start-command 0.35.4 → 0.37.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # start-command
 
+## 0.37.0
+
+### Minor Changes
+
+- 94db203: Add copy-free Docker command resumes with guarded legacy snapshots, persistent
+  task labels, wrapper help flags, private sanitized log uploads, and faithful shell
+  argument and exit-code handling. Enforce JavaScript-first CI and shared Rust parity.
+
+## 0.36.0
+
+### Minor Changes
+
+- dbf7ba6: Add Docker launch/recovery resource limits with daemon percentages and random ranges, opt-in delayed CPU penalties, and remote/DinD memory diagnostics. Reserve launches before side effects, atomically publish store locks and database writes, and require exit-time evidence for OOM verdicts while recognizing attributed Docker daemon restarts.
+
 ## 0.35.4
 
 ### Patch Changes

package/README.md

@@ -24,6 +24,8 @@ $ ls -la
 $ bun test
 $ git status
 $ --list
+$ --help
+$ -i docker -d --label task.tool=codex -- my-task
 $ --attach <id>
 $ --resume <id> -- <command>
 $ --resume-all
@@ -34,6 +36,10 @@ See the project-wide [README](../README.md), [docs/USAGE.md](../docs/USAGE.md),
 [docs/EXAMPLES.md](../docs/EXAMPLES.md) for the full user-facing guide and
 checked examples.
 
+`-h` also prints usage. Labels persist across Docker resumes. New detached
+containers support copy-free command handoff; legacy snapshots require capacity
+preflight. Log uploads are private and sanitized; manual `--no-sanitize` opts out.
+
 ## Development
 
 ```bash
@@ -56,3 +62,13 @@ GitHub Releases. The release title carries the `[JavaScript]` prefix, e.g.
 ## License
 
 Released into the public domain under the [Unlicense](../LICENSE).
+
+### Docker resource and recovery controls
+
+Launch with `--memory 64m`, `--memory-swap 64m` and `--cpus 1`, or use daemon
+percentages and uniform ranges such as `--memory '70%-80%'`. Memory-swap defaults
+to memory. `--cpu-penalty` enables delayed caps and reports state through status.
+Manual `--resume <id> --memory 128m` updates before starting;
+`--on-kill-resume-memory` changes memory only after a fresh qualifying OOM.
+See the [full resource and recovery guide](../README.md#docker-launch-limits-recovery-limits-and-cpu-penalty)
+and [incident research](../docs/case-studies/issue-195/README.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "start-command",
-  "version": "0.35.4",
+  "version": "0.37.0",
   "description": "Gamification of coding, execute any command with ability to auto-report issues on GitHub",
   "main": "src/bin/cli.js",
   "exports": {

package/src/bin/cli.js

@@ -192,6 +192,10 @@ try {
 }
 
 const { wrapperOptions, command: parsedCommand } = parsedArgs;
+if (wrapperOptions.help) {
+  printUsage();
+  process.exit(0);
+}
 
 // Query/control modes (--status, --list, --attach, --resume, ...) address an
 // execution that already exists, so they never need a command of their own.
@@ -241,6 +245,18 @@ const sessionId = wrapperOptions.sessionId || generateUUID();
     process.exit(queryExitCode === null ? 0 : queryExitCode);
   }
 
+  if (wrapperOptions.isolated === 'docker') {
+    const {
+      resolveResourceOptions,
+    } = require('../lib/docker-resource-options');
+    Object.assign(
+      wrapperOptions,
+      resolveResourceOptions(
+        wrapperOptions,
+        require('../lib/execution-control').runCommand
+      )
+    );
+  }
   // Check if running in isolation mode or with user isolation
   if (hasIsolation(wrapperOptions) || wrapperOptions.user) {
     await runWithIsolation(
@@ -419,14 +435,21 @@ async function runWithIsolation(
   // Save initial execution record and set global reference for signal cleanup
   if (executionRecord && store) {
     currentExecutionRecord = executionRecord;
+    require('../lib/launch-owner').markLaunch(executionRecord);
     try {
       store.save(executionRecord);
     } catch (err) {
-      if (config.verbose) {
-        console.error(
-          `[Tracking] Warning: Could not save execution record: ${err.message}`
-        );
-      }
+      console.error(
+        JSON.stringify({
+          code: 'LAUNCH_RESERVATION_FAILED',
+          uuid: executionRecord.uuid,
+          containerName: sessionName,
+          error: err.message,
+        })
+      );
+      currentExecutionRecord = null;
+      process.exitCode = 1;
+      return 1;
     }
   }
 
@@ -458,7 +481,9 @@ async function runWithIsolation(
     // Note: Isolation environments currently use native spawn/execSync
     // Future: Add command-stream support with raw() function for multiplexers
     result = await runIsolated(environment, cmd, {
+      ...options,
       session: sessionName,
+      sessionId,
       image: effectiveImage,
       endpoint: options.endpoint,
       detached: mode === 'detached',
@@ -502,6 +527,11 @@ async function runWithIsolation(
 
   // Update execution record: detached keeps "executing" (resolved at query time)
   if (executionRecord && store) {
+    executionRecord.options.launchPending = false;
+    if (result.diagnostics) {
+      executionRecord.cgroupMemory = result.diagnostics.cgroupMemory;
+      executionRecord.options.exitEvidence = result.diagnostics.exitEvidence;
+    }
     if (result.containerId) {
       executionRecord.options.containerId = result.containerId;
     }
@@ -515,11 +545,22 @@ async function runWithIsolation(
           : executionRecord
       );
     } catch (err) {
-      if (config.verbose) {
+      if (environment === 'docker' && mode === 'detached' && result.success) {
         console.error(
-          `[Tracking] Warning: Could not update execution record: ${err.message}`
+          require('../lib/launch-persistence').failLaunchedPersistence(
+            store,
+            executionRecord,
+            require('../lib/execution-control').runCommand,
+            err
+          )
         );
+        currentExecutionRecord = null;
+        process.exitCode = 1;
+        return 1;
       }
+      console.error(
+        `[Tracking] Could not update execution record: ${err.message}`
+      );
     }
     currentExecutionRecord = null;
   }

package/src/lib/args-parser-queries.js

@@ -26,6 +26,8 @@ function createQueryOptionDefaults() {
     list: false, // List all tracked execution records
     running: false, // Restrict --list to executions that are still running
     uploadLog: null, // UUID/session name whose stored log should be uploaded
+    noSanitize: false,
+    removeOriginal: false,
     outputFormat: null, // Output format (links-notation, json, text)
     stop: null, // UUID/session name to stop gracefully
     terminate: null, // UUID/session name to terminate immediately
@@ -55,6 +57,12 @@ const IDENTIFIER_OPTIONS = {
  * Boolean flags with no argument.
  */
 const FLAG_OPTIONS = {
+  '--no-sanitize': (options) => {
+    options.noSanitize = true;
+  },
+  '--remove-original': (options) => {
+    options.removeOriginal = true;
+  },
   '--list': (options) => {
     options.list = true;
   },
@@ -185,6 +193,12 @@ const OUTPUT_FORMAT_MODES = ['--status', '--list', '--resume', '--resume-all'];
  * @throws {Error} When the combination is not supported
  */
 function validateQueryOptions(options) {
+  if (options.noSanitize && !hasValue(options.uploadLog)) {
+    throw new Error('--no-sanitize is only valid with --upload-log');
+  }
+  if (options.removeOriginal && !hasValue(options.resume)) {
+    throw new Error('--remove-original is only valid with --resume');
+  }
   if (hasValue(options.outputFormat)) {
     if (!VALID_OUTPUT_FORMATS.includes(options.outputFormat)) {
       throw new Error(

package/src/lib/args-parser.js

@@ -44,6 +44,8 @@
 const { getDefaultDockerImage } = require('./docker-utils');
 const dockerNetworkOptions = require('./docker-network-options');
 const dockerRecoveryOptions = require('./docker-recovery-options');
+const cpuPenalty = require('./cpu-penalty');
+const dockerResourceOptions = require('./docker-resource-options');
 const { parseSequence, isSequence } = require('./sequence-parser');
 const { buildCommandString } = require('./shell-utils');
 const {
@@ -191,6 +193,8 @@ function parseArgs(args) {
     volumes: [], // Docker bind mounts/volumes (-v/--volume), applied to docker levels
     mounts: [], // Docker --mount specs, applied to docker levels
     env: [], // Docker environment variables (-e/--env, KEY=VALUE), applied to docker levels
+    labels: [], // Caller attribution, applied to every Docker level
+    help: false,
     privileged: false, // Run docker container in privileged mode
     network: null, // First Docker network name (compatibility accessor)
     networks: [], // Ordered Docker network names
@@ -245,7 +249,9 @@ function parseArgs(args) {
   }
 
   // Validate options
-  validateOptions(wrapperOptions);
+  if (!wrapperOptions.help) {
+    validateOptions(wrapperOptions);
+  }
 
   return {
     wrapperOptions,
@@ -286,6 +292,16 @@ function parseWrapperArgs(args, options) {
  */
 function parseOption(args, index, options) {
   const arg = args[index];
+  if (arg === '--help' || arg === '-h') {
+    options.help = true;
+    return 1;
+  }
+  if (arg === '--label' || arg.startsWith('--label=')) {
+    const label = arg === '--label' ? args[index + 1] : arg.slice(8);
+    require('./docker-labels').validateLabel(label);
+    options.labels.push(label);
+    return arg === '--label' ? 2 : 1;
+  }
 
   // --isolated, --isolation, or -i
   if (arg === '--isolated' || arg === '--isolation' || arg === '-i') {
@@ -414,6 +430,14 @@ function parseOption(args, index, options) {
     return networkOption;
   }
 
+  const cpuConsumed = cpuPenalty.parse(args, index, options);
+  if (cpuConsumed) {
+    return cpuConsumed;
+  }
+  const resourceOption = dockerResourceOptions.parse(args, index, options);
+  if (resourceOption) {
+    return resourceOption;
+  }
   const recoveryOption = dockerRecoveryOptions.parse(args, index, options);
   if (recoveryOption) {
     return recoveryOption;
@@ -558,6 +582,11 @@ function parseOption(args, index, options) {
  * @throws {Error} If a docker-only option is set without docker isolation
  */
 function validateDockerRuntimeOptionsRequireDocker(options) {
+  if (options.labels?.length > 0 && !options.resume) {
+    throw new Error(
+      '--label option is only valid with docker isolation or --resume'
+    );
+  }
   if (options.volumes && options.volumes.length > 0) {
     throw new Error(
       '--volume option is only valid when isolation stack includes docker'
@@ -756,6 +785,8 @@ function validateOptions(options) {
   }
 
   dockerRecoveryOptions.validate(options);
+  dockerResourceOptions.validate(options);
+  cpuPenalty.validate(options);
 
   // Session name is only valid with isolation
   if (options.session && !options.isolated) {

package/src/lib/atomic-write.js

@@ -0,0 +1,34 @@
+/** Keep the previous database intact when a write fails, including ENOSPC. */
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+function atomicWrite(file, content) {
+  const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  try {
+    fs.writeFileSync(temporary, content, { flag: 'wx' });
+    const handle = fs.openSync(temporary, 'r+');
+    try {
+      fs.fsyncSync(handle);
+    } finally {
+      fs.closeSync(handle);
+    }
+    fs.renameSync(temporary, file);
+    if (process.platform !== 'win32') {
+      const directory = fs.openSync(path.dirname(file), 'r');
+      try {
+        fs.fsyncSync(directory);
+      } finally {
+        fs.closeSync(directory);
+      }
+    }
+  } finally {
+    try {
+      fs.unlinkSync(temporary);
+    } catch {
+      /* Renamed or never created. */
+    }
+  }
+}
+
+module.exports = { atomicWrite };

package/src/lib/attached-diagnostics.js

@@ -0,0 +1,90 @@
+/** Keep the same memory and CPU monitors alive during an attached Docker run. */
+const { spawn, spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const cgroup = require('./cgroup-memory');
+const cpu = require('./cpu-penalty-monitor');
+const evidence = require('./exit-evidence');
+const { shellQuote } = require('./isolation-log-utils');
+
+function startAttachedDiagnostics(name, options) {
+  const file = path.join(os.tmpdir(), `start-attached-${crypto.randomUUID()}`);
+  let worker;
+  {
+    const script = [
+      cgroup.buildCgroupSamplerStartSnippet(name),
+      cpu.startSnippet(options.executionId, name, 1, options),
+      'read __start_stop',
+      cgroup.buildCgroupSamplerStopSnippet(),
+      cpu.stopSnippet(),
+      `printf '%s' "$__start_command_cgroup" > ${shellQuote(file)}`,
+      `printf '%s' "$__start_command_memory_unavailable" > ${shellQuote(`${file}.reason`)}`,
+    ]
+      .filter(Boolean)
+      .join('; ');
+    worker = spawn('sh', ['-c', script], {
+      stdio: ['pipe', 'ignore', 'ignore'],
+    });
+    worker.on('error', () => {});
+    // Subscribe before a fast command finishes, including shell startup failure.
+    worker.done = new Promise((resolve) => worker.once('close', resolve));
+    worker.stdin.on('error', () => {});
+  }
+  return {
+    async finish(state) {
+      if (worker) {
+        worker.stdin.end();
+        await worker.done;
+      }
+      let sample = '';
+      let unavailable = 'sampler could not start (sh unavailable)';
+      try {
+        sample = fs.readFileSync(file, 'utf8');
+        unavailable =
+          fs.readFileSync(`${file}.reason`, 'utf8') ||
+          'sampler stopped before a reading';
+      } catch {
+        /* Optional diagnostics are best effort. */
+      }
+      try {
+        fs.unlinkSync(file);
+        fs.unlinkSync(`${file}.reason`);
+      } catch {
+        /* Optional diagnostics are best effort. */
+      }
+      const docker = require('./docker-cleanup').getDockerCommand();
+      const limit = spawnSync(
+        docker,
+        ['inspect', '-f', '{{.HostConfig.Memory}}', name],
+        { encoding: 'utf8' }
+      );
+      const line = evidence.collectExitEvidence({
+        containerName: name,
+        sample,
+        finishedAt: state?.finishedAt,
+        exitCode: state?.exitCode,
+        oomKilled: state?.oomKilled,
+      });
+      if (options.logPath) {
+        try {
+          fs.appendFileSync(
+            options.logPath,
+            `${cgroup.formatCgroupMemoryLogLine(sample, limit.status === 0 ? limit.stdout.trim() : 'unknown', unavailable)}\n${line}\n`
+          );
+        } catch (error) {
+          if (process.env.START_DEBUG === '1') {
+            console.error(`[DEBUG] Attached diagnostics: ${error.message}`);
+          }
+        }
+      }
+      return {
+        cgroupMemory: cgroup.parseCgroupMemorySample(sample),
+        exitEvidence: evidence.fromLog(line),
+      };
+    },
+  };
+}
+
+module.exports = { startAttachedDiagnostics };

package/src/lib/cgroup-memory.js

@@ -67,6 +67,7 @@ function buildCgroupFunctionsSnippet() {
     '__start_command_cgroup_read() { __scr_events=$(cat "$1/memory.events" 2>/dev/null) || return 1; ' +
       "__scr_oom=$(printf '%s\\n' \"$__scr_events\" | sed -n 's/^oom //p'); " +
       "__scr_kill=$(printf '%s\\n' \"$__scr_events\" | sed -n 's/^oom_kill //p'); " +
+      'case "$__scr_oom:$__scr_kill" in *[!0-9:]*|:*|*:) return 1;; esac; ' +
       '__scr_max=$(cat "$1/memory.max" 2>/dev/null); __scr_peak=$(cat "$1/memory.peak" 2>/dev/null); ' +
       'printf \'%s %s %s %s %s\\n\' "${__scr_max:--}" "${__scr_peak:--}" ' +
       '"${__scr_oom:--}" "${__scr_kill:--}" "$1"; }',
@@ -82,13 +83,33 @@ function buildCgroupFunctionsSnippet() {
  */
 function buildCgroupSamplerStartSnippet(containerName) {
   const v = CGROUP_SHELL_VARS;
+  const name = shellQuote(containerName);
+  const remoteRead = '__start_command_cgroup_read /sys/fs/cgroup';
   return [
     buildCgroupFunctionsSnippet(),
     `${v.file}="\${TMPDIR:-/tmp}/start-command-cgroup.$$"`,
-    `rm -f "$${v.file}" "$${v.file}.tmp"`,
-    `( __scs_dir=$(__start_command_cgroup_dir ${shellQuote(containerName)}) || exit 0; ` +
-      'while __scs_line=$(__start_command_cgroup_read "$__scs_dir"); do ' +
-      `printf '%s\\n' "$__scs_line" > "$${v.file}.tmp" && mv -f "$${v.file}.tmp" "$${v.file}"; ` +
+    `rm -f "$${v.file}" "$${v.file}.tmp" "$${v.file}.reason"`,
+    `__start_command_memory_limit=$(docker inspect -f '{{.HostConfig.Memory}}' ${name} 2>/dev/null)`,
+    `__start_command_sample_name=${name}`,
+    // The first counter is a baseline, including after watcher restart. Only
+    // changes between adjacent successful samples supply exit-time evidence.
+    `( export START_COMMAND_CGROUP_SAMPLING=1; __scs_previous=''; __scs_previous_at=0; __scs_changed=0; ` +
+      `__scs_dir=$(__start_command_cgroup_dir ${name}); while :; do ` +
+      '__scs_line=""; if [ -n "$__scs_dir" ]; then __scs_line=$(__start_command_cgroup_read "$__scs_dir"); fi; ' +
+      `if [ -z "$__scs_line" ]; then __scs_ns=$(docker inspect -f '{{.HostConfig.CgroupnsMode}}' ${name} 2>/dev/null); ` +
+      `if [ "$__scs_ns" = private ]; then ` +
+      `__scs_remote=$(docker exec ${name} sh -c ${shellQuote(`${buildCgroupFunctionsSnippet()}; ${remoteRead}`)} 2>&1); __scs_exit=$?; ` +
+      'if [ "$__scs_exit" = 0 ]; then __scs_line=$__scs_remote; ' +
+      'else __scs_detail=$(printf "%s" "$__scs_remote" | sed -n "1p" | cut -c 1-240); ' +
+      `printf '%s\n' "local cgroup unavailable; Docker exec exit=$__scs_exit: \${__scs_detail:-private cgroup v2 counters unreadable}" > "$${v.file}.reason"; fi; ` +
+      `else printf '%s\n' "local cgroup unavailable; container cgroup namespace=\${__scs_ns:-unavailable}, private required" > "$${v.file}.reason"; fi; fi; ` +
+      '__scs_now=$(date +%s); if [ -n "$__scs_line" ]; then ' +
+      '__scs_kill=$(printf "%s" "$__scs_line" | cut -d " " -f 4); ' +
+      'if [ -n "$__scs_previous" ] && [ "$__scs_kill" -gt "$__scs_previous" ] 2>/dev/null && [ "$((__scs_now-__scs_previous_at))" -le 3 ]; then __scs_changed=$__scs_now; fi; ' +
+      '__scs_previous=$__scs_kill; __scs_previous_at=$__scs_now; ' +
+      '__scs_fields=$(printf "%s" "$__scs_line" | cut -d " " -f 1-4); ' +
+      `printf '%s %s %s %s\\n' "$__scs_fields" "$__scs_changed" "$__scs_now" "$__scs_dir" > "$${v.file}.tmp" && mv -f "$${v.file}.tmp" "$${v.file}"; fi; ` +
+      `if [ "$(docker inspect -f '{{.State.Running}}' ${name} 2>/dev/null)" = false ]; then break; fi; ` +
       `sleep ${CGROUP_SAMPLE_INTERVAL_SECONDS}; done ) >/dev/null 2>&1 & ${v.sampler}=$!`,
   ].join('; ');
 }
@@ -106,10 +127,16 @@ function buildCgroupSamplerStopSnippet() {
     `kill "$${v.sampler}" 2>/dev/null`,
     `wait "$${v.sampler}" 2>/dev/null`,
     `${v.sample}=$(cat "$${v.file}" 2>/dev/null)`,
-    `__scs_dir=$(printf '%s' "$${v.sample}" | cut -s -d ' ' -f 5-)`,
-    `if [ -n "$__scs_dir" ] && __scs_line=$(__start_command_cgroup_read "$__scs_dir"); then ${v.sample}=$__scs_line; fi`,
-    `rm -f "$${v.file}" "$${v.file}.tmp"`,
-    `${v.sample}=$(printf '%s' "$${v.sample}" | cut -d ' ' -f 1-4)`,
+    `__start_command_memory_unavailable=$(cat "$${v.file}.reason" 2>/dev/null)`,
+    `__scs_dir=$(printf '%s' "$${v.sample}" | cut -s -d ' ' -f 7-)`,
+    `if [ -n "$__scs_dir" ] && __scs_line=$(__start_command_cgroup_read "$__scs_dir"); then ` +
+      `__scs_old=$(printf '%s' "$${v.sample}" | cut -d ' ' -f 4); __scs_at=$(printf '%s' "$${v.sample}" | cut -d ' ' -f 6); ` +
+      `__scs_changed=$(printf '%s' "$${v.sample}" | cut -d ' ' -f 5); __scs_now=$(date +%s); ` +
+      `__scs_new=$(printf '%s' "$__scs_line" | cut -d ' ' -f 4); ` +
+      `if [ "$__scs_new" -gt "$__scs_old" ] 2>/dev/null && [ "$((__scs_now-__scs_at))" -le 3 ]; then __scs_changed=$__scs_now; fi; ` +
+      `${v.sample}="$(printf '%s' "$__scs_line" | cut -d ' ' -f 1-4) $__scs_changed $__scs_now"; fi`,
+    `rm -f "$${v.file}" "$${v.file}.tmp" "$${v.file}.reason"`,
+    `${v.sample}=$(printf '%s' "$${v.sample}" | cut -d ' ' -f 1-6)`,
   ].join('; ');
 }
 
@@ -128,7 +155,8 @@ function buildCgroupMemoryLogSnippet(quotedLogPath) {
     `__scm_note=' (${OOM_SCOPE_NOTES[OOM_SCOPE.UNKNOWN]})'; fi; ` +
     `printf 'Memory:     memory.max=%s memory.peak=%s oom=%s oom_kill=%s%s\\n' ` +
     `"$1" "$2" "$3" "$4" "$__scm_note"; }; ` +
-    `if [ -n "$${v.sample}" ]; then __start_command_cgroup_log $${v.sample} >> ${quotedLogPath}; fi`
+    `if [ -n "$${v.sample}" ]; then __start_command_cgroup_log $${v.sample} >> ${quotedLogPath}; ` +
+    `else printf 'Memory:     unavailable (%s) memory.limit=%s (HostConfig)\\n' "\${__start_command_memory_unavailable:-sampler stopped before a reading; local cgroup unavailable}" "\${__start_command_memory_limit:-unknown}" >> ${quotedLogPath}; fi`
   );
 }
 
@@ -138,10 +166,14 @@ function buildCgroupMemoryLogSnippet(quotedLogPath) {
  * @param {string|null|undefined} text - `<memory.max> <memory.peak> <oom> <oom_kill>`
  * @returns {?string} Line without a trailing newline, or null without a sample
  */
-function formatCgroupMemoryLogLine(text) {
+function formatCgroupMemoryLogLine(
+  text,
+  memoryLimit = 'unknown',
+  unavailable = 'sampler unavailable; local cgroup hidden or unreadable'
+) {
   const counters = parseCgroupMemorySample(text);
   if (!counters) {
-    return null;
+    return `Memory:     unavailable (${unavailable}) memory.limit=${memoryLimit} (HostConfig)`;
   }
   const [max, peak, oom, kill] = String(text).trim().split(/\s+/);
   const scope = describeCgroupOomScope(counters);

package/src/lib/command-builder.js

@@ -57,6 +57,46 @@ function buildNextLevelCommand(options, command) {
   // Docker runtime options are flat (not per-level); forward them only when a
   // remaining level still uses docker so the nested $ invocation can apply them.
   if (remainingStack.includes('docker')) {
+    for (const [key, flag] of [
+      ['memory', '--memory'],
+      ['memorySwap', '--memory-swap'],
+      ['cpus', '--cpus'],
+      ['onKillResumeMemory', '--on-kill-resume-memory'],
+    ]) {
+      if (options[key] !== null && options[key] !== undefined) {
+        parts.push(
+          `${flag} ${require('./shell-utils').quoteShellArg(String(options[key]))}`
+        );
+      }
+    }
+    if (options.cpuPenaltyConfig) {
+      parts.push('--cpu-penalty');
+      for (const [key, flag] of [
+        ['cpus', '--cpu-penalty-cpus'],
+        ['trigger', '--cpu-penalty-trigger'],
+        ['triggerWindowMs', '--cpu-penalty-trigger-window'],
+        ['release', '--cpu-penalty-release'],
+        ['releaseWindowMs', '--cpu-penalty-release-window'],
+      ]) {
+        parts.push(
+          `${flag} ${options.cpuPenaltyConfig[key]}${key.endsWith('Ms') ? 'ms' : ''}`
+        );
+      }
+    }
+    if (options.onKillResume !== null && options.onKillResume !== undefined) {
+      parts.push(`--on-kill-resume ${options.onKillResume}`);
+    }
+    if (
+      options.onKillResumeDelay !== null &&
+      options.onKillResumeDelay !== undefined
+    ) {
+      parts.push(`--on-kill-resume-delay ${options.onKillResumeDelay}`);
+    }
+    if (options.recoveryCommand) {
+      parts.push(
+        `--recovery-command ${require('./shell-utils').quoteShellArg(options.recoveryCommand)}`
+      );
+    }
     for (const volume of options.volumes || []) {
       parts.push(`--volume "${volume}"`);
     }
@@ -66,6 +106,9 @@ function buildNextLevelCommand(options, command) {
     for (const envVar of options.env || []) {
       parts.push(`--env "${envVar}"`);
     }
+    for (const label of options.labels || []) {
+      parts.push(`--label ${require('./shell-utils').quoteShellArg(label)}`);
+    }
     if (options.privileged) {
       parts.push('--privileged');
     }