Address Copilot review feedback

- Remove the redundant second `TrimEnd('\n')` from the return path.
  The earlier trim already removes any trailing newline before the
  `\n...` doc-end check; the marker-removal substring does not
  re-introduce one, so the second trim was dead code.
- Surface full exception (`ex.ToString()`) in the test round-trip
  helper so YAML parse failures show stack + inner exception, not
  just the top-level message.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.devcontainer/devcontainer.json

@@ -4,7 +4,7 @@
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:2": {},
     "ghcr.io/devcontainers/features/dotnet": {
-      "version": "8.0.420"
+      "version": "8.0.421"
     },
     "ghcr.io/devcontainers/features/node:1": {
       "version": "20"

docs/start/envlinux.md

@@ -25,11 +25,11 @@ The `installdependencies.sh` script should install all required dependencies on
 
 Debian based OS (Debian, Ubuntu, Linux Mint)
 
-- liblttng-ust1 or liblttng-ust0
+- liblttng-ust1t64, liblttng-ust1 or liblttng-ust0
 - libkrb5-3
 - zlib1g
 - libssl3t64, libssl3, libssl1.1, libssl1.0.2 or libssl1.0.0
-- libicu76, libicu75, ..., libicu66, libicu65, libicu63, libicu60, libicu57, libicu55, or libicu52
+- libicu80, libicu79, ..., libicu66, libicu65, libicu63, libicu60, libicu57, libicu55, or libicu52
 
 Fedora based OS (Fedora, Red Hat Enterprise Linux, CentOS, Oracle Linux 7)
 

images/Dockerfile

@@ -5,8 +5,8 @@ ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
 ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=29.4.0
-ARG BUILDX_VERSION=0.33.0
+ARG DOCKER_VERSION=29.5.0
+ARG BUILDX_VERSION=0.34.0
 
 RUN apt update -y && apt install curl unzip -y
 

src/Misc/layoutbin/installdependencies.sh

@@ -94,7 +94,7 @@ then
             fi
         }
 
-        apt_get_with_fallbacks liblttng-ust1 liblttng-ust0
+        apt_get_with_fallbacks liblttng-ust1t64 liblttng-ust1 liblttng-ust0
         if [ $? -ne 0 ]
         then
             echo "'$apt_get' failed with exit code '$?'"
@@ -110,7 +110,7 @@ then
             exit 1
         fi
 
-        apt_get_with_fallbacks libicu76 libicu75 libicu74 libicu73 libicu72 libicu71 libicu70 libicu69 libicu68 libicu67 libicu66 libicu65 libicu63 libicu60 libicu57 libicu55 libicu52
+        apt_get_with_fallbacks libicu80 libicu79 libicu78 libicu77 libicu76 libicu75 libicu74 libicu73 libicu72 libicu71 libicu70 libicu69 libicu68 libicu67 libicu66 libicu65 libicu63 libicu60 libicu57 libicu55 libicu52
         if [ $? -ne 0 ]
         then
             echo "'$apt_get' failed with exit code '$?'"

src/Runner.Common/Constants.cs

@@ -179,6 +179,7 @@ namespace GitHub.Runner.Common
                 public static readonly string EmitCompositeMarkers = "actions_runner_emit_composite_markers";
                 public static readonly string BatchActionResolution = "actions_batch_action_resolution";
                 public static readonly string UseBearerTokenForCodeload = "actions_use_bearer_token_for_codeload";
+                public static readonly string OverrideDebuggerWelcomeMessage = "actions_runner_override_debugger_welcome_message";
             }
 
             // Node version migration related constants

src/Runner.Worker/Dap/DapDebugger.cs

@@ -63,6 +63,7 @@ namespace GitHub.Runner.Worker.Dap
         private volatile DapSessionState _state = DapSessionState.NotStarted;
         private CancellationTokenRegistration? _cancellationRegistration;
         private bool _isFirstStep = true;
+        private bool _welcomeMessageSent;
 
         // Dev Tunnel relay host for remote debugging
         private TunnelRelayTunnelHost _tunnelRelayHost;
@@ -243,6 +244,26 @@ namespace GitHub.Runner.Worker.Dap
         {
             if (_state != DapSessionState.NotStarted)
             {
+                // Pause so the user can inspect final job state before we tear down,
+                // but only if the user was stepping through (not if they hit continue).
+                if (IsActive && _pauseOnNextStep)
+                {
+                    try
+                    {
+                        if (_jobContext != null)
+                        {
+                            Trace.Info("Job completed — pausing for inspection");
+                            SendStoppedEvent("completed", "Job completed — inspect variables before the session ends.");
+
+                            await WaitForCommandAsync(_jobContext.CancellationToken);
+                        }
+                    }
+                    catch (Exception ex)
+                    {
+                        Trace.Warning($"DAP job-completed pause error: {ex.Message}");
+                    }
+                }
+
                 try
                 {
                     OnJobCompleted();
@@ -252,8 +273,6 @@ namespace GitHub.Runner.Worker.Dap
                     Trace.Warning($"DAP OnJobCompleted error: {ex.Message}");
                 }
             }
-
-            await StopAsync();
         }
 
         public async Task StopAsync()
@@ -472,6 +491,11 @@ namespace GitHub.Runner.Worker.Dap
                     });
                     Trace.Info("Sent initialized event");
                 }
+
+                if (request.Command == "configurationDone")
+                {
+                    SendWelcomeMessage();
+                }
             }
             catch (Exception ex)
             {
@@ -490,6 +514,7 @@ namespace GitHub.Runner.Worker.Dap
         internal void HandleClientConnected()
         {
             _isClientConnected = true;
+            _welcomeMessageSent = false;
             Trace.Info("Client connected to debug session");
 
             // If we're paused, re-send the stopped event so the new client
@@ -800,6 +825,34 @@ namespace GitHub.Runner.Worker.Dap
             });
         }
 
+        internal void SendWelcomeMessage()
+        {
+            if (_welcomeMessageSent)
+            {
+                return;
+            }
+            _welcomeMessageSent = true;
+
+            var debuggerConfig = _jobContext?.Global?.Debugger;
+            if (debuggerConfig?.OverrideWelcomeMessage == true)
+            {
+                if (!string.IsNullOrEmpty(debuggerConfig.WelcomeMessage))
+                {
+                    SendOutput("console", debuggerConfig.WelcomeMessage);
+                    Trace.Info("Sent custom welcome message");
+                }
+                else
+                {
+                    Trace.Info("Welcome message suppressed by override");
+                }
+            }
+            else
+            {
+                SendOutput("console", DapReplParser.GetGeneralHelp());
+                Trace.Info("Sent default welcome message");
+            }
+        }
+
         internal async Task OnStepStartingAsync(IStep step, bool isFirstStep)
         {
             bool pauseOnNextStep;
@@ -842,6 +895,9 @@ namespace GitHub.Runner.Worker.Dap
             // Send stopped event to debugger (only if client is connected)
             SendStoppedEvent(reason, description);
 
+            // Emit a banner so the user knows where REPL commands will execute
+            SendExecutionContextBanner();
+
             // Wait for debugger command
             await WaitForCommandAsync(cancellationToken);
         }
@@ -1177,7 +1233,12 @@ namespace GitHub.Runner.Worker.Dap
 
                 case RunCommand run:
                     var context = GetExecutionContextForFrame(frameId);
-                    return await _replExecutor.ExecuteRunCommandAsync(run, context, cancellationToken);
+                    bool isActionStep;
+                    lock (_stateLock)
+                    {
+                        isActionStep = _currentStep is IActionRunner;
+                    }
+                    return await _replExecutor.ExecuteRunCommandAsync(run, context, isActionStep, cancellationToken);
 
                 default:
                     return new EvaluateResponseBody
@@ -1302,6 +1363,13 @@ namespace GitHub.Runner.Worker.Dap
                 _commandTcs = new TaskCompletionSource<DapCommand>(TaskCreationOptions.RunContinuationsAsynchronously);
             }
 
+            // If cancellation already fired before we created the new TCS,
+            // the registration callback targeted the old one. Unblock now.
+            if (cancellationToken.IsCancellationRequested)
+            {
+                _commandTcs.TrySetResult(DapCommand.Disconnect);
+            }
+
             Trace.Info("Waiting for debugger command...");
 
             var command = await _commandTcs.Task;
@@ -1382,6 +1450,40 @@ namespace GitHub.Runner.Worker.Dap
             });
         }
 
+        /// <summary>
+        /// Emits a console output banner telling the user whether REPL
+        /// commands will execute on the host or inside the job container.
+        /// </summary>
+        private void SendExecutionContextBanner()
+        {
+            if (!_isClientConnected)
+            {
+                return;
+            }
+
+            bool isActionStep = _currentStep is IActionRunner;
+            var container = _jobContext?.Global?.Container;
+
+            string target;
+            if (isActionStep && container != null &&
+                (!string.IsNullOrEmpty(container.ContainerId) ||
+                 FeatureManager.IsContainerHooksEnabled(_jobContext?.Global?.Variables)))
+            {
+                var image = container.ContainerImage ?? "container";
+                var shortId = !string.IsNullOrEmpty(container.ContainerId) && container.ContainerId.Length >= 12
+                    ? container.ContainerId.Substring(0, 12)
+                    : container.ContainerId ?? "";
+                var idSuffix = !string.IsNullOrEmpty(shortId) ? $" ({shortId})" : "";
+                target = $"job container: {image}{idSuffix}";
+            }
+            else
+            {
+                target = "runner host";
+            }
+
+            SendOutput("console", $"\nCommands will run on {target}\n");
+        }
+
         private string MaskUserVisibleText(string value)
         {
             if (string.IsNullOrEmpty(value))

src/Runner.Worker/Dap/DapReplExecutor.cs

@@ -9,6 +9,7 @@ using GitHub.DistributedTask.Pipelines.ContextData;
 using GitHub.Runner.Common;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker.Container;
 using GitHub.Runner.Worker.Handlers;
 
 namespace GitHub.Runner.Worker.Dap
@@ -43,6 +44,7 @@ namespace GitHub.Runner.Worker.Dap
         public async Task<EvaluateResponseBody> ExecuteRunCommandAsync(
             RunCommand command,
             IExecutionContext context,
+            bool isActionStep,
             CancellationToken cancellationToken)
         {
             if (context == null)
@@ -52,7 +54,7 @@ namespace GitHub.Runner.Worker.Dap
 
             try
             {
-                return await ExecuteScriptAsync(command, context, cancellationToken);
+                return await ExecuteScriptAsync(command, context, isActionStep, cancellationToken);
             }
             catch (Exception ex)
             {
@@ -65,9 +67,17 @@ namespace GitHub.Runner.Worker.Dap
         private async Task<EvaluateResponseBody> ExecuteScriptAsync(
             RunCommand command,
             IExecutionContext context,
+            bool isActionStep,
             CancellationToken cancellationToken)
         {
-            // 1. Resolve shell — same logic as ScriptHandler
+            // 1. Resolve step host — container or host, same as ActionRunner.
+            //    Only action steps (user-defined run:/uses:) execute inside the
+            //    container.  Infrastructure steps (Set up job, Initialize
+            //    containers, Complete job, etc.) always run on the host.
+            var stepHost = CreateStepHost(context, isActionStep);
+            var isContainerStepHost = stepHost is IContainerStepHost;
+
+            // 2. Resolve shell — same logic as ScriptHandler
             string shellCommand;
             string argFormat;
 
@@ -87,9 +97,9 @@ namespace GitHub.Runner.Worker.Dap
                 argFormat = ScriptHandlerHelpers.GetScriptArgumentsFormat(shellCommand);
             }
 
-            _trace.Info("Resolved REPL shell");
+            _trace.Info($"Resolved REPL shell (container={isContainerStepHost})");
 
-            // 2. Expand ${{ }} expressions in the script body, just like
+            // 3. Expand ${{ }} expressions in the script body, just like
             //    ActionRunner evaluates step inputs before ScriptHandler sees them
             var contents = ExpandExpressions(command.Script, context);
             contents = ScriptHandlerHelpers.FixUpScriptContents(shellCommand, contents);
@@ -111,25 +121,47 @@ namespace GitHub.Runner.Worker.Dap
 
             try
             {
-                // 3. Format arguments with script path
-                var resolvedPath = scriptFilePath.Replace("\"", "\\\"");
+                // 4. Resolve script path — translate for container if needed
+                var resolvedPath = stepHost.ResolvePathForStepHost(context, scriptFilePath).Replace("\"", "\\\"");
                 if (string.IsNullOrEmpty(argFormat) || !argFormat.Contains("{0}"))
                 {
                     return ErrorResult($"Invalid shell option '{shellCommand}'. Shell must be a valid built-in (bash, sh, cmd, powershell, pwsh) or a format string containing '{{0}}'");
                 }
                 var arguments = string.Format(argFormat, resolvedPath);
 
-                // 4. Resolve shell command path
+                // 5. Resolve shell command path — for containers, use the shell
+                //    name directly (it will be resolved inside the container);
+                //    for host execution, resolve the full path on the host.
                 string prependPath = string.Join(
                     Path.PathSeparator.ToString(),
                     Enumerable.Reverse(context.Global.PrependPath));
-                var commandPath = WhichUtil.Which(shellCommand, false, _trace, prependPath)
-                    ?? shellCommand;
+                var fileName = isContainerStepHost
+                    ? shellCommand
+                    : WhichUtil.Which(shellCommand, false, _trace, prependPath) ?? shellCommand;
 
-                // 5. Build environment — merge from execution context like a real step
+                // 6. Build environment — merge from execution context like a real step
                 var environment = BuildEnvironment(context, command.Env);
 
-                // 6. Resolve working directory
+                // 7. Handle PrependPath — mirrors Handler.AddPrependPathToEnvironment
+                if (context.Global.PrependPath.Count > 0)
+                {
+                    if (stepHost is IContainerStepHost containerHost)
+                    {
+                        containerHost.PrependPath = prependPath;
+                    }
+                    else
+                    {
+                        string taskEnvPATH;
+                        environment.TryGetValue(Constants.PathVariable, out taskEnvPATH);
+                        string originalPath = context.Global.Variables?.Get(Constants.PathVariable) ?? // Prefer a job variable.
+                            taskEnvPATH ?? // Then a task-environment variable.
+                            System.Environment.GetEnvironmentVariable(Constants.PathVariable) ?? // Then an environment variable.
+                            string.Empty;
+                        environment[Constants.PathVariable] = PathUtil.PrependPath(prependPath, originalPath);
+                    }
+                }
+
+                // 8. Resolve working directory — translate for container
                 var workingDirectory = command.WorkingDirectory;
                 if (string.IsNullOrEmpty(workingDirectory))
                 {
@@ -141,48 +173,60 @@ namespace GitHub.Runner.Worker.Dap
                         : null;
                     workingDirectory = workspace ?? _hostContext.GetDirectory(WellKnownDirectory.Work);
                 }
+                workingDirectory = stepHost.ResolvePathForStepHost(context, workingDirectory);
 
                 _trace.Info("Executing REPL command");
 
                 // Stream execution info to debugger
                 SendOutput("console", $"$ {shellCommand} {command.Script.Substring(0, Math.Min(command.Script.Length, 80))}{(command.Script.Length > 80 ? "..." : "")}\n");
 
-                // 7. Execute via IProcessInvoker (same as DefaultStepHost)
-                int exitCode;
-                using (var processInvoker = _hostContext.CreateService<IProcessInvoker>())
+                // NOTE: When container hooks are enabled, ContainerStepHost routes
+                // execution through IContainerHookManager which does not raise
+                // OutputDataReceived/ErrorDataReceived events. Output will not be
+                // streamed to the debug console in that mode.
+                if (isContainerStepHost && FeatureManager.IsContainerHooksEnabled(context.Global?.Variables))
                 {
-                    processInvoker.OutputDataReceived += (sender, args) =>
-                    {
-                        if (!string.IsNullOrEmpty(args.Data))
-                        {
-                            var masked = _hostContext.SecretMasker.MaskSecrets(args.Data);
-                            SendOutput("stdout", masked + "\n");
-                        }
-                    };
-
-                    processInvoker.ErrorDataReceived += (sender, args) =>
-                    {
-                        if (!string.IsNullOrEmpty(args.Data))
-                        {
-                            var masked = _hostContext.SecretMasker.MaskSecrets(args.Data);
-                            SendOutput("stderr", masked + "\n");
-                        }
-                    };
-
-                    exitCode = await processInvoker.ExecuteAsync(
-                        workingDirectory: workingDirectory,
-                        fileName: commandPath,
-                        arguments: arguments,
-                        environment: environment,
-                        requireExitCodeZero: false,
-                        outputEncoding: null,
-                        killProcessOnCancel: true,
-                        cancellationToken: cancellationToken);
+                    const string hookWarning = "Container hooks are enabled. REPL output will not be streamed to the debug console for this command.";
+                    _trace.Warning(hookWarning);
+                    SendOutput("stderr", hookWarning + "\n");
                 }
 
+                // 9. Execute via IStepHost — handles docker exec for containers,
+                //    direct process execution for host, and container hooks
+                stepHost.OutputDataReceived += (sender, args) =>
+                {
+                    if (!string.IsNullOrEmpty(args.Data))
+                    {
+                        var masked = _hostContext.SecretMasker.MaskSecrets(args.Data);
+                        SendOutput("stdout", masked + "\n");
+                    }
+                };
+
+                stepHost.ErrorDataReceived += (sender, args) =>
+                {
+                    if (!string.IsNullOrEmpty(args.Data))
+                    {
+                        var masked = _hostContext.SecretMasker.MaskSecrets(args.Data);
+                        SendOutput("stderr", masked + "\n");
+                    }
+                };
+
+                int exitCode = await stepHost.ExecuteAsync(
+                    context: context,
+                    workingDirectory: workingDirectory,
+                    fileName: fileName,
+                    arguments: arguments,
+                    environment: environment,
+                    requireExitCodeZero: false,
+                    outputEncoding: null,
+                    killProcessOnCancel: true,
+                    inheritConsoleHandler: false,
+                    standardInInput: null,
+                    cancellationToken: cancellationToken);
+
                 _trace.Info($"REPL command exited with code {exitCode}");
 
-                // 8. Return only the exit code summary (output was already streamed)
+                // 10. Return only the exit code summary (output was already streamed)
                 return new EvaluateResponseBody
                 {
                     Result = exitCode == 0 ? $"(exit code: {exitCode})" : $"Process completed with exit code {exitCode}.",
@@ -198,6 +242,43 @@ namespace GitHub.Runner.Worker.Dap
             }
         }
 
+        /// <summary>
+        /// Creates the appropriate <see cref="IStepHost"/> for the current
+        /// execution context, mirroring how <see cref="ActionRunner"/> decides
+        /// between host and container execution.
+        ///
+        /// Only action steps (user-defined run:/uses: steps) run inside the
+        /// job container.  Infrastructure steps like "Set up job", "Initialize
+        /// containers", "Stop containers", and "Complete job" always execute
+        /// on the host regardless of whether a container is configured.
+        /// </summary>
+        internal IStepHost CreateStepHost(IExecutionContext context, bool isActionStep)
+        {
+            if (!isActionStep)
+            {
+                _trace.Info("Creating DefaultStepHost for REPL execution (infrastructure step)");
+                return _hostContext.CreateService<IDefaultStepHost>();
+            }
+
+            var container = context?.Global?.Container;
+            if (container != null)
+            {
+                // Container hooks don't always set ContainerId, but the container
+                // step host handles that internally
+                var hooksEnabled = FeatureManager.IsContainerHooksEnabled(context.Global?.Variables);
+                if (hooksEnabled || !string.IsNullOrEmpty(container.ContainerId))
+                {
+                    _trace.Info("Creating ContainerStepHost for REPL execution");
+                    var containerStepHost = _hostContext.CreateService<IContainerStepHost>();
+                    containerStepHost.Container = container;
+                    return containerStepHost;
+                }
+            }
+
+            _trace.Info("Creating DefaultStepHost for REPL execution");
+            return _hostContext.CreateService<IDefaultStepHost>();
+        }
+
         /// <summary>
         /// Expands <c>${{ }}</c> expressions in the input string using the
         /// runner's template evaluator — the same evaluation path that processes

src/Runner.Worker/Dap/DebuggerConfig.cs

@@ -1,4 +1,4 @@
-using GitHub.DistributedTask.Pipelines;
+using GitHub.DistributedTask.Pipelines;
 
 namespace GitHub.Runner.Worker.Dap
 {
@@ -8,10 +8,12 @@ namespace GitHub.Runner.Worker.Dap
     /// </summary>
     public sealed class DebuggerConfig
     {
-        public DebuggerConfig(bool enabled, DebuggerTunnelInfo tunnel)
+        public DebuggerConfig(bool enabled, DebuggerTunnelInfo tunnel, bool overrideWelcomeMessage = false, string welcomeMessage = null)
         {
             Enabled = enabled;
             Tunnel = tunnel;
+            OverrideWelcomeMessage = overrideWelcomeMessage;
+            WelcomeMessage = welcomeMessage;
         }
 
         /// <summary>Whether the debugger is enabled for this job.</summary>
@@ -23,6 +25,19 @@ namespace GitHub.Runner.Worker.Dap
         /// </summary>
         public DebuggerTunnelInfo Tunnel { get; }
 
+        /// <summary>
+        /// When true, the runner overrides the default welcome message with
+        /// <see cref="WelcomeMessage"/>. A null or empty <see cref="WelcomeMessage"/>
+        /// suppresses the message entirely. When false, the default help text is shown.
+        /// </summary>
+        public bool OverrideWelcomeMessage { get; }
+
+        /// <summary>
+        /// Optional welcome message content for the debugger console. Only used when
+        /// <see cref="OverrideWelcomeMessage"/> is true.
+        /// </summary>
+        public string WelcomeMessage { get; }
+
         /// <summary>Whether the tunnel configuration is complete and valid.</summary>
         public bool HasValidTunnel => Tunnel != null
             && !string.IsNullOrEmpty(Tunnel.TunnelId)

src/Runner.Worker/Dap/IDapDebugger.cs

@@ -22,5 +22,6 @@ namespace GitHub.Runner.Worker.Dap
         Task OnStepStartingAsync(IStep step);
         void OnStepCompleted(IStep step);
         Task OnJobCompletedAsync();
+        Task StopAsync();
     }
 }

src/Runner.Worker/Dap/YamlScalarFormatter.cs

@@ -0,0 +1,63 @@
+using System;
+using System.Globalization;
+using System.IO;
+using GitHub.Runner.Sdk;
+using YamlDotNet.Core;
+using YamlDotNet.Core.Events;
+
+namespace GitHub.Runner.Worker.Dap
+{
+    /// <summary>
+    /// Formats a single string as a quote-safe YAML scalar by routing it
+    /// through YamlDotNet's <see cref="Emitter"/>. The returned text is
+    /// safe to splice into a hand-emitted YAML document fragment.
+    ///
+    /// Caller responsibility: this only handles the scalar value; it does
+    /// not emit a key, indent, or trailing newline.
+    /// </summary>
+    internal static class YamlScalarFormatter
+    {
+        /// <summary>
+        /// Return <paramref name="value"/> formatted as a YAML scalar:
+        /// plain, single-quoted, or double-quoted as the emitter chooses,
+        /// with no surrounding document markers or trailing newline.
+        /// </summary>
+        public static string Format(string value)
+        {
+            ArgUtil.NotNull(value, nameof(value));
+
+            using var sw = new StringWriter(CultureInfo.InvariantCulture);
+            // Force LF line breaks; YamlDotNet's Emitter calls WriteLine,
+            // which would otherwise produce CRLF on Windows and break
+            // both our document-end stripping below and downstream
+            // consumers that assume a single line-break convention.
+            sw.NewLine = "\n";
+            var emitter = new Emitter(sw);
+            emitter.Emit(new StreamStart());
+            emitter.Emit(new DocumentStart(null, null, true));
+            emitter.Emit(new Scalar(null, null, value, ScalarStyle.Any, true, true));
+            emitter.Emit(new DocumentEnd(true));
+            emitter.Emit(new StreamEnd());
+
+            string raw = sw.ToString();
+            // Strip YAML document markers. Emitter elides these for most
+            // scalars but emits "--- " (with space) for some edge cases
+            // (e.g. empty strings). Defensively handle "---\n" too.
+            if (raw.StartsWith("--- ", StringComparison.Ordinal))
+            {
+                raw = raw.Substring(4);
+            }
+            else if (raw.StartsWith("---\n", StringComparison.Ordinal))
+            {
+                raw = raw.Substring(4);
+            }
+            raw = raw.TrimEnd('\n');
+            const string DocEndMarker = "\n...";
+            if (raw.EndsWith(DocEndMarker, StringComparison.Ordinal))
+            {
+                raw = raw.Substring(0, raw.Length - DocEndMarker.Length);
+            }
+            return raw;
+        }
+    }
+}

src/Runner.Worker/ExecutionContext.cs

@@ -970,7 +970,8 @@ namespace GitHub.Runner.Worker
             Global.WriteDebug = Global.Variables.Step_Debug ?? false;
 
             // Debugger enabled flag (from acquire response).
-            Global.Debugger = new Dap.DebuggerConfig(message.EnableDebugger, message.DebuggerTunnel);
+            var overrideDebuggerWelcomeMessage = Global.Variables.GetBoolean(Constants.Runner.Features.OverrideDebuggerWelcomeMessage) ?? false;
+            Global.Debugger = new Dap.DebuggerConfig(message.EnableDebugger, message.DebuggerTunnel, overrideDebuggerWelcomeMessage, message.DebuggerWelcomeMessage);
 
             // Hook up JobServerQueueThrottling event, we will log warning on server tarpit.
             _jobServerQueue.JobServerQueueThrottling += JobServerQueueThrottling_EventReceived;

src/Runner.Worker/JobExtension.cs

@@ -16,6 +16,7 @@ using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Common;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker.Dap;
 using GitHub.Services.Common;
 using Newtonsoft.Json;
 using Pipelines = GitHub.DistributedTask.Pipelines;
@@ -50,6 +51,7 @@ namespace GitHub.Runner.Worker
         private Task _diskSpaceCheckTask = null;
         private CancellationTokenSource _serviceConnectivityCheckToken = new();
         private Task _serviceConnectivityCheckTask = null;
+        private IDapDebugger _dapDebugger;
 
         // Download all required actions.
         // Make sure all condition inputs are valid.
@@ -67,6 +69,7 @@ namespace GitHub.Runner.Worker
 
             List<IStep> preJobSteps = new();
             List<IStep> jobSteps = new();
+            var initSucceeded = false;
             using (var register = jobContext.CancellationToken.Register(() => { context.CancelToken(); }))
             {
                 try
@@ -481,6 +484,41 @@ namespace GitHub.Runner.Worker
                     Trace.Info($"Start checking service connectivity in background.");
                     _serviceConnectivityCheckTask = CheckServiceConnectivityAsync(context, _serviceConnectivityCheckToken.Token);
 
+                    // Start the DAP debugger and wait for a client connection inside
+                    // "Set up job" so the step stays in-progress while we wait.
+                    if (jobContext.Global.Debugger?.Enabled == true)
+                    {
+                        Trace.Info("Debugger enabled — starting inside Set up job");
+                        context.Output("Starting debugger…");
+
+                        try
+                        {
+                            _dapDebugger = HostContext.GetService<IDapDebugger>();
+                            await _dapDebugger.StartAsync(jobContext);
+
+                            context.Output("Waiting for debugger client to connect…");
+
+                            await _dapDebugger.WaitUntilReadyAsync();
+                            context.Output("Debugger connected.");
+                            AddDebuggerConnectionTelemetry(jobContext, "Connected");
+                        }
+                        catch (OperationCanceledException) when (jobContext.CancellationToken.IsCancellationRequested)
+                        {
+                            Trace.Info("Job was cancelled before debugger client connected.");
+                            AddDebuggerConnectionTelemetry(jobContext, "Canceled");
+                            context.Error("Job was cancelled before debugger client connected.");
+                            throw;
+                        }
+                        catch (Exception ex)
+                        {
+                            Trace.Error($"DAP debugger failed: {ex.Message}");
+                            AddDebuggerConnectionTelemetry(jobContext, $"Failed: {ex.GetType().Name}");
+                            context.Error("The debugger failed to start or no debugger client connected in time.");
+                            throw;
+                        }
+                    }
+
+                    initSucceeded = true;
                     return steps;
                 }
                 catch (OperationCanceledException ex) when (jobContext.CancellationToken.IsCancellationRequested)
@@ -501,12 +539,36 @@ namespace GitHub.Runner.Worker
                 }
                 finally
                 {
+                    // If InitializeJob failed after the debugger was started,
+                    // tear down the transport here since FinalizeJob won't run.
+                    if (!initSucceeded && _dapDebugger != null)
+                    {
+                        try
+                        {
+                            await _dapDebugger.StopAsync();
+                        }
+                        catch (Exception ex)
+                        {
+                            Trace.Warning($"DAP debugger cleanup during failed init: {ex.Message}");
+                        }
+                        _dapDebugger = null;
+                    }
+
                     context.Debug("Finishing: Set up job");
                     context.Complete();
                 }
             }
         }
 
+        private static void AddDebuggerConnectionTelemetry(IExecutionContext jobContext, string result)
+        {
+            jobContext.Global.JobTelemetry.Add(new JobTelemetry
+            {
+                Type = JobTelemetryType.General,
+                Message = $"DebuggerConnectionResult: {result}"
+            });
+        }
+
         private string GetWorkflowReference(IDictionary<string, VariableValue> variables)
         {
             var reference = "";
@@ -782,6 +844,34 @@ namespace GitHub.Runner.Worker
                 }
                 finally
                 {
+                    // Pause for debugger inspection, then tear down the DAP session.
+                    // OnJobCompletedAsync pauses first, then sends terminated/exited
+                    // events and stops the transport.
+                    if (_dapDebugger != null)
+                    {
+                        context.Output("Job completed — pausing for debugger inspection. Press continue to finish.");
+                        try
+                        {
+                            await _dapDebugger.OnJobCompletedAsync();
+                        }
+                        catch (Exception ex)
+                        {
+                            Trace.Warning($"DAP debugger completion error: {ex.Message}");
+                        }
+                        finally
+                        {
+                            try
+                            {
+                                await _dapDebugger.StopAsync();
+                            }
+                            catch (Exception ex)
+                            {
+                                Trace.Warning($"DAP debugger stop error: {ex.Message}");
+                            }
+                        }
+                        _dapDebugger = null;
+                    }
+
                     context.Debug("Finishing: Complete job");
                     context.Complete();
                 }

src/Runner.Worker/JobRunner.cs

@@ -13,7 +13,6 @@ using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Common;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
-using GitHub.Runner.Worker.Dap;
 using GitHub.Services.Common;
 using GitHub.Services.WebApi;
 using Sdk.RSWebApi.Contracts;
@@ -29,7 +28,6 @@ namespace GitHub.Runner.Worker
 
     public sealed class JobRunner : RunnerService, IJobRunner
     {
-        private const string DebuggerConnectionTelemetryPrefix = "DebuggerConnectionResult";
         private IJobServerQueue _jobServerQueue;
         private RunnerSettings _runnerSettings;
         private ITempDirectoryManager _tempDirectoryManager;
@@ -114,7 +112,6 @@ namespace GitHub.Runner.Worker
 
             IExecutionContext jobContext = null;
             CancellationTokenRegistration? runnerShutdownRegistration = null;
-            IDapDebugger dapDebugger = null;
             try
             {
                 // Create the job execution context.
@@ -181,25 +178,6 @@ namespace GitHub.Runner.Worker
                 _tempDirectoryManager = HostContext.GetService<ITempDirectoryManager>();
                 _tempDirectoryManager.InitializeTempDirectory(jobContext);
 
-                // Setup the debugger
-                if (jobContext.Global.Debugger?.Enabled == true)
-                {
-                    Trace.Info("Debugger enabled for this job run");
-
-                    try
-                    {
-                        dapDebugger = HostContext.GetService<IDapDebugger>();
-                        await dapDebugger.StartAsync(jobContext);
-                    }
-                    catch (Exception ex)
-                    {
-                        Trace.Error($"Failed to start DAP debugger: {ex.Message}");
-                        AddDebuggerConnectionTelemetry(jobContext, $"Failed: {ex.Message}");
-                        jobContext.Error("Failed to start debugger.");
-                        return await CompleteJobAsync(server, jobContext, message, TaskResult.Failed);
-                    }
-                }
-
 
                 // Get the job extension.
                 Trace.Info("Getting job extension.");
@@ -242,33 +220,6 @@ namespace GitHub.Runner.Worker
                     await Task.WhenAny(_jobServerQueue.JobRecordUpdated.Task, Task.Delay(1000));
                 }
 
-                // Wait for DAP debugger client connection and handshake after "Set up job"
-                // so the job page shows the setup step before we block on the debugger
-                if (dapDebugger != null)
-                {
-                    try
-                    {
-                        await dapDebugger.WaitUntilReadyAsync();
-                        AddDebuggerConnectionTelemetry(jobContext, "Connected");
-                    }
-                    catch (OperationCanceledException) when (jobRequestCancellationToken.IsCancellationRequested)
-                    {
-                        Trace.Info("Job was cancelled before debugger client connected.");
-                        AddDebuggerConnectionTelemetry(jobContext, "Canceled");
-                        jobContext.Error("Job was cancelled before debugger client connected.");
-                        return await CompleteJobAsync(server, jobContext, message, TaskResult.Canceled);
-                    }
-                    catch (Exception ex)
-                    {
-                        Trace.Error($"DAP debugger failed to become ready: {ex.Message}");
-                        AddDebuggerConnectionTelemetry(jobContext, $"Failed: {ex.Message}");
-
-                        // If debugging was requested but the debugger is not available, fail the job
-                        jobContext.Error("The debugger failed to start or no debugger client connected in time.");
-                        return await CompleteJobAsync(server, jobContext, message, TaskResult.Failed);
-                    }
-                }
-
                 // Run all job steps
                 Trace.Info("Run all job steps.");
                 var stepsRunner = HostContext.GetService<IStepsRunner>();
@@ -309,11 +260,6 @@ namespace GitHub.Runner.Worker
                     runnerShutdownRegistration = null;
                 }
 
-                if (dapDebugger != null)
-                {
-                    await dapDebugger.OnJobCompletedAsync();
-                }
-
                 await ShutdownQueue(throwOnFailure: false);
             }
         }
@@ -495,15 +441,6 @@ namespace GitHub.Runner.Worker
             throw new AggregateException(exceptions);
         }
 
-        private static void AddDebuggerConnectionTelemetry(IExecutionContext jobContext, string result)
-        {
-            jobContext.Global.JobTelemetry.Add(new JobTelemetry
-            {
-                Type = JobTelemetryType.General,
-                Message = $"{DebuggerConnectionTelemetryPrefix}: {result}"
-            });
-        }
-
         private void MaskTelemetrySecrets(List<JobTelemetry> jobTelemetry)
         {
             foreach (var telemetryItem in jobTelemetry)

src/Sdk/DTPipelines/Pipelines/AgentJobRequestMessage.cs

@@ -267,6 +267,21 @@ namespace GitHub.DistributedTask.Pipelines
             set;
         }
 
+        /// <summary>
+        /// Optional welcome message shown in the debugger console when a client connects.
+        /// Only used when the <c>actions_runner_override_debugger_welcome_message</c>
+        /// feature flag is set to <c>true</c> in the job variables. With the flag set,
+        /// a non-empty value is shown as-is and a null or empty value suppresses the
+        /// default welcome message. When the flag is not set, the runner shows its
+        /// built-in help text and this field is ignored.
+        /// </summary>
+        [DataMember(EmitDefaultValue = false)]
+        public string DebuggerWelcomeMessage
+        {
+            get;
+            set;
+        }
+
         /// <summary>
         /// Gets the workflow-level action dependencies (lockfile entries)
         /// </summary>

src/Test/L0/Sdk/RSWebApi/AgentJobRequestMessageL0.cs

@@ -1,4 +1,4 @@
-using System.Collections.Generic;
+using System.Collections.Generic;
 using System.IO;
 using System.Runtime.Serialization.Json;
 using System.Text;
@@ -17,13 +17,13 @@ public sealed class AgentJobRequestMessageL0
         // Arrange
         var serializer = new DataContractJsonSerializer(typeof(AgentJobRequestMessage));
         string jsonWithEnabledDebugger = DoubleQuotify("{'EnableDebugger': true}");
-        
+
         // Act
         using var stream = new MemoryStream();
         stream.Write(Encoding.UTF8.GetBytes(jsonWithEnabledDebugger));
         stream.Position = 0;
         var recoveredMessage = serializer.ReadObject(stream) as AgentJobRequestMessage;
-        
+
         // Assert
         Assert.NotNull(recoveredMessage);
         Assert.True(recoveredMessage.EnableDebugger, "EnableDebugger should be true when JSON contains 'EnableDebugger': true");
@@ -37,13 +37,13 @@ public sealed class AgentJobRequestMessageL0
         // Arrange
         var serializer = new DataContractJsonSerializer(typeof(AgentJobRequestMessage));
         string jsonWithoutDebugger = DoubleQuotify("{'messageType': 'PipelineAgentJobRequest'}");
-        
+
         // Act
         using var stream = new MemoryStream();
         stream.Write(Encoding.UTF8.GetBytes(jsonWithoutDebugger));
         stream.Position = 0;
         var recoveredMessage = serializer.ReadObject(stream) as AgentJobRequestMessage;
-        
+
         // Assert
         Assert.NotNull(recoveredMessage);
         Assert.False(recoveredMessage.EnableDebugger, "EnableDebugger should default to false when JSON field is absent");
@@ -57,13 +57,13 @@ public sealed class AgentJobRequestMessageL0
         // Arrange
         var serializer = new DataContractJsonSerializer(typeof(AgentJobRequestMessage));
         string jsonWithDisabledDebugger = DoubleQuotify("{'EnableDebugger': false}");
-        
+
         // Act
         using var stream = new MemoryStream();
         stream.Write(Encoding.UTF8.GetBytes(jsonWithDisabledDebugger));
         stream.Position = 0;
         var recoveredMessage = serializer.ReadObject(stream) as AgentJobRequestMessage;
-        
+
         // Assert
         Assert.NotNull(recoveredMessage);
         Assert.False(recoveredMessage.EnableDebugger, "EnableDebugger should be false when JSON contains 'EnableDebugger': false");
@@ -161,6 +161,26 @@ public sealed class AgentJobRequestMessageL0
         Assert.Empty(recoveredMessage.ActionsDependencies);
     }
 
+    [Fact]
+    [Trait("Level", "L0")]
+    [Trait("Category", "Common")]
+    public void VerifyDebuggerWelcomeMessageRoundTrips()
+    {
+        // Arrange
+        var serializer = new DataContractJsonSerializer(typeof(AgentJobRequestMessage));
+        string json = DoubleQuotify("{'DebuggerWelcomeMessage': 'Welcome to debugging!'}");
+
+        // Act
+        using var stream = new MemoryStream();
+        stream.Write(Encoding.UTF8.GetBytes(json));
+        stream.Position = 0;
+        var recoveredMessage = serializer.ReadObject(stream) as AgentJobRequestMessage;
+
+        // Assert
+        Assert.NotNull(recoveredMessage);
+        Assert.Equal("Welcome to debugging!", recoveredMessage.DebuggerWelcomeMessage);
+    }
+
     private static string DoubleQuotify(string text)
     {
         return text.Replace('\'', '"');

src/Test/L0/Worker/DapDebuggerL0.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.IO;
 using System.Net;
 using System.Net.Sockets;
@@ -236,7 +236,7 @@ namespace GitHub.Runner.Common.Tests.Worker
             }
         }
 
-        private static Mock<IExecutionContext> CreateJobContextWithTunnel(CancellationToken cancellationToken, ushort port, string jobName = null)
+        private static Mock<IExecutionContext> CreateJobContextWithTunnel(CancellationToken cancellationToken, ushort port, string jobName = null, bool overrideWelcomeMessage = false, string welcomeMessage = null)
         {
             var tunnel = new GitHub.DistributedTask.Pipelines.DebuggerTunnelInfo
             {
@@ -245,7 +245,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 HostToken = "test-token",
                 Port = port
             };
-            var debuggerConfig = new DebuggerConfig(true, tunnel);
+            var debuggerConfig = new DebuggerConfig(true, tunnel, overrideWelcomeMessage, welcomeMessage);
             var jobContext = new Mock<IExecutionContext>();
             jobContext.Setup(x => x.CancellationToken).Returns(cancellationToken);
             jobContext.Setup(x => x.Global).Returns(new GlobalContext { Debugger = debuggerConfig });
@@ -742,16 +742,36 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 // Read the configurationDone response
                 await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                // Read the welcome message output event
+                await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
                 await waitTask;
 
-                // Complete the job — events are sent via OnJobCompletedAsync
-                await _debugger.OnJobCompletedAsync();
+                // Complete the job — OnJobCompletedAsync pauses when stepping,
+                // so run it in the background and send continue to unblock.
+                var completedTask = _debugger.OnJobCompletedAsync();
 
-                var msg1 = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
-                var msg2 = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                // Read the stopped event from the pause
+                var stoppedMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"event\":\"stopped\"", stoppedMsg);
 
-                // Both events should arrive (order may vary)
-                var combined = msg1 + msg2;
+                // Send continue to unblock the pause
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 2,
+                    Type = "request",
+                    Command = "continue"
+                });
+
+                await completedTask;
+
+                // Read remaining messages — continue response + continued event + terminated + exited
+                var allMessages = new System.Text.StringBuilder();
+                for (int i = 0; i < 4; i++)
+                {
+                    allMessages.Append(await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5)));
+                }
+
+                var combined = allMessages.ToString();
                 Assert.Contains("\"event\":\"terminated\"", combined);
                 Assert.Contains("\"event\":\"exited\"", combined);
             }
@@ -809,5 +829,266 @@ namespace GitHub.Runner.Common.Tests.Worker
                 });
             }
         }
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task WaitForCommandAsyncUnblocksOnCancellationDuringWait()
+        {
+            using (CreateTestContext())
+            {
+                var port = GetFreePort();
+                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var jobContext = CreateJobContextWithTunnel(cts.Token, port);
+                await _debugger.StartAsync(jobContext.Object);
+
+                var waitTask = _debugger.WaitUntilReadyAsync();
+                using var client = await ConnectClientAsync(port);
+                var stream = client.GetStream();
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 1,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                // Read the welcome message output event
+                await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                await waitTask;
+
+                // Start OnJobCompletedAsync — it will pause because _pauseOnNextStep is true
+                var completedTask = _debugger.OnJobCompletedAsync();
+
+                // Read the stopped event
+                var stoppedMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"event\":\"stopped\"", stoppedMsg);
+
+                // Cancel the job while waiting — should unblock the pause
+                cts.Cancel();
+
+                // OnJobCompletedAsync should complete without hanging
+                var finished = await Task.WhenAny(completedTask, Task.Delay(TimeSpan.FromSeconds(5)));
+                Assert.Equal(completedTask, finished);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task WelcomeMessageSendsDefaultHelpWhenOverrideDisabled()
+        {
+            using (CreateTestContext())
+            {
+                var port = GetFreePort();
+                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var jobContext = CreateJobContextWithTunnel(cts.Token, port);
+                await _debugger.StartAsync(jobContext.Object);
+
+                using var client = await ConnectClientAsync(port);
+                var stream = client.GetStream();
+
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 1,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                // First message: configurationDone response
+                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
+
+                // Second message: welcome output event with default help text
+                var welcomeMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"event\":\"output\"", welcomeMsg);
+                Assert.Contains("\"category\":\"console\"", welcomeMsg);
+                Assert.Contains("Actions Debug Console", welcomeMsg);
+                Assert.Contains("help", welcomeMsg);
+
+                await _debugger.StopAsync();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task WelcomeMessageShowsCustomMessageWhenOverrideEnabled()
+        {
+            using (CreateTestContext())
+            {
+                var port = GetFreePort();
+                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var jobContext = CreateJobContextWithTunnel(cts.Token, port,
+                    overrideWelcomeMessage: true,
+                    welcomeMessage: "Welcome to debugging!");
+                await _debugger.StartAsync(jobContext.Object);
+
+                using var client = await ConnectClientAsync(port);
+                var stream = client.GetStream();
+
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 1,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                // First: configurationDone response
+                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
+
+                // Second: custom welcome message
+                var welcomeMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"event\":\"output\"", welcomeMsg);
+                Assert.Contains("Welcome to debugging!", welcomeMsg);
+
+                await _debugger.StopAsync();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task WelcomeMessageSuppressedWhenOverrideEnabledWithEmptyMessage()
+        {
+            using (CreateTestContext())
+            {
+                var port = GetFreePort();
+                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var jobContext = CreateJobContextWithTunnel(cts.Token, port,
+                    overrideWelcomeMessage: true,
+                    welcomeMessage: "");
+                await _debugger.StartAsync(jobContext.Object);
+
+                using var client = await ConnectClientAsync(port);
+                var stream = client.GetStream();
+
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 1,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                // Read configurationDone response
+                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
+
+                // Send threads request — if welcome message was suppressed, this
+                // should be the next response (no output event in between)
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 2,
+                    Type = "request",
+                    Command = "threads"
+                });
+
+                var threadsResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"threads\"", threadsResponse);
+
+                await _debugger.StopAsync();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task WelcomeMessageSuppressedWhenOverrideEnabledWithNullMessage()
+        {
+            using (CreateTestContext())
+            {
+                var port = GetFreePort();
+                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var jobContext = CreateJobContextWithTunnel(cts.Token, port,
+                    overrideWelcomeMessage: true,
+                    welcomeMessage: null);
+                await _debugger.StartAsync(jobContext.Object);
+
+                using var client = await ConnectClientAsync(port);
+                var stream = client.GetStream();
+
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 1,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                // Read configurationDone response
+                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
+
+                // Send threads request — if welcome message was suppressed, this
+                // should be the next response (no output event in between)
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 2,
+                    Type = "request",
+                    Command = "threads"
+                });
+
+                var threadsResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"threads\"", threadsResponse);
+
+                await _debugger.StopAsync();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task WelcomeMessageSentOnlyOnce()
+        {
+            using (CreateTestContext())
+            {
+                var port = GetFreePort();
+                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var jobContext = CreateJobContextWithTunnel(cts.Token, port);
+                await _debugger.StartAsync(jobContext.Object);
+
+                using var client = await ConnectClientAsync(port);
+                var stream = client.GetStream();
+
+                // First configurationDone
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 1,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
+
+                // Welcome message should appear
+                var welcomeMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"event\":\"output\"", welcomeMsg);
+                Assert.Contains("Actions Debug Console", welcomeMsg);
+
+                // Second configurationDone — should NOT produce another welcome message
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 2,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                var secondResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"configurationDone\"", secondResponse);
+
+                // Next message should be threads response, not another welcome output
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 3,
+                    Type = "request",
+                    Command = "threads"
+                });
+
+                var threadsResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"threads\"", threadsResponse);
+
+                await _debugger.StopAsync();
+            }
+        }
     }
 }

src/Test/L0/Worker/DapReplExecutorL0.cs

@@ -5,9 +5,12 @@ using System.Threading;
 using System.Threading.Tasks;
 using GitHub.DistributedTask.Expressions2;
 using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Common.Tests;
 using GitHub.Runner.Worker;
+using GitHub.Runner.Worker.Container;
 using GitHub.Runner.Worker.Dap;
+using GitHub.Runner.Worker.Handlers;
 using Moq;
 using Xunit;
 
@@ -40,7 +43,8 @@ namespace GitHub.Runner.Common.Tests.Worker
 
         private Mock<IExecutionContext> CreateMockContext(
             DictionaryContextData exprValues = null,
-            IDictionary<string, IDictionary<string, string>> jobDefaults = null)
+            IDictionary<string, IDictionary<string, string>> jobDefaults = null,
+            ContainerInfo container = null)
         {
             var mock = new Mock<IExecutionContext>();
             mock.Setup(x => x.ExpressionValues).Returns(exprValues ?? new DictionaryContextData());
@@ -51,6 +55,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 PrependPath = new List<string>(),
                 JobDefaults = jobDefaults
                     ?? new Dictionary<string, IDictionary<string, string>>(StringComparer.OrdinalIgnoreCase),
+                Container = container,
             };
             mock.Setup(x => x.Global).Returns(global);
 
@@ -65,7 +70,7 @@ namespace GitHub.Runner.Common.Tests.Worker
             using (CreateTestContext())
             {
                 var command = new RunCommand { Script = "echo hello" };
-                var result = await _executor.ExecuteRunCommandAsync(command, null, CancellationToken.None);
+                var result = await _executor.ExecuteRunCommandAsync(command, null, false, CancellationToken.None);
 
                 Assert.Equal("error", result.Type);
                 Assert.Contains("No execution context available", result.Result);
@@ -233,5 +238,101 @@ namespace GitHub.Runner.Common.Tests.Worker
                 Assert.False(result.ContainsKey("BAZ"));
             }
         }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void CreateStepHost_NoContainer_ReturnsDefaultStepHost()
+        {
+            using (var hc = CreateTestContext())
+            {
+                hc.EnqueueInstance<IDefaultStepHost>(new DefaultStepHost());
+                var context = CreateMockContext();
+                var result = _executor.CreateStepHost(context.Object, isActionStep: true);
+
+                Assert.IsType<DefaultStepHost>(result);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void CreateStepHost_WithContainer_ActionStep_ReturnsContainerStepHost()
+        {
+            using (var hc = CreateTestContext())
+            {
+                hc.EnqueueInstance<IContainerStepHost>(new ContainerStepHost());
+                var container = new ContainerInfo { ContainerId = "abc123" };
+                var context = CreateMockContext(container: container);
+                var result = _executor.CreateStepHost(context.Object, isActionStep: true);
+
+                Assert.IsType<ContainerStepHost>(result);
+                var containerHost = (ContainerStepHost)result;
+                Assert.Same(container, containerHost.Container);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void CreateStepHost_WithContainer_InfrastructureStep_ReturnsDefaultStepHost()
+        {
+            using (var hc = CreateTestContext())
+            {
+                hc.EnqueueInstance<IDefaultStepHost>(new DefaultStepHost());
+                var container = new ContainerInfo { ContainerId = "abc123" };
+                var context = CreateMockContext(container: container);
+                var result = _executor.CreateStepHost(context.Object, isActionStep: false);
+
+                Assert.IsType<DefaultStepHost>(result);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void CreateStepHost_ContainerWithoutId_NoHooks_ReturnsDefaultStepHost()
+        {
+            using (var hc = CreateTestContext())
+            {
+                hc.EnqueueInstance<IDefaultStepHost>(new DefaultStepHost());
+                // Container exists but hasn't been started yet (no ContainerId)
+                var container = new ContainerInfo();
+                var context = CreateMockContext(container: container);
+                var result = _executor.CreateStepHost(context.Object, isActionStep: true);
+
+                Assert.IsType<DefaultStepHost>(result);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void CreateStepHost_ContainerWithoutId_HooksEnabled_ReturnsContainerStepHost()
+        {
+            using (var hc = CreateTestContext())
+            {
+                hc.EnqueueInstance<IContainerStepHost>(new ContainerStepHost());
+                // Container hooks need both the feature flag and the env var
+                Environment.SetEnvironmentVariable("ACTIONS_RUNNER_CONTAINER_HOOKS", "/some/hook/path");
+                try
+                {
+                    var container = new ContainerInfo();
+                    var context = CreateMockContext(container: container);
+                    context.Object.Global.Variables = new Variables(
+                        hc,
+                        new Dictionary<string, VariableValue>
+                        {
+                            { Constants.Runner.Features.AllowRunnerContainerHooks, new VariableValue("true") }
+                        });
+                    var result = _executor.CreateStepHost(context.Object, isActionStep: true);
+                    Assert.IsAssignableFrom<IContainerStepHost>(result);
+                }
+                finally
+                {
+                    Environment.SetEnvironmentVariable("ACTIONS_RUNNER_CONTAINER_HOOKS", null);
+                }
+            }
+        }
     }
 }

src/Test/L0/Worker/JobExtensionL0.cs

@@ -760,5 +760,171 @@ namespace GitHub.Runner.Common.Tests.Worker
             Environment.SetEnvironmentVariable("RUNNER_ENVIRONMENT", null);
             Environment.SetEnvironmentVariable("GITHUB_ACTIONS_IMAGE_GEN_ENABLED", null);
         }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task DebuggerStartedInSetupJobWhenEnabled()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                var jobExtension = new JobExtension();
+                jobExtension.Initialize(hc);
+
+                // Enable debugger on the message
+                _message.EnableDebugger = true;
+                _message.DebuggerTunnel = new Pipelines.DebuggerTunnelInfo
+                {
+                    TunnelId = "test-tunnel",
+                    ClusterId = "test-cluster",
+                    HostToken = "test-token",
+                    Port = 9229
+                };
+
+                // Re-initialize the execution context so it picks up debugger config
+                _jobEc = new Runner.Worker.ExecutionContext();
+                _jobEc.Initialize(hc);
+                _jobEc.InitializeJob(_message, _tokenSource.Token);
+
+                // Set up mock debugger
+                var mockDebugger = new Mock<IDapDebugger>();
+                mockDebugger.Setup(x => x.StartAsync(It.IsAny<IExecutionContext>())).Returns(Task.CompletedTask);
+                mockDebugger.Setup(x => x.WaitUntilReadyAsync()).Returns(Task.CompletedTask);
+                hc.SetSingleton(mockDebugger.Object);
+
+                _actionManager.Setup(x => x.PrepareActionsAsync(It.IsAny<IExecutionContext>(), It.IsAny<IEnumerable<Pipelines.JobStep>>(), It.IsAny<Guid>()))
+                              .Returns(Task.FromResult(new PrepareResult(new List<JobExtensionRunner>(), new Dictionary<Guid, IActionRunner>())));
+
+                List<IStep> result = await jobExtension.InitializeJob(_jobEc, _message);
+
+                // Verify DAP debugger was started and waited on
+                mockDebugger.Verify(x => x.StartAsync(It.IsAny<IExecutionContext>()), Times.Once);
+                mockDebugger.Verify(x => x.WaitUntilReadyAsync(), Times.Once);
+
+                // Verify steps are still returned correctly
+                Assert.Equal(5, result.Count);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task DebuggerNotStartedInSetupJobWhenDisabled()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                var jobExtension = new JobExtension();
+                jobExtension.Initialize(hc);
+
+                // Debugger NOT enabled on the message — should not be started
+
+                // Set up mock debugger (should NOT be called)
+                var mockDebugger = new Mock<IDapDebugger>();
+                hc.SetSingleton(mockDebugger.Object);
+
+                _actionManager.Setup(x => x.PrepareActionsAsync(It.IsAny<IExecutionContext>(), It.IsAny<IEnumerable<Pipelines.JobStep>>(), It.IsAny<Guid>()))
+                              .Returns(Task.FromResult(new PrepareResult(new List<JobExtensionRunner>(), new Dictionary<Guid, IActionRunner>())));
+
+                List<IStep> result = await jobExtension.InitializeJob(_jobEc, _message);
+
+                // Verify DAP debugger was NOT started during setup job
+                mockDebugger.Verify(x => x.StartAsync(It.IsAny<IExecutionContext>()), Times.Never);
+                mockDebugger.Verify(x => x.WaitUntilReadyAsync(), Times.Never);
+
+                Assert.Equal(5, result.Count);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task DebuggerCleanedUpInFinalizeJob()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                var jobExtension = new JobExtension();
+                jobExtension.Initialize(hc);
+
+                // Enable debugger on the message
+                _message.EnableDebugger = true;
+                _message.DebuggerTunnel = new Pipelines.DebuggerTunnelInfo
+                {
+                    TunnelId = "test-tunnel",
+                    ClusterId = "test-cluster",
+                    HostToken = "test-token",
+                    Port = 9229
+                };
+
+                // Re-initialize the execution context so it picks up debugger config
+                _jobEc = new Runner.Worker.ExecutionContext();
+                _jobEc.Initialize(hc);
+                _jobEc.InitializeJob(_message, _tokenSource.Token);
+
+                // Set up mock debugger
+                var mockDebugger = new Mock<IDapDebugger>();
+                mockDebugger.Setup(x => x.StartAsync(It.IsAny<IExecutionContext>())).Returns(Task.CompletedTask);
+                mockDebugger.Setup(x => x.WaitUntilReadyAsync()).Returns(Task.CompletedTask);
+                mockDebugger.Setup(x => x.OnJobCompletedAsync()).Returns(Task.CompletedTask);
+                hc.SetSingleton(mockDebugger.Object);
+
+                _actionManager.Setup(x => x.PrepareActionsAsync(It.IsAny<IExecutionContext>(), It.IsAny<IEnumerable<Pipelines.JobStep>>(), It.IsAny<Guid>()))
+                              .Returns(Task.FromResult(new PrepareResult(new List<JobExtensionRunner>(), new Dictionary<Guid, IActionRunner>())));
+
+                // Run InitializeJob to start the debugger
+                await jobExtension.InitializeJob(_jobEc, _message);
+
+                // Run FinalizeJob — should pause (inside OnJobCompletedAsync) then clean up
+                await jobExtension.FinalizeJob(_jobEc, _message, DateTime.UtcNow);
+
+                // Verify OnJobCompletedAsync was called (it handles pause + cleanup)
+                mockDebugger.Verify(x => x.OnJobCompletedAsync(), Times.Once);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task FinalizeJobHandlesDebuggerCleanupException()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                var jobExtension = new JobExtension();
+                jobExtension.Initialize(hc);
+
+                // Enable debugger on the message
+                _message.EnableDebugger = true;
+                _message.DebuggerTunnel = new Pipelines.DebuggerTunnelInfo
+                {
+                    TunnelId = "test-tunnel",
+                    ClusterId = "test-cluster",
+                    HostToken = "test-token",
+                    Port = 9229
+                };
+
+                // Re-initialize the execution context so it picks up debugger config
+                _jobEc = new Runner.Worker.ExecutionContext();
+                _jobEc.Initialize(hc);
+                _jobEc.InitializeJob(_message, _tokenSource.Token);
+
+                // Set up mock debugger — OnJobCompletedAsync throws
+                var mockDebugger = new Mock<IDapDebugger>();
+                mockDebugger.Setup(x => x.StartAsync(It.IsAny<IExecutionContext>())).Returns(Task.CompletedTask);
+                mockDebugger.Setup(x => x.WaitUntilReadyAsync()).Returns(Task.CompletedTask);
+                mockDebugger.Setup(x => x.OnJobCompletedAsync()).ThrowsAsync(new InvalidOperationException("tunnel disposed"));
+                mockDebugger.Setup(x => x.StopAsync()).Returns(Task.CompletedTask);
+                hc.SetSingleton(mockDebugger.Object);
+
+                _actionManager.Setup(x => x.PrepareActionsAsync(It.IsAny<IExecutionContext>(), It.IsAny<IEnumerable<Pipelines.JobStep>>(), It.IsAny<Guid>()))
+                              .Returns(Task.FromResult(new PrepareResult(new List<JobExtensionRunner>(), new Dictionary<Guid, IActionRunner>())));
+
+                await jobExtension.InitializeJob(_jobEc, _message);
+
+                // FinalizeJob should not throw even when OnJobCompletedAsync throws
+                await jobExtension.FinalizeJob(_jobEc, _message, DateTime.UtcNow);
+
+                mockDebugger.Verify(x => x.OnJobCompletedAsync(), Times.Once);
+                mockDebugger.Verify(x => x.StopAsync(), Times.Once);
+            }
+        }
     }
 }

src/Test/L0/Worker/YamlScalarFormatterL0.cs

@@ -0,0 +1,119 @@
+using System;
+using System.Collections.Generic;
+using GitHub.Runner.Worker.Dap;
+using Xunit;
+using YamlDotNet.Serialization;
+
+namespace GitHub.Runner.Common.Tests.Worker
+{
+    public sealed class YamlScalarFormatterL0
+    {
+        private static readonly IDeserializer Deserializer = new DeserializerBuilder().Build();
+
+        // Embed the formatter output inside a minimal YAML mapping and
+        // round-trip through YamlDotNet, asserting the parsed value equals
+        // the original input. Decouples assertions from the emitter's
+        // quoting choices (plain vs single- vs double-quoted).
+        private static void AssertRoundTrips(string value)
+        {
+            string scalar = YamlScalarFormatter.Format(value);
+            string yaml = $"k: {scalar}\n";
+
+            Dictionary<string, object> doc;
+            try
+            {
+                doc = Deserializer.Deserialize<Dictionary<string, object>>(yaml);
+            }
+            catch (Exception ex)
+            {
+                throw new Xunit.Sdk.XunitException(
+                    $"Formatted scalar did not round-trip as valid YAML.\nInput: '{value}'\nFormatted: '{scalar}'\nFull YAML:\n{yaml}\nError: {ex}");
+            }
+            Assert.NotNull(doc);
+            Assert.True(doc.ContainsKey("k"), $"missing key in parsed doc. Formatted: '{scalar}'");
+            Assert.Equal(value, doc["k"] as string);
+        }
+
+        [Theory]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        [InlineData("hello")]
+        [InlineData("with: colon")]
+        [InlineData("with#hash")]
+        [InlineData(" leading")]
+        [InlineData("trailing ")]
+        [InlineData("a\"b")]
+        [InlineData("a\\b")]
+        [InlineData("@at")]
+        [InlineData("*star")]
+        [InlineData("&amp")]
+        [InlineData("?question")]
+        [InlineData("!exclaim")]
+        [InlineData("- dash")]
+        [InlineData("{brace}")]
+        [InlineData("[bracket]")]
+        public void Format_RoundTripsThroughYamlDeserializer(string value)
+        {
+            // The formatter must produce output that, embedded under a key,
+            // parses back to exactly the input. The emitter is free to
+            // pick plain, single-quoted, or double-quoted style.
+            AssertRoundTrips(value);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Format_PlainAscii_NoQuotingNeeded()
+        {
+            // Sanity check that the simple case stays plain.
+            Assert.Equal("hello", YamlScalarFormatter.Format("hello"));
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Format_NoTrailingNewline()
+        {
+            Assert.False(YamlScalarFormatter.Format("hello").EndsWith("\n"));
+            Assert.False(YamlScalarFormatter.Format("with: colon").EndsWith("\n"));
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Format_NoDocumentMarkers()
+        {
+            // The emitter wraps the scalar in a document; the formatter
+            // must strip both `--- ` (with space) and `---\n` (on its
+            // own line) prefixes plus the `\n...` suffix.
+            Assert.DoesNotContain("---", YamlScalarFormatter.Format("hello"));
+            Assert.DoesNotContain("...", YamlScalarFormatter.Format("hello"));
+            // Empty string is one of the cases where the emitter does
+            // produce a document marker by default.
+            Assert.DoesNotContain("---", YamlScalarFormatter.Format(""));
+            Assert.DoesNotContain("...", YamlScalarFormatter.Format(""));
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Format_AlwaysUsesLfLineBreaks()
+        {
+            // Regression: YamlDotNet's Emitter calls WriteLine, which on
+            // Windows produces CRLF (the host's Environment.NewLine).
+            // Format must force LF so the output round-trips regardless
+            // of platform.
+            Assert.DoesNotContain('\r', YamlScalarFormatter.Format("hello"));
+            Assert.DoesNotContain('\r', YamlScalarFormatter.Format("with: colon"));
+            Assert.DoesNotContain('\r', YamlScalarFormatter.Format(""));
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Format_NullValue_Throws()
+        {
+            Assert.Throws<ArgumentNullException>(() => YamlScalarFormatter.Format(null));
+        }
+    }
+}

src/dev.sh

@@ -17,7 +17,7 @@ LAYOUT_DIR="$SCRIPT_DIR/../_layout"
 DOWNLOAD_DIR="$SCRIPT_DIR/../_downloads/netcore2x"
 PACKAGE_DIR="$SCRIPT_DIR/../_package"
 DOTNETSDK_ROOT="$SCRIPT_DIR/../_dotnetsdk"
-DOTNETSDK_VERSION="8.0.420"
+DOTNETSDK_VERSION="8.0.421"
 DOTNETSDK_INSTALLDIR="$DOTNETSDK_ROOT/$DOTNETSDK_VERSION"
 RUNNER_VERSION=$(cat runnerversion)
 

src/global.json

@@ -1,5 +1,5 @@
 {
   "sdk": {
-    "version": "8.0.420"
+    "version": "8.0.421"
   }
 }