, name))) {
+            return LOCKFILE_TO_PM[name];
+        }
+    }
+    return null;
+}
 /**
  * Compute a short SHA-256 hash of lockfiles tracked in the repo.
  * Searches for all known lockfile types (pnpm, npm, yarn, bun) and hashes

package/dist/output/cleanup.test.js

@@ -136,6 +136,51 @@ describe("computeLockfileHash", () => {
         expect(hash).toMatch(/^[a-f0-9]{16}$/);
     });
 });
+// ── detectPackageManager tests ────────────────────────────────────────────────
+describe("detectPackageManager", () => {
+    let repoDir;
+    beforeEach(() => {
+        repoDir = fs.mkdtempSync(path.join(os.tmpdir(), "oa-pm-detect-"));
+    });
+    afterEach(() => {
+        fs.rmSync(repoDir, { recursive: true, force: true });
+    });
+    it("detects pnpm from pnpm-lock.yaml", async () => {
+        const { detectPackageManager } = await import("./cleanup.js");
+        fs.writeFileSync(path.join(repoDir, "pnpm-lock.yaml"), "lockfileVersion: '9.0'\n");
+        expect(detectPackageManager(repoDir)).toBe("pnpm");
+    });
+    it("detects npm from package-lock.json", async () => {
+        const { detectPackageManager } = await import("./cleanup.js");
+        fs.writeFileSync(path.join(repoDir, "package-lock.json"), '{"lockfileVersion": 3}');
+        expect(detectPackageManager(repoDir)).toBe("npm");
+    });
+    it("detects yarn from yarn.lock", async () => {
+        const { detectPackageManager } = await import("./cleanup.js");
+        fs.writeFileSync(path.join(repoDir, "yarn.lock"), "# yarn lockfile v1");
+        expect(detectPackageManager(repoDir)).toBe("yarn");
+    });
+    it("detects bun from bun.lock", async () => {
+        const { detectPackageManager } = await import("./cleanup.js");
+        fs.writeFileSync(path.join(repoDir, "bun.lock"), '{"lockfileVersion": 0}');
+        expect(detectPackageManager(repoDir)).toBe("bun");
+    });
+    it("detects bun from bun.lockb", async () => {
+        const { detectPackageManager } = await import("./cleanup.js");
+        fs.writeFileSync(path.join(repoDir, "bun.lockb"), Buffer.from([0x00]));
+        expect(detectPackageManager(repoDir)).toBe("bun");
+    });
+    it("returns null when no lockfile exists", async () => {
+        const { detectPackageManager } = await import("./cleanup.js");
+        expect(detectPackageManager(repoDir)).toBeNull();
+    });
+    it("prefers pnpm over npm when both lockfiles exist", async () => {
+        const { detectPackageManager } = await import("./cleanup.js");
+        fs.writeFileSync(path.join(repoDir, "pnpm-lock.yaml"), "lockfileVersion: '9.0'\n");
+        fs.writeFileSync(path.join(repoDir, "package-lock.json"), '{"lockfileVersion": 3}');
+        expect(detectPackageManager(repoDir)).toBe("pnpm");
+    });
+});
 // ── isWarmNodeModules tests ───────────────────────────────────────────────────
 describe("isWarmNodeModules", () => {
     let tmpDir;

package/dist/output/reporter.js

@@ -23,14 +23,12 @@ export function printSummary(results, runDir) {
             else {
                 process.stdout.write(`  ✗ ${f.workflow} > ${f.taskId}\n`);
             }
-            if (f.failedExitCode !== undefined) {
-                process.stdout.write(`    Exit code: ${f.failedExitCode}\n`);
+            if (f.failedStepLogPath && fs.existsSync(f.failedStepLogPath)) {
+                const content = fs.readFileSync(f.failedStepLogPath, "utf-8");
+                process.stdout.write("\n" + content);
             }
-            if (f.lastOutputLines && f.lastOutputLines.length > 0) {
-                process.stdout.write(`    Last output:\n`);
-                for (const line of f.lastOutputLines) {
-                    process.stdout.write(`      ${line}\n`);
-                }
+            else if (f.lastOutputLines && f.lastOutputLines.length > 0) {
+                process.stdout.write("\n" + f.lastOutputLines.join("\n") + "\n");
             }
             process.stdout.write("\n");
         }

package/dist/output/reporter.test.js

@@ -0,0 +1,109 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { printSummary } from "./reporter.js";
+function makeResult(overrides = {}) {
+    return {
+        name: "container-1",
+        workflow: "retry-proof.yml",
+        taskId: "test",
+        succeeded: false,
+        durationMs: 1000,
+        debugLogPath: "/tmp/debug.log",
+        ...overrides,
+    };
+}
+describe("printSummary", () => {
+    let tmpDir;
+    let output;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "reporter-test-"));
+        output = "";
+        vi.spyOn(process.stdout, "write").mockImplementation((chunk) => {
+            output += chunk;
+            return true;
+        });
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it("outputs full step log content when failedStepLogPath exists", () => {
+        const logPath = path.join(tmpDir, "Run-assertion-test.log");
+        fs.writeFileSync(logPath, "line 1\nline 2\nline 3\n");
+        printSummary([
+            makeResult({
+                failedStep: "Run assertion test",
+                failedStepLogPath: logPath,
+                lastOutputLines: ["last line only"],
+            }),
+        ]);
+        expect(output).toContain("line 1\nline 2\nline 3\n");
+        expect(output).not.toContain("last line only");
+        expect(output).not.toContain("Last output:");
+        expect(output).not.toContain("Exit code:");
+    });
+    it("falls back to lastOutputLines when failedStepLogPath is absent", () => {
+        printSummary([
+            makeResult({
+                failedStep: "Run assertion test",
+                lastOutputLines: ["fallback line 1", "fallback line 2"],
+            }),
+        ]);
+        expect(output).toContain("fallback line 1\nfallback line 2");
+        expect(output).not.toContain("Last output:");
+    });
+    it("shows the failed step name in the FAILURES section", () => {
+        const logPath = path.join(tmpDir, "step.log");
+        fs.writeFileSync(logPath, "error output\n");
+        printSummary([
+            makeResult({
+                failedStep: "Run assertion test",
+                failedStepLogPath: logPath,
+            }),
+        ]);
+        expect(output).toContain('✗ retry-proof.yml > test > "Run assertion test"');
+    });
+    it("shows pass count in summary for a successful run", () => {
+        printSummary([makeResult({ succeeded: true })]);
+        expect(output).toContain("✓ 1 passed");
+        expect(output).not.toContain("FAILURES");
+    });
+});
+// ── Empty results behavior (CLI exit logic) ──────────────────────────────────
+// The CLI treats empty results as failure. These tests verify the logic pattern
+// used in cli.ts: `results.length === 0 || results.some(r => !r.succeeded)`
+describe("empty results exit logic", () => {
+    function shouldFail(results) {
+        return results.length === 0 || results.some((r) => !r.succeeded);
+    }
+    function shouldPrintSummary(results) {
+        return results.length > 0;
+    }
+    it("treats empty results as failure", () => {
+        expect(shouldFail([])).toBe(true);
+    });
+    it("treats results with a failure as failure", () => {
+        expect(shouldFail([makeResult({ succeeded: false })])).toBe(true);
+    });
+    it("treats all-passing results as success", () => {
+        const passing = [
+            {
+                name: "c1",
+                workflow: "ci.yml",
+                taskId: "test",
+                succeeded: true,
+                durationMs: 100,
+                debugLogPath: "/tmp/x",
+            },
+        ];
+        expect(shouldFail(passing)).toBe(false);
+    });
+    it("skips summary print for empty results", () => {
+        expect(shouldPrintSummary([])).toBe(false);
+    });
+    it("prints summary for non-empty results", () => {
+        expect(shouldPrintSummary([makeResult()])).toBe(true);
+    });
+});

package/dist/output/state-renderer.js

@@ -17,6 +17,18 @@ function getSpinnerFrame() {
 function fmtMs(ms) {
     return ms >= 1000 ? `${(ms / 1000).toFixed(1)}s` : `${ms}ms`;
 }
+function fmtBytes(bytes) {
+    if (bytes >= 1000000000) {
+        return `${(bytes / 1000000000).toFixed(1)} GB`;
+    }
+    if (bytes >= 1000000) {
+        return `${(bytes / 1000000).toFixed(1)} MB`;
+    }
+    if (bytes >= 1000) {
+        return `${(bytes / 1000).toFixed(1)} KB`;
+    }
+    return `${bytes} B`;
+}
 // ─── Step node builder ────────────────────────────────────────────────────────
 function buildStepNode(step, job, padW) {
     const pad = (n) => String(n).padStart(padW);
@@ -72,8 +84,21 @@ function buildJobNodes(job, singleJobMode) {
         const bootNode = {
             label: `${getSpinnerFrame()} Starting runner ${job.runnerId} (${elapsed}s)`,
         };
+        const children = [];
+        if (job.pullProgress) {
+            const { phase, currentBytes, totalBytes } = job.pullProgress;
+            const pct = totalBytes > 0 ? Math.round((currentBytes / totalBytes) * 100) : 0;
+            const label = phase === "extracting" ? "Extracting" : "Downloading";
+            children.push({
+                label: `${DIM}${label}: ${fmtBytes(currentBytes)} / ${fmtBytes(totalBytes)} (${pct}%)${RESET}`,
+            });
+        }
         if (job.logDir) {
-            bootNode.children = [{ label: `${DIM}Logs: ${job.logDir}${RESET}` }];
+            const shortLogDir = job.logDir.replace(/^.*?(agent-ci\/)/, "$1");
+            children.push({ label: `${DIM}Logs: ${shortLogDir}${RESET}` });
+        }
+        if (children.length > 0) {
+            bootNode.children = children;
         }
         return [bootNode];
     }

package/dist/runner/directory-setup.js

@@ -1,7 +1,7 @@
 import path from "path";
 import fs from "fs";
 import { getWorkingDirectory } from "../output/working-directory.js";
-import { computeLockfileHash, repairWarmCache } from "../output/cleanup.js";
+import { computeLockfileHash, detectPackageManager, repairWarmCache } from "../output/cleanup.js";
 import { config } from "../config.js";
 import { findRepoRoot } from "./metadata.js";
 import { debugRunner } from "../output/debug.js";
@@ -23,14 +23,26 @@ export function createRunDirectories(opts) {
     // Shared caches
     const repoSlug = (githubRepo || config.GITHUB_REPO).replace("/", "-");
     const toolCacheDir = path.resolve(workDir, "cache", "toolcache");
-    const pnpmStoreDir = path.resolve(workDir, "cache", "pnpm-store", repoSlug);
-    const npmCacheDir = path.resolve(workDir, "cache", "npm-cache", repoSlug);
-    const bunCacheDir = path.resolve(workDir, "cache", "bun-cache", repoSlug);
     const playwrightCacheDir = path.resolve(workDir, "cache", "playwright", repoSlug);
+    // Detect the project's package manager so we only mount the relevant cache
+    let detectedPM = null;
+    const repoRoot = workflowPath ? findRepoRoot(workflowPath) : undefined;
+    if (repoRoot) {
+        detectedPM = detectPackageManager(repoRoot);
+    }
+    // Only create cache dirs for the detected PM (or all if unknown)
+    const pnpmStoreDir = !detectedPM || detectedPM === "pnpm"
+        ? path.resolve(workDir, "cache", "pnpm-store", repoSlug)
+        : undefined;
+    const npmCacheDir = !detectedPM || detectedPM === "npm"
+        ? path.resolve(workDir, "cache", "npm-cache", repoSlug)
+        : undefined;
+    const bunCacheDir = !detectedPM || detectedPM === "bun"
+        ? path.resolve(workDir, "cache", "bun-cache", repoSlug)
+        : undefined;
     // Warm node_modules: keyed by the lockfile hash (any supported PM)
     let lockfileHash = "no-lockfile";
     try {
-        const repoRoot = workflowPath ? findRepoRoot(workflowPath) : undefined;
         if (repoRoot) {
             lockfileHash = computeLockfileHash(repoRoot);
         }
@@ -55,7 +67,7 @@ export function createRunDirectories(opts) {
         bunCacheDir,
         playwrightCacheDir,
         warmModulesDir,
-    ];
+    ].filter((d) => d !== undefined);
     for (const dir of allDirs) {
         fs.mkdirSync(dir, { recursive: true, mode: 0o777 });
     }
@@ -79,6 +91,7 @@ export function createRunDirectories(opts) {
         warmModulesDir,
         workspaceDir,
         repoSlug,
+        detectedPM,
     };
 }
 // ─── Permissions helper ───────────────────────────────────────────────────────

package/dist/runner/directory-setup.test.js

@@ -2,6 +2,7 @@ import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
+import { execSync } from "node:child_process";
 // ── ensureWorldWritable ───────────────────────────────────────────────────────
 describe("ensureWorldWritable", () => {
     let tmpDir;
@@ -29,3 +30,181 @@ describe("ensureWorldWritable", () => {
         expect(() => ensureWorldWritable(["/nonexistent/path"])).not.toThrow();
     });
 });
+// ── Package manager detection + conditional cache dirs ────────────────────────
+describe("createRunDirectories — PM-scoped caching", () => {
+    let repoDir;
+    let runDir;
+    /** Scaffold a git repo with a workflow file and the given lockfile. */
+    function makeFixture(lockfileName, lockfileContent) {
+        repoDir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-fixture-"));
+        runDir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-rundir-"));
+        execSync("git init", { cwd: repoDir, stdio: "pipe" });
+        execSync('git config user.name "test"', { cwd: repoDir, stdio: "pipe" });
+        execSync('git config user.email "t@t.com"', { cwd: repoDir, stdio: "pipe" });
+        // Lockfile
+        fs.writeFileSync(path.join(repoDir, lockfileName), lockfileContent);
+        // Minimal workflow
+        const wfDir = path.join(repoDir, ".github", "workflows");
+        fs.mkdirSync(wfDir, { recursive: true });
+        fs.writeFileSync(path.join(wfDir, "ci.yml"), "name: CI\non: [push]\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo ok\n");
+        execSync("git add -A", { cwd: repoDir, stdio: "pipe" });
+        execSync('git commit -m "init"', { cwd: repoDir, stdio: "pipe" });
+    }
+    afterEach(() => {
+        if (repoDir) {
+            fs.rmSync(repoDir, { recursive: true, force: true });
+        }
+        if (runDir) {
+            fs.rmSync(runDir, { recursive: true, force: true });
+        }
+    });
+    it("npm: only creates npm cache dir, not pnpm or bun", async () => {
+        makeFixture("package-lock.json", '{"lockfileVersion":3}');
+        const { createRunDirectories } = await import("./directory-setup.js");
+        const dirs = createRunDirectories({
+            runDir,
+            githubRepo: "test/npm-project",
+            workflowPath: path.join(repoDir, ".github", "workflows", "ci.yml"),
+        });
+        expect(dirs.detectedPM).toBe("npm");
+        expect(dirs.npmCacheDir).toBeDefined();
+        expect(dirs.pnpmStoreDir).toBeUndefined();
+        expect(dirs.bunCacheDir).toBeUndefined();
+    });
+    it("pnpm: only creates pnpm cache dir, not npm or bun", async () => {
+        makeFixture("pnpm-lock.yaml", "lockfileVersion: '9.0'\n");
+        const { createRunDirectories } = await import("./directory-setup.js");
+        const dirs = createRunDirectories({
+            runDir,
+            githubRepo: "test/pnpm-project",
+            workflowPath: path.join(repoDir, ".github", "workflows", "ci.yml"),
+        });
+        expect(dirs.detectedPM).toBe("pnpm");
+        expect(dirs.pnpmStoreDir).toBeDefined();
+        expect(dirs.npmCacheDir).toBeUndefined();
+        expect(dirs.bunCacheDir).toBeUndefined();
+    });
+    it("yarn: creates no PM-specific cache dirs (no dedicated mount)", async () => {
+        makeFixture("yarn.lock", "# yarn lockfile v1\n");
+        const { createRunDirectories } = await import("./directory-setup.js");
+        const dirs = createRunDirectories({
+            runDir,
+            githubRepo: "test/yarn-project",
+            workflowPath: path.join(repoDir, ".github", "workflows", "ci.yml"),
+        });
+        expect(dirs.detectedPM).toBe("yarn");
+        expect(dirs.pnpmStoreDir).toBeUndefined();
+        expect(dirs.npmCacheDir).toBeUndefined();
+        expect(dirs.bunCacheDir).toBeUndefined();
+    });
+    it("bun: only creates bun cache dir, not pnpm or npm", async () => {
+        makeFixture("bun.lock", '{"lockfileVersion":0}');
+        const { createRunDirectories } = await import("./directory-setup.js");
+        const dirs = createRunDirectories({
+            runDir,
+            githubRepo: "test/bun-project",
+            workflowPath: path.join(repoDir, ".github", "workflows", "ci.yml"),
+        });
+        expect(dirs.detectedPM).toBe("bun");
+        expect(dirs.bunCacheDir).toBeDefined();
+        expect(dirs.pnpmStoreDir).toBeUndefined();
+        expect(dirs.npmCacheDir).toBeUndefined();
+    });
+    it("no lockfile: creates all PM cache dirs (fallback)", async () => {
+        // Repo with no lockfile at all
+        repoDir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-fixture-"));
+        runDir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-rundir-"));
+        execSync("git init", { cwd: repoDir, stdio: "pipe" });
+        execSync('git config user.name "test"', { cwd: repoDir, stdio: "pipe" });
+        execSync('git config user.email "t@t.com"', { cwd: repoDir, stdio: "pipe" });
+        const wfDir = path.join(repoDir, ".github", "workflows");
+        fs.mkdirSync(wfDir, { recursive: true });
+        fs.writeFileSync(path.join(wfDir, "ci.yml"), "name: CI\non: [push]\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo ok\n");
+        execSync("git add -A", { cwd: repoDir, stdio: "pipe" });
+        execSync('git commit -m "init"', { cwd: repoDir, stdio: "pipe" });
+        const { createRunDirectories } = await import("./directory-setup.js");
+        const dirs = createRunDirectories({
+            runDir,
+            githubRepo: "test/no-pm-project",
+            workflowPath: path.join(repoDir, ".github", "workflows", "ci.yml"),
+        });
+        expect(dirs.detectedPM).toBeNull();
+        expect(dirs.pnpmStoreDir).toBeDefined();
+        expect(dirs.npmCacheDir).toBeDefined();
+        expect(dirs.bunCacheDir).toBeDefined();
+    });
+});
+// ── Bind mounts respect detected PM ──────────────────────────────────────────
+describe("buildContainerBinds — PM-scoped mounts", () => {
+    it("npm project: only mounts .npm, no .pnpm-store or .bun", async () => {
+        const { buildContainerBinds } = await import("../docker/container-config.js");
+        const binds = buildContainerBinds({
+            hostWorkDir: "/tmp/work",
+            shimsDir: "/tmp/shims",
+            diagDir: "/tmp/diag",
+            toolCacheDir: "/tmp/toolcache",
+            npmCacheDir: "/tmp/npm-cache",
+            // pnpmStoreDir and bunCacheDir intentionally omitted (npm project)
+            playwrightCacheDir: "/tmp/playwright",
+            warmModulesDir: "/tmp/warm",
+            hostRunnerDir: "/tmp/runner",
+            useDirectContainer: false,
+        });
+        expect(binds).toContain("/tmp/npm-cache:/home/runner/.npm");
+        expect(binds.some((b) => b.includes(".pnpm-store"))).toBe(false);
+        expect(binds.some((b) => b.includes(".bun/install"))).toBe(false);
+    });
+    it("pnpm project: only mounts .pnpm-store, no .npm or .bun", async () => {
+        const { buildContainerBinds } = await import("../docker/container-config.js");
+        const binds = buildContainerBinds({
+            hostWorkDir: "/tmp/work",
+            shimsDir: "/tmp/shims",
+            diagDir: "/tmp/diag",
+            toolCacheDir: "/tmp/toolcache",
+            pnpmStoreDir: "/tmp/pnpm-store",
+            // npmCacheDir and bunCacheDir intentionally omitted (pnpm project)
+            playwrightCacheDir: "/tmp/playwright",
+            warmModulesDir: "/tmp/warm",
+            hostRunnerDir: "/tmp/runner",
+            useDirectContainer: false,
+        });
+        expect(binds).toContain("/tmp/pnpm-store:/home/runner/_work/.pnpm-store");
+        expect(binds.some((b) => b.includes("/.npm"))).toBe(false);
+        expect(binds.some((b) => b.includes(".bun/install"))).toBe(false);
+    });
+    it("bun project: only mounts .bun, no .pnpm-store or .npm", async () => {
+        const { buildContainerBinds } = await import("../docker/container-config.js");
+        const binds = buildContainerBinds({
+            hostWorkDir: "/tmp/work",
+            shimsDir: "/tmp/shims",
+            diagDir: "/tmp/diag",
+            toolCacheDir: "/tmp/toolcache",
+            bunCacheDir: "/tmp/bun-cache",
+            // pnpmStoreDir and npmCacheDir intentionally omitted (bun project)
+            playwrightCacheDir: "/tmp/playwright",
+            warmModulesDir: "/tmp/warm",
+            hostRunnerDir: "/tmp/runner",
+            useDirectContainer: false,
+        });
+        expect(binds).toContain("/tmp/bun-cache:/home/runner/.bun/install/cache");
+        expect(binds.some((b) => b.includes(".pnpm-store"))).toBe(false);
+        expect(binds.some((b) => b.includes("/.npm"))).toBe(false);
+    });
+    it("yarn project: no PM-specific mounts at all", async () => {
+        const { buildContainerBinds } = await import("../docker/container-config.js");
+        const binds = buildContainerBinds({
+            hostWorkDir: "/tmp/work",
+            shimsDir: "/tmp/shims",
+            diagDir: "/tmp/diag",
+            toolCacheDir: "/tmp/toolcache",
+            // all PM dirs omitted (yarn has no dedicated mount)
+            playwrightCacheDir: "/tmp/playwright",
+            warmModulesDir: "/tmp/warm",
+            hostRunnerDir: "/tmp/runner",
+            useDirectContainer: false,
+        });
+        expect(binds.some((b) => b.includes(".pnpm-store"))).toBe(false);
+        expect(binds.some((b) => b.includes("/.npm"))).toBe(false);
+        expect(binds.some((b) => b.includes(".bun/install"))).toBe(false);
+    });
+});

package/dist/runner/local-job.js

@@ -15,8 +15,8 @@ import { writeJobMetadata } from "./metadata.js";
 import { computeFakeSha, writeGitShim } from "./git-shim.js";
 import { prepareWorkspace } from "./workspace.js";
 import { createRunDirectories } from "./directory-setup.js";
-import { buildContainerEnv, buildContainerBinds, buildContainerCmd, resolveDtuHost, resolveDockerApiUrl, } from "../docker/container-config.js";
-import { buildJobResult, sanitizeStepName } from "./result-builder.js";
+import { buildContainerEnv, buildContainerBinds, buildContainerCmd, resolveDtuHost, resolveDockerApiUrl, resolveDockerExtraHosts, } from "../docker/container-config.js";
+import { buildJobResult } from "./result-builder.js";
 import { wrapJobSteps, appendOutputCaptureStep } from "./step-wrapper.js";
 import { syncWorkspaceForRetry } from "./sync.js";
 // ─── Docker setup ─────────────────────────────────────────────────────────────
@@ -115,9 +115,27 @@ export async function executeLocalJob(job, options) {
     // own isolated DTU instance on a random port — eliminating port conflicts.
     let t0 = Date.now();
     const dtuCacheDir = path.resolve(getWorkingDirectory(), "cache", "dtu");
-    const ephemeralDtu = await startEphemeralDtu(dtuCacheDir).catch(() => null);
+    let ephemeralDtu = null;
+    try {
+        ephemeralDtu = await startEphemeralDtu(dtuCacheDir);
+        debugRunner(`DTU server started - CLI URL: ${ephemeralDtu.url}, Container URL: ${ephemeralDtu.containerUrl}`);
+    }
+    catch (e) {
+        debugRunner(`Failed to start ephemeral DTU: ${e}`);
+    }
+    // CLI uses url (127.0.0.1), containers use containerUrl (host IP)
     const dtuUrl = ephemeralDtu?.url ?? config.GITHUB_API_URL;
+    const dtuContainerUrl = ephemeralDtu?.containerUrl ?? dtuUrl;
     t0 = bt("dtu-start", t0);
+    // ── Create run directories ────────────────────────────────────────────────
+    // Done before DTU registration so we can use the detected package manager
+    // to scope virtualCachePatterns to only the relevant PM.
+    const dirs = createRunDirectories({
+        runDir,
+        githubRepo: job.githubRepo,
+        workflowPath: job.workflowPath,
+    });
+    debugRunner(`Detected package manager: ${dirs.detectedPM ?? "none (mounting all PM caches)"}`);
     await fetch(`${dtuUrl}/_dtu/start-runner`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -129,7 +147,7 @@ export async function executeLocalJob(job, options) {
             // no need for the runner to tar/gzip them. Tell the DTU to return a
             // synthetic hit for any cache key matching these patterns — skipping the
             // 60s+ tar entirely.
-            virtualCachePatterns: ["pnpm", "npm", "yarn", "bun"],
+            virtualCachePatterns: dirs.detectedPM ? [dirs.detectedPM] : ["pnpm", "npm", "yarn", "bun"],
         }),
     }).catch(() => {
         /* non-fatal */
@@ -139,12 +157,6 @@ export async function executeLocalJob(job, options) {
     writeJobMetadata({ logDir, containerName, job });
     // Open debug stream to capture raw container output
     const debugStream = fs.createWriteStream(debugLogPath);
-    // ── Create run directories ────────────────────────────────────────────────
-    const dirs = createRunDirectories({
-        runDir,
-        githubRepo: job.githubRepo,
-        workflowPath: job.workflowPath,
-    });
     // Signal handler: ensure cleanup runs even when killed.
     const signalCleanup = () => {
         killRunnerContainers(containerName);
@@ -219,12 +231,15 @@ export async function executeLocalJob(job, options) {
             bt("workspace-prep", workspacePrepStart);
         })();
         // 6. Spawn container
-        const dtuPort = new URL(dtuUrl).port || "80";
-        const dtuHost = resolveDtuHost();
-        const dockerApiUrl = resolveDockerApiUrl(dtuUrl, dtuHost);
+        const dtuHost = await resolveDtuHost();
+        const dockerApiUrl = resolveDockerApiUrl(dtuContainerUrl, dtuHost);
+        const parsedDockerApiUrl = new URL(dockerApiUrl);
+        const dtuPort = parsedDockerApiUrl.port || (parsedDockerApiUrl.protocol === "https:" ? "443" : "80");
         const githubRepo = job.githubRepo || config.GITHUB_REPO;
         const repoUrl = `${dockerApiUrl}/${githubRepo}`;
         debugRunner(`Spawning container ${containerName}...`);
+        debugRunner(`DTU config - Port: ${dtuPort}, Host: ${dtuHost}, Docker API: ${dockerApiUrl}`);
+        debugRunner(`Runner will connect to: ${repoUrl}`);
         // Pre-cleanup: remove any stale container with the same name
         try {
             const stale = docker.getContainer(containerName);
@@ -293,11 +308,81 @@ export async function executeLocalJob(job, options) {
                     if (err) {
                         return reject(err);
                     }
+                    // Track per-layer progress across download and extraction phases
+                    const downloadProgress = new Map();
+                    const extractProgress = new Map();
+                    let lastProgressUpdate = 0;
+                    let currentPhase = "downloading";
+                    const flushProgress = (force = false) => {
+                        const map = currentPhase === "downloading" ? downloadProgress : extractProgress;
+                        if (map.size === 0) {
+                            return;
+                        }
+                        const now = Date.now();
+                        if (!force && now - lastProgressUpdate < 250) {
+                            return;
+                        }
+                        lastProgressUpdate = now;
+                        let totalBytes = 0;
+                        let currentBytes = 0;
+                        for (const layer of map.values()) {
+                            totalBytes += layer.total;
+                            currentBytes += layer.current;
+                        }
+                        store?.updateJob(containerName, {
+                            pullProgress: { phase: currentPhase, currentBytes, totalBytes },
+                        });
+                    };
                     docker.modem.followProgress(stream, (err) => {
                         if (err) {
                             return reject(err);
                         }
+                        store?.updateJob(containerName, { pullProgress: undefined });
                         resolve();
+                    }, (event) => {
+                        if (!event.id) {
+                            return;
+                        }
+                        const detail = event.progressDetail;
+                        const hasByteCounts = detail &&
+                            typeof detail.current === "number" &&
+                            typeof detail.total === "number" &&
+                            detail.total > 0;
+                        if (event.status === "Downloading" && hasByteCounts) {
+                            downloadProgress.set(event.id, {
+                                current: detail.current,
+                                total: detail.total,
+                            });
+                        }
+                        else if (event.status === "Download complete") {
+                            const existing = downloadProgress.get(event.id);
+                            if (existing) {
+                                existing.current = existing.total;
+                            }
+                        }
+                        else if (event.status === "Extracting" && hasByteCounts) {
+                            const phaseChanged = currentPhase !== "extracting";
+                            currentPhase = "extracting";
+                            extractProgress.set(event.id, {
+                                current: detail.current,
+                                total: detail.total,
+                            });
+                            // Force update on first extraction event so the phase change is visible immediately
+                            if (phaseChanged) {
+                                flushProgress(true);
+                                return;
+                            }
+                        }
+                        else if (event.status === "Pull complete") {
+                            const existing = extractProgress.get(event.id);
+                            if (existing) {
+                                existing.current = existing.total;
+                            }
+                        }
+                        else {
+                            return;
+                        }
+                        flushProgress();
                     });
                 });
             });
@@ -333,6 +418,7 @@ export async function executeLocalJob(job, options) {
             useDirectContainer,
             containerName,
         });
+        const extraHosts = resolveDockerExtraHosts(dtuHost);
         t0 = Date.now();
         const container = await docker.createContainer({
             Image: containerImage,
@@ -345,6 +431,7 @@ export async function executeLocalJob(job, options) {
                 AutoRemove: false,
                 Ulimits: [{ Name: "nofile", Soft: 65536, Hard: 65536 }],
                 ...(serviceCtx ? { NetworkMode: serviceCtx.networkName } : {}),
+                ...(extraHosts ? { ExtraHosts: extraHosts } : {}),
             },
             Tty: true,
         });
@@ -408,44 +495,24 @@ export async function executeLocalJob(job, options) {
                     const lines = content.split("\n");
                     pausedStepName = lines[0] || null;
                     const attempt = parseInt(lines[1] || "1", 10);
-                    if (attempt !== lastSeenAttempt) {
+                    const isNewAttempt = attempt !== lastSeenAttempt;
+                    if (isNewAttempt) {
                         lastSeenAttempt = attempt;
                         isPaused = true;
                         pausedAtMs = Date.now();
                         setupStdinRetry();
-                        // Read last output lines from the failed step's log
-                        let tailLines = [];
-                        if (pausedStepName) {
-                            const stepsDir = path.join(logDir, "steps");
-                            const sanitized = sanitizeStepName(pausedStepName);
-                            const byName = path.join(stepsDir, `${sanitized}.log`);
-                            tailLines = tailLogFile(byName, 20);
-                            if (tailLines.length === 0 && fs.existsSync(stepsDir)) {
-                                let newest = "";
-                                let newestMtime = 0;
-                                for (const f of fs.readdirSync(stepsDir)) {
-                                    if (!f.endsWith(".log")) {
-                                        continue;
-                                    }
-                                    const mt = fs.statSync(path.join(stepsDir, f)).mtimeMs;
-                                    if (mt > newestMtime) {
-                                        newestMtime = mt;
-                                        newest = f;
-                                    }
-                                }
-                                if (newest) {
-                                    tailLines = tailLogFile(path.join(stepsDir, newest), 20);
-                                }
-                            }
-                        }
-                        store?.updateJob(containerName, {
-                            status: "paused",
-                            pausedAtStep: pausedStepName || undefined,
-                            pausedAtMs: new Date(pausedAtMs).toISOString(),
-                            attempt: lastSeenAttempt,
-                            lastOutputLines: tailLines,
-                        });
                     }
+                    // Read output captured by the wrapper script's tee — written directly
+                    // to the signals dir so it's always available when paused.
+                    const tailLines = tailLogFile(path.join(dirs.signalsDir, "step-output"), 20);
+                    store?.updateJob(containerName, {
+                        status: "paused",
+                        pausedAtStep: pausedStepName || undefined,
+                        ...(isNewAttempt && pausedAtMs !== null
+                            ? { pausedAtMs: new Date(pausedAtMs).toISOString(), attempt: lastSeenAttempt }
+                            : {}),
+                        lastOutputLines: tailLines,
+                    });
                 }
                 else if (isPaused && !fs.existsSync(pausedSignalPath)) {
                     // Pause signal removed — job is retrying
@@ -683,7 +750,13 @@ export async function executeLocalJob(job, options) {
             }
         }
         if (jobSucceeded && fs.existsSync(dirs.containerWorkDir)) {
-            fs.rmSync(dirs.containerWorkDir, { recursive: true, force: true });
+            try {
+                fs.rmSync(dirs.containerWorkDir, { recursive: true, force: true });
+            }
+            catch {
+                // Best-effort cleanup — ENOTEMPTY can occur when container
+                // processes haven't fully released file handles yet.
+            }
         }
         await ephemeralDtu?.close().catch(() => { });
         return buildJobResult({

package/dist/runner/step-wrapper.js

@@ -40,7 +40,7 @@ while true; do
   set +e
   (
     ${script}
-  )
+  ) > >(tee "$__SIGNALS/step-output") 2>&1
   __EC=$?
   set -e
   if [ $__EC -eq 0 ]; then exit 0; fi

package/dist/runner/step-wrapper.test.js

@@ -33,6 +33,10 @@ describe("wrapStepScript", () => {
         const wrapped = wrapStepScript("npm test", "My Step", 1);
         expect(wrapped).toContain(`"$__FROM_STEP" != '*'`);
     });
+    it("captures output via tee to signals dir", () => {
+        const wrapped = wrapStepScript("npm test", "Run tests", 1);
+        expect(wrapped).toContain('> >(tee "$__SIGNALS/step-output") 2>&1');
+    });
 });
 // ── wrapJobSteps ──────────────────────────────────────────────────────────────
 describe("wrapJobSteps", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redwoodjs/agent-ci",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Local GitHub Actions runner — pause on failure, ~0ms cache, official runner binary. Built for AI coding agents.",
   "keywords": [
     "act-alternative",
@@ -40,7 +40,7 @@
     "log-update": "^7.2.0",
     "minimatch": "^10.2.1",
     "yaml": "^2.8.2",
-    "dtu-github-actions": "0.5.0"
+    "dtu-github-actions": "0.7.0"
   },
   "devDependencies": {
     "@types/dockerode": "^3.3.34",