@vm0/runner 2.13.4 → 2.14.0

package/index.js

@@ -5638,6 +5638,8 @@ var unifiedRunRequestSchema = z6.object({
   volumeVersions: z6.record(z6.string(), z6.string()).optional(),
   // Debug flag to force real Claude in mock environments (internal use only)
   debugNoMockClaude: z6.boolean().optional(),
+  // Model provider for automatic LLM credential injection
+  modelProvider: z6.string().optional(),
   // Required
   prompt: z6.string().min(1, "Missing prompt")
 });
@@ -9316,188 +9318,193 @@ async function executeJob2(context, config) {
     console.log(`  Job ${context.runId} reported as ${result.status}`);
   }
 }
-var startCommand = new Command("start").description("Start the runner").option("--config <path>", "Config file path", "./runner.yaml").action(async (options) => {
-  try {
-    const config = loadConfig(options.config);
-    validateFirecrackerPaths(config.firecracker);
-    console.log("Config valid");
-    const datasetSuffix = process.env.AXIOM_DATASET_SUFFIX;
-    if (!datasetSuffix) {
-      throw new Error(
-        "AXIOM_DATASET_SUFFIX is required. Set to 'dev' or 'prod'."
-      );
-    }
-    initMetrics({
-      serviceName: "vm0-runner",
-      runnerLabel: config.name,
-      axiomToken: process.env.AXIOM_TOKEN,
-      environment: datasetSuffix
-    });
-    const networkCheck = checkNetworkPrerequisites();
-    if (!networkCheck.ok) {
-      console.error("Network prerequisites not met:");
-      for (const error of networkCheck.errors) {
-        console.error(`  - ${error}`);
-      }
-      process.exit(1);
-    }
-    console.log("Setting up network bridge...");
-    await setupBridge();
-    console.log("Flushing bridge ARP cache...");
-    await flushBridgeArpCache();
-    console.log("Cleaning up orphaned proxy rules...");
-    await cleanupOrphanedProxyRules(config.name);
-    console.log("Cleaning up orphaned IP allocations...");
-    await cleanupOrphanedAllocations();
-    console.log("Initializing network proxy...");
-    initVMRegistry();
-    const proxyManager = initProxyManager({
-      apiUrl: config.server.url,
-      port: config.proxy.port,
-      caDir: config.proxy.ca_dir
-    });
-    let proxyEnabled = false;
+var startCommand = new Command("start").description("Start the runner").option("--config <path>", "Config file path", "./runner.yaml").action(
+  // eslint-disable-next-line complexity -- TODO: refactor complex function
+  async (options) => {
     try {
-      await proxyManager.start();
-      proxyEnabled = true;
-      console.log("Network proxy initialized successfully");
-    } catch (err) {
-      console.warn(
-        `Network proxy not available: ${err instanceof Error ? err.message : "Unknown error"}`
-      );
-      console.warn(
-        "Jobs with experimentalFirewall enabled will run without network interception"
-      );
-    }
-    const statusFilePath = join2(dirname(options.config), "status.json");
-    const startedAt = /* @__PURE__ */ new Date();
-    const state = { mode: "running" };
-    const updateStatus = () => {
-      writeStatusFile(statusFilePath, state.mode, startedAt);
-    };
-    console.log(
-      `Starting runner '${config.name}' for group '${config.group}'...`
-    );
-    console.log(`Max concurrent jobs: ${config.sandbox.max_concurrent}`);
-    console.log(`Status file: ${statusFilePath}`);
-    console.log("Press Ctrl+C to stop");
-    console.log("");
-    updateStatus();
-    let running = true;
-    process.on("SIGINT", () => {
-      console.log("\nShutting down...");
-      running = false;
-      state.mode = "stopped";
-      updateStatus();
-    });
-    process.on("SIGTERM", () => {
-      console.log("\nShutting down...");
-      running = false;
-      state.mode = "stopped";
-      updateStatus();
-    });
-    process.on("SIGUSR1", () => {
-      if (state.mode === "running") {
-        console.log("\n[Maintenance] Entering drain mode...");
-        console.log(
-          `[Maintenance] Active jobs: ${activeRuns.size} (will wait for completion)`
+      const config = loadConfig(options.config);
+      validateFirecrackerPaths(config.firecracker);
+      console.log("Config valid");
+      const datasetSuffix = process.env.AXIOM_DATASET_SUFFIX;
+      if (!datasetSuffix) {
+        throw new Error(
+          "AXIOM_DATASET_SUFFIX is required. Set to 'dev' or 'prod'."
         );
-        state.mode = "draining";
-        updateStatus();
       }
-    });
-    const jobPromises = /* @__PURE__ */ new Set();
-    while (running) {
-      if (state.mode === "draining") {
-        if (activeRuns.size === 0) {
-          console.log("[Maintenance] All jobs completed, exiting drain mode");
-          running = false;
-          break;
-        }
-        if (jobPromises.size > 0) {
-          await Promise.race(jobPromises);
-          updateStatus();
-        }
-        continue;
-      }
-      if (activeRuns.size >= config.sandbox.max_concurrent) {
-        if (jobPromises.size > 0) {
-          await Promise.race(jobPromises);
-          updateStatus();
+      initMetrics({
+        serviceName: "vm0-runner",
+        runnerLabel: config.name,
+        axiomToken: process.env.AXIOM_TOKEN,
+        environment: datasetSuffix
+      });
+      const networkCheck = checkNetworkPrerequisites();
+      if (!networkCheck.ok) {
+        console.error("Network prerequisites not met:");
+        for (const error of networkCheck.errors) {
+          console.error(`  - ${error}`);
         }
-        continue;
+        process.exit(1);
       }
+      console.log("Setting up network bridge...");
+      await setupBridge();
+      console.log("Flushing bridge ARP cache...");
+      await flushBridgeArpCache();
+      console.log("Cleaning up orphaned proxy rules...");
+      await cleanupOrphanedProxyRules(config.name);
+      console.log("Cleaning up orphaned IP allocations...");
+      await cleanupOrphanedAllocations();
+      console.log("Initializing network proxy...");
+      initVMRegistry();
+      const proxyManager = initProxyManager({
+        apiUrl: config.server.url,
+        port: config.proxy.port,
+        caDir: config.proxy.ca_dir
+      });
+      let proxyEnabled = false;
       try {
-        const job = await withRunnerTiming(
-          "poll",
-          () => pollForJob(config.server, config.group)
+        await proxyManager.start();
+        proxyEnabled = true;
+        console.log("Network proxy initialized successfully");
+      } catch (err) {
+        console.warn(
+          `Network proxy not available: ${err instanceof Error ? err.message : "Unknown error"}`
         );
-        if (!job) {
-          await new Promise(
-            (resolve) => setTimeout(resolve, config.sandbox.poll_interval_ms)
+        console.warn(
+          "Jobs with experimentalFirewall enabled will run without network interception"
+        );
+      }
+      const statusFilePath = join2(dirname(options.config), "status.json");
+      const startedAt = /* @__PURE__ */ new Date();
+      const state = { mode: "running" };
+      const updateStatus = () => {
+        writeStatusFile(statusFilePath, state.mode, startedAt);
+      };
+      console.log(
+        `Starting runner '${config.name}' for group '${config.group}'...`
+      );
+      console.log(`Max concurrent jobs: ${config.sandbox.max_concurrent}`);
+      console.log(`Status file: ${statusFilePath}`);
+      console.log("Press Ctrl+C to stop");
+      console.log("");
+      updateStatus();
+      let running = true;
+      process.on("SIGINT", () => {
+        console.log("\nShutting down...");
+        running = false;
+        state.mode = "stopped";
+        updateStatus();
+      });
+      process.on("SIGTERM", () => {
+        console.log("\nShutting down...");
+        running = false;
+        state.mode = "stopped";
+        updateStatus();
+      });
+      process.on("SIGUSR1", () => {
+        if (state.mode === "running") {
+          console.log("\n[Maintenance] Entering drain mode...");
+          console.log(
+            `[Maintenance] Active jobs: ${activeRuns.size} (will wait for completion)`
           );
+          state.mode = "draining";
+          updateStatus();
+        }
+      });
+      const jobPromises = /* @__PURE__ */ new Set();
+      while (running) {
+        if (state.mode === "draining") {
+          if (activeRuns.size === 0) {
+            console.log(
+              "[Maintenance] All jobs completed, exiting drain mode"
+            );
+            running = false;
+            break;
+          }
+          if (jobPromises.size > 0) {
+            await Promise.race(jobPromises);
+            updateStatus();
+          }
+          continue;
+        }
+        if (activeRuns.size >= config.sandbox.max_concurrent) {
+          if (jobPromises.size > 0) {
+            await Promise.race(jobPromises);
+            updateStatus();
+          }
           continue;
         }
-        console.log(`Found job: ${job.runId}`);
         try {
-          const context = await withRunnerTiming(
-            "claim",
-            () => claimJob(config.server, job.runId)
+          const job = await withRunnerTiming(
+            "poll",
+            () => pollForJob(config.server, config.group)
           );
-          console.log(`Claimed job: ${context.runId}`);
-          activeRuns.add(context.runId);
-          updateStatus();
-          const jobPromise = executeJob2(context, config).catch((error) => {
-            console.error(
-              `Job ${context.runId} failed:`,
-              error instanceof Error ? error.message : "Unknown error"
+          if (!job) {
+            await new Promise(
+              (resolve) => setTimeout(resolve, config.sandbox.poll_interval_ms)
             );
-          }).finally(() => {
-            activeRuns.delete(context.runId);
-            jobPromises.delete(jobPromise);
+            continue;
+          }
+          console.log(`Found job: ${job.runId}`);
+          try {
+            const context = await withRunnerTiming(
+              "claim",
+              () => claimJob(config.server, job.runId)
+            );
+            console.log(`Claimed job: ${context.runId}`);
+            activeRuns.add(context.runId);
             updateStatus();
-          });
-          jobPromises.add(jobPromise);
+            const jobPromise = executeJob2(context, config).catch((error) => {
+              console.error(
+                `Job ${context.runId} failed:`,
+                error instanceof Error ? error.message : "Unknown error"
+              );
+            }).finally(() => {
+              activeRuns.delete(context.runId);
+              jobPromises.delete(jobPromise);
+              updateStatus();
+            });
+            jobPromises.add(jobPromise);
+          } catch (error) {
+            console.log(
+              `Could not claim job ${job.runId}:`,
+              error instanceof Error ? error.message : "Unknown error"
+            );
+          }
         } catch (error) {
-          console.log(
-            `Could not claim job ${job.runId}:`,
+          console.error(
+            "Polling error:",
             error instanceof Error ? error.message : "Unknown error"
           );
+          await new Promise((resolve) => setTimeout(resolve, 2e3));
         }
-      } catch (error) {
-        console.error(
-          "Polling error:",
-          error instanceof Error ? error.message : "Unknown error"
+      }
+      if (jobPromises.size > 0) {
+        console.log(
+          `Waiting for ${jobPromises.size} active job(s) to complete...`
         );
-        await new Promise((resolve) => setTimeout(resolve, 2e3));
+        await Promise.all(jobPromises);
       }
+      if (proxyEnabled) {
+        console.log("Stopping network proxy...");
+        await getProxyManager().stop();
+      }
+      console.log("Flushing metrics...");
+      await flushMetrics();
+      await shutdownMetrics();
+      state.mode = "stopped";
+      updateStatus();
+      console.log("Runner stopped");
+      process.exit(0);
+    } catch (error) {
+      if (error instanceof Error) {
+        console.error(`Error: ${error.message}`);
+      } else {
+        console.error("An unknown error occurred");
+      }
+      process.exit(1);
     }
-    if (jobPromises.size > 0) {
-      console.log(
-        `Waiting for ${jobPromises.size} active job(s) to complete...`
-      );
-      await Promise.all(jobPromises);
-    }
-    if (proxyEnabled) {
-      console.log("Stopping network proxy...");
-      await getProxyManager().stop();
-    }
-    console.log("Flushing metrics...");
-    await flushMetrics();
-    await shutdownMetrics();
-    state.mode = "stopped";
-    updateStatus();
-    console.log("Runner stopped");
-    process.exit(0);
-  } catch (error) {
-    if (error instanceof Error) {
-      console.error(`Error: ${error.message}`);
-    } else {
-      console.error("An unknown error occurred");
-    }
-    process.exit(1);
   }
-});
+);
 
 // src/commands/doctor.ts
 import { Command as Command2 } from "commander";
@@ -9612,194 +9619,197 @@ function findMitmproxyProcess() {
 }
 
 // src/commands/doctor.ts
-var doctorCommand = new Command2("doctor").description("Diagnose runner health, check network, and detect issues").option("--config <path>", "Config file path", "./runner.yaml").action(async (options) => {
-  try {
-    const config = loadConfig(options.config);
-    const configDir = dirname2(options.config);
-    const statusFilePath = join3(configDir, "status.json");
-    const workspacesDir = join3(configDir, "workspaces");
-    console.log(`Runner: ${config.name}`);
-    let status = null;
-    if (existsSync3(statusFilePath)) {
-      try {
-        status = JSON.parse(
-          readFileSync3(statusFilePath, "utf-8")
-        );
-        console.log(`Mode: ${status.mode}`);
-        if (status.started_at) {
-          const started = new Date(status.started_at);
-          const uptime = formatUptime(Date.now() - started.getTime());
-          console.log(
-            `Started: ${started.toLocaleString()} (uptime: ${uptime})`
+var doctorCommand = new Command2("doctor").description("Diagnose runner health, check network, and detect issues").option("--config <path>", "Config file path", "./runner.yaml").action(
+  // eslint-disable-next-line complexity -- TODO: refactor complex function
+  async (options) => {
+    try {
+      const config = loadConfig(options.config);
+      const configDir = dirname2(options.config);
+      const statusFilePath = join3(configDir, "status.json");
+      const workspacesDir = join3(configDir, "workspaces");
+      console.log(`Runner: ${config.name}`);
+      let status = null;
+      if (existsSync3(statusFilePath)) {
+        try {
+          status = JSON.parse(
+            readFileSync3(statusFilePath, "utf-8")
           );
+          console.log(`Mode: ${status.mode}`);
+          if (status.started_at) {
+            const started = new Date(status.started_at);
+            const uptime = formatUptime(Date.now() - started.getTime());
+            console.log(
+              `Started: ${started.toLocaleString()} (uptime: ${uptime})`
+            );
+          }
+        } catch {
+          console.log("Mode: unknown (status.json unreadable)");
         }
-      } catch {
-        console.log("Mode: unknown (status.json unreadable)");
-      }
-    } else {
-      console.log("Mode: unknown (no status.json)");
-    }
-    console.log("");
-    console.log("API Connectivity:");
-    try {
-      await pollForJob(config.server, config.group);
-      console.log(`  \u2713 Connected to ${config.server.url}`);
-      console.log("  \u2713 Authentication: OK");
-    } catch (error) {
-      console.log(`  \u2717 Cannot connect to ${config.server.url}`);
-      console.log(
-        `    Error: ${error instanceof Error ? error.message : "Unknown error"}`
-      );
-    }
-    console.log("");
-    console.log("Network:");
-    const warnings = [];
-    const bridgeStatus = await checkBridgeStatus();
-    if (bridgeStatus.exists) {
-      console.log(`  \u2713 Bridge ${BRIDGE_NAME2} (${bridgeStatus.ip})`);
-    } else {
-      console.log(`  \u2717 Bridge ${BRIDGE_NAME2} not found`);
-      warnings.push({
-        message: `Network bridge ${BRIDGE_NAME2} does not exist`
-      });
-    }
-    const proxyPort = config.proxy.port;
-    const mitmProc = findMitmproxyProcess();
-    const portInUse = await isPortInUse(proxyPort);
-    if (mitmProc) {
-      console.log(
-        `  \u2713 Proxy mitmproxy (PID ${mitmProc.pid}) on :${proxyPort}`
-      );
-    } else if (portInUse) {
-      console.log(
-        `  \u26A0\uFE0F Proxy port :${proxyPort} in use but mitmproxy process not found`
-      );
-      warnings.push({
-        message: `Port ${proxyPort} is in use but mitmproxy process not detected`
-      });
-    } else {
-      console.log(`  \u2717 Proxy mitmproxy not running`);
-      warnings.push({ message: "Proxy mitmproxy is not running" });
-    }
-    console.log("");
-    const processes = findFirecrackerProcesses();
-    const tapDevices = await listTapDevices();
-    const workspaces = existsSync3(workspacesDir) ? readdirSync2(workspacesDir).filter((d) => d.startsWith("vm0-")) : [];
-    const jobs = [];
-    const statusVmIds = /* @__PURE__ */ new Set();
-    const allocations = getAllocations();
-    if (status?.active_run_ids) {
-      for (const runId of status.active_run_ids) {
-        const vmId = runId.split("-")[0];
-        if (!vmId) continue;
-        statusVmIds.add(vmId);
-        const proc = processes.find((p) => p.vmId === vmId);
-        const ip = getIPForVm(vmId) ?? "not allocated";
-        jobs.push({
-          runId,
-          vmId,
-          ip,
-          hasProcess: !!proc,
-          pid: proc?.pid
-        });
+      } else {
+        console.log("Mode: unknown (no status.json)");
       }
-    }
-    const ipToVmIds = /* @__PURE__ */ new Map();
-    for (const [ip, allocation] of allocations) {
-      const existing = ipToVmIds.get(ip) ?? [];
-      existing.push(allocation.vmId);
-      ipToVmIds.set(ip, existing);
-    }
-    const maxConcurrent = config.sandbox.max_concurrent;
-    console.log(`Runs (${jobs.length} active, max ${maxConcurrent}):`);
-    if (jobs.length === 0) {
-      console.log("  No active runs");
-    } else {
-      console.log(
-        "  Run ID                                VM ID       IP              Status"
-      );
-      for (const job of jobs) {
-        const ipConflict = (ipToVmIds.get(job.ip)?.length ?? 0) > 1;
-        let statusText;
-        if (ipConflict) {
-          statusText = "\u26A0\uFE0F IP conflict!";
-        } else if (job.hasProcess) {
-          statusText = `\u2713 Running (PID ${job.pid})`;
-        } else {
-          statusText = "\u26A0\uFE0F No process";
-        }
+      console.log("");
+      console.log("API Connectivity:");
+      try {
+        await pollForJob(config.server, config.group);
+        console.log(`  \u2713 Connected to ${config.server.url}`);
+        console.log("  \u2713 Authentication: OK");
+      } catch (error) {
+        console.log(`  \u2717 Cannot connect to ${config.server.url}`);
         console.log(
-          `  ${job.runId}  ${job.vmId}    ${job.ip.padEnd(15)} ${statusText}`
+          `    Error: ${error instanceof Error ? error.message : "Unknown error"}`
         );
       }
-    }
-    console.log("");
-    for (const job of jobs) {
-      if (!job.hasProcess) {
+      console.log("");
+      console.log("Network:");
+      const warnings = [];
+      const bridgeStatus = await checkBridgeStatus();
+      if (bridgeStatus.exists) {
+        console.log(`  \u2713 Bridge ${BRIDGE_NAME2} (${bridgeStatus.ip})`);
+      } else {
+        console.log(`  \u2717 Bridge ${BRIDGE_NAME2} not found`);
         warnings.push({
-          message: `Run ${job.vmId} in status.json but no Firecracker process running`
+          message: `Network bridge ${BRIDGE_NAME2} does not exist`
         });
       }
-    }
-    for (const [ip, vmIds] of ipToVmIds) {
-      if (vmIds.length > 1) {
+      const proxyPort = config.proxy.port;
+      const mitmProc = findMitmproxyProcess();
+      const portInUse = await isPortInUse(proxyPort);
+      if (mitmProc) {
+        console.log(
+          `  \u2713 Proxy mitmproxy (PID ${mitmProc.pid}) on :${proxyPort}`
+        );
+      } else if (portInUse) {
+        console.log(
+          `  \u26A0\uFE0F Proxy port :${proxyPort} in use but mitmproxy process not found`
+        );
         warnings.push({
-          message: `IP conflict: ${ip} assigned to ${vmIds.join(", ")}`
+          message: `Port ${proxyPort} is in use but mitmproxy process not detected`
         });
+      } else {
+        console.log(`  \u2717 Proxy mitmproxy not running`);
+        warnings.push({ message: "Proxy mitmproxy is not running" });
       }
-    }
-    const processVmIds = new Set(processes.map((p) => p.vmId));
-    for (const proc of processes) {
-      if (!statusVmIds.has(proc.vmId)) {
-        warnings.push({
-          message: `Orphan process: PID ${proc.pid} (vmId ${proc.vmId}) not in status.json`
-        });
+      console.log("");
+      const processes = findFirecrackerProcesses();
+      const tapDevices = await listTapDevices();
+      const workspaces = existsSync3(workspacesDir) ? readdirSync2(workspacesDir).filter((d) => d.startsWith("vm0-")) : [];
+      const jobs = [];
+      const statusVmIds = /* @__PURE__ */ new Set();
+      const allocations = getAllocations();
+      if (status?.active_run_ids) {
+        for (const runId of status.active_run_ids) {
+          const vmId = runId.split("-")[0];
+          if (!vmId) continue;
+          statusVmIds.add(vmId);
+          const proc = processes.find((p) => p.vmId === vmId);
+          const ip = getIPForVm(vmId) ?? "not allocated";
+          jobs.push({
+            runId,
+            vmId,
+            ip,
+            hasProcess: !!proc,
+            pid: proc?.pid
+          });
+        }
       }
-    }
-    for (const tap of tapDevices) {
-      const vmId = tap.replace("tap", "");
-      if (!processVmIds.has(vmId) && !statusVmIds.has(vmId)) {
-        warnings.push({
-          message: `Orphan TAP device: ${tap} (no matching job or process)`
-        });
+      const ipToVmIds = /* @__PURE__ */ new Map();
+      for (const [ip, allocation] of allocations) {
+        const existing = ipToVmIds.get(ip) ?? [];
+        existing.push(allocation.vmId);
+        ipToVmIds.set(ip, existing);
       }
-    }
-    for (const ws of workspaces) {
-      const vmId = ws.replace("vm0-", "");
-      if (!processVmIds.has(vmId) && !statusVmIds.has(vmId)) {
+      const maxConcurrent = config.sandbox.max_concurrent;
+      console.log(`Runs (${jobs.length} active, max ${maxConcurrent}):`);
+      if (jobs.length === 0) {
+        console.log("  No active runs");
+      } else {
+        console.log(
+          "  Run ID                                VM ID       IP              Status"
+        );
+        for (const job of jobs) {
+          const ipConflict = (ipToVmIds.get(job.ip)?.length ?? 0) > 1;
+          let statusText;
+          if (ipConflict) {
+            statusText = "\u26A0\uFE0F IP conflict!";
+          } else if (job.hasProcess) {
+            statusText = `\u2713 Running (PID ${job.pid})`;
+          } else {
+            statusText = "\u26A0\uFE0F No process";
+          }
+          console.log(
+            `  ${job.runId}  ${job.vmId}    ${job.ip.padEnd(15)} ${statusText}`
+          );
+        }
+      }
+      console.log("");
+      for (const job of jobs) {
+        if (!job.hasProcess) {
+          warnings.push({
+            message: `Run ${job.vmId} in status.json but no Firecracker process running`
+          });
+        }
+      }
+      for (const [ip, vmIds] of ipToVmIds) {
+        if (vmIds.length > 1) {
+          warnings.push({
+            message: `IP conflict: ${ip} assigned to ${vmIds.join(", ")}`
+          });
+        }
+      }
+      const processVmIds = new Set(processes.map((p) => p.vmId));
+      for (const proc of processes) {
+        if (!statusVmIds.has(proc.vmId)) {
+          warnings.push({
+            message: `Orphan process: PID ${proc.pid} (vmId ${proc.vmId}) not in status.json`
+          });
+        }
+      }
+      for (const tap of tapDevices) {
+        const vmId = tap.replace("tap", "");
+        if (!processVmIds.has(vmId) && !statusVmIds.has(vmId)) {
+          warnings.push({
+            message: `Orphan TAP device: ${tap} (no matching job or process)`
+          });
+        }
+      }
+      for (const ws of workspaces) {
+        const vmId = ws.replace("vm0-", "");
+        if (!processVmIds.has(vmId) && !statusVmIds.has(vmId)) {
+          warnings.push({
+            message: `Orphan workspace: ${ws} (no matching job or process)`
+          });
+        }
+      }
+      const activeVmIps = new Set(jobs.map((j) => j.ip));
+      const iptablesRules = await listIptablesNatRules();
+      const orphanedIptables = await findOrphanedIptablesRules(
+        iptablesRules,
+        activeVmIps,
+        proxyPort
+      );
+      for (const rule of orphanedIptables) {
         warnings.push({
-          message: `Orphan workspace: ${ws} (no matching job or process)`
+          message: `Orphan iptables rule: redirect ${rule.sourceIp}:${rule.destPort} -> :${rule.redirectPort}`
         });
       }
-    }
-    const activeVmIps = new Set(jobs.map((j) => j.ip));
-    const iptablesRules = await listIptablesNatRules();
-    const orphanedIptables = await findOrphanedIptablesRules(
-      iptablesRules,
-      activeVmIps,
-      proxyPort
-    );
-    for (const rule of orphanedIptables) {
-      warnings.push({
-        message: `Orphan iptables rule: redirect ${rule.sourceIp}:${rule.destPort} -> :${rule.redirectPort}`
-      });
-    }
-    console.log("Warnings:");
-    if (warnings.length === 0) {
-      console.log("  None");
-    } else {
-      for (const w of warnings) {
-        console.log(`  - ${w.message}`);
+      console.log("Warnings:");
+      if (warnings.length === 0) {
+        console.log("  None");
+      } else {
+        for (const w of warnings) {
+          console.log(`  - ${w.message}`);
+        }
       }
+      process.exit(warnings.length > 0 ? 1 : 0);
+    } catch (error) {
+      console.error(
+        `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+      process.exit(1);
     }
-    process.exit(warnings.length > 0 ? 1 : 0);
-  } catch (error) {
-    console.error(
-      `Error: ${error instanceof Error ? error.message : "Unknown error"}`
-    );
-    process.exit(1);
   }
-});
+);
 function formatUptime(ms) {
   const seconds = Math.floor(ms / 1e3);
   const minutes = Math.floor(seconds / 60);
@@ -9817,6 +9827,7 @@ import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync
 import { dirname as dirname3, join as join4 } from "path";
 import * as readline2 from "readline";
 var killCommand = new Command3("kill").description("Force terminate a run and clean up all resources").argument("<run-id>", "Run ID (full UUID or short 8-char vmId)").option("--config <path>", "Config file path", "./runner.yaml").option("--force", "Skip confirmation prompt").action(
+  // eslint-disable-next-line complexity -- TODO: refactor complex function
   async (runIdArg, options) => {
     try {
       loadConfig(options.config);
@@ -10079,7 +10090,7 @@ var benchmarkCommand = new Command4("benchmark").description(
 });
 
 // src/index.ts
-var version = true ? "2.13.4" : "0.1.0";
+var version = true ? "2.14.0" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(doctorCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/runner",
-  "version": "2.13.4",
+  "version": "2.14.0",
   "description": "Self-hosted runner for VM0 agents",
   "repository": {
     "type": "git",