@outerlayer/cli 0.10.1 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @outerlayer/cli
 
+## 0.11.0
+
+### Minor Changes
+
+- b248d4f: A container or microVM build now checks out every repository connected to the factory. The primary stays at `/build/work/checkout`, and each other repository is cloned to `/build/work/repos/<owner>/<repo>` on its claim branch. `OUTERLAYER_REPOSITORIES` lists each repository with its path, branch and whether it is primary. `outerlayer work open-pr --repository <owner/name>` opens a pull request in any repository the claim names. The runner protocol is now 16: a gateway refuses an older runner a claim over more than one repository.
+- 4b30f06: A runner with an update pending now keeps taking work while a build runs, and updates the first time no build is running. It holds new work only when the gateway refuses its version or the update has waited longer than `runner.update.maxWaitHours` (default 6, `0` holds at once). The runner logs when an update is pending and when it starts holding work, and `outerlayer runner status` shows the pending version and the builds the runner waits for.
+
+## 0.10.2
+
+### Patch Changes
+
+- 4e309ad: `outerlayer init` now also adds the OuterLayer docs MCP server, `outerlayer-docs` at `https://docs.outerlayer.ai/mcp`, beside the `outerlayer` one, so your coding agent can look up how OuterLayer works. It goes into the same file, `.mcp.json` or `.outerlayer/mcp.json`, and an entry of that name already there is left as it is. `outerlayer mcp install` is unchanged.
+- a1b7ec0: `outerlayer work list --startable` help now says what makes an item startable: a build request, no open pull request, and no live lease. An item with an open pull request is no longer offered to the implement queue. `outerlayer work build --item <n>` on such an item reruns the amend when a review waits on an agent, and is otherwise refused with `nothing_to_rerun`.
+- 854a747: A runner now updates itself to a release that has no npm provenance attestation. The tarball must still match the registry's digest and pass `npm audit signatures`. An attestation that is present must still name this repository's release workflow and cover the same tarball, and one that cannot be read refuses the release.
+
 ## 0.10.1
 
 ### Patch Changes

package/dist/{agent-setup-ODTDC3US.js → agent-setup-YEFN74Y4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { addStdioMcpEntryIfAbsent } from './chunk-47RS42OZ.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-A56PYPDF.js';
 import { installStarterPack } from './chunk-SUMWRA7K.js';
 import { runEmit } from './chunk-YU5GL7QS.js';
 import { C } from './chunk-YRYMNBGQ.js';
@@ -119,6 +119,9 @@ function runAgentSetup(opts) {
     const mcp = addStdioMcpEntryIfAbsent(repoRoot);
     if (mcp.added) written.add(mcp.path);
     else kept.push(`${mcp.path} (already has an outerlayer server)`);
+    const docs = addDocsMcpEntryIfAbsent(repoRoot);
+    if (docs.added) written.add(docs.path);
+    else kept.push(`${docs.path} (already has an ${DOCS_MCP_SERVER_NAME} server)`);
   } catch (err) {
     problems.push(errorMessage(err));
   }
@@ -186,9 +189,9 @@ function renderPaths(paths, kept) {
 `;
 }
 function renderDone(paths, kept, mcpKept) {
-  const mcpNote = mcpKept ? `  ${C.yellow}!${C.reset} The outerlayer entry was not added to .mcp.json, so its MCP server is not set up. Add it to .mcp.json by hand, or move the servers you wrote into .outerlayer/mcp.json and run \`outerlayer context emit\`.
+  const mcpNote = mcpKept ? `  ${C.yellow}!${C.reset} The outerlayer and ${DOCS_MCP_SERVER_NAME} entries were not added to .mcp.json, so their MCP servers are not set up. Add them to .mcp.json by hand, or move the servers you wrote into .outerlayer/mcp.json and run \`outerlayer context emit\`.
 ` : "";
-  const what = mcpKept ? "the OuterLayer skills" : "the OuterLayer skills and MCP server";
+  const what = mcpKept ? "the OuterLayer skills" : "the OuterLayer skills and MCP servers";
   if (paths.length === 0) {
     return `${C.green}\u2713${C.reset} Agent setup: already in place, nothing changed
 ${renderPaths(paths, kept)}${mcpNote}`;

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-07T13:16:15.617Z+e27c8d7","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-07T20:56:19.457Z+b4e50a8","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-EVO6F2NO.js → builder-PP436VGZ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-JSUUXA5W.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-CJGQQZWB.js';
 import './chunk-CX22S5BA.js';
 import './chunk-IU4NZROR.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-YT35WGIP.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-ZM2IMMYN.js';

package/dist/{check-RBRRI77E.js → check-YDXOLVJ5.js}

@@ -1,35 +1,36 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-4AVAETSU.js';
+import { probeCredentials } from './chunk-3YFCWYBU.js';
+import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-I2UOAV7X.js';
-import './chunk-ABIWDUMS.js';
-import './chunk-KZ5M4QOB.js';
+import './chunk-YETTWTAY.js';
+import './chunk-BHOBM3IZ.js';
 import './chunk-T6OIJQRT.js';
-import './chunk-PDTSUOVT.js';
-import './chunk-UGP76IZ5.js';
+import './chunk-FI5UYJMQ.js';
+import './chunk-O765JR4W.js';
 import './chunk-HKUH5AR2.js';
-import './chunk-V42JY4F6.js';
+import './chunk-HYZRY4KZ.js';
 import './chunk-Y6P5XX2B.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-ESZJ5QIC.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-R7BJYFD2.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-MC6J453K.js';
-import './chunk-472KC6JV.js';
-import './chunk-BREEX2Z7.js';
+import './chunk-7C4T5BGN.js';
+import './chunk-BEZSECPA.js';
+import './chunk-E5DC4VZL.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
 import './chunk-JKIWMRFH.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-VVIRHTH4.js';
+import './chunk-2GBCTEN4.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-JSUUXA5W.js';
+import './chunk-CJGQQZWB.js';
 import './chunk-CX22S5BA.js';
-import './chunk-6CXYORUS.js';
-import './chunk-S6IUUNCD.js';
+import './chunk-QKFB4K7X.js';
+import './chunk-RSNSZ2LJ.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-DTDZXDQ3.js';
@@ -41,10 +42,10 @@ import './chunk-IU4NZROR.js';
 import './chunk-USO2DKBD.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-M2PBLRB7.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-XR3BJN33.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';

package/dist/{chunk-VVIRHTH4.js → chunk-2GBCTEN4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-JSUUXA5W.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-CJGQQZWB.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-4AVAETSU.js → chunk-3YFCWYBU.js}

@@ -1,25 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
-import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-KZ5M4QOB.js';
+import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-BHOBM3IZ.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
-import { RUNNER_PROTOCOL } from './chunk-PDTSUOVT.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-ESZJ5QIC.js';
+import { RUNNER_PROTOCOL } from './chunk-FI5UYJMQ.js';
+import { writePendingUpdate } from './chunk-O765JR4W.js';
+import { placeholderQueues, placeholderProblem } from './chunk-R7BJYFD2.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-BREEX2Z7.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-E5DC4VZL.js';
 import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-VVIRHTH4.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-JSUUXA5W.js';
+import { spawnRun } from './chunk-2GBCTEN4.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-CJGQQZWB.js';
 import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DTDZXDQ3.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-M2PBLRB7.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-XR3BJN33.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
-import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-M6G7TJVF.js';
+import { parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { parseClaimIdentity } from './chunk-BYT5O5RV.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-V7NIVOFD.js';
@@ -225,15 +226,17 @@ async function verifyInto(staging, version, deps) {
   const digest = await fetchTarballDigest(meta.tarball, deps.fetchImpl);
   if (digest !== expected) return failed(`the tarball for ${version} does not match the registry's integrity digest`);
   const provenance = await fetchProvenance(version, deps.fetchImpl);
-  if (provenance === void 0) return failed(`${version} has no provenance attestation`);
-  if (provenance.repository !== RELEASE_REPOSITORY) {
-    return failed(`the provenance of ${version} names the repository ${provenance.repository}, not ${RELEASE_REPOSITORY}`);
-  }
-  if (provenance.workflowPath !== RELEASE_WORKFLOW_PATH) {
-    return failed(`the provenance of ${version} names the workflow ${provenance.workflowPath}, not ${RELEASE_WORKFLOW_PATH}`);
-  }
-  if (Buffer.from(provenance.subjectSha512, "hex").toString("base64") !== digest) {
-    return failed(`the provenance of ${version} covers a different package than the tarball`);
+  if (provenance.kind === "unreadable") return failed(`the provenance of ${version} could not be read`);
+  if (provenance.kind === "found") {
+    if (provenance.repository !== RELEASE_REPOSITORY) {
+      return failed(`the provenance of ${version} names the repository ${provenance.repository}, not ${RELEASE_REPOSITORY}`);
+    }
+    if (provenance.workflowPath !== RELEASE_WORKFLOW_PATH) {
+      return failed(`the provenance of ${version} names the workflow ${provenance.workflowPath}, not ${RELEASE_WORKFLOW_PATH}`);
+    }
+    if (Buffer.from(provenance.subjectSha512, "hex").toString("base64") !== digest) {
+      return failed(`the provenance of ${version} covers a different package than the tarball`);
+    }
   }
   mkdirSync(staging, { recursive: true, mode: RUNNER_DIR_MODE });
   const npm = await npmVersion(deps.runNpm, staging);
@@ -948,12 +951,19 @@ function considerNamedVersion(state, named) {
   });
   const updating = decision === "update" && !retryHeld(state, named);
   state.pendingUpdate = updating ? named : void 0;
+  if (!updating) clearUpdateWait(state);
   if (!updating || state.preflightedUpdate !== named) state.preflightedUpdate = void 0;
   if (decision === "cannot_self_update" && !state.cannotSelfUpdateLogged && installedSwitchOf(state, update).kind !== "restart") {
     state.cannotSelfUpdateLogged = true;
     logOf(state).line(`this runner cannot update itself to ${named}: ${blocker}`);
   }
 }
+function adoptUpdateWait(state, version) {
+  const previous = state.updateWait;
+  const wait = { version, sinceMs: previous?.sinceMs ?? nowOf(state).getTime(), holdSinceMs: previous?.holdSinceMs };
+  state.updateWait = wait;
+  return wait;
+}
 function retryHeld(state, version) {
   return state.updateRetry?.version === version && nowOf(state).getTime() < state.updateRetry.retryAtMs;
 }
@@ -970,6 +980,68 @@ function updateArgsOf(state, update, version) {
 function dropPendingUpdate(state) {
   state.pendingUpdate = void 0;
   state.preflightedUpdate = void 0;
+  clearUpdateWait(state);
+}
+function clearUpdateWait(state) {
+  state.updateWait = void 0;
+  state.updateLogged = void 0;
+  state.upgradeRefused = false;
+  recordPendingUpdate(state, void 0);
+}
+function recordPendingUpdate(state, record) {
+  const text = record === void 0 ? "none" : JSON.stringify(record);
+  if (state.updateRecord === text) return;
+  try {
+    writePendingUpdate(runnerDir(state.config.configPath), record);
+    state.updateRecord = text;
+    reportRepeating(state, "the update-pending.json record", void 0);
+  } catch (err) {
+    const code = err.code;
+    const cause = code?.replace(/^ERR_FS_/, "") ?? (err instanceof Error ? err.name : "unknown error");
+    reportRepeating(
+      state,
+      "the update-pending.json record",
+      `could not write update-pending.json (${cause}): \`runner status\` will not show the pending update`
+    );
+  }
+}
+function runningItems(state) {
+  const numbers = [...state.jobs.values()].map((entry) => Number(entry.job.item)).filter((n) => Number.isFinite(n));
+  return numbers.sort((a, b) => a - b);
+}
+function holdForUpdate(state, version, mayHold = true) {
+  const log = logOf(state);
+  const nowMs = nowOf(state).getTime();
+  const wait = adoptUpdateWait(state, version);
+  const failed2 = readLastUpdate(state.config.configPath);
+  const failedAtMs = failed2?.to === version && failed2.outcome === "retrying" ? new Date(failed2.at ?? Number.NaN).getTime() : Number.NaN;
+  if (failedAtMs < wait.sinceMs) wait.sinceMs = failedAtMs;
+  const logged = state.updateLogged ??= {};
+  if (logged.pending !== version) {
+    logged.pending = version;
+    log.line(`update to ${version} pending \xB7 updating when no build is running`);
+  }
+  const maxWaitMs = (state.config.update?.maxWaitHours ?? DEFAULT_UPDATE_MAX_WAIT_HOURS) * 60 * 6e4;
+  const holding = mayHold && (state.upgradeRefused === true || nowMs - wait.sinceMs >= maxWaitMs);
+  const record = { version, since: new Date(wait.sinceMs).toISOString() };
+  if (holding) {
+    wait.holdSinceMs ??= nowMs;
+    const builds = runningItems(state);
+    const key = `${version}:${builds.join(",")}`;
+    if (logged.hold !== key) {
+      logged.hold = key;
+      log.line(`claiming nothing: update to ${version} waits for ${buildsPhrase(builds)} to finish`);
+    }
+    record.holding = { builds, since: new Date(wait.holdSinceMs).toISOString() };
+  } else {
+    wait.holdSinceMs = void 0;
+    logged.hold = void 0;
+  }
+  recordPendingUpdate(state, record);
+  return holding;
+}
+function buildsPhrase(builds) {
+  return builds.length === 0 ? "the running builds" : builds.map((n) => `#${n}`).join(", ");
 }
 function reportUpdateResult(state, version, result) {
   if (result.kind === "retrying") state.updateRetry = { version, retryAtMs: result.retryAtMs };
@@ -1029,7 +1101,10 @@ function restartOntoInstalled(state) {
 async function updateWhenIdle(state) {
   const update = state.deps.update;
   const version = state.pendingUpdate;
-  if (update === void 0 || version === void 0) return false;
+  if (update === void 0 || version === void 0) {
+    recordPendingUpdate(state, void 0);
+    return false;
+  }
   if (!state.config.autoUpdate || retryHeld(state, version)) {
     dropPendingUpdate(state);
     return false;
@@ -1037,18 +1112,22 @@ async function updateWhenIdle(state) {
   if (state.jobs.size > 0) {
     const record = readLastUpdate(state.config.configPath);
     if (record?.to === version && record.outcome === "retrying") {
-      const failedAtMs = record.at === void 0 ? Number.NaN : Date.parse(record.at);
-      if (!(nowOf(state).getTime() >= failedAtMs + RETRY_MAX_WAIT_MS)) return false;
-    }
-    if (state.preflightedUpdate === version) return true;
-    const early = await preflightUpdate(updateArgsOf(state, update, version));
-    if (early !== void 0) {
-      dropPendingUpdate(state);
-      reportUpdateResult(state, version, early);
-      return false;
+      const failedAtMs = new Date(record.at ?? Number.NaN).getTime();
+      if (!(nowOf(state).getTime() >= failedAtMs + RETRY_MAX_WAIT_MS)) {
+        holdForUpdate(state, version, false);
+        return false;
+      }
     }
-    state.preflightedUpdate = version;
-    return true;
+    if (state.preflightedUpdate !== version) {
+      const early = await preflightUpdate(updateArgsOf(state, update, version));
+      if (early !== void 0) {
+        dropPendingUpdate(state);
+        reportUpdateResult(state, version, early);
+        return false;
+      }
+      state.preflightedUpdate = version;
+    }
+    return holdForUpdate(state, version);
   }
   dropPendingUpdate(state);
   const result = await performUpdate(updateArgsOf(state, update, version));
@@ -1213,7 +1292,7 @@ async function runTick(state) {
           claimed = true;
           break;
         }
-        if (attempt.kind === "outdated" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch") {
+        if (attempt.kind === "outdated" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch" || attempt.kind === "unreadable_repositories") {
           return;
         }
         if (attempt.kind === "error") {
@@ -1233,7 +1312,7 @@ async function runTick(state) {
   );
 }
 var CLAIM_REFUSAL_CODES = new Set(
-  "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
+  "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
   const { postJson: postJson2 } = await import('./work-cmd-ZJY3NA2G.js');
@@ -1274,11 +1353,13 @@ async function tryClaimAndStart(state, item, queue) {
     }
     if (claim.code === "runner_upgrade_required") {
       reportRepeating(state, "the runner protocol", claim.message ?? claim.reason);
+      state.upgradeRefused = true;
       return { kind: "outdated" };
     }
     return { kind: "error", reason: `${claim.reason} (${claim.attempts} attempt(s))` };
   }
   reportRepeating(state, "the runner protocol", void 0);
+  state.upgradeRefused = false;
   reportRepeating(state, "the request signature", void 0);
   const { data } = claim.value;
   const claimId = data.id === void 0 || data.id === null ? "" : String(data.id);
@@ -1324,8 +1405,22 @@ async function tryClaimAndStart(state, item, queue) {
   }
   reportRepeating(state, "the branch", void 0);
   const identity = parseClaimIdentity(data);
+  const repositories = parseClaimedRepositories(data.repositories);
+  if (repositories === null) {
+    const released = await retrySend(
+      () => releaseLease(state.config, item.number, void 0, {}, state.deps.fetchImpl),
+      { now: state.deps.now, sleep: state.deps.sleep }
+    );
+    reportRepeating(
+      state,
+      "the repositories",
+      `the gateway named repositories for #${item.number} that this runner cannot read; upgrade the runner or the gateway. ` + (released.ok ? "The claim was released and no build started" : `No build started, but releasing the claim failed (${released.reason}), so it stays held until its lease lapses`)
+    );
+    return { kind: "unreadable_repositories" };
+  }
+  reportRepeating(state, "the repositories", void 0);
   try {
-    await startJob(state, item, queue, claimId, itemKey, branch, identity);
+    await startJob(state, item, queue, claimId, itemKey, branch, identity, repositories);
   } catch (err) {
     const stranded = [...state.jobs.values()].find((active) => active.job.claimId === claimId);
     if (stranded === void 0) throw err;
@@ -1350,9 +1445,11 @@ function wasExtended(claim) {
   if (!Number.isFinite(createdAtMs) || !Number.isFinite(expiresAtMs)) return false;
   return expiresAtMs - createdAtMs > LEASE_SECONDS * 1e3 + 2e3;
 }
-async function startJob(state, item, queue, claimId, itemKey, branch, identity) {
+async function startJob(state, item, queue, claimId, itemKey, branch, identity, claimed) {
   const log = logOf(state);
   const startedAt = nowOf(state);
+  const repositories = repositoriesOf({ repositories: claimed, repository: item.specRepository, branch });
+  const primary = primaryOf(repositories);
   const dirPath = freeJobDir(state.config.configPath, queue, item.number, claimId, startedAt);
   mkdirSync(dirPath, { recursive: true, mode: RUNNER_DIR_MODE });
   const runnerRoot = runnerDir(state.config.configPath);
@@ -1364,7 +1461,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
     itemKey,
     branch,
     commitIdentity: identity,
-    ...item.specRepository === void 0 || item.specRepository === null || item.specRepository === "" ? {} : { repository: item.specRepository },
+    ...primary === void 0 ? {} : { repository: primary.repository, repositories },
     startedAt: startedAt.toISOString()
   };
   writeJobFile(jobFilePath, job);
@@ -1438,7 +1535,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
       item,
       itemKey,
       tokens,
-      branch,
+      branch: primary?.branch ?? branch,
+      repositories,
       jobDir: dirPath,
       cliVersion,
       log,
@@ -1470,7 +1568,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
       item,
       itemKey,
       tokens,
-      branch,
+      branch: primary?.branch ?? branch,
+      repositories,
       jobDir: dirPath,
       cliVersion,
       log,
@@ -1747,6 +1846,7 @@ function buildTokensFor(state, active, item) {
   return new BuildTokens({
     config: state.config,
     item,
+    primary: primaryOf(repositoriesOf({ repositories: active.job.repositories, repository: active.job.repository, branch: active.job.branch }))?.repository,
     fetchImpl: state.deps.fetchImpl,
     now: state.deps.now,
     sleep: state.deps.sleep,
@@ -1972,7 +2072,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-RBRRI77E.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-YDXOLVJ5.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2018,7 +2118,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       if (cores !== void 0) runtimeOf(state).cpus.hold(job.container.buildId, cores);
       const tokens = buildTokensFor(state, adopted, job.item);
       runtimeOf(state).credentials.set(dirPath, tokens);
-      await ensureTunnel(runtimeOf(state), job.container, dirPath, config, job.itemKey, job.branch);
+      await ensureTunnel(runtimeOf(state), job.container, dirPath, config, job.itemKey, job.branch, job.repositories);
       try {
         await tokens.token("read");
         keepGhConfigCurrent(

package/dist/{chunk-M6G7TJVF.js → chunk-4Q7OMKAT.js}

@@ -345,11 +345,38 @@ async function startBuildServices(input) {
   }
 }
 
+// src/runner/repositories.ts
+function parseClaimedRepositories(value) {
+  if (!Array.isArray(value) || value.length === 0) return void 0;
+  const parsed = [];
+  for (const entry of value) {
+    if (typeof entry !== "object" || entry === null) return null;
+    const { repository, branch, primary } = entry;
+    if (typeof repository !== "string" || repository === "" || typeof branch !== "string" || branch === "") return null;
+    parsed.push({ repository, branch, primary: primary === true });
+  }
+  const primaryAt = parsed.findIndex((entry) => entry.primary);
+  const at = primaryAt === -1 ? 0 : primaryAt;
+  return [{ ...parsed[at], primary: true }, ...parsed.filter((_, index) => index !== at).map((entry) => ({ ...entry, primary: false }))];
+}
+function repositoriesOf(input) {
+  if (input.repositories !== void 0 && input.repositories.length > 0) return input.repositories;
+  if (input.repository === void 0 || input.repository === null || input.repository === "" || input.branch === void 0) return [];
+  return [{ repository: input.repository, branch: input.branch, primary: true }];
+}
+function primaryOf(repositories) {
+  return repositories.find((entry) => entry.primary) ?? repositories[0];
+}
+
 // src/runner/container/environment.ts
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
 var EVAL_INPUT_DIR = `${JOB_MOUNT}/eval-input`;
 var CHECKOUT_DIR = "/build/work/checkout";
+var REPOS_DIR = "/build/work/repos";
+function checkoutPath(entry) {
+  return entry.primary ? CHECKOUT_DIR : `${REPOS_DIR}/${entry.repository}`;
+}
 var MAX_HOSTS = 200;
 function tokenVariables() {
   return ["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GITHUB_ENTERPRISE_TOKEN"];
@@ -377,7 +404,7 @@ function proxyEnvironment(proxyUrl, alsoNoProxy) {
     YARN_HTTP_PROXY: proxyUrl
   };
 }
-function runnerLiterals(repository) {
+function runnerLiterals(repository, repositories = []) {
   return {
     OUTERLAYER_JOB_DIR: JOB_MOUNT,
     HOME: "/build/home",
@@ -386,7 +413,13 @@ function runnerLiterals(repository) {
     GIT_TERMINAL_PROMPT: "0",
     GH_CONFIG_DIR: `${JOB_MOUNT}/gh`,
     GH_NO_UPDATE_NOTIFIER: "1",
-    ...repository === void 0 ? {} : { GH_REPO: repository }
+    ...repository === void 0 ? {} : { GH_REPO: repository },
+    // What the build's command reads to find every repository it holds: its path, its branch, and whether it is the primary.
+    ...repositories.length === 0 ? {} : {
+      OUTERLAYER_REPOSITORIES: JSON.stringify(
+        repositories.map((entry) => ({ repository: entry.repository, path: checkoutPath(entry), branch: entry.branch, primary: entry.primary }))
+      )
+    }
   };
 }
 function containerBuiltInAddress(name) {
@@ -448,7 +481,14 @@ function buildEnvironment(input) {
     delete passed.GIT_CONFIG_COUNT;
   }
   return {
-    literals: { ...recipe, ...destinations, ...runnerLiterals(input.repository), ...builtInLiterals, ...authored, ...hooks },
+    literals: {
+      ...recipe,
+      ...destinations,
+      ...runnerLiterals(input.repository, repositoriesOf({ repositories: input.repositories, repository: input.repository, branch: input.branch })),
+      ...builtInLiterals,
+      ...authored,
+      ...hooks
+    },
     passed,
     variables,
     skippedTokenVariables
@@ -504,4 +544,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, buildEnvironment, builtInEnvironment, checkEnvironment, claudeCredential, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseIsolation, proxyEnvironment, resolveDestinations, sharedUserEnvironment, startBuildServices, withTunnelRecord };
+export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseClaimedRepositories, parseIsolation, primaryOf, proxyEnvironment, repositoriesOf, resolveDestinations, sharedUserEnvironment, startBuildServices, withTunnelRecord };

package/dist/{chunk-MC6J453K.js → chunk-7C4T5BGN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-472KC6JV.js';
-import { MIN_ENGINE_MAJOR } from './chunk-BREEX2Z7.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-BEZSECPA.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E5DC4VZL.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-47RS42OZ.js → chunk-A56PYPDF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { mkdirSync, writeFileSync, existsSync, readFileSync } from 'fs';
+import { existsSync, writeFileSync, mkdirSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -47,7 +47,7 @@ function readMcpDoc(absPath, relPath) {
 function mcpTargetPath(repoRoot) {
   return existsSync(join(repoRoot, ".outerlayer", "mcp.json")) ? ".outerlayer/mcp.json" : ".mcp.json";
 }
-function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
+function addMcpEntryIfAbsent(repoRoot, name, entry) {
   const relPath = mcpTargetPath(repoRoot);
   const absPath = join(repoRoot, relPath);
   const doc = readMcpDoc(absPath, relPath);
@@ -57,12 +57,19 @@ function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
   }
   const existing = servers ?? {};
   if (name in existing) return { path: relPath, added: false };
-  const entry = buildStdioServerEntry(DEFAULT_MCP_COMMAND, void 0, void 0);
   mkdirSync(dirname(absPath), { recursive: true });
   writeFileSync(absPath, `${JSON.stringify({ ...doc, mcpServers: { ...existing, [name]: entry } }, null, 2)}
 `);
   return { path: relPath, added: true };
 }
+function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
+  return addMcpEntryIfAbsent(repoRoot, name, buildStdioServerEntry(DEFAULT_MCP_COMMAND, void 0, void 0));
+}
+var DOCS_MCP_SERVER_NAME = "outerlayer-docs";
+var DOCS_MCP_URL = "https://docs.outerlayer.ai/mcp";
+function addDocsMcpEntryIfAbsent(repoRoot) {
+  return addMcpEntryIfAbsent(repoRoot, DOCS_MCP_SERVER_NAME, { type: "http", url: DOCS_MCP_URL });
+}
 function runMcpInstall(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   if (!existsSync(cwd)) throw new McpInstallError(`no such directory: ${cwd}`);
@@ -92,4 +99,4 @@ function handleMcpInstallError(err) {
   process.exitCode = 1;
 }
 
-export { DEFAULT_MCP_COMMAND, McpInstallError, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall };
+export { DEFAULT_MCP_COMMAND, DOCS_MCP_SERVER_NAME, McpInstallError, addDocsMcpEntryIfAbsent, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall };

package/dist/{chunk-472KC6JV.js → chunk-BEZSECPA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-BREEX2Z7.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E5DC4VZL.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';