@outerlayer/cli 0.18.0 → 0.19.0

package/dist/{chunk-3OFZM4X6.js → chunk-6U3MV7TZ.js}

@@ -1,34 +1,34 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-SADUQSO4.js';
-import { senderPidfile } from './chunk-UYOYTKE2.js';
+import { senderPidfile } from './chunk-5GHGAF6P.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-XNGMQ27R.js';
-import { installScrubContext } from './chunk-JF42URPU.js';
-import { AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-Y5MXET4M.js';
-import { childEnvironment } from './chunk-L2USZT6T.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR } from './chunk-S26M3YBJ.js';
+import { installScrubContext } from './chunk-7SJPQWBM.js';
+import { AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-7KSSBQTS.js';
+import { childEnvironment } from './chunk-VMJPFQNE.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR } from './chunk-3UZTIRLF.js';
 import { waitForAgent, vmExecArgs } from './chunk-GGOMT6KF.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-X5H2WYMB.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-6CHIYEZZ.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-KK4VBOH6.js';
-import { planArtifactUpload } from './chunk-MQJSXHV7.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-XGP3VYOG.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-XSZD4AZ6.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-HPJNLETG.js';
+import { planArtifactUpload } from './chunk-G3IJ3N6F.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-P53VEAOF.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { readBranchHead, fetchCommit, diffBetween } from './chunk-3CWUOFV6.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { scrubText } from './chunk-BMYGAGBJ.js';
-import { resolvePackRoot } from './chunk-MNTSH4CL.js';
-import { parsePolicy } from './chunk-X5N6KC6V.js';
+import { scrubText } from './chunk-QNLX477Q.js';
+import { resolvePackRoot } from './chunk-NNLA7LLQ.js';
+import { parsePolicy } from './chunk-WFSUUUAN.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { signerFor } from './chunk-M2ZWWTWZ.js';
 import { runnerDir, buildDir, vsockPath, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BQXFBI7T.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { spawn, spawnSync } from 'child_process';
 import { randomBytes, createHash } from 'crypto';
-import { mkdirSync, chmodSync, writeFileSync, appendFileSync, statSync, accessSync, constants, openSync, existsSync, readFileSync, closeSync, rmSync, readdirSync, lstatSync, realpathSync } from 'fs';
+import { mkdirSync, chmodSync, writeFileSync, appendFileSync, statSync, accessSync, constants, openSync, existsSync, readFileSync, closeSync, rmSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';
 import { pathToFileURL } from 'url';
 
@@ -989,6 +989,119 @@ async function settleVerdict(deps) {
     await deps.sleep(everyMs);
   }
 }
+var RUNNER_LOG_FILE = "runner.log";
+var RUNNER_LOG_KEEP_BYTES = 65536;
+function isTailedStage(stage) {
+  const tailed = ["provision", "sync", "cleanup", "report"];
+  return tailed.includes(stage);
+}
+var READ_LIMIT_BYTES = 1048576;
+var ITEM_LINE = /^#(\d+)\b/;
+var AttemptLogBook = class {
+  constructor(now = () => /* @__PURE__ */ new Date()) {
+    this.now = now;
+    this.dirs = /* @__PURE__ */ new Map();
+    this.lastByKey = /* @__PURE__ */ new Map();
+  }
+  /** Starts keeping lines for `item` in `jobDirPath`. Idempotent. */
+  open(item, jobDirPath) {
+    this.dirs.set(Number(item), jobDirPath);
+  }
+  /** Stops keeping lines for `item`; its file stays on disk until housekeeping removes the job directory. */
+  close(item) {
+    const number = Number(item);
+    this.dirs.delete(number);
+    for (const key of [...this.lastByKey.keys()]) {
+      if (key.startsWith(`${number}:`)) this.lastByKey.delete(key);
+    }
+  }
+  /** The log with every line it writes for an open item also kept in that item's file. */
+  wrap(log) {
+    return {
+      line: (text2) => {
+        log.line(text2);
+        this.keepItemLine(text2);
+      },
+      error: (text2) => {
+        log.error(text2);
+        this.keepItemLine(text2);
+      }
+    };
+  }
+  /** One line for `item` that does not itself start with its number. */
+  note(item, text2) {
+    this.append(Number(item), text2);
+  }
+  /** One line, written only when `text` differs from the last one written under `key` for the item. */
+  noteChanged(item, key, text2) {
+    const number = Number(item);
+    const slot = `${number}:${key}`;
+    if (this.lastByKey.get(slot) === text2) return;
+    this.lastByKey.set(slot, text2);
+    this.append(number, text2);
+  }
+  keepItemLine(text2) {
+    const match = ITEM_LINE.exec(text2);
+    if (match !== null) this.append(Number(match[1]), text2);
+  }
+  append(item, text2) {
+    const dir = this.dirs.get(item);
+    if (dir === void 0) return;
+    try {
+      appendFileSync(join(dir, RUNNER_LOG_FILE), `${logStamp(this.now())} ${text2.replace(/[\r\n]+/g, " ")}
+`, { mode: 384 });
+    } catch {
+    }
+  }
+};
+function readEnd(path, maxBytes) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const size = fstatSync(fd).size;
+    const length = Math.min(size, maxBytes);
+    const buffer = Buffer.alloc(length);
+    readSync(fd, buffer, 0, length, size - length);
+    return buffer.toString("utf8");
+  } catch {
+    return void 0;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+function lastLines(text2, count) {
+  const lines = text2.split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  return lines.slice(-200);
+}
+function capRunnerLog(text2) {
+  const bytes = Buffer.from(text2, "utf8");
+  if (bytes.length <= RUNNER_LOG_KEEP_BYTES) return text2;
+  let start = bytes.length - RUNNER_LOG_KEEP_BYTES;
+  if (bytes[start - 1] !== 10) {
+    const newline = bytes.indexOf(10, start);
+    if (newline + 1 < bytes.length) {
+      start = newline + 1;
+    } else {
+      while ((bytes[start] & 192) === 128) start++;
+    }
+  }
+  return `[runner log truncated: the first ${start} bytes were cut]
+${bytes.subarray(start).toString("utf8")}`;
+}
+function buildReleaseLog(jobDirPath, endStage, scrub) {
+  const parts = [];
+  const own = readEnd(join(jobDirPath, RUNNER_LOG_FILE), READ_LIMIT_BYTES);
+  if (own !== void 0 && own.trim() !== "") parts.push(own.endsWith("\n") ? own.slice(0, -1) : own);
+  if (isTailedStage(endStage)) {
+    const file = `${endStage}.log`;
+    const stage = readEnd(join(jobDirPath, file), READ_LIMIT_BYTES);
+    const tail = stage === void 0 ? [] : lastLines(stage);
+    if (tail.length > 0) parts.push(`--- the last ${tail.length} lines of ${file} ---`, ...tail);
+  }
+  if (parts.length === 0) return void 0;
+  return capRunnerLog(scrub(parts.join("\n")) + "\n");
+}
 var ENDED = "ended before provision finished";
 async function provisionProcess(input) {
   const { config, runtime, item, repository, jobDir } = input;
@@ -1898,6 +2011,14 @@ function transcriptScrub(config, secrets) {
 function stripUnsendableReasonChars(text2) {
   return text2.replace(/\u0000/g, "").replace(/\p{Cs}/gu, "");
 }
+function stripTerminalControls(text2) {
+  return text2.replace(/\u001b\[[0-?]*[ -\/]*[@-~]/g, "").replace(/\u001b\][^\u0007\u001b\r\n]*(?:\u0007|\u001b\\)?/g, "").replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "");
+}
+function releaseLogFor(jobDirPath, job, config) {
+  const home = homeFromEnv();
+  installScrubContext(home, transcriptScrub(config, [job.itemKey, config.apiKey]));
+  return buildReleaseLog(jobDirPath, job.endStage, (text2) => scrubText(stripTerminalControls(stripUnsendableReasonChars(text2))));
+}
 function readReasonLine(jobDirPath, config, home = homeFromEnv()) {
   let raw;
   try {
@@ -2032,28 +2153,31 @@ async function renewLease(config, item, fetchImpl) {
 }
 var ALREADY_RELEASED = "already released";
 async function releaseLease(config, item, outcome, detail, fetchImpl) {
-  const send = async (environment2, sent2) => postJson(
+  const send = async (environment2, sent2, log2) => postJson(
     config.url,
     `/v1/work-items/${item}/claim/release`,
     config.apiKey,
     config.appId,
-    { host: config.host, outcome: sent2, stage: detail.stage, exitCode: detail.exitCode, reason: detail.reason, environment: environment2 },
+    { host: config.host, outcome: sent2, stage: detail.stage, exitCode: detail.exitCode, reason: detail.reason, environment: environment2, log: log2 },
     fetchImpl,
     void 0,
     await signerFor(config.configPath)
   );
   let environment = detail.environment;
   let sent = outcome;
+  let log = detail.log;
   let data;
   for (; ; ) {
     try {
-      ({ data } = await send(environment, sent));
+      ({ data } = await send(environment, sent, log));
       break;
     } catch (err) {
       if (!(err instanceof WorkCommandError) || err.status !== 400 || err.code !== "invalid_request_body") throw err;
       const namesOutcome = /\boutcome\b/.test(err.message);
       if (sent === "incomplete" && namesOutcome) {
         sent = "ok";
+      } else if (log !== void 0 && /\blog\b/.test(err.message)) {
+        log = void 0;
       } else if (environment?.controlPlane !== void 0) {
         const { controlPlane: _omittedPlane, ...withoutPlane } = environment;
         environment = withoutPlane;
@@ -2150,6 +2274,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   const jobFilePath = join(jobDirPath, "job.json");
   const logPath = join(jobDirPath, "command.log");
   const tag = `#${job.item}`;
+  deps.attemptLogs?.open(job.item, jobDirPath);
   if (job.sender !== void 0) {
     await stopSender({ job, deps: { spawnFn, runtime: deps.container, log } });
     delete job.sender;
@@ -2424,6 +2549,9 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     } else if (ending?.reason === void 0) {
       job.reason = (outcome === "ok" ? void 0 : held?.reason) ?? (isolated ? fromHook ?? job.reason : fromHook);
     }
+    if (outcome === "failed" && job.reason === void 0 && job.commandEndReason !== void 0) {
+      job.reason = scrubReason(job.commandEndReason, config);
+    }
     const cliVersion = deps.cliVersion ?? resolveVersion();
     const base = job.environment ?? (job.microvm !== void 0 ? { isolation: "vm", cliVersion } : job.container === void 0 ? sharedUserEnvironment(cliVersion) : { isolation: "container", cliVersion });
     if (isolated || job.build !== void 0) {
@@ -2436,7 +2564,8 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     writeJobFile(jobFilePath, job);
   }
   const sentAtMs = now().getTime();
-  const detail = outcome === void 0 ? {} : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment };
+  const runnerLog = releaseLogFor(jobDirPath, job, config);
+  const detail = outcome === void 0 ? { log: runnerLog } : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment, log: runnerLog };
   const release = await retrySend(() => releaseLease(config, job.item, outcome, detail, deps.fetchImpl), {
     now: deps.now,
     sleep: deps.sleep
@@ -2447,6 +2576,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   job.endedAt = endedAt.toISOString();
   job.releaseFailed = release.ok ? alreadyReleased ? ALREADY_RELEASED : void 0 : release.reason;
   writeJobFile(jobFilePath, job);
+  deps.attemptLogs?.close(job.item);
   const total = formatDuration(endedAt.getTime() - new Date(job.startedAt).getTime());
   if (alreadyReleased) {
     log.line(
@@ -2492,7 +2622,8 @@ async function retryFailedReleases(jobsDirPath, config, deps) {
     if (!job || job.releaseFailed === void 0 || job.releaseFailed === ALREADY_RELEASED || isUnfinished(job)) {
       continue;
     }
-    const detail = job.outcome === void 0 ? {} : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment };
+    const runnerLog = releaseLogFor(dirPath, job, config);
+    const detail = job.outcome === void 0 ? { log: runnerLog } : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment, log: runnerLog };
     const release = await retrySend(() => releaseLease(config, job.item, job.outcome, detail, deps.fetchImpl), {
       now: deps.now,
       sleep: deps.sleep
@@ -2665,4 +2796,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, LEASE_SECONDS, RENEW_INTERVAL_SECONDS, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, isGroupAlive, isIdle, isTimedOut, isUnfinished, jobEnv, listAdoptableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, retryFailedReleases, runCommand, runHook, setStage, startHostServices, startSender, stopOrphanedMicroVms, unfinishedJobs, workdirProblem };
+export { ALREADY_RELEASED, AttemptLogBook, LEASE_SECONDS, RENEW_INTERVAL_SECONDS, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, isGroupAlive, isIdle, isTimedOut, isUnfinished, jobEnv, listAdoptableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, retryFailedReleases, runCommand, runHook, setStage, startHostServices, startSender, stopOrphanedMicroVms, unfinishedJobs, workdirProblem };

package/dist/{chunk-F4XSVQJ4.js → chunk-6X4SQ5MY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-MNTSH4CL.js';
-import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-NNLA7LLQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-Y5MXET4M.js → chunk-7KSSBQTS.js}

@@ -1,24 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-L2USZT6T.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, JUDGE_DIR, MAX_REPORT_BYTES } from './chunk-S26M3YBJ.js';
+import { currentCliBuild } from './chunk-OGFGZQA3.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-VMJPFQNE.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, JUDGE_DIR, MAX_REPORT_BYTES } from './chunk-3UZTIRLF.js';
 import { execCapture } from './chunk-GGOMT6KF.js';
 import { GUEST_CID } from './chunk-X5H2WYMB.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, sharedSkillNames, shimScript } from './chunk-6CHIYEZZ.js';
-import { WorkCommandError } from './chunk-KK4VBOH6.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-XSZD4AZ6.js';
+import { WorkCommandError } from './chunk-HPJNLETG.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3CWUOFV6.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-BMYGAGBJ.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-X5N6KC6V.js';
-import { downconvertSession } from './chunk-N3CUDFCW.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QNLX477Q.js';
+import { sharedSkillNames, skillConflictMessage } from './chunk-LLM3I5YU.js';
+import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-G2YNJIGF.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-WFSUUUAN.js';
+import { downconvertSession } from './chunk-7VUK5RFS.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-N2PXGQRL.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BQXFBI7T.js';
-import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-G2YNJIGF.js';
 import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { join, dirname, basename } from 'path';
 import { spawnSync, spawn } from 'child_process';
@@ -731,7 +732,7 @@ async function deliveryRefusal(input, staged) {
   const ownNames = new Set(own.stdout.split("\n").map((name) => name.trim()));
   const clash = sharedSkillNames(join(staged.dir, "tree")).find((name) => ownNames.has(name));
   if (clash === void 0) return void 0;
-  return `context_skill_conflict: .claude/skills/${clash} in ${input.repository} has the same name as the shared skill ${clash} from ${staged.repository}, and would replace it in this build; rename or remove it from the repository`;
+  return `context_skill_conflict: ${skillConflictMessage({ skill: clash, repository: input.repository, controlPlane: staged.repository })}, and would replace it in this build; rename or remove it from the repository`;
 }
 async function deliver(input, staged) {
   const dir = deliveryDir(staged.repository, staged.sha);

package/dist/{chunk-JF42URPU.js → chunk-7SJPQWBM.js}

@@ -1,24 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { uploadSpooledSteps } from './chunk-KYS3TQAG.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-MQJSXHV7.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-G3IJ3N6F.js';
+import { writeSyncStatus, spoolDir } from './chunk-NFIR3GEE.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-BMYGAGBJ.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QNLX477Q.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
-import { defaultFetch } from './chunk-ZRL6HKBY.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-52NC2FIU.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-N3CUDFCW.js';
-import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
-import { signerFor, signRunnerRequest } from './chunk-M2ZWWTWZ.js';
-import { writeSyncStatus, spoolDir } from './chunk-ULSIJGLS.js';
-import { removeJournalHooks } from './chunk-XCCLFVXM.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-NTRCK4NH.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-7VUK5RFS.js';
+import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { signerFor, signRunnerRequest } from './chunk-M2ZWWTWZ.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';
@@ -1797,6 +1798,29 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting
       }
     }
     releaseArtifactLock();
+    const stepPass = await uploadSpooledSteps({
+      home,
+      url,
+      apiKey,
+      appId,
+      kind: resolved.kind,
+      onlyItem: itemScope?.item,
+      fetchImpl,
+      quiet: opts.quiet,
+      lockWaitMs: opts.artifactLockWaitMs
+    });
+    if (stepPass !== void 0) {
+      if (stepPass.uploaded > 0) stats.contacted = true;
+      if (!opts.quiet) {
+        process.stderr.write(
+          `${C.dim}steps${C.reset} ${stepPass.uploaded} uploaded \xB7 ${stepPass.pending} queued \xB7 ${stepPass.dropped} dropped
+`
+        );
+      }
+      if (stepPass.unauthorized !== void 0) {
+        throw new SyncTransportError(stepPass.unauthorized, 401);
+      }
+    }
     if (shippedBatches === batches.length && (opts.url || opts.apiKey || opts.appId)) {
       if (isLoopbackUrl(url)) {
         if (!opts.quiet) {

package/dist/{chunk-N3CUDFCW.js → chunk-7VUK5RFS.js}

@@ -22279,7 +22279,7 @@ var ArtifactTombstoneRecordSchema = external_exports.looseObject({
 });
 external_exports.union([ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema]);
 var EMITTED_RESULTS = ["pass", "fail"];
-var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings"];
+var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings", "step"];
 var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).superRefine((name, ctx) => {
   if (RESERVED_EMIT_NAMES.includes(name)) {
     ctx.addIssue({
@@ -22324,6 +22324,19 @@ external_exports.object({
   item: external_exports.object({ number: external_exports.number().int().positive() }).optional(),
   sessionId: external_exports.string().optional()
 }).superRefine((request, ctx) => refuseDuplicateIds(request.criteria, ctx));
+var STEP_NAME_MAX = 80;
+var CONTROL_CHARACTER = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+var StepNameSchema = external_exports.string().trim().min(1, "name must not be empty").max(STEP_NAME_MAX, `name must be at most ${STEP_NAME_MAX} characters`).refine((name) => !CONTROL_CHARACTER.test(name), {
+  message: "name must be one line, with no line break or control character"
+});
+var StepBodySchema = external_exports.object({
+  /** Minted by the CLI once per step; the same id on the same item is the same step. */
+  clientStepId: external_exports.string().uuid(),
+  name: StepNameSchema,
+  item: external_exports.object({ number: external_exports.number().int().positive() }),
+  /** When the agent started the step. The gateway clamps it to the receive time. */
+  startedAt: external_exports.string().datetime({ offset: true })
+});
 var FINDING_CATEGORIES = ["context", "flaky-test", "tooling", "environment", "defect", "other"];
 var FINDING_RULE_RELATIONS = ["wrong", "broken", "missing"];
 var FINDING_ID_MAX_LENGTH = 64;
@@ -22531,4 +22544,4 @@ xmlchars/xmlns/1.0/ed3.js:
    *)
 */
 
-export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };
+export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };

package/dist/{chunk-SWCTGCSC.js → chunk-7YP7T6GV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-WGAUY5LE.js';
+import { DEFAULT_UNIT_NAME } from './chunk-QEFKA2QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
 import { RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';

package/dist/{chunk-KDVIU23F.js → chunk-BWSUPRDK.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 19;
+var RUNNER_PROTOCOL = 20;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-S76AYB4M.js → chunk-CG36IONK.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
-import { remoteLookupFailed } from './chunk-BMYGAGBJ.js';
-import { DEFAULT_DASHBOARD } from './chunk-NACDBXUG.js';
-import { resolveGatewayCredentials } from './chunk-52NC2FIU.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
+import { DEFAULT_DASHBOARD } from './chunk-BM63HB2M.js';
+import { remoteLookupFailed } from './chunk-QNLX477Q.js';
+import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { createInterface } from 'readline/promises';

package/dist/chunk-CJJDJ7AT.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { join, basename } from 'path';
+
+createRequire(import.meta.url);
+var BEGIN = "# BEGIN outerlayer claude";
+var END = "# END outerlayer claude";
+var SHELL_FUNCTION_LINE = 'claude() { outerlayer claude "$@"; }';
+var STARTUP_FILES = { zsh: ".zshrc", bash: ".bashrc" };
+function startupFileFor(home, shellPath) {
+  const name = STARTUP_FILES[basename(shellPath ?? "")];
+  return name === void 0 ? void 0 : join(home, name);
+}
+function blockLines() {
+  return [BEGIN, "# Added by `outerlayer init`. Remove this block, or run `outerlayer init --no-shell-function`, to undo it.", SHELL_FUNCTION_LINE, END];
+}
+function find(lines) {
+  let begin = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i] === BEGIN) begin = i;
+    else if (lines[i] === END && begin >= 0) return { begin, end: i };
+  }
+  return void 0;
+}
+function installShellFunction(input) {
+  const file = startupFileFor(input.home, input.shellPath);
+  if (file === void 0) return { status: "unsupported" };
+  const text = existsSync(file) ? readFileSync(file, "utf8") : "";
+  if (find(text.split("\n")) !== void 0) return { status: "unchanged", file };
+  const endsLine = text === "" || text.endsWith("\n");
+  writeFileSync(file, `${text}${endsLine ? "" : "\n"}
+${blockLines().join("\n")}${endsLine ? "\n" : ""}`);
+  return { status: "added", file };
+}
+function removeShellFunction(input) {
+  const changed = [];
+  for (const name of Object.values(STARTUP_FILES)) {
+    const file = join(input.home, name);
+    if (!existsSync(file)) continue;
+    const lines = readFileSync(file, "utf8").split("\n");
+    const found = find(lines);
+    if (found === void 0) continue;
+    const from = found.begin > 0 && lines[found.begin - 1] === "" ? found.begin - 1 : found.begin;
+    lines.splice(from, found.end - from + 1);
+    writeFileSync(file, lines.join("\n"));
+    changed.push(file);
+  }
+  return changed;
+}
+function shellFunctionInstalled(input) {
+  const file = startupFileFor(input.home, input.shellPath);
+  return file !== void 0 && existsSync(file) && find(readFileSync(file, "utf8").split("\n")) !== void 0;
+}
+
+export { SHELL_FUNCTION_LINE, installShellFunction, removeShellFunction, shellFunctionInstalled };

package/dist/{chunk-FUB7LRUE.js → chunk-DADWEUH3.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-GOBOJMOJ.js';
-import { describeCallFailure } from './chunk-6CHIYEZZ.js';
-import { WorkCommandError, getJson } from './chunk-KK4VBOH6.js';
-import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
-import { builtinKind } from './chunk-XGP3VYOG.js';
+import { isPlaceholderCommand } from './chunk-6D7GT22T.js';
+import { describeCallFailure } from './chunk-XSZD4AZ6.js';
+import { WorkCommandError, getJson } from './chunk-HPJNLETG.js';
+import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
+import { builtinKind } from './chunk-P53VEAOF.js';
 import { signerFor } from './chunk-M2ZWWTWZ.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-BQXFBI7T.js';
 

package/dist/{chunk-RAZTWYZN.js → chunk-DJ3ZUSC3.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-47TTLEDX.js';
+import { runEmit } from './chunk-ZHAUSEEN.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
-import { installStarterPack } from './chunk-F4XSVQJ4.js';
+import { installStarterPack } from './chunk-6X4SQ5MY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-W5VPCONO.js';
-import { pinExists, readContextManifest } from './chunk-LXAY4A2G.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-MNTSH4CL.js';
-import { generatedHeaderSource } from './chunk-X5N6KC6V.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-452TM7J4.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-NNLA7LLQ.js';
+import { generatedHeaderSource } from './chunk-WFSUUUAN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
@@ -40,10 +40,9 @@ function gitTopLevel(cwd) {
   }
 }
 function contextComesFromControlPlane(repoRoot) {
-  if (pinExists(repoRoot)) return true;
   const gitCommonDir = resolveGitCommonDir(defaultGitRunner, repoRoot);
   if (gitCommonDir === void 0) throw new GitLookupError("git could not report this repository's git directory");
-  return readContextManifest(gitCommonDir) !== void 0;
+  return cloneIsGoverned(gitCommonDir);
 }
 function mcpReplacementLosesNothing(existing, content) {
   try {

package/dist/{chunk-MQJSXHV7.js → chunk-G3IJ3N6F.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-N3CUDFCW.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-7VUK5RFS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';
@@ -273,7 +273,9 @@ function artifactLockIsStale(path, nowMs, isAlive) {
   }
 }
 async function acquireArtifactSpoolLock(home = homeFromEnv(), opts = {}) {
-  const path = artifactsLockPath(home);
+  return acquireSpoolLockAt(artifactsLockPath(home), opts);
+}
+async function acquireSpoolLockAt(path, opts = {}) {
   const waitMs = opts.waitMs ?? ARTIFACT_LOCK_WAIT_MS;
   const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const isAlive = opts.isAlive ?? processIsAlive;
@@ -460,4 +462,4 @@ function resolveArtifactTurnIndex(turns, filename) {
   return found;
 }
 
-export { ARTIFACT_RETRY_MAX_AGE_MS, acquireArtifactSpoolLock, appendArtifactRecord, appendArtifactTombstone, artifactBlobsDir, artifactsSpoolPath, artifactsStatePath, findPendingArtifactRecord, isArtifactTombstoned, localArtifactIds, migrateLegacyArtifactSidecars, neededArtifactShas, planArtifactUpload, readEffectiveArtifactSpoolState, reclaimUnneededArtifactBlobs, resolveArtifactTurnIndex, sanitizeTerminal, writeArtifactSpoolState };
+export { ARTIFACT_RETRY_MAX_AGE_MS, acquireArtifactSpoolLock, acquireSpoolLockAt, appendArtifactRecord, appendArtifactTombstone, artifactBlobsDir, artifactsSpoolPath, artifactsStatePath, findPendingArtifactRecord, isArtifactTombstoned, localArtifactIds, migrateLegacyArtifactSidecars, neededArtifactShas, planArtifactUpload, readEffectiveArtifactSpoolState, reclaimUnneededArtifactBlobs, resolveArtifactTurnIndex, sanitizeTerminal, writeArtifactSpoolState };