@outerlayer/cli 0.17.0 → 0.18.0

package/dist/{chunk-4Q7OMKAT.js → chunk-BQXFBI7T.js}

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { authorEnvironment, withHooksPath } from './chunk-BYT5O5RV.js';
 import { existsSync, unlinkSync, chmodSync } from 'fs';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
@@ -345,6 +344,61 @@ async function startBuildServices(input) {
   }
 }
 
+// src/runner/commit-identity.ts
+var NOREPLY_SUFFIX = "@users.noreply.github.com";
+var MAX_LENGTH = 200;
+function parseIdentity(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const { name, email } = value;
+  if (typeof name !== "string" || typeof email !== "string") return void 0;
+  if (name.trim() === "" || name.length > MAX_LENGTH || /[\r\n\0<>]/.test(name)) return void 0;
+  if (email.length > MAX_LENGTH || !email.endsWith(NOREPLY_SUFFIX) || /[\s\0<>]/.test(email) || email.length === NOREPLY_SUFFIX.length) return void 0;
+  return { name, email };
+}
+function parseClaimIdentity(data) {
+  const author = parseIdentity(data.commitAuthor);
+  if (author === void 0) return void 0;
+  const coAuthor = parseIdentity(data.coAuthor);
+  return coAuthor === void 0 ? { author } : { author, coAuthor };
+}
+function authorEnvironment(identity) {
+  if (identity === void 0) return {};
+  return {
+    GIT_AUTHOR_NAME: identity.name,
+    GIT_AUTHOR_EMAIL: identity.email,
+    GIT_COMMITTER_NAME: identity.name,
+    GIT_COMMITTER_EMAIL: identity.email
+  };
+}
+function configCount(env) {
+  const raw = String(env.GIT_CONFIG_COUNT);
+  return /^[0-9]+$/.test(raw) ? Number(raw) : 0;
+}
+function withGitConfig(env, key, value) {
+  const at = configCount(env);
+  return {
+    ...env,
+    GIT_CONFIG_COUNT: String(at + 1),
+    [`GIT_CONFIG_KEY_${at}`]: key,
+    [`GIT_CONFIG_VALUE_${at}`]: value
+  };
+}
+function tokenHeader(token) {
+  return `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+}
+function withTokenHeader(env, url, token) {
+  return withGitConfig(env, `http.${url}.extraHeader`, tokenHeader(token));
+}
+function withHooksPath(env, dir) {
+  return withGitConfig(env, "core.hooksPath", dir);
+}
+function commitIdentityRecord(identity) {
+  return {
+    author: identity === void 0 ? "host" : "app",
+    coAuthor: identity?.coAuthor !== void 0 && identity.hooksPath !== void 0 ? "credited" : "none"
+  };
+}
+
 // src/runner/repositories.ts
 function parseClaimedRepositories(value) {
   if (!Array.isArray(value) || value.length === 0) return void 0;
@@ -372,10 +426,19 @@ function primaryOf(repositories) {
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
 var EVAL_INPUT_DIR = `${JOB_MOUNT}/eval-input`;
+var BUILD_HOME = "/build/home";
 var CHECKOUT_DIR = "/build/work/checkout";
 var REPOS_DIR = "/build/work/repos";
 function checkoutPath(entry) {
-  return entry.primary ? CHECKOUT_DIR : `${REPOS_DIR}/${entry.repository}`;
+  return entry.primary ? CHECKOUT_DIR : repositoryPath(entry.repository);
+}
+function repositoryPath(repository) {
+  return `${REPOS_DIR}/${repository.toLowerCase()}`;
+}
+function lifecycleWorkdir(repositories, governingRepository) {
+  const governing = governingRepository?.toLowerCase();
+  const entry = governing === void 0 ? void 0 : repositories.find((candidate) => candidate.repository.toLowerCase() === governing);
+  return entry === void 0 ? CHECKOUT_DIR : checkoutPath(entry);
 }
 var MAX_HOSTS = 200;
 function tokenVariables() {
@@ -404,10 +467,16 @@ function proxyEnvironment(proxyUrl, alsoNoProxy) {
     YARN_HTTP_PROXY: proxyUrl
   };
 }
+var PROXY_WARNING_FLAG = "--disable-warning=UNDICI-EHPA";
+function withProxyWarningHidden(options) {
+  const given = options?.trim() ?? "";
+  if (given.split(/\s+/).includes(PROXY_WARNING_FLAG)) return given;
+  return given === "" ? PROXY_WARNING_FLAG : `${given} ${PROXY_WARNING_FLAG}`;
+}
 function runnerLiterals(repository, repositories = []) {
   return {
     OUTERLAYER_JOB_DIR: JOB_MOUNT,
-    HOME: "/build/home",
+    HOME: BUILD_HOME,
     TMPDIR: "/tmp",
     ...proxyEnvironment(PROXY_URL),
     GIT_TERMINAL_PROMPT: "0",
@@ -466,6 +535,11 @@ function buildEnvironment(input) {
     passed[name] = value;
     variables.push(name);
   }
+  const nodeOptions = {};
+  if (input.imageEnv !== void 0) {
+    if (passed.NODE_OPTIONS !== void 0) passed.NODE_OPTIONS = withProxyWarningHidden(passed.NODE_OPTIONS);
+    else nodeOptions.NODE_OPTIONS = withProxyWarningHidden(recipe.NODE_OPTIONS ?? input.imageEnv.NODE_OPTIONS);
+  }
   const destinations = destinationEnvironment(input.config.build?.destinations, containerLocalAddress);
   const builtInLiterals = builtIns ? builtInEnvironment(containerBuiltInAddress, claudeCredential(input.hostEnv)) : {};
   const hooksPath = input.identity?.hooksPath;
@@ -483,6 +557,7 @@ function buildEnvironment(input) {
   return {
     literals: {
       ...recipe,
+      ...nodeOptions,
       ...destinations,
       ...runnerLiterals(input.repository, repositoriesOf({ repositories: input.repositories, repository: input.repository, branch: input.branch })),
       ...builtInLiterals,
@@ -502,7 +577,8 @@ function checkEnvironment(input) {
     repository: input.repository,
     hostEnv: input.hostEnv,
     containerEnv: input.containerEnv,
-    builtIns: false
+    builtIns: false,
+    imageEnv: input.imageEnv
   });
   const withheld = /* @__PURE__ */ new Set(["OUTERLAYER_URL", "OUTERLAYER_API_KEY", ...CLAUDE_CREDENTIAL_VARIABLES]);
   const literals = { OUTERLAYER_EVAL_INPUT: EVAL_INPUT_DIR };
@@ -544,4 +620,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseClaimedRepositories, parseIsolation, primaryOf, proxyEnvironment, repositoriesOf, resolveDestinations, sharedUserEnvironment, startBuildServices, withTunnelRecord };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, commitIdentityRecord, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, primaryOf, proxyEnvironment, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord };

package/dist/chunk-CRB3POP4.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { join, sep } from 'path';
+import { fileURLToPath } from 'url';
+
+createRequire(import.meta.url);
+var CLI_PACKAGE = "@outerlayer/cli";
+function packageRunnerOf(bin) {
+  for (const part of bin.replace(/\\/g, "/").split("/")) {
+    if (part === "_npx") return "npx";
+    if (part === "dlx") return "pnpm dlx";
+    if (part.startsWith("dlx-")) return "yarn dlx";
+    if (part.startsWith("bunx-")) return "bunx";
+  }
+  return void 0;
+}
+function runningModule() {
+  try {
+    return fileURLToPath(import.meta.url);
+  } catch {
+    return "";
+  }
+}
+function cliInvocation(opts = {}) {
+  const bin = opts.bin ?? runningModule();
+  const runner = packageRunnerOf(bin);
+  if (runner !== void 0) return `${runner} ${CLI_PACKAGE}`;
+  const installedCopy = join(opts.home ?? homeFromEnv(), ".outerlayer", "cli") + sep;
+  if (bin.startsWith(installedCopy)) return `npx ${CLI_PACKAGE}`;
+  return "outerlayer";
+}
+
+export { cliInvocation, packageRunnerOf };

package/dist/{chunk-F47JBIAW.js → chunk-DSF2FWAZ.js}

@@ -2,6 +2,7 @@
 import { createRequire } from 'node:module';
 import { recordReportedCost } from './chunk-BKO6JEZI.js';
 import { decodeWrappedCommand } from './chunk-5QRP3MVS.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync } from 'fs';
 import { spawn } from 'child_process';
@@ -69,7 +70,7 @@ function renderStatusline(stdin, state, now) {
     segments.push(`${state.unsynced} unsynced`);
   }
   if (!fresh) {
-    segments.push(dim("outerlayer doctor"));
+    segments.push(dim(`${cliInvocation()} doctor`));
   }
   const prefix = "\u2B22 OL";
   return segments.length === 0 ? prefix : `${prefix}  ${segments.join(dim(" \xB7 "))}`;

package/dist/{chunk-N5FOE5PS.js → chunk-ECODQ7II.js}

@@ -1,40 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
-import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync } from 'fs';
+import { isSameProcess } from './chunk-JBJTC3UU.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
+import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
-import { execFileSync } from 'child_process';
 
 createRequire(import.meta.url);
-function startTimeOf(pid) {
-  if (process.platform === "linux") return startTimeOfLinux(pid);
-  return startTimeOfPs(pid);
-}
-function startTimeOfLinux(pid) {
-  try {
-    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
-    const afterComm = stat.slice(stat.lastIndexOf(")") + 1).trim();
-    const fields = afterComm.split(/\s+/);
-    if (fields[0] === "Z" || fields[0] === "X") return null;
-    const starttime = fields[19];
-    return starttime ?? null;
-  } catch {
-    return null;
-  }
-}
-function startTimeOfPs(pid) {
-  try {
-    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" }).trim();
-    return out.length > 0 ? out : null;
-  } catch {
-    return null;
-  }
-}
-function isSameProcess(pid, start) {
-  return startTimeOf(pid) === start;
-}
-
-// src/runner/pidfile.ts
 function readPidFile(path) {
   if (!existsSync(path)) return null;
   try {
@@ -68,4 +39,4 @@ function claimPidFile(path, self, isSameProcessFn = isSameProcess) {
   writePidFile(path, self);
 }
 
-export { RunnerAlreadyRunningError, claimPidFile, isSameProcess, readPidFile, releasePidFile, startTimeOf };
+export { RunnerAlreadyRunningError, claimPidFile, readPidFile, releasePidFile };

package/dist/{chunk-NBGDBTO2.js → chunk-ESC6UR76.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-XCK2YAY5.js';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-42ZI52JW.js';
-import { pinExists, readContextManifest } from './chunk-WTE3MQML.js';
-import { resolvePackRoot, loadTemplateFiles, skillDir } from './chunk-POJMEEJJ.js';
+import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-F4XSVQJ4.js';
+import { pinExists, readContextManifest } from './chunk-LXAY4A2G.js';
+import { resolvePackRoot, loadTemplateFiles, skillDir } from './chunk-MNTSH4CL.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
@@ -109,7 +110,7 @@ function contextIsGoverned(root, gitCommonDir) {
   return pinExists(root) || readContextManifest(gitCommonDir) !== void 0;
 }
 var NAME = "Starter files";
-var UPDATE = "outerlayer init --update";
+var UPDATE = `${cliInvocation()} init --update`;
 function shownPaths(items, all) {
   const shown = [];
   const whole = /* @__PURE__ */ new Set();

package/dist/{chunk-HHJDN6AU.js → chunk-ESVW4MJY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readLaunchSpoolState, launchesPath } from './chunk-GQD22KKN.js';
+import { readLaunchSpoolState, launchesPath } from './chunk-T2Q7ISPE.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-42ZI52JW.js → chunk-F4XSVQJ4.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-POJMEEJJ.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-MNTSH4CL.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 
@@ -98,7 +99,7 @@ function formatStarterPackOutput(result) {
     ...result.validatorsKept.map((path) => `${C.dim}${path} already exists \u2014 left as it is${C.reset}`),
     "",
     `Next: create .outerlayer/config.json naming your agent tools, for example {"targets": ["claude-code"]},`,
-    `then run ${C.yellow}outerlayer context emit${C.reset} to compile the skills into their native files.`
+    `then run ${C.yellow}${cliInvocation()} context emit${C.reset} to compile the skills into their native files.`
   );
   return lines.join("\n") + "\n";
 }

package/dist/{chunk-LWSJQJC6.js → chunk-FUB7LRUE.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-VQYBXPI7.js';
-import { describeCallFailure } from './chunk-MAK5LYRF.js';
-import { WorkCommandError, getJson } from './chunk-S3NYLI2P.js';
-import { builtinKind } from './chunk-22RMZBGW.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-4Q7OMKAT.js';
-import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
-import { signerFor } from './chunk-V7NIVOFD.js';
+import { isPlaceholderCommand } from './chunk-GOBOJMOJ.js';
+import { describeCallFailure } from './chunk-6CHIYEZZ.js';
+import { WorkCommandError, getJson } from './chunk-KK4VBOH6.js';
+import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
+import { builtinKind } from './chunk-XGP3VYOG.js';
+import { signerFor } from './chunk-M2ZWWTWZ.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-BQXFBI7T.js';
 
 createRequire(import.meta.url);
 

package/dist/chunk-G2YNJIGF.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/control-plane-paths.ts
+var CONTROL_PLANE_DIR_VARIABLE = "OUTERLAYER_CONTROL_PLANE_DIR";
+var PROJECT_DIR_SPELLINGS = [
+  /"\$\{?CLAUDE_PROJECT_DIR\}?"\/\.claude(?![\w.-])/g,
+  /\$\{CLAUDE_PROJECT_DIR\}\/\.claude(?![\w.-])/g,
+  /\$CLAUDE_PROJECT_DIR\/\.claude(?![\w.-])/g
+];
+var CONTROL_PLANE_VARIABLE_FORMS = [
+  new RegExp(`\\$\\{${CONTROL_PLANE_DIR_VARIABLE}:-[^}]*\\}/\\.claude(?![\\w.-])`, "g"),
+  new RegExp(`\\$\\{${CONTROL_PLANE_DIR_VARIABLE}\\}/\\.claude(?![\\w.-])`, "g"),
+  new RegExp(`\\$${CONTROL_PLANE_DIR_VARIABLE}/\\.claude(?![\\w.-])`, "g")
+];
+function rewriteHookCommand(command, dir) {
+  return PROJECT_DIR_SPELLINGS.reduce((text, pattern) => text.replace(pattern, () => `${dir}/.claude`), command);
+}
+function rewriteControlPlanePaths(text, dir) {
+  return text.replace(/(?<![\w./~$}:-])(\.outerlayer|\.claude)\//g, (_match, root) => `${dir}/${root}/`);
+}
+function hookCommandEscapesControlPlane(command) {
+  const remaining = [...PROJECT_DIR_SPELLINGS, ...CONTROL_PLANE_VARIABLE_FORMS].reduce((text, pattern) => text.replace(pattern, " "), command);
+  return /\.claude(?:\/|["'\s;|&)]|$)/.test(remaining) || /\$\{?CLAUDE_PROJECT_DIR\}?"?\/\.claude/.test(remaining);
+}
+var MINIMUM_CLAUDE_VERSION = "2.1.284";
+function versionParts(text) {
+  const found = /(\d+)\.(\d+)\.(\d+)/.exec(text);
+  return found === null ? void 0 : [Number(found[1]), Number(found[2]), Number(found[3])];
+}
+function versionAtLeast(text, minimum = MINIMUM_CLAUDE_VERSION) {
+  const have = versionParts(text);
+  const need = versionParts(minimum);
+  if (have === void 0 || need === void 0) return false;
+  const difference = have.map((part, i) => part - need[i]).find((delta) => delta !== 0);
+  return (difference ?? 0) >= 0;
+}
+var SHIM_SCRIPT = `#!/bin/sh
+exec outerlayer claude "$@"
+`;
+
+export { CONTROL_PLANE_DIR_VARIABLE, MINIMUM_CLAUDE_VERSION, SHIM_SCRIPT, hookCommandEscapesControlPlane, rewriteControlPlanePaths, rewriteHookCommand, versionAtLeast };

package/dist/{chunk-QKFB4K7X.js → chunk-GGOMT6KF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-RSNSZ2LJ.js';
+import { EXEC_PORT } from './chunk-X5H2WYMB.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-VQYBXPI7.js → chunk-GOBOJMOJ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-ONKJUM6R.js';
-import { MIN_ENGINE_MAJOR } from './chunk-MAK5LYRF.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-OZGHL5Y5.js';
-import { runnerCredentialProblem } from './chunk-22RMZBGW.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-NL4XPC7W.js';
+import { MIN_ENGINE_MAJOR } from './chunk-Y5MXET4M.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-SWCTGCSC.js';
+import { runnerCredentialProblem } from './chunk-XGP3VYOG.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-N6LURUEF.js → chunk-GOSFARMS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { C } from './chunk-YRYMNBGQ.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfig, removeCloudConfigKeys } from './chunk-EABW6AJQ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/chunk-JBJTC3UU.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readFileSync } from 'fs';
+import { execFileSync } from 'child_process';
+
+createRequire(import.meta.url);
+function startTimeOf(pid) {
+  if (process.platform === "linux") return startTimeOfLinux(pid);
+  return startTimeOfPs(pid);
+}
+function startTimeOfLinux(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    const afterComm = stat.slice(stat.lastIndexOf(")") + 1).trim();
+    const fields = afterComm.split(/\s+/);
+    if (fields[0] === "Z" || fields[0] === "X") return null;
+    const starttime = fields[19];
+    return starttime ?? null;
+  } catch {
+    return null;
+  }
+}
+function startTimeOfPs(pid) {
+  try {
+    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" }).trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+function isSameProcess(pid, start) {
+  return startTimeOf(pid) === start;
+}
+
+export { isSameProcess, startTimeOf };

package/dist/{chunk-NWQTTSBB.js → chunk-JF42URPU.js}

@@ -1,22 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LaunchFilter } from './chunk-HHJDN6AU.js';
+import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-MQJSXHV7.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-WUYTWNMA.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-JXYVA45C.js';
-import { C } from './chunk-YRYMNBGQ.js';
-import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
-import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
-import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-J5M7BSJQ.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-BMYGAGBJ.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
+import { defaultFetch } from './chunk-ZRL6HKBY.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-52NC2FIU.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-N3CUDFCW.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
-import { signerFor, signRunnerRequest } from './chunk-V7NIVOFD.js';
-import { writeSyncStatus, spoolDir } from './chunk-BWQ66M6N.js';
+import { signerFor, signRunnerRequest } from './chunk-M2ZWWTWZ.js';
+import { writeSyncStatus, spoolDir } from './chunk-ULSIJGLS.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
+import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
@@ -668,7 +669,7 @@ var LiveUploader = class {
       const credential = this.env.OUTERLAYER_API_KEY;
       const appId = this.env.OUTERLAYER_APP_ID;
       if (!url || !credential || !appId) {
-        this.warnOnce("incomplete", `live upload is idle: this build's environment lacks ${[!url && "OUTERLAYER_URL", !credential && "OUTERLAYER_API_KEY", !appId && "OUTERLAYER_APP_ID"].filter(Boolean).join(", ")}, so nothing streams until \`outerlayer sync\` runs.
+        this.warnOnce("incomplete", `live upload is idle: this build's environment lacks ${[!url && "OUTERLAYER_URL", !credential && "OUTERLAYER_API_KEY", !appId && "OUTERLAYER_APP_ID"].filter(Boolean).join(", ")}, so nothing streams until \`${cliInvocation()} sync\` runs.
 `);
         return false;
       }
@@ -724,7 +725,7 @@ var LiveUploader = class {
         this.stopped = true;
         this.onUnauthorized?.();
         this.stderr(
-          destination.credential.startsWith("olu_") ? `live upload stopped: the login was refused (expired or revoked). No session streams from this daemon until you run \`outerlayer login\` and it restarts.
+          destination.credential.startsWith("olu_") ? `live upload stopped: the login was refused (expired or revoked). No session streams from this daemon until you run \`${cliInvocation()} login\` and it restarts.
 ` : `live upload stopped: the API key was refused. No session streams from this daemon until it restarts with a valid key.
 `
         );
@@ -739,7 +740,7 @@ var LiveUploader = class {
           lastError: reason,
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         });
-        this.stderr(`live upload stopped for session ${prepared.id}: ${reason}. The next \`outerlayer sync\` uploads it whole.
+        this.stderr(`live upload stopped for session ${prepared.id}: ${reason}. The next \`${cliInvocation()} sync\` uploads it whole.
 `);
         return true;
       }
@@ -1439,7 +1440,7 @@ async function runSyncInner(opts, stats) {
       if (opts.quiet || shippedBatches === 0) return;
       process.stderr.write(
         `
-${C.yellow}!${C.reset} progress saved: ${synced} session(s) in ${shippedBatches}/${batches.length} batch(es) shipped before the failure \u2014 re-run ${C.dim}outerlayer sync${C.reset} to resume from there.
+${C.yellow}!${C.reset} progress saved: ${synced} session(s) in ${shippedBatches}/${batches.length} batch(es) shipped before the failure \u2014 re-run ${C.dim}${cliInvocation()} sync${C.reset} to resume from there.
 `
       );
     };

package/dist/{chunk-ADJRGVZC.js → chunk-KDVIU23F.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 17;
+var RUNNER_PROTOCOL = 19;
 
 export { RUNNER_PROTOCOL };