@vm0/runner 3.7.3 → 3.8.1

package/index.js

@@ -16,7 +16,7 @@ import yaml from "yaml";
 import path from "path";
 var VM0_RUN_DIR = "/var/run/vm0";
 var VM0_TMP_PREFIX = "/tmp/vm0";
-var paths = {
+var runtimePaths = {
   /** Runner PID file for single-instance lock */
   runnerPid: path.join(VM0_RUN_DIR, "runner.pid"),
   /** IP pool lock file */
@@ -303,12 +303,12 @@ async function subscribeToJobs(server, group, onJob, onConnectionChange) {
 }
 
 // src/lib/executor.ts
-import path5 from "path";
+import path6 from "path";
 
 // src/lib/firecracker/vm.ts
 import { spawn } from "child_process";
 import fs4 from "fs";
-import path3 from "path";
+import path4 from "path";
 import readline from "readline";
 
 // src/lib/firecracker/client.ts
@@ -321,7 +321,7 @@ var FirecrackerClient = class {
   /**
    * Make HTTP request to Firecracker API
    */
-  async request(method, path8, body) {
+  async request(method, path9, body) {
     return new Promise((resolve, reject) => {
       const bodyStr = body !== void 0 ? JSON.stringify(body) : void 0;
       const headers = {
@@ -334,11 +334,11 @@ var FirecrackerClient = class {
         headers["Content-Length"] = Buffer.byteLength(bodyStr);
       }
       console.log(
-        `[FC API] ${method} ${path8}${bodyStr ? ` (${Buffer.byteLength(bodyStr)} bytes)` : ""}`
+        `[FC API] ${method} ${path9}${bodyStr ? ` (${Buffer.byteLength(bodyStr)} bytes)` : ""}`
       );
       const options = {
         socketPath: this.socketPath,
-        path: path8,
+        path: path9,
         method,
         headers,
         // Disable agent to ensure fresh connection for each request
@@ -472,13 +472,8 @@ var FirecrackerClient = class {
 };
 
 // src/lib/firecracker/network.ts
-import { execSync, exec as exec2 } from "child_process";
-import { promisify as promisify2 } from "util";
-
-// src/lib/firecracker/ip-pool.ts
-import { exec } from "child_process";
+import { execSync, exec } from "child_process";
 import { promisify } from "util";
-import * as fs2 from "fs";
 
 // src/lib/logger.ts
 var _log = null;
@@ -500,204 +495,10 @@ function createLogger(prefix) {
   };
 }
 
-// src/lib/firecracker/ip-pool.ts
+// src/lib/firecracker/network.ts
 var execAsync = promisify(exec);
-var logger = createLogger("IP Pool");
-var REGISTRY_FILE_PATH = paths.ipRegistry;
+var logger = createLogger("Network");
 var BRIDGE_NAME = "vm0br0";
-var IP_PREFIX = "172.16.0.";
-var IP_START = 2;
-var IP_END = 254;
-var LOCK_TIMEOUT_MS = 1e4;
-var LOCK_RETRY_INTERVAL_MS = 100;
-var ALLOCATION_GRACE_PERIOD_MS = 3e4;
-async function ensureRunDir() {
-  if (!fs2.existsSync(VM0_RUN_DIR)) {
-    await execAsync(`sudo mkdir -p ${VM0_RUN_DIR}`);
-    await execAsync(`sudo chmod 777 ${VM0_RUN_DIR}`);
-  }
-}
-async function withLock(fn) {
-  await ensureRunDir();
-  const lockMarker = paths.ipPoolLock;
-  const startTime = Date.now();
-  let lockAcquired = false;
-  while (Date.now() - startTime < LOCK_TIMEOUT_MS) {
-    try {
-      fs2.writeFileSync(lockMarker, process.pid.toString(), { flag: "wx" });
-      lockAcquired = true;
-      break;
-    } catch {
-      try {
-        const pidStr = fs2.readFileSync(lockMarker, "utf-8");
-        const pid = parseInt(pidStr, 10);
-        try {
-          process.kill(pid, 0);
-        } catch {
-          fs2.unlinkSync(lockMarker);
-          continue;
-        }
-      } catch {
-      }
-      await new Promise(
-        (resolve) => setTimeout(resolve, LOCK_RETRY_INTERVAL_MS)
-      );
-    }
-  }
-  if (!lockAcquired) {
-    throw new Error(
-      `Failed to acquire IP pool lock after ${LOCK_TIMEOUT_MS}ms`
-    );
-  }
-  try {
-    return await fn();
-  } finally {
-    try {
-      fs2.unlinkSync(lockMarker);
-    } catch {
-    }
-  }
-}
-function readRegistry() {
-  try {
-    if (fs2.existsSync(REGISTRY_FILE_PATH)) {
-      const content = fs2.readFileSync(REGISTRY_FILE_PATH, "utf-8");
-      return JSON.parse(content);
-    }
-  } catch {
-  }
-  return { allocations: {} };
-}
-function writeRegistry(registry) {
-  fs2.writeFileSync(REGISTRY_FILE_PATH, JSON.stringify(registry, null, 2));
-}
-function getAllocations() {
-  const registry = readRegistry();
-  return new Map(Object.entries(registry.allocations));
-}
-function getIPForVm(vmId) {
-  const registry = readRegistry();
-  for (const [ip, allocation] of Object.entries(registry.allocations)) {
-    if (allocation.vmId === vmId) {
-      return ip;
-    }
-  }
-  return void 0;
-}
-async function scanTapDevices() {
-  const tapDevices = /* @__PURE__ */ new Map();
-  try {
-    const { stdout } = await execAsync(
-      `ip link show master ${BRIDGE_NAME} 2>/dev/null || true`
-    );
-    const lines = stdout.split("\n");
-    for (const line of lines) {
-      const match = line.match(/^\d+:\s+(tap[a-f0-9]+):/);
-      if (match && match[1]) {
-        const tapName = match[1];
-        const vmIdPrefix = tapName.substring(3);
-        tapDevices.set(tapName, vmIdPrefix);
-      }
-    }
-  } catch {
-  }
-  return tapDevices;
-}
-function reconcileRegistry(registry, activeTaps) {
-  const reconciled = { allocations: {} };
-  const activeTapNames = new Set(activeTaps.keys());
-  const now = Date.now();
-  for (const [ip, allocation] of Object.entries(registry.allocations)) {
-    const allocatedTime = new Date(allocation.allocatedAt).getTime();
-    const isWithinGracePeriod = now - allocatedTime < ALLOCATION_GRACE_PERIOD_MS;
-    if (activeTapNames.has(allocation.tapDevice)) {
-      reconciled.allocations[ip] = allocation;
-    } else if (isWithinGracePeriod) {
-      reconciled.allocations[ip] = allocation;
-    } else {
-      logger.log(
-        `Removing stale allocation for ${ip} (TAP ${allocation.tapDevice} no longer exists)`
-      );
-    }
-  }
-  return reconciled;
-}
-function findFreeIP(registry) {
-  const allocatedIPs = new Set(Object.keys(registry.allocations));
-  for (let octet = IP_START; octet <= IP_END; octet++) {
-    const ip = `${IP_PREFIX}${octet}`;
-    if (!allocatedIPs.has(ip)) {
-      return ip;
-    }
-  }
-  return null;
-}
-async function allocateIP(vmId) {
-  const tapDevice = `tap${vmId.substring(0, 8)}`;
-  return withLock(async () => {
-    const registry = readRegistry();
-    const ip = findFreeIP(registry);
-    if (!ip) {
-      throw new Error(
-        "No free IP addresses available in pool (172.16.0.2-254)"
-      );
-    }
-    const allocatedCount = Object.keys(registry.allocations).length;
-    const allocatedIPs = Object.keys(registry.allocations).sort();
-    logger.log(
-      `Current state: ${allocatedCount} IPs allocated [${allocatedIPs.join(", ")}], assigning ${ip}`
-    );
-    registry.allocations[ip] = {
-      vmId,
-      tapDevice,
-      allocatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    writeRegistry(registry);
-    logger.log(`Allocated ${ip} for VM ${vmId} (TAP ${tapDevice})`);
-    return ip;
-  });
-}
-async function releaseIP(ip) {
-  return withLock(async () => {
-    const registry = readRegistry();
-    if (registry.allocations[ip]) {
-      const allocation = registry.allocations[ip];
-      delete registry.allocations[ip];
-      writeRegistry(registry);
-      logger.log(`Released ${ip} (was allocated to VM ${allocation.vmId})`);
-    } else {
-      logger.log(`IP ${ip} was not in registry, nothing to release`);
-    }
-  });
-}
-async function cleanupOrphanedAllocations() {
-  return withLock(async () => {
-    logger.log("Cleaning up orphaned allocations...");
-    const registry = readRegistry();
-    const beforeCount = Object.keys(registry.allocations).length;
-    if (beforeCount === 0) {
-      logger.log("No allocations in registry, nothing to clean up");
-      return;
-    }
-    const activeTaps = await scanTapDevices();
-    logger.log(`Found ${activeTaps.size} active TAP device(s) on bridge`);
-    const reconciled = reconcileRegistry(registry, activeTaps);
-    const afterCount = Object.keys(reconciled.allocations).length;
-    if (afterCount !== beforeCount) {
-      writeRegistry(reconciled);
-      logger.log(
-        `Cleaned up ${beforeCount - afterCount} orphaned allocation(s)`
-      );
-    } else {
-      logger.log("No orphaned allocations found");
-    }
-  });
-}
-
-// src/lib/firecracker/network.ts
-var execAsync2 = promisify2(exec2);
-var logger2 = createLogger("Network");
-var BRIDGE_NAME2 = "vm0br0";
 var BRIDGE_IP = "172.16.0.1";
 var BRIDGE_NETMASK = "255.255.255.0";
 var BRIDGE_CIDR = "172.16.0.0/24";
@@ -728,7 +529,7 @@ function commandExists(cmd) {
 async function execCommand(cmd, sudo = true) {
   const fullCmd = sudo ? `sudo ${cmd}` : cmd;
   try {
-    const { stdout } = await execAsync2(fullCmd);
+    const { stdout } = await execAsync(fullCmd);
     return stdout.trim();
   } catch (error) {
     const execError = error;
@@ -748,33 +549,33 @@ async function getDefaultInterface() {
 }
 async function setupForwardRules() {
   const extIface = await getDefaultInterface();
-  logger2.log(`Setting up FORWARD rules for ${BRIDGE_NAME2} <-> ${extIface}`);
+  logger.log(`Setting up FORWARD rules for ${BRIDGE_NAME} <-> ${extIface}`);
   try {
     await execCommand(
-      `iptables -C FORWARD -i ${BRIDGE_NAME2} -o ${extIface} -j ACCEPT`
+      `iptables -C FORWARD -i ${BRIDGE_NAME} -o ${extIface} -j ACCEPT`
     );
-    logger2.log("FORWARD outbound rule already exists");
+    logger.log("FORWARD outbound rule already exists");
   } catch {
     await execCommand(
-      `iptables -I FORWARD -i ${BRIDGE_NAME2} -o ${extIface} -j ACCEPT`
+      `iptables -I FORWARD -i ${BRIDGE_NAME} -o ${extIface} -j ACCEPT`
     );
-    logger2.log("FORWARD outbound rule added");
+    logger.log("FORWARD outbound rule added");
   }
   try {
     await execCommand(
-      `iptables -C FORWARD -i ${extIface} -o ${BRIDGE_NAME2} -m state --state RELATED,ESTABLISHED -j ACCEPT`
+      `iptables -C FORWARD -i ${extIface} -o ${BRIDGE_NAME} -m state --state RELATED,ESTABLISHED -j ACCEPT`
     );
-    logger2.log("FORWARD inbound rule already exists");
+    logger.log("FORWARD inbound rule already exists");
   } catch {
     await execCommand(
-      `iptables -I FORWARD -i ${extIface} -o ${BRIDGE_NAME2} -m state --state RELATED,ESTABLISHED -j ACCEPT`
+      `iptables -I FORWARD -i ${extIface} -o ${BRIDGE_NAME} -m state --state RELATED,ESTABLISHED -j ACCEPT`
     );
-    logger2.log("FORWARD inbound rule added");
+    logger.log("FORWARD inbound rule added");
   }
 }
 async function bridgeExists() {
   try {
-    await execCommand(`ip link show ${BRIDGE_NAME2}`, true);
+    await execCommand(`ip link show ${BRIDGE_NAME}`, true);
     return true;
   } catch {
     return false;
@@ -782,108 +583,30 @@ async function bridgeExists() {
 }
 async function setupBridge() {
   if (await bridgeExists()) {
-    logger2.log(`Bridge ${BRIDGE_NAME2} already exists`);
+    logger.log(`Bridge ${BRIDGE_NAME} already exists`);
     await setupForwardRules();
     return;
   }
-  logger2.log(`Creating bridge ${BRIDGE_NAME2}...`);
-  await execCommand(`ip link add name ${BRIDGE_NAME2} type bridge`);
+  logger.log(`Creating bridge ${BRIDGE_NAME}...`);
+  await execCommand(`ip link add name ${BRIDGE_NAME} type bridge`);
   await execCommand(
-    `ip addr add ${BRIDGE_IP}/${BRIDGE_NETMASK} dev ${BRIDGE_NAME2}`
+    `ip addr add ${BRIDGE_IP}/${BRIDGE_NETMASK} dev ${BRIDGE_NAME}`
   );
-  await execCommand(`ip link set ${BRIDGE_NAME2} up`);
+  await execCommand(`ip link set ${BRIDGE_NAME} up`);
   await execCommand(`sysctl -w net.ipv4.ip_forward=1`);
   try {
     await execCommand(
       `iptables -t nat -C POSTROUTING -s ${BRIDGE_CIDR} -j MASQUERADE`
     );
-    logger2.log("NAT rule already exists");
+    logger.log("NAT rule already exists");
   } catch {
     await execCommand(
       `iptables -t nat -A POSTROUTING -s ${BRIDGE_CIDR} -j MASQUERADE`
     );
-    logger2.log("NAT rule added");
+    logger.log("NAT rule added");
   }
   await setupForwardRules();
-  logger2.log(`Bridge ${BRIDGE_NAME2} configured with IP ${BRIDGE_IP}`);
-}
-async function tapDeviceExists(tapDevice) {
-  try {
-    await execCommand(`ip link show ${tapDevice}`, true);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function clearStaleIptablesRulesForIP(ip) {
-  try {
-    const { stdout } = await execAsync2(
-      "sudo iptables -t nat -S PREROUTING 2>/dev/null || true"
-    );
-    const lines = stdout.split("\n");
-    const rulesForIP = lines.filter((line) => line.includes(`-s ${ip}`));
-    if (rulesForIP.length === 0) {
-      return;
-    }
-    logger2.log(
-      `Clearing ${rulesForIP.length} stale iptables rule(s) for IP ${ip}`
-    );
-    for (const rule of rulesForIP) {
-      const deleteRule = rule.replace("-A ", "-D ");
-      try {
-        await execCommand(`iptables -t nat ${deleteRule}`);
-      } catch {
-      }
-    }
-  } catch {
-  }
-}
-async function createTapDevice(vmId) {
-  const tapDevice = `tap${vmId.substring(0, 8)}`;
-  const guestMac = generateMacAddress(vmId);
-  const guestIp = await allocateIP(vmId);
-  logger2.log(`[VM ${vmId}] IP allocated: ${guestIp}`);
-  await clearStaleIptablesRulesForIP(guestIp);
-  logger2.log(`[VM ${vmId}] Stale iptables cleared`);
-  if (await tapDeviceExists(tapDevice)) {
-    logger2.log(
-      `[VM ${vmId}] TAP device ${tapDevice} already exists, deleting...`
-    );
-    await deleteTapDevice(tapDevice);
-  }
-  await execCommand(`ip tuntap add ${tapDevice} mode tap`);
-  logger2.log(`[VM ${vmId}] TAP device created`);
-  await execCommand(`ip link set ${tapDevice} master ${BRIDGE_NAME2}`);
-  logger2.log(`[VM ${vmId}] TAP added to bridge`);
-  await execCommand(`ip link set ${tapDevice} up`);
-  logger2.log(
-    `[VM ${vmId}] TAP created: ${tapDevice}, MAC ${guestMac}, IP ${guestIp}`
-  );
-  return {
-    tapDevice,
-    guestMac,
-    guestIp,
-    gatewayIp: BRIDGE_IP,
-    netmask: BRIDGE_NETMASK
-  };
-}
-async function deleteTapDevice(tapDevice, guestIp) {
-  if (!await tapDeviceExists(tapDevice)) {
-    logger2.log(`TAP device ${tapDevice} does not exist, skipping delete`);
-  } else {
-    await execCommand(`ip link delete ${tapDevice}`);
-    logger2.log(`TAP device ${tapDevice} deleted`);
-  }
-  if (guestIp) {
-    try {
-      await execCommand(`ip neigh del ${guestIp} dev ${BRIDGE_NAME2}`, true);
-      logger2.log(`ARP entry cleared for ${guestIp}`);
-    } catch {
-    }
-  }
-  if (guestIp) {
-    await releaseIP(guestIp);
-  }
+  logger.log(`Bridge ${BRIDGE_NAME} configured with IP ${BRIDGE_IP}`);
 }
 function generateNetworkBootArgs(config) {
   return `ip=${config.guestIp}::${config.gatewayIp}:${config.netmask}:vm0-guest:eth0:off`;
@@ -910,69 +633,53 @@ function checkNetworkPrerequisites() {
 }
 async function setupCIDRProxyRules(proxyPort) {
   const comment = "vm0:cidr-proxy";
-  logger2.log(
+  logger.log(
     `Setting up CIDR proxy rules for ${BRIDGE_CIDR} -> port ${proxyPort}`
   );
   try {
     await execCommand(
       `iptables -t nat -C PREROUTING -s ${BRIDGE_CIDR} -p tcp --dport 80 -j REDIRECT --to-port ${proxyPort} -m comment --comment "${comment}"`
     );
-    logger2.log("CIDR proxy rule for port 80 already exists");
+    logger.log("CIDR proxy rule for port 80 already exists");
   } catch {
     await execCommand(
       `iptables -t nat -A PREROUTING -s ${BRIDGE_CIDR} -p tcp --dport 80 -j REDIRECT --to-port ${proxyPort} -m comment --comment "${comment}"`
     );
-    logger2.log("CIDR proxy rule for port 80 added");
+    logger.log("CIDR proxy rule for port 80 added");
   }
   try {
     await execCommand(
       `iptables -t nat -C PREROUTING -s ${BRIDGE_CIDR} -p tcp --dport 443 -j REDIRECT --to-port ${proxyPort} -m comment --comment "${comment}"`
     );
-    logger2.log("CIDR proxy rule for port 443 already exists");
+    logger.log("CIDR proxy rule for port 443 already exists");
   } catch {
     await execCommand(
       `iptables -t nat -A PREROUTING -s ${BRIDGE_CIDR} -p tcp --dport 443 -j REDIRECT --to-port ${proxyPort} -m comment --comment "${comment}"`
     );
-    logger2.log("CIDR proxy rule for port 443 added");
+    logger.log("CIDR proxy rule for port 443 added");
   }
 }
 async function cleanupCIDRProxyRules(proxyPort) {
   const comment = "vm0:cidr-proxy";
-  logger2.log("Cleaning up CIDR proxy rules...");
+  logger.log("Cleaning up CIDR proxy rules...");
   try {
     await execCommand(
       `iptables -t nat -D PREROUTING -s ${BRIDGE_CIDR} -p tcp --dport 80 -j REDIRECT --to-port ${proxyPort} -m comment --comment "${comment}"`
     );
-    logger2.log("CIDR proxy rule for port 80 removed");
+    logger.log("CIDR proxy rule for port 80 removed");
   } catch {
   }
   try {
     await execCommand(
       `iptables -t nat -D PREROUTING -s ${BRIDGE_CIDR} -p tcp --dport 443 -j REDIRECT --to-port ${proxyPort} -m comment --comment "${comment}"`
     );
-    logger2.log("CIDR proxy rule for port 443 removed");
+    logger.log("CIDR proxy rule for port 443 removed");
   } catch {
   }
 }
-async function listTapDevices() {
-  try {
-    const result = await execCommand("ip -o link show type tuntap", false);
-    const devices = [];
-    const lines = result.split("\n");
-    for (const line of lines) {
-      const match = line.match(/^\d+:\s+(tap[a-f0-9]{8}):/);
-      if (match && match[1]) {
-        devices.push(match[1]);
-      }
-    }
-    return devices;
-  } catch {
-    return [];
-  }
-}
 async function checkBridgeStatus() {
   try {
-    const result = await execCommand(`ip -o addr show ${BRIDGE_NAME2}`, false);
+    const result = await execCommand(`ip -o addr show ${BRIDGE_NAME}`, false);
     const ipMatch = result.match(/inet\s+(\d+\.\d+\.\d+\.\d+)/);
     const upMatch = result.includes("UP") || result.includes("state UP");
     return {
@@ -1029,17 +736,17 @@ async function findOrphanedIptablesRules(rules, activeVmIps, expectedProxyPort)
   return orphaned;
 }
 async function flushBridgeArpCache() {
-  logger2.log(`Flushing ARP cache on bridge ${BRIDGE_NAME2}...`);
+  logger.log(`Flushing ARP cache on bridge ${BRIDGE_NAME}...`);
   try {
     if (!await bridgeExists()) {
-      logger2.log("Bridge does not exist, skipping ARP flush");
+      logger.log("Bridge does not exist, skipping ARP flush");
       return;
     }
-    const { stdout } = await execAsync2(
-      `ip neigh show dev ${BRIDGE_NAME2} 2>/dev/null || true`
+    const { stdout } = await execAsync(
+      `ip neigh show dev ${BRIDGE_NAME} 2>/dev/null || true`
     );
     if (!stdout.trim()) {
-      logger2.log("No ARP entries on bridge");
+      logger.log("No ARP entries on bridge");
       return;
     }
     const lines = stdout.split("\n").filter((line) => line.trim());
@@ -1049,104 +756,642 @@ async function flushBridgeArpCache() {
       if (match && match[1]) {
         const ip = match[1];
         try {
-          await execCommand(`ip neigh del ${ip} dev ${BRIDGE_NAME2}`, true);
+          await execCommand(`ip neigh del ${ip} dev ${BRIDGE_NAME}`, true);
           cleared++;
         } catch {
         }
       }
     }
-    logger2.log(`Cleared ${cleared} ARP entries from bridge`);
+    logger.log(`Cleared ${cleared} ARP entries from bridge`);
   } catch (error) {
-    logger2.log(
+    logger.log(
       `Warning: Could not flush ARP cache: ${error instanceof Error ? error.message : "Unknown error"}`
     );
   }
 }
 async function cleanupOrphanedProxyRules(runnerName) {
   const comment = `vm0:runner:${runnerName}`;
-  logger2.log(`Cleaning up orphaned proxy rules for runner '${runnerName}'...`);
+  logger.log(`Cleaning up orphaned proxy rules for runner '${runnerName}'...`);
   try {
     const rules = await execCommand("iptables -t nat -S PREROUTING", false);
     const ourRules = rules.split("\n").filter((rule) => rule.includes(comment));
     if (ourRules.length === 0) {
-      logger2.log("No orphaned proxy rules found");
+      logger.log("No orphaned proxy rules found");
       return;
     }
-    logger2.log(`Found ${ourRules.length} orphaned rule(s) to clean up`);
+    logger.log(`Found ${ourRules.length} orphaned rule(s) to clean up`);
     for (const rule of ourRules) {
       const deleteRule = rule.replace("-A ", "-D ");
       try {
         await execCommand(`iptables -t nat ${deleteRule}`);
-        logger2.log(`Deleted orphaned rule: ${rule.substring(0, 80)}...`);
+        logger.log(`Deleted orphaned rule: ${rule.substring(0, 80)}...`);
       } catch {
-        logger2.log(
+        logger.log(
           `Failed to delete rule (may already be gone): ${rule.substring(0, 80)}...`
         );
       }
     }
-    logger2.log("Orphaned proxy rules cleanup complete");
+    logger.log("Orphaned proxy rules cleanup complete");
   } catch (error) {
-    logger2.log(
+    logger.log(
       `Warning: Could not clean up orphaned rules: ${error instanceof Error ? error.message : "Unknown error"}`
     );
   }
 }
 
-// src/lib/firecracker/overlay-pool.ts
-import { exec as exec3 } from "child_process";
-import { randomUUID } from "crypto";
-import fs3 from "fs";
-import path2 from "path";
-import { promisify as promisify3 } from "util";
-var execAsync3 = promisify3(exec3);
-var logger3 = createLogger("OverlayPool");
-var OVERLAY_SIZE = 2 * 1024 * 1024 * 1024;
-async function defaultCreateFile(filePath) {
-  const fd = fs3.openSync(filePath, "w");
-  fs3.ftruncateSync(fd, OVERLAY_SIZE);
-  fs3.closeSync(fd);
-  await execAsync3(`mkfs.ext4 -F -q "${filePath}"`);
+// src/lib/firecracker/overlay-pool.ts
+import { exec as exec2 } from "child_process";
+import { randomUUID } from "crypto";
+import fs2 from "fs";
+import path2 from "path";
+import { promisify as promisify2 } from "util";
+var execAsync2 = promisify2(exec2);
+var logger2 = createLogger("OverlayPool");
+var OVERLAY_SIZE = 2 * 1024 * 1024 * 1024;
+async function defaultCreateFile(filePath) {
+  const fd = fs2.openSync(filePath, "w");
+  fs2.ftruncateSync(fd, OVERLAY_SIZE);
+  fs2.closeSync(fd);
+  await execAsync2(`mkfs.ext4 -F -q "${filePath}"`);
+}
+var OverlayPool = class {
+  initialized = false;
+  queue = [];
+  replenishing = false;
+  config;
+  constructor(config) {
+    this.config = {
+      size: config.size,
+      replenishThreshold: config.replenishThreshold,
+      poolDir: config.poolDir,
+      createFile: config.createFile ?? defaultCreateFile
+    };
+  }
+  /**
+   * Generate unique file name using UUID
+   */
+  generateFileName() {
+    return `overlay-${randomUUID()}.ext4`;
+  }
+  /**
+   * Ensure the pool directory exists
+   */
+  async ensurePoolDir() {
+    const parentDir = path2.dirname(this.config.poolDir);
+    if (!fs2.existsSync(parentDir)) {
+      await execAsync2(`sudo mkdir -p ${parentDir}`);
+      await execAsync2(`sudo chmod 777 ${parentDir}`);
+    }
+    if (!fs2.existsSync(this.config.poolDir)) {
+      fs2.mkdirSync(this.config.poolDir, { recursive: true });
+    }
+  }
+  /**
+   * Scan pool directory for overlay files
+   */
+  scanPoolDir() {
+    if (!fs2.existsSync(this.config.poolDir)) {
+      return [];
+    }
+    return fs2.readdirSync(this.config.poolDir).filter((f) => f.startsWith("overlay-") && f.endsWith(".ext4")).map((f) => path2.join(this.config.poolDir, f));
+  }
+  /**
+   * Replenish the pool in background
+   */
+  async replenish() {
+    if (this.replenishing || !this.initialized) {
+      return;
+    }
+    const needed = this.config.size - this.queue.length;
+    if (needed <= 0) {
+      return;
+    }
+    this.replenishing = true;
+    logger2.log(`Replenishing pool: creating ${needed} overlay(s)...`);
+    try {
+      const promises = [];
+      for (let i = 0; i < needed; i++) {
+        const filePath = path2.join(
+          this.config.poolDir,
+          this.generateFileName()
+        );
+        promises.push(
+          this.config.createFile(filePath).then(() => {
+            this.queue.push(filePath);
+          })
+        );
+      }
+      await Promise.all(promises);
+      logger2.log(`Pool replenished: ${this.queue.length} available`);
+    } catch (err) {
+      logger2.error(
+        `Replenish failed: ${err instanceof Error ? err.message : "Unknown"}`
+      );
+    } finally {
+      this.replenishing = false;
+    }
+  }
+  /**
+   * Initialize the overlay pool
+   */
+  async init() {
+    this.queue = [];
+    logger2.log(
+      `Initializing overlay pool (size=${this.config.size}, threshold=${this.config.replenishThreshold})...`
+    );
+    await this.ensurePoolDir();
+    const existing = this.scanPoolDir();
+    if (existing.length > 0) {
+      logger2.log(`Cleaning up ${existing.length} stale overlay(s)`);
+      for (const file of existing) {
+        fs2.unlinkSync(file);
+      }
+    }
+    this.initialized = true;
+    await this.replenish();
+    logger2.log("Overlay pool initialized");
+  }
+  /**
+   * Acquire an overlay file from the pool
+   *
+   * Returns the file path. Caller owns the file and must delete it when done.
+   * Falls back to on-demand creation if pool is exhausted.
+   */
+  async acquire() {
+    if (!this.initialized) {
+      throw new Error("Overlay pool not initialized");
+    }
+    const filePath = this.queue.shift();
+    if (filePath) {
+      logger2.log(`Acquired overlay from pool (${this.queue.length} remaining)`);
+      if (this.queue.length < this.config.replenishThreshold) {
+        this.replenish().catch((err) => {
+          logger2.error(
+            `Background replenish failed: ${err instanceof Error ? err.message : "Unknown"}`
+          );
+        });
+      }
+      return filePath;
+    }
+    logger2.log("Pool exhausted, creating overlay on-demand");
+    const newPath = path2.join(this.config.poolDir, this.generateFileName());
+    await this.config.createFile(newPath);
+    return newPath;
+  }
+  /**
+   * Clean up the overlay pool
+   */
+  cleanup() {
+    if (!this.initialized) {
+      return;
+    }
+    logger2.log("Cleaning up overlay pool...");
+    for (const file of this.queue) {
+      try {
+        fs2.unlinkSync(file);
+      } catch (err) {
+        logger2.log(
+          `Failed to delete ${file}: ${err instanceof Error ? err.message : "Unknown"}`
+        );
+      }
+    }
+    this.queue = [];
+    for (const file of this.scanPoolDir()) {
+      try {
+        fs2.unlinkSync(file);
+      } catch (err) {
+        logger2.log(
+          `Failed to delete ${file}: ${err instanceof Error ? err.message : "Unknown"}`
+        );
+      }
+    }
+    this.initialized = false;
+    this.replenishing = false;
+    logger2.log("Overlay pool cleaned up");
+  }
+};
+var overlayPool = null;
+async function initOverlayPool(config) {
+  if (overlayPool) {
+    overlayPool.cleanup();
+  }
+  overlayPool = new OverlayPool(config);
+  await overlayPool.init();
+  return overlayPool;
+}
+function acquireOverlay() {
+  if (!overlayPool) {
+    throw new Error(
+      "Overlay pool not initialized. Call initOverlayPool() first."
+    );
+  }
+  return overlayPool.acquire();
+}
+function cleanupOverlayPool() {
+  if (overlayPool) {
+    overlayPool.cleanup();
+    overlayPool = null;
+  }
+}
+
+// src/lib/firecracker/tap-pool.ts
+import { createHash } from "crypto";
+import { exec as exec4 } from "child_process";
+import { promisify as promisify4 } from "util";
+
+// src/lib/firecracker/ip-registry.ts
+import { exec as exec3 } from "child_process";
+import { promisify as promisify3 } from "util";
+import * as fs3 from "fs";
+import path3 from "path";
+var execAsync3 = promisify3(exec3);
+var logger3 = createLogger("IPRegistry");
+var IP_PREFIX = "172.16.0.";
+var IP_START = 2;
+var IP_END = 254;
+var LOCK_TIMEOUT_MS = 1e4;
+var LOCK_RETRY_INTERVAL_MS = 100;
+async function defaultEnsureRunDir(runDir) {
+  if (!fs3.existsSync(runDir)) {
+    await execAsync3(`sudo mkdir -p ${runDir}`);
+    await execAsync3(`sudo chmod 777 ${runDir}`);
+  }
+}
+async function defaultScanTapDevices() {
+  const tapDevices = /* @__PURE__ */ new Set();
+  try {
+    const { stdout } = await execAsync3(
+      `ip -o link show type tuntap 2>/dev/null || true`
+    );
+    const lines = stdout.split("\n");
+    for (const line of lines) {
+      const match = line.match(/^\d+:\s+([a-z0-9]+):/);
+      if (match && match[1]) {
+        tapDevices.add(match[1]);
+      }
+    }
+  } catch {
+  }
+  return tapDevices;
+}
+async function defaultCheckTapExists(tapDevice) {
+  try {
+    await execAsync3(`ip link show ${tapDevice} 2>/dev/null`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isProcessRunning(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+var IPRegistry = class {
+  config;
+  constructor(config = {}) {
+    const runDir = config.runDir ?? VM0_RUN_DIR;
+    this.config = {
+      runDir,
+      lockPath: config.lockPath ?? path3.join(runDir, "ip-pool.lock.active"),
+      registryPath: config.registryPath ?? path3.join(runDir, "ip-registry.json"),
+      ensureRunDir: config.ensureRunDir ?? (() => defaultEnsureRunDir(runDir)),
+      scanTapDevices: config.scanTapDevices ?? defaultScanTapDevices,
+      checkTapExists: config.checkTapExists ?? defaultCheckTapExists
+    };
+  }
+  // ============ File Lock ============
+  /**
+   * Execute a function while holding an exclusive lock on the IP pool
+   */
+  async withIPLock(fn) {
+    await this.config.ensureRunDir();
+    const startTime = Date.now();
+    let lockAcquired = false;
+    while (Date.now() - startTime < LOCK_TIMEOUT_MS) {
+      try {
+        fs3.writeFileSync(this.config.lockPath, process.pid.toString(), {
+          flag: "wx"
+        });
+        lockAcquired = true;
+        break;
+      } catch {
+        try {
+          const pidStr = fs3.readFileSync(this.config.lockPath, "utf-8");
+          const pid = parseInt(pidStr, 10);
+          if (!isProcessRunning(pid)) {
+            fs3.unlinkSync(this.config.lockPath);
+            continue;
+          }
+        } catch {
+        }
+        await new Promise(
+          (resolve) => setTimeout(resolve, LOCK_RETRY_INTERVAL_MS)
+        );
+      }
+    }
+    if (!lockAcquired) {
+      throw new Error(
+        `Failed to acquire IP pool lock after ${LOCK_TIMEOUT_MS}ms`
+      );
+    }
+    try {
+      return await fn();
+    } finally {
+      try {
+        fs3.unlinkSync(this.config.lockPath);
+      } catch {
+      }
+    }
+  }
+  // ============ Registry CRUD ============
+  /**
+   * Read the IP registry from file
+   */
+  readRegistry() {
+    try {
+      if (fs3.existsSync(this.config.registryPath)) {
+        const content = fs3.readFileSync(this.config.registryPath, "utf-8");
+        return JSON.parse(content);
+      }
+    } catch {
+    }
+    return { allocations: {} };
+  }
+  /**
+   * Write the IP registry to file
+   */
+  writeRegistry(registry) {
+    fs3.writeFileSync(
+      this.config.registryPath,
+      JSON.stringify(registry, null, 2)
+    );
+  }
+  /**
+   * Find the first available IP in the range
+   */
+  findFreeIP(registry) {
+    const allocatedIPs = new Set(Object.keys(registry.allocations));
+    for (let octet = IP_START; octet <= IP_END; octet++) {
+      const ip = `${IP_PREFIX}${octet}`;
+      if (!allocatedIPs.has(ip)) {
+        return ip;
+      }
+    }
+    return null;
+  }
+  // ============ IP Allocation ============
+  /**
+   * Allocate an IP address for a TAP device
+   */
+  async allocateIP(tapDevice) {
+    return this.withIPLock(async () => {
+      const registry = this.readRegistry();
+      const ip = this.findFreeIP(registry);
+      if (!ip) {
+        throw new Error(
+          "No free IP addresses available in pool (172.16.0.2-254)"
+        );
+      }
+      registry.allocations[ip] = {
+        runnerPid: process.pid,
+        tapDevice,
+        vmId: null
+      };
+      this.writeRegistry(registry);
+      logger3.log(`Allocated IP ${ip} for TAP ${tapDevice}`);
+      return ip;
+    });
+  }
+  /**
+   * Release an IP address back to the pool
+   */
+  async releaseIP(ip) {
+    return this.withIPLock(async () => {
+      const registry = this.readRegistry();
+      if (registry.allocations[ip]) {
+        const allocation = registry.allocations[ip];
+        delete registry.allocations[ip];
+        this.writeRegistry(registry);
+        logger3.log(
+          `Released IP ${ip} (was allocated to TAP ${allocation.tapDevice})`
+        );
+      }
+    });
+  }
+  // ============ Cleanup ============
+  /**
+   * Clean up orphaned IP allocations
+   *
+   * An allocation is orphaned if:
+   * 1. TAP device no longer exists on the system, OR
+   * 2. Runner process that created it is no longer running
+   *
+   * @returns List of orphaned TAP devices that should be deleted by caller
+   */
+  async cleanupOrphanedIPs() {
+    const activeTaps = await this.config.scanTapDevices();
+    logger3.log(`Found ${activeTaps.size} TAP device(s) on system`);
+    return this.withIPLock(async () => {
+      const registry = this.readRegistry();
+      const beforeCount = Object.keys(registry.allocations).length;
+      if (beforeCount === 0) {
+        return [];
+      }
+      const cleanedRegistry = { allocations: {} };
+      const orphanedTaps = [];
+      for (const [ip, allocation] of Object.entries(registry.allocations)) {
+        const tapInScan = activeTaps.has(allocation.tapDevice);
+        const runnerAlive = isProcessRunning(allocation.runnerPid);
+        if (!runnerAlive) {
+          logger3.log(
+            `Removing orphaned IP ${ip} (runner PID ${allocation.runnerPid} not running)`
+          );
+          if (tapInScan) {
+            orphanedTaps.push(allocation.tapDevice);
+          }
+          continue;
+        }
+        if (tapInScan) {
+          cleanedRegistry.allocations[ip] = allocation;
+        } else {
+          const exists = await this.config.checkTapExists(allocation.tapDevice);
+          if (exists) {
+            cleanedRegistry.allocations[ip] = allocation;
+          } else {
+            logger3.log(
+              `Removing orphaned IP ${ip} (TAP ${allocation.tapDevice} not found)`
+            );
+          }
+        }
+      }
+      const afterCount = Object.keys(cleanedRegistry.allocations).length;
+      if (afterCount !== beforeCount) {
+        this.writeRegistry(cleanedRegistry);
+        logger3.log(`Cleaned up ${beforeCount - afterCount} orphaned IP(s)`);
+      }
+      return orphanedTaps;
+    });
+  }
+  // ============ VM ID Tracking ============
+  /**
+   * Assign a vmId to an IP allocation (called when VM acquires the pair)
+   */
+  async assignVmIdToIP(ip, vmId) {
+    return this.withIPLock(async () => {
+      const registry = this.readRegistry();
+      if (registry.allocations[ip]) {
+        registry.allocations[ip].vmId = vmId;
+        this.writeRegistry(registry);
+      }
+    });
+  }
+  /**
+   * Clear vmId from an IP allocation (called when pair is returned to pool)
+   * Only clears if the current vmId matches expectedVmId to prevent race conditions
+   * where a new VM's vmId could be cleared by the previous VM's release.
+   */
+  async clearVmIdFromIP(ip, expectedVmId) {
+    return this.withIPLock(async () => {
+      const registry = this.readRegistry();
+      if (registry.allocations[ip] && registry.allocations[ip].vmId === expectedVmId) {
+        registry.allocations[ip].vmId = null;
+        this.writeRegistry(registry);
+      }
+    });
+  }
+  // ============ Diagnostic Functions ============
+  /**
+   * Get all current IP allocations (for diagnostic purposes)
+   * Used by the doctor command to display allocated IPs.
+   */
+  getAllocations() {
+    const registry = this.readRegistry();
+    return new Map(Object.entries(registry.allocations));
+  }
+  /**
+   * Get IP allocation for a specific VM ID (for diagnostic purposes)
+   */
+  getIPForVm(vmId) {
+    const registry = this.readRegistry();
+    for (const [ip, allocation] of Object.entries(registry.allocations)) {
+      if (allocation.vmId === vmId) {
+        return ip;
+      }
+    }
+    return void 0;
+  }
+};
+var globalRegistry = null;
+function getRegistry() {
+  if (!globalRegistry) {
+    globalRegistry = new IPRegistry();
+  }
+  return globalRegistry;
+}
+async function allocateIP(tapDevice) {
+  return getRegistry().allocateIP(tapDevice);
+}
+async function releaseIP(ip) {
+  return getRegistry().releaseIP(ip);
+}
+async function cleanupOrphanedIPs() {
+  return getRegistry().cleanupOrphanedIPs();
+}
+async function assignVmIdToIP(ip, vmId) {
+  return getRegistry().assignVmIdToIP(ip, vmId);
+}
+async function clearVmIdFromIP(ip, expectedVmId) {
+  return getRegistry().clearVmIdFromIP(ip, expectedVmId);
+}
+function getAllocations() {
+  return getRegistry().getAllocations();
+}
+function getIPForVm(vmId) {
+  return getRegistry().getIPForVm(vmId);
+}
+
+// src/lib/firecracker/tap-pool.ts
+var execAsync4 = promisify4(exec4);
+var logger4 = createLogger("TapPool");
+function generateTapPrefix(name) {
+  const hash = createHash("md5").update(name).digest("hex").substring(0, 8);
+  return `vm0${hash}`;
 }
-var OverlayPool = class {
+async function execCommand2(cmd) {
+  const fullCmd = `sudo ${cmd}`;
+  const { stdout } = await execAsync4(fullCmd);
+  return stdout.trim();
+}
+async function defaultCreateTap(name) {
+  await execCommand2(`ip tuntap add ${name} mode tap`);
+  await execCommand2(`ip link set ${name} master ${BRIDGE_NAME}`);
+  await execCommand2(`ip link set ${name} up`);
+}
+async function defaultDeleteTap(name) {
+  await execCommand2(`ip link delete ${name}`);
+}
+async function defaultSetMac(tap, mac) {
+  await execCommand2(`ip link set dev ${tap} address ${mac}`);
+}
+async function clearArpEntry(ip) {
+  try {
+    await execCommand2(`ip neigh del ${ip} dev ${BRIDGE_NAME}`);
+  } catch {
+  }
+}
+var TapPool = class {
   initialized = false;
   queue = [];
   replenishing = false;
+  nextIndex = 0;
+  prefix;
   config;
   constructor(config) {
+    this.prefix = generateTapPrefix(config.name);
     this.config = {
+      name: config.name,
       size: config.size,
       replenishThreshold: config.replenishThreshold,
-      poolDir: config.poolDir,
-      createFile: config.createFile ?? defaultCreateFile
+      createTap: config.createTap ?? defaultCreateTap,
+      deleteTap: config.deleteTap ?? defaultDeleteTap,
+      setMac: config.setMac ?? defaultSetMac
     };
   }
   /**
-   * Generate unique file name using UUID
+   * Generate TAP device name
+   * Format: {prefix}{index} (e.g., vm01a2b3c4d000)
    */
-  generateFileName() {
-    return `overlay-${randomUUID()}.ext4`;
+  generateTapName(index) {
+    return `${this.prefix}${index.toString().padStart(3, "0")}`;
   }
   /**
-   * Ensure the pool directory exists
+   * Check if a TAP name belongs to this pool instance
    */
-  async ensurePoolDir() {
-    const parentDir = path2.dirname(this.config.poolDir);
-    if (!fs3.existsSync(parentDir)) {
-      await execAsync3(`sudo mkdir -p ${parentDir}`);
-      await execAsync3(`sudo chmod 777 ${parentDir}`);
-    }
-    if (!fs3.existsSync(this.config.poolDir)) {
-      fs3.mkdirSync(this.config.poolDir, { recursive: true });
-    }
+  isOwnTap(name) {
+    return name.startsWith(this.prefix);
   }
   /**
-   * Scan pool directory for overlay files
+   * Create a {TAP, IP} pair
    */
-  scanPoolDir() {
-    if (!fs3.existsSync(this.config.poolDir)) {
-      return [];
+  async createPair() {
+    const tapDevice = this.generateTapName(this.nextIndex++);
+    await this.config.createTap(tapDevice);
+    let guestIp;
+    try {
+      guestIp = await allocateIP(tapDevice);
+    } catch (err) {
+      await this.config.deleteTap(tapDevice).catch(() => {
+      });
+      throw err;
     }
-    return fs3.readdirSync(this.config.poolDir).filter((f) => f.startsWith("overlay-") && f.endsWith(".ext4")).map((f) => path2.join(this.config.poolDir, f));
+    return { tapDevice, guestIp };
   }
   /**
    * Replenish the pool in background
@@ -1160,135 +1405,267 @@ var OverlayPool = class {
       return;
     }
     this.replenishing = true;
-    logger3.log(`Replenishing pool: creating ${needed} overlay(s)...`);
+    logger4.log(`Replenishing pool: creating up to ${needed} pair(s)...`);
     try {
-      const promises = [];
       for (let i = 0; i < needed; i++) {
-        const filePath = path2.join(
-          this.config.poolDir,
-          this.generateFileName()
-        );
-        promises.push(
-          this.config.createFile(filePath).then(() => {
-            this.queue.push(filePath);
-          })
-        );
+        if (!this.initialized) {
+          logger4.log("Pool shutdown detected, stopping replenish");
+          break;
+        }
+        if (this.queue.length >= this.config.size) {
+          break;
+        }
+        try {
+          const pair = await this.createPair();
+          if (!this.initialized) {
+            await releaseIP(pair.guestIp).catch(() => {
+            });
+            await this.config.deleteTap(pair.tapDevice).catch(() => {
+            });
+            logger4.log("Pool shutdown detected, cleaned up in-flight pair");
+            break;
+          }
+          this.queue.push(pair);
+        } catch (err) {
+          logger4.error(
+            `Failed to create pair: ${err instanceof Error ? err.message : "Unknown"}`
+          );
+        }
       }
-      await Promise.all(promises);
-      logger3.log(`Pool replenished: ${this.queue.length} available`);
-    } catch (err) {
-      logger3.error(
-        `Replenish failed: ${err instanceof Error ? err.message : "Unknown"}`
-      );
+      logger4.log(`Pool replenished: ${this.queue.length} available`);
     } finally {
       this.replenishing = false;
     }
   }
   /**
-   * Initialize the overlay pool
+   * Scan for orphaned TAP devices from previous runs (matching this pool's prefix)
+   */
+  async scanOrphanedTaps() {
+    try {
+      const { stdout } = await execAsync4(
+        `ip -o link show type tuntap 2>/dev/null || true`
+      );
+      const orphaned = [];
+      const lines = stdout.split("\n");
+      for (const line of lines) {
+        const match = line.match(/^\d+:\s+([a-z0-9]+):/);
+        if (match && match[1] && this.isOwnTap(match[1])) {
+          orphaned.push(match[1]);
+        }
+      }
+      return orphaned;
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * Initialize the TAP pool
    */
   async init() {
     this.queue = [];
-    logger3.log(
-      `Initializing overlay pool (size=${this.config.size}, threshold=${this.config.replenishThreshold})...`
+    this.nextIndex = 0;
+    logger4.log(
+      `Initializing TAP pool (size=${this.config.size}, threshold=${this.config.replenishThreshold})...`
     );
-    await this.ensurePoolDir();
-    const existing = this.scanPoolDir();
-    if (existing.length > 0) {
-      logger3.log(`Cleaning up ${existing.length} stale overlay(s)`);
-      for (const file of existing) {
-        fs3.unlinkSync(file);
+    const orphanedTaps = await this.scanOrphanedTaps();
+    if (orphanedTaps.length > 0) {
+      logger4.log(`Cleaning up ${orphanedTaps.length} orphaned TAP(s)`);
+      for (const tap of orphanedTaps) {
+        try {
+          await execCommand2(`ip link delete ${tap}`);
+        } catch {
+        }
+      }
+    }
+    const orphanedTapsFromRegistry = await cleanupOrphanedIPs();
+    for (const tap of orphanedTapsFromRegistry) {
+      try {
+        await execCommand2(`ip link delete ${tap}`);
+        logger4.log(`Deleted orphaned TAP ${tap} (runner dead)`);
+      } catch {
       }
     }
     this.initialized = true;
     await this.replenish();
-    logger3.log("Overlay pool initialized");
+    logger4.log("TAP pool initialized");
   }
   /**
-   * Acquire an overlay file from the pool
+   * Acquire a {TAP, IP} pair from the pool
    *
-   * Returns the file path. Caller owns the file and must delete it when done.
+   * Returns VMNetworkConfig with TAP device, IP, and MAC.
    * Falls back to on-demand creation if pool is exhausted.
    */
-  async acquire() {
-    if (!this.initialized) {
-      throw new Error("Overlay pool not initialized");
-    }
-    const filePath = this.queue.shift();
-    if (filePath) {
-      logger3.log(`Acquired overlay from pool (${this.queue.length} remaining)`);
+  async acquire(vmId) {
+    let resource;
+    let fromPool;
+    const pooled = this.queue.shift();
+    if (pooled) {
+      resource = pooled;
+      fromPool = true;
+      logger4.log(`Acquired pair from pool (${this.queue.length} remaining)`);
       if (this.queue.length < this.config.replenishThreshold) {
         this.replenish().catch((err) => {
-          logger3.error(
+          logger4.error(
+            `Background replenish failed: ${err instanceof Error ? err.message : "Unknown"}`
+          );
+        });
+      }
+    } else {
+      logger4.log("Pool exhausted, creating pair on-demand");
+      resource = await this.createPair();
+      fromPool = false;
+      if (this.config.replenishThreshold > 0) {
+        this.replenish().catch((err) => {
+          logger4.error(
             `Background replenish failed: ${err instanceof Error ? err.message : "Unknown"}`
           );
         });
       }
-      return filePath;
     }
-    logger3.log("Pool exhausted, creating overlay on-demand");
-    const newPath = path2.join(this.config.poolDir, this.generateFileName());
-    await this.config.createFile(newPath);
-    return newPath;
+    const guestMac = generateMacAddress(vmId);
+    try {
+      await this.config.setMac(resource.tapDevice, guestMac);
+    } catch (err) {
+      if (fromPool) {
+        this.queue.push(resource);
+        logger4.log(
+          `Returned pair to pool after MAC set failure: ${resource.tapDevice}`
+        );
+      } else {
+        await releaseIP(resource.guestIp).catch(() => {
+        });
+        await this.config.deleteTap(resource.tapDevice).catch(() => {
+        });
+      }
+      throw err;
+    }
+    await clearArpEntry(resource.guestIp);
+    try {
+      await assignVmIdToIP(resource.guestIp, vmId);
+    } catch (err) {
+      logger4.error(
+        `Failed to assign vmId to IP registry: ${err instanceof Error ? err.message : "Unknown"}`
+      );
+    }
+    logger4.log(
+      `Acquired: TAP ${resource.tapDevice}, MAC ${guestMac}, IP ${resource.guestIp}`
+    );
+    return {
+      tapDevice: resource.tapDevice,
+      guestMac,
+      guestIp: resource.guestIp,
+      gatewayIp: BRIDGE_IP,
+      netmask: BRIDGE_NETMASK
+    };
   }
   /**
-   * Clean up the overlay pool
+   * Release a {TAP, IP} pair back to the pool
+   * @param vmId The VM ID that is releasing this pair (for registry cleanup)
    */
-  cleanup() {
+  async release(tapDevice, guestIp, vmId) {
+    await clearArpEntry(guestIp);
     if (!this.initialized) {
+      await releaseIP(guestIp).catch(() => {
+      });
+      try {
+        await this.config.deleteTap(tapDevice);
+        logger4.log(`Pair deleted (pool shutdown): ${tapDevice}, ${guestIp}`);
+      } catch (err) {
+        logger4.log(
+          `Failed to delete TAP ${tapDevice}: ${err instanceof Error ? err.message : "Unknown"}`
+        );
+      }
       return;
     }
-    logger3.log("Cleaning up overlay pool...");
-    for (const file of this.queue) {
+    if (this.isOwnTap(tapDevice)) {
+      const alreadyInQueue = this.queue.some((r) => r.tapDevice === tapDevice);
+      if (alreadyInQueue) {
+        logger4.log(
+          `Pair ${tapDevice} already in pool, ignoring duplicate release`
+        );
+        return;
+      }
+      this.queue.push({ tapDevice, guestIp });
+      logger4.log(
+        `Pair released: ${tapDevice}, ${guestIp} (${this.queue.length} available)`
+      );
       try {
-        fs3.unlinkSync(file);
+        await clearVmIdFromIP(guestIp, vmId);
       } catch (err) {
-        logger3.log(
-          `Failed to delete ${file}: ${err instanceof Error ? err.message : "Unknown"}`
+        logger4.error(
+          `Failed to clear vmId from IP registry: ${err instanceof Error ? err.message : "Unknown"}`
         );
       }
-    }
-    this.queue = [];
-    for (const file of this.scanPoolDir()) {
+    } else {
+      await releaseIP(guestIp).catch(() => {
+      });
       try {
-        fs3.unlinkSync(file);
+        await this.config.deleteTap(tapDevice);
+        logger4.log(`Non-pooled pair deleted: ${tapDevice}, ${guestIp}`);
       } catch (err) {
-        logger3.log(
-          `Failed to delete ${file}: ${err instanceof Error ? err.message : "Unknown"}`
+        logger4.log(
+          `Failed to delete non-pooled TAP ${tapDevice}: ${err instanceof Error ? err.message : "Unknown"}`
         );
       }
     }
+  }
+  /**
+   * Clean up the TAP pool
+   *
+   * Note: This is a sync function for compatibility with process cleanup.
+   * Resources are cleaned up asynchronously (fire-and-forget).
+   * Any remaining resources will be cleaned up by init() on next startup.
+   */
+  cleanup() {
+    if (!this.initialized) {
+      return;
+    }
+    logger4.log(`Cleaning up TAP pool (${this.queue.length} pairs)...`);
+    for (const { tapDevice, guestIp } of this.queue) {
+      releaseIP(guestIp).catch(() => {
+      });
+      this.config.deleteTap(tapDevice).catch((err) => {
+        logger4.log(
+          `Failed to delete ${tapDevice}: ${err instanceof Error ? err.message : "Unknown"}`
+        );
+      });
+    }
+    this.queue = [];
     this.initialized = false;
     this.replenishing = false;
-    logger3.log("Overlay pool cleaned up");
+    logger4.log("TAP pool cleanup initiated");
   }
 };
-var overlayPool = null;
-async function initOverlayPool(config) {
-  if (overlayPool) {
-    overlayPool.cleanup();
+var tapPool = null;
+async function initTapPool(config) {
+  if (tapPool) {
+    tapPool.cleanup();
+  }
+  tapPool = new TapPool(config);
+  await tapPool.init();
+  return tapPool;
+}
+async function acquireTap(vmId) {
+  if (!tapPool) {
+    throw new Error("TAP pool not initialized. Call initTapPool() first.");
   }
-  overlayPool = new OverlayPool(config);
-  await overlayPool.init();
-  return overlayPool;
+  return tapPool.acquire(vmId);
 }
-function acquireOverlay() {
-  if (!overlayPool) {
-    throw new Error(
-      "Overlay pool not initialized. Call initOverlayPool() first."
-    );
+async function releaseTap(tapDevice, guestIp, vmId) {
+  if (!tapPool) {
+    throw new Error("TAP pool not initialized. Call initTapPool() first.");
   }
-  return overlayPool.acquire();
+  return tapPool.release(tapDevice, guestIp, vmId);
 }
-function cleanupOverlayPool() {
-  if (overlayPool) {
-    overlayPool.cleanup();
-    overlayPool = null;
+function cleanupTapPool() {
+  if (tapPool) {
+    tapPool.cleanup();
+    tapPool = null;
   }
 }
 
 // src/lib/firecracker/vm.ts
-var logger4 = createLogger("VM");
+var logger5 = createLogger("VM");
 var FirecrackerVM = class {
   config;
   process = null;
@@ -1304,8 +1681,8 @@ var FirecrackerVM = class {
   constructor(config) {
     this.config = config;
     this.workDir = config.workDir || tempPaths.vmWorkDir(config.vmId);
-    this.socketPath = path3.join(this.workDir, "firecracker.sock");
-    this.vsockPath = path3.join(this.workDir, "vsock.sock");
+    this.socketPath = path4.join(this.workDir, "firecracker.sock");
+    this.vsockPath = path4.join(this.workDir, "vsock.sock");
   }
   /**
    * Get current VM state
@@ -1350,19 +1727,13 @@ var FirecrackerVM = class {
       if (fs4.existsSync(this.socketPath)) {
         fs4.unlinkSync(this.socketPath);
       }
-      logger4.log(`[VM ${this.config.vmId}] Setting up overlay and network...`);
-      const setupOverlay = async () => {
-        this.vmOverlayPath = await acquireOverlay();
-        logger4.log(
-          `[VM ${this.config.vmId}] Overlay acquired: ${this.vmOverlayPath}`
-        );
-      };
-      const [, networkConfig] = await Promise.all([
-        setupOverlay(),
-        createTapDevice(this.config.vmId)
-      ]);
-      this.networkConfig = networkConfig;
-      logger4.log(`[VM ${this.config.vmId}] Starting Firecracker...`);
+      logger5.log(`[VM ${this.config.vmId}] Acquiring overlay...`);
+      this.vmOverlayPath = await acquireOverlay();
+      logger5.log(`[VM ${this.config.vmId}] Overlay acquired`);
+      logger5.log(`[VM ${this.config.vmId}] Acquiring TAP+IP...`);
+      this.networkConfig = await acquireTap(this.config.vmId);
+      logger5.log(`[VM ${this.config.vmId}] TAP+IP acquired`);
+      logger5.log(`[VM ${this.config.vmId}] Starting Firecracker...`);
       this.process = spawn(
         this.config.firecrackerBinary,
         ["--api-sock", this.socketPath],
@@ -1373,11 +1744,11 @@ var FirecrackerVM = class {
         }
       );
       this.process.on("error", (err) => {
-        logger4.log(`[VM ${this.config.vmId}] Firecracker error: ${err}`);
+        logger5.log(`[VM ${this.config.vmId}] Firecracker error: ${err}`);
         this.state = "error";
       });
       this.process.on("exit", (code, signal) => {
-        logger4.log(
+        logger5.log(
           `[VM ${this.config.vmId}] Firecracker exited: code=${code}, signal=${signal}`
         );
         if (this.state !== "stopped") {
@@ -1390,7 +1761,7 @@ var FirecrackerVM = class {
         });
         stdoutRL.on("line", (line) => {
           if (line.trim()) {
-            logger4.log(`[VM ${this.config.vmId}] ${line}`);
+            logger5.log(`[VM ${this.config.vmId}] ${line}`);
           }
         });
       }
@@ -1400,19 +1771,19 @@ var FirecrackerVM = class {
         });
         stderrRL.on("line", (line) => {
           if (line.trim()) {
-            logger4.log(`[VM ${this.config.vmId}] stderr: ${line}`);
+            logger5.log(`[VM ${this.config.vmId}] stderr: ${line}`);
           }
         });
       }
       this.client = new FirecrackerClient(this.socketPath);
-      logger4.log(`[VM ${this.config.vmId}] Waiting for API...`);
+      logger5.log(`[VM ${this.config.vmId}] Waiting for API...`);
       await this.client.waitUntilReady(1e4, 100);
       this.state = "configuring";
       await this.configure();
-      logger4.log(`[VM ${this.config.vmId}] Booting...`);
+      logger5.log(`[VM ${this.config.vmId}] Booting...`);
       await this.client.start();
       this.state = "running";
-      logger4.log(
+      logger5.log(
         `[VM ${this.config.vmId}] Running at ${this.networkConfig.guestIp}`
       );
     } catch (error) {
@@ -1428,7 +1799,7 @@ var FirecrackerVM = class {
     if (!this.client || !this.networkConfig || !this.vmOverlayPath) {
       throw new Error("VM not properly initialized");
     }
-    logger4.log(
+    logger5.log(
       `[VM ${this.config.vmId}] Configuring: ${this.config.vcpus} vCPUs, ${this.config.memoryMb}MB RAM`
     );
     await this.client.setMachineConfig({
@@ -1437,12 +1808,12 @@ var FirecrackerVM = class {
     });
     const networkBootArgs = generateNetworkBootArgs(this.networkConfig);
     const bootArgs = `console=ttyS0 reboot=k panic=1 pci=off nomodules random.trust_cpu=on quiet loglevel=0 nokaslr audit=0 numa=off mitigations=off noresume init=/sbin/vm-init ${networkBootArgs}`;
-    logger4.log(`[VM ${this.config.vmId}] Boot args: ${bootArgs}`);
+    logger5.log(`[VM ${this.config.vmId}] Boot args: ${bootArgs}`);
     await this.client.setBootSource({
       kernel_image_path: this.config.kernelPath,
       boot_args: bootArgs
     });
-    logger4.log(
+    logger5.log(
       `[VM ${this.config.vmId}] Base rootfs: ${this.config.rootfsPath}`
     );
     await this.client.setDrive({
@@ -1451,14 +1822,14 @@ var FirecrackerVM = class {
       is_root_device: true,
       is_read_only: true
     });
-    logger4.log(`[VM ${this.config.vmId}] Overlay: ${this.vmOverlayPath}`);
+    logger5.log(`[VM ${this.config.vmId}] Overlay: ${this.vmOverlayPath}`);
     await this.client.setDrive({
       drive_id: "overlay",
       path_on_host: this.vmOverlayPath,
       is_root_device: false,
       is_read_only: false
     });
-    logger4.log(
+    logger5.log(
       `[VM ${this.config.vmId}] Network: ${this.networkConfig.tapDevice}`
     );
     await this.client.setNetworkInterface({
@@ -1466,7 +1837,7 @@ var FirecrackerVM = class {
       guest_mac: this.networkConfig.guestMac,
       host_dev_name: this.networkConfig.tapDevice
     });
-    logger4.log(`[VM ${this.config.vmId}] Vsock: ${this.vsockPath}`);
+    logger5.log(`[VM ${this.config.vmId}] Vsock: ${this.vsockPath}`);
     await this.client.setVsock({
       vsock_id: "vsock0",
       guest_cid: 3,
@@ -1478,15 +1849,15 @@ var FirecrackerVM = class {
    */
   async stop() {
     if (this.state !== "running") {
-      logger4.log(`[VM ${this.config.vmId}] Not running, state: ${this.state}`);
+      logger5.log(`[VM ${this.config.vmId}] Not running, state: ${this.state}`);
       return;
     }
     this.state = "stopping";
-    logger4.log(`[VM ${this.config.vmId}] Stopping...`);
+    logger5.log(`[VM ${this.config.vmId}] Stopping...`);
     try {
       if (this.client) {
         await this.client.sendCtrlAltDel().catch((error) => {
-          logger4.log(
+          logger5.log(
             `[VM ${this.config.vmId}] Graceful shutdown signal failed (VM may already be stopping): ${error instanceof Error ? error.message : error}`
           );
         });
@@ -1499,7 +1870,7 @@ var FirecrackerVM = class {
    * Force kill the VM
    */
   async kill() {
-    logger4.log(`[VM ${this.config.vmId}] Force killing...`);
+    logger5.log(`[VM ${this.config.vmId}] Force killing...`);
     await this.cleanup();
   }
   /**
@@ -1513,10 +1884,17 @@ var FirecrackerVM = class {
       this.process = null;
     }
     if (this.networkConfig) {
-      await deleteTapDevice(
-        this.networkConfig.tapDevice,
-        this.networkConfig.guestIp
-      );
+      try {
+        await releaseTap(
+          this.networkConfig.tapDevice,
+          this.networkConfig.guestIp,
+          this.config.vmId
+        );
+      } catch (err) {
+        logger5.log(
+          `[VM ${this.config.vmId}] Failed to release TAP: ${err instanceof Error ? err.message : "Unknown"}`
+        );
+      }
       this.networkConfig = null;
     }
     if (this.vmOverlayPath && fs4.existsSync(this.vmOverlayPath)) {
@@ -1528,7 +1906,7 @@ var FirecrackerVM = class {
     }
     this.client = null;
     this.state = "stopped";
-    logger4.log(`[VM ${this.config.vmId}] Stopped`);
+    logger5.log(`[VM ${this.config.vmId}] Stopped`);
   }
   /**
    * Wait for the VM process to exit
@@ -1591,8 +1969,8 @@ function encodeExecPayload(command, timeoutMs) {
   cmdBuf.copy(payload, 8);
   return payload;
 }
-function encodeWriteFilePayload(path8, content, sudo) {
-  const pathBuf = Buffer.from(path8, "utf-8");
+function encodeWriteFilePayload(path9, content, sudo) {
+  const pathBuf = Buffer.from(path9, "utf-8");
   if (pathBuf.length > 65535) {
     throw new Error(`Path too long: ${pathBuf.length} bytes (max 65535)`);
   }
@@ -2449,8 +2827,8 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 var makeIssue = (params) => {
-  const { data, path: path8, errorMaps, issueData } = params;
-  const fullPath = [...path8, ...issueData.path || []];
+  const { data, path: path9, errorMaps, issueData } = params;
+  const fullPath = [...path9, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -2549,11 +2927,11 @@ var errorUtil;
   errorUtil2.toString = (message) => typeof message === "string" ? message : message === null || message === void 0 ? void 0 : message.message;
 })(errorUtil || (errorUtil = {}));
 var ParseInputLazyPath = class {
-  constructor(parent, value, path8, key) {
+  constructor(parent, value, path9, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path8;
+    this._path = path9;
     this._key = key;
   }
   get path() {
@@ -8729,7 +9107,7 @@ var ENV_LOADER_PATH = "/usr/local/bin/vm0-agent/env-loader.mjs";
 
 // src/lib/proxy/vm-registry.ts
 import fs6 from "fs";
-var logger5 = createLogger("VMRegistry");
+var logger6 = createLogger("VMRegistry");
 var DEFAULT_REGISTRY_PATH = tempPaths.vmRegistry;
 var VMRegistry = class {
   registryPath;
@@ -8776,7 +9154,7 @@ var VMRegistry = class {
     this.save();
     const firewallInfo = options?.firewallRules ? ` with ${options.firewallRules.length} firewall rules` : "";
     const mitmInfo = options?.mitmEnabled ? ", MITM enabled" : "";
-    logger5.log(
+    logger6.log(
       `Registered VM ${vmIp} for run ${runId}${firewallInfo}${mitmInfo}`
     );
   }
@@ -8788,7 +9166,7 @@ var VMRegistry = class {
       const registration = this.data.vms[vmIp];
       delete this.data.vms[vmIp];
       this.save();
-      logger5.log(`Unregistered VM ${vmIp} (run ${registration.runId})`);
+      logger6.log(`Unregistered VM ${vmIp} (run ${registration.runId})`);
     }
   }
   /**
@@ -8809,7 +9187,7 @@ var VMRegistry = class {
   clear() {
     this.data.vms = {};
     this.save();
-    logger5.log("Cleared all registrations");
+    logger6.log("Cleared all registrations");
   }
   /**
    * Get the path to the registry file
@@ -8818,22 +9196,22 @@ var VMRegistry = class {
     return this.registryPath;
   }
 };
-var globalRegistry = null;
+var globalRegistry2 = null;
 function getVMRegistry() {
-  if (!globalRegistry) {
-    globalRegistry = new VMRegistry();
+  if (!globalRegistry2) {
+    globalRegistry2 = new VMRegistry();
   }
-  return globalRegistry;
+  return globalRegistry2;
 }
 function initVMRegistry(registryPath) {
-  globalRegistry = new VMRegistry(registryPath);
-  return globalRegistry;
+  globalRegistry2 = new VMRegistry(registryPath);
+  return globalRegistry2;
 }
 
 // src/lib/proxy/proxy-manager.ts
 import { spawn as spawn2 } from "child_process";
 import fs7 from "fs";
-import path4 from "path";
+import path5 from "path";
 
 // src/lib/proxy/mitm-addon-script.ts
 var RUNNER_MITM_ADDON_SCRIPT = `#!/usr/bin/env python3
@@ -9319,7 +9697,7 @@ addons = [tls_clienthello, request, response]
 `;
 
 // src/lib/proxy/proxy-manager.ts
-var logger6 = createLogger("ProxyManager");
+var logger7 = createLogger("ProxyManager");
 var DEFAULT_PROXY_OPTIONS = {
   port: 8080,
   registryPath: DEFAULT_REGISTRY_PATH
@@ -9329,7 +9707,7 @@ var ProxyManager = class {
   process = null;
   isRunning = false;
   constructor(config) {
-    const addonPath = path4.join(config.caDir, "mitm_addon.py");
+    const addonPath = path5.join(config.caDir, "mitm_addon.py");
     this.config = {
       ...DEFAULT_PROXY_OPTIONS,
       ...config,
@@ -9356,14 +9734,14 @@ var ProxyManager = class {
    * Ensure the addon script exists at the configured path
    */
   ensureAddonScript() {
-    const addonDir = path4.dirname(this.config.addonPath);
+    const addonDir = path5.dirname(this.config.addonPath);
     if (!fs7.existsSync(addonDir)) {
       fs7.mkdirSync(addonDir, { recursive: true });
     }
     fs7.writeFileSync(this.config.addonPath, RUNNER_MITM_ADDON_SCRIPT, {
       mode: 493
     });
-    logger6.log(`Addon script written to ${this.config.addonPath}`);
+    logger7.log(`Addon script written to ${this.config.addonPath}`);
   }
   /**
    * Validate proxy configuration
@@ -9372,7 +9750,7 @@ var ProxyManager = class {
     if (!fs7.existsSync(this.config.caDir)) {
       throw new Error(`Proxy CA directory not found: ${this.config.caDir}`);
     }
-    const caCertPath = path4.join(this.config.caDir, "mitmproxy-ca.pem");
+    const caCertPath = path5.join(this.config.caDir, "mitmproxy-ca.pem");
     if (!fs7.existsSync(caCertPath)) {
       throw new Error(`Proxy CA certificate not found: ${caCertPath}`);
     }
@@ -9383,7 +9761,7 @@ var ProxyManager = class {
    */
   async start() {
     if (this.isRunning) {
-      logger6.log("Proxy already running");
+      logger7.log("Proxy already running");
       return;
     }
     const mitmproxyInstalled = await this.checkMitmproxyInstalled();
@@ -9394,11 +9772,11 @@ var ProxyManager = class {
     }
     this.validateConfig();
     getVMRegistry();
-    logger6.log("Starting mitmproxy...");
-    logger6.log(`  Port: ${this.config.port}`);
-    logger6.log(`  CA Dir: ${this.config.caDir}`);
-    logger6.log(`  Addon: ${this.config.addonPath}`);
-    logger6.log(`  Registry: ${this.config.registryPath}`);
+    logger7.log("Starting mitmproxy...");
+    logger7.log(`  Port: ${this.config.port}`);
+    logger7.log(`  CA Dir: ${this.config.caDir}`);
+    logger7.log(`  Addon: ${this.config.addonPath}`);
+    logger7.log(`  Registry: ${this.config.registryPath}`);
     const args = [
       "--mode",
       "transparent",
@@ -9428,18 +9806,18 @@ var ProxyManager = class {
       mitmLogger.log(data.toString().trim());
     });
     this.process.on("close", (code) => {
-      logger6.log(`mitmproxy exited with code ${code}`);
+      logger7.log(`mitmproxy exited with code ${code}`);
       this.isRunning = false;
       this.process = null;
     });
     this.process.on("error", (err) => {
-      logger6.error(`mitmproxy error: ${err.message}`);
+      logger7.error(`mitmproxy error: ${err.message}`);
       this.isRunning = false;
       this.process = null;
     });
     await this.waitForReady();
     this.isRunning = true;
-    logger6.log("mitmproxy started successfully");
+    logger7.log("mitmproxy started successfully");
     process.on("exit", () => {
       if (this.process && !this.process.killed) {
         this.process.kill("SIGKILL");
@@ -9470,24 +9848,24 @@ var ProxyManager = class {
    */
   async stop() {
     if (!this.process || !this.isRunning) {
-      logger6.log("Proxy not running");
+      logger7.log("Proxy not running");
       return;
     }
-    logger6.log("Stopping mitmproxy...");
+    logger7.log("Stopping mitmproxy...");
     return new Promise((resolve) => {
       if (!this.process) {
         resolve();
         return;
       }
       const timeout = setTimeout(() => {
-        logger6.log("Force killing mitmproxy...");
+        logger7.log("Force killing mitmproxy...");
         this.process?.kill("SIGKILL");
       }, 5e3);
       this.process.on("close", () => {
         clearTimeout(timeout);
         this.isRunning = false;
         this.process = null;
-        logger6.log("mitmproxy stopped");
+        logger7.log("mitmproxy stopped");
         resolve();
       });
       this.process.kill("SIGTERM");
@@ -9632,15 +10010,15 @@ async function withSandboxTiming(actionType, fn) {
 }
 
 // src/lib/vm-setup/vm-setup.ts
-var logger7 = createLogger("VMSetup");
+var logger8 = createLogger("VMSetup");
 var VM_PROXY_CA_PATH = "/usr/local/share/ca-certificates/vm0-proxy-ca.crt";
 async function downloadStorages(guest, manifest) {
   const totalArchives = manifest.storages.filter((s) => s.archiveUrl).length + (manifest.artifact?.archiveUrl ? 1 : 0);
   if (totalArchives === 0) {
-    logger7.log(`No archives to download`);
+    logger8.log(`No archives to download`);
     return;
   }
-  logger7.log(`Downloading ${totalArchives} archive(s)...`);
+  logger8.log(`Downloading ${totalArchives} archive(s)...`);
   const manifestJson = JSON.stringify(manifest);
   await guest.writeFile("/tmp/storage-manifest.json", manifestJson);
   const result = await guest.exec(
@@ -9649,23 +10027,23 @@ async function downloadStorages(guest, manifest) {
   if (result.exitCode !== 0) {
     throw new Error(`Storage download failed: ${result.stderr}`);
   }
-  logger7.log(`Storage download completed`);
+  logger8.log(`Storage download completed`);
 }
 async function restoreSessionHistory(guest, resumeSession, workingDir, cliAgentType) {
   const { sessionId, sessionHistory } = resumeSession;
   let sessionPath;
   if (cliAgentType === "codex") {
-    logger7.log(`Codex resume session will be handled by checkpoint.py`);
+    logger8.log(`Codex resume session will be handled by checkpoint.py`);
     return;
   } else {
     const projectName = workingDir.replace(/^\//, "").replace(/\//g, "-");
     sessionPath = `/home/user/.claude/projects/-${projectName}/${sessionId}.jsonl`;
   }
-  logger7.log(`Restoring session history to ${sessionPath}`);
+  logger8.log(`Restoring session history to ${sessionPath}`);
   const dirPath = sessionPath.substring(0, sessionPath.lastIndexOf("/"));
   await guest.execOrThrow(`mkdir -p "${dirPath}"`);
   await guest.writeFile(sessionPath, sessionHistory);
-  logger7.log(
+  logger8.log(
     `Session history restored (${sessionHistory.split("\n").length} lines)`
   );
 }
@@ -9719,7 +10097,7 @@ function buildEnvironmentVariables(context, apiUrl) {
 
 // src/lib/network-logs/network-logs.ts
 import fs8 from "fs";
-var logger8 = createLogger("NetworkLogs");
+var logger9 = createLogger("NetworkLogs");
 function getNetworkLogPath(runId) {
   return tempPaths.networkLog(runId);
 }
@@ -9733,7 +10111,7 @@ function readNetworkLogs(runId) {
     const lines = content.split("\n").filter((line) => line.trim());
     return lines.map((line) => JSON.parse(line));
   } catch (err) {
-    logger8.error(
+    logger9.error(
       `Failed to read network logs: ${err instanceof Error ? err.message : "Unknown error"}`
     );
     return [];
@@ -9746,7 +10124,7 @@ function cleanupNetworkLogs(runId) {
       fs8.unlinkSync(logPath);
     }
   } catch (err) {
-    logger8.error(
+    logger9.error(
       `Failed to cleanup network logs: ${err instanceof Error ? err.message : "Unknown error"}`
     );
   }
@@ -9754,10 +10132,10 @@ function cleanupNetworkLogs(runId) {
 async function uploadNetworkLogs(apiUrl, sandboxToken, runId) {
   const networkLogs = readNetworkLogs(runId);
   if (networkLogs.length === 0) {
-    logger8.log(`No network logs to upload for ${runId}`);
+    logger9.log(`No network logs to upload for ${runId}`);
     return;
   }
-  logger8.log(
+  logger9.log(
     `Uploading ${networkLogs.length} network log entries for ${runId}`
   );
   const headers = {
@@ -9778,15 +10156,15 @@ async function uploadNetworkLogs(apiUrl, sandboxToken, runId) {
   });
   if (!response.ok) {
     const errorText = await response.text();
-    logger8.error(`Failed to upload network logs: ${errorText}`);
+    logger9.error(`Failed to upload network logs: ${errorText}`);
     return;
   }
-  logger8.log(`Network logs uploaded successfully for ${runId}`);
+  logger9.log(`Network logs uploaded successfully for ${runId}`);
   cleanupNetworkLogs(runId);
 }
 
 // src/lib/executor.ts
-var logger9 = createLogger("Executor");
+var logger10 = createLogger("Executor");
 function getVmIdFromRunId(runId) {
   return runId.split("-")[0] || runId.substring(0, 8);
 }
@@ -9806,9 +10184,9 @@ async function executeJob(context, config, options = {}) {
   const vmId = getVmIdFromRunId(context.runId);
   let vm = null;
   let guestIp = null;
-  logger9.log(`Starting job ${context.runId} in VM ${vmId}`);
+  logger10.log(`Starting job ${context.runId} in VM ${vmId}`);
   try {
-    const workspacesDir = path5.join(process.cwd(), "workspaces");
+    const workspacesDir = path6.join(process.cwd(), "workspaces");
     const vmConfig = {
       vmId,
       vcpus: config.sandbox.vcpu,
@@ -9816,30 +10194,30 @@ async function executeJob(context, config, options = {}) {
       kernelPath: config.firecracker.kernel,
       rootfsPath: config.firecracker.rootfs,
       firecrackerBinary: config.firecracker.binary,
-      workDir: path5.join(workspacesDir, `vm0-${vmId}`)
+      workDir: path6.join(workspacesDir, `vm0-${vmId}`)
     };
-    logger9.log(`Creating VM ${vmId}...`);
+    logger10.log(`Creating VM ${vmId}...`);
     vm = new FirecrackerVM(vmConfig);
     await withSandboxTiming("vm_create", () => vm.start());
     guestIp = vm.getGuestIp();
     if (!guestIp) {
       throw new Error("VM started but no IP address available");
     }
-    logger9.log(`VM ${vmId} started, guest IP: ${guestIp}`);
+    logger10.log(`VM ${vmId} started, guest IP: ${guestIp}`);
     const vsockPath = vm.getVsockPath();
     const guest = new VsockClient(vsockPath);
-    logger9.log(`Using vsock for guest communication: ${vsockPath}`);
-    logger9.log(`Waiting for guest connection...`);
+    logger10.log(`Using vsock for guest communication: ${vsockPath}`);
+    logger10.log(`Waiting for guest connection...`);
     await withSandboxTiming(
       "guest_wait",
       () => guest.waitForGuestConnection(3e4)
     );
-    logger9.log(`Guest client ready`);
+    logger10.log(`Guest client ready`);
     const firewallConfig = context.experimentalFirewall;
     if (firewallConfig?.enabled) {
       const mitmEnabled = firewallConfig.experimental_mitm ?? false;
       const sealSecretsEnabled = firewallConfig.experimental_seal_secrets ?? false;
-      logger9.log(
+      logger10.log(
         `Setting up network security for VM ${guestIp} (mitm=${mitmEnabled}, sealSecrets=${sealSecretsEnabled})`
       );
       await withSandboxTiming("network_setup", async () => {
@@ -9874,7 +10252,7 @@ async function executeJob(context, config, options = {}) {
     }
     const envVars = buildEnvironmentVariables(context, config.server.url);
     const envJson = JSON.stringify(envVars);
-    logger9.log(
+    logger10.log(
       `Writing env JSON (${envJson.length} bytes) to ${ENV_JSON_PATH}`
     );
     await guest.writeFile(ENV_JSON_PATH, envJson);
@@ -9883,14 +10261,14 @@ async function executeJob(context, config, options = {}) {
     const maxWaitMs = 2 * 60 * 60 * 1e3;
     let command;
     if (options.benchmarkMode) {
-      logger9.log(`Running command directly (benchmark mode)...`);
+      logger10.log(`Running command directly (benchmark mode)...`);
       command = `${context.prompt} > ${systemLogFile} 2>&1`;
     } else {
-      logger9.log(`Running agent via env-loader...`);
+      logger10.log(`Running agent via env-loader...`);
       command = `node ${ENV_LOADER_PATH} > ${systemLogFile} 2>&1`;
     }
     const { pid } = await guest.spawnAndWatch(command, maxWaitMs);
-    logger9.log(`Process started with pid=${pid}`);
+    logger10.log(`Process started with pid=${pid}`);
     let exitCode = 1;
     let exitEvent;
     try {
@@ -9899,7 +10277,7 @@ async function executeJob(context, config, options = {}) {
     } catch {
       const durationMs2 = Date.now() - startTime;
       const duration2 = Math.round(durationMs2 / 1e3);
-      logger9.log(`Agent timed out after ${duration2}s`);
+      logger10.log(`Agent timed out after ${duration2}s`);
       recordOperation({
         actionType: "agent_execute",
         durationMs: durationMs2,
@@ -9917,7 +10295,7 @@ async function executeJob(context, config, options = {}) {
         `dmesg | tail -20 | grep -iE "killed|oom" 2>/dev/null`
       );
       if (dmesgCheck.stdout.toLowerCase().includes("oom") || dmesgCheck.stdout.toLowerCase().includes("killed")) {
-        logger9.log(`OOM detected: ${dmesgCheck.stdout}`);
+        logger10.log(`OOM detected: ${dmesgCheck.stdout}`);
         recordOperation({
           actionType: "agent_execute",
           durationMs,
@@ -9934,9 +10312,9 @@ async function executeJob(context, config, options = {}) {
       durationMs,
       success: exitCode === 0
     });
-    logger9.log(`Agent finished in ${duration}s with exit code ${exitCode}`);
+    logger10.log(`Agent finished in ${duration}s with exit code ${exitCode}`);
     if (exitEvent.stderr) {
-      logger9.log(
+      logger10.log(
         `Stderr (${exitEvent.stderr.length} chars): ${exitEvent.stderr.substring(0, 500)}`
       );
     }
@@ -9946,14 +10324,14 @@ async function executeJob(context, config, options = {}) {
     };
   } catch (error) {
     const errorMsg = error instanceof Error ? error.message : "Unknown error";
-    logger9.error(`Job ${context.runId} failed: ${errorMsg}`);
+    logger10.error(`Job ${context.runId} failed: ${errorMsg}`);
     return {
       exitCode: 1,
       error: errorMsg
     };
   } finally {
     if (context.experimentalFirewall?.enabled && guestIp) {
-      logger9.log(`Cleaning up network security for VM ${guestIp}`);
+      logger10.log(`Cleaning up network security for VM ${guestIp}`);
       getVMRegistry().unregister(guestIp);
       if (!options.benchmarkMode) {
         try {
@@ -9963,14 +10341,14 @@ async function executeJob(context, config, options = {}) {
             context.runId
           );
         } catch (err) {
-          logger9.error(
+          logger10.error(
             `Failed to upload network logs: ${err instanceof Error ? err.message : "Unknown error"}`
           );
         }
       }
     }
     if (vm) {
-      logger9.log(`Cleaning up VM ${vmId}...`);
+      logger10.log(`Cleaning up VM ${vmId}...`);
       await withSandboxTiming("cleanup", () => vm.kill());
     }
     await clearSandboxContext();
@@ -9979,7 +10357,7 @@ async function executeJob(context, config, options = {}) {
 
 // src/lib/runner/status.ts
 import { writeFileSync as writeFileSync2 } from "fs";
-var logger10 = createLogger("Runner");
+var logger11 = createLogger("Runner");
 function writeStatusFile(statusFilePath, mode, activeRuns, startedAt) {
   const status = {
     mode,
@@ -9991,7 +10369,7 @@ function writeStatusFile(statusFilePath, mode, activeRuns, startedAt) {
   try {
     writeFileSync2(statusFilePath, JSON.stringify(status, null, 2));
   } catch (err) {
-    logger10.error(
+    logger11.error(
       `Failed to write status file: ${err instanceof Error ? err.message : "Unknown error"}`
     );
   }
@@ -10008,25 +10386,25 @@ function createStatusUpdater(statusFilePath, state) {
 }
 
 // src/lib/runner/runner-lock.ts
-import { exec as exec4 } from "child_process";
+import { exec as exec5 } from "child_process";
 import fs9 from "fs";
-import path6 from "path";
-import { promisify as promisify4 } from "util";
-var execAsync4 = promisify4(exec4);
-var logger11 = createLogger("RunnerLock");
-var DEFAULT_PID_FILE = paths.runnerPid;
+import path7 from "path";
+import { promisify as promisify5 } from "util";
+var execAsync5 = promisify5(exec5);
+var logger12 = createLogger("RunnerLock");
+var DEFAULT_PID_FILE = runtimePaths.runnerPid;
 var currentPidFile = null;
-async function ensureRunDir2(dirPath, skipSudo) {
+async function ensureRunDir(dirPath, skipSudo) {
   if (!fs9.existsSync(dirPath)) {
     if (skipSudo) {
       fs9.mkdirSync(dirPath, { recursive: true });
     } else {
-      await execAsync4(`sudo mkdir -p ${dirPath}`);
-      await execAsync4(`sudo chmod 777 ${dirPath}`);
+      await execAsync5(`sudo mkdir -p ${dirPath}`);
+      await execAsync5(`sudo chmod 777 ${dirPath}`);
     }
   }
 }
-function isProcessRunning(pid) {
+function isProcessRunning2(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -10040,64 +10418,68 @@ function isProcessRunning(pid) {
 async function acquireRunnerLock(options = {}) {
   const pidFile = options.pidFile ?? DEFAULT_PID_FILE;
   const skipSudo = options.skipSudo ?? false;
-  const runDir = path6.dirname(pidFile);
-  await ensureRunDir2(runDir, skipSudo);
+  const runDir = path7.dirname(pidFile);
+  await ensureRunDir(runDir, skipSudo);
   if (fs9.existsSync(pidFile)) {
     const pidStr = fs9.readFileSync(pidFile, "utf-8").trim();
     const pid = parseInt(pidStr, 10);
-    if (!isNaN(pid) && isProcessRunning(pid)) {
-      logger11.error(`Error: Another runner is already running (PID ${pid})`);
-      logger11.error(`If this is incorrect, remove ${pidFile} and try again.`);
+    if (!isNaN(pid) && isProcessRunning2(pid)) {
+      logger12.error(`Error: Another runner is already running (PID ${pid})`);
+      logger12.error(`If this is incorrect, remove ${pidFile} and try again.`);
       process.exit(1);
     }
     if (isNaN(pid)) {
-      logger11.log("Cleaning up invalid PID file");
+      logger12.log("Cleaning up invalid PID file");
     } else {
-      logger11.log(`Cleaning up stale PID file (PID ${pid} not running)`);
+      logger12.log(`Cleaning up stale PID file (PID ${pid} not running)`);
     }
     fs9.unlinkSync(pidFile);
   }
   fs9.writeFileSync(pidFile, process.pid.toString());
   currentPidFile = pidFile;
-  logger11.log(`Runner lock acquired (PID ${process.pid})`);
+  logger12.log(`Runner lock acquired (PID ${process.pid})`);
 }
 function releaseRunnerLock() {
   const pidFile = currentPidFile ?? DEFAULT_PID_FILE;
   if (fs9.existsSync(pidFile)) {
     fs9.unlinkSync(pidFile);
-    logger11.log("Runner lock released");
+    logger12.log("Runner lock released");
   }
   currentPidFile = null;
 }
 
 // src/lib/runner/setup.ts
-var logger12 = createLogger("Runner");
+var logger13 = createLogger("Runner");
 async function setupEnvironment(options) {
   const { config } = options;
   await acquireRunnerLock();
   const networkCheck = checkNetworkPrerequisites();
   if (!networkCheck.ok) {
-    logger12.error("Network prerequisites not met:");
+    logger13.error("Network prerequisites not met:");
     for (const error of networkCheck.errors) {
-      logger12.error(`  - ${error}`);
+      logger13.error(`  - ${error}`);
     }
     process.exit(1);
   }
-  logger12.log("Setting up network bridge...");
+  logger13.log("Setting up network bridge...");
   await setupBridge();
-  logger12.log("Flushing bridge ARP cache...");
+  logger13.log("Flushing bridge ARP cache...");
   await flushBridgeArpCache();
-  logger12.log("Cleaning up orphaned proxy rules...");
+  logger13.log("Cleaning up orphaned proxy rules...");
   await cleanupOrphanedProxyRules(config.name);
-  logger12.log("Cleaning up orphaned IP allocations...");
-  await cleanupOrphanedAllocations();
-  logger12.log("Initializing overlay pool...");
+  logger13.log("Initializing overlay pool...");
   await initOverlayPool({
     size: config.sandbox.max_concurrent + 2,
     replenishThreshold: config.sandbox.max_concurrent,
     poolDir: dataPaths.overlayPool(config.data_dir)
   });
-  logger12.log("Initializing network proxy...");
+  logger13.log("Initializing TAP pool...");
+  await initTapPool({
+    name: config.name,
+    size: config.sandbox.max_concurrent + 2,
+    replenishThreshold: config.sandbox.max_concurrent
+  });
+  logger13.log("Initializing network proxy...");
   initVMRegistry();
   const proxyManager = initProxyManager({
     apiUrl: config.server.url,
@@ -10108,14 +10490,14 @@ async function setupEnvironment(options) {
   try {
     await proxyManager.start();
     proxyEnabled = true;
-    logger12.log("Network proxy initialized successfully");
-    logger12.log("Setting up CIDR proxy rules...");
+    logger13.log("Network proxy initialized successfully");
+    logger13.log("Setting up CIDR proxy rules...");
     await setupCIDRProxyRules(config.proxy.port);
   } catch (err) {
-    logger12.log(
+    logger13.log(
       `Network proxy not available: ${err instanceof Error ? err.message : "Unknown error"}`
     );
-    logger12.log(
+    logger13.log(
       "Jobs with experimentalFirewall enabled will run without network interception"
     );
   }
@@ -10125,22 +10507,22 @@ async function cleanupEnvironment(resources) {
   const errors = [];
   if (resources.proxyEnabled) {
     try {
-      logger12.log("Cleaning up CIDR proxy rules...");
+      logger13.log("Cleaning up CIDR proxy rules...");
       await cleanupCIDRProxyRules(resources.proxyPort);
     } catch (err) {
       const error = err instanceof Error ? err : new Error(String(err));
       errors.push(error);
-      logger12.error(`Failed to cleanup CIDR proxy rules: ${error.message}`);
+      logger13.error(`Failed to cleanup CIDR proxy rules: ${error.message}`);
     }
   }
   if (resources.proxyEnabled) {
     try {
-      logger12.log("Stopping network proxy...");
+      logger13.log("Stopping network proxy...");
       await getProxyManager().stop();
     } catch (err) {
       const error = err instanceof Error ? err : new Error(String(err));
       errors.push(error);
-      logger12.error(`Failed to stop network proxy: ${error.message}`);
+      logger13.error(`Failed to stop network proxy: ${error.message}`);
     }
   }
   try {
@@ -10148,39 +10530,46 @@ async function cleanupEnvironment(resources) {
   } catch (err) {
     const error = err instanceof Error ? err : new Error(String(err));
     errors.push(error);
-    logger12.error(`Failed to cleanup overlay pool: ${error.message}`);
+    logger13.error(`Failed to cleanup overlay pool: ${error.message}`);
+  }
+  try {
+    cleanupTapPool();
+  } catch (err) {
+    const error = err instanceof Error ? err : new Error(String(err));
+    errors.push(error);
+    logger13.error(`Failed to cleanup TAP pool: ${error.message}`);
   }
   try {
     releaseRunnerLock();
   } catch (err) {
     const error = err instanceof Error ? err : new Error(String(err));
     errors.push(error);
-    logger12.error(`Failed to release runner lock: ${error.message}`);
+    logger13.error(`Failed to release runner lock: ${error.message}`);
   }
   if (errors.length > 0) {
-    logger12.error(`Cleanup completed with ${errors.length} error(s)`);
+    logger13.error(`Cleanup completed with ${errors.length} error(s)`);
   }
 }
 
 // src/lib/runner/signals.ts
-var logger13 = createLogger("Runner");
+var logger14 = createLogger("Runner");
 function setupSignalHandlers(state, handlers) {
   process.on("SIGINT", () => {
-    logger13.log("\nShutting down...");
+    logger14.log("\nShutting down...");
     state.mode = "stopping";
     handlers.updateStatus();
     handlers.onShutdown();
   });
   process.on("SIGTERM", () => {
-    logger13.log("\nShutting down...");
+    logger14.log("\nShutting down...");
     state.mode = "stopping";
     handlers.updateStatus();
     handlers.onShutdown();
   });
   process.on("SIGUSR1", () => {
     if (state.mode === "running") {
-      logger13.log("\n[Maintenance] Entering drain mode...");
-      logger13.log(
+      logger14.log("\n[Maintenance] Entering drain mode...");
+      logger14.log(
         `[Maintenance] Active jobs: ${state.activeRuns.size} (will wait for completion)`
       );
       state.mode = "draining";
@@ -10191,7 +10580,7 @@ function setupSignalHandlers(state, handlers) {
 }
 
 // src/lib/runner/runner.ts
-var logger14 = createLogger("Runner");
+var logger15 = createLogger("Runner");
 var Runner = class _Runner {
   config;
   statusFilePath;
@@ -10230,7 +10619,7 @@ var Runner = class _Runner {
       onDrain: () => {
         this.pendingJobs.length = 0;
         if (this.state.activeRuns.size === 0) {
-          logger14.log("[Maintenance] No active jobs, exiting immediately");
+          logger15.log("[Maintenance] No active jobs, exiting immediately");
           this.state.mode = "stopping";
           this.updateStatus();
           this.resolveShutdown?.();
@@ -10238,35 +10627,35 @@ var Runner = class _Runner {
       },
       updateStatus: this.updateStatus
     });
-    logger14.log(
+    logger15.log(
       `Starting runner '${this.config.name}' for group '${this.config.group}'...`
     );
-    logger14.log(`Max concurrent jobs: ${this.config.sandbox.max_concurrent}`);
-    logger14.log(`Status file: ${this.statusFilePath}`);
-    logger14.log("Press Ctrl+C to stop");
-    logger14.log("");
+    logger15.log(`Max concurrent jobs: ${this.config.sandbox.max_concurrent}`);
+    logger15.log(`Status file: ${this.statusFilePath}`);
+    logger15.log("Press Ctrl+C to stop");
+    logger15.log("");
     this.updateStatus();
-    logger14.log("Checking for pending jobs...");
+    logger15.log("Checking for pending jobs...");
     await this.pollFallback();
-    logger14.log("Connecting to realtime job notifications...");
+    logger15.log("Connecting to realtime job notifications...");
     this.subscription = await subscribeToJobs(
       this.config.server,
       this.config.group,
       (notification) => {
-        logger14.log(`Ably notification: ${notification.runId}`);
+        logger15.log(`Ably notification: ${notification.runId}`);
         this.processJob(notification.runId).catch(console.error);
       },
       (connectionState, reason) => {
-        logger14.log(
+        logger15.log(
           `Ably connection: ${connectionState}${reason ? ` (${reason})` : ""}`
         );
       }
     );
-    logger14.log("Connected to realtime job notifications");
+    logger15.log("Connected to realtime job notifications");
     this.pollInterval = setInterval(() => {
       this.pollFallback().catch(console.error);
     }, this.config.sandbox.poll_interval_ms);
-    logger14.log(
+    logger15.log(
       `Polling fallback enabled (every ${this.config.sandbox.poll_interval_ms / 1e3}s)`
     );
     await shutdownPromise;
@@ -10277,7 +10666,7 @@ var Runner = class _Runner {
       this.subscription.cleanup();
     }
     if (this.state.jobPromises.size > 0) {
-      logger14.log(
+      logger15.log(
         `Waiting for ${this.state.jobPromises.size} active job(s) to complete...`
       );
       await Promise.all(this.state.jobPromises);
@@ -10285,7 +10674,7 @@ var Runner = class _Runner {
     await cleanupEnvironment(this.resources);
     this.state.mode = "stopped";
     this.updateStatus();
-    logger14.log("Runner stopped");
+    logger15.log("Runner stopped");
     process.exit(0);
   }
   /**
@@ -10302,11 +10691,11 @@ var Runner = class _Runner {
         () => pollForJob(this.config.server, this.config.group)
       );
       if (job) {
-        logger14.log(`Poll fallback found job: ${job.runId}`);
+        logger15.log(`Poll fallback found job: ${job.runId}`);
         await this.processJob(job.runId);
       }
     } catch (error) {
-      logger14.error(
+      logger15.error(
         `Poll fallback error: ${error instanceof Error ? error.message : "Unknown error"}`
       );
     }
@@ -10316,7 +10705,7 @@ var Runner = class _Runner {
    */
   async processJob(runId) {
     if (this.state.mode !== "running") {
-      logger14.log(`Not running (${this.state.mode}), ignoring job ${runId}`);
+      logger15.log(`Not running (${this.state.mode}), ignoring job ${runId}`);
       return;
     }
     if (this.state.activeRuns.has(runId)) {
@@ -10324,10 +10713,10 @@ var Runner = class _Runner {
     }
     if (this.state.activeRuns.size >= this.config.sandbox.max_concurrent) {
       if (!this.pendingJobs.includes(runId) && this.pendingJobs.length < _Runner.MAX_PENDING_QUEUE_SIZE) {
-        logger14.log(`At capacity, queueing job ${runId}`);
+        logger15.log(`At capacity, queueing job ${runId}`);
         this.pendingJobs.push(runId);
       } else if (this.pendingJobs.length >= _Runner.MAX_PENDING_QUEUE_SIZE) {
-        logger14.log(
+        logger15.log(
           `Pending queue full (${_Runner.MAX_PENDING_QUEUE_SIZE}), dropping job ${runId}`
         );
       }
@@ -10338,11 +10727,11 @@ var Runner = class _Runner {
         "claim",
         () => claimJob(this.config.server, runId)
       );
-      logger14.log(`Claimed job: ${context.runId}`);
+      logger15.log(`Claimed job: ${context.runId}`);
       this.state.activeRuns.add(context.runId);
       this.updateStatus();
       const jobPromise = this.executeJob(context).catch((error) => {
-        logger14.error(
+        logger15.error(
           `Job ${context.runId} failed: ${error instanceof Error ? error.message : "Unknown error"}`
         );
       }).finally(() => {
@@ -10350,7 +10739,7 @@ var Runner = class _Runner {
         this.state.jobPromises.delete(jobPromise);
         this.updateStatus();
         if (this.state.mode === "draining" && this.state.activeRuns.size === 0) {
-          logger14.log("[Maintenance] All jobs completed, exiting");
+          logger15.log("[Maintenance] All jobs completed, exiting");
           this.state.mode = "stopping";
           this.updateStatus();
           this.resolveShutdown?.();
@@ -10365,33 +10754,33 @@ var Runner = class _Runner {
       });
       this.state.jobPromises.add(jobPromise);
     } catch (error) {
-      logger14.log(
+      logger15.log(
         `Could not claim job ${runId}: ${error instanceof Error ? error.message : "Unknown error"}`
       );
     }
   }
   async executeJob(context) {
-    logger14.log(`  Executing job ${context.runId}...`);
-    logger14.log(`  Prompt: ${context.prompt.substring(0, 100)}...`);
-    logger14.log(`  Compose version: ${context.agentComposeVersionId}`);
+    logger15.log(`  Executing job ${context.runId}...`);
+    logger15.log(`  Prompt: ${context.prompt.substring(0, 100)}...`);
+    logger15.log(`  Compose version: ${context.agentComposeVersionId}`);
     try {
       const result = await executeJob(context, this.config);
-      logger14.log(
+      logger15.log(
         `  Job ${context.runId} execution completed with exit code ${result.exitCode}`
       );
       if (result.exitCode !== 0 && result.error) {
-        logger14.error(`  Job ${context.runId} failed: ${result.error}`);
+        logger15.error(`  Job ${context.runId} failed: ${result.error}`);
       }
     } catch (err) {
       const error = err instanceof Error ? err.message : "Unknown execution error";
-      logger14.error(`  Job ${context.runId} execution failed: ${error}`);
+      logger15.error(`  Job ${context.runId} execution failed: ${error}`);
       const result = await completeJob(
         this.config.server.url,
         context,
         1,
         error
       );
-      logger14.log(`  Job ${context.runId} reported as ${result.status}`);
+      logger15.log(`  Job ${context.runId} reported as ${result.status}`);
     }
   }
 };
@@ -10422,7 +10811,7 @@ import { dirname as dirname2, join as join2 } from "path";
 
 // src/lib/firecracker/process.ts
 import { readdirSync, readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
-import path7 from "path";
+import path8 from "path";
 function parseFirecrackerCmdline(cmdline) {
   const args = cmdline.split("\0");
   if (!args[0]?.includes("firecracker")) return null;
@@ -10455,7 +10844,7 @@ function findFirecrackerProcesses() {
   for (const entry of entries) {
     if (!/^\d+$/.test(entry)) continue;
     const pid = parseInt(entry, 10);
-    const cmdlinePath = path7.join(procDir, entry, "cmdline");
+    const cmdlinePath = path8.join(procDir, entry, "cmdline");
     if (!existsSync3(cmdlinePath)) continue;
     try {
       const cmdline = readFileSync2(cmdlinePath, "utf-8");
@@ -10473,7 +10862,7 @@ function findProcessByVmId(vmId) {
   const processes = findFirecrackerProcesses();
   return processes.find((p) => p.vmId === vmId) || null;
 }
-function isProcessRunning2(pid) {
+function isProcessRunning3(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -10482,24 +10871,24 @@ function isProcessRunning2(pid) {
   }
 }
 async function killProcess(pid, timeoutMs = 5e3) {
-  if (!isProcessRunning2(pid)) return true;
+  if (!isProcessRunning3(pid)) return true;
   try {
     process.kill(pid, "SIGTERM");
   } catch {
-    return !isProcessRunning2(pid);
+    return !isProcessRunning3(pid);
   }
   const startTime = Date.now();
   while (Date.now() - startTime < timeoutMs) {
-    if (!isProcessRunning2(pid)) return true;
+    if (!isProcessRunning3(pid)) return true;
     await new Promise((resolve) => setTimeout(resolve, 100));
   }
-  if (isProcessRunning2(pid)) {
+  if (isProcessRunning3(pid)) {
     try {
       process.kill(pid, "SIGKILL");
     } catch {
     }
   }
-  return !isProcessRunning2(pid);
+  return !isProcessRunning3(pid);
 }
 function findMitmproxyProcess() {
   const procDir = "/proc";
@@ -10512,7 +10901,7 @@ function findMitmproxyProcess() {
   for (const entry of entries) {
     if (!/^\d+$/.test(entry)) continue;
     const pid = parseInt(entry, 10);
-    const cmdlinePath = path7.join(procDir, entry, "cmdline");
+    const cmdlinePath = path8.join(procDir, entry, "cmdline");
     if (!existsSync3(cmdlinePath)) continue;
     try {
       const cmdline = readFileSync2(cmdlinePath, "utf-8");
@@ -10574,11 +10963,11 @@ var doctorCommand = new Command2("doctor").description("Diagnose runner health,
       const warnings = [];
       const bridgeStatus = await checkBridgeStatus();
       if (bridgeStatus.exists) {
-        console.log(`  \u2713 Bridge ${BRIDGE_NAME2} (${bridgeStatus.ip})`);
+        console.log(`  \u2713 Bridge ${BRIDGE_NAME} (${bridgeStatus.ip})`);
       } else {
-        console.log(`  \u2717 Bridge ${BRIDGE_NAME2} not found`);
+        console.log(`  \u2717 Bridge ${BRIDGE_NAME} not found`);
         warnings.push({
-          message: `Network bridge ${BRIDGE_NAME2} does not exist`
+          message: `Network bridge ${BRIDGE_NAME} does not exist`
         });
       }
       const proxyPort = config.proxy.port;
@@ -10601,7 +10990,6 @@ var doctorCommand = new Command2("doctor").description("Diagnose runner health,
       }
       console.log("");
       const processes = findFirecrackerProcesses();
-      const tapDevices = await listTapDevices();
       const workspaces = existsSync4(workspacesDir) ? readdirSync2(workspacesDir).filter((d) => d.startsWith("vm0-")) : [];
       const jobs = [];
       const statusVmIds = /* @__PURE__ */ new Set();
@@ -10624,9 +11012,11 @@ var doctorCommand = new Command2("doctor").description("Diagnose runner health,
       }
       const ipToVmIds = /* @__PURE__ */ new Map();
       for (const [ip, allocation] of allocations) {
-        const existing = ipToVmIds.get(ip) ?? [];
-        existing.push(allocation.vmId);
-        ipToVmIds.set(ip, existing);
+        if (allocation.vmId) {
+          const existing = ipToVmIds.get(ip) ?? [];
+          existing.push(allocation.vmId);
+          ipToVmIds.set(ip, existing);
+        }
       }
       const maxConcurrent = config.sandbox.max_concurrent;
       console.log(`Runs (${jobs.length} active, max ${maxConcurrent}):`);
@@ -10674,14 +11064,6 @@ var doctorCommand = new Command2("doctor").description("Diagnose runner health,
           });
         }
       }
-      for (const tap of tapDevices) {
-        const vmId = tap.replace("tap", "");
-        if (!processVmIds.has(vmId) && !statusVmIds.has(vmId)) {
-          warnings.push({
-            message: `Orphan TAP device: ${tap} (no matching job or process)`
-          });
-        }
-      }
       for (const ws of workspaces) {
         const vmId = ws.replace("vm0-", "");
         if (!processVmIds.has(vmId) && !statusVmIds.has(vmId)) {
@@ -10746,7 +11128,7 @@ var killCommand = new Command3("kill").description("Force terminate a run and cl
       const { vmId, runId } = resolveRunId(runIdArg, statusFilePath);
       console.log(`Killing run ${vmId}...`);
       const proc = findProcessByVmId(vmId);
-      const tapDevice = `tap${vmId}`;
+      const guestIp = getIPForVm(vmId);
       const workspaceDir = join3(workspacesDir, `vm0-${vmId}`);
       console.log("");
       console.log("Resources to clean up:");
@@ -10755,7 +11137,9 @@ var killCommand = new Command3("kill").description("Force terminate a run and cl
       } else {
         console.log("  - Firecracker process: not found");
       }
-      console.log(`  - TAP device: ${tapDevice}`);
+      if (guestIp) {
+        console.log(`  - IP address: ${guestIp} (TAP/IP released by runner)`);
+      }
       console.log(`  - Workspace: ${workspaceDir}`);
       if (runId) {
         console.log(`  - status.json entry: ${runId.substring(0, 12)}...`);
@@ -10783,20 +11167,6 @@ var killCommand = new Command3("kill").description("Force terminate a run and cl
           message: "Not running"
         });
       }
-      try {
-        await deleteTapDevice(tapDevice);
-        results.push({
-          step: "TAP device",
-          success: true,
-          message: `${tapDevice} deleted`
-        });
-      } catch (error) {
-        results.push({
-          step: "TAP device",
-          success: false,
-          message: error instanceof Error ? error.message : "Unknown error"
-        });
-      }
       if (existsSync5(workspaceDir)) {
         try {
           rmSync(workspaceDir, { recursive: true, force: true });
@@ -10969,6 +11339,8 @@ var benchmarkCommand = new Command4("benchmark").description(
 ).argument("<prompt>", "The bash command to execute in the VM").option("--config <path>", "Config file path", "./runner.yaml").option("--working-dir <path>", "Working directory in VM", "/home/user").option("--agent-type <type>", "Agent type", "claude-code").action(async (prompt, options) => {
   const timer = new Timer();
   setGlobalLogger(timer.log.bind(timer));
+  let exitCode = 1;
+  let poolsInitialized = false;
   try {
     timer.log("Loading configuration...");
     const config = loadDebugConfig(options.config);
@@ -10984,12 +11356,14 @@ var benchmarkCommand = new Command4("benchmark").description(
     }
     timer.log("Setting up network bridge...");
     await setupBridge();
-    timer.log("Initializing overlay pool...");
+    timer.log("Initializing pools...");
     await initOverlayPool({
       size: 2,
       replenishThreshold: 1,
       poolDir: dataPaths.overlayPool(config.data_dir)
     });
+    await initTapPool({ name: config.name, size: 2, replenishThreshold: 1 });
+    poolsInitialized = true;
     timer.log(`Executing command: ${prompt}`);
     const context = createBenchmarkContext(prompt, options);
     const result = await executeJob(context, config, {
@@ -11000,17 +11374,22 @@ var benchmarkCommand = new Command4("benchmark").description(
       timer.log(`Error: ${result.error}`);
     }
     timer.log(`Total time: ${timer.totalSeconds().toFixed(1)}s`);
-    process.exit(result.exitCode);
+    exitCode = result.exitCode;
   } catch (error) {
     timer.log(
       `Error: ${error instanceof Error ? error.message : "Unknown error"}`
     );
-    process.exit(1);
+  } finally {
+    if (poolsInitialized) {
+      cleanupTapPool();
+      cleanupOverlayPool();
+    }
   }
+  process.exit(exitCode);
 });
 
 // src/index.ts
-var version = true ? "3.7.3" : "0.1.0";
+var version = true ? "3.8.1" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(doctorCommand);