@outerlayer/cli 0.10.1 → 0.11.0

package/dist/{chunk-M2PBLRB7.js → chunk-XR3BJN33.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-M6G7TJVF.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-4Q7OMKAT.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
@@ -86,8 +86,11 @@ var RUNNER_KEYS = [
   "build",
   "housekeeping",
   "checks",
-  "autoUpdate"
+  "autoUpdate",
+  "update"
 ];
+var UPDATE_KEYS = ["maxWaitHours"];
+var DEFAULT_UPDATE_MAX_WAIT_HOURS = 6;
 function runnerNumbers() {
   return [
     { key: "concurrency", min: 1 },
@@ -205,6 +208,7 @@ function loadRunnerConfig(configPath) {
   const build = resolveBuild(configPath, runner.build);
   const housekeeping = resolveHousekeeping(configPath, runner.housekeeping, build.disk);
   const checks = resolveChecks(configPath, runner.checks);
+  const update = resolveUpdate(configPath, runner.update);
   if (config.scrub?.literals !== void 0 && !Array.isArray(config.scrub.literals)) {
     fail(configPath, "scrub.literals", "must be a list of strings");
   }
@@ -233,6 +237,7 @@ function loadRunnerConfig(configPath) {
     build,
     housekeeping,
     checks,
+    update,
     // A host with executables of its own for provision and cleanup chose
     // its own environment, and an update could change what its hooks run
     // under; it opts in. The built-in hooks are the runner's own. Provision
@@ -300,6 +305,21 @@ function resolveChecks(configPath, block) {
   }
   return { timeLimitMinutes: limit };
 }
+function resolveUpdate(configPath, block) {
+  const given = block ?? {};
+  if (typeof given !== "object" || Array.isArray(given)) fail(configPath, "runner.update", "must be an object");
+  const keys = given;
+  for (const key of Object.keys(keys)) {
+    if (UPDATE_KEYS.includes(key)) continue;
+    const near = nearestKey(key, UPDATE_KEYS);
+    fail(configPath, `runner.update.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+  }
+  const hours = keys.maxWaitHours === void 0 ? DEFAULT_UPDATE_MAX_WAIT_HOURS : keys.maxWaitHours;
+  if (typeof hours !== "number" || !Number.isFinite(hours) || hours < 0) {
+    fail(configPath, "runner.update.maxWaitHours", "must be a number of hours, 0 or more");
+  }
+  return { maxWaitHours: hours };
+}
 function wholeBytes(bytes) {
   if (bytes === void 0) return void 0;
   const whole = Math.floor(bytes);
@@ -359,4 +379,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };

package/dist/{chunk-ABIWDUMS.js → chunk-YETTWTAY.js}

@@ -34,17 +34,17 @@ async function fetchTarballDigest(url, fetchImpl) {
 }
 async function fetchProvenance(version, fetchImpl) {
   const response = await get(`${REGISTRY_URL}/-/npm/v1/attestations/${PACKAGE_PATH}@${encodeURIComponent(version)}`, fetchImpl);
-  if (response.status === 404) return void 0;
+  if (response.status === 404) return { kind: "absent" };
   if (!response.ok) throw new Error(`the registry answered HTTP ${response.status} for the attestations of ${PACKAGE_NAME}@${version}`);
   const body = await response.json();
   const slsa = (body.attestations ?? []).find((a) => a.predicateType === SLSA_PREDICATE);
   const payload = slsa?.bundle?.dsseEnvelope?.payload;
-  if (typeof payload !== "string") return void 0;
+  if (typeof payload !== "string") return { kind: "unreadable" };
   const statement = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
   const workflow = statement.predicate?.buildDefinition?.externalParameters?.workflow;
   const subjectSha512 = statement.subject?.[0]?.digest?.sha512;
-  if (typeof workflow?.repository !== "string" || typeof workflow.path !== "string" || typeof subjectSha512 !== "string") return void 0;
-  return { repository: workflow.repository, workflowPath: workflow.path, subjectSha512 };
+  if (typeof workflow?.repository !== "string" || typeof workflow.path !== "string" || typeof subjectSha512 !== "string") return { kind: "unreadable" };
+  return { kind: "found", repository: workflow.repository, workflowPath: workflow.path, subjectSha512 };
 }
 
 // src/runner/update/npm.ts

package/dist/{cli-G6TH4YMK.js → cli-RQZXTOEI.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-R2UYH4QV.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-EOWWTFUU.js';
 import './chunk-F47JBIAW.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-DTDZXDQ3.js';
@@ -3820,7 +3820,7 @@ function buildProgram(argv = process.argv) {
   program2.name("outerlayer").description("OuterLayer \u2014 see what your coding agents actually do").enablePositionalOptions().version(resolveVersion()).option(NO_COLOR_FLAG, "disable color (NO_COLOR=1 does the same)").addHelpText("after", SUPPORT_TEXT);
   program2.command("init").description("Connect this repository, install hooks and agent skills, run doctor").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--local", "install the hooks only: no connect step and no network call").option("--factory <org/factory>", "the factory to connect this repository to (see `outerlayer connect`)").option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--template <name>", "install the starter skills and a policy file (only: default)").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    "\nIn a repository, init runs four steps: connect the repository to a\nfactory (`outerlayer connect`), install the hooks, set up the coding agent,\nand run `outerlayer doctor`. It never signs in and asks nothing. With no\nlogin it skips the connect step and says to run `outerlayer login`. With\n--json it prints one document naming the outcome of each step: done,\nskipped or failed. The exit code is 1 when a step failed.\n\nThe agent setup step installs the starter skills and the `outerlayer` skill\ninto .outerlayer/skills/, writes .outerlayer/config.json for Claude Code when\nthere is none, runs `outerlayer context emit` so the skills appear in\n.claude/skills/, and adds the OuterLayer MCP server to .mcp.json. Nothing you\nwrote is changed: an existing config, policy, edited skill, MCP entry or root\nCLAUDE.md and AGENTS.md is left as it is, and a hand-written file the emit\nwould replace is kept and listed. The files are left uncommitted.\nThe step is skipped outside a git repository and in a repository whose\ncontext comes from a control plane, where it arrives at session start.\n\n--local installs only the hooks: no connect step, no agent setup and no\nnetwork call. Add `--template default` to also write the starter skills and\na policy file into .outerlayer/ without compiling them; `outerlayer context\nemit` does that.\n\nIdempotent: settings are backed up before any write, and a second run\nchanges nothing. Wrapping adds one spawn per hook firing; undo it with\n`outerlayer hooks unwrap`. An occupied status-line slot is wrapped, never\nreplaced.\n\nThree of the starter skills are copied once and are yours to edit. The\nothers are rewritten from this CLI on every `context emit`.\n"
+    "\nIn a repository, init runs four steps: connect the repository to a\nfactory (`outerlayer connect`), install the hooks, set up the coding agent,\nand run `outerlayer doctor`. It never signs in and asks nothing. With no\nlogin it skips the connect step and says to run `outerlayer login`. With\n--json it prints one document naming the outcome of each step: done,\nskipped or failed. The exit code is 1 when a step failed.\n\nThe agent setup step installs the starter skills and the `outerlayer` skill\ninto .outerlayer/skills/, writes .outerlayer/config.json for Claude Code when\nthere is none, runs `outerlayer context emit` so the skills appear in\n.claude/skills/, and adds the outerlayer and outerlayer-docs MCP servers to\n.mcp.json. Nothing you wrote is changed: an existing config, policy, edited\nskill, MCP entry or root CLAUDE.md and AGENTS.md is left as it is, and a\nhand-written file the emit would replace is kept and listed. The files are\nleft uncommitted.\nThe step is skipped outside a git repository and in a repository whose\ncontext comes from a control plane, where it arrives at session start.\n\n--local installs only the hooks: no connect step, no agent setup and no\nnetwork call. Add `--template default` to also write the starter skills and\na policy file into .outerlayer/ without compiling them; `outerlayer context\nemit` does that.\n\nIdempotent: settings are backed up before any write, and a second run\nchanges nothing. Wrapping adds one spawn per hook firing; undo it with\n`outerlayer hooks unwrap`. An occupied status-line slot is wrapped, never\nreplaced.\n\nThree of the starter skills are copied once and are yours to edit. The\nothers are rewritten from this CLI on every `context emit`.\n"
   ).action(async (opts) => {
     let starterTemplate;
     if (opts.template !== void 0) {
@@ -3855,7 +3855,7 @@ function buildProgram(argv = process.argv) {
       else process.stdout.write(outcome.text);
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-5TEM2QNH.js');
+    const { runInitCommand } = await import('./init-cmd-NPNR23UL.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory },
       {
@@ -3867,7 +3867,7 @@ function buildProgram(argv = process.argv) {
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-ODTDC3US.js');
+          const { runAgentSetup } = await import('./agent-setup-YEFN74Y4.js');
           return runAgentSetup({ cwd: process.cwd() });
         },
         runDoctorChecks: gatherDoctorChecks
@@ -3985,7 +3985,7 @@ function buildProgram(argv = process.argv) {
     await startRelay({ port, socketPath: opts.socket, forwards });
   });
   program2.command("vm-exec", { hidden: true }).description("run a command in a microVM build's guest through its exec agent").requiredOption("--socket <path>", "the Unix socket Firecracker serves the build's vsock device on").option("--user <user>", "the user to run as", "").option("--cwd <dir>", "the working directory", "/").option("--env <NAME=value>", "an environment value the command line carries; repeatable", (value, previous) => [...previous, value], []).option("--pass <NAME>", "an environment variable whose value is read from this process; repeatable", (value, previous) => [...previous, value], []).argument("<argv...>", "the command and its arguments").action(async (argv2, opts) => {
-    const { runVmExec } = await import('./exec-client-QTUO6TZT.js');
+    const { runVmExec } = await import('./exec-client-CQV746UF.js');
     const env = {};
     for (const entry of opts.env) {
       const eq = entry.indexOf("=");
@@ -4018,7 +4018,7 @@ function buildProgram(argv = process.argv) {
     }
   });
   program2.command("vm-init", { hidden: true }).description("lay out a microVM build's guest; the guest helper runs it").action(async () => {
-    const { realGuestHost, runGuestInit } = await import('./guest-init-4UW4HM6N.js');
+    const { realGuestHost, runGuestInit } = await import('./guest-init-LJP5GPZF.js');
     const { readFileSync: readFileSync3 } = await import('fs');
     try {
       runGuestInit(realGuestHost(), readFileSync3("/proc/cmdline", "utf8"));
@@ -4349,7 +4349,7 @@ live addition remains on it.
       throw err;
     }
   });
-  workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items with an unused build request and no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
+  workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
     const { runWorkList, WorkCommandError } = await import('./work-cmd-ZJY3NA2G.js');
     try {
@@ -4367,7 +4367,7 @@ live addition remains on it.
     "\n  outerlayer work claim --item 42 --kind implement\n\nRecords a lease held by the API key that sends it. A live lease held\nby a different key is refused; claiming again with the same key extends\nit. --host is a label only.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-DYD6II56.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-LXXSNEGF.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4383,7 +4383,7 @@ live addition remains on it.
     "\n  outerlayer work renew --item 42\n\nExtends the live lease this API key holds. Refused with a 410 if the\nlease has expired, or a 403 if a different key holds it.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-DYD6II56.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-LXXSNEGF.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4402,7 +4402,7 @@ live addition remains on it.
     "\n  outerlayer work release --item 42 --outcome ok\n  outerlayer work release --item 42\n\nMarks the lease this API key holds released, optionally with an\noutcome. A lease held by a different key is refused. Releasing an\nalready-released lease is a no-op that returns the recorded release\ntime and outcome.\n\nRun inside a session with no --host, it releases that session's own\nlease instead, so the item's review opens without ending the\nsession. It never releases another session's lease. --outcome\napplies to a host's lease only. A later tool call in the session\ntakes the lease again.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-DYD6II56.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-LXXSNEGF.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4429,12 +4429,12 @@ live addition remains on it.
       throw err;
     }
   });
-  workCmd.command("open-pr").description("Open, or edit, the pull request for the work item this session is on").requiredOption("--title <title>", "the pull request's title").requiredOption("--body-file <path>", "a file holding the pull request's description").option("--repo <owner/name>", "repository, on the gh path (default: the current checkout's remote)").option("--session-id <id>", "session id to record as-is, on the gh path, skipping detection").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  workCmd.command("open-pr").description("Open, or edit, the pull request for the work item this session is on").requiredOption("--title <title>", "the pull request's title").requiredOption("--body-file <path>", "a file holding the pull request's description").option("--repository <owner/name>", "repository to open the pull request in (default: the primary)").option("--repo <owner/name>", "same as --repository, on the gh path").option("--session-id <id>", "session id to record as-is, on the gh path, skipping detection").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
-    '\n  outerlayer work open-pr --title "Add the thing" --body-file pr.md\n\nIn a host build, which holds an item key, the gateway opens the pull\nrequest as the factory\'s GitHub App, from the branch the claim named,\nor edits the one already open on that branch. No gh command runs.\nIn your own session it runs `gh pr create` (or `gh pr edit`) under your\nlogin, then declares the pull request on the item, as `work pr` does.\nRun it again after a change to the title or description.\n'
+    '\n  outerlayer work open-pr --title "Add the thing" --body-file pr.md\n  outerlayer work open-pr --repository acme/web --title "Add the thing" --body-file pr.md\n\nIn a host build, which holds an item key, the gateway opens the pull\nrequest as the factory\'s GitHub App, from the branch the claim named,\nor edits the one already open on that branch. No gh command runs.\nIn your own session it runs `gh pr create` (or `gh pr edit`) under your\nlogin, then declares the pull request on the item, as `work pr` does.\nRun it again after a change to the title or description.\n'
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-N2RBDKZ4.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-YZAENDP6.js');
     const { WorkCommandError } = await import('./work-cmd-ZJY3NA2G.js');
     try {
       await runWorkOpenPr(opts);
@@ -4451,12 +4451,12 @@ function registerRunnerCommands(program2) {
   const runnerCmd = program2.command("runner").description("Take work from the implement and amend queues on this machine");
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-X45X7AS4.js');
-    const { start, RunnerStartError } = await import('./loop-ZNUQT736.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-MKBX2ZQD.js');
+    const { start, RunnerStartError } = await import('./loop-3FNROLW7.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-UZRH774M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
-      const { realUpdateDeps } = await import('./real-deps-LS64D3M6.js');
+      const { realUpdateDeps } = await import('./real-deps-KNNBQC75.js');
       await start(configPath, { update: realUpdateDeps(), fetchImpl: fetch });
     } catch (err) {
       if (err instanceof RunnerConfigError || err instanceof RunnerAlreadyRunningError || err instanceof RunnerStartError) {
@@ -4467,8 +4467,8 @@ function registerRunnerCommands(program2) {
     }
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-X45X7AS4.js');
-    const { runRunnerCheck } = await import('./check-RBRRI77E.js');
+    const { defaultRunnerConfigPath } = await import('./config-MKBX2ZQD.js');
+    const { runRunnerCheck } = await import('./check-YDXOLVJ5.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4484,7 +4484,7 @@ function registerRunnerCommands(program2) {
 `);
   });
   runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").option("--allow-downgrade", "install this CLI even when it is older than the version the runner runs").option("--unit-name <name>", "with --service, the unit's name, to run a second runner beside the first").action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-X45X7AS4.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-MKBX2ZQD.js');
     const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-5HYMXLEW.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.service !== true) {
@@ -4497,7 +4497,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-LNEFKIVC.js');
+        const { installServiceCommand } = await import('./command-U6UGIBVT.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -4552,18 +4552,18 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
       fail("pass --service: `outerlayer runner uninstall --service` removes the runner's service.");
       return;
     }
-    const { defaultRunnerConfigPath } = await import('./config-X45X7AS4.js');
-    const { uninstallServiceCommand } = await import('./command-LNEFKIVC.js');
+    const { defaultRunnerConfigPath } = await import('./config-MKBX2ZQD.js');
+    const { uninstallServiceCommand } = await import('./command-U6UGIBVT.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
     else fail(result.lines.length > 0 ? result.lines.join("\n  ") : "the service was not removed");
   });
   runnerCmd.command("init").description("Write a runner block that fits this machine; on macOS, offers a Linux VM").option("--config <path>", configOption).option("--vm", "on macOS, run the runner in a Linux VM (Lima), with container builds").option("--no-vm", "on macOS, skip the VM and run builds as unisolated processes").option("--allow-process-builds", "where builds cannot be isolated, run them as processes anyway").addOption(new Option("--config-stdin", "the VM-side hand-off: read the whole config as JSON on stdin").hideHelp()).option("--vm-cli-package <path>", "with --vm, install this packed CLI tarball in the VM").option("--unit-name <name>", "the service unit's name, to run a second runner beside the first").action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-X45X7AS4.js');
-    const { runRunnerInit, RunnerInitError } = await import('./init-OKCDXEOG.js');
-    const { detectMachine } = await import('./machine-TBJKZ6TN.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-ORDCPTFD.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-MKBX2ZQD.js');
+    const { runRunnerInit, RunnerInitError } = await import('./init-PUY2BUHH.js');
+    const { detectMachine } = await import('./machine-RWDDJRWB.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-M5IBAGVE.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
       const machine = detectMachine();
@@ -4663,7 +4663,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       }
       let serviceUp = false;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-LNEFKIVC.js');
+        const { installServiceCommand } = await import('./command-U6UGIBVT.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -4701,12 +4701,12 @@ Next:
     "after",
     "\nFetches the head of the default branch into the runner's cache, reads its\n.devcontainer/devcontainer.json, and builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-X45X7AS4.js');
+    const { defaultRunnerConfigPath } = await import('./config-MKBX2ZQD.js');
     const { buildRepositoryImage, RecipeError } = await import('./build-LELVCWHV.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-GM526LGX.js');
-    const { builderSpec } = await import('./builder-EVO6F2NO.js');
-    const { loadRunnerConfig } = await import('./config-X45X7AS4.js');
+    const { createDockerHost } = await import('./docker-WVRRMK6R.js');
+    const { builderSpec } = await import('./builder-PP436VGZ.js');
+    const { loadRunnerConfig } = await import('./config-MKBX2ZQD.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const memory = (() => {
       try {
@@ -4767,21 +4767,23 @@ Next:
     }
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-X45X7AS4.js');
-    const { requestStop } = await import('./loop-ZNUQT736.js');
+    const { defaultRunnerConfigPath } = await import('./config-MKBX2ZQD.js');
+    const { requestStop } = await import('./loop-3FNROLW7.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
-    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-X45X7AS4.js');
+    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-MKBX2ZQD.js');
     const { jobsDir, runnerDir } = await import('./paths-OYKMVYJP.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-ZNUQT736.js');
-    const { renderStatus } = await import('./status-KPDVZMJ6.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-3FNROLW7.js');
+    const { renderStatus } = await import('./status-2OW5AKWL.js');
     const { readHousekeepingRecord } = await import('./record-C43U4PKS.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const all = listJobFiles(configPath);
     const housekeeping = readHousekeepingRecord(runnerDir(configPath));
+    const { readPendingUpdate } = await import('./pending-MXLSRYMO.js');
+    const pendingUpdate = readPendingUpdate(runnerDir(configPath));
     let host = "unknown";
     let concurrency = 1;
     try {
@@ -4794,7 +4796,7 @@ Next:
     const service = await (async () => {
       if (process.platform !== "linux" || !existsSync("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-PYNCWSTV.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-HKOVISUP.js');
       const facts = inspectService(DEFAULT_UNIT_NAME, path2.dirname(configPath), realInspectProbes());
       return facts === void 0 ? void 0 : { unit: facts.unit, running: facts.mainPid !== void 0, delegated: facts.delegate };
     })();
@@ -4807,6 +4809,7 @@ Next:
         concurrency,
         // A hold is only true of a runner that is running.
         housekeeping: processState.state === "running" ? housekeeping : { ...housekeeping, holding: void 0 },
+        pendingUpdate: processState.state === "running" ? pendingUpdate : void 0,
         jobs: all.map(({ dirName, job }) => ({ ...withoutItemKey(job), jobDir: path2.join(jobsDir(configPath), dirName) }))
       });
       return;
@@ -4821,14 +4824,15 @@ Next:
         now: /* @__PURE__ */ new Date(),
         recent: Boolean(opts.recent),
         housekeeping,
+        pendingUpdate,
         service
       })}
 `
     );
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-X45X7AS4.js');
-    const { listJobFiles } = await import('./loop-ZNUQT736.js');
+    const { defaultRunnerConfigPath } = await import('./config-MKBX2ZQD.js');
+    const { listJobFiles } = await import('./loop-3FNROLW7.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-H55NWW4H.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5052,7 +5056,7 @@ function registerMcpCommands(program2) {
     "after",
     "\nThe API key is never a flag and never written to .mcp.json as a literal value.\n  stdio (default): the client spawns `outerlayer mcp serve`, which reads the key\n  from ~/.outerlayer/config.json (or OUTERLAYER_API_KEY) on every connect, so a\n  rotated key is picked up without rewriting the entry.\n  http: the entry carries the ${OUTERLAYER_API_KEY} placeholder, which the client\n  resolves from the environment it was launched with.\n\n--command: use an absolute or ${HOME}-relative path when the CLI is not on PATH.\n--url: with stdio the endpoint resolves from OUTERLAYER_URL / the config file at\nconnect time; for self-host pass your gateway-node origin + /v1/mcp.\nSelf-host deployments also need --app-id: without a key service to resolve the\ncaller from the bearer token, the gateway answers 401 without that header.\n"
   ).action(async (opts) => {
-    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-4AQMSIGY.js');
+    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-XZARXNYT.js');
     try {
       if (opts.transport !== void 0 && opts.transport !== "stdio" && opts.transport !== "http") {
         throw new McpInstallError(`--transport must be "stdio" or "http", got "${opts.transport}"`);

package/dist/{command-LNEFKIVC.js → command-U6UGIBVT.js}

@@ -5,9 +5,9 @@ import './chunk-I2UOAV7X.js';
 import { readJobFile } from './chunk-T6OIJQRT.js';
 import './chunk-PTW6W5NR.js';
 import { currentLink, execStartCommand } from './chunk-TI7B7UEO.js';
-import { detectMachine } from './chunk-472KC6JV.js';
-import './chunk-BREEX2Z7.js';
-import { installService, uninstallService, realTaskScheduler } from './chunk-NTLGWCWK.js';
+import { detectMachine } from './chunk-BEZSECPA.js';
+import './chunk-E5DC4VZL.js';
+import { installService, uninstallService, realTaskScheduler } from './chunk-TFIOXPZT.js';
 import './chunk-FBTE2A2X.js';
 import './chunk-JKIWMRFH.js';
 import { realLima } from './chunk-77MM5RYD.js';
@@ -15,12 +15,12 @@ import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-VVIRHTH4.js';
+import './chunk-2GBCTEN4.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-JSUUXA5W.js';
+import './chunk-CJGQQZWB.js';
 import './chunk-CX22S5BA.js';
-import './chunk-6CXYORUS.js';
-import './chunk-S6IUUNCD.js';
+import './chunk-QKFB4K7X.js';
+import './chunk-RSNSZ2LJ.js';
 import './chunk-DTDZXDQ3.js';
 import './chunk-ZQ5JGHUO.js';
 import './chunk-BFESLKPP.js';
@@ -30,10 +30,10 @@ import './chunk-IU4NZROR.js';
 import './chunk-USO2DKBD.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { runnerVmOf, loadRunnerConfig } from './chunk-M2PBLRB7.js';
+import { runnerVmOf, loadRunnerConfig } from './chunk-XR3BJN33.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-RWQWPZB4.js';
 import './chunk-ZJSNLVCE.js';

package/dist/config-MKBX2ZQD.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf } from './chunk-XR3BJN33.js';
+import './chunk-UXYLWVTQ.js';
+import './chunk-7RQ73DLO.js';
+import './chunk-4Q7OMKAT.js';
+import './chunk-BYT5O5RV.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{docker-GM526LGX.js → docker-WVRRMK6R.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { childEnvironment, createDockerHost, spawnRun } from './chunk-VVIRHTH4.js';
+export { childEnvironment, createDockerHost, spawnRun } from './chunk-2GBCTEN4.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-JSUUXA5W.js';
+import './chunk-CJGQQZWB.js';
 import './chunk-CX22S5BA.js';
 import './chunk-IU4NZROR.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-YT35WGIP.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-ZM2IMMYN.js';

package/dist/{doctor-QSV4DYT2.js → doctor-ZF4PYWVN.js}

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-ESZJ5QIC.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-R7BJYFD2.js';
 import { launcherCheck } from './chunk-PTW6W5NR.js';
 import './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-MC6J453K.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-472KC6JV.js';
-import { MIN_ENGINE_MAJOR } from './chunk-BREEX2Z7.js';
+import './chunk-7C4T5BGN.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-BEZSECPA.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E5DC4VZL.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import { resolveDevcontainerCli, spawnRun } from './chunk-VVIRHTH4.js';
+import { resolveDevcontainerCli, spawnRun } from './chunk-2GBCTEN4.js';
 import { locateRecipe, assertBuildable, readRecipe, RecipeError } from './chunk-QOZKPLVJ.js';
-import { buildxState } from './chunk-JSUUXA5W.js';
+import { buildxState } from './chunk-CJGQQZWB.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
-import './chunk-6CXYORUS.js';
-import './chunk-S6IUUNCD.js';
+import './chunk-QKFB4K7X.js';
+import './chunk-RSNSZ2LJ.js';
 import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-DTDZXDQ3.js';
 import './chunk-ZQ5JGHUO.js';
 import './chunk-BFESLKPP.js';
@@ -26,10 +26,10 @@ import { compareVersions } from './chunk-IU4NZROR.js';
 import './chunk-USO2DKBD.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { builtinKind } from './chunk-M2PBLRB7.js';
+import { builtinKind } from './chunk-XR3BJN33.js';
 import { allowHostProblem, MAX_ALLOW_HOSTS } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-WZBHBH3J.js';
 import { defaultGitRunner } from './chunk-RWQWPZB4.js';
 import './chunk-ZJSNLVCE.js';

package/dist/{exec-client-QTUO6TZT.js → exec-client-CQV746UF.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { CAPTURE_LIMIT_BYTES, ExecConnectionError, HANDSHAKE_TIMEOUT_MS, execCapture, runExec, runVmExec, vmExecArgs, waitForAgent } from './chunk-6CXYORUS.js';
-import './chunk-S6IUUNCD.js';
-import './chunk-M6G7TJVF.js';
+export { CAPTURE_LIMIT_BYTES, ExecConnectionError, HANDSHAKE_TIMEOUT_MS, execCapture, runExec, runVmExec, vmExecArgs, waitForAgent } from './chunk-QKFB4K7X.js';
+import './chunk-RSNSZ2LJ.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{guest-init-4UW4HM6N.js → guest-init-LJP5GPZF.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-V42JY4F6.js';
-import './chunk-S6IUUNCD.js';
-import './chunk-M6G7TJVF.js';
+export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-HYZRY4KZ.js';
+import './chunk-RSNSZ2LJ.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/index.js

@@ -22,5 +22,5 @@ if (argv[0] === "statusline") {
   process.exit(0);
 }
 (await import('./hook-fast-AQCAQIA6.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-G6TH4YMK.js');
+var { runCli } = await import('./cli-RQZXTOEI.js');
 await runCli(process.argv);

package/dist/{init-ORDCPTFD.js → init-M5IBAGVE.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { npmSupportsProvenance } from './chunk-ABIWDUMS.js';
-import { readConfigObject, RunnerInitError } from './chunk-MC6J453K.js';
-import './chunk-472KC6JV.js';
-import './chunk-BREEX2Z7.js';
+import { npmSupportsProvenance } from './chunk-YETTWTAY.js';
+import { readConfigObject, RunnerInitError } from './chunk-7C4T5BGN.js';
+import './chunk-BEZSECPA.js';
+import './chunk-E5DC4VZL.js';
 import { VM_SERVICE_NAME } from './chunk-FBTE2A2X.js';
 import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-JKIWMRFH.js';
 import { writeLaunchAgent } from './chunk-LF6MLJCY.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-VVIRHTH4.js';
+import './chunk-2GBCTEN4.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-JSUUXA5W.js';
+import './chunk-CJGQQZWB.js';
 import './chunk-CX22S5BA.js';
-import './chunk-6CXYORUS.js';
-import './chunk-S6IUUNCD.js';
+import './chunk-QKFB4K7X.js';
+import './chunk-RSNSZ2LJ.js';
 import './chunk-DTDZXDQ3.js';
 import './chunk-ZQ5JGHUO.js';
 import './chunk-BFESLKPP.js';
@@ -25,10 +25,10 @@ import './chunk-IU4NZROR.js';
 import './chunk-USO2DKBD.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { resolveBuild, resolveHousekeeping } from './chunk-M2PBLRB7.js';
+import { resolveBuild, resolveHousekeeping } from './chunk-XR3BJN33.js';
 import './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-RWQWPZB4.js';
 import './chunk-ZJSNLVCE.js';

package/dist/{init-OKCDXEOG.js → init-PUY2BUHH.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit } from './chunk-MC6J453K.js';
-import './chunk-472KC6JV.js';
-import './chunk-BREEX2Z7.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit } from './chunk-7C4T5BGN.js';
+import './chunk-BEZSECPA.js';
+import './chunk-E5DC4VZL.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-VVIRHTH4.js';
+import './chunk-2GBCTEN4.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-JSUUXA5W.js';
+import './chunk-CJGQQZWB.js';
 import './chunk-CX22S5BA.js';
-import './chunk-6CXYORUS.js';
-import './chunk-S6IUUNCD.js';
+import './chunk-QKFB4K7X.js';
+import './chunk-RSNSZ2LJ.js';
 import './chunk-DTDZXDQ3.js';
 import './chunk-ZQ5JGHUO.js';
 import './chunk-BFESLKPP.js';
@@ -23,7 +23,7 @@ import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-M6G7TJVF.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-RWQWPZB4.js';
 import './chunk-ZJSNLVCE.js';

package/dist/{init-cmd-5TEM2QNH.js → init-cmd-NPNR23UL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-R2UYH4QV.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-EOWWTFUU.js';
 import './chunk-F47JBIAW.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-DTDZXDQ3.js';