@vm0/runner 3.11.2 → 3.12.0

package/index.js

@@ -44,7 +44,7 @@ var runnerPaths = {
   /** Runner status file */
   statusFile: (baseDir) => path.join(baseDir, "status.json"),
   /** Snapshot generation work directory */
-  snapshotWorkDir: (baseDir) => path.join(baseDir, "workspaces", ".snapshot-work"),
+  snapshotWorkDir: (baseDir) => path.join(baseDir, "workspaces", "snapshot"),
   /** Check if a directory name is a VM workspace */
   isVmWorkspace: (dirname) => dirname.startsWith(VM_WORKSPACE_PREFIX),
   /** Extract vmId from workspace directory name */
@@ -62,6 +62,14 @@ var vmPaths = {
   /** Overlay filesystem for VM writes */
   overlay: (workDir) => path.join(workDir, "overlay.ext4")
 };
+var snapshotOutputPaths = {
+  /** VM state snapshot */
+  snapshot: (outputDir) => path.join(outputDir, "snapshot.bin"),
+  /** VM memory snapshot */
+  memory: (outputDir) => path.join(outputDir, "memory.bin"),
+  /** Golden overlay with guest state */
+  overlay: (outputDir) => path.join(outputDir, "overlay.ext4")
+};
 var tempPaths = {
   /** Default proxy CA directory */
   proxyDir: `${VM0_TMP_PREFIX}-proxy`,
@@ -102,7 +110,12 @@ var runnerConfigSchema = z.object({
   firecracker: z.object({
     binary: z.string().min(1, "Firecracker binary path is required"),
     kernel: z.string().min(1, "Kernel path is required"),
-    rootfs: z.string().min(1, "Rootfs path is required")
+    rootfs: z.string().min(1, "Rootfs path is required"),
+    snapshot: z.object({
+      snapshot: z.string().min(1, "Snapshot state file path is required"),
+      memory: z.string().min(1, "Snapshot memory file path is required"),
+      overlay: z.string().min(1, "Snapshot overlay file path is required")
+    }).optional()
   }),
   proxy: z.object({
     // TODO: Allow 0 to auto-find available port
@@ -131,7 +144,12 @@ var debugConfigSchema = z.object({
   firecracker: z.object({
     binary: z.string().min(1, "Firecracker binary path is required"),
     kernel: z.string().min(1, "Kernel path is required"),
-    rootfs: z.string().min(1, "Rootfs path is required")
+    rootfs: z.string().min(1, "Rootfs path is required"),
+    snapshot: z.object({
+      snapshot: z.string().min(1, "Snapshot state file path is required"),
+      memory: z.string().min(1, "Snapshot memory file path is required"),
+      overlay: z.string().min(1, "Snapshot overlay file path is required")
+    }).optional()
   }),
   proxy: z.object({
     port: z.number().int().min(1024).max(65535).default(PROXY_DEFAULTS.port),
@@ -172,6 +190,13 @@ function validateFirecrackerPaths(config) {
     { path: config.kernel, name: "Kernel" },
     { path: config.rootfs, name: "Rootfs" }
   ];
+  if (config.snapshot) {
+    checks.push(
+      { path: config.snapshot.snapshot, name: "Snapshot state file" },
+      { path: config.snapshot.memory, name: "Snapshot memory file" },
+      { path: config.snapshot.overlay, name: "Snapshot overlay file" }
+    );
+  }
   for (const check of checks) {
     if (!fs.existsSync(check.path)) {
       throw new Error(`${check.name} not found: ${check.path}`);
@@ -337,10 +362,13 @@ async function subscribeToJobs(server, group, onJob, onConnectionChange) {
 
 // src/lib/executor.ts
 import fs9 from "fs";
+import path6 from "path";
 
 // src/lib/firecracker/vm.ts
 import { spawn } from "child_process";
 import fs4 from "fs";
+import os from "os";
+import path4 from "path";
 import readline from "readline";
 
 // src/lib/firecracker/netns-pool.ts
@@ -379,8 +407,8 @@ var DEFAULT_OPTIONS = {
     maxTimeout: 1e3
   }
 };
-async function withFileLock(path7, fn, options) {
-  const release = await lockfile.lock(path7, { ...DEFAULT_OPTIONS, ...options });
+async function withFileLock(path9, fn, options) {
+  const release = await lockfile.lock(path9, { ...DEFAULT_OPTIONS, ...options });
   try {
     return await fn();
   } finally {
@@ -436,6 +464,10 @@ async function createNetnsWithTap(nsName, tap) {
   await execCommand(`ip netns exec ${nsName} ip link set ${tap.tapName} up`);
   await execCommand(`ip netns exec ${nsName} ip link set lo up`);
 }
+async function deleteNetns(nsName) {
+  await execCommand(`ip netns del ${nsName}`).catch(() => {
+  });
+}
 
 // src/lib/firecracker/netns-pool.ts
 var logger = createLogger("NetnsPool");
@@ -1077,10 +1109,10 @@ import * as http from "http";
 import * as fs3 from "fs";
 var logger3 = createLogger("FirecrackerClient");
 var FirecrackerApiError = class extends Error {
-  constructor(statusCode, path7, faultMessage) {
-    super(`Firecracker API error ${statusCode} on ${path7}: ${faultMessage}`);
+  constructor(statusCode, path9, faultMessage) {
+    super(`Firecracker API error ${statusCode} on ${path9}: ${faultMessage}`);
     this.statusCode = statusCode;
-    this.path = path7;
+    this.path = path9;
     this.faultMessage = faultMessage;
     this.name = "FirecrackerApiError";
   }
@@ -1193,27 +1225,27 @@ var FirecrackerClient = class {
   /**
    * GET request
    */
-  async get(path7) {
-    return this.request("GET", path7);
+  async get(path9) {
+    return this.request("GET", path9);
   }
   /**
    * PATCH request
    */
-  async patch(path7, body) {
-    return this.request("PATCH", path7, body);
+  async patch(path9, body) {
+    return this.request("PATCH", path9, body);
   }
   /**
    * PUT request
    */
-  async put(path7, body) {
-    return this.request("PUT", path7, body);
+  async put(path9, body) {
+    return this.request("PUT", path9, body);
   }
   /**
    * Make an HTTP request to Firecracker API
    *
    * @param timeoutMs Request timeout in milliseconds (default: 30000ms)
    */
-  request(method, path7, body, timeoutMs = 3e4) {
+  request(method, path9, body, timeoutMs = 3e4) {
     return new Promise((resolve, reject) => {
       const bodyStr = body !== void 0 ? JSON.stringify(body) : void 0;
       const headers = {
@@ -1227,7 +1259,7 @@ var FirecrackerClient = class {
       }
       const options = {
         socketPath: this.socketPath,
-        path: path7,
+        path: path9,
         method,
         headers,
         timeout: timeoutMs,
@@ -1235,7 +1267,7 @@ var FirecrackerClient = class {
         // Firecracker's single-threaded API can have issues with pipelined requests
         agent: false
       };
-      logger3.log(`${method} ${path7}${bodyStr ? " " + bodyStr : ""}`);
+      logger3.log(`${method} ${path9}${bodyStr ? " " + bodyStr : ""}`);
       const req = http.request(options, (res) => {
         let data = "";
         res.on("data", (chunk) => {
@@ -1252,14 +1284,14 @@ var FirecrackerClient = class {
               faultMessage = errorBody.fault_message || data;
             } catch {
             }
-            reject(new FirecrackerApiError(statusCode, path7, faultMessage));
+            reject(new FirecrackerApiError(statusCode, path9, faultMessage));
           }
         });
       });
       req.on("timeout", () => {
         req.destroy();
         reject(
-          new Error(`Request timeout after ${timeoutMs}ms: ${method} ${path7}`)
+          new Error(`Request timeout after ${timeoutMs}ms: ${method} ${path9}`)
         );
       });
       req.on("error", (err) => {
@@ -1352,7 +1384,7 @@ var FirecrackerVM = class {
     this.workDir = config.workDir;
     this.vsockPath = vmPaths.vsock(this.workDir);
     this.configPath = vmPaths.config(this.workDir);
-    this.apiSocketPath = `${this.workDir}/api.sock`;
+    this.apiSocketPath = vmPaths.apiSock(this.workDir);
   }
   /**
    * Get current VM state
@@ -1451,6 +1483,7 @@ var FirecrackerVM = class {
     const config = this.buildConfig();
     fs4.writeFileSync(this.configPath, JSON.stringify(config, null, 2));
     logger4.log(`[VM ${this.config.vmId}] Starting Firecracker (fresh boot)...`);
+    const currentUser = os.userInfo().username;
     this.process = spawn(
       "sudo",
       [
@@ -1458,6 +1491,9 @@ var FirecrackerVM = class {
         "netns",
         "exec",
         this.netns.name,
+        "sudo",
+        "-u",
+        currentUser,
         this.config.firecrackerBinary,
         "--config-file",
         this.configPath,
@@ -1475,25 +1511,58 @@ var FirecrackerVM = class {
    * Start VM from snapshot
    * Uses --api-sock to load snapshot via API
    *
-   * Drive configuration must be done before loading snapshot
-   * because our overlay path differs from the snapshot's original path.
+   * Snapshot contains original absolute paths for drives. We use mount namespace
+   * isolation to bind mount our actual overlay file to the path expected by the snapshot.
+   * This allows concurrent VMs to each have their own overlay while restoring from
+   * the same snapshot.
    */
   async startFromSnapshot(snapshot) {
     logger4.log(
       `[VM ${this.config.vmId}] Starting Firecracker (snapshot restore)...`
     );
-    logger4.log(`[VM ${this.config.vmId}] Snapshot: ${snapshot.snapshotPath}`);
-    logger4.log(`[VM ${this.config.vmId}] Memory: ${snapshot.memoryPath}`);
+    logger4.log(`[VM ${this.config.vmId}] Snapshot: ${snapshot.snapshot}`);
+    logger4.log(`[VM ${this.config.vmId}] Memory: ${snapshot.memory}`);
+    const actualVsockDir = vmPaths.vsockDir(this.workDir);
+    logger4.log(
+      `[VM ${this.config.vmId}] Snapshot vsock: ${snapshot.snapshotVsockDir}`
+    );
+    logger4.log(
+      `[VM ${this.config.vmId}] Snapshot overlay: ${snapshot.snapshotOverlay}`
+    );
+    logger4.log(`[VM ${this.config.vmId}] Actual vsock: ${actualVsockDir}`);
+    logger4.log(
+      `[VM ${this.config.vmId}] Actual overlay: ${this.vmOverlayPath}`
+    );
+    fs4.mkdirSync(snapshot.snapshotVsockDir, { recursive: true });
+    fs4.mkdirSync(path4.dirname(snapshot.snapshotOverlay), {
+      recursive: true
+    });
+    if (!fs4.existsSync(snapshot.snapshotOverlay)) {
+      fs4.writeFileSync(snapshot.snapshotOverlay, "");
+    }
+    const currentUser = os.userInfo().username;
+    const bindMountVsock = `mount --bind "${actualVsockDir}" "${snapshot.snapshotVsockDir}"`;
+    const bindMountOverlay = `mount --bind "${this.vmOverlayPath}" "${snapshot.snapshotOverlay}"`;
+    const firecrackerCmd = [
+      "ip",
+      "netns",
+      "exec",
+      this.netns.name,
+      "sudo",
+      "-u",
+      currentUser,
+      this.config.firecrackerBinary,
+      "--api-sock",
+      this.apiSocketPath
+    ].join(" ");
     this.process = spawn(
       "sudo",
       [
-        "ip",
-        "netns",
-        "exec",
-        this.netns.name,
-        this.config.firecrackerBinary,
-        "--api-sock",
-        this.apiSocketPath
+        "unshare",
+        "--mount",
+        "bash",
+        "-c",
+        `${bindMountVsock} && ${bindMountOverlay} && ${firecrackerCmd}`
       ],
       {
         cwd: this.workDir,
@@ -1504,26 +1573,11 @@ var FirecrackerVM = class {
     this.setupProcessHandlers();
     const client = new FirecrackerClient(this.apiSocketPath);
     await this.waitForApiReady(client);
-    logger4.log(`[VM ${this.config.vmId}] Configuring drives...`);
-    await Promise.all([
-      client.configureDrive({
-        drive_id: "rootfs",
-        path_on_host: this.config.rootfsPath,
-        is_root_device: true,
-        is_read_only: true
-      }),
-      client.configureDrive({
-        drive_id: "overlay",
-        path_on_host: this.vmOverlayPath,
-        is_root_device: false,
-        is_read_only: false
-      })
-    ]);
     logger4.log(`[VM ${this.config.vmId}] Loading snapshot...`);
     await client.loadSnapshot({
-      snapshot_path: snapshot.snapshotPath,
+      snapshot_path: snapshot.snapshot,
       mem_backend: {
-        backend_path: snapshot.memoryPath,
+        backend_path: snapshot.memory,
         backend_type: "File"
       },
       resume_vm: true
@@ -1756,8 +1810,8 @@ function encodeExecPayload(command, timeoutMs) {
   cmdBuf.copy(payload, 8);
   return payload;
 }
-function encodeWriteFilePayload(path7, content, sudo) {
-  const pathBuf = Buffer.from(path7, "utf-8");
+function encodeWriteFilePayload(path9, content, sudo) {
+  const pathBuf = Buffer.from(path9, "utf-8");
   if (pathBuf.length > 65535) {
     throw new Error(`Path too long: ${pathBuf.length} bytes (max 65535)`);
   }
@@ -2285,6 +2339,20 @@ var VsockClient = class {
     }
     this.cachedExits.clear();
   }
+  /**
+   * Send raw bytes directly to the socket (for testing only)
+   *
+   * This allows tests to send malformed messages to verify the agent's
+   * protocol error handling (e.g., oversized messages).
+   *
+   * @internal This method is only for testing purposes
+   */
+  sendRawForTesting(data) {
+    if (!this.connected || !this.socket) {
+      throw new Error("Not connected - call waitForGuestConnection() first");
+    }
+    this.socket.write(data);
+  }
 };
 
 // ../../packages/core/src/contracts/base.ts
@@ -2638,8 +2706,8 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 var makeIssue = (params) => {
-  const { data, path: path7, errorMaps, issueData } = params;
-  const fullPath = [...path7, ...issueData.path || []];
+  const { data, path: path9, errorMaps, issueData } = params;
+  const fullPath = [...path9, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -2738,11 +2806,11 @@ var errorUtil;
   errorUtil2.toString = (message) => typeof message === "string" ? message : message === null || message === void 0 ? void 0 : message.message;
 })(errorUtil || (errorUtil = {}));
 var ParseInputLazyPath = class {
-  constructor(parent, value, path7, key) {
+  constructor(parent, value, path9, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path7;
+    this._path = path9;
     this._key = key;
   }
   get path() {
@@ -7705,58 +7773,159 @@ var credentialsByNameContract = c10.router({
   }
 });
 
-// ../../packages/core/src/contracts/model-providers.ts
+// ../../packages/core/src/contracts/secrets.ts
 import { z as z18 } from "zod";
 var c11 = initContract();
-var modelProviderTypeSchema = z18.enum([
+var secretNameSchema = z18.string().min(1, "Secret name is required").max(255, "Secret name must be at most 255 characters").regex(
+  /^[A-Z][A-Z0-9_]*$/,
+  "Secret name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_API_KEY)"
+);
+var secretTypeSchema = z18.enum(["user", "model-provider"]);
+var secretResponseSchema = z18.object({
+  id: z18.string().uuid(),
+  name: z18.string(),
+  description: z18.string().nullable(),
+  type: secretTypeSchema,
+  createdAt: z18.string(),
+  updatedAt: z18.string()
+});
+var secretListResponseSchema = z18.object({
+  secrets: z18.array(secretResponseSchema)
+});
+var setSecretRequestSchema = z18.object({
+  name: secretNameSchema,
+  value: z18.string().min(1, "Secret value is required"),
+  description: z18.string().max(1e3).optional()
+});
+var secretsMainContract = c11.router({
+  /**
+   * GET /api/secrets
+   * List all secrets for the current user's scope (metadata only)
+   */
+  list: {
+    method: "GET",
+    path: "/api/secrets",
+    headers: authHeadersSchema,
+    responses: {
+      200: secretListResponseSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List all secrets (metadata only)"
+  },
+  /**
+   * PUT /api/secrets
+   * Create or update a secret
+   */
+  set: {
+    method: "PUT",
+    path: "/api/secrets",
+    headers: authHeadersSchema,
+    body: setSecretRequestSchema,
+    responses: {
+      200: secretResponseSchema,
+      201: secretResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Create or update a secret"
+  }
+});
+var secretsByNameContract = c11.router({
+  /**
+   * GET /api/secrets/:name
+   * Get a secret by name (metadata only)
+   */
+  get: {
+    method: "GET",
+    path: "/api/secrets/:name",
+    headers: authHeadersSchema,
+    pathParams: z18.object({
+      name: secretNameSchema
+    }),
+    responses: {
+      200: secretResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get secret metadata by name"
+  },
+  /**
+   * DELETE /api/secrets/:name
+   * Delete a secret by name
+   */
+  delete: {
+    method: "DELETE",
+    path: "/api/secrets/:name",
+    headers: authHeadersSchema,
+    pathParams: z18.object({
+      name: secretNameSchema
+    }),
+    responses: {
+      204: c11.noBody(),
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Delete a secret"
+  }
+});
+
+// ../../packages/core/src/contracts/model-providers.ts
+import { z as z19 } from "zod";
+var c12 = initContract();
+var modelProviderTypeSchema = z19.enum([
   "claude-code-oauth-token",
   "anthropic-api-key",
   "openrouter-api-key",
   "moonshot-api-key",
   "minimax-api-key",
   "deepseek-api-key",
+  "zai-api-key",
   "aws-bedrock"
 ]);
-var modelProviderFrameworkSchema = z18.enum(["claude-code", "codex"]);
-var modelProviderResponseSchema = z18.object({
-  id: z18.string().uuid(),
+var modelProviderFrameworkSchema = z19.enum(["claude-code", "codex"]);
+var modelProviderResponseSchema = z19.object({
+  id: z19.string().uuid(),
   type: modelProviderTypeSchema,
   framework: modelProviderFrameworkSchema,
-  credentialName: z18.string().nullable(),
+  credentialName: z19.string().nullable(),
   // Legacy single-credential (deprecated for multi-auth)
-  authMethod: z18.string().nullable(),
+  authMethod: z19.string().nullable(),
   // For multi-auth providers
-  credentialNames: z18.array(z18.string()).nullable(),
+  credentialNames: z19.array(z19.string()).nullable(),
   // For multi-auth providers
-  isDefault: z18.boolean(),
-  selectedModel: z18.string().nullable(),
-  createdAt: z18.string(),
-  updatedAt: z18.string()
+  isDefault: z19.boolean(),
+  selectedModel: z19.string().nullable(),
+  createdAt: z19.string(),
+  updatedAt: z19.string()
 });
-var modelProviderListResponseSchema = z18.object({
-  modelProviders: z18.array(modelProviderResponseSchema)
+var modelProviderListResponseSchema = z19.object({
+  modelProviders: z19.array(modelProviderResponseSchema)
 });
-var upsertModelProviderRequestSchema = z18.object({
+var upsertModelProviderRequestSchema = z19.object({
   type: modelProviderTypeSchema,
-  credential: z18.string().min(1).optional(),
+  credential: z19.string().min(1).optional(),
   // Legacy single credential
-  authMethod: z18.string().optional(),
+  authMethod: z19.string().optional(),
   // For multi-auth providers
-  credentials: z18.record(z18.string(), z18.string()).optional(),
+  credentials: z19.record(z19.string(), z19.string()).optional(),
   // For multi-auth providers
-  convert: z18.boolean().optional(),
-  selectedModel: z18.string().optional()
+  convert: z19.boolean().optional(),
+  selectedModel: z19.string().optional()
 });
-var upsertModelProviderResponseSchema = z18.object({
+var upsertModelProviderResponseSchema = z19.object({
   provider: modelProviderResponseSchema,
-  created: z18.boolean()
+  created: z19.boolean()
 });
-var checkCredentialResponseSchema = z18.object({
-  exists: z18.boolean(),
-  credentialName: z18.string(),
-  currentType: z18.enum(["user", "model-provider"]).optional()
+var checkCredentialResponseSchema = z19.object({
+  exists: z19.boolean(),
+  credentialName: z19.string(),
+  currentType: z19.enum(["user", "model-provider"]).optional()
 });
-var modelProvidersMainContract = c11.router({
+var modelProvidersMainContract = c12.router({
   list: {
     method: "GET",
     path: "/api/model-providers",
@@ -7784,12 +7953,12 @@ var modelProvidersMainContract = c11.router({
     summary: "Create or update a model provider"
   }
 });
-var modelProvidersCheckContract = c11.router({
+var modelProvidersCheckContract = c12.router({
   check: {
     method: "GET",
     path: "/api/model-providers/check/:type",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
     responses: {
@@ -7800,16 +7969,16 @@ var modelProvidersCheckContract = c11.router({
     summary: "Check if credential exists for a model provider type"
   }
 });
-var modelProvidersByTypeContract = c11.router({
+var modelProvidersByTypeContract = c12.router({
   delete: {
     method: "DELETE",
     path: "/api/model-providers/:type",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c11.noBody(),
+      204: c12.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -7817,15 +7986,15 @@ var modelProvidersByTypeContract = c11.router({
     summary: "Delete a model provider"
   }
 });
-var modelProvidersConvertContract = c11.router({
+var modelProvidersConvertContract = c12.router({
   convert: {
     method: "POST",
     path: "/api/model-providers/:type/convert",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
-    body: z18.undefined(),
+    body: z19.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       400: apiErrorSchema,
@@ -7836,15 +8005,15 @@ var modelProvidersConvertContract = c11.router({
     summary: "Convert existing user credential to model provider"
   }
 });
-var modelProvidersSetDefaultContract = c11.router({
+var modelProvidersSetDefaultContract = c12.router({
   setDefault: {
     method: "POST",
     path: "/api/model-providers/:type/set-default",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
-    body: z18.undefined(),
+    body: z19.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       401: apiErrorSchema,
@@ -7854,15 +8023,15 @@ var modelProvidersSetDefaultContract = c11.router({
     summary: "Set a model provider as default for its framework"
   }
 });
-var updateModelRequestSchema = z18.object({
-  selectedModel: z18.string().optional()
+var updateModelRequestSchema = z19.object({
+  selectedModel: z19.string().optional()
 });
-var modelProvidersUpdateModelContract = c11.router({
+var modelProvidersUpdateModelContract = c12.router({
   updateModel: {
     method: "PATCH",
     path: "/api/model-providers/:type/model",
     headers: authHeadersSchema,
-    pathParams: z18.object({
+    pathParams: z19.object({
       type: modelProviderTypeSchema
     }),
     body: updateModelRequestSchema,
@@ -7877,42 +8046,42 @@ var modelProvidersUpdateModelContract = c11.router({
 });
 
 // ../../packages/core/src/contracts/sessions.ts
-import { z as z19 } from "zod";
-var c12 = initContract();
-var sessionResponseSchema = z19.object({
-  id: z19.string(),
-  agentComposeId: z19.string(),
-  agentComposeVersionId: z19.string().nullable(),
-  conversationId: z19.string().nullable(),
-  artifactName: z19.string().nullable(),
-  vars: z19.record(z19.string(), z19.string()).nullable(),
-  secretNames: z19.array(z19.string()).nullable(),
-  volumeVersions: z19.record(z19.string(), z19.string()).nullable(),
-  createdAt: z19.string(),
-  updatedAt: z19.string()
+import { z as z20 } from "zod";
+var c13 = initContract();
+var sessionResponseSchema = z20.object({
+  id: z20.string(),
+  agentComposeId: z20.string(),
+  agentComposeVersionId: z20.string().nullable(),
+  conversationId: z20.string().nullable(),
+  artifactName: z20.string().nullable(),
+  vars: z20.record(z20.string(), z20.string()).nullable(),
+  secretNames: z20.array(z20.string()).nullable(),
+  volumeVersions: z20.record(z20.string(), z20.string()).nullable(),
+  createdAt: z20.string(),
+  updatedAt: z20.string()
 });
-var agentComposeSnapshotSchema = z19.object({
-  agentComposeVersionId: z19.string(),
-  vars: z19.record(z19.string(), z19.string()).optional(),
-  secretNames: z19.array(z19.string()).optional()
+var agentComposeSnapshotSchema = z20.object({
+  agentComposeVersionId: z20.string(),
+  vars: z20.record(z20.string(), z20.string()).optional(),
+  secretNames: z20.array(z20.string()).optional()
 });
-var artifactSnapshotSchema2 = z19.object({
-  artifactName: z19.string(),
-  artifactVersion: z19.string()
+var artifactSnapshotSchema2 = z20.object({
+  artifactName: z20.string(),
+  artifactVersion: z20.string()
 });
-var volumeVersionsSnapshotSchema2 = z19.object({
-  versions: z19.record(z19.string(), z19.string())
+var volumeVersionsSnapshotSchema2 = z20.object({
+  versions: z20.record(z20.string(), z20.string())
 });
-var checkpointResponseSchema = z19.object({
-  id: z19.string(),
-  runId: z19.string(),
-  conversationId: z19.string(),
+var checkpointResponseSchema = z20.object({
+  id: z20.string(),
+  runId: z20.string(),
+  conversationId: z20.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z19.string()
+  createdAt: z20.string()
 });
-var sessionsByIdContract = c12.router({
+var sessionsByIdContract = c13.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -7921,8 +8090,8 @@ var sessionsByIdContract = c12.router({
     method: "GET",
     path: "/api/agent/sessions/:id",
     headers: authHeadersSchema,
-    pathParams: z19.object({
-      id: z19.string().min(1, "Session ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -7933,7 +8102,7 @@ var sessionsByIdContract = c12.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c12.router({
+var checkpointsByIdContract = c13.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -7942,8 +8111,8 @@ var checkpointsByIdContract = c12.router({
     method: "GET",
     path: "/api/agent/checkpoints/:id",
     headers: authHeadersSchema,
-    pathParams: z19.object({
-      id: z19.string().min(1, "Checkpoint ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -7956,93 +8125,93 @@ var checkpointsByIdContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z20 } from "zod";
-var c13 = initContract();
-var scheduleTriggerSchema = z20.object({
-  cron: z20.string().optional(),
-  at: z20.string().optional(),
-  timezone: z20.string().default("UTC")
+import { z as z21 } from "zod";
+var c14 = initContract();
+var scheduleTriggerSchema = z21.object({
+  cron: z21.string().optional(),
+  at: z21.string().optional(),
+  timezone: z21.string().default("UTC")
 }).refine((data) => data.cron && !data.at || !data.cron && data.at, {
   message: "Exactly one of 'cron' or 'at' must be specified"
 });
-var scheduleRunConfigSchema = z20.object({
-  agent: z20.string().min(1, "Agent reference required"),
-  prompt: z20.string().min(1, "Prompt required"),
-  vars: z20.record(z20.string(), z20.string()).optional(),
-  secrets: z20.record(z20.string(), z20.string()).optional(),
-  artifactName: z20.string().optional(),
-  artifactVersion: z20.string().optional(),
-  volumeVersions: z20.record(z20.string(), z20.string()).optional()
+var scheduleRunConfigSchema = z21.object({
+  agent: z21.string().min(1, "Agent reference required"),
+  prompt: z21.string().min(1, "Prompt required"),
+  vars: z21.record(z21.string(), z21.string()).optional(),
+  secrets: z21.record(z21.string(), z21.string()).optional(),
+  artifactName: z21.string().optional(),
+  artifactVersion: z21.string().optional(),
+  volumeVersions: z21.record(z21.string(), z21.string()).optional()
 });
-var scheduleDefinitionSchema = z20.object({
+var scheduleDefinitionSchema = z21.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z20.object({
-  version: z20.literal("1.0"),
-  schedules: z20.record(z20.string(), scheduleDefinitionSchema)
-});
-var deployScheduleRequestSchema = z20.object({
-  name: z20.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z20.string().optional(),
-  atTime: z20.string().optional(),
-  timezone: z20.string().default("UTC"),
-  prompt: z20.string().min(1, "Prompt required"),
-  vars: z20.record(z20.string(), z20.string()).optional(),
-  secrets: z20.record(z20.string(), z20.string()).optional(),
-  artifactName: z20.string().optional(),
-  artifactVersion: z20.string().optional(),
-  volumeVersions: z20.record(z20.string(), z20.string()).optional(),
+var scheduleYamlSchema = z21.object({
+  version: z21.literal("1.0"),
+  schedules: z21.record(z21.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z21.object({
+  name: z21.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z21.string().optional(),
+  atTime: z21.string().optional(),
+  timezone: z21.string().default("UTC"),
+  prompt: z21.string().min(1, "Prompt required"),
+  vars: z21.record(z21.string(), z21.string()).optional(),
+  secrets: z21.record(z21.string(), z21.string()).optional(),
+  artifactName: z21.string().optional(),
+  artifactVersion: z21.string().optional(),
+  volumeVersions: z21.record(z21.string(), z21.string()).optional(),
   // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
-  composeId: z20.string().uuid("Invalid compose ID")
+  composeId: z21.string().uuid("Invalid compose ID")
 }).refine(
   (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
   {
     message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
   }
 );
-var scheduleResponseSchema = z20.object({
-  id: z20.string().uuid(),
-  composeId: z20.string().uuid(),
-  composeName: z20.string(),
-  scopeSlug: z20.string(),
-  name: z20.string(),
-  cronExpression: z20.string().nullable(),
-  atTime: z20.string().nullable(),
-  timezone: z20.string(),
-  prompt: z20.string(),
-  vars: z20.record(z20.string(), z20.string()).nullable(),
+var scheduleResponseSchema = z21.object({
+  id: z21.string().uuid(),
+  composeId: z21.string().uuid(),
+  composeName: z21.string(),
+  scopeSlug: z21.string(),
+  name: z21.string(),
+  cronExpression: z21.string().nullable(),
+  atTime: z21.string().nullable(),
+  timezone: z21.string(),
+  prompt: z21.string(),
+  vars: z21.record(z21.string(), z21.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z20.array(z20.string()).nullable(),
-  artifactName: z20.string().nullable(),
-  artifactVersion: z20.string().nullable(),
-  volumeVersions: z20.record(z20.string(), z20.string()).nullable(),
-  enabled: z20.boolean(),
-  nextRunAt: z20.string().nullable(),
-  lastRunAt: z20.string().nullable(),
-  retryStartedAt: z20.string().nullable(),
-  createdAt: z20.string(),
-  updatedAt: z20.string()
-});
-var runSummarySchema = z20.object({
-  id: z20.string().uuid(),
-  status: z20.enum(["pending", "running", "completed", "failed", "timeout"]),
-  createdAt: z20.string(),
-  completedAt: z20.string().nullable(),
-  error: z20.string().nullable()
-});
-var scheduleRunsResponseSchema = z20.object({
-  runs: z20.array(runSummarySchema)
-});
-var scheduleListResponseSchema = z20.object({
-  schedules: z20.array(scheduleResponseSchema)
-});
-var deployScheduleResponseSchema = z20.object({
+  secretNames: z21.array(z21.string()).nullable(),
+  artifactName: z21.string().nullable(),
+  artifactVersion: z21.string().nullable(),
+  volumeVersions: z21.record(z21.string(), z21.string()).nullable(),
+  enabled: z21.boolean(),
+  nextRunAt: z21.string().nullable(),
+  lastRunAt: z21.string().nullable(),
+  retryStartedAt: z21.string().nullable(),
+  createdAt: z21.string(),
+  updatedAt: z21.string()
+});
+var runSummarySchema = z21.object({
+  id: z21.string().uuid(),
+  status: z21.enum(["pending", "running", "completed", "failed", "timeout"]),
+  createdAt: z21.string(),
+  completedAt: z21.string().nullable(),
+  error: z21.string().nullable()
+});
+var scheduleRunsResponseSchema = z21.object({
+  runs: z21.array(runSummarySchema)
+});
+var scheduleListResponseSchema = z21.object({
+  schedules: z21.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z21.object({
   schedule: scheduleResponseSchema,
-  created: z20.boolean()
+  created: z21.boolean()
   // true if created, false if updated
 });
-var schedulesMainContract = c13.router({
+var schedulesMainContract = c14.router({
   /**
    * POST /api/agent/schedules
    * Deploy (create or update) a schedule
@@ -8080,7 +8249,7 @@ var schedulesMainContract = c13.router({
     summary: "List all schedules"
   }
 });
-var schedulesByNameContract = c13.router({
+var schedulesByNameContract = c14.router({
   /**
    * GET /api/agent/schedules/:name
    * Get schedule by name
@@ -8089,11 +8258,11 @@ var schedulesByNameContract = c13.router({
     method: "GET",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    query: z20.object({
-      composeId: z20.string().uuid("Compose ID required")
+    query: z21.object({
+      composeId: z21.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -8110,21 +8279,21 @@ var schedulesByNameContract = c13.router({
     method: "DELETE",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    query: z20.object({
-      composeId: z20.string().uuid("Compose ID required")
+    query: z21.object({
+      composeId: z21.string().uuid("Compose ID required")
     }),
     responses: {
-      204: c13.noBody(),
+      204: c14.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete schedule"
   }
 });
-var schedulesEnableContract = c13.router({
+var schedulesEnableContract = c14.router({
   /**
    * POST /api/agent/schedules/:name/enable
    * Enable a disabled schedule
@@ -8133,11 +8302,11 @@ var schedulesEnableContract = c13.router({
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    body: z20.object({
-      composeId: z20.string().uuid("Compose ID required")
+    body: z21.object({
+      composeId: z21.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -8154,11 +8323,11 @@ var schedulesEnableContract = c13.router({
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    body: z20.object({
-      composeId: z20.string().uuid("Compose ID required")
+    body: z21.object({
+      composeId: z21.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -8168,7 +8337,7 @@ var schedulesEnableContract = c13.router({
     summary: "Disable schedule"
   }
 });
-var scheduleRunsContract = c13.router({
+var scheduleRunsContract = c14.router({
   /**
    * GET /api/agent/schedules/:name/runs
    * List recent runs for a schedule
@@ -8177,12 +8346,12 @@ var scheduleRunsContract = c13.router({
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      name: z20.string().min(1, "Schedule name required")
+    pathParams: z21.object({
+      name: z21.string().min(1, "Schedule name required")
     }),
-    query: z20.object({
-      composeId: z20.string().uuid("Compose ID required"),
-      limit: z20.coerce.number().min(0).max(100).default(5)
+    query: z21.object({
+      composeId: z21.string().uuid("Compose ID required"),
+      limit: z21.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -8194,18 +8363,18 @@ var scheduleRunsContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/realtime.ts
-import { z as z21 } from "zod";
-var c14 = initContract();
-var ablyTokenRequestSchema = z21.object({
-  keyName: z21.string(),
-  ttl: z21.number().optional(),
-  timestamp: z21.number(),
-  capability: z21.string(),
-  clientId: z21.string().optional(),
-  nonce: z21.string(),
-  mac: z21.string()
+import { z as z22 } from "zod";
+var c15 = initContract();
+var ablyTokenRequestSchema = z22.object({
+  keyName: z22.string(),
+  ttl: z22.number().optional(),
+  timestamp: z22.number(),
+  capability: z22.string(),
+  clientId: z22.string().optional(),
+  nonce: z22.string(),
+  mac: z22.string()
 });
-var realtimeTokenContract = c14.router({
+var realtimeTokenContract = c15.router({
   /**
    * POST /api/realtime/token
    * Get an Ably token to subscribe to a run's events channel
@@ -8214,8 +8383,8 @@ var realtimeTokenContract = c14.router({
     method: "POST",
     path: "/api/realtime/token",
     headers: authHeadersSchema,
-    body: z21.object({
-      runId: z21.string().uuid("runId must be a valid UUID")
+    body: z22.object({
+      runId: z22.string().uuid("runId must be a valid UUID")
     }),
     responses: {
       200: ablyTokenRequestSchema,
@@ -8227,7 +8396,7 @@ var realtimeTokenContract = c14.router({
     summary: "Get Ably token for run event subscription"
   }
 });
-var runnerRealtimeTokenContract = c14.router({
+var runnerRealtimeTokenContract = c15.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -8236,7 +8405,7 @@ var runnerRealtimeTokenContract = c14.router({
     method: "POST",
     path: "/api/runners/realtime/token",
     headers: authHeadersSchema,
-    body: z21.object({
+    body: z22.object({
       group: runnerGroupSchema
     }),
     responses: {
@@ -8250,11 +8419,11 @@ var runnerRealtimeTokenContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/platform.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 
 // ../../packages/core/src/contracts/public/common.ts
-import { z as z22 } from "zod";
-var publicApiErrorTypeSchema = z22.enum([
+import { z as z23 } from "zod";
+var publicApiErrorTypeSchema = z23.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -8268,40 +8437,40 @@ var publicApiErrorTypeSchema = z22.enum([
   "rate_limit_error"
   // Rate limit exceeded (429)
 ]);
-var publicApiErrorSchema = z22.object({
-  error: z22.object({
+var publicApiErrorSchema = z23.object({
+  error: z23.object({
     type: publicApiErrorTypeSchema,
-    code: z22.string(),
-    message: z22.string(),
-    param: z22.string().optional(),
-    docUrl: z22.string().url().optional()
+    code: z23.string(),
+    message: z23.string(),
+    param: z23.string().optional(),
+    docUrl: z23.string().url().optional()
   })
 });
-var paginationSchema = z22.object({
-  hasMore: z22.boolean(),
-  nextCursor: z22.string().nullable()
+var paginationSchema = z23.object({
+  hasMore: z23.boolean(),
+  nextCursor: z23.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z22.object({
-    data: z22.array(dataSchema),
+  return z23.object({
+    data: z23.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z22.object({
-  cursor: z22.string().optional(),
-  limit: z22.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z23.object({
+  cursor: z23.string().optional(),
+  limit: z23.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z22.string().uuid();
-var timestampSchema = z22.string().datetime();
+var requestIdSchema = z23.string().uuid();
+var timestampSchema = z23.string().datetime();
 
 // ../../packages/core/src/contracts/platform.ts
-var c15 = initContract();
-var platformPaginationSchema = z23.object({
-  hasMore: z23.boolean(),
-  nextCursor: z23.string().nullable(),
-  totalPages: z23.number()
+var c16 = initContract();
+var platformPaginationSchema = z24.object({
+  hasMore: z24.boolean(),
+  nextCursor: z24.string().nullable(),
+  totalPages: z24.number()
 });
-var platformLogStatusSchema = z23.enum([
+var platformLogStatusSchema = z24.enum([
   "pending",
   "running",
   "completed",
@@ -8309,41 +8478,41 @@ var platformLogStatusSchema = z23.enum([
   "timeout",
   "cancelled"
 ]);
-var platformLogEntrySchema = z23.object({
-  id: z23.string().uuid(),
-  sessionId: z23.string().nullable(),
-  agentName: z23.string(),
-  framework: z23.string().nullable(),
+var platformLogEntrySchema = z24.object({
+  id: z24.string().uuid(),
+  sessionId: z24.string().nullable(),
+  agentName: z24.string(),
+  framework: z24.string().nullable(),
   status: platformLogStatusSchema,
-  createdAt: z23.string()
+  createdAt: z24.string()
 });
-var platformLogsListResponseSchema = z23.object({
-  data: z23.array(platformLogEntrySchema),
+var platformLogsListResponseSchema = z24.object({
+  data: z24.array(platformLogEntrySchema),
   pagination: platformPaginationSchema
 });
-var artifactSchema = z23.object({
-  name: z23.string().nullable(),
-  version: z23.string().nullable()
+var artifactSchema = z24.object({
+  name: z24.string().nullable(),
+  version: z24.string().nullable()
 });
-var platformLogDetailSchema = z23.object({
-  id: z23.string().uuid(),
-  sessionId: z23.string().nullable(),
-  agentName: z23.string(),
-  framework: z23.string().nullable(),
+var platformLogDetailSchema = z24.object({
+  id: z24.string().uuid(),
+  sessionId: z24.string().nullable(),
+  agentName: z24.string(),
+  framework: z24.string().nullable(),
   status: platformLogStatusSchema,
-  prompt: z23.string(),
-  error: z23.string().nullable(),
-  createdAt: z23.string(),
-  startedAt: z23.string().nullable(),
-  completedAt: z23.string().nullable(),
+  prompt: z24.string(),
+  error: z24.string().nullable(),
+  createdAt: z24.string(),
+  startedAt: z24.string().nullable(),
+  completedAt: z24.string().nullable(),
   artifact: artifactSchema
 });
-var platformLogsListContract = c15.router({
+var platformLogsListContract = c16.router({
   list: {
     method: "GET",
     path: "/api/platform/logs",
     query: listQuerySchema.extend({
-      search: z23.string().optional()
+      search: z24.string().optional()
     }),
     responses: {
       200: platformLogsListResponseSchema,
@@ -8352,12 +8521,12 @@ var platformLogsListContract = c15.router({
     summary: "List agent run logs with pagination"
   }
 });
-var platformLogsByIdContract = c15.router({
+var platformLogsByIdContract = c16.router({
   getById: {
     method: "GET",
     path: "/api/platform/logs/:id",
-    pathParams: z23.object({
-      id: z23.string().uuid("Invalid log ID")
+    pathParams: z24.object({
+      id: z24.string().uuid("Invalid log ID")
     }),
     responses: {
       200: platformLogDetailSchema,
@@ -8367,17 +8536,17 @@ var platformLogsByIdContract = c15.router({
     summary: "Get agent run log details by ID"
   }
 });
-var artifactDownloadResponseSchema = z23.object({
-  url: z23.string().url(),
-  expiresAt: z23.string()
+var artifactDownloadResponseSchema = z24.object({
+  url: z24.string().url(),
+  expiresAt: z24.string()
 });
-var platformArtifactDownloadContract = c15.router({
+var platformArtifactDownloadContract = c16.router({
   getDownloadUrl: {
     method: "GET",
     path: "/api/platform/artifacts/download",
-    query: z23.object({
-      name: z23.string().min(1, "Artifact name is required"),
-      version: z23.string().optional()
+    query: z24.object({
+      name: z24.string().min(1, "Artifact name is required"),
+      version: z24.string().optional()
     }),
     responses: {
       200: artifactDownloadResponseSchema,
@@ -8389,29 +8558,29 @@ var platformArtifactDownloadContract = c15.router({
 });
 
 // ../../packages/core/src/contracts/llm.ts
-import { z as z24 } from "zod";
-var c16 = initContract();
-var messageRoleSchema = z24.enum(["user", "assistant", "system"]);
-var chatMessageSchema = z24.object({
+import { z as z25 } from "zod";
+var c17 = initContract();
+var messageRoleSchema = z25.enum(["user", "assistant", "system"]);
+var chatMessageSchema = z25.object({
   role: messageRoleSchema,
-  content: z24.string()
+  content: z25.string()
 });
-var tokenUsageSchema = z24.object({
-  promptTokens: z24.number(),
-  completionTokens: z24.number(),
-  totalTokens: z24.number()
+var tokenUsageSchema = z25.object({
+  promptTokens: z25.number(),
+  completionTokens: z25.number(),
+  totalTokens: z25.number()
 });
-var llmChatRequestSchema = z24.object({
-  model: z24.string().min(1).optional(),
-  messages: z24.array(chatMessageSchema).min(1, "At least one message is required"),
-  stream: z24.boolean().optional().default(false)
+var llmChatRequestSchema = z25.object({
+  model: z25.string().min(1).optional(),
+  messages: z25.array(chatMessageSchema).min(1, "At least one message is required"),
+  stream: z25.boolean().optional().default(false)
 });
-var llmChatResponseSchema = z24.object({
-  content: z24.string(),
-  model: z24.string(),
+var llmChatResponseSchema = z25.object({
+  content: z25.string(),
+  model: z25.string(),
   usage: tokenUsageSchema
 });
-var llmChatContract = c16.router({
+var llmChatContract = c17.router({
   chat: {
     method: "POST",
     path: "/api/llm/chat",
@@ -8427,28 +8596,28 @@ var llmChatContract = c16.router({
 });
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z25 } from "zod";
-var c17 = initContract();
-var publicAgentSchema = z25.object({
-  id: z25.string(),
-  name: z25.string(),
-  currentVersionId: z25.string().nullable(),
+import { z as z26 } from "zod";
+var c18 = initContract();
+var publicAgentSchema = z26.object({
+  id: z26.string(),
+  name: z26.string(),
+  currentVersionId: z26.string().nullable(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var agentVersionSchema = z25.object({
-  id: z25.string(),
-  agentId: z25.string(),
-  versionNumber: z25.number(),
+var agentVersionSchema = z26.object({
+  id: z26.string(),
+  agentId: z26.string(),
+  versionNumber: z26.number(),
   createdAt: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z25.string().optional()
+  name: z26.string().optional()
 });
-var publicAgentsListContract = c17.router({
+var publicAgentsListContract = c18.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -8463,13 +8632,13 @@ var publicAgentsListContract = c17.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c17.router({
+var publicAgentByIdContract = c18.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Agent ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -8481,13 +8650,13 @@ var publicAgentByIdContract = c17.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c17.router({
+var publicAgentVersionsContract = c18.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Agent ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -8502,9 +8671,9 @@ var publicAgentVersionsContract = c17.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z26 } from "zod";
-var c18 = initContract();
-var publicRunStatusSchema = z26.enum([
+import { z as z27 } from "zod";
+var c19 = initContract();
+var publicRunStatusSchema = z27.enum([
   "pending",
   "running",
   "completed",
@@ -8512,54 +8681,54 @@ var publicRunStatusSchema = z26.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z26.object({
-  id: z26.string(),
-  agentId: z26.string(),
-  agentName: z26.string(),
+var publicRunSchema = z27.object({
+  id: z27.string(),
+  agentId: z27.string(),
+  agentName: z27.string(),
   status: publicRunStatusSchema,
-  prompt: z26.string(),
+  prompt: z27.string(),
   createdAt: timestampSchema,
   startedAt: timestampSchema.nullable(),
   completedAt: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z26.string().nullable(),
-  executionTimeMs: z26.number().nullable(),
-  checkpointId: z26.string().nullable(),
-  sessionId: z26.string().nullable(),
-  artifactName: z26.string().nullable(),
-  artifactVersion: z26.string().nullable(),
-  volumes: z26.record(z26.string(), z26.string()).optional()
+  error: z27.string().nullable(),
+  executionTimeMs: z27.number().nullable(),
+  checkpointId: z27.string().nullable(),
+  sessionId: z27.string().nullable(),
+  artifactName: z27.string().nullable(),
+  artifactVersion: z27.string().nullable(),
+  volumes: z27.record(z27.string(), z27.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z26.object({
+var createRunRequestSchema = z27.object({
   // Agent identification (one of: agent, agentId, sessionId, checkpointId)
-  agent: z26.string().optional(),
+  agent: z27.string().optional(),
   // Agent name
-  agentId: z26.string().optional(),
+  agentId: z27.string().optional(),
   // Agent ID
-  agentVersion: z26.string().optional(),
+  agentVersion: z27.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  sessionId: z26.string().optional(),
+  sessionId: z27.string().optional(),
   // Resume from checkpoint
-  checkpointId: z26.string().optional(),
+  checkpointId: z27.string().optional(),
   // Required
-  prompt: z26.string().min(1, "Prompt is required"),
+  prompt: z27.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z26.record(z26.string(), z26.string()).optional(),
-  secrets: z26.record(z26.string(), z26.string()).optional(),
-  artifactName: z26.string().optional(),
+  variables: z27.record(z27.string(), z27.string()).optional(),
+  secrets: z27.record(z27.string(), z27.string()).optional(),
+  artifactName: z27.string().optional(),
   // Artifact name to mount
-  artifactVersion: z26.string().optional(),
+  artifactVersion: z27.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z26.record(z26.string(), z26.string()).optional()
+  volumes: z27.record(z27.string(), z27.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
   status: publicRunStatusSchema.optional()
 });
-var publicRunsListContract = c18.router({
+var publicRunsListContract = c19.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -8591,13 +8760,13 @@ var publicRunsListContract = c18.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c18.router({
+var publicRunByIdContract = c19.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -8609,15 +8778,15 @@ var publicRunByIdContract = c18.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c18.router({
+var publicRunCancelContract = c19.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
-    body: z26.undefined(),
+    body: z27.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -8630,27 +8799,27 @@ var publicRunCancelContract = c18.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z26.object({
+var logEntrySchema = z27.object({
   timestamp: timestampSchema,
-  type: z26.enum(["agent", "system", "network"]),
-  level: z26.enum(["debug", "info", "warn", "error"]),
-  message: z26.string(),
-  metadata: z26.record(z26.string(), z26.unknown()).optional()
+  type: z27.enum(["agent", "system", "network"]),
+  level: z27.enum(["debug", "info", "warn", "error"]),
+  message: z27.string(),
+  metadata: z27.record(z27.string(), z27.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z26.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z27.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z26.enum(["asc", "desc"]).default("asc")
+  order: z27.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c18.router({
+var publicRunLogsContract = c19.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -8663,30 +8832,30 @@ var publicRunLogsContract = c18.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z26.object({
+var metricPointSchema = z27.object({
   timestamp: timestampSchema,
-  cpuPercent: z26.number(),
-  memoryUsedMb: z26.number(),
-  memoryTotalMb: z26.number(),
-  diskUsedMb: z26.number(),
-  diskTotalMb: z26.number()
-});
-var metricsSummarySchema = z26.object({
-  avgCpuPercent: z26.number(),
-  maxMemoryUsedMb: z26.number(),
-  totalDurationMs: z26.number().nullable()
-});
-var metricsResponseSchema2 = z26.object({
-  data: z26.array(metricPointSchema),
+  cpuPercent: z27.number(),
+  memoryUsedMb: z27.number(),
+  memoryTotalMb: z27.number(),
+  diskUsedMb: z27.number(),
+  diskTotalMb: z27.number()
+});
+var metricsSummarySchema = z27.object({
+  avgCpuPercent: z27.number(),
+  maxMemoryUsedMb: z27.number(),
+  totalDurationMs: z27.number().nullable()
+});
+var metricsResponseSchema2 = z27.object({
+  data: z27.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c18.router({
+var publicRunMetricsContract = c19.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -8698,7 +8867,7 @@ var publicRunMetricsContract = c18.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z26.enum([
+var sseEventTypeSchema = z27.enum([
   "status",
   // Run status change
   "output",
@@ -8710,26 +8879,26 @@ var sseEventTypeSchema = z26.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z26.object({
+var sseEventSchema = z27.object({
   event: sseEventTypeSchema,
-  data: z26.unknown(),
-  id: z26.string().optional()
+  data: z27.unknown(),
+  id: z27.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c18.router({
+var publicRunEventsContract = c19.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
     headers: authHeadersSchema,
-    pathParams: z26.object({
-      id: z26.string().min(1, "Run ID is required")
+    pathParams: z27.object({
+      id: z27.string().min(1, "Run ID is required")
     }),
-    query: z26.object({
-      lastEventId: z26.string().optional()
+    query: z27.object({
+      lastEventId: z27.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z26.any(),
+      200: z27.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -8741,28 +8910,28 @@ var publicRunEventsContract = c18.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z27 } from "zod";
-var c19 = initContract();
-var publicArtifactSchema = z27.object({
-  id: z27.string(),
-  name: z27.string(),
-  currentVersionId: z27.string().nullable(),
-  size: z27.number(),
+import { z as z28 } from "zod";
+var c20 = initContract();
+var publicArtifactSchema = z28.object({
+  id: z28.string(),
+  name: z28.string(),
+  currentVersionId: z28.string().nullable(),
+  size: z28.number(),
   // Total size in bytes
-  fileCount: z27.number(),
+  fileCount: z28.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var artifactVersionSchema = z27.object({
-  id: z27.string(),
+var artifactVersionSchema = z28.object({
+  id: z28.string(),
   // SHA-256 content hash
-  artifactId: z27.string(),
-  size: z27.number(),
+  artifactId: z28.string(),
+  size: z28.number(),
   // Size in bytes
-  fileCount: z27.number(),
-  message: z27.string().nullable(),
+  fileCount: z28.number(),
+  message: z28.string().nullable(),
   // Optional commit message
-  createdBy: z27.string(),
+  createdBy: z28.string(),
   createdAt: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -8772,7 +8941,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c19.router({
+var publicArtifactsListContract = c20.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -8787,13 +8956,13 @@ var publicArtifactsListContract = c19.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c19.router({
+var publicArtifactByIdContract = c20.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
     headers: authHeadersSchema,
-    pathParams: z27.object({
-      id: z27.string().min(1, "Artifact ID is required")
+    pathParams: z28.object({
+      id: z28.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -8805,13 +8974,13 @@ var publicArtifactByIdContract = c19.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c19.router({
+var publicArtifactVersionsContract = c20.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z27.object({
-      id: z27.string().min(1, "Artifact ID is required")
+    pathParams: z28.object({
+      id: z28.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -8824,20 +8993,20 @@ var publicArtifactVersionsContract = c19.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c19.router({
+var publicArtifactDownloadContract = c20.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
     headers: authHeadersSchema,
-    pathParams: z27.object({
-      id: z27.string().min(1, "Artifact ID is required")
+    pathParams: z28.object({
+      id: z28.string().min(1, "Artifact ID is required")
     }),
-    query: z27.object({
-      versionId: z27.string().optional()
+    query: z28.object({
+      versionId: z28.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z27.undefined(),
+      302: z28.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -8849,28 +9018,28 @@ var publicArtifactDownloadContract = c19.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z28 } from "zod";
-var c20 = initContract();
-var publicVolumeSchema = z28.object({
-  id: z28.string(),
-  name: z28.string(),
-  currentVersionId: z28.string().nullable(),
-  size: z28.number(),
+import { z as z29 } from "zod";
+var c21 = initContract();
+var publicVolumeSchema = z29.object({
+  id: z29.string(),
+  name: z29.string(),
+  currentVersionId: z29.string().nullable(),
+  size: z29.number(),
   // Total size in bytes
-  fileCount: z28.number(),
+  fileCount: z29.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var volumeVersionSchema = z28.object({
-  id: z28.string(),
+var volumeVersionSchema = z29.object({
+  id: z29.string(),
   // SHA-256 content hash
-  volumeId: z28.string(),
-  size: z28.number(),
+  volumeId: z29.string(),
+  size: z29.number(),
   // Size in bytes
-  fileCount: z28.number(),
-  message: z28.string().nullable(),
+  fileCount: z29.number(),
+  message: z29.string().nullable(),
   // Optional commit message
-  createdBy: z28.string(),
+  createdBy: z29.string(),
   createdAt: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -8878,7 +9047,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c20.router({
+var publicVolumesListContract = c21.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -8893,13 +9062,13 @@ var publicVolumesListContract = c20.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c20.router({
+var publicVolumeByIdContract = c21.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
     headers: authHeadersSchema,
-    pathParams: z28.object({
-      id: z28.string().min(1, "Volume ID is required")
+    pathParams: z29.object({
+      id: z29.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -8911,13 +9080,13 @@ var publicVolumeByIdContract = c20.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c20.router({
+var publicVolumeVersionsContract = c21.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z28.object({
-      id: z28.string().min(1, "Volume ID is required")
+    pathParams: z29.object({
+      id: z29.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -8930,20 +9099,20 @@ var publicVolumeVersionsContract = c20.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c20.router({
+var publicVolumeDownloadContract = c21.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
     headers: authHeadersSchema,
-    pathParams: z28.object({
-      id: z28.string().min(1, "Volume ID is required")
+    pathParams: z29.object({
+      id: z29.string().min(1, "Volume ID is required")
     }),
-    query: z28.object({
-      versionId: z28.string().optional()
+    query: z29.object({
+      versionId: z29.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z28.undefined(),
+      302: z29.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -9105,7 +9274,7 @@ function initVMRegistry(registryPath) {
 // src/lib/proxy/proxy-manager.ts
 import { spawn as spawn2 } from "child_process";
 import fs7 from "fs";
-import path4 from "path";
+import path5 from "path";
 
 // src/lib/proxy/mitm-addon-script.ts
 var RUNNER_MITM_ADDON_SCRIPT = `#!/usr/bin/env python3
@@ -9601,7 +9770,7 @@ var ProxyManager = class {
   process = null;
   isRunning = false;
   constructor(config) {
-    const addonPath = path4.join(config.caDir, "mitm_addon.py");
+    const addonPath = path5.join(config.caDir, "mitm_addon.py");
     this.config = {
       ...DEFAULT_PROXY_OPTIONS,
       ...config,
@@ -9628,7 +9797,7 @@ var ProxyManager = class {
    * Ensure the addon script exists at the configured path
    */
   ensureAddonScript() {
-    const addonDir = path4.dirname(this.config.addonPath);
+    const addonDir = path5.dirname(this.config.addonPath);
     if (!fs7.existsSync(addonDir)) {
       fs7.mkdirSync(addonDir, { recursive: true });
     }
@@ -9644,7 +9813,7 @@ var ProxyManager = class {
     if (!fs7.existsSync(this.config.caDir)) {
       throw new Error(`Proxy CA directory not found: ${this.config.caDir}`);
     }
-    const caCertPath = path4.join(this.config.caDir, "mitmproxy-ca.pem");
+    const caCertPath = path5.join(this.config.caDir, "mitmproxy-ca.pem");
     if (!fs7.existsSync(caCertPath)) {
       throw new Error(`Proxy CA certificate not found: ${caCertPath}`);
     }
@@ -10097,7 +10266,21 @@ async function executeJob(context, config, options = {}) {
     const guestConnectionPromise = guest.waitForGuestConnection(3e4);
     logger9.log(`Creating VM ${vmId}...`);
     vm = new FirecrackerVM(vmConfig);
-    await withSandboxTiming("vm_create", () => vm.start());
+    const snapshotConfig = config.firecracker.snapshot;
+    let snapshotPaths;
+    if (snapshotConfig) {
+      const snapshotDir = path6.dirname(snapshotConfig.snapshot);
+      const originalBaseDir = path6.dirname(snapshotDir);
+      const snapshotBaseDir = runnerPaths.snapshotBaseDir(originalBaseDir);
+      const snapshotWorkDir = runnerPaths.snapshotWorkDir(snapshotBaseDir);
+      snapshotPaths = {
+        snapshot: snapshotConfig.snapshot,
+        memory: snapshotConfig.memory,
+        snapshotOverlay: vmPaths.overlay(snapshotWorkDir),
+        snapshotVsockDir: vmPaths.vsockDir(snapshotWorkDir)
+      };
+    }
+    await withSandboxTiming("vm_create", () => vm.start(snapshotPaths));
     guestIp = vm.getGuestIp();
     vethNsIp = vm.getNetns()?.vethNsIp ?? null;
     if (!guestIp || !vethNsIp) {
@@ -10125,6 +10308,10 @@ async function executeJob(context, config, options = {}) {
     logger9.log(`Waiting for guest connection...`);
     await withSandboxTiming("guest_wait", () => guestConnectionPromise);
     logger9.log(`Guest client ready`);
+    if (config.firecracker.snapshot) {
+      const timestamp = (Date.now() / 1e3).toFixed(3);
+      await guest.exec(`date -s "@${timestamp}"`);
+    }
     if (context.storageManifest) {
       await withSandboxTiming(
         "storage_download",
@@ -10327,7 +10514,7 @@ async function isPortInUse(port) {
 
 // src/lib/runner/runner-lock.ts
 import fs10 from "fs";
-import path5 from "path";
+import path7 from "path";
 var logger11 = createLogger("RunnerLock");
 var DEFAULT_PID_FILE = runtimePaths.runnerPid;
 var currentPidFile = null;
@@ -10344,7 +10531,7 @@ function isProcessRunning(pid) {
 }
 function acquireRunnerLock(options = {}) {
   const pidFile = options.pidFile ?? DEFAULT_PID_FILE;
-  const runDir = path5.dirname(pidFile);
+  const runDir = path7.dirname(pidFile);
   fs10.mkdirSync(runDir, { recursive: true });
   if (fs10.existsSync(pidFile)) {
     const pidStr = fs10.readFileSync(pidFile, "utf-8").trim();
@@ -10378,7 +10565,7 @@ function releaseRunnerLock() {
 var logger12 = createLogger("Runner");
 async function setupEnvironment(options) {
   const { config } = options;
-  await acquireRunnerLock();
+  acquireRunnerLock();
   const networkCheck = checkNetworkPrerequisites();
   if (!networkCheck.ok) {
     logger12.error("Network prerequisites not met:");
@@ -10408,10 +10595,16 @@ async function setupEnvironment(options) {
     );
   }
   logger12.log("Initializing overlay pool...");
+  const snapshotConfig = config.firecracker.snapshot;
   await initOverlayPool({
     size: config.sandbox.max_concurrent + 2,
     replenishThreshold: config.sandbox.max_concurrent,
-    poolDir: runnerPaths.overlayPool(config.base_dir)
+    poolDir: runnerPaths.overlayPool(config.base_dir),
+    createFile: snapshotConfig ? (filePath) => execCommand(
+      `cp --sparse=always "${snapshotConfig.overlay}" "${filePath}"`,
+      false
+    ).then(() => {
+    }) : void 0
   });
   logger12.log("Initializing namespace pool...");
   await initNetnsPool({
@@ -10719,7 +10912,7 @@ import { existsSync as existsSync5, readFileSync as readFileSync3, readdirSync a
 
 // src/lib/firecracker/process.ts
 import { readdirSync, readFileSync as readFileSync2, existsSync as existsSync4 } from "fs";
-import path6 from "path";
+import path8 from "path";
 function parseFirecrackerCmdline(cmdline) {
   const args = cmdline.split("\0");
   if (!args[0]?.includes("firecracker")) return null;
@@ -10752,7 +10945,7 @@ function findFirecrackerProcesses() {
   for (const entry of entries) {
     if (!/^\d+$/.test(entry)) continue;
     const pid = parseInt(entry, 10);
-    const cmdlinePath = path6.join(procDir, entry, "cmdline");
+    const cmdlinePath = path8.join(procDir, entry, "cmdline");
     if (!existsSync4(cmdlinePath)) continue;
     try {
       const cmdline = readFileSync2(cmdlinePath, "utf-8");
@@ -10810,7 +11003,7 @@ function findMitmproxyProcess() {
   for (const entry of entries) {
     if (!/^\d+$/.test(entry)) continue;
     const pid = parseInt(entry, 10);
-    const cmdlinePath = path6.join(procDir, entry, "cmdline");
+    const cmdlinePath = path8.join(procDir, entry, "cmdline");
     if (!existsSync4(cmdlinePath)) continue;
     try {
       const cmdline = readFileSync2(cmdlinePath, "utf-8");
@@ -10826,142 +11019,127 @@ function findMitmproxyProcess() {
 }
 
 // src/commands/doctor.ts
-var doctorCommand = new Command2("doctor").description("Diagnose runner health, check network, and detect issues").option("--config <path>", "Config file path", "./runner.yaml").action(
-  // eslint-disable-next-line complexity -- TODO: refactor complex function
-  async (options) => {
-    try {
-      const config = loadConfig(options.config);
-      const statusFilePath = runnerPaths.statusFile(config.base_dir);
-      const workspacesDir = runnerPaths.workspacesDir(config.base_dir);
-      console.log(`Runner: ${config.name}`);
-      let status = null;
-      if (existsSync5(statusFilePath)) {
-        try {
-          status = JSON.parse(
-            readFileSync3(statusFilePath, "utf-8")
-          );
-          console.log(`Mode: ${status.mode}`);
-          if (status.started_at) {
-            const started = new Date(status.started_at);
-            const uptime = formatUptime(Date.now() - started.getTime());
-            console.log(
-              `Started: ${started.toLocaleString()} (uptime: ${uptime})`
-            );
-          }
-        } catch {
-          console.log("Mode: unknown (status.json unreadable)");
-        }
-      } else {
-        console.log("Mode: unknown (no status.json)");
-      }
-      console.log("");
-      console.log("API Connectivity:");
-      try {
-        await pollForJob(config.server, config.group);
-        console.log(`  \u2713 Connected to ${config.server.url}`);
-        console.log("  \u2713 Authentication: OK");
-      } catch (error) {
-        console.log(`  \u2717 Cannot connect to ${config.server.url}`);
-        console.log(
-          `    Error: ${error instanceof Error ? error.message : "Unknown error"}`
-        );
-      }
-      console.log("");
-      console.log("Network:");
-      const warnings = [];
-      const proxyPort = config.proxy.port;
-      const mitmProc = findMitmproxyProcess();
-      const portInUse = await isPortInUse(proxyPort);
-      if (mitmProc) {
-        console.log(
-          `  \u2713 Proxy mitmproxy (PID ${mitmProc.pid}) on :${proxyPort}`
-        );
-      } else if (portInUse) {
-        console.log(
-          `  \u26A0\uFE0F Proxy port :${proxyPort} in use but mitmproxy process not found`
-        );
-        warnings.push({
-          message: `Port ${proxyPort} is in use but mitmproxy process not detected`
-        });
-      } else {
-        console.log(`  \u2717 Proxy mitmproxy not running`);
-        warnings.push({ message: "Proxy mitmproxy is not running" });
-      }
-      console.log(
-        `  \u2139 Namespaces: each VM runs in isolated namespace with IP ${SNAPSHOT_NETWORK.guestIp}`
-      );
-      console.log("");
-      const processes = findFirecrackerProcesses();
-      const workspaces = existsSync5(workspacesDir) ? readdirSync2(workspacesDir).filter(runnerPaths.isVmWorkspace) : [];
-      const jobs = [];
-      const statusVmIds = /* @__PURE__ */ new Set();
-      if (status?.active_run_ids) {
-        for (const runId of status.active_run_ids) {
-          const vmId = createVmId(runId);
-          statusVmIds.add(vmId);
-          const proc = processes.find((p) => p.vmId === vmId);
-          jobs.push({
-            runId,
-            vmId,
-            hasProcess: !!proc,
-            pid: proc?.pid
-          });
-        }
-      }
-      const maxConcurrent = config.sandbox.max_concurrent;
-      console.log(`Runs (${jobs.length} active, max ${maxConcurrent}):`);
-      if (jobs.length === 0) {
-        console.log("  No active runs");
-      } else {
-        console.log(
-          "  Run ID                                VM ID       Status"
-        );
-        for (const job of jobs) {
-          const statusText = job.hasProcess ? `\u2713 Running (PID ${job.pid})` : "\u26A0\uFE0F No process";
-          console.log(`  ${job.runId}  ${job.vmId}    ${statusText}`);
-        }
-      }
-      console.log("");
-      for (const job of jobs) {
-        if (!job.hasProcess) {
-          warnings.push({
-            message: `Run ${job.vmId} in status.json but no Firecracker process running`
-          });
-        }
-      }
-      const processVmIds = new Set(processes.map((p) => p.vmId));
-      for (const proc of processes) {
-        if (!statusVmIds.has(proc.vmId)) {
-          warnings.push({
-            message: `Orphan process: PID ${proc.pid} (vmId ${proc.vmId}) not in status.json`
-          });
-        }
-      }
-      for (const ws of workspaces) {
-        const vmId = runnerPaths.extractVmId(ws);
-        if (!processVmIds.has(vmId) && !statusVmIds.has(vmId)) {
-          warnings.push({
-            message: `Orphan workspace: ${ws} (no matching job or process)`
-          });
-        }
-      }
-      console.log("Warnings:");
-      if (warnings.length === 0) {
-        console.log("  None");
-      } else {
-        for (const w of warnings) {
-          console.log(`  - ${w.message}`);
-        }
-      }
-      process.exit(warnings.length > 0 ? 1 : 0);
-    } catch (error) {
-      console.error(
-        `Error: ${error instanceof Error ? error.message : "Unknown error"}`
-      );
-      process.exit(1);
+function displayRunnerStatus(statusFilePath) {
+  if (!existsSync5(statusFilePath)) {
+    console.log("Mode: unknown (no status.json)");
+    return null;
+  }
+  try {
+    const status = JSON.parse(
+      readFileSync3(statusFilePath, "utf-8")
+    );
+    console.log(`Mode: ${status.mode}`);
+    if (status.started_at) {
+      const started = new Date(status.started_at);
+      const uptime = formatUptime(Date.now() - started.getTime());
+      console.log(`Started: ${started.toLocaleString()} (uptime: ${uptime})`);
     }
+    return status;
+  } catch {
+    console.log("Mode: unknown (status.json unreadable)");
+    return null;
   }
-);
+}
+async function checkApiConnectivity(config) {
+  console.log("API Connectivity:");
+  try {
+    await pollForJob(config.server, config.group);
+    console.log(`  \u2713 Connected to ${config.server.url}`);
+    console.log("  \u2713 Authentication: OK");
+  } catch (error) {
+    console.log(`  \u2717 Cannot connect to ${config.server.url}`);
+    console.log(
+      `    Error: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+  }
+}
+async function checkNetwork(config, warnings) {
+  console.log("Network:");
+  const proxyPort = config.proxy.port;
+  const mitmProc = findMitmproxyProcess();
+  const portInUse = await isPortInUse(proxyPort);
+  if (mitmProc) {
+    console.log(`  \u2713 Proxy mitmproxy (PID ${mitmProc.pid}) on :${proxyPort}`);
+  } else if (portInUse) {
+    console.log(
+      `  \u26A0\uFE0F Proxy port :${proxyPort} in use but mitmproxy process not found`
+    );
+    warnings.push({
+      message: `Port ${proxyPort} is in use but mitmproxy process not detected`
+    });
+  } else {
+    console.log(`  \u2717 Proxy mitmproxy not running`);
+    warnings.push({ message: "Proxy mitmproxy is not running" });
+  }
+  console.log(
+    `  \u2139 Namespaces: each VM runs in isolated namespace with IP ${SNAPSHOT_NETWORK.guestIp}`
+  );
+}
+function buildJobInfo(status, processes) {
+  const jobs = [];
+  const statusVmIds = /* @__PURE__ */ new Set();
+  if (status?.active_run_ids) {
+    for (const runId of status.active_run_ids) {
+      const vmId = createVmId(runId);
+      statusVmIds.add(vmId);
+      const proc = processes.find((p) => p.vmId === vmId);
+      jobs.push({
+        runId,
+        vmId,
+        hasProcess: !!proc,
+        pid: proc?.pid
+      });
+    }
+  }
+  return { jobs, statusVmIds };
+}
+function displayRuns(jobs, maxConcurrent) {
+  console.log(`Runs (${jobs.length} active, max ${maxConcurrent}):`);
+  if (jobs.length === 0) {
+    console.log("  No active runs");
+    return;
+  }
+  console.log("  Run ID                                VM ID       Status");
+  for (const job of jobs) {
+    const statusText = job.hasProcess ? `\u2713 Running (PID ${job.pid})` : "\u26A0\uFE0F No process";
+    console.log(`  ${job.runId}  ${job.vmId}    ${statusText}`);
+  }
+}
+function detectOrphanResources(jobs, processes, workspaces, statusVmIds, warnings) {
+  for (const job of jobs) {
+    if (!job.hasProcess) {
+      warnings.push({
+        message: `Run ${job.vmId} in status.json but no Firecracker process running`
+      });
+    }
+  }
+  const processVmIds = new Set(processes.map((p) => p.vmId));
+  for (const proc of processes) {
+    if (!statusVmIds.has(proc.vmId)) {
+      warnings.push({
+        message: `Orphan process: PID ${proc.pid} (vmId ${proc.vmId}) not in status.json`
+      });
+    }
+  }
+  for (const ws of workspaces) {
+    const vmId = runnerPaths.extractVmId(ws);
+    if (!processVmIds.has(vmId) && !statusVmIds.has(vmId)) {
+      warnings.push({
+        message: `Orphan workspace: ${ws} (no matching job or process)`
+      });
+    }
+  }
+}
+function displayWarnings(warnings) {
+  console.log("Warnings:");
+  if (warnings.length === 0) {
+    console.log("  None");
+  } else {
+    for (const w of warnings) {
+      console.log(`  - ${w.message}`);
+    }
+  }
+}
 function formatUptime(ms) {
   const seconds = Math.floor(ms / 1e3);
   const minutes = Math.floor(seconds / 60);
@@ -10972,6 +11150,34 @@ function formatUptime(ms) {
   if (minutes > 0) return `${minutes}m`;
   return `${seconds}s`;
 }
+var doctorCommand = new Command2("doctor").description("Diagnose runner health, check network, and detect issues").option("--config <path>", "Config file path", "./runner.yaml").action(async (options) => {
+  try {
+    const config = loadConfig(options.config);
+    const statusFilePath = runnerPaths.statusFile(config.base_dir);
+    const workspacesDir = runnerPaths.workspacesDir(config.base_dir);
+    const warnings = [];
+    console.log(`Runner: ${config.name}`);
+    const status = displayRunnerStatus(statusFilePath);
+    console.log("");
+    await checkApiConnectivity(config);
+    console.log("");
+    await checkNetwork(config, warnings);
+    console.log("");
+    const processes = findFirecrackerProcesses();
+    const workspaces = existsSync5(workspacesDir) ? readdirSync2(workspacesDir).filter(runnerPaths.isVmWorkspace) : [];
+    const { jobs, statusVmIds } = buildJobInfo(status, processes);
+    displayRuns(jobs, config.sandbox.max_concurrent);
+    console.log("");
+    detectOrphanResources(jobs, processes, workspaces, statusVmIds, warnings);
+    displayWarnings(warnings);
+    process.exit(warnings.length > 0 ? 1 : 0);
+  } catch (error) {
+    console.error(
+      `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+    process.exit(1);
+  }
+});
 
 // src/commands/kill.ts
 import { Command as Command3 } from "commander";
@@ -11208,10 +11414,16 @@ var benchmarkCommand = new Command4("benchmark").description(
       process.exit(1);
     }
     timer.log("Initializing pools...");
+    const snapshotConfig = config.firecracker.snapshot;
     await initOverlayPool({
       size: 2,
       replenishThreshold: 1,
-      poolDir: runnerPaths.overlayPool(config.base_dir)
+      poolDir: runnerPaths.overlayPool(config.base_dir),
+      createFile: snapshotConfig ? (filePath) => execCommand(
+        `cp --sparse=always "${snapshotConfig.overlay}" "${filePath}"`,
+        false
+      ).then(() => {
+      }) : void 0
     });
     await initNetnsPool({ name: config.name, size: 2 });
     poolsInitialized = true;
@@ -11239,12 +11451,219 @@ var benchmarkCommand = new Command4("benchmark").description(
   process.exit(exitCode);
 });
 
+// src/commands/snapshot.ts
+import { Command as Command5 } from "commander";
+import { spawn as spawn3 } from "child_process";
+import fs11 from "fs";
+import os2 from "os";
+import readline3 from "readline";
+var logger15 = createLogger("Snapshot");
+function startFirecracker(nsName, firecrackerBinary, apiSocketPath, workDir) {
+  logger15.log("Starting Firecracker with API socket...");
+  const currentUser = os2.userInfo().username;
+  const fcProcess = spawn3(
+    "sudo",
+    [
+      "ip",
+      "netns",
+      "exec",
+      nsName,
+      "sudo",
+      "-u",
+      currentUser,
+      firecrackerBinary,
+      "--api-sock",
+      apiSocketPath
+    ],
+    {
+      cwd: workDir,
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: false
+    }
+  );
+  if (fcProcess.stdout) {
+    const stdoutRL = readline3.createInterface({ input: fcProcess.stdout });
+    stdoutRL.on("line", (line) => {
+      if (line.trim()) logger15.log(`[FC] ${line}`);
+    });
+  }
+  if (fcProcess.stderr) {
+    const stderrRL = readline3.createInterface({ input: fcProcess.stderr });
+    stderrRL.on("line", (line) => {
+      if (line.trim()) logger15.log(`[FC stderr] ${line}`);
+    });
+  }
+  fcProcess.on("error", (err) => logger15.log(`Firecracker error: ${err}`));
+  fcProcess.on(
+    "exit",
+    (code, signal) => logger15.log(`Firecracker exited: code=${code}, signal=${signal}`)
+  );
+  return fcProcess;
+}
+var snapshotCommand = new Command5("snapshot").description("Generate a Firecracker snapshot for fast VM startup").argument("<output-dir>", "Output directory for snapshot files").option("--config <path>", "Config file path", "./runner.yaml").action(
+  async (outputDir, opts) => {
+    const options = {
+      config: opts.config ?? "./runner.yaml",
+      output: outputDir
+    };
+    const timer = new Timer();
+    setGlobalLogger(timer.log.bind(timer));
+    logger15.log("Loading configuration...");
+    const config = loadDebugConfig(options.config);
+    validateFirecrackerPaths(config.firecracker);
+    const nsName = "vm0-snapshot";
+    const workDir = runnerPaths.snapshotWorkDir(config.base_dir);
+    const overlayPath = vmPaths.overlay(workDir);
+    const vsockPath = vmPaths.vsock(workDir);
+    const apiSocketPath = vmPaths.apiSock(workDir);
+    const outputSnapshot = snapshotOutputPaths.snapshot(options.output);
+    const outputMemory = snapshotOutputPaths.memory(options.output);
+    const outputOverlay = snapshotOutputPaths.overlay(options.output);
+    let fcProcess = null;
+    let vsockClient = null;
+    let exitCode = 0;
+    try {
+      if (fs11.existsSync(workDir)) {
+        logger15.log("Cleaning up stale work directory...");
+        fs11.rmSync(workDir, { recursive: true, force: true });
+      }
+      logger15.log(`Creating directories...`);
+      fs11.mkdirSync(options.output, { recursive: true });
+      fs11.mkdirSync(workDir, { recursive: true });
+      fs11.mkdirSync(vmPaths.vsockDir(workDir), { recursive: true });
+      logger15.log("Creating overlay filesystem...");
+      await createOverlayFile(overlayPath);
+      logger15.log(`Overlay created: ${overlayPath}`);
+      logger15.log(`Creating network namespace: ${nsName}`);
+      await deleteNetns(nsName);
+      await createNetnsWithTap(nsName, {
+        tapName: SNAPSHOT_NETWORK.tapName,
+        gatewayIpWithPrefix: `${SNAPSHOT_NETWORK.gatewayIp}/${SNAPSHOT_NETWORK.prefixLen}`
+      });
+      logger15.log("Network namespace created");
+      fcProcess = startFirecracker(
+        nsName,
+        config.firecracker.binary,
+        apiSocketPath,
+        workDir
+      );
+      const apiClient = new FirecrackerClient(apiSocketPath);
+      logger15.log("Waiting for API to be ready...");
+      await apiClient.waitForReady();
+      logger15.log("API ready");
+      logger15.log("Configuring VM via API...");
+      await Promise.all([
+        apiClient.configureMachine({
+          vcpu_count: config.sandbox.vcpu,
+          mem_size_mib: config.sandbox.memory_mb
+        }),
+        apiClient.configureBootSource({
+          kernel_image_path: config.firecracker.kernel,
+          boot_args: buildBootArgs()
+        }),
+        apiClient.configureDrive({
+          drive_id: "rootfs",
+          path_on_host: config.firecracker.rootfs,
+          is_root_device: true,
+          is_read_only: true
+        }),
+        apiClient.configureDrive({
+          drive_id: "overlay",
+          path_on_host: overlayPath,
+          is_root_device: false,
+          is_read_only: false
+        }),
+        apiClient.configureNetworkInterface({
+          iface_id: "eth0",
+          guest_mac: SNAPSHOT_NETWORK.guestMac,
+          host_dev_name: SNAPSHOT_NETWORK.tapName
+        }),
+        apiClient.configureVsock({
+          guest_cid: 3,
+          uds_path: vsockPath
+        })
+      ]);
+      logger15.log("VM configured");
+      logger15.log("Starting vsock listener...");
+      vsockClient = new VsockClient(vsockPath);
+      const guestConnectionPromise = vsockClient.waitForGuestConnection(6e4);
+      logger15.log("Starting VM...");
+      await apiClient.startInstance();
+      logger15.log("VM started");
+      logger15.log("Waiting for guest connection...");
+      await guestConnectionPromise;
+      logger15.log("Guest connected");
+      logger15.log("Verifying guest is responsive...");
+      const reachable = await vsockClient.isReachable();
+      if (!reachable) {
+        throw new Error("Guest is not responsive");
+      }
+      logger15.log("Guest is responsive");
+      logger15.log("Pausing VM...");
+      await apiClient.pause();
+      logger15.log("VM paused");
+      logger15.log("Creating snapshot...");
+      await apiClient.createSnapshot({
+        snapshot_type: "Full",
+        snapshot_path: outputSnapshot,
+        mem_file_path: outputMemory
+      });
+      logger15.log("Snapshot created");
+      logger15.log("Copying overlay as golden overlay...");
+      await execCommand(
+        `cp --sparse=always "${overlayPath}" "${outputOverlay}"`,
+        false
+      );
+      logger15.log("Golden overlay created");
+      logger15.log("=".repeat(40));
+      logger15.log("Snapshot generation complete!");
+      logger15.log("Files (logical size):");
+      const lsOutput = await execCommand(`ls -lh "${options.output}"`, false);
+      logger15.log(lsOutput);
+      logger15.log("Actual disk usage:");
+      const duOutput = await execCommand(
+        `du -h "${options.output}"/*`,
+        false
+      );
+      logger15.log(duOutput);
+      logger15.log("=".repeat(40));
+    } catch (error) {
+      logger15.error(
+        `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+      exitCode = 1;
+    } finally {
+      logger15.log("Cleaning up...");
+      if (vsockClient) {
+        vsockClient.close();
+      }
+      if (fcProcess && !fcProcess.killed) {
+        fcProcess.kill("SIGKILL");
+      }
+      await execCommand(
+        `pkill -9 -f "firecracker.*${apiSocketPath}"`,
+        true
+      ).catch(() => {
+      });
+      await deleteNetns(nsName);
+      if (fs11.existsSync(workDir)) {
+        fs11.rmSync(workDir, { recursive: true, force: true });
+      }
+      logger15.log("Cleanup complete");
+    }
+    if (exitCode !== 0) {
+      process.exit(exitCode);
+    }
+  }
+);
+
 // src/index.ts
-var version = true ? "3.11.2" : "0.1.0";
+var version = true ? "3.12.0" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(doctorCommand);
 program.addCommand(killCommand);
 program.addCommand(benchmarkCommand);
+program.addCommand(snapshotCommand);
 program.parse();
 //# sourceMappingURL=index.js.map