start-command 0.35.4 → 0.36.0

package/src/lib/status-formatter.js

@@ -326,6 +326,9 @@ function applyEndTime(enriched, dockerState, footerFinishedAt) {
 }
 
 function resolveDetachedStatus(record, logTail) {
+  if (require('./launch-owner').hasActiveLaunch(record)) {
+    return record;
+  }
   const footer = parseFooterFromTail(logTail);
   const footerExit = footer.exitCode;
   const dockerState = isDetachedDockerRecord(record)
@@ -444,6 +447,7 @@ function attachExitReason(record, logTail) {
     logTail,
     oomKilled: record.oomKilled,
     cgroupMemory: record.cgroupMemory,
+    exitEvidence: record.options?.exitEvidence,
   });
 
   if (!exitReason) {
@@ -490,9 +494,22 @@ function attachMemoryExhaustion(record, logTail) {
     logTail,
     oomKilled: record.oomKilled,
     cgroupMemory: record.cgroupMemory,
+    exitEvidence: record.options?.exitEvidence,
   });
 
   if (!memory) {
+    if (
+      record.memoryExhaustedReason?.startsWith('Docker reported') ||
+      record.memoryExhaustedReason?.startsWith('cgroup memory.events')
+    ) {
+      const cleared = Object.assign(
+        Object.create(Object.getPrototypeOf(record)),
+        record
+      );
+      delete cleared.memoryExhausted;
+      delete cleared.memoryExhaustedReason;
+      return cleared;
+    }
     return record;
   }
 
@@ -517,6 +534,14 @@ function enrichDetachedStatus(record) {
   if (!record) {
     return record;
   }
+  const cpuPenalty = require('./cpu-penalty-monitor').readState(record);
+  if (cpuPenalty) {
+    record = Object.assign(
+      Object.create(Object.getPrototypeOf(record)),
+      record
+    );
+    record.cpuPenalty = cpuPenalty;
+  }
   const {
     readAttemptActivity,
     readAttemptLogTail,
@@ -693,6 +718,9 @@ function formatRecordAsText(record) {
     ...(formatCgroupMemory(obj.cgroupMemory)
       ? [`Cgroup Memory:     ${formatCgroupMemory(obj.cgroupMemory)}`]
       : []),
+    ...(obj.cpuPenalty
+      ? [`CPU Penalty:       ${JSON.stringify(obj.cpuPenalty)}`]
+      : []),
     `PID:               ${obj.pid !== null ? obj.pid : 'N/A'}`,
     `Working Directory: ${obj.workingDirectory}`,
     `Shell:             ${obj.shell}`,

package/src/lib/store-lock.js

@@ -0,0 +1,133 @@
+/** Populate before publishing: a failed write must never poison the shared lock. */
+const fs = require('fs');
+const os = require('os');
+const crypto = require('crypto');
+const LOCK_TIMEOUT_MS = 30000;
+const LOCK_STALE_MS = 60000;
+const MALFORMED_LOCK_GRACE_MS = 3000;
+
+class LockManager {
+  constructor(lockFilePath, filesystem = fs) {
+    this.lockFilePath = lockFilePath;
+    this.fs = filesystem;
+    this.lockAcquired = false;
+    this.identity = null;
+  }
+
+  acquire(timeout = LOCK_TIMEOUT_MS) {
+    const started = Date.now();
+    const debug = (message) => {
+      if (process.env.START_DEBUG === '1') {
+        console.error(`[DEBUG] Store lock ${this.lockFilePath}: ${message}`);
+      }
+    };
+    while (Date.now() - started < timeout) {
+      const temp = `${this.lockFilePath}.${process.pid}.${crypto.randomUUID()}`;
+      try {
+        try {
+          const stat = this.fs.statSync(this.lockFilePath);
+          if (this.isLockStale(this.readLockFile(), stat)) {
+            const current = this.fs.statSync(this.lockFilePath);
+            if (current.ino === stat.ino && current.mtimeMs === stat.mtimeMs) {
+              debug('reclaiming stale or malformed lock');
+              this.fs.unlinkSync(this.lockFilePath);
+            }
+          }
+        } catch (error) {
+          if (error.code !== 'ENOENT') {
+            throw error;
+          }
+        }
+        this.fs.writeFileSync(
+          temp,
+          JSON.stringify({
+            pid: process.pid,
+            timestamp: Date.now(),
+            hostname: os.hostname(),
+          }),
+          { flag: 'wx' }
+        );
+        const handle = this.fs.openSync(temp, 'r+');
+        try {
+          this.fs.fsyncSync(handle);
+        } finally {
+          this.fs.closeSync(handle);
+        }
+        const identity = this.fs.statSync(temp);
+        this.fs.linkSync(temp, this.lockFilePath);
+        this.identity = identity;
+        this.lockAcquired = true;
+        debug(`acquired after ${Date.now() - started}ms`);
+        return true;
+      } catch (error) {
+        if (error.code !== 'EEXIST') {
+          throw error;
+        }
+        this.sleep(100);
+      } finally {
+        try {
+          this.fs.unlinkSync(temp);
+        } catch {
+          /* May not have been created. */
+        }
+      }
+    }
+    debug('acquisition timed out');
+    return false;
+  }
+
+  release() {
+    if (!this.lockAcquired) {
+      return;
+    }
+    try {
+      const current = this.fs.statSync(this.lockFilePath);
+      if (
+        current.dev === this.identity.dev &&
+        current.ino === this.identity.ino
+      ) {
+        this.fs.unlinkSync(this.lockFilePath);
+      }
+    } catch {
+      /* The lock may already be gone. */
+    }
+    this.lockAcquired = false;
+  }
+
+  readLockFile() {
+    try {
+      return JSON.parse(this.fs.readFileSync(this.lockFilePath, 'utf8'));
+    } catch {
+      return null;
+    }
+  }
+
+  isLockStale(data, stat) {
+    if (
+      !data ||
+      !Number.isFinite(data.timestamp) ||
+      !Number.isInteger(data.pid) ||
+      data.pid <= 0 ||
+      data.pid > 2147483647
+    ) {
+      return Boolean(
+        stat && Date.now() - stat.mtimeMs >= MALFORMED_LOCK_GRACE_MS
+      );
+    }
+    if (data.hostname === os.hostname()) {
+      try {
+        process.kill(data.pid, 0);
+        return false;
+      } catch (error) {
+        return error.code === 'ESRCH';
+      }
+    }
+    return Date.now() - data.timestamp > LOCK_STALE_MS;
+  }
+
+  sleep(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  }
+}
+
+module.exports = { LockManager, LOCK_TIMEOUT_MS, MALFORMED_LOCK_GRACE_MS };

package/src/lib/usage.js

@@ -19,6 +19,17 @@ Options:
   --on-kill-resume <N>  Resume a killed (exit 137 / OOM) detached docker session up to N times
   --recovery-command <cmd>  Command to run in the same container on such a resume
   --on-kill-resume-delay <min[-max]>  Wait a random number of seconds before each such resume (default 0)
+  --memory <size|N%|MIN%-MAX%>  Docker RAM cap; percentages use daemon capacity
+  --memory-swap <spec>  Combined memory+swap cap (defaults to memory, no extra swap)
+  --cpus <n|N%|MIN%-MAX%>  Docker CPU cap; ranges draw once per creation
+  --on-kill-resume-memory <spec>  New memory cap before a qualifying OOM recovery
+  --cpu-penalty        Enable delayed Docker CPU penalty (default off)
+  --cpu-penalty-cpus <n>  Penalty cap (default 2 CPUs)
+  --cpu-penalty-trigger <p%>  Busy threshold (default 95% of usable CPUs)
+  --cpu-penalty-trigger-window <d>  Fully covered busy window (default 15m)
+  --cpu-penalty-release <p%>  Quiet threshold (default 65% of penalty cap)
+  --cpu-penalty-release-window <d>  Minimum quiet/capped window (default 15m)
+                        Durations accept ms, s, m, h; --status reports penalty state
   --endpoint <endpoint> SSH endpoint (required for ssh isolation, e.g., user@host)
   --isolated-user, -u [name]  Create isolated user with same permissions
   --keep-user           Keep isolated user after command completes

package/test/docker-runtime-options.js

@@ -305,6 +305,9 @@ describe('buildDockerRuntimeMetadata', () => {
       networks: null,
       networkAliases: null,
       resourceLimits: null,
+      resolvedLimits: null,
+      resourceLimitSpecs: null,
+      onKillResumeMemory: null,
       onKillResume: null,
       recoveryCommand: null,
       onKillResumeDelay: null,
@@ -331,6 +334,9 @@ describe('buildDockerRuntimeMetadata', () => {
         networks: ['hive-formal-ai', 'public-egress'],
         networkAliases: ['formal-ai', 'checker'],
         resourceLimits: null,
+        resolvedLimits: null,
+        resourceLimitSpecs: null,
+        onKillResumeMemory: null,
         onKillResume: null,
         recoveryCommand: null,
         onKillResumeDelay: null,

package/test/execution-resume.js

@@ -270,11 +270,14 @@ describe('resumeExecution', () => {
         watchers.push([name, policy, logPath]),
     });
     assert.strictEqual(result.success, true, result.error);
-    assert.deepStrictEqual(calls, [['docker', 'start', 'box']]);
+    assert.deepStrictEqual(
+      calls.filter((call) => call[1] !== 'inspect'),
+      [['docker', 'start', 'box']]
+    );
     assert.strictEqual(watchers.length, 1);
     assert.strictEqual(watchers[0][0], 'box');
     assert.strictEqual(watchers[0][2], '/tmp/session.log');
-    assert.strictEqual(store.saved.length, 2);
+    assert.strictEqual(store.saved.length, 3);
     assert.strictEqual(store.saved[0].uuid, record.uuid);
     assert.strictEqual(store.saved[0].status, 'executing');
     assert.strictEqual(store.saved[0].options.resumeCount, 1);
@@ -320,7 +323,10 @@ describe('resumeExecution', () => {
     });
     assert.strictEqual(result.success, false);
     assert.match(result.error, /no such container/);
-    assert.strictEqual(store.saved.length, 0);
+    assert.strictEqual(store.saved.length, 2);
+    assert.strictEqual(store.saved.at(-1).status, 'executing');
+    assert.strictEqual(store.saved.at(-1).options.sessionName, 'box');
+    assert.strictEqual(store.saved.at(-1).options.launchPending, undefined);
   });
 
   test('relaunches through the isolation backend when the container is gone', async () => {

package/test/exit-reason.js

@@ -111,7 +111,11 @@ describe('resolveExitReason', () => {
   });
 
   it('should report the cgroup OOM observation when there is no marker', () => {
-    const reason = resolveExitReason({ exitCode: 137, oomKilled: true });
+    const reason = resolveExitReason({
+      exitCode: 137,
+      oomKilled: true,
+      exitEvidence: { mainOom: true },
+    });
     assert.strictEqual(reason, 'memory-exhaustion (cgroup-oom-killer)');
   });
 
@@ -173,6 +177,7 @@ describe('resolveMemoryExhaustion', () => {
       resolveMemoryExhaustion({
         exitCode: 137,
         logTail: 'killed\n',
+        exitEvidence: { mainOom: true },
         oomKilled: true,
       }),
       {

package/test/isolation.js

@@ -16,6 +16,7 @@ const {
   supportsLogfileOption,
   resetScreenVersionCache,
   getDefaultDockerImage,
+  canRunLinuxDockerImages,
 } = require('../src/lib/isolation');
 
 describe('Isolation Module', () => {
@@ -665,8 +666,8 @@ describe('detectShellInEnvironment', () => {
   });
 
   it('should auto-detect shell in docker if docker is available', () => {
-    if (!isCommandAvailable('docker')) {
-      console.log('  Skipping: docker not installed');
+    if (!canRunLinuxDockerImages()) {
+      console.log('  Skipping: Docker cannot run Linux container images');
       return;
     }
     // Use alpine:latest which is commonly available and has sh
@@ -703,8 +704,8 @@ describe('Shell option forwarding to isolation runners', () => {
 
   describe('runInDocker shell option', () => {
     it('should accept shell option in options object', async () => {
-      if (!isCommandAvailable('docker')) {
-        console.log('  Skipping: docker not installed');
+      if (!canRunLinuxDockerImages()) {
+        console.log('  Skipping: Docker cannot run Linux container images');
         return;
       }
 

package/test/regression-174.js

@@ -100,9 +100,11 @@ function runWatcher({ policy, running, state, withLog = true }) {
     [
       '#!/bin/sh',
       `dir='${dir}'`,
+      '[ "$START_COMMAND_CGROUP_SAMPLING" = 1 ] && exit 1',
       'case "$1" in',
       '  inspect)',
       '    case "$3" in',
+      '      *HostConfig*) exit 1 ;;',
       '      *State.Running*)',
       '        answer=$(head -n 1 "$dir/running")',
       '        if [ "$(wc -l < "$dir/running")" -gt 1 ]; then',
@@ -173,7 +175,7 @@ describe('issue #174: docker logs -f returning is not the container exiting', ()
     });
 
     expect(run.status).toBe(0);
-    expect(run.calls).toContain('wait');
+    expect(run.calls).toContain('inspect-running false');
     expect(run.calls.indexOf('wait')).toBeGreaterThan(
       run.calls.indexOf('logs')
     );

package/test/regression-180.js

@@ -70,20 +70,20 @@ describe('issue #180: the sticky OOMKilled flag is not an exit reason', () => {
     {
       exitCode: 137,
       oomKilled: true,
-      reason: CGROUP_OOM_EXIT_REASON,
-      memory: true,
+      reason: 'signal (SIGKILL; cause unknown)',
+      memory: false,
     },
     {
       exitCode: 137,
       oomKilled: false,
-      reason: 'signal (SIGKILL)',
+      reason: 'signal (SIGKILL; cause unknown)',
       memory: false,
     },
     {
       exitCode: -1,
       oomKilled: true,
-      reason: CGROUP_OOM_EXIT_REASON,
-      memory: true,
+      reason: null,
+      memory: false,
     },
     {
       exitCode: 139,
@@ -104,10 +104,17 @@ describe('issue #180: the sticky OOMKilled flag is not an exit reason', () => {
     });
   }
 
-  it('blames the flag on the command only for SIGKILL or an unknown exit', () => {
-    expect(isOomKillOfCommand({ exitCode: 137, oomKilled: true })).toBe(true);
-    expect(isOomKillOfCommand({ exitCode: null, oomKilled: true })).toBe(true);
-    expect(isOomKillOfCommand({ exitCode: -1, oomKilled: true })).toBe(true);
+  it('requires fresh attribution in addition to SIGKILL or an unknown exit', () => {
+    expect(isOomKillOfCommand({ exitCode: 137, oomKilled: true })).toBe(false);
+    expect(
+      isOomKillOfCommand({
+        exitCode: 137,
+        oomKilled: true,
+        exitEvidence: { mainOom: true },
+      })
+    ).toBe(true);
+    expect(isOomKillOfCommand({ exitCode: null, oomKilled: true })).toBe(false);
+    expect(isOomKillOfCommand({ exitCode: -1, oomKilled: true })).toBe(false);
     expect(isOomKillOfCommand({ exitCode: 0, oomKilled: true })).toBe(false);
     expect(isOomKillOfCommand({ exitCode: 1, oomKilled: true })).toBe(false);
     expect(isOomKillOfCommand({ exitCode: 137, oomKilled: false })).toBe(false);
@@ -191,6 +198,6 @@ describe('issue #180: the sticky OOMKilled flag is not an exit reason', () => {
       oomKilled: true,
       logPath: null,
     });
-    expect(main).toContain('Docker reports it was OOM-killed.');
+    expect(main).toContain('Docker reports a process in it was OOM-killed.');
   });
 });

package/test/regression-182.js

@@ -285,9 +285,13 @@ describe('issue #182: the watcher samples the cgroup while the container runs',
       timeout: 20000,
     });
     expect(result.status).toBe(0);
-    expect(fs.readFileSync(path.join(host.dir, 'sample'), 'utf8')).toBe(
-      OOM_SAMPLE
-    );
+    expect(
+      fs
+        .readFileSync(path.join(host.dir, 'sample'), 'utf8')
+        .split(' ')
+        .slice(0, 4)
+        .join(' ')
+    ).toBe(OOM_SAMPLE);
     expect(fs.readFileSync(logPath, 'utf8')).toBe(
       `${formatCgroupMemoryLogLine(OOM_SAMPLE)}\n`
     );

package/test/regression-185.js

@@ -97,15 +97,10 @@ describe('issue #185: counter-only OOM scope is unknown', () => {
     }
     for (const exitCode of [137, null, -1]) {
       const input = { exitCode, oomKilled: false, cgroupMemory };
-      expect(resolveExitReason(input)).toBe(CGROUP_OOM_EXIT_REASON);
-      expect(resolveMemoryExhaustion(input)).toEqual(
-        exitCode === null
-          ? null
-          : {
-              memoryExhausted: true,
-              memoryExhaustedReason: 'cgroup memory.events reported oom_kill=3',
-            }
-      );
+      expect(resolveExitReason(input)).not.toBe(CGROUP_OOM_EXIT_REASON);
+      expect(resolveMemoryExhaustion(input)).toBeNull();
+      const attributed = { ...input, exitEvidence: { mainOom: true } };
+      expect(resolveExitReason(attributed)).toBe(CGROUP_OOM_EXIT_REASON);
     }
   });
 });

package/test/regression-187.js

@@ -368,7 +368,8 @@ esac
       probe: () => ({ alive: false, state: SessionState.MISSING }),
       runIsolated: (backend, command, options) => {
         expect(options.deferCompletionWatcher).toBe(true);
-        expect(store.get(record.uuid).status).toBe('executed');
+        expect(store.get(record.uuid).status).toBe('executing');
+        expect(store.get(record.uuid).options.launchPending).toBe(true);
         return { success: true, containerId: 'replacement-container' };
       },
       startWatcher: () => {

package/test/regression-189.js

@@ -0,0 +1,224 @@
+const { it, expect } = require('bun:test');
+const { parseArgs } = require('../src/lib/args-parser');
+it('CPU penalty is opt-in and accepts durations and percentage settings', () => {
+  const options = parseArgs([
+    '--isolated',
+    'docker',
+    '--cpu-penalty',
+    '--cpu-penalty-trigger-window',
+    '1s',
+    '--',
+    'true',
+  ]).wrapperOptions;
+  expect(options.cpuPenaltyConfig.triggerWindowMs).toBe(1000);
+  expect(options.cpuPenaltyConfig.release).toBe(65);
+});
+const { initialState, evaluate, average } = require('../src/lib/cpu-penalty');
+const config = {
+  cpus: 2,
+  trigger: 95,
+  triggerWindowMs: 100,
+  release: 65,
+  releaseWindowMs: 100,
+};
+it('requires complete time-weighted windows, then lifts and observes afresh', () => {
+  let state = initialState(null, 0);
+  const tick = (now, cores) => {
+    const result = evaluate(
+      state,
+      { now, cores, daemonCpus: 6, maxGapMs: 50 },
+      config
+    );
+    state = result.state;
+    return result.action;
+  };
+  expect(tick(0, 6)).toBeNull();
+  expect(tick(40, 6)).toBeNull();
+  expect(tick(80, 6)).toBeNull();
+  expect(tick(100, 0.4).kind).toBe('apply');
+  expect(state.penaltyCount).toBe(1);
+  expect(tick(120, 0.4)).toBeNull();
+  expect(tick(160, 0.4)).toBeNull();
+  expect(tick(200, 0.4)).toBeNull();
+  expect(tick(220, 6).kind).toBe('lift');
+  expect(state.penalizedMs).toBe(120);
+  expect(tick(240, 6)).toBeNull();
+  expect(tick(280, 6)).toBeNull();
+  expect(tick(320, 6)).toBeNull();
+  expect(tick(340, 6).kind).toBe('apply');
+  expect(state.penaltyCount).toBe(2);
+});
+it('resets coverage on outage, gaps, resize and restart, and skips ineffective caps', () => {
+  let state = initialState(4, 0);
+  for (const [now, cores, daemonCpus] of [
+    [0, 4, 6],
+    [40, 4, 6],
+    [80, NaN, 6],
+    [120, 4, 6],
+    [160, 4, 6],
+    [200, 4, 8],
+  ]) {
+    const result = evaluate(
+      state,
+      { now, cores, daemonCpus, maxGapMs: 50 },
+      config
+    );
+    state = result.state;
+    expect(result.action).toBeNull();
+  }
+  const restarted = initialState(4, 240, state);
+  expect(
+    evaluate(
+      restarted,
+      { now: 240, cores: 4, daemonCpus: 8, maxGapMs: 50 },
+      config
+    ).action
+  ).toBeNull();
+  expect(
+    evaluate(state, { now: 400, cores: 4, daemonCpus: 8, maxGapMs: 50 }, config)
+      .action
+  ).toBeNull();
+  state = initialState(1, 0);
+  for (const now of [0, 40, 80, 120]) {
+    const r = evaluate(
+      state,
+      { now, cores: 1, daemonCpus: 6, maxGapMs: 50 },
+      config
+    );
+    state = r.state;
+    expect(r.action).toBeNull();
+  }
+});
+it('weights timestamps rather than giving short intervals equal weight', () => {
+  expect(
+    average(
+      [
+        { at: 0, cores: 6 },
+        { at: 90, cores: 0 },
+        { at: 100, cores: 0 },
+      ],
+      100,
+      100
+    )
+  ).toBe(5.4);
+});
+it('resume restores the original base within resized daemon capacity', () => {
+  const { prepareResumeResources } = require('../src/lib/resume-resources');
+  const record = {
+    options: {
+      isolated: 'docker',
+      sessionName: 'task',
+      cpuPenaltyConfig: config,
+      baseResourceLimits: ['--cpus=3'],
+      resourceLimits: ['--cpus=0.5'],
+      resolvedLimits: { cpus: 3 },
+    },
+  };
+  const result = prepareResumeResources(
+    record,
+    { state: 'stopped' },
+    {},
+    (_cmd, args) => ({
+      success: true,
+      stdout: JSON.stringify(
+        args[0] === 'info'
+          ? { MemTotal: 1073741824, NCPU: 2 }
+          : { NanoCpus: 500000000 }
+      ),
+    })
+  );
+  expect(result.resourceLimits).toContain('--cpus=2');
+  expect(result.resolvedLimits.cpus).toBe(2);
+  expect(record.options.baseResourceLimits).toEqual(['--cpus=3']);
+});
+
+it('monitor applies, lifts and reapplies with tracking disabled', () => {
+  if (process.platform === 'win32') {
+    return;
+  }
+  const fs = require('fs'),
+    path = require('path'),
+    os = require('os');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cpu-monitor-189-'));
+  try {
+    const logPath = path.join(dir, 'task.log');
+    fs.writeFileSync(logPath, '');
+    const record = {
+      logPath,
+      options: {
+        sessionName: 'cpu-task',
+        cpuPenaltyConfig: {
+          ...config,
+          triggerWindowMs: 200,
+          releaseWindowMs: 200,
+        },
+        baseResourceLimits: [],
+      },
+    };
+    const result = require('child_process').spawnSync(
+      '/bin/sh',
+      [
+        path.resolve(__dirname, '../../experiments/issue-195-cpu-monitor.sh'),
+        process.execPath,
+        require.resolve('../src/lib/cpu-penalty-monitor'),
+        '',
+        'cpu-task',
+        '1',
+        JSON.stringify(record),
+      ],
+      { encoding: 'utf8' }
+    );
+    expect(result.status).toBe(0);
+    const lines = fs.readFileSync(logPath, 'utf8').trim().split('\n');
+    expect(lines.length).toBe(3);
+    expect(lines[0]).toContain('CPU penalty applied: 2');
+    expect(lines[1]).toContain('CPU penalty lifted: 6');
+    expect(lines[2]).toContain('CPU penalty applied: 2');
+    const state = JSON.parse(
+      fs.readFileSync(`${logPath}.cpu-penalty.json`, 'utf8')
+    );
+    expect(state.penaltyCount).toBe(2);
+    expect(state.phase).toBe('penalized');
+    expect(state.penalizedMs).toBeGreaterThan(200);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}, 15000);
+
+it('preserves legacy CPU quota format and the lower original base', () => {
+  const limits = require('../src/lib/docker-resource-limits');
+  const base = ['--cpu-period=200000', '--cpu-quota=100000'];
+  expect(limits.cpuCount(base)).toBe(0.5);
+  expect(limits.withCpuLimit(base, 0.25)).toEqual([
+    '--cpu-period=100000',
+    '--cpu-quota=25000',
+  ]);
+  expect(limits.cpuUpdateArgs(base, 0.25)).toEqual([
+    '--cpu-period=100000',
+    '--cpu-quota=25000',
+  ]);
+  const { clampCpuToDaemon } = require('../src/lib/resume-resources');
+  expect(
+    clampCpuToDaemon(base, () => ({
+      success: true,
+      stdout: '{"NCPU":4,"MemTotal":1073741824}',
+    }))
+  ).toEqual(['--cpu-period=100000', '--cpu-quota=50000']);
+  const { prepareResumeResources } = require('../src/lib/resume-resources');
+  const overridden = prepareResumeResources(
+    {
+      options: {
+        isolated: 'docker',
+        sessionName: 'task',
+        resourceLimits: base,
+      },
+    },
+    { state: 'stopped' },
+    { cpus: '0.25' },
+    () => ({ success: true, stdout: '{"CpuPeriod":200000,"CpuQuota":100000}' })
+  );
+  expect(overridden.resourceLimits).toEqual([
+    '--cpu-period=100000',
+    '--cpu-quota=25000',
+  ]);
+});