@outerlayer/cli 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @outerlayer/cli
 
+## 0.20.0
+
+### Minor Changes
+
+- 89270e0: `outerlayer emit criteria` reads an acceptance file ending in `.md`, so a person can record or replace an item's criteria from the file a build committed.
+- bf0bf30: `outerlayer work stop --item <n>` asks the host building an item to stop. The runner reports what it is doing, so an item can say why nothing is building it.
+
+## 0.19.1
+
+### Patch Changes
+
+- 331130f: A session start that removes an earlier CLI's copies also puts back `.outerlayer-pin.json` when that CLI rewrote it, so `git status` is clean afterwards. A staged change to the pin is left alone.
+
+  `outerlayer init --local --shell-function` adds the `claude` shell function, and `--local --no-shell-function` removes it. `--local` used to skip both flags without a word.
+
 ## 0.19.0
 
 ### Minor Changes

package/README.md

@@ -91,8 +91,10 @@ content:
   work item's general thread or a criterion thread — the detected session id
   rides along the same way it does for `emit`, only ever narrowing what the
   comment may do; `outerlayer work threads` reads them back. `outerlayer work logs`
-  reads the runner's log for a host attempt. A runner key
-  needs `git.read` and `work.read` to
+  reads the runner's log for a host attempt. `outerlayer work stop` sends
+  `POST /v1/work-items/<n>/claim/stop` with the optional note, and the
+  gateway records the request against the item's live host build. A runner
+  key needs `git.read` and `work.read` to
   list and read items, and `work.claim` to claim, renew or release — `work.claim`
   is not granted to a dashboard role by default, since a claim is a host's
   lease, not a person's.
@@ -118,6 +120,12 @@ content:
   off for want of disk it adds the free and needed bytes. While a check of
   its own stops it claiming, it adds one sentence saying why, which can
   include the host's usable memory and Docker's own error text, unscrubbed.
+  Every heartbeat also says what the runner is doing about new work (taking
+  work, draining, restarting, holding for an update, blocked or low on
+  disk), the queues and repository patterns it takes, and, while draining,
+  the numbers of the items it waits on. The reply can name a build that
+  someone stopped with `outerlayer work stop`; the runner then ends that
+  build and releases it as stopped, with the name of whoever stopped it.
   When a build's command exits 0, it reads that work item once more, for its
   evidence verdict, before releasing it: it sends nothing but the request.
   Just before that read, the runner runs the repository's host checks. A host
@@ -408,6 +416,7 @@ before it gives up.
 | `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. A JUnit XML file bound with `--for` proves a criterion that declares `test` proof; `--test <name[=path:line]>` binds only the named tests. |
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |
 | `outerlayer work comment --item <n> [--criterion <id>] --body <text> [--artifact <id>] [--pass\|--fail\|--attach\|--ready]` | Post one comment on a work item's general thread, or on one acceptance criterion's own thread with `--criterion`. `--pass`/`--fail` need a person's own credential and apply to the whole item, so they work on the general thread only and the gateway refuses them with `--criterion`; `--attach` makes the named artifact that criterion's current proof; `--ready` hands a thread back to a person. The detected session id rides along automatically, only ever narrowing what the comment may do. |
+| `outerlayer work stop --item <n> [--note <text>]` | Ask the host that holds the item's build to end it. The host reads the request at its next heartbeat and ends the build with outcome `stopped`, so the build may run a little longer. The item is not built again until a new build request. Needs `work.update`. Exits 1 when no host build is running for the item. |
 | `outerlayer work logs --item <n> [--attempt <claim id>]` | Print the runner's log for a host attempt on a work item: the newest attempt a runner made, or the one `--attempt` names (an `id` from `claims` in `work status --json`). The log is what the runner did around the agent, with secrets removed on the host. Exits 1 for an attempt that is still running or that an older runner released without a log. |
 | `outerlayer work threads --item <n>` | Read a work item's threads back — the general thread first, then one per criterion with proof or a comment, each with its `waitingOn`. |
 | `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] [--cause <text>] [--detail <text>] [--suggestion <text>] [--command <text>] [--error <text>] [--test <name>] [--symbol <name>] [--started-at <event> --ended-at <event>] [--problem <id> … --link-reason <text> \| --new] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. `--cause`, `--detail`, `--suggestion`, `--command`, `--error` (the first error line), `--test` and `--symbol` carry what a fix needs. Every finding joins a factory-level problem: when a key of the finding matches a known problem it joins that problem; otherwise nothing is stored, the closest problems are printed, and the command exits with code 3. Run it again with `--problem <id> --link-reason <text>` (repeat `--problem` for each problem the finding reports) or with `--new`. Without `--started-at`, it prints the session's recent events with ids and times; name the event where you hit the problem and the one where you got past it with `--started-at` and `--ended-at`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding and keeps its problems. |

package/dist/{agent-setup-TPR4BBFV.js → agent-setup-AM42SA2D.js}

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-DJ3ZUSC3.js';
-import './chunk-ZHAUSEEN.js';
+export { keepHandWritten, runAgentSetup } from './chunk-CGGPS7SI.js';
+import './chunk-5VML45HH.js';
 import './chunk-YVZJ6GKF.js';
 import './chunk-6X4SQ5MY.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-452TM7J4.js';
-import './chunk-IXYZUUYQ.js';
+import './chunk-EAEELQVQ.js';
+import './chunk-7UWVLZXD.js';
 import './chunk-FVMYKL6L.js';
 import './chunk-NTRCK4NH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-NNLA7LLQ.js';
-import './chunk-WFSUUUAN.js';
-import './chunk-7VUK5RFS.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-CRB3POP4.js';
 import './chunk-YQR6E6OV.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-13T19:11:37.037Z+109c2bd","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-14T00:32:09.011Z+25b1e13","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-UWQAL2MN.js → check-BR5D27CX.js}

@@ -1,36 +1,36 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-5MYFOW5V.js';
-import './chunk-6U3MV7TZ.js';
+import { probeCredentials } from './chunk-AD3EYI7P.js';
+import './chunk-B6SCN5NY.js';
+import './chunk-SADUQSO4.js';
 import './chunk-MTP2QEVO.js';
 import './chunk-S5PCA3SN.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
-import './chunk-SADUQSO4.js';
 import './chunk-I2UOAV7X.js';
-import './chunk-BWSUPRDK.js';
-import './chunk-5GHGAF6P.js';
+import './chunk-ZX4I2MEK.js';
+import './chunk-JHGEBPLE.js';
 import './chunk-XNGMQ27R.js';
-import './chunk-7SJPQWBM.js';
+import './chunk-R22NZSGA.js';
 import './chunk-KYS3TQAG.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-DADWEUH3.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-GEMQLBMW.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-AMFWYESY.js';
 import './chunk-TBT347UY.js';
-import './chunk-6D7GT22T.js';
+import './chunk-PIZRPNKR.js';
 import './chunk-7YP7T6GV.js';
-import './chunk-UVG35MWF.js';
-import './chunk-7KSSBQTS.js';
+import './chunk-LW7G5TJB.js';
+import './chunk-3ZR7Y23Y.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-VMJPFQNE.js';
 import './chunk-3UZTIRLF.js';
 import './chunk-GGOMT6KF.js';
 import './chunk-X5H2WYMB.js';
-import './chunk-XSZD4AZ6.js';
+import './chunk-XZ4H4X5F.js';
 import './chunk-QEFKA2QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-HPJNLETG.js';
+import './chunk-FBTGMSQF.js';
 import './chunk-IF2OSI5T.js';
 import './chunk-CG36IONK.js';
 import './chunk-G3IJ3N6F.js';
@@ -43,7 +43,7 @@ import './chunk-QOZKPLVJ.js';
 import './chunk-CX22S5BA.js';
 import './chunk-ECODQ7II.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-NFIR3GEE.js';
+import './chunk-PSN33ERW.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-QNLX477Q.js';
@@ -53,20 +53,20 @@ import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
 import './chunk-LLM3I5YU.js';
-import './chunk-452TM7J4.js';
-import './chunk-IXYZUUYQ.js';
+import './chunk-EAEELQVQ.js';
+import './chunk-7UWVLZXD.js';
 import './chunk-FVMYKL6L.js';
 import './chunk-NTRCK4NH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-G2YNJIGF.js';
 import './chunk-NNLA7LLQ.js';
-import './chunk-WFSUUUAN.js';
-import './chunk-7VUK5RFS.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-CRB3POP4.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';

package/dist/{chunk-7KSSBQTS.js → chunk-3ZR7Y23Y.js}

@@ -5,8 +5,8 @@ import { createDockerHost, childEnvironment, spawnRun } from './chunk-VMJPFQNE.j
 import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, JUDGE_DIR, MAX_REPORT_BYTES } from './chunk-3UZTIRLF.js';
 import { execCapture } from './chunk-GGOMT6KF.js';
 import { GUEST_CID } from './chunk-X5H2WYMB.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-XSZD4AZ6.js';
-import { WorkCommandError } from './chunk-HPJNLETG.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-XZ4H4X5F.js';
+import { WorkCommandError } from './chunk-FBTGMSQF.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3CWUOFV6.js';

package/dist/{chunk-ZHAUSEEN.js → chunk-5VML45HH.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-IXYZUUYQ.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-7UWVLZXD.js';
 import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-NNLA7LLQ.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-WFSUUUAN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-WFSUUUAN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-5MYFOW5V.js → chunk-AD3EYI7P.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-6U3MV7TZ.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-B6SCN5NY.js';
+import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-SADUQSO4.js';
 import { writePendingUpdate } from './chunk-MTP2QEVO.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-S5PCA3SN.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
-import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-SADUQSO4.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
-import { RUNNER_PROTOCOL } from './chunk-BWSUPRDK.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-DADWEUH3.js';
+import { RUNNER_PROTOCOL } from './chunk-ZX4I2MEK.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-GEMQLBMW.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-AMFWYESY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, measureDisk, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-7KSSBQTS.js';
+import { provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, measureDisk, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-3ZR7Y23Y.js';
 import { spawnRun } from './chunk-VMJPFQNE.js';
 import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-3UZTIRLF.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-XSZD4AZ6.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-XZ4H4X5F.js';
 import { checkFit } from './chunk-QEFKA2QD.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-HPJNLETG.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-FBTGMSQF.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-P53VEAOF.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { claimPidFile, readPidFile, releasePidFile } from './chunk-ECODQ7II.js';
@@ -85,6 +85,9 @@ var HEARTBEAT_TIMEOUT_MS = 1e4;
 var ERROR_CODE_MAX = 100;
 var ERROR_MESSAGE_MAX = 500;
 var BLOCKED_REASON_MAX = 500;
+var TAKES_PATTERNS_MAX = 50;
+var TAKES_PATTERN_CHARS_MAX = 200;
+var WAITING_ITEMS_MAX = 200;
 var UNREACHABLE_MESSAGE = "the request did not reach the platform";
 function noPlatformMessage(status) {
   return `the request got HTTP ${status} with no error message from the platform`;
@@ -112,6 +115,35 @@ function workRequestFromFailure(err) {
 function workRequestFromRetryFailure(outcome) {
   return shapeWorkRequestFailure(outcome.code, outcome.status, outcome.message);
 }
+function stopsOf(data) {
+  const raw = data?.stops;
+  if (!Array.isArray(raw)) return [];
+  const stops = [];
+  for (const entry of raw) {
+    const stop = entry;
+    if (stop === null || typeof stop !== "object" || typeof stop.claimId !== "string") continue;
+    stops.push({
+      claimId: stop.claimId,
+      requestedByName: typeof stop.requestedByName === "string" ? stop.requestedByName : "",
+      note: typeof stop.note === "string" && stop.note !== "" ? stop.note : null
+    });
+  }
+  return stops;
+}
+function takesBody(takes) {
+  let truncated = false;
+  const list = (patterns) => {
+    const all = (patterns ?? []).filter((pattern) => typeof pattern === "string");
+    if (all.length > TAKES_PATTERNS_MAX) truncated = true;
+    return all.slice(0, TAKES_PATTERNS_MAX).map((pattern) => {
+      if (pattern.length > TAKES_PATTERN_CHARS_MAX) truncated = true;
+      return cutForGateway(pattern, TAKES_PATTERN_CHARS_MAX);
+    }).filter((pattern) => pattern !== "");
+  };
+  const include = list(takes.repos.include);
+  const exclude = list(takes.repos.exclude);
+  return { queues: takes.queues, repos: { include, exclude }, truncated };
+}
 async function sendHeartbeat(args, fetchImpl) {
   const body = {
     host: args.host,
@@ -132,7 +164,10 @@ async function sendHeartbeat(args, fetchImpl) {
     // Free disk on the runner's file system, in bytes. Sent only while held, so a host with room sends nothing about its disk.
     lowDisk: args.lowDisk === void 0 ? void 0 : { free: args.lowDisk.free, needed: args.lowDisk.needed },
     // Why the runner claims nothing. Sent only while it holds, so a runner that takes work says nothing about it.
-    blocked: args.blocked === void 0 ? void 0 : { reason: cutForGateway(args.blocked.reason, BLOCKED_REASON_MAX) }
+    blocked: args.blocked === void 0 ? void 0 : { reason: cutForGateway(args.blocked.reason, BLOCKED_REASON_MAX) },
+    state: args.state,
+    waitingItems: args.waitingItems === void 0 ? void 0 : args.waitingItems.slice(0, WAITING_ITEMS_MAX),
+    takes: args.takes === void 0 ? void 0 : takesBody(args.takes)
   };
   try {
     const response = await postJson(
@@ -146,11 +181,22 @@ async function sendHeartbeat(args, fetchImpl) {
       await signerFor(args.configPath)
     );
     const runnerVersion = response.data?.runnerVersion;
-    return typeof runnerVersion === "string" ? { ok: true, runnerVersion } : { ok: true };
+    const stops = stopsOf(response.data);
+    return typeof runnerVersion === "string" ? { ok: true, runnerVersion, stops } : { ok: true, stops };
   } catch (err) {
     return { ok: false, reason: describeCallFailure(err) };
   }
 }
+
+// src/runner/host-state.ts
+function hostState(flags) {
+  if (flags.draining) return "draining";
+  if (flags.restarting) return "restarting";
+  if (flags.holdingForUpdate) return "holding-for-update";
+  if (flags.blocked) return "blocked";
+  if (flags.lowDisk) return "low-disk";
+  return "taking-work";
+}
 var OUTCOMES = ["updated", "rolled_back", "verification_failed", "not_published", "retrying"];
 function lastUpdatePath(configPath) {
   return join(runnerDir(configPath), "last-update.json");
@@ -1042,6 +1088,7 @@ async function sendTickHeartbeat(state, workRequest) {
     let next = workRequest;
     for (; ; ) {
       reportRepeating(state, "the heartbeat's previous call", void 0, "line");
+      const waitingItems = state.draining === true ? runningItems(state) : [];
       const result = await sendHeartbeat(
         {
           configPath: state.config.configPath,
@@ -1056,12 +1103,25 @@ async function sendTickHeartbeat(state, workRequest) {
           workRequest: next,
           lastUpdate: readLastUpdate(state.config.configPath),
           lowDisk: state.lowDisk,
-          blocked: state.blocked
+          blocked: state.blocked,
+          state: hostState({
+            draining: state.draining === true,
+            restarting: state.restarting === true,
+            holdingForUpdate: state.holdingForUpdate === true,
+            blocked: state.blocked !== void 0,
+            lowDisk: state.lowDisk !== void 0
+          }),
+          // Left out unless a draining runner has builds to wait on, so the gateway stores null.
+          waitingItems: waitingItems.length > 0 ? waitingItems : void 0,
+          takes: { queues: state.config.queues, repos: { include: state.config.repos?.include, exclude: state.config.repos?.exclude } }
         },
         state.deps.fetchImpl
       );
       reportRepeating(state, "the heartbeat", result.ok ? void 0 : `heartbeat failed: ${result.reason}`);
-      if (result.ok) considerNamedVersion(state, result.runnerVersion);
+      if (result.ok) {
+        considerNamedVersion(state, result.runnerVersion);
+        applyStops(state, result.stops);
+      }
       next = state.queuedWorkRequest;
       state.queuedWorkRequest = void 0;
       if (next === void 0) break;
@@ -1070,6 +1130,27 @@ async function sendTickHeartbeat(state, workRequest) {
     state.heartbeating = false;
   }
 }
+function applyStops(state, stops) {
+  for (const stop of stops) {
+    const held = [...state.jobs.values()].find((entry) => entry.job.claimId === stop.claimId);
+    const active = held !== void 0 && !held.ending ? held : void 0;
+    if (active === void 0) {
+      reportRepeating(
+        state,
+        `stop of claim ${stop.claimId}`,
+        held === void 0 ? `ignoring a stop for claim ${stop.claimId}: this runner holds no build under that claim` : `#${held.job.item} a stop was asked for; the build is already ending`,
+        "line"
+      );
+      continue;
+    }
+    const who = `stopped by ${stop.requestedByName === "" ? "someone" : stop.requestedByName} through OuterLayer`;
+    const reason = stop.note === null ? who : `${who}: ${stop.note}`;
+    logOf(state).line(`#${active.job.item} ${reason} \xB7 ending the build`);
+    void endJob(state, active, "stopped", { reason }).catch((err) => {
+      logOf(state).error(`#${active.job.item} could not be stopped: ${describeCallFailure(err)}`);
+    });
+  }
+}
 function ownVersionOf(deps) {
   return (deps.cliVersion ?? resolveVersion()).split(" ")[0] ?? "";
 }
@@ -1405,9 +1486,17 @@ async function housekeepingPass(state) {
   }
 }
 async function runTick(state) {
+  state.restarting = false;
+  state.holdingForUpdate = false;
   reloadConfig(state);
-  if (restartOntoInstalled(state)) return;
-  if (await updateWhenIdle(state)) return;
+  if (restartOntoInstalled(state)) {
+    state.restarting = true;
+    return;
+  }
+  if (await updateWhenIdle(state)) {
+    state.holdingForUpdate = true;
+    return;
+  }
   if (holdWhenBlocked(state)) return;
   if (holdOffForDisk(state)) return;
   const log = logOf(state);
@@ -1463,7 +1552,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-5EPPD33Y.js');
+  const { postJson: postJson2 } = await import('./work-cmd-5I3J2XQQ.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2226,7 +2315,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-UWQAL2MN.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-BR5D27CX.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2312,12 +2401,11 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   }
   let intakeClosed = false;
   let closed = false;
-  let draining = false;
   let stopping = false;
   let exited = false;
   let interrupts = 0;
   state.pollTimerSeconds = state.config.pollSeconds;
-  const pollTimer = setInterval(() => void tick(state), state.pollTimerSeconds * 1e3);
+  let pollTimer = setInterval(() => void tick(state), state.pollTimerSeconds * 1e3);
   const hooksKind = builtinKind(config.hooks.provision);
   const housekeepingTimer = hooksKind === "container" || hooksKind === "vm" ? (() => {
     const everyMs = deps.housekeeping?.intervalMs ?? HOUSEKEEPING_INTERVAL_MS;
@@ -2357,6 +2445,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     if (intakeClosed) return;
     intakeClosed = true;
     clearInterval(pollTimer);
+    pollTimer = setInterval(() => void sendTickHeartbeat(state, void 0), (state.pollTimerSeconds ?? state.config.pollSeconds) * 1e3);
     clearInterval(housekeepingTimer);
   };
   const close = () => {
@@ -2364,6 +2453,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     detachSignals();
     if (closed) return;
     closed = true;
+    clearInterval(pollTimer);
     clearInterval(watchTimer);
   };
   const finish2 = () => {
@@ -2374,8 +2464,8 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     log.line("runner exited");
   };
   const drain = async (onWaiting) => {
-    if (draining) return;
-    draining = true;
+    if (state.draining === true) return;
+    state.draining = true;
     stopIntake();
     let passes = 0;
     while (state.jobs.size > 0 && !exited) {
@@ -2397,6 +2487,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     if (stopping) return;
     stopping = true;
     stopIntake();
+    clearInterval(pollTimer);
     clearInterval(watchTimer);
     log.line(`stopping: ending ${state.jobs.size} running job(s) now`);
     await Promise.all([...state.jobs.values()].map((active) => endJob(state, active, "stopped")));

package/dist/{chunk-6U3MV7TZ.js → chunk-B6SCN5NY.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-SADUQSO4.js';
-import { senderPidfile } from './chunk-5GHGAF6P.js';
+import { senderPidfile } from './chunk-JHGEBPLE.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-XNGMQ27R.js';
-import { installScrubContext } from './chunk-7SJPQWBM.js';
-import { AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-7KSSBQTS.js';
+import { installScrubContext } from './chunk-R22NZSGA.js';
+import { AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-3ZR7Y23Y.js';
 import { childEnvironment } from './chunk-VMJPFQNE.js';
 import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR } from './chunk-3UZTIRLF.js';
 import { waitForAgent, vmExecArgs } from './chunk-GGOMT6KF.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-X5H2WYMB.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-XSZD4AZ6.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-HPJNLETG.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-XZ4H4X5F.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-FBTGMSQF.js';
 import { planArtifactUpload } from './chunk-G3IJ3N6F.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-P53VEAOF.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
@@ -19,8 +19,8 @@ import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { scrubText } from './chunk-QNLX477Q.js';
 import { resolvePackRoot } from './chunk-NNLA7LLQ.js';
-import { parsePolicy } from './chunk-WFSUUUAN.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { parsePolicy } from './chunk-WFSUUUAN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { signerFor } from './chunk-M2ZWWTWZ.js';

package/dist/{chunk-DJ3ZUSC3.js → chunk-CGGPS7SI.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-ZHAUSEEN.js';
+import { runEmit } from './chunk-5VML45HH.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
 import { installStarterPack } from './chunk-6X4SQ5MY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-452TM7J4.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-EAEELQVQ.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-NNLA7LLQ.js';
-import { generatedHeaderSource } from './chunk-WFSUUUAN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
+import { generatedHeaderSource } from './chunk-WFSUUUAN.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-452TM7J4.js → chunk-EAEELQVQ.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-IXYZUUYQ.js';
+import { removeRetiredSkills } from './chunk-7UWVLZXD.js';
 import { defaultFetch } from './chunk-FVMYKL6L.js';
 import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-NNLA7LLQ.js';
-import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-WFSUUUAN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
+import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-WFSUUUAN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { withTokenHeader } from './chunk-BQXFBI7T.js';
 import { execFileSync } from 'child_process';

package/dist/{chunk-HPJNLETG.js → chunk-FBTGMSQF.js}

@@ -421,7 +421,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-YAZG5MDX.js');
+      const { logHookError } = await import('./hook-fast-RL5E5OXE.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-DADWEUH3.js → chunk-GEMQLBMW.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-6D7GT22T.js';
-import { describeCallFailure } from './chunk-XSZD4AZ6.js';
-import { WorkCommandError, getJson } from './chunk-HPJNLETG.js';
+import { isPlaceholderCommand } from './chunk-PIZRPNKR.js';
+import { describeCallFailure } from './chunk-XZ4H4X5F.js';
+import { WorkCommandError, getJson } from './chunk-FBTGMSQF.js';
 import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
 import { builtinKind } from './chunk-P53VEAOF.js';
 import { signerFor } from './chunk-M2ZWWTWZ.js';

package/dist/{chunk-5TN7GLYX.js → chunk-HOKXGFDR.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-TWF3RICI.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-HPJNLETG.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-FBTGMSQF.js';
 import { isLinkedRepository } from './chunk-CG36IONK.js';
 import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-NFIR3GEE.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-PSN33ERW.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-DSF2FWAZ.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-QNLX477Q.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { checkFormerSkillNames } from './chunk-IXYZUUYQ.js';
+import { checkFormerSkillNames } from './chunk-7UWVLZXD.js';
 import { defaultFetch } from './chunk-FVMYKL6L.js';
 import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1181,7 +1181,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-23BBJWBX.js');
+    const { runnerHostChecks } = await import('./doctor-DHUM5DBB.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{chunk-5GHGAF6P.js → chunk-JHGEBPLE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-7SJPQWBM.js';
-import { spoolDir } from './chunk-NFIR3GEE.js';
+import { LiveUploader } from './chunk-R22NZSGA.js';
+import { spoolDir } from './chunk-PSN33ERW.js';
 import { CaptureDaemon } from './chunk-QNLX477Q.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-UVG35MWF.js → chunk-LW7G5TJB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-7KSSBQTS.js';
+import { MIN_ENGINE_MAJOR } from './chunk-3ZR7Y23Y.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-6D7GT22T.js → chunk-PIZRPNKR.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-7YP7T6GV.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-UVG35MWF.js';
-import { MIN_ENGINE_MAJOR } from './chunk-7KSSBQTS.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-LW7G5TJB.js';
+import { MIN_ENGINE_MAJOR } from './chunk-3ZR7Y23Y.js';
 import { runnerCredentialProblem } from './chunk-P53VEAOF.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';