@outerlayer/cli 0.11.0 → 0.13.0

package/dist/{chunk-DTDZXDQ3.js → chunk-P4MM66C6.js}

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-ZQ5JGHUO.js';
-import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { sanitizeTerminal } from './chunk-VDI5POCC.js';
-import { resolveRepoIdentity } from './chunk-IU4NZROR.js';
+import { autoConnect } from './chunk-EFZLAYPE.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { workPageUrl } from './chunk-4QVZCVWT.js';
+import { sanitizeTerminal } from './chunk-CNFVHDHG.js';
+import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
+import { C } from './chunk-YRYMNBGQ.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
 import { signRunnerRequest } from './chunk-V7NIVOFD.js';
+import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -39,10 +42,6 @@ function isSignatureRefusal(code) {
 }
 
 // src/work-cmd.ts
-var GREEN = "\x1B[32m";
-var YELLOW = "\x1B[33m";
-var DIM = "\x1B[2m";
-var RESET = "\x1B[0m";
 async function signatureHeaders(method, endpoint, payload, signer) {
   if (signer === void 0) return {};
   return { ...await signRunnerRequest({ method, url: endpoint, body: new TextEncoder().encode(payload), signer }) };
@@ -298,7 +297,19 @@ function tokenWarning(data) {
   if (tokens === void 0 || tokens === null || tokens.earnable !== false) return "";
   const why = typeof tokens.message === "string" ? sanitizeTerminal(tokens.message) : "the gateway named no reason";
   return `
-${YELLOW}!${RESET} a container host will fail this build: ${why}`;
+${C.yellow}!${C.reset} a container host will fail this build: ${why}`;
+}
+function itemLabel(data) {
+  return data.number != null ? `item #${data.number}` : `item ${sanitizeTerminal(String(data.workItemId))}`;
+}
+function issueLabel(subject) {
+  if ("issue" in subject) return `issue ${sanitizeTerminal(subject.repository)}#${subject.issue}`;
+  return `issue ${sanitizeTerminal(subject.key)}`;
+}
+function itemPageUrl(home, cwd, appId, workItemId) {
+  const connection = readRepoConnection(cwd);
+  if (connection === void 0 || connection.appId !== appId || typeof workItemId !== "string" || workItemId === "") return void 0;
+  return `${workPageUrl(home, connection.organization.name, connection.factory.name)}/${encodeURIComponent(workItemId)}`;
 }
 async function runWorkBuild(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -326,7 +337,7 @@ async function runWorkBuild(opts) {
     const label = data2.number != null ? `#${data2.number}` : String(data2.workItemId);
     const launch = data2.number != null ? `OUTERLAYER_WORK=${data2.number} claude` : null;
     const branch = typeof data2.branch === "string" && data2.branch !== "" ? data2.branch : null;
-    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${GREEN}\u2713${RESET} on Work for you to build ${DIM}\xB7${RESET} ${label} ${DIM}\xB7${RESET} no host will take it` + (branch !== null ? `
+    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${C.green}\u2713${C.reset} on Work for you to build ${C.dim}\xB7${C.reset} ${label} ${C.dim}\xB7${C.reset} no host will take it` + (branch !== null ? `
   branch: ${branch}` : "") + (launch !== null ? `
   start your session with: ${launch}` : "");
     if (!opts.quiet) process.stdout.write(output2 + "\n");
@@ -338,7 +349,9 @@ async function runWorkBuild(opts) {
     ...facts
   };
   const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep);
-  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} build requested ${DIM}\xB7${RESET} ${data.number != null ? `#${data.number}` : data.workItemId} ${DIM}\xB7${RESET} by ${data.attestor}` + tokenWarning(data);
+  const page = itemPageUrl(home, cwd, appId, data.workItemId);
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} build requested ${C.dim}\xB7${C.reset} ${itemLabel(data)}${"subject" in body ? ` (${issueLabel(body.subject)})` : ""} ${C.dim}\xB7${C.reset} by ${data.attestor}` + (page !== void 0 ? `
+  ${page}` : "") + tokenWarning(data);
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -347,7 +360,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-AQCAQIA6.js');
+      const { logHookError } = await import('./hook-fast-PXWKQPN6.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -387,7 +400,7 @@ async function linkSession(opts) {
   }
   const heldBy = typeof data.heldBy === "string" ? data.heldBy : void 0;
   const linked = data.linked === true;
-  const output = opts.json ? JSON.stringify(data) : opts.ended ? linked ? `${GREEN}\u2713${RESET} ended ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}` : `${DIM}\xB7${RESET} session ${sessionId} was not linked to #${number}` : heldBy ? `${DIM}\xB7${RESET} session ${sessionId} linked to #${number}, held by ${sanitizeTerminal(heldBy)} \u2014 no lease taken` : `${GREEN}\u2713${RESET} linked ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}`;
+  const output = opts.json ? JSON.stringify(data) : opts.ended ? linked ? `${C.green}\u2713${C.reset} ended ${C.dim}\xB7${C.reset} session ${sessionId} ${C.dim}\xB7${C.reset} #${number}` : `${C.dim}\xB7${C.reset} session ${sessionId} was not linked to #${number}` : heldBy ? `${C.dim}\xB7${C.reset} session ${sessionId} linked to #${number}, held by ${sanitizeTerminal(heldBy)} \u2014 no lease taken` : `${C.green}\u2713${C.reset} linked ${C.dim}\xB7${C.reset} session ${sessionId} ${C.dim}\xB7${C.reset} #${number}`;
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -411,7 +424,7 @@ async function runWorkRemove(opts) {
       { reason: opts.reason, ...environmentFacts({ cwd, env, home }) },
       fetchImpl
     );
-    const output2 = opts.json ? JSON.stringify(data2) : `${GREEN}\u2713${RESET} removed ${DIM}\xB7${RESET} ${data2.workItemId} ${DIM}\xB7${RESET} withdrawn ${data2.itemWithdrawn}`;
+    const output2 = opts.json ? JSON.stringify(data2) : `${C.green}\u2713${C.reset} removed ${C.dim}\xB7${C.reset} ${data2.workItemId} ${C.dim}\xB7${C.reset} withdrawn ${data2.itemWithdrawn}`;
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
   }
@@ -421,7 +434,7 @@ async function runWorkRemove(opts) {
   const item = await findLiveItem(creds, repository, subject, fetchImpl);
   if (!item) {
     const data2 = { workItemId: null, removed: true, itemWithdrawn: false, noLiveAddition: true };
-    const output2 = opts.json ? JSON.stringify(data2) : `${GREEN}\u2713${RESET} nothing to remove ${DIM}\xB7${RESET} no live addition on ${repository}#${number}`;
+    const output2 = opts.json ? JSON.stringify(data2) : `${C.green}\u2713${C.reset} nothing to remove ${C.dim}\xB7${C.reset} no live addition on ${repository}#${number}`;
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
   }
@@ -433,7 +446,7 @@ async function runWorkRemove(opts) {
     { reason: opts.reason, ...environmentFacts({ cwd, env, home }) },
     fetchImpl
   );
-  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} removed ${DIM}\xB7${RESET} ${data.workItemId} ${DIM}\xB7${RESET} withdrawn ${data.itemWithdrawn}`;
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} removed ${C.dim}\xB7${C.reset} ${data.workItemId} ${C.dim}\xB7${C.reset} withdrawn ${data.itemWithdrawn}`;
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -496,10 +509,10 @@ async function runWorkList(opts) {
   const claimSuffix = (claim) => {
     if (!claim) return "";
     const holder = claim.holderKind === "session" ? `${claim.memberName || "a member"} (local session` : `${sanitizeTerminal(claim.host)} (${claim.kind}`;
-    return ` ${DIM}\xB7${RESET} claimed by ${holder}, since ${claim.createdAt}, until ${claim.expiresAt})`;
+    return ` ${C.dim}\xB7${C.reset} claimed by ${holder}, since ${claim.createdAt}, until ${claim.expiresAt})`;
   };
   const output = opts.json ? JSON.stringify(data) : items.length === 0 ? "no live work items" : items.map(
-    (i) => `${i.trackerKey} ${DIM}\xB7${RESET} ${i.stage} ${DIM}\xB7${RESET} ${i.section} ${DIM}\xB7${RESET} ${i.title}${claimSuffix(i.claim)}`
+    (i) => `${i.trackerKey} ${C.dim}\xB7${C.reset} ${i.stage} ${C.dim}\xB7${C.reset} ${i.section} ${C.dim}\xB7${C.reset} ${i.title}${claimSuffix(i.claim)}`
   ).join("\n");
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };

package/dist/{chunk-BEZSECPA.js → chunk-P6FX4D43.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-E5DC4VZL.js';
+import { MIN_ENGINE_MAJOR } from './chunk-MZN7AQOB.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-A56PYPDF.js → chunk-R7OQTKWT.js}

@@ -62,8 +62,9 @@ function addMcpEntryIfAbsent(repoRoot, name, entry) {
 `);
   return { path: relPath, added: true };
 }
+var INIT_STDIO_ENTRY = { type: "stdio", command: "npx", args: ["-y", "@outerlayer/cli", "mcp", "serve"] };
 function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
-  return addMcpEntryIfAbsent(repoRoot, name, buildStdioServerEntry(DEFAULT_MCP_COMMAND, void 0, void 0));
+  return addMcpEntryIfAbsent(repoRoot, name, { ...INIT_STDIO_ENTRY, args: [...INIT_STDIO_ENTRY.args] });
 }
 var DOCS_MCP_SERVER_NAME = "outerlayer-docs";
 var DOCS_MCP_URL = "https://docs.outerlayer.ai/mcp";

package/dist/{chunk-TFIOXPZT.js → chunk-RLYZLUQ7.js}

@@ -1,13 +1,64 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerUnit, UNIT_MARKER } from './chunk-FBTE2A2X.js';
-import { checkFit } from './chunk-JKIWMRFH.js';
-import { builtinKind } from './chunk-XR3BJN33.js';
+import { builtinKind } from './chunk-22RMZBGW.js';
+import { parseSize } from './chunk-7RQ73DLO.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 
 createRequire(import.meta.url);
+
+// src/runner/vm/service.ts
+var VM_SERVICE_NAME = "outerlayer-runner";
+var UNIT_MARKER = "# Written by outerlayer runner install --service; edit the runner config, not this file.";
+var STOP_MARGIN_MINUTES = 10;
+function escapeUnitPath(path) {
+  return path.replace(/%/g, "%%").replace(/ /g, "\\x20");
+}
+function runnerUnit(unit) {
+  return `${UNIT_MARKER}
+[Unit]
+Description=OuterLayer runner
+After=network-online.target${unit.docker ? " docker.service" : ""}
+Wants=network-online.target
+${unit.docker ? "Requires=docker.service\n" : ""}
+[Service]
+User=${unit.user}
+ExecStart=${unit.execStart}
+EnvironmentFile=-${escapeUnitPath(`${unit.configDir}/runner.env`)}
+Restart=on-failure
+RestartForceExitStatus=75
+RestartSec=30
+KillSignal=SIGTERM
+KillMode=mixed
+TimeoutStopSec=${unit.timeLimitMinutes + STOP_MARGIN_MINUTES}min
+OOMPolicy=continue
+Delegate=yes
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+// src/runner/service/fit.ts
+var GIB = 1024 ** 3;
+var RUNNER_RESERVE_BYTES = 2 * GIB;
+function gib(bytes) {
+  return `${Number((bytes / GIB).toFixed(1))} GiB`;
+}
+function checkFit(input) {
+  const perBuild = parseSize(input.buildMemory);
+  if (perBuild === void 0) return { fits: true };
+  const neededBytes = input.concurrency * perBuild;
+  const availableBytes = Math.max(0, input.usableBytes - RUNNER_RESERVE_BYTES);
+  if (neededBytes <= availableBytes) return { fits: true };
+  return {
+    fits: false,
+    neededBytes,
+    availableBytes,
+    message: `runner.concurrency ${input.concurrency} times runner.build.memory ${input.buildMemory} needs ${gib(neededBytes)}, and ${gib(availableBytes)} is available (${gib(input.usableBytes)} of memory less ${gib(RUNNER_RESERVE_BYTES)} for the runner and the system)`
+  };
+}
 function withSystemd(conf) {
   const lines = (conf ?? "").split("\n");
   if (lines.at(-1) === "") lines.pop();
@@ -130,7 +181,18 @@ function installService(request, deps) {
     if (deps.platform === "wsl2") lines.push(...ensureLoginTask(deps, unitName));
   };
   if (existing === unit) {
-    if (!running() && !asRoot(deps, lines, say, ["enable", "--now", unitName])) return outcome(false, "refused", lines);
+    const wasRunning = running();
+    if (!wasRunning && !asRoot(deps, lines, say, ["enable", "--now", unitName])) return outcome(false, "refused", lines);
+    if (wasRunning && request.restart === true) {
+      ensureTask();
+      if (deps.buildsRunning(runnerDir(request.configPath))) {
+        lines.push(`the service ${unitName} is current; a build is running, so it was not restarted and reads runner.env at its next restart`);
+        return outcome(true, "pending-restart", lines);
+      }
+      if (!asRoot(deps, lines, say, ["restart", unitName])) return outcome(false, "refused", lines);
+      lines.push(`restarted the service ${unitName}, so it reads runner.env`);
+      return outcome(true, "updated", lines);
+    }
     lines.push(`the service ${unitName} is current: the unit already matches the config, so nothing was changed`);
     ensureTask();
     return outcome(true, "current", lines);
@@ -212,4 +274,4 @@ function uninstallService(request, deps) {
   return outcome(true, "removed", lines);
 }
 
-export { DEFAULT_UNIT_NAME, installService, realTaskScheduler, uninstallService, unitPathFor };
+export { DEFAULT_UNIT_NAME, RUNNER_RESERVE_BYTES, VM_SERVICE_NAME, checkFit, installService, realTaskScheduler, uninstallService, unitPathFor };

package/dist/chunk-RMWLBUCJ.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { existsSync, readFileSync, mkdirSync, chmodSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+createRequire(import.meta.url);
+var ITEM_KEY_FILE = "item-key";
+function itemKeyPath(jobPath) {
+  return join(dirname(jobPath), ITEM_KEY_FILE);
+}
+function withItemKey(jobPath, job) {
+  let key;
+  try {
+    key = readFileSync(itemKeyPath(jobPath), "utf8").trim();
+  } catch {
+    return job;
+  }
+  return key === "" ? job : { ...job, itemKey: key };
+}
+function writeOwnerOnly(path, content) {
+  if (existsSync(path)) chmodSync(path, RUNNER_FILE_MODE);
+  writeFileSync(path, content, { mode: RUNNER_FILE_MODE });
+}
+function readJobFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return withItemKey(path, JSON.parse(readFileSync(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function readJobFileChecked(path) {
+  if (!existsSync(path)) return { kind: "missing" };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { kind: "unreadable" };
+    return { kind: "ok", job: withItemKey(path, parsed) };
+  } catch {
+    return { kind: "unreadable" };
+  }
+}
+function writeJobFile(path, job) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  const { itemKey, ...rest } = job;
+  if (itemKey !== void 0) writeOwnerOnly(itemKeyPath(path), itemKey);
+  writeOwnerOnly(path, JSON.stringify(rest, null, 2));
+}
+
+export { readJobFile, readJobFileChecked, writeJobFile };

package/dist/{chunk-4HMXH2OA.js → chunk-SFFHGX3G.js}

@@ -634,7 +634,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-KQZYATQZ.js');
+          const { materializeContext: materialize } = await import('./context-materialize-7S6NLLRO.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-3YFCWYBU.js → chunk-SVEP7PVH.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-C6IV5BV7.js';
+import { writePendingUpdate } from './chunk-O765JR4W.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-BHOBM3IZ.js';
-import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
+import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-RMWLBUCJ.js';
+import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { RUNNER_PROTOCOL } from './chunk-FI5UYJMQ.js';
-import { writePendingUpdate } from './chunk-O765JR4W.js';
-import { placeholderQueues, placeholderProblem } from './chunk-R7BJYFD2.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
+import { placeholderQueues, placeholderProblem } from './chunk-TOPDNXHZ.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-E5DC4VZL.js';
-import { checkFit } from './chunk-JKIWMRFH.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-MZN7AQOB.js';
+import { checkFit } from './chunk-RLYZLUQ7.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-2GBCTEN4.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-CJGQQZWB.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DTDZXDQ3.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-XR3BJN33.js';
+import { spawnRun } from './chunk-3KTA5UU2.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-NX57IBNK.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-P4MM66C6.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-22RMZBGW.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { parseClaimIdentity } from './chunk-BYT5O5RV.js';
@@ -1315,7 +1315,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-ZJY3NA2G.js');
+  const { postJson: postJson2 } = await import('./work-cmd-X7NMJDFL.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2072,7 +2072,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-YDXOLVJ5.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-63IDCEEV.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/chunk-T5VPP6H7.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { DEFAULT_UNIT_NAME } from './chunk-RLYZLUQ7.js';
+import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
+import { RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
+import { join, dirname } from 'path';
+
+createRequire(import.meta.url);
+var AGENT_COMMANDS = {
+  claude: {
+    implement: 'claude -p "/build" --permission-mode bypassPermissions',
+    amend: 'claude -p "/amend" --permission-mode bypassPermissions'
+  }
+};
+function isAgentName(name) {
+  return Object.hasOwn(AGENT_COMMANDS, name);
+}
+var CLAUDE_CREDENTIAL_NAMES = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+var RunnerEnvError = class extends Error {
+};
+var CREDENTIAL_SHAPE = /^sk-ant-(oat|api)[0-9]*-[A-Za-z0-9_-]+$/;
+var SETS = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=/;
+function runnerEnvPath(configPath) {
+  return join(dirname(configPath), "runner.env");
+}
+function credentialFromStdin(text) {
+  const value = (text ?? "").trim();
+  if (value === "") return void 0;
+  const kind = CREDENTIAL_SHAPE.exec(value)?.[1];
+  if (kind === void 0) {
+    throw new RunnerEnvError(
+      "the value on stdin is not a Claude credential, so nothing was written. Pipe one value: a token from `claude setup-token`, which starts sk-ant-oat, or an Anthropic API key, which starts sk-ant-api."
+    );
+  }
+  return { variable: kind === "oat" ? "CLAUDE_CODE_OAUTH_TOKEN" : "ANTHROPIC_API_KEY", value };
+}
+function hasStoredCredential(configPath) {
+  const path = runnerEnvPath(configPath);
+  if (!existsSync(path)) return false;
+  const env = parseRunnerEnv(readFileSync(path, "utf8"));
+  return CLAUDE_CREDENTIAL_NAMES.some((name) => env[name]);
+}
+function storeClaudeCredential(configPath, credential) {
+  const path = runnerEnvPath(configPath);
+  const kept = existsSync(path) ? readFileSync(path, "utf8").split("\n").filter((line) => !CLAUDE_CREDENTIAL_NAMES.includes(SETS.exec(line)?.[1] ?? "")) : [];
+  while (kept[kept.length - 1] === "") kept.pop();
+  const text = `${[...kept, `${credential.variable}=${credential.value}`].join("\n")}
+`;
+  const temporary = `${path}.${process.pid}.tmp`;
+  try {
+    writeFileSync(temporary, text, { mode: RUNNER_FILE_MODE, flag: "wx" });
+    renameSync(temporary, path);
+  } catch (err) {
+    rmSync(temporary, { force: true });
+    throw err;
+  }
+  return path;
+}
+function restartForCredential(state, unitName = DEFAULT_UNIT_NAME) {
+  if (state !== "pending-restart" && state !== "differs") return void 0;
+  return `The service ${unitName} reads runner.env only when it starts. Restart it so it uses the stored credential: sudo systemctl restart ${unitName}`;
+}
+
+export { AGENT_COMMANDS, RunnerEnvError, credentialFromStdin, hasStoredCredential, isAgentName, restartForCredential, storeClaudeCredential };

package/dist/{chunk-BGWTYRSS.js → chunk-TCIW27FM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-TB7EP24C.js';
+import { splitRawFile } from './chunk-2M63GG56.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-R7BJYFD2.js → chunk-TOPDNXHZ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-7C4T5BGN.js';
-import { describeCallFailure } from './chunk-E5DC4VZL.js';
-import { WorkCommandError, getJson } from './chunk-DTDZXDQ3.js';
-import { sanitizeTerminal } from './chunk-VDI5POCC.js';
-import { builtinKind } from './chunk-XR3BJN33.js';
+import { isPlaceholderCommand } from './chunk-MJXXRX4M.js';
+import { describeCallFailure } from './chunk-MZN7AQOB.js';
+import { WorkCommandError, getJson } from './chunk-P4MM66C6.js';
+import { sanitizeTerminal } from './chunk-CNFVHDHG.js';
+import { builtinKind } from './chunk-22RMZBGW.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 

package/dist/{chunk-HKUH5AR2.js → chunk-XJKL4BNU.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-Y6P5XX2B.js';
-import { CaptureDaemon } from './chunk-IU4NZROR.js';
+import { LiveUploader } from './chunk-3D4OYFCD.js';
+import { CaptureDaemon } from './chunk-JXYVA45C.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-4HMXH2OA.js';
+import { spoolDir } from './chunk-SFFHGX3G.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';