@vm0/runner 2.6.1 → 2.7.1

package/index.js

@@ -37,6 +37,42 @@ var runnerConfigSchema = z.object({
     port: z.number().int().min(1024).max(65535).default(8080)
   }).default({})
 });
+var debugConfigSchema = z.object({
+  name: z.string().default("debug-runner"),
+  group: z.string().default("debug/local"),
+  server: z.object({
+    url: z.string().url().default("http://localhost:3000"),
+    token: z.string().default("debug-token")
+  }).default({}),
+  sandbox: z.object({
+    max_concurrent: z.number().int().min(1).default(1),
+    vcpu: z.number().int().min(1).default(2),
+    memory_mb: z.number().int().min(128).default(2048),
+    poll_interval_ms: z.number().int().min(1e3).default(5e3)
+  }).default({}),
+  firecracker: z.object({
+    binary: z.string().min(1, "Firecracker binary path is required"),
+    kernel: z.string().min(1, "Kernel path is required"),
+    rootfs: z.string().min(1, "Rootfs path is required")
+  }),
+  proxy: z.object({
+    port: z.number().int().min(1024).max(65535).default(8080)
+  }).default({})
+});
+function loadDebugConfig(configPath) {
+  if (!fs.existsSync(configPath)) {
+    throw new Error(`Config file not found: ${configPath}`);
+  }
+  const content = fs.readFileSync(configPath, "utf-8");
+  const raw = yaml.parse(content);
+  const result = debugConfigSchema.safeParse(raw);
+  if (!result.success) {
+    const errors = result.error.errors.map((e) => `  - ${e.path.join(".")}: ${e.message}`).join("\n");
+    throw new Error(`Invalid configuration:
+${errors}`);
+  }
+  return result.data;
+}
 function loadConfig(configPath) {
   if (!fs.existsSync(configPath)) {
     throw new Error(`runner.yaml not found: ${configPath}`);
@@ -142,7 +178,7 @@ import path4 from "path";
 import fs6 from "fs";
 
 // src/lib/firecracker/vm.ts
-import { spawn } from "child_process";
+import { execSync as execSync2, spawn } from "child_process";
 import fs2 from "fs";
 import path from "path";
 import readline from "readline";
@@ -545,13 +581,13 @@ var FirecrackerVM = class {
   state = "created";
   workDir;
   socketPath;
-  vmRootfsPath;
-  // Per-VM copy of rootfs
+  vmOverlayPath;
+  // Per-VM sparse overlay for writes
   constructor(config) {
     this.config = config;
     this.workDir = config.workDir || `/tmp/vm0-vm-${config.vmId}`;
     this.socketPath = path.join(this.workDir, "firecracker.sock");
-    this.vmRootfsPath = path.join(this.workDir, "rootfs.ext4");
+    this.vmOverlayPath = path.join(this.workDir, "overlay.ext4");
   }
   /**
    * Get current VM state
@@ -590,8 +626,12 @@ var FirecrackerVM = class {
       if (fs2.existsSync(this.socketPath)) {
         fs2.unlinkSync(this.socketPath);
       }
-      console.log(`[VM ${this.config.vmId}] Copying rootfs for isolation...`);
-      fs2.copyFileSync(this.config.rootfsPath, this.vmRootfsPath);
+      console.log(`[VM ${this.config.vmId}] Creating sparse overlay file...`);
+      const overlaySize = 2 * 1024 * 1024 * 1024;
+      const fd = fs2.openSync(this.vmOverlayPath, "w");
+      fs2.ftruncateSync(fd, overlaySize);
+      fs2.closeSync(fd);
+      execSync2(`mkfs.ext4 -F -q "${this.vmOverlayPath}"`, { stdio: "ignore" });
       console.log(`[VM ${this.config.vmId}] Setting up network...`);
       this.networkConfig = await createTapDevice(this.config.vmId);
       console.log(`[VM ${this.config.vmId}] Starting Firecracker...`);
@@ -668,19 +708,27 @@ var FirecrackerVM = class {
       mem_size_mib: this.config.memoryMb
     });
     const networkBootArgs = generateNetworkBootArgs(this.networkConfig);
-    const bootArgs = `console=ttyS0 reboot=k panic=1 pci=off ${networkBootArgs}`;
+    const bootArgs = `console=ttyS0 reboot=k panic=1 pci=off init=/sbin/overlay-init ${networkBootArgs}`;
     console.log(`[VM ${this.config.vmId}] Boot args: ${bootArgs}`);
     await this.client.setBootSource({
       kernel_image_path: this.config.kernelPath,
       boot_args: bootArgs
     });
-    console.log(`[VM ${this.config.vmId}] Rootfs: ${this.vmRootfsPath}`);
+    console.log(
+      `[VM ${this.config.vmId}] Base rootfs: ${this.config.rootfsPath}`
+    );
     await this.client.setDrive({
       drive_id: "rootfs",
-      path_on_host: this.vmRootfsPath,
+      path_on_host: this.config.rootfsPath,
       is_root_device: true,
+      is_read_only: true
+    });
+    console.log(`[VM ${this.config.vmId}] Overlay: ${this.vmOverlayPath}`);
+    await this.client.setDrive({
+      drive_id: "overlay",
+      path_on_host: this.vmOverlayPath,
+      is_root_device: false,
       is_read_only: false
-      // Need write access for agent execution
     });
     console.log(
       `[VM ${this.config.vmId}] Network: ${this.networkConfig.tapDevice}`
@@ -770,7 +818,7 @@ var FirecrackerVM = class {
 };
 
 // src/lib/firecracker/guest.ts
-import { exec as exec2, execSync as execSync2 } from "child_process";
+import { exec as exec2, execSync as execSync3 } from "child_process";
 import { promisify as promisify2 } from "util";
 import fs3 from "fs";
 import path2 from "path";
@@ -6239,9 +6287,207 @@ var checkpointsByIdContract = c10.router({
   }
 });
 
-// ../../packages/core/src/contracts/public/common.ts
+// ../../packages/core/src/contracts/schedules.ts
 import { z as z15 } from "zod";
-var publicApiErrorTypeSchema = z15.enum([
+var c11 = initContract();
+var scheduleTriggerSchema = z15.object({
+  cron: z15.string().optional(),
+  at: z15.string().optional(),
+  timezone: z15.string().default("UTC")
+}).refine((data) => data.cron && !data.at || !data.cron && data.at, {
+  message: "Exactly one of 'cron' or 'at' must be specified"
+});
+var scheduleRunConfigSchema = z15.object({
+  agent: z15.string().min(1, "Agent reference required"),
+  prompt: z15.string().min(1, "Prompt required"),
+  vars: z15.record(z15.string(), z15.string()).optional(),
+  secrets: z15.record(z15.string(), z15.string()).optional(),
+  artifactName: z15.string().optional(),
+  artifactVersion: z15.string().optional(),
+  volumeVersions: z15.record(z15.string(), z15.string()).optional()
+});
+var scheduleDefinitionSchema = z15.object({
+  on: scheduleTriggerSchema,
+  run: scheduleRunConfigSchema
+});
+var scheduleYamlSchema = z15.object({
+  version: z15.literal("1.0"),
+  schedules: z15.record(z15.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z15.object({
+  name: z15.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z15.string().optional(),
+  atTime: z15.string().optional(),
+  timezone: z15.string().default("UTC"),
+  prompt: z15.string().min(1, "Prompt required"),
+  vars: z15.record(z15.string(), z15.string()).optional(),
+  secrets: z15.record(z15.string(), z15.string()).optional(),
+  artifactName: z15.string().optional(),
+  artifactVersion: z15.string().optional(),
+  volumeVersions: z15.record(z15.string(), z15.string()).optional(),
+  // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
+  composeId: z15.string().uuid("Invalid compose ID")
+}).refine(
+  (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
+  {
+    message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
+  }
+);
+var scheduleResponseSchema = z15.object({
+  id: z15.string().uuid(),
+  composeId: z15.string().uuid(),
+  composeName: z15.string(),
+  scopeSlug: z15.string(),
+  name: z15.string(),
+  cronExpression: z15.string().nullable(),
+  atTime: z15.string().nullable(),
+  timezone: z15.string(),
+  prompt: z15.string(),
+  vars: z15.record(z15.string(), z15.string()).nullable(),
+  // Secret names only (values are never returned)
+  secretNames: z15.array(z15.string()).nullable(),
+  artifactName: z15.string().nullable(),
+  artifactVersion: z15.string().nullable(),
+  volumeVersions: z15.record(z15.string(), z15.string()).nullable(),
+  enabled: z15.boolean(),
+  nextRunAt: z15.string().nullable(),
+  lastRunAt: z15.string().nullable(),
+  lastRunId: z15.string().nullable(),
+  createdAt: z15.string(),
+  updatedAt: z15.string()
+});
+var scheduleListResponseSchema = z15.object({
+  schedules: z15.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z15.object({
+  schedule: scheduleResponseSchema,
+  created: z15.boolean()
+  // true if created, false if updated
+});
+var schedulesMainContract = c11.router({
+  /**
+   * POST /api/agent/schedules
+   * Deploy (create or update) a schedule
+   */
+  deploy: {
+    method: "POST",
+    path: "/api/agent/schedules",
+    body: deployScheduleRequestSchema,
+    responses: {
+      200: deployScheduleResponseSchema,
+      // Updated
+      201: deployScheduleResponseSchema,
+      // Created
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      409: apiErrorSchema
+      // Schedule limit reached
+    },
+    summary: "Deploy schedule (create or update)"
+  },
+  /**
+   * GET /api/agent/schedules
+   * List all schedules for the user
+   */
+  list: {
+    method: "GET",
+    path: "/api/agent/schedules",
+    responses: {
+      200: scheduleListResponseSchema,
+      401: apiErrorSchema
+    },
+    summary: "List all schedules"
+  }
+});
+var schedulesByNameContract = c11.router({
+  /**
+   * GET /api/agent/schedules/:name
+   * Get schedule by name
+   */
+  getByName: {
+    method: "GET",
+    path: "/api/agent/schedules/:name",
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
+    }),
+    query: z15.object({
+      composeId: z15.string().uuid("Compose ID required")
+    }),
+    responses: {
+      200: scheduleResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get schedule by name"
+  },
+  /**
+   * DELETE /api/agent/schedules/:name
+   * Delete schedule by name
+   */
+  delete: {
+    method: "DELETE",
+    path: "/api/agent/schedules/:name",
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
+    }),
+    query: z15.object({
+      composeId: z15.string().uuid("Compose ID required")
+    }),
+    responses: {
+      204: z15.undefined(),
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Delete schedule"
+  }
+});
+var schedulesEnableContract = c11.router({
+  /**
+   * POST /api/agent/schedules/:name/enable
+   * Enable a disabled schedule
+   */
+  enable: {
+    method: "POST",
+    path: "/api/agent/schedules/:name/enable",
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
+    }),
+    body: z15.object({
+      composeId: z15.string().uuid("Compose ID required")
+    }),
+    responses: {
+      200: scheduleResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Enable schedule"
+  },
+  /**
+   * POST /api/agent/schedules/:name/disable
+   * Disable an enabled schedule
+   */
+  disable: {
+    method: "POST",
+    path: "/api/agent/schedules/:name/disable",
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
+    }),
+    body: z15.object({
+      composeId: z15.string().uuid("Compose ID required")
+    }),
+    responses: {
+      200: scheduleResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Disable schedule"
+  }
+});
+
+// ../../packages/core/src/contracts/public/common.ts
+import { z as z16 } from "zod";
+var publicApiErrorTypeSchema = z16.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -6253,55 +6499,55 @@ var publicApiErrorTypeSchema = z15.enum([
   "conflict_error"
   // Resource conflict (409)
 ]);
-var publicApiErrorSchema = z15.object({
-  error: z15.object({
+var publicApiErrorSchema = z16.object({
+  error: z16.object({
     type: publicApiErrorTypeSchema,
-    code: z15.string(),
-    message: z15.string(),
-    param: z15.string().optional(),
-    doc_url: z15.string().url().optional()
+    code: z16.string(),
+    message: z16.string(),
+    param: z16.string().optional(),
+    doc_url: z16.string().url().optional()
   })
 });
-var paginationSchema = z15.object({
-  has_more: z15.boolean(),
-  next_cursor: z15.string().nullable()
+var paginationSchema = z16.object({
+  has_more: z16.boolean(),
+  next_cursor: z16.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z15.object({
-    data: z15.array(dataSchema),
+  return z16.object({
+    data: z16.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z15.object({
-  cursor: z15.string().optional(),
-  limit: z15.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z16.object({
+  cursor: z16.string().optional(),
+  limit: z16.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z15.string().uuid();
-var timestampSchema = z15.string().datetime();
+var requestIdSchema = z16.string().uuid();
+var timestampSchema = z16.string().datetime();
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z16 } from "zod";
-var c11 = initContract();
-var publicAgentSchema = z16.object({
-  id: z16.string(),
-  name: z16.string(),
-  current_version_id: z16.string().nullable(),
+import { z as z17 } from "zod";
+var c12 = initContract();
+var publicAgentSchema = z17.object({
+  id: z17.string(),
+  name: z17.string(),
+  current_version_id: z17.string().nullable(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var agentVersionSchema = z16.object({
-  id: z16.string(),
-  agent_id: z16.string(),
-  version_number: z16.number(),
+var agentVersionSchema = z17.object({
+  id: z17.string(),
+  agent_id: z17.string(),
+  version_number: z17.number(),
   created_at: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z16.string().optional()
+  name: z17.string().optional()
 });
-var publicAgentsListContract = c11.router({
+var publicAgentsListContract = c12.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -6315,12 +6561,12 @@ var publicAgentsListContract = c11.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c11.router({
+var publicAgentByIdContract = c12.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Agent ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -6332,12 +6578,12 @@ var publicAgentByIdContract = c11.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c11.router({
+var publicAgentVersionsContract = c12.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Agent ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -6352,9 +6598,9 @@ var publicAgentVersionsContract = c11.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z17 } from "zod";
-var c12 = initContract();
-var publicRunStatusSchema = z17.enum([
+import { z as z18 } from "zod";
+var c13 = initContract();
+var publicRunStatusSchema = z18.enum([
   "pending",
   "running",
   "completed",
@@ -6362,56 +6608,56 @@ var publicRunStatusSchema = z17.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z17.object({
-  id: z17.string(),
-  agent_id: z17.string(),
-  agent_name: z17.string(),
+var publicRunSchema = z18.object({
+  id: z18.string(),
+  agent_id: z18.string(),
+  agent_name: z18.string(),
   status: publicRunStatusSchema,
-  prompt: z17.string(),
+  prompt: z18.string(),
   created_at: timestampSchema,
   started_at: timestampSchema.nullable(),
   completed_at: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z17.string().nullable(),
-  execution_time_ms: z17.number().nullable(),
-  checkpoint_id: z17.string().nullable(),
-  session_id: z17.string().nullable(),
-  artifact_name: z17.string().nullable(),
-  artifact_version: z17.string().nullable(),
-  volumes: z17.record(z17.string(), z17.string()).optional()
+  error: z18.string().nullable(),
+  execution_time_ms: z18.number().nullable(),
+  checkpoint_id: z18.string().nullable(),
+  session_id: z18.string().nullable(),
+  artifact_name: z18.string().nullable(),
+  artifact_version: z18.string().nullable(),
+  volumes: z18.record(z18.string(), z18.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z17.object({
+var createRunRequestSchema = z18.object({
   // Agent identification (one of: agent, agent_id, session_id, checkpoint_id)
-  agent: z17.string().optional(),
+  agent: z18.string().optional(),
   // Agent name
-  agent_id: z17.string().optional(),
+  agent_id: z18.string().optional(),
   // Agent ID
-  agent_version: z17.string().optional(),
+  agent_version: z18.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  session_id: z17.string().optional(),
+  session_id: z18.string().optional(),
   // Resume from checkpoint
-  checkpoint_id: z17.string().optional(),
+  checkpoint_id: z18.string().optional(),
   // Required
-  prompt: z17.string().min(1, "Prompt is required"),
+  prompt: z18.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z17.record(z17.string(), z17.string()).optional(),
-  secrets: z17.record(z17.string(), z17.string()).optional(),
-  artifact_name: z17.string().optional(),
+  variables: z18.record(z18.string(), z18.string()).optional(),
+  secrets: z18.record(z18.string(), z18.string()).optional(),
+  artifact_name: z18.string().optional(),
   // Artifact name to mount
-  artifact_version: z17.string().optional(),
+  artifact_version: z18.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z17.record(z17.string(), z17.string()).optional()
+  volumes: z18.record(z18.string(), z18.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
-  agent_id: z17.string().optional(),
+  agent_id: z18.string().optional(),
   status: publicRunStatusSchema.optional(),
   since: timestampSchema.optional()
 });
-var publicRunsListContract = c12.router({
+var publicRunsListContract = c13.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -6440,12 +6686,12 @@ var publicRunsListContract = c12.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c12.router({
+var publicRunByIdContract = c13.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Run ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -6457,14 +6703,14 @@ var publicRunByIdContract = c12.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c12.router({
+var publicRunCancelContract = c13.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Run ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Run ID is required")
     }),
-    body: z17.undefined(),
+    body: z18.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -6477,26 +6723,26 @@ var publicRunCancelContract = c12.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z17.object({
+var logEntrySchema = z18.object({
   timestamp: timestampSchema,
-  type: z17.enum(["agent", "system", "network"]),
-  level: z17.enum(["debug", "info", "warn", "error"]),
-  message: z17.string(),
-  metadata: z17.record(z17.string(), z17.unknown()).optional()
+  type: z18.enum(["agent", "system", "network"]),
+  level: z18.enum(["debug", "info", "warn", "error"]),
+  message: z18.string(),
+  metadata: z18.record(z18.string(), z18.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z17.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z18.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z17.enum(["asc", "desc"]).default("asc")
+  order: z18.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c12.router({
+var publicRunLogsContract = c13.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Run ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -6509,29 +6755,29 @@ var publicRunLogsContract = c12.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z17.object({
+var metricPointSchema = z18.object({
   timestamp: timestampSchema,
-  cpu_percent: z17.number(),
-  memory_used_mb: z17.number(),
-  memory_total_mb: z17.number(),
-  disk_used_mb: z17.number(),
-  disk_total_mb: z17.number()
-});
-var metricsSummarySchema = z17.object({
-  avg_cpu_percent: z17.number(),
-  max_memory_used_mb: z17.number(),
-  total_duration_ms: z17.number().nullable()
-});
-var metricsResponseSchema2 = z17.object({
-  data: z17.array(metricPointSchema),
+  cpu_percent: z18.number(),
+  memory_used_mb: z18.number(),
+  memory_total_mb: z18.number(),
+  disk_used_mb: z18.number(),
+  disk_total_mb: z18.number()
+});
+var metricsSummarySchema = z18.object({
+  avg_cpu_percent: z18.number(),
+  max_memory_used_mb: z18.number(),
+  total_duration_ms: z18.number().nullable()
+});
+var metricsResponseSchema2 = z18.object({
+  data: z18.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c12.router({
+var publicRunMetricsContract = c13.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Run ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -6543,7 +6789,7 @@ var publicRunMetricsContract = c12.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z17.enum([
+var sseEventTypeSchema = z18.enum([
   "status",
   // Run status change
   "output",
@@ -6555,25 +6801,25 @@ var sseEventTypeSchema = z17.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z17.object({
+var sseEventSchema = z18.object({
   event: sseEventTypeSchema,
-  data: z17.unknown(),
-  id: z17.string().optional()
+  data: z18.unknown(),
+  id: z18.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c12.router({
+var publicRunEventsContract = c13.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Run ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Run ID is required")
     }),
-    query: z17.object({
-      last_event_id: z17.string().optional()
+    query: z18.object({
+      last_event_id: z18.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z17.any(),
+      200: z18.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -6585,28 +6831,28 @@ var publicRunEventsContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z18 } from "zod";
-var c13 = initContract();
-var publicArtifactSchema = z18.object({
-  id: z18.string(),
-  name: z18.string(),
-  current_version_id: z18.string().nullable(),
-  size: z18.number(),
+import { z as z19 } from "zod";
+var c14 = initContract();
+var publicArtifactSchema = z19.object({
+  id: z19.string(),
+  name: z19.string(),
+  current_version_id: z19.string().nullable(),
+  size: z19.number(),
   // Total size in bytes
-  file_count: z18.number(),
+  file_count: z19.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var artifactVersionSchema = z18.object({
-  id: z18.string(),
+var artifactVersionSchema = z19.object({
+  id: z19.string(),
   // SHA-256 content hash
-  artifact_id: z18.string(),
-  size: z18.number(),
+  artifact_id: z19.string(),
+  size: z19.number(),
   // Size in bytes
-  file_count: z18.number(),
-  message: z18.string().nullable(),
+  file_count: z19.number(),
+  message: z19.string().nullable(),
   // Optional commit message
-  created_by: z18.string(),
+  created_by: z19.string(),
   created_at: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -6616,7 +6862,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c13.router({
+var publicArtifactsListContract = c14.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -6630,12 +6876,12 @@ var publicArtifactsListContract = c13.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c13.router({
+var publicArtifactByIdContract = c14.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Artifact ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -6647,12 +6893,12 @@ var publicArtifactByIdContract = c13.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c13.router({
+var publicArtifactVersionsContract = c14.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Artifact ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -6665,19 +6911,19 @@ var publicArtifactVersionsContract = c13.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c13.router({
+var publicArtifactDownloadContract = c14.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Artifact ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Artifact ID is required")
     }),
-    query: z18.object({
-      version_id: z18.string().optional()
+    query: z19.object({
+      version_id: z19.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z18.undefined(),
+      302: z19.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -6689,28 +6935,28 @@ var publicArtifactDownloadContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z19 } from "zod";
-var c14 = initContract();
-var publicVolumeSchema = z19.object({
-  id: z19.string(),
-  name: z19.string(),
-  current_version_id: z19.string().nullable(),
-  size: z19.number(),
+import { z as z20 } from "zod";
+var c15 = initContract();
+var publicVolumeSchema = z20.object({
+  id: z20.string(),
+  name: z20.string(),
+  current_version_id: z20.string().nullable(),
+  size: z20.number(),
   // Total size in bytes
-  file_count: z19.number(),
+  file_count: z20.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var volumeVersionSchema = z19.object({
-  id: z19.string(),
+var volumeVersionSchema = z20.object({
+  id: z20.string(),
   // SHA-256 content hash
-  volume_id: z19.string(),
-  size: z19.number(),
+  volume_id: z20.string(),
+  size: z20.number(),
   // Size in bytes
-  file_count: z19.number(),
-  message: z19.string().nullable(),
+  file_count: z20.number(),
+  message: z20.string().nullable(),
   // Optional commit message
-  created_by: z19.string(),
+  created_by: z20.string(),
   created_at: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -6718,7 +6964,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c14.router({
+var publicVolumesListContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -6732,12 +6978,12 @@ var publicVolumesListContract = c14.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c14.router({
+var publicVolumeByIdContract = c15.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Volume ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -6749,12 +6995,12 @@ var publicVolumeByIdContract = c14.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c14.router({
+var publicVolumeVersionsContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Volume ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -6767,19 +7013,19 @@ var publicVolumeVersionsContract = c14.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c14.router({
+var publicVolumeDownloadContract = c15.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Volume ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Volume ID is required")
     }),
-    query: z19.object({
-      version_id: z19.string().optional()
+    query: z20.object({
+      version_id: z20.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z19.undefined(),
+      302: z20.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -9955,6 +10201,208 @@ function initProxyManager(config) {
   return globalProxyManager;
 }
 
+// src/lib/metrics/provider.ts
+import {
+  MeterProvider,
+  PeriodicExportingMetricReader
+} from "@opentelemetry/sdk-metrics";
+import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-proto";
+import { Resource } from "@opentelemetry/resources";
+import { ATTR_SERVICE_NAME } from "@opentelemetry/semantic-conventions";
+import { metrics } from "@opentelemetry/api";
+var meterProvider = null;
+var initialized = false;
+var enabled = false;
+var _runnerLabel = "";
+function initMetrics(config) {
+  if (initialized) return;
+  initialized = true;
+  _runnerLabel = config.runnerLabel;
+  if (!config.axiomToken) {
+    console.log("[metrics] AXIOM_TOKEN not configured, metrics disabled");
+    return;
+  }
+  const env = config.environment ?? "dev";
+  const exporter = new OTLPMetricExporter({
+    url: "https://api.axiom.co/v1/metrics",
+    headers: {
+      Authorization: `Bearer ${config.axiomToken}`,
+      "X-Axiom-Dataset": `runner-metrics-${env}`
+    }
+  });
+  meterProvider = new MeterProvider({
+    resource: new Resource({
+      [ATTR_SERVICE_NAME]: config.serviceName,
+      "deployment.environment": env,
+      "runner.label": config.runnerLabel
+    }),
+    readers: [
+      new PeriodicExportingMetricReader({
+        exporter,
+        exportIntervalMillis: config.exportIntervalMs ?? 3e4
+      })
+    ]
+  });
+  metrics.setGlobalMeterProvider(meterProvider);
+  enabled = true;
+  console.log(
+    `[metrics] initialized for ${config.serviceName} (${env}), runner: ${config.runnerLabel}`
+  );
+}
+function isMetricsEnabled() {
+  return enabled;
+}
+function getRunnerLabel() {
+  return _runnerLabel;
+}
+function getMeter(name) {
+  return metrics.getMeter(name);
+}
+async function flushMetrics() {
+  if (meterProvider) {
+    await meterProvider.forceFlush();
+  }
+}
+async function shutdownMetrics() {
+  if (meterProvider) {
+    await meterProvider.shutdown();
+  }
+}
+
+// src/lib/metrics/instruments.ts
+var runnerOperationTotal = null;
+var runnerOperationErrorsTotal = null;
+var runnerOperationDuration = null;
+var sandboxOperationTotal = null;
+var sandboxOperationErrorsTotal = null;
+var sandboxOperationDuration = null;
+function getRunnerInstruments() {
+  if (!runnerOperationTotal) {
+    const meter = getMeter("vm0-runner");
+    runnerOperationTotal = meter.createCounter("runner_operation_total", {
+      description: "Total number of runner operations"
+    });
+    runnerOperationErrorsTotal = meter.createCounter(
+      "runner_operation_errors_total",
+      {
+        description: "Total number of runner operation errors"
+      }
+    );
+    runnerOperationDuration = meter.createHistogram(
+      "runner_operation_duration_ms",
+      {
+        description: "Runner operation duration in milliseconds",
+        unit: "ms"
+      }
+    );
+  }
+  return {
+    runnerOperationTotal,
+    runnerOperationErrorsTotal,
+    runnerOperationDuration
+  };
+}
+function getSandboxInstruments() {
+  if (!sandboxOperationTotal) {
+    const meter = getMeter("vm0-runner");
+    sandboxOperationTotal = meter.createCounter("sandbox_operation_total", {
+      description: "Total number of sandbox operations"
+    });
+    sandboxOperationErrorsTotal = meter.createCounter(
+      "sandbox_operation_errors_total",
+      {
+        description: "Total number of sandbox operation errors"
+      }
+    );
+    sandboxOperationDuration = meter.createHistogram(
+      "sandbox_operation_duration_ms",
+      {
+        description: "Sandbox operation duration in milliseconds",
+        unit: "ms"
+      }
+    );
+  }
+  return {
+    sandboxOperationTotal,
+    sandboxOperationErrorsTotal,
+    sandboxOperationDuration
+  };
+}
+function recordRunnerOperation(attrs) {
+  if (!isMetricsEnabled()) return;
+  const {
+    runnerOperationTotal: runnerOperationTotal2,
+    runnerOperationErrorsTotal: runnerOperationErrorsTotal2,
+    runnerOperationDuration: runnerOperationDuration2
+  } = getRunnerInstruments();
+  const labels = {
+    action_type: attrs.actionType,
+    runner_label: getRunnerLabel()
+  };
+  runnerOperationTotal2.add(1, labels);
+  if (!attrs.success) {
+    runnerOperationErrorsTotal2.add(1, labels);
+  }
+  runnerOperationDuration2.record(attrs.durationMs, {
+    ...labels,
+    success: String(attrs.success)
+  });
+}
+function recordSandboxOperation(attrs) {
+  if (!isMetricsEnabled()) return;
+  const {
+    sandboxOperationTotal: sandboxOperationTotal2,
+    sandboxOperationErrorsTotal: sandboxOperationErrorsTotal2,
+    sandboxOperationDuration: sandboxOperationDuration2
+  } = getSandboxInstruments();
+  const labels = {
+    sandbox_type: "runner",
+    action_type: attrs.actionType
+  };
+  sandboxOperationTotal2.add(1, labels);
+  if (!attrs.success) {
+    sandboxOperationErrorsTotal2.add(1, labels);
+  }
+  sandboxOperationDuration2.record(attrs.durationMs, {
+    ...labels,
+    success: String(attrs.success)
+  });
+}
+
+// src/lib/metrics/timing.ts
+async function withRunnerTiming(actionType, fn) {
+  const startTime = Date.now();
+  let success = true;
+  try {
+    return await fn();
+  } catch (error) {
+    success = false;
+    throw error;
+  } finally {
+    recordRunnerOperation({
+      actionType,
+      durationMs: Date.now() - startTime,
+      success
+    });
+  }
+}
+async function withSandboxTiming(actionType, fn) {
+  const startTime = Date.now();
+  let success = true;
+  try {
+    return await fn();
+  } catch (error) {
+    success = false;
+    throw error;
+  } finally {
+    recordSandboxOperation({
+      actionType,
+      durationMs: Date.now() - startTime,
+      success
+    });
+  }
+}
+
 // src/lib/executor.ts
 function getVmIdFromRunId(runId) {
   return runId.split("-")[0] || runId.substring(0, 8);
@@ -10142,11 +10590,12 @@ nameserver 1.1.1.1`;
     `sudo sh -c 'rm -f /etc/resolv.conf && echo "${dnsConfig}" > /etc/resolv.conf'`
   );
 }
-async function executeJob(context, config) {
+async function executeJob(context, config, options = {}) {
   const vmId = getVmIdFromRunId(context.runId);
   let vm = null;
   let guestIp = null;
-  console.log(`[Executor] Starting job ${context.runId} in VM ${vmId}`);
+  const log = options.logger ?? ((msg) => console.log(msg));
+  log(`[Executor] Starting job ${context.runId} in VM ${vmId}`);
   try {
     const workspacesDir = path4.join(process.cwd(), "workspaces");
     const vmConfig = {
@@ -10158,24 +10607,27 @@ async function executeJob(context, config) {
       firecrackerBinary: config.firecracker.binary,
       workDir: path4.join(workspacesDir, `vm0-${vmId}`)
     };
-    console.log(`[Executor] Creating VM ${vmId}...`);
+    log(`[Executor] Creating VM ${vmId}...`);
     vm = new FirecrackerVM(vmConfig);
-    await vm.start();
+    await withSandboxTiming("vm_create", () => vm.start());
     guestIp = vm.getGuestIp();
     if (!guestIp) {
       throw new Error("VM started but no IP address available");
     }
-    console.log(`[Executor] VM ${vmId} started, guest IP: ${guestIp}`);
+    log(`[Executor] VM ${vmId} started, guest IP: ${guestIp}`);
     const privateKeyPath = getRunnerSSHKeyPath();
     const ssh = createVMSSHClient(guestIp, "user", privateKeyPath || void 0);
-    console.log(`[Executor] Waiting for SSH on ${guestIp}...`);
-    await ssh.waitUntilReachable(12e4, 2e3);
-    console.log(`[Executor] SSH ready on ${guestIp}`);
+    log(`[Executor] Waiting for SSH on ${guestIp}...`);
+    await withSandboxTiming(
+      "ssh_wait",
+      () => ssh.waitUntilReachable(12e4, 2e3)
+    );
+    log(`[Executor] SSH ready on ${guestIp}`);
     const firewallConfig = context.experimentalFirewall;
     if (firewallConfig?.enabled) {
       const mitmEnabled = firewallConfig.experimental_mitm ?? false;
       const sealSecretsEnabled = firewallConfig.experimental_seal_secrets ?? false;
-      console.log(
+      log(
         `[Executor] Setting up network security for VM ${guestIp} (mitm=${mitmEnabled}, sealSecrets=${sealSecretsEnabled})`
       );
       await setupVMProxyRules(guestIp, config.proxy.port);
@@ -10188,36 +10640,50 @@ async function executeJob(context, config) {
         await installProxyCA(ssh);
       }
     }
-    console.log(`[Executor] Configuring DNS...`);
+    log(`[Executor] Configuring DNS...`);
     await configureDNS(ssh);
-    console.log(`[Executor] Uploading scripts...`);
-    await uploadScripts(ssh);
-    console.log(`[Executor] Scripts uploaded to ${SCRIPT_PATHS.baseDir}`);
+    log(`[Executor] Uploading scripts...`);
+    await withSandboxTiming("script_upload", () => uploadScripts(ssh));
+    log(`[Executor] Scripts uploaded to ${SCRIPT_PATHS.baseDir}`);
     if (context.storageManifest) {
-      await downloadStorages(ssh, context.storageManifest);
+      await withSandboxTiming(
+        "storage_download",
+        () => downloadStorages(ssh, context.storageManifest)
+      );
     }
     if (context.resumeSession) {
-      await restoreSessionHistory(
-        ssh,
-        context.resumeSession,
-        context.workingDir,
-        context.cliAgentType || "claude-code"
+      await withSandboxTiming(
+        "session_restore",
+        () => restoreSessionHistory(
+          ssh,
+          context.resumeSession,
+          context.workingDir,
+          context.cliAgentType || "claude-code"
+        )
       );
     }
     const envVars = buildEnvironmentVariables(context, config.server.url);
     const envJson = JSON.stringify(envVars);
-    console.log(
+    log(
       `[Executor] Writing env JSON (${envJson.length} bytes) to ${ENV_JSON_PATH}`
     );
     await ssh.writeFile(ENV_JSON_PATH, envJson);
     const systemLogFile = `/tmp/vm0-main-${context.runId}.log`;
     const exitCodeFile = `/tmp/vm0-exit-${context.runId}`;
-    console.log(`[Executor] Running agent via env-loader (background)...`);
     const startTime = Date.now();
-    await ssh.exec(
-      `nohup sh -c 'python3 -u ${ENV_LOADER_PATH}; echo $? > ${exitCodeFile}' > ${systemLogFile} 2>&1 &`
-    );
-    console.log(`[Executor] Agent started in background`);
+    if (options.benchmarkMode) {
+      log(`[Executor] Running command directly (benchmark mode)...`);
+      await ssh.exec(
+        `nohup sh -c '${context.prompt}; echo $? > ${exitCodeFile}' > ${systemLogFile} 2>&1 &`
+      );
+      log(`[Executor] Command started in background`);
+    } else {
+      log(`[Executor] Running agent via env-loader (background)...`);
+      await ssh.exec(
+        `nohup sh -c 'python3 -u ${ENV_LOADER_PATH}; echo $? > ${exitCodeFile}' > ${systemLogFile} 2>&1 &`
+      );
+      log(`[Executor] Agent started in background`);
+    }
     const pollIntervalMs = 2e3;
     const maxWaitMs = 24 * 60 * 60 * 1e3;
     let exitCode = 1;
@@ -10226,25 +10692,35 @@ async function executeJob(context, config) {
       await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
       const checkResult = await ssh.exec(`cat ${exitCodeFile} 2>/dev/null`);
       if (checkResult.exitCode === 0 && checkResult.stdout.trim()) {
-        exitCode = parseInt(checkResult.stdout.trim(), 10) || 1;
+        const parsed = parseInt(checkResult.stdout.trim(), 10);
+        exitCode = Number.isNaN(parsed) ? 1 : parsed;
         completed = true;
         break;
       }
     }
-    const duration = Math.round((Date.now() - startTime) / 1e3);
+    const durationMs = Date.now() - startTime;
+    const duration = Math.round(durationMs / 1e3);
     if (!completed) {
-      console.log(`[Executor] Agent timed out after ${duration}s`);
+      log(`[Executor] Agent timed out after ${duration}s`);
+      recordRunnerOperation({
+        actionType: "agent_execute",
+        durationMs,
+        success: false
+      });
       return {
         exitCode: 1,
         error: `Agent execution timed out after ${duration}s`
       };
     }
-    console.log(
-      `[Executor] Agent finished in ${duration}s with exit code ${exitCode}`
-    );
+    recordRunnerOperation({
+      actionType: "agent_execute",
+      durationMs,
+      success: exitCode === 0
+    });
+    log(`[Executor] Agent finished in ${duration}s with exit code ${exitCode}`);
     const logResult = await ssh.exec(`tail -100 ${systemLogFile} 2>/dev/null`);
     if (logResult.stdout) {
-      console.log(
+      log(
         `[Executor] Log output (${logResult.stdout.length} chars): ${logResult.stdout.substring(0, 500)}`
       );
     }
@@ -10261,7 +10737,7 @@ async function executeJob(context, config) {
     };
   } finally {
     if (context.experimentalFirewall?.enabled && guestIp) {
-      console.log(`[Executor] Cleaning up network security for VM ${guestIp}`);
+      log(`[Executor] Cleaning up network security for VM ${guestIp}`);
       try {
         await removeVMProxyRules(guestIp, config.proxy.port);
       } catch (err) {
@@ -10270,21 +10746,23 @@ async function executeJob(context, config) {
         );
       }
       getVMRegistry().unregister(guestIp);
-      try {
-        await uploadNetworkLogs(
-          config.server.url,
-          context.sandboxToken,
-          context.runId
-        );
-      } catch (err) {
-        console.error(
-          `[Executor] Failed to upload network logs: ${err instanceof Error ? err.message : "Unknown error"}`
-        );
+      if (!options.benchmarkMode) {
+        try {
+          await uploadNetworkLogs(
+            config.server.url,
+            context.sandboxToken,
+            context.runId
+          );
+        } catch (err) {
+          console.error(
+            `[Executor] Failed to upload network logs: ${err instanceof Error ? err.message : "Unknown error"}`
+          );
+        }
       }
     }
     if (vm) {
-      console.log(`[Executor] Cleaning up VM ${vmId}...`);
-      await vm.kill();
+      log(`[Executor] Cleaning up VM ${vmId}...`);
+      await withSandboxTiming("cleanup", () => vm.kill());
     }
   }
 }
@@ -10331,6 +10809,18 @@ var startCommand = new Command("start").description("Start the runner").option("
     const config = loadConfig(options.config);
     validateFirecrackerPaths(config.firecracker);
     console.log("Config valid");
+    const datasetSuffix = process.env.AXIOM_DATASET_SUFFIX;
+    if (!datasetSuffix) {
+      throw new Error(
+        "AXIOM_DATASET_SUFFIX is required. Set to 'dev' or 'prod'."
+      );
+    }
+    initMetrics({
+      serviceName: "vm0-runner",
+      runnerLabel: config.name,
+      axiomToken: process.env.AXIOM_TOKEN,
+      environment: datasetSuffix
+    });
     const networkCheck = checkNetworkPrerequisites();
     if (!networkCheck.ok) {
       console.error("Network prerequisites not met:");
@@ -10419,7 +10909,10 @@ var startCommand = new Command("start").description("Start the runner").option("
         continue;
       }
       try {
-        const job = await pollForJob(config.server, config.group);
+        const job = await withRunnerTiming(
+          "poll",
+          () => pollForJob(config.server, config.group)
+        );
         if (!job) {
           await new Promise(
             (resolve) => setTimeout(resolve, config.sandbox.poll_interval_ms)
@@ -10428,7 +10921,10 @@ var startCommand = new Command("start").description("Start the runner").option("
         }
         console.log(`Found job: ${job.runId}`);
         try {
-          const context = await claimJob(config.server, job.runId);
+          const context = await withRunnerTiming(
+            "claim",
+            () => claimJob(config.server, job.runId)
+          );
           console.log(`Claimed job: ${context.runId}`);
           activeJobs.add(context.runId);
           updateStatus();
@@ -10467,6 +10963,9 @@ var startCommand = new Command("start").description("Start the runner").option("
       console.log("Stopping network proxy...");
       await getProxyManager().stop();
     }
+    console.log("Flushing metrics...");
+    await flushMetrics();
+    await shutdownMetrics();
     state.mode = "stopped";
     updateStatus();
     console.log("Runner stopped");
@@ -10505,10 +11004,102 @@ var statusCommand = new Command2("status").description("Check runner connectivit
   }
 });
 
+// src/commands/benchmark.ts
+import { Command as Command3 } from "commander";
+import crypto from "crypto";
+
+// src/lib/timing.ts
+var Timer = class {
+  startTime;
+  constructor() {
+    this.startTime = Date.now();
+  }
+  /**
+   * Get elapsed time formatted as [MM:SS.s]
+   */
+  elapsed() {
+    const ms = Date.now() - this.startTime;
+    const totalSeconds = ms / 1e3;
+    const minutes = Math.floor(totalSeconds / 60);
+    const seconds = (totalSeconds % 60).toFixed(1);
+    return `[${String(minutes).padStart(2, "0")}:${seconds.padStart(4, "0")}]`;
+  }
+  /**
+   * Log message with timestamp
+   */
+  log(message) {
+    console.log(`${this.elapsed()} ${message}`);
+  }
+  /**
+   * Get total elapsed time in seconds
+   */
+  totalSeconds() {
+    return (Date.now() - this.startTime) / 1e3;
+  }
+};
+
+// src/commands/benchmark.ts
+function createBenchmarkContext(prompt, options) {
+  return {
+    runId: crypto.randomUUID(),
+    prompt,
+    agentComposeVersionId: "benchmark-local",
+    vars: null,
+    secretNames: null,
+    checkpointId: null,
+    sandboxToken: "benchmark-token-not-used",
+    workingDir: options.workingDir,
+    storageManifest: null,
+    environment: null,
+    resumeSession: null,
+    secretValues: null,
+    cliAgentType: options.agentType
+  };
+}
+var benchmarkCommand = new Command3("benchmark").description(
+  "Run a VM performance benchmark (executes bash command directly)"
+).argument("<prompt>", "The bash command to execute in the VM").option("--config <path>", "Config file path", "./runner.yaml").option("--working-dir <path>", "Working directory in VM", "/home/user").option("--agent-type <type>", "Agent type", "claude-code").action(async (prompt, options) => {
+  const timer = new Timer();
+  try {
+    timer.log("Loading configuration...");
+    const config = loadDebugConfig(options.config);
+    validateFirecrackerPaths(config.firecracker);
+    timer.log("Checking network prerequisites...");
+    const networkCheck = checkNetworkPrerequisites();
+    if (!networkCheck.ok) {
+      console.error("Network prerequisites not met:");
+      for (const error of networkCheck.errors) {
+        console.error(`  - ${error}`);
+      }
+      process.exit(1);
+    }
+    timer.log("Setting up network bridge...");
+    await setupBridge();
+    timer.log(`Executing command: ${prompt}`);
+    const context = createBenchmarkContext(prompt, options);
+    const result = await executeJob(context, config, {
+      benchmarkMode: true,
+      logger: timer.log.bind(timer)
+    });
+    timer.log(`Exit code: ${result.exitCode}`);
+    if (result.error) {
+      timer.log(`Error: ${result.error}`);
+    }
+    timer.log(`Total time: ${timer.totalSeconds().toFixed(1)}s`);
+    process.exit(result.exitCode);
+  } catch (error) {
+    timer.log(
+      `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+    process.exit(1);
+  }
+});
+
 // src/index.ts
-var version = true ? "2.6.1" : "0.1.0";
+var version = true ? "2.7.1" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(statusCommand);
+program.addCommand(benchmarkCommand);
 program.parse();
 //# sourceMappingURL=index.js.map