@vm0/runner 3.11.1 → 3.11.3

package/index.js

@@ -33,6 +33,8 @@ var runtimePaths = {
 };
 var VM_WORKSPACE_PREFIX = "vm0-";
 var runnerPaths = {
+  /** Base directory used for snapshot generation (baseDir + /snapshot-gen) */
+  snapshotBaseDir: (baseDir) => path.join(baseDir, "snapshot-gen"),
   /** Overlay pool directory for pre-warmed VM overlays */
   overlayPool: (baseDir) => path.join(baseDir, "overlay-pool"),
   /** Workspaces directory for VM work directories */
@@ -41,16 +43,24 @@ var runnerPaths = {
   vmWorkDir: (baseDir, vmId) => path.join(baseDir, "workspaces", `${VM_WORKSPACE_PREFIX}${vmId}`),
   /** Runner status file */
   statusFile: (baseDir) => path.join(baseDir, "status.json"),
+  /** Snapshot generation work directory */
+  snapshotWorkDir: (baseDir) => path.join(baseDir, "workspaces", ".snapshot-work"),
   /** Check if a directory name is a VM workspace */
   isVmWorkspace: (dirname) => dirname.startsWith(VM_WORKSPACE_PREFIX),
   /** Extract vmId from workspace directory name */
   extractVmId: (dirname) => createVmId(dirname.replace(VM_WORKSPACE_PREFIX, ""))
 };
 var vmPaths = {
-  /** Firecracker config file (used with --config-file --no-api) */
+  /** Firecracker config file (used with --config-file) */
   config: (workDir) => path.join(workDir, "config.json"),
-  /** Vsock UDS for host-guest communication */
-  vsock: (workDir) => path.join(workDir, "vsock.sock")
+  /** Vsock directory for host-guest communication */
+  vsockDir: (workDir) => path.join(workDir, "vsock"),
+  /** Vsock UDS path for host-guest communication */
+  vsock: (workDir) => path.join(workDir, "vsock", "vsock.sock"),
+  /** Firecracker API socket (used with --api-sock) */
+  apiSock: (workDir) => path.join(workDir, "api.sock"),
+  /** Overlay filesystem for VM writes */
+  overlay: (workDir) => path.join(workDir, "overlay.ext4")
 };
 var tempPaths = {
   /** Default proxy CA directory */
@@ -325,15 +335,16 @@ async function subscribeToJobs(server, group, onJob, onConnectionChange) {
   };
 }
 
+// src/lib/executor.ts
+import fs9 from "fs";
+
 // src/lib/firecracker/vm.ts
 import { spawn } from "child_process";
 import fs4 from "fs";
 import readline from "readline";
 
 // src/lib/firecracker/netns-pool.ts
-import { exec } from "child_process";
 import path2 from "path";
-import { promisify } from "util";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { z as z3 } from "zod";
 
@@ -377,9 +388,25 @@ async function withFileLock(path7, fn, options) {
   }
 }
 
-// src/lib/firecracker/netns-pool.ts
+// src/lib/utils/exec.ts
+import { exec } from "child_process";
+import { promisify } from "util";
 var execAsync = promisify(exec);
-var logger = createLogger("NetnsPool");
+async function execCommand(cmd, sudo = true) {
+  const fullCmd = sudo ? `sudo ${cmd}` : cmd;
+  try {
+    const { stdout } = await execAsync(fullCmd);
+    return stdout.trim();
+  } catch (error) {
+    const execError = error;
+    throw new Error(
+      `Command failed: ${fullCmd}
+${execError.stderr || execError.message}`
+    );
+  }
+}
+
+// src/lib/firecracker/netns.ts
 var SNAPSHOT_NETWORK = {
   /** TAP device name inside namespace (must match Firecracker config) */
   tapName: "vm0-tap",
@@ -394,14 +421,28 @@ var SNAPSHOT_NETWORK = {
   /** CIDR prefix length (for ip commands) */
   prefixLen: 29
 };
-var VETH_NS = "veth0";
-var NS_PREFIX = "vm0-ns-";
-var VETH_PREFIX = "vm0-ve-";
-var VETH_IP_PREFIX = "10.200";
 function generateSnapshotNetworkBootArgs() {
   const { guestIp, gatewayIp, netmask } = SNAPSHOT_NETWORK;
   return `ip=${guestIp}::${gatewayIp}:${netmask}:vm0-guest:eth0:off`;
 }
+async function createNetnsWithTap(nsName, tap) {
+  await execCommand(`ip netns add ${nsName}`);
+  await execCommand(
+    `ip netns exec ${nsName} ip tuntap add ${tap.tapName} mode tap`
+  );
+  await execCommand(
+    `ip netns exec ${nsName} ip addr add ${tap.gatewayIpWithPrefix} dev ${tap.tapName}`
+  );
+  await execCommand(`ip netns exec ${nsName} ip link set ${tap.tapName} up`);
+  await execCommand(`ip netns exec ${nsName} ip link set lo up`);
+}
+
+// src/lib/firecracker/netns-pool.ts
+var logger = createLogger("NetnsPool");
+var VETH_NS = "veth0";
+var NS_PREFIX = "vm0-ns-";
+var VETH_PREFIX = "vm0-ve-";
+var VETH_IP_PREFIX = "10.200";
 var MAX_RUNNERS = 64;
 var MAX_NAMESPACES_PER_RUNNER = 256;
 var NamespaceEntrySchema = z3.object({
@@ -459,19 +500,6 @@ var RegistryFile = class {
     });
   }
 };
-async function execCommand(cmd, sudo = true) {
-  const fullCmd = sudo ? `sudo ${cmd}` : cmd;
-  try {
-    const { stdout } = await execAsync(fullCmd);
-    return stdout.trim();
-  } catch (error) {
-    const execError = error;
-    throw new Error(
-      `Command failed: ${fullCmd}
-${execError.stderr || execError.message}`
-    );
-  }
-}
 async function getDefaultInterface() {
   const result = await execCommand("ip route get 8.8.8.8", false);
   const match = result.match(/dev\s+(\S+)/);
@@ -694,16 +722,10 @@ var NetnsPool = class _NetnsPool {
     });
     logger.log(`Creating namespace ${name}...`);
     try {
-      await execCommand(`ip netns add ${name}`);
-      await execCommand(
-        `ip netns exec ${name} ip tuntap add ${SNAPSHOT_NETWORK.tapName} mode tap`
-      );
-      await execCommand(
-        `ip netns exec ${name} ip addr add ${SNAPSHOT_NETWORK.gatewayIp}/${SNAPSHOT_NETWORK.prefixLen} dev ${SNAPSHOT_NETWORK.tapName}`
-      );
-      await execCommand(
-        `ip netns exec ${name} ip link set ${SNAPSHOT_NETWORK.tapName} up`
-      );
+      await createNetnsWithTap(name, {
+        tapName: SNAPSHOT_NETWORK.tapName,
+        gatewayIpWithPrefix: `${SNAPSHOT_NETWORK.gatewayIp}/${SNAPSHOT_NETWORK.prefixLen}`
+      });
       await execCommand(
         `ip link add ${vethHost} type veth peer name ${VETH_NS} netns ${name}`
       );
@@ -711,7 +733,6 @@ var NetnsPool = class _NetnsPool {
         `ip netns exec ${name} ip addr add ${vethNsIp}/30 dev ${VETH_NS}`
       );
       await execCommand(`ip netns exec ${name} ip link set ${VETH_NS} up`);
-      await execCommand(`ip netns exec ${name} ip link set lo up`);
       await execCommand(`ip addr add ${vethHostIp}/30 dev ${vethHost}`);
       await execCommand(`ip link set ${vethHost} up`);
       await execCommand(
@@ -1068,6 +1089,36 @@ var FirecrackerClient = class {
   constructor(socketPath) {
     this.socketPath = socketPath;
   }
+  /**
+   * Configure machine settings (vCPUs, memory)
+   */
+  async configureMachine(config) {
+    await this.put("/machine-config", config);
+  }
+  /**
+   * Configure boot source (kernel, boot args)
+   */
+  async configureBootSource(config) {
+    await this.put("/boot-source", config);
+  }
+  /**
+   * Configure network interface
+   */
+  async configureNetworkInterface(config) {
+    await this.put(`/network-interfaces/${config.iface_id}`, config);
+  }
+  /**
+   * Configure vsock device
+   */
+  async configureVsock(config) {
+    await this.put("/vsock", config);
+  }
+  /**
+   * Start the VM instance
+   */
+  async startInstance() {
+    await this.put("/actions", { action_type: "InstanceStart" });
+  }
   /**
    * Pause the VM
    *
@@ -1164,17 +1215,27 @@ var FirecrackerClient = class {
    */
   request(method, path7, body, timeoutMs = 3e4) {
     return new Promise((resolve, reject) => {
+      const bodyStr = body !== void 0 ? JSON.stringify(body) : void 0;
+      const headers = {
+        Accept: "application/json",
+        // Disable keep-alive to prevent pipelining issues
+        Connection: "close"
+      };
+      if (bodyStr !== void 0) {
+        headers["Content-Type"] = "application/json";
+        headers["Content-Length"] = Buffer.byteLength(bodyStr);
+      }
       const options = {
         socketPath: this.socketPath,
-        path: `http://localhost${path7}`,
+        path: path7,
         method,
-        headers: {
-          "Content-Type": "application/json",
-          Accept: "application/json"
-        },
-        timeout: timeoutMs
+        headers,
+        timeout: timeoutMs,
+        // Disable agent to ensure fresh connection for each request
+        // Firecracker's single-threaded API can have issues with pipelined requests
+        agent: false
       };
-      logger3.log(`${method} ${path7}${body ? " " + JSON.stringify(body) : ""}`);
+      logger3.log(`${method} ${path7}${bodyStr ? " " + bodyStr : ""}`);
       const req = http.request(options, (res) => {
         let data = "";
         res.on("data", (chunk) => {
@@ -1204,8 +1265,8 @@ var FirecrackerClient = class {
       req.on("error", (err) => {
         reject(err);
       });
-      if (body) {
-        req.write(JSON.stringify(body));
+      if (bodyStr !== void 0) {
+        req.write(bodyStr);
       }
       req.end();
     });
@@ -1218,6 +1279,58 @@ var FirecrackerClient = class {
   }
 };
 
+// src/lib/firecracker/config.ts
+function buildBootArgs() {
+  const networkBootArgs = generateSnapshotNetworkBootArgs();
+  return `console=ttyS0 reboot=k panic=1 pci=off nomodules random.trust_cpu=on quiet loglevel=0 nokaslr audit=0 numa=off mitigations=off noresume init=/sbin/vm-init ${networkBootArgs}`;
+}
+function buildFirecrackerConfig(params) {
+  const bootArgs = buildBootArgs();
+  return {
+    "boot-source": {
+      kernel_image_path: params.kernelPath,
+      boot_args: bootArgs
+    },
+    drives: [
+      // Base drive (squashfs, read-only, shared across VMs)
+      // Mounted as /dev/vda inside the VM
+      {
+        drive_id: "rootfs",
+        path_on_host: params.rootfsPath,
+        is_root_device: true,
+        is_read_only: true
+      },
+      // Overlay drive (ext4, read-write, per-VM)
+      // Mounted as /dev/vdb inside the VM
+      // The vm-init script combines these using overlayfs
+      {
+        drive_id: "overlay",
+        path_on_host: params.overlayPath,
+        is_root_device: false,
+        is_read_only: false
+      }
+    ],
+    "machine-config": {
+      vcpu_count: params.vcpus,
+      mem_size_mib: params.memoryMb
+    },
+    "network-interfaces": [
+      {
+        // Network interface uses fixed config from SNAPSHOT_NETWORK
+        // TAP device is inside the namespace, created by netns-pool
+        iface_id: "eth0",
+        guest_mac: SNAPSHOT_NETWORK.guestMac,
+        host_dev_name: SNAPSHOT_NETWORK.tapName
+      }
+    ],
+    // Guest CID 3 is the standard guest identifier (CID 0=hypervisor, 1=local, 2=host)
+    vsock: {
+      guest_cid: 3,
+      uds_path: params.vsockPath
+    }
+  };
+}
+
 // src/lib/firecracker/vm.ts
 var logger4 = createLogger("VM");
 var FirecrackerVM = class {
@@ -1282,7 +1395,6 @@ var FirecrackerVM = class {
       throw new Error(`Cannot start VM in state: ${this.state}`);
     }
     try {
-      fs4.mkdirSync(this.workDir, { recursive: true });
       logger4.log(`[VM ${this.config.vmId}] Acquiring resources...`);
       const results = await Promise.allSettled([
         acquireOverlay(),
@@ -1458,74 +1570,23 @@ var FirecrackerVM = class {
   }
   /**
    * Build Firecracker configuration object
-   *
-   * Creates the JSON configuration for Firecracker's --config-file option.
-   * Boot args:
-   *   - console=ttyS0: serial console output
-   *   - reboot=k: use keyboard controller for reboot
-   *   - panic=1: reboot after 1 second on kernel panic
-   *   - pci=off: disable PCI bus (not needed in microVM)
-   *   - nomodules: skip module loading (not needed in microVM)
-   *   - random.trust_cpu=on: trust CPU RNG, skip entropy wait
-   *   - quiet loglevel=0: minimize kernel log output
-   *   - nokaslr: disable kernel address space randomization
-   *   - audit=0: disable kernel auditing
-   *   - numa=off: disable NUMA (single node)
-   *   - mitigations=off: disable CPU vulnerability mitigations
-   *   - noresume: skip hibernation resume check
-   *   - init=/sbin/vm-init: use vm-init (Rust binary) for filesystem setup and vsock-agent
-   *   - ip=...: network configuration (fixed IPs from SNAPSHOT_NETWORK)
    */
   buildConfig() {
     if (!this.netns || !this.vmOverlayPath) {
       throw new Error("VM not properly initialized");
     }
-    const networkBootArgs = generateSnapshotNetworkBootArgs();
-    const bootArgs = `console=ttyS0 reboot=k panic=1 pci=off nomodules random.trust_cpu=on quiet loglevel=0 nokaslr audit=0 numa=off mitigations=off noresume init=/sbin/vm-init ${networkBootArgs}`;
-    logger4.log(`[VM ${this.config.vmId}] Boot args: ${bootArgs}`);
-    return {
-      "boot-source": {
-        kernel_image_path: this.config.kernelPath,
-        boot_args: bootArgs
-      },
-      drives: [
-        // Base drive (squashfs, read-only, shared across VMs)
-        // Mounted as /dev/vda inside the VM
-        {
-          drive_id: "rootfs",
-          path_on_host: this.config.rootfsPath,
-          is_root_device: true,
-          is_read_only: true
-        },
-        // Overlay drive (ext4, read-write, per-VM)
-        // Mounted as /dev/vdb inside the VM
-        // The vm-init script combines these using overlayfs
-        {
-          drive_id: "overlay",
-          path_on_host: this.vmOverlayPath,
-          is_root_device: false,
-          is_read_only: false
-        }
-      ],
-      "machine-config": {
-        vcpu_count: this.config.vcpus,
-        mem_size_mib: this.config.memoryMb
-      },
-      "network-interfaces": [
-        {
-          // Network interface uses fixed config from SNAPSHOT_NETWORK
-          // TAP device is inside the namespace, created by netns-pool
-          iface_id: "eth0",
-          guest_mac: SNAPSHOT_NETWORK.guestMac,
-          host_dev_name: SNAPSHOT_NETWORK.tapName
-        }
-      ],
-      // Guest CID 3 is the standard guest identifier (CID 0=hypervisor, 1=local, 2=host)
-      vsock: {
-        guest_cid: 3,
-        uds_path: this.vsockPath
-      }
-    };
+    const config = buildFirecrackerConfig({
+      kernelPath: this.config.kernelPath,
+      rootfsPath: this.config.rootfsPath,
+      overlayPath: this.vmOverlayPath,
+      vsockPath: this.vsockPath,
+      vcpus: this.config.vcpus,
+      memoryMb: this.config.memoryMb
+    });
+    logger4.log(
+      `[VM ${this.config.vmId}] Boot args: ${config["boot-source"].boot_args}`
+    );
+    return config;
   }
   /**
    * Stop the VM
@@ -2224,6 +2285,20 @@ var VsockClient = class {
     }
     this.cachedExits.clear();
   }
+  /**
+   * Send raw bytes directly to the socket (for testing only)
+   *
+   * This allows tests to send malformed messages to verify the agent's
+   * protocol error handling (e.g., oversized messages).
+   *
+   * @internal This method is only for testing purposes
+   */
+  sendRawForTesting(data) {
+    if (!this.connected || !this.socket) {
+      throw new Error("Not connected - call waitForGuestConnection() first");
+    }
+    this.socket.write(data);
+  }
 };
 
 // ../../packages/core/src/contracts/base.ts
@@ -7644,57 +7719,159 @@ var credentialsByNameContract = c10.router({
   }
 });
 
-// ../../packages/core/src/contracts/model-providers.ts
+// ../../packages/core/src/contracts/secrets.ts
 import { z as z18 } from "zod";
 var c11 = initContract();
-var modelProviderTypeSchema = z18.enum([
+var secretNameSchema = z18.string().min(1, "Secret name is required").max(255, "Secret name must be at most 255 characters").regex(
+  /^[A-Z][A-Z0-9_]*$/,
+  "Secret name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_API_KEY)"
+);
+var secretTypeSchema = z18.enum(["user", "model-provider"]);
+var secretResponseSchema = z18.object({
+  id: z18.string().uuid(),
+  name: z18.string(),
+  description: z18.string().nullable(),
+  type: secretTypeSchema,
+  createdAt: z18.string(),
+  updatedAt: z18.string()
+});
+var secretListResponseSchema = z18.object({
+  secrets: z18.array(secretResponseSchema)
+});
+var setSecretRequestSchema = z18.object({
+  name: secretNameSchema,
+  value: z18.string().min(1, "Secret value is required"),
+  description: z18.string().max(1e3).optional()
+});
+var secretsMainContract = c11.router({
+  /**
+   * GET /api/secrets
+   * List all secrets for the current user's scope (metadata only)
+   */
+  list: {
+    method: "GET",
+    path: "/api/secrets",
+    headers: authHeadersSchema,
+    responses: {
+      200: secretListResponseSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List all secrets (metadata only)"
+  },
+  /**
+   * PUT /api/secrets
+   * Create or update a secret
+   */
+  set: {
+    method: "PUT",
+    path: "/api/secrets",
+    headers: authHeadersSchema,
+    body: setSecretRequestSchema,
+    responses: {
+      200: secretResponseSchema,
+      201: secretResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Create or update a secret"
+  }
+});
+var secretsByNameContract = c11.router({
+  /**
+   * GET /api/secrets/:name
+   * Get a secret by name (metadata only)
+   */
+  get: {
+    method: "GET",
+    path: "/api/secrets/:name",
+    headers: authHeadersSchema,
+    pathParams: z18.object({
+      name: secretNameSchema
+    }),
+    responses: {
+      200: secretResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get secret metadata by name"
+  },
+  /**
+   * DELETE /api/secrets/:name
+   * Delete a secret by name
+   */
+  delete: {
+    method: "DELETE",
+    path: "/api/secrets/:name",
+    headers: authHeadersSchema,
+    pathParams: z18.object({
+      name: secretNameSchema
+    }),
+    responses: {
+      204: c11.noBody(),
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Delete a secret"
+  }
+});
+
+// ../../packages/core/src/contracts/model-providers.ts
+import { z as z19 } from "zod";
+var c12 = initContract();
+var modelProviderTypeSchema = z19.enum([
   "claude-code-oauth-token",
   "anthropic-api-key",
   "openrouter-api-key",
   "moonshot-api-key",
   "minimax-api-key",
+  "deepseek-api-key",
+  "zai-api-key",
   "aws-bedrock"
 ]);
-var modelProviderFrameworkSchema = z18.enum(["claude-code", "codex"]);
-var modelProviderResponseSchema = z18.object({
-  id: z18.string().uuid(),
+var modelProviderFrameworkSchema = z19.enum(["claude-code", "codex"]);
+var modelProviderResponseSchema = z19.object({
+  id: z19.string().uuid(),
   type: modelProviderTypeSchema,
   framework: modelProviderFrameworkSchema,
-  credentialName: z18.string().nullable(),
+  credentialName: z19.string().nullable(),
   // Legacy single-credential (deprecated for multi-auth)
-  authMethod: z18.string().nullable(),
+  authMethod: z19.string().nullable(),
   // For multi-auth providers
-  credentialNames: z18.array(z18.string()).nullable(),
+  credentialNames: z19.array(z19.string()).nullable(),
   // For multi-auth providers
-  isDefault: z18.boolean(),
-  selectedModel: z18.string().nullable(),
-  createdAt: z18.string(),
-  updatedAt: z18.string()
+  isDefault: z19.boolean(),
+  selectedModel: z19.string().nullable(),
+  createdAt: z19.string(),
+  updatedAt: z19.string()
 });
-var modelProviderListResponseSchema = z18.object({
-  modelProviders: z18.array(modelProviderResponseSchema)
+var modelProviderListResponseSchema = z19.object({
+  modelProviders: z19.array(modelProviderResponseSchema)
 });
-var upsertModelProviderRequestSchema = z18.object({
+var upsertModelProviderRequestSchema = z19.object({
   type: modelProviderTypeSchema,
-  credential: z18.string().min(1).optional(),
+  credential: z19.string().min(1).optional(),
   // Legacy single credential
-  authMethod: z18.string().optional(),
+  authMethod: z19.string().optional(),
   // For multi-auth providers
-  credentials: z18.record(z18.string(), z18.string()).optional(),
+  credentials: z19.record(z19.string(), z19.string()).optional(),
   // For multi-auth providers
-  convert: z18.boolean().optional(),
-  selectedModel: z18.string().optional()
+  convert: z19.boolean().optional(),
+  selectedModel: z19.string().optional()
 });
-var upsertModelProviderResponseSchema = z18.object({
+var upsertModelProviderResponseSchema = z19.object({
   provider: modelProviderResponseSchema,
-  created: z18.boolean()
+  created: z19.boolean()
 });
-var checkCredentialResponseSchema = z18.object({
-  exists: z18.boolean(),
-  credentialName: z18.string(),
-  currentType: z18.enum(["user", "model-provider"]).optional()
+var checkCredentialResponseSchema = z19.object({
+  exists: z19.boolean(),
+  credentialName: z19.string(),
+  currentType: z19.enum(["user", "model-provider"]).optional()
 });
-var modelProvidersMainContract = c11.router({
+var modelProvidersMainContract = c12.router({
   list: {
     method: "GET",
     path: "/api/model-providers",
@@ -7722,12 +7899,12 @@ var modelProvidersMainContract = c11.router({
     summary: "Create or update a model provider"
   }
 });
-var modelProvidersCheckContract = c11.router({
+var modelProvidersCheckContract = c12.router({
   check: {
     method: "GET",
     path: "/api/model-providers/check/:type",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
     responses: {
@@ -7738,16 +7915,16 @@ var modelProvidersCheckContract = c11.router({
     summary: "Check if credential exists for a model provider type"
   }
 });
-var modelProvidersByTypeContract = c11.router({
+var modelProvidersByTypeContract = c12.router({
   delete: {
     method: "DELETE",
     path: "/api/model-providers/:type",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c11.noBody(),
+      204: c12.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -7755,15 +7932,15 @@ var modelProvidersByTypeContract = c11.router({
     summary: "Delete a model provider"
   }
 });
-var modelProvidersConvertContract = c11.router({
+var modelProvidersConvertContract = c12.router({
   convert: {
     method: "POST",
     path: "/api/model-providers/:type/convert",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
-    body: z18.undefined(),
+    body: z19.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       400: apiErrorSchema,
@@ -7774,15 +7951,15 @@ var modelProvidersConvertContract = c11.router({
     summary: "Convert existing user credential to model provider"
   }
 });
-var modelProvidersSetDefaultContract = c11.router({
+var modelProvidersSetDefaultContract = c12.router({
   setDefault: {
     method: "POST",
     path: "/api/model-providers/:type/set-default",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
-    body: z18.undefined(),
+    body: z19.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       401: apiErrorSchema,
@@ -7792,15 +7969,15 @@ var modelProvidersSetDefaultContract = c11.router({
     summary: "Set a model provider as default for its framework"
   }
 });
-var updateModelRequestSchema = z18.object({
-  selectedModel: z18.string().optional()
+var updateModelRequestSchema = z19.object({
+  selectedModel: z19.string().optional()
 });
-var modelProvidersUpdateModelContract = c11.router({
+var modelProvidersUpdateModelContract = c12.router({
   updateModel: {
     method: "PATCH",
     path: "/api/model-providers/:type/model",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
     body: updateModelRequestSchema,
@@ -7815,42 +7992,42 @@ var modelProvidersUpdateModelContract = c11.router({
 });
 
 // ../../packages/core/src/contracts/sessions.ts
-import { z as z19 } from "zod";
-var c12 = initContract();
-var sessionResponseSchema = z19.object({
-  id: z19.string(),
-  agentComposeId: z19.string(),
-  agentComposeVersionId: z19.string().nullable(),
-  conversationId: z19.string().nullable(),
-  artifactName: z19.string().nullable(),
-  vars: z19.record(z19.string(), z19.string()).nullable(),
-  secretNames: z19.array(z19.string()).nullable(),
-  volumeVersions: z19.record(z19.string(), z19.string()).nullable(),
-  createdAt: z19.string(),
-  updatedAt: z19.string()
+import { z as z20 } from "zod";
+var c13 = initContract();
+var sessionResponseSchema = z20.object({
+  id: z20.string(),
+  agentComposeId: z20.string(),
+  agentComposeVersionId: z20.string().nullable(),
+  conversationId: z20.string().nullable(),
+  artifactName: z20.string().nullable(),
+  vars: z20.record(z20.string(), z20.string()).nullable(),
+  secretNames: z20.array(z20.string()).nullable(),
+  volumeVersions: z20.record(z20.string(), z20.string()).nullable(),
+  createdAt: z20.string(),
+  updatedAt: z20.string()
 });
-var agentComposeSnapshotSchema = z19.object({
-  agentComposeVersionId: z19.string(),
-  vars: z19.record(z19.string(), z19.string()).optional(),
-  secretNames: z19.array(z19.string()).optional()
+var agentComposeSnapshotSchema = z20.object({
+  agentComposeVersionId: z20.string(),
+  vars: z20.record(z20.string(), z20.string()).optional(),
+  secretNames: z20.array(z20.string()).optional()
 });
-var artifactSnapshotSchema2 = z19.object({
-  artifactName: z19.string(),
-  artifactVersion: z19.string()
+var artifactSnapshotSchema2 = z20.object({
+  artifactName: z20.string(),
+  artifactVersion: z20.string()
 });
-var volumeVersionsSnapshotSchema2 = z19.object({
-  versions: z19.record(z19.string(), z19.string())
+var volumeVersionsSnapshotSchema2 = z20.object({
+  versions: z20.record(z20.string(), z20.string())
 });
-var checkpointResponseSchema = z19.object({
-  id: z19.string(),
-  runId: z19.string(),
-  conversationId: z19.string(),
+var checkpointResponseSchema = z20.object({
+  id: z20.string(),
+  runId: z20.string(),
+  conversationId: z20.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z19.string()
+  createdAt: z20.string()
 });
-var sessionsByIdContract = c12.router({
+var sessionsByIdContract = c13.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -7859,8 +8036,8 @@ var sessionsByIdContract = c12.router({
     method: "GET",
     path: "/api/agent/sessions/:id",
     headers: authHeadersSchema,
-    pathParams: z19.object({
-      id: z19.string().min(1, "Session ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -7871,7 +8048,7 @@ var sessionsByIdContract = c12.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c12.router({
+var checkpointsByIdContract = c13.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -7880,8 +8057,8 @@ var checkpointsByIdContract = c12.router({
     method: "GET",
     path: "/api/agent/checkpoints/:id",
     headers: authHeadersSchema,
-    pathParams: z19.object({
-      id: z19.string().min(1, "Checkpoint ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -7894,93 +8071,93 @@ var checkpointsByIdContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z20 } from "zod";
-var c13 = initContract();
-var scheduleTriggerSchema = z20.object({
-  cron: z20.string().optional(),
-  at: z20.string().optional(),
-  timezone: z20.string().default("UTC")
+import { z as z21 } from "zod";
+var c14 = initContract();
+var scheduleTriggerSchema = z21.object({
+  cron: z21.string().optional(),
+  at: z21.string().optional(),
+  timezone: z21.string().default("UTC")
 }).refine((data) => data.cron && !data.at || !data.cron && data.at, {
   message: "Exactly one of 'cron' or 'at' must be specified"
 });
-var scheduleRunConfigSchema = z20.object({
-  agent: z20.string().min(1, "Agent reference required"),
-  prompt: z20.string().min(1, "Prompt required"),
-  vars: z20.record(z20.string(), z20.string()).optional(),
-  secrets: z20.record(z20.string(), z20.string()).optional(),
-  artifactName: z20.string().optional(),
-  artifactVersion: z20.string().optional(),
-  volumeVersions: z20.record(z20.string(), z20.string()).optional()
+var scheduleRunConfigSchema = z21.object({
+  agent: z21.string().min(1, "Agent reference required"),
+  prompt: z21.string().min(1, "Prompt required"),
+  vars: z21.record(z21.string(), z21.string()).optional(),
+  secrets: z21.record(z21.string(), z21.string()).optional(),
+  artifactName: z21.string().optional(),
+  artifactVersion: z21.string().optional(),
+  volumeVersions: z21.record(z21.string(), z21.string()).optional()
 });
-var scheduleDefinitionSchema = z20.object({
+var scheduleDefinitionSchema = z21.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z20.object({
-  version: z20.literal("1.0"),
-  schedules: z20.record(z20.string(), scheduleDefinitionSchema)
-});
-var deployScheduleRequestSchema = z20.object({
-  name: z20.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z20.string().optional(),
-  atTime: z20.string().optional(),
-  timezone: z20.string().default("UTC"),
-  prompt: z20.string().min(1, "Prompt required"),
-  vars: z20.record(z20.string(), z20.string()).optional(),
-  secrets: z20.record(z20.string(), z20.string()).optional(),
-  artifactName: z20.string().optional(),
-  artifactVersion: z20.string().optional(),
-  volumeVersions: z20.record(z20.string(), z20.string()).optional(),
+var scheduleYamlSchema = z21.object({
+  version: z21.literal("1.0"),
+  schedules: z21.record(z21.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z21.object({
+  name: z21.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z21.string().optional(),
+  atTime: z21.string().optional(),
+  timezone: z21.string().default("UTC"),
+  prompt: z21.string().min(1, "Prompt required"),
+  vars: z21.record(z21.string(), z21.string()).optional(),
+  secrets: z21.record(z21.string(), z21.string()).optional(),
+  artifactName: z21.string().optional(),
+  artifactVersion: z21.string().optional(),
+  volumeVersions: z21.record(z21.string(), z21.string()).optional(),
   // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
-  composeId: z20.string().uuid("Invalid compose ID")
+  composeId: z21.string().uuid("Invalid compose ID")
 }).refine(
   (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
   {
     message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
   }
 );
-var scheduleResponseSchema = z20.object({
-  id: z20.string().uuid(),
-  composeId: z20.string().uuid(),
-  composeName: z20.string(),
-  scopeSlug: z20.string(),
-  name: z20.string(),
-  cronExpression: z20.string().nullable(),
-  atTime: z20.string().nullable(),
-  timezone: z20.string(),
-  prompt: z20.string(),
-  vars: z20.record(z20.string(), z20.string()).nullable(),
+var scheduleResponseSchema = z21.object({
+  id: z21.string().uuid(),
+  composeId: z21.string().uuid(),
+  composeName: z21.string(),
+  scopeSlug: z21.string(),
+  name: z21.string(),
+  cronExpression: z21.string().nullable(),
+  atTime: z21.string().nullable(),
+  timezone: z21.string(),
+  prompt: z21.string(),
+  vars: z21.record(z21.string(), z21.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z20.array(z20.string()).nullable(),
-  artifactName: z20.string().nullable(),
-  artifactVersion: z20.string().nullable(),
-  volumeVersions: z20.record(z20.string(), z20.string()).nullable(),
-  enabled: z20.boolean(),
-  nextRunAt: z20.string().nullable(),
-  lastRunAt: z20.string().nullable(),
-  retryStartedAt: z20.string().nullable(),
-  createdAt: z20.string(),
-  updatedAt: z20.string()
-});
-var runSummarySchema = z20.object({
-  id: z20.string().uuid(),
-  status: z20.enum(["pending", "running", "completed", "failed", "timeout"]),
-  createdAt: z20.string(),
-  completedAt: z20.string().nullable(),
-  error: z20.string().nullable()
-});
-var scheduleRunsResponseSchema = z20.object({
-  runs: z20.array(runSummarySchema)
-});
-var scheduleListResponseSchema = z20.object({
-  schedules: z20.array(scheduleResponseSchema)
-});
-var deployScheduleResponseSchema = z20.object({
+  secretNames: z21.array(z21.string()).nullable(),
+  artifactName: z21.string().nullable(),
+  artifactVersion: z21.string().nullable(),
+  volumeVersions: z21.record(z21.string(), z21.string()).nullable(),
+  enabled: z21.boolean(),
+  nextRunAt: z21.string().nullable(),
+  lastRunAt: z21.string().nullable(),
+  retryStartedAt: z21.string().nullable(),
+  createdAt: z21.string(),
+  updatedAt: z21.string()
+});
+var runSummarySchema = z21.object({
+  id: z21.string().uuid(),
+  status: z21.enum(["pending", "running", "completed", "failed", "timeout"]),
+  createdAt: z21.string(),
+  completedAt: z21.string().nullable(),
+  error: z21.string().nullable()
+});
+var scheduleRunsResponseSchema = z21.object({
+  runs: z21.array(runSummarySchema)
+});
+var scheduleListResponseSchema = z21.object({
+  schedules: z21.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z21.object({
   schedule: scheduleResponseSchema,
-  created: z20.boolean()
+  created: z21.boolean()
   // true if created, false if updated
 });
-var schedulesMainContract = c13.router({
+var schedulesMainContract = c14.router({
   /**
    * POST /api/agent/schedules
    * Deploy (create or update) a schedule
@@ -8018,7 +8195,7 @@ var schedulesMainContract = c13.router({
     summary: "List all schedules"
   }
 });
-var schedulesByNameContract = c13.router({
+var schedulesByNameContract = c14.router({
   /**
    * GET /api/agent/schedules/:name
    * Get schedule by name
@@ -8027,11 +8204,11 @@ var schedulesByNameContract = c13.router({
     method: "GET",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    query: z20.object({
-      composeId: z20.string().uuid("Compose ID required")
+    query: z21.object({
+      composeId: z21.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -8048,21 +8225,21 @@ var schedulesByNameContract = c13.router({
     method: "DELETE",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    query: z20.object({
-      composeId: z20.string().uuid("Compose ID required")
+    query: z21.object({
+      composeId: z21.string().uuid("Compose ID required")
     }),
     responses: {
-      204: c13.noBody(),
+      204: c14.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete schedule"
   }
 });
-var schedulesEnableContract = c13.router({
+var schedulesEnableContract = c14.router({
   /**
    * POST /api/agent/schedules/:name/enable
    * Enable a disabled schedule
@@ -8071,11 +8248,11 @@ var schedulesEnableContract = c13.router({
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    body: z20.object({
-      composeId: z20.string().uuid("Compose ID required")
+    body: z21.object({
+      composeId: z21.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -8092,11 +8269,11 @@ var schedulesEnableContract = c13.router({
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    body: z20.object({
-      composeId: z20.string().uuid("Compose ID required")
+    body: z21.object({
+      composeId: z21.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -8106,7 +8283,7 @@ var schedulesEnableContract = c13.router({
     summary: "Disable schedule"
   }
 });
-var scheduleRunsContract = c13.router({
+var scheduleRunsContract = c14.router({
   /**
    * GET /api/agent/schedules/:name/runs
    * List recent runs for a schedule
@@ -8115,12 +8292,12 @@ var scheduleRunsContract = c13.router({
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    query: z20.object({
-      composeId: z20.string().uuid("Compose ID required"),
-      limit: z20.coerce.number().min(0).max(100).default(5)
+    query: z21.object({
+      composeId: z21.string().uuid("Compose ID required"),
+      limit: z21.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -8132,18 +8309,18 @@ var scheduleRunsContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/realtime.ts
-import { z as z21 } from "zod";
-var c14 = initContract();
-var ablyTokenRequestSchema = z21.object({
-  keyName: z21.string(),
-  ttl: z21.number().optional(),
-  timestamp: z21.number(),
-  capability: z21.string(),
-  clientId: z21.string().optional(),
-  nonce: z21.string(),
-  mac: z21.string()
-});
-var realtimeTokenContract = c14.router({
+import { z as z22 } from "zod";
+var c15 = initContract();
+var ablyTokenRequestSchema = z22.object({
+  keyName: z22.string(),
+  ttl: z22.number().optional(),
+  timestamp: z22.number(),
+  capability: z22.string(),
+  clientId: z22.string().optional(),
+  nonce: z22.string(),
+  mac: z22.string()
+});
+var realtimeTokenContract = c15.router({
   /**
    * POST /api/realtime/token
    * Get an Ably token to subscribe to a run's events channel
@@ -8152,8 +8329,8 @@ var realtimeTokenContract = c14.router({
     method: "POST",
     path: "/api/realtime/token",
     headers: authHeadersSchema,
-    body: z21.object({
-      runId: z21.string().uuid("runId must be a valid UUID")
+    body: z22.object({
+      runId: z22.string().uuid("runId must be a valid UUID")
     }),
     responses: {
       200: ablyTokenRequestSchema,
@@ -8165,7 +8342,7 @@ var realtimeTokenContract = c14.router({
     summary: "Get Ably token for run event subscription"
   }
 });
-var runnerRealtimeTokenContract = c14.router({
+var runnerRealtimeTokenContract = c15.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -8174,7 +8351,7 @@ var runnerRealtimeTokenContract = c14.router({
     method: "POST",
     path: "/api/runners/realtime/token",
     headers: authHeadersSchema,
-    body: z21.object({
+    body: z22.object({
       group: runnerGroupSchema
     }),
     responses: {
@@ -8188,11 +8365,11 @@ var runnerRealtimeTokenContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/platform.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 
 // ../../packages/core/src/contracts/public/common.ts
-import { z as z22 } from "zod";
-var publicApiErrorTypeSchema = z22.enum([
+import { z as z23 } from "zod";
+var publicApiErrorTypeSchema = z23.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -8206,40 +8383,40 @@ var publicApiErrorTypeSchema = z22.enum([
   "rate_limit_error"
   // Rate limit exceeded (429)
 ]);
-var publicApiErrorSchema = z22.object({
-  error: z22.object({
+var publicApiErrorSchema = z23.object({
+  error: z23.object({
     type: publicApiErrorTypeSchema,
-    code: z22.string(),
-    message: z22.string(),
-    param: z22.string().optional(),
-    docUrl: z22.string().url().optional()
+    code: z23.string(),
+    message: z23.string(),
+    param: z23.string().optional(),
+    docUrl: z23.string().url().optional()
   })
 });
-var paginationSchema = z22.object({
-  hasMore: z22.boolean(),
-  nextCursor: z22.string().nullable()
+var paginationSchema = z23.object({
+  hasMore: z23.boolean(),
+  nextCursor: z23.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z22.object({
-    data: z22.array(dataSchema),
+  return z23.object({
+    data: z23.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z22.object({
-  cursor: z22.string().optional(),
-  limit: z22.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z23.object({
+  cursor: z23.string().optional(),
+  limit: z23.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z22.string().uuid();
-var timestampSchema = z22.string().datetime();
+var requestIdSchema = z23.string().uuid();
+var timestampSchema = z23.string().datetime();
 
 // ../../packages/core/src/contracts/platform.ts
-var c15 = initContract();
-var platformPaginationSchema = z23.object({
-  hasMore: z23.boolean(),
-  nextCursor: z23.string().nullable(),
-  totalPages: z23.number()
+var c16 = initContract();
+var platformPaginationSchema = z24.object({
+  hasMore: z24.boolean(),
+  nextCursor: z24.string().nullable(),
+  totalPages: z24.number()
 });
-var platformLogStatusSchema = z23.enum([
+var platformLogStatusSchema = z24.enum([
   "pending",
   "running",
   "completed",
@@ -8247,41 +8424,41 @@ var platformLogStatusSchema = z23.enum([
   "timeout",
   "cancelled"
 ]);
-var platformLogEntrySchema = z23.object({
-  id: z23.string().uuid(),
-  sessionId: z23.string().nullable(),
-  agentName: z23.string(),
-  framework: z23.string().nullable(),
+var platformLogEntrySchema = z24.object({
+  id: z24.string().uuid(),
+  sessionId: z24.string().nullable(),
+  agentName: z24.string(),
+  framework: z24.string().nullable(),
   status: platformLogStatusSchema,
-  createdAt: z23.string()
+  createdAt: z24.string()
 });
-var platformLogsListResponseSchema = z23.object({
-  data: z23.array(platformLogEntrySchema),
+var platformLogsListResponseSchema = z24.object({
+  data: z24.array(platformLogEntrySchema),
   pagination: platformPaginationSchema
 });
-var artifactSchema = z23.object({
-  name: z23.string().nullable(),
-  version: z23.string().nullable()
+var artifactSchema = z24.object({
+  name: z24.string().nullable(),
+  version: z24.string().nullable()
 });
-var platformLogDetailSchema = z23.object({
-  id: z23.string().uuid(),
-  sessionId: z23.string().nullable(),
-  agentName: z23.string(),
-  framework: z23.string().nullable(),
+var platformLogDetailSchema = z24.object({
+  id: z24.string().uuid(),
+  sessionId: z24.string().nullable(),
+  agentName: z24.string(),
+  framework: z24.string().nullable(),
   status: platformLogStatusSchema,
-  prompt: z23.string(),
-  error: z23.string().nullable(),
-  createdAt: z23.string(),
-  startedAt: z23.string().nullable(),
-  completedAt: z23.string().nullable(),
+  prompt: z24.string(),
+  error: z24.string().nullable(),
+  createdAt: z24.string(),
+  startedAt: z24.string().nullable(),
+  completedAt: z24.string().nullable(),
   artifact: artifactSchema
 });
-var platformLogsListContract = c15.router({
+var platformLogsListContract = c16.router({
   list: {
     method: "GET",
     path: "/api/platform/logs",
     query: listQuerySchema.extend({
-      search: z23.string().optional()
+      search: z24.string().optional()
     }),
     responses: {
       200: platformLogsListResponseSchema,
@@ -8290,12 +8467,12 @@ var platformLogsListContract = c15.router({
     summary: "List agent run logs with pagination"
   }
 });
-var platformLogsByIdContract = c15.router({
+var platformLogsByIdContract = c16.router({
   getById: {
     method: "GET",
     path: "/api/platform/logs/:id",
-    pathParams: z23.object({
-      id: z23.string().uuid("Invalid log ID")
+    pathParams: z24.object({
+      id: z24.string().uuid("Invalid log ID")
     }),
     responses: {
       200: platformLogDetailSchema,
@@ -8305,17 +8482,17 @@ var platformLogsByIdContract = c15.router({
     summary: "Get agent run log details by ID"
   }
 });
-var artifactDownloadResponseSchema = z23.object({
-  url: z23.string().url(),
-  expiresAt: z23.string()
+var artifactDownloadResponseSchema = z24.object({
+  url: z24.string().url(),
+  expiresAt: z24.string()
 });
-var platformArtifactDownloadContract = c15.router({
+var platformArtifactDownloadContract = c16.router({
   getDownloadUrl: {
     method: "GET",
     path: "/api/platform/artifacts/download",
-    query: z23.object({
-      name: z23.string().min(1, "Artifact name is required"),
-      version: z23.string().optional()
+    query: z24.object({
+      name: z24.string().min(1, "Artifact name is required"),
+      version: z24.string().optional()
     }),
     responses: {
       200: artifactDownloadResponseSchema,
@@ -8327,29 +8504,29 @@ var platformArtifactDownloadContract = c15.router({
 });
 
 // ../../packages/core/src/contracts/llm.ts
-import { z as z24 } from "zod";
-var c16 = initContract();
-var messageRoleSchema = z24.enum(["user", "assistant", "system"]);
-var chatMessageSchema = z24.object({
+import { z as z25 } from "zod";
+var c17 = initContract();
+var messageRoleSchema = z25.enum(["user", "assistant", "system"]);
+var chatMessageSchema = z25.object({
   role: messageRoleSchema,
-  content: z24.string()
+  content: z25.string()
 });
-var tokenUsageSchema = z24.object({
-  promptTokens: z24.number(),
-  completionTokens: z24.number(),
-  totalTokens: z24.number()
+var tokenUsageSchema = z25.object({
+  promptTokens: z25.number(),
+  completionTokens: z25.number(),
+  totalTokens: z25.number()
 });
-var llmChatRequestSchema = z24.object({
-  model: z24.string().min(1).optional(),
-  messages: z24.array(chatMessageSchema).min(1, "At least one message is required"),
-  stream: z24.boolean().optional().default(false)
+var llmChatRequestSchema = z25.object({
+  model: z25.string().min(1).optional(),
+  messages: z25.array(chatMessageSchema).min(1, "At least one message is required"),
+  stream: z25.boolean().optional().default(false)
 });
-var llmChatResponseSchema = z24.object({
-  content: z24.string(),
-  model: z24.string(),
+var llmChatResponseSchema = z25.object({
+  content: z25.string(),
+  model: z25.string(),
   usage: tokenUsageSchema
 });
-var llmChatContract = c16.router({
+var llmChatContract = c17.router({
   chat: {
     method: "POST",
     path: "/api/llm/chat",
@@ -8365,28 +8542,28 @@ var llmChatContract = c16.router({
 });
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z25 } from "zod";
-var c17 = initContract();
-var publicAgentSchema = z25.object({
-  id: z25.string(),
-  name: z25.string(),
-  currentVersionId: z25.string().nullable(),
+import { z as z26 } from "zod";
+var c18 = initContract();
+var publicAgentSchema = z26.object({
+  id: z26.string(),
+  name: z26.string(),
+  currentVersionId: z26.string().nullable(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var agentVersionSchema = z25.object({
-  id: z25.string(),
-  agentId: z25.string(),
-  versionNumber: z25.number(),
+var agentVersionSchema = z26.object({
+  id: z26.string(),
+  agentId: z26.string(),
+  versionNumber: z26.number(),
   createdAt: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z25.string().optional()
+  name: z26.string().optional()
 });
-var publicAgentsListContract = c17.router({
+var publicAgentsListContract = c18.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -8401,13 +8578,13 @@ var publicAgentsListContract = c17.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c17.router({
+var publicAgentByIdContract = c18.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Agent ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -8419,13 +8596,13 @@ var publicAgentByIdContract = c17.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c17.router({
+var publicAgentVersionsContract = c18.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Agent ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -8440,9 +8617,9 @@ var publicAgentVersionsContract = c17.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z26 } from "zod";
-var c18 = initContract();
-var publicRunStatusSchema = z26.enum([
+import { z as z27 } from "zod";
+var c19 = initContract();
+var publicRunStatusSchema = z27.enum([
   "pending",
   "running",
   "completed",
@@ -8450,54 +8627,54 @@ var publicRunStatusSchema = z26.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z26.object({
-  id: z26.string(),
-  agentId: z26.string(),
-  agentName: z26.string(),
+var publicRunSchema = z27.object({
+  id: z27.string(),
+  agentId: z27.string(),
+  agentName: z27.string(),
   status: publicRunStatusSchema,
-  prompt: z26.string(),
+  prompt: z27.string(),
   createdAt: timestampSchema,
   startedAt: timestampSchema.nullable(),
   completedAt: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z26.string().nullable(),
-  executionTimeMs: z26.number().nullable(),
-  checkpointId: z26.string().nullable(),
-  sessionId: z26.string().nullable(),
-  artifactName: z26.string().nullable(),
-  artifactVersion: z26.string().nullable(),
-  volumes: z26.record(z26.string(), z26.string()).optional()
+  error: z27.string().nullable(),
+  executionTimeMs: z27.number().nullable(),
+  checkpointId: z27.string().nullable(),
+  sessionId: z27.string().nullable(),
+  artifactName: z27.string().nullable(),
+  artifactVersion: z27.string().nullable(),
+  volumes: z27.record(z27.string(), z27.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z26.object({
+var createRunRequestSchema = z27.object({
   // Agent identification (one of: agent, agentId, sessionId, checkpointId)
-  agent: z26.string().optional(),
+  agent: z27.string().optional(),
   // Agent name
-  agentId: z26.string().optional(),
+  agentId: z27.string().optional(),
   // Agent ID
-  agentVersion: z26.string().optional(),
+  agentVersion: z27.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  sessionId: z26.string().optional(),
+  sessionId: z27.string().optional(),
   // Resume from checkpoint
-  checkpointId: z26.string().optional(),
+  checkpointId: z27.string().optional(),
   // Required
-  prompt: z26.string().min(1, "Prompt is required"),
+  prompt: z27.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z26.record(z26.string(), z26.string()).optional(),
-  secrets: z26.record(z26.string(), z26.string()).optional(),
-  artifactName: z26.string().optional(),
+  variables: z27.record(z27.string(), z27.string()).optional(),
+  secrets: z27.record(z27.string(), z27.string()).optional(),
+  artifactName: z27.string().optional(),
   // Artifact name to mount
-  artifactVersion: z26.string().optional(),
+  artifactVersion: z27.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z26.record(z26.string(), z26.string()).optional()
+  volumes: z27.record(z27.string(), z27.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
   status: publicRunStatusSchema.optional()
 });
-var publicRunsListContract = c18.router({
+var publicRunsListContract = c19.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -8529,13 +8706,13 @@ var publicRunsListContract = c18.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c18.router({
+var publicRunByIdContract = c19.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -8547,15 +8724,15 @@ var publicRunByIdContract = c18.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c18.router({
+var publicRunCancelContract = c19.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
-    body: z26.undefined(),
+    body: z27.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -8568,27 +8745,27 @@ var publicRunCancelContract = c18.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z26.object({
+var logEntrySchema = z27.object({
   timestamp: timestampSchema,
-  type: z26.enum(["agent", "system", "network"]),
-  level: z26.enum(["debug", "info", "warn", "error"]),
-  message: z26.string(),
-  metadata: z26.record(z26.string(), z26.unknown()).optional()
+  type: z27.enum(["agent", "system", "network"]),
+  level: z27.enum(["debug", "info", "warn", "error"]),
+  message: z27.string(),
+  metadata: z27.record(z27.string(), z27.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z26.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z27.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z26.enum(["asc", "desc"]).default("asc")
+  order: z27.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c18.router({
+var publicRunLogsContract = c19.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -8601,30 +8778,30 @@ var publicRunLogsContract = c18.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z26.object({
+var metricPointSchema = z27.object({
   timestamp: timestampSchema,
-  cpuPercent: z26.number(),
-  memoryUsedMb: z26.number(),
-  memoryTotalMb: z26.number(),
-  diskUsedMb: z26.number(),
-  diskTotalMb: z26.number()
-});
-var metricsSummarySchema = z26.object({
-  avgCpuPercent: z26.number(),
-  maxMemoryUsedMb: z26.number(),
-  totalDurationMs: z26.number().nullable()
-});
-var metricsResponseSchema2 = z26.object({
-  data: z26.array(metricPointSchema),
+  cpuPercent: z27.number(),
+  memoryUsedMb: z27.number(),
+  memoryTotalMb: z27.number(),
+  diskUsedMb: z27.number(),
+  diskTotalMb: z27.number()
+});
+var metricsSummarySchema = z27.object({
+  avgCpuPercent: z27.number(),
+  maxMemoryUsedMb: z27.number(),
+  totalDurationMs: z27.number().nullable()
+});
+var metricsResponseSchema2 = z27.object({
+  data: z27.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c18.router({
+var publicRunMetricsContract = c19.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -8636,7 +8813,7 @@ var publicRunMetricsContract = c18.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z26.enum([
+var sseEventTypeSchema = z27.enum([
   "status",
   // Run status change
   "output",
@@ -8648,26 +8825,26 @@ var sseEventTypeSchema = z26.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z26.object({
+var sseEventSchema = z27.object({
   event: sseEventTypeSchema,
-  data: z26.unknown(),
-  id: z26.string().optional()
+  data: z27.unknown(),
+  id: z27.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c18.router({
+var publicRunEventsContract = c19.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
-    query: z26.object({
-      lastEventId: z26.string().optional()
+    query: z27.object({
+      lastEventId: z27.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z26.any(),
+      200: z27.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -8679,28 +8856,28 @@ var publicRunEventsContract = c18.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z27 } from "zod";
-var c19 = initContract();
-var publicArtifactSchema = z27.object({
-  id: z27.string(),
-  name: z27.string(),
-  currentVersionId: z27.string().nullable(),
-  size: z27.number(),
+import { z as z28 } from "zod";
+var c20 = initContract();
+var publicArtifactSchema = z28.object({
+  id: z28.string(),
+  name: z28.string(),
+  currentVersionId: z28.string().nullable(),
+  size: z28.number(),
   // Total size in bytes
-  fileCount: z27.number(),
+  fileCount: z28.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var artifactVersionSchema = z27.object({
-  id: z27.string(),
+var artifactVersionSchema = z28.object({
+  id: z28.string(),
   // SHA-256 content hash
-  artifactId: z27.string(),
-  size: z27.number(),
+  artifactId: z28.string(),
+  size: z28.number(),
   // Size in bytes
-  fileCount: z27.number(),
-  message: z27.string().nullable(),
+  fileCount: z28.number(),
+  message: z28.string().nullable(),
   // Optional commit message
-  createdBy: z27.string(),
+  createdBy: z28.string(),
   createdAt: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -8710,7 +8887,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c19.router({
+var publicArtifactsListContract = c20.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -8725,13 +8902,13 @@ var publicArtifactsListContract = c19.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c19.router({
+var publicArtifactByIdContract = c20.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
     headers: authHeadersSchema,
-    pathParams: z27.object({
-      id: z27.string().min(1, "Artifact ID is required")
+    pathParams: z28.object({
+      id: z28.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -8743,13 +8920,13 @@ var publicArtifactByIdContract = c19.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c19.router({
+var publicArtifactVersionsContract = c20.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z27.object({
-      id: z27.string().min(1, "Artifact ID is required")
+    pathParams: z28.object({
+      id: z28.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -8762,20 +8939,20 @@ var publicArtifactVersionsContract = c19.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c19.router({
+var publicArtifactDownloadContract = c20.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
     headers: authHeadersSchema,
-    pathParams: z27.object({
-      id: z27.string().min(1, "Artifact ID is required")
+    pathParams: z28.object({
+      id: z28.string().min(1, "Artifact ID is required")
     }),
-    query: z27.object({
-      versionId: z27.string().optional()
+    query: z28.object({
+      versionId: z28.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z27.undefined(),
+      302: z28.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -8787,28 +8964,28 @@ var publicArtifactDownloadContract = c19.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z28 } from "zod";
-var c20 = initContract();
-var publicVolumeSchema = z28.object({
-  id: z28.string(),
-  name: z28.string(),
-  currentVersionId: z28.string().nullable(),
-  size: z28.number(),
+import { z as z29 } from "zod";
+var c21 = initContract();
+var publicVolumeSchema = z29.object({
+  id: z29.string(),
+  name: z29.string(),
+  currentVersionId: z29.string().nullable(),
+  size: z29.number(),
   // Total size in bytes
-  fileCount: z28.number(),
+  fileCount: z29.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var volumeVersionSchema = z28.object({
-  id: z28.string(),
+var volumeVersionSchema = z29.object({
+  id: z29.string(),
   // SHA-256 content hash
-  volumeId: z28.string(),
-  size: z28.number(),
+  volumeId: z29.string(),
+  size: z29.number(),
   // Size in bytes
-  fileCount: z28.number(),
-  message: z28.string().nullable(),
+  fileCount: z29.number(),
+  message: z29.string().nullable(),
   // Optional commit message
-  createdBy: z28.string(),
+  createdBy: z29.string(),
   createdAt: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -8816,7 +8993,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c20.router({
+var publicVolumesListContract = c21.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -8831,13 +9008,13 @@ var publicVolumesListContract = c20.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c20.router({
+var publicVolumeByIdContract = c21.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
     headers: authHeadersSchema,
-    pathParams: z28.object({
-      id: z28.string().min(1, "Volume ID is required")
+    pathParams: z29.object({
+      id: z29.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -8849,13 +9026,13 @@ var publicVolumeByIdContract = c20.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c20.router({
+var publicVolumeVersionsContract = c21.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z28.object({
-      id: z28.string().min(1, "Volume ID is required")
+    pathParams: z29.object({
+      id: z29.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -8868,20 +9045,20 @@ var publicVolumeVersionsContract = c20.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c20.router({
+var publicVolumeDownloadContract = c21.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
     headers: authHeadersSchema,
-    pathParams: z28.object({
-      id: z28.string().min(1, "Volume ID is required")
+    pathParams: z29.object({
+      id: z29.string().min(1, "Volume ID is required")
     }),
-    query: z28.object({
-      versionId: z28.string().optional()
+    query: z29.object({
+      versionId: z29.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z28.undefined(),
+      302: z29.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -10026,6 +10203,13 @@ async function executeJob(context, config, options = {}) {
       firecrackerBinary: config.firecracker.binary,
       workDir: runnerPaths.vmWorkDir(config.base_dir, vmId)
     };
+    fs9.mkdirSync(vmConfig.workDir, { recursive: true });
+    fs9.mkdirSync(vmPaths.vsockDir(vmConfig.workDir), { recursive: true });
+    const vsockPath = vmPaths.vsock(vmConfig.workDir);
+    vsockClient = new VsockClient(vsockPath);
+    const guest = vsockClient;
+    logger9.log(`Starting vsock listener: ${vsockPath}`);
+    const guestConnectionPromise = guest.waitForGuestConnection(3e4);
     logger9.log(`Creating VM ${vmId}...`);
     vm = new FirecrackerVM(vmConfig);
     await withSandboxTiming("vm_create", () => vm.start());
@@ -10037,10 +10221,6 @@ async function executeJob(context, config, options = {}) {
     logger9.log(
       `VM ${vmId} started, guest IP: ${guestIp}, veth NS IP: ${vethNsIp}`
     );
-    const vsockPath = vm.getVsockPath();
-    vsockClient = new VsockClient(vsockPath);
-    const guest = vsockClient;
-    logger9.log(`Using vsock for guest communication: ${vsockPath}`);
     const envJson = JSON.stringify(
       buildEnvironmentVariables(context, config.server.url)
     );
@@ -10058,10 +10238,7 @@ async function executeJob(context, config, options = {}) {
       });
     }
     logger9.log(`Waiting for guest connection...`);
-    await withSandboxTiming(
-      "guest_wait",
-      () => guest.waitForGuestConnection(3e4)
-    );
+    await withSandboxTiming("guest_wait", () => guestConnectionPromise);
     logger9.log(`Guest client ready`);
     if (context.storageManifest) {
       await withSandboxTiming(
@@ -10264,7 +10441,7 @@ async function isPortInUse(port) {
 }
 
 // src/lib/runner/runner-lock.ts
-import fs9 from "fs";
+import fs10 from "fs";
 import path5 from "path";
 var logger11 = createLogger("RunnerLock");
 var DEFAULT_PID_FILE = runtimePaths.runnerPid;
@@ -10283,9 +10460,9 @@ function isProcessRunning(pid) {
 function acquireRunnerLock(options = {}) {
   const pidFile = options.pidFile ?? DEFAULT_PID_FILE;
   const runDir = path5.dirname(pidFile);
-  fs9.mkdirSync(runDir, { recursive: true });
-  if (fs9.existsSync(pidFile)) {
-    const pidStr = fs9.readFileSync(pidFile, "utf-8").trim();
+  fs10.mkdirSync(runDir, { recursive: true });
+  if (fs10.existsSync(pidFile)) {
+    const pidStr = fs10.readFileSync(pidFile, "utf-8").trim();
     const pid = parseInt(pidStr, 10);
     if (!isNaN(pid) && isProcessRunning(pid)) {
       logger11.error(`Error: Another runner is already running (PID ${pid})`);
@@ -10297,16 +10474,16 @@ function acquireRunnerLock(options = {}) {
     } else {
       logger11.log(`Cleaning up stale PID file (PID ${pid} not running)`);
     }
-    fs9.unlinkSync(pidFile);
+    fs10.unlinkSync(pidFile);
   }
-  fs9.writeFileSync(pidFile, process.pid.toString());
+  fs10.writeFileSync(pidFile, process.pid.toString());
   currentPidFile = pidFile;
   logger11.log(`Runner lock acquired (PID ${process.pid})`);
 }
 function releaseRunnerLock() {
   const pidFile = currentPidFile ?? DEFAULT_PID_FILE;
-  if (fs9.existsSync(pidFile)) {
-    fs9.unlinkSync(pidFile);
+  if (fs10.existsSync(pidFile)) {
+    fs10.unlinkSync(pidFile);
     logger11.log("Runner lock released");
   }
   currentPidFile = null;
@@ -11178,7 +11355,7 @@ var benchmarkCommand = new Command4("benchmark").description(
 });
 
 // src/index.ts
-var version = true ? "3.11.1" : "0.1.0";
+var version = true ? "3.11.3" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(doctorCommand);