@outerlayer/cli 0.2.0 → 0.4.0

package/dist/{paths-D2VGWWFI.js → cli-build-K56DK4DS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, attemptStamp, jobDir, jobsDir, pidFilePath, runnerDir } from './chunk-JJP7YLMN.js';
+export { currentCliBuild } from './chunk-OGFGZQA3.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/config-XVJYZ4IQ.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, runnerVmOf } from './chunk-5Y3QQRUH.js';
+import './chunk-F6GFZXZ3.js';
+import './chunk-AUFG23AA.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/connect-cmd-OOG4TPU7.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { promptOnTerminal, realConnectDeps, runConnect, runConnectCommand } from './chunk-2E54Z3P5.js';
+import './chunk-3TT7RQYB.js';
+import './chunk-6Y63SXFO.js';
+import './chunk-G7FSV7JX.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
+import './chunk-YRYMNBGQ.js';
+import './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/context-adopt-UMA4O5NY.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { defaultGitRunner, hasSymlinkComponent } from './chunk-XDDW4FRS.js';
+import { writeContextManifest, writePinIfChanged, touchLastCheck, clearDegraded, writeSourceCache, SOURCE_CACHE_TTL_SUCCESS_MS, writeBuildHold } from './chunk-WIOZAJ2W.js';
+import './chunk-WO2BXCTQ.js';
+import './chunk-EMY4I27X.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BCLJSQCV.js';
+import './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-RA3O54FC.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import { ensureContextExcludes, installPreCommitGuardInGitDir } from './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+import { lstatSync, readFileSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
+import { join, dirname } from 'path';
+
+createRequire(import.meta.url);
+var CONFLICT_MESSAGE = "this repository tracks AGENTS.md, .claude or .outerlayer in git, which would shadow the control plane's context: remove them in a commit";
+var refused = (code, message) => ({ status: "refused", code, message });
+function readSummary(stagedDir) {
+  try {
+    const parsed = JSON.parse(readFileSync(join(stagedDir, "staged.json"), "utf8"));
+    if (parsed.schemaVersion === 1 && typeof parsed.sha === "string" && typeof parsed.repository === "string" && typeof parsed.ref === "string" && Array.isArray(parsed.files) && parsed.files.every((f) => typeof f === "string")) {
+      return parsed;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isContextPath(rel) {
+  if (rel.split("/").some((segment) => segment === ".." || segment === "")) return false;
+  return rel === "AGENTS.md" || rel.startsWith(".claude/") || rel.startsWith(".outerlayer/");
+}
+function adoptStagedContext(input) {
+  const git = input.git ?? defaultGitRunner;
+  const now = input.now ?? Date.now;
+  const summary = readSummary(input.stagedDir);
+  if (summary === void 0) return refused("context_adoption_failed", `${join(input.stagedDir, "staged.json")} is missing or malformed`);
+  const run = (args) => {
+    const result = git(args, { cwd: input.cwd, timeoutMs: 5e3 });
+    return result.ok ? result.stdout.toString("utf8").trim() : void 0;
+  };
+  const repoRoot = run(["rev-parse", "--show-toplevel"]);
+  const gitCommonDir = run(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  if (repoRoot === void 0 || gitCommonDir === void 0) return refused("context_adoption_failed", `${input.cwd} is not a git checkout`);
+  const tracked = git(["ls-files", "-z", "--", "AGENTS.md", ".claude", ".outerlayer"], { cwd: repoRoot, timeoutMs: 5e3 });
+  if (!tracked.ok) return refused("context_adoption_failed", "git could not list the checkout's tracked files");
+  if (tracked.stdout.length > 0) return refused("context_adoption_conflict", CONFLICT_MESSAGE);
+  const tree = join(input.stagedDir, "tree");
+  const copies = [];
+  for (const rel of summary.files) {
+    if (!isContextPath(rel)) return refused("context_adoption_failed", `the staged context lists ${rel}, which is not a context path`);
+    let content;
+    let executable;
+    try {
+      const source = join(tree, rel);
+      const stat = lstatSync(source);
+      if (!stat.isFile()) return refused("context_adoption_failed", `the staged ${rel} is not a regular file`);
+      executable = (stat.mode & 73) !== 0;
+      content = readFileSync(source);
+    } catch {
+      return refused("context_adoption_failed", `the staged ${rel} could not be read`);
+    }
+    if (hasSymlinkComponent(repoRoot, rel)) return refused("context_adoption_failed", `${rel} in the checkout passes through a symlink, so it is not written`);
+    copies.push({ rel, content, mode: executable ? 493 : 420 });
+  }
+  for (const { rel, content, mode } of copies) {
+    const destination = join(repoRoot, rel);
+    mkdirSync(dirname(destination), { recursive: true });
+    writeFileSync(destination, content);
+    chmodSync(destination, mode);
+  }
+  const at = new Date(now()).toISOString();
+  writeContextManifest(gitCommonDir, { schemaVersion: 1, sha: summary.sha, files: summary.files, materializedAt: at });
+  ensureContextExcludes(gitCommonDir);
+  const guard = installPreCommitGuardInGitDir(gitCommonDir);
+  writePinIfChanged(repoRoot, summary.sha);
+  touchLastCheck(gitCommonDir, now());
+  clearDegraded(gitCommonDir);
+  writeSourceCache(gitCommonDir, { checkedAt: at, status: "governed", repository: summary.repository, ref: summary.ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
+  writeBuildHold(gitCommonDir, { sha: summary.sha, repository: summary.repository, ref: summary.ref, at });
+  const guardMissing = !guard.adopted;
+  return {
+    status: "adopted",
+    sha: summary.sha,
+    files: copies.length,
+    ...guardMissing ? { message: "the commit guard is NOT installed: a pre-commit hook this build did not write occupies its slot" } : {}
+  };
+}
+function runContextAdopt(stagedDir, cwd, deps = {}) {
+  let outcome;
+  try {
+    outcome = adoptStagedContext({ stagedDir, cwd, ...deps });
+  } catch (err) {
+    outcome = refused("context_adoption_failed", err instanceof Error ? err.message : String(err));
+  }
+  return { exitCode: outcome.status === "adopted" ? 0 : 1, stdout: `${JSON.stringify(outcome)}
+` };
+}
+
+export { adoptStagedContext, runContextAdopt };

package/dist/context-materialize-G2FUFC72.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir } from './chunk-XDDW4FRS.js';
+import './chunk-WIOZAJ2W.js';
+import './chunk-WO2BXCTQ.js';
+import './chunk-EMY4I27X.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BCLJSQCV.js';
+import './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-RA3O54FC.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/dist-RW4UPPC2.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { CaptureDaemon, PRICE_TABLE_SOURCE, SECRET_PATTERNS, SOURCE_ADAPTERS, SUPPORTED_VERSIONS, StatuslineAggregator, WARNING_CODES, claudeCodeAdapter, codexAdapter, codexSessionIdFromPath, compareVersions, completePrefix, computeStatuslineState, costOfUsage, cursorAdapter, cursorChatIdFromPath, defaultCodexSessionsDir, defaultCursorChatsDir, defaultCursorProjectsDir, defaultProjectsDir, defaultRawDir, enrichSessionRepo, findCodexRollouts, findCursorChats, findTranscripts, isNewerThanSupported, isPriceKnown, normalizeErrorSignature, normalizeRemote, parseCodexRollout, parseCursorChat, parseTranscript, readStatuslineState, readSyncWatermarkMs, remoteLookupFailed, resolvePrice, resolveRepoIdentity, rootChildIds, scanAll, scrubDeep, scrubText, sessionIdFromPath, setCustomScrubbers, setLocalIdentity, setRepoRoot, statuslineStatePath, tailTranscript, workspacesByHash, writeStatuslineState } from './chunk-G7FSV7JX.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/docker-NEGDLU6D.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { childEnvironment, createDockerHost, spawnRun } from './chunk-774HEQL6.js';
+import './chunk-QOZKPLVJ.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/doctor-53F2PYY7.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { launchAgentPath } from './chunk-LF6MLJCY.js';
+import './chunk-Z5GEFMRW.js';
+import { existsSync } from 'fs';
+
+createRequire(import.meta.url);
+function runnerVmCheck(configPath, env) {
+  const name = "Runner VM";
+  const { instance } = env;
+  if (env.lima.locate() === void 0) {
+    return { name, status: "fail", detail: `limactl is not installed, so ${instance} cannot be read`, fix: "brew install lima" };
+  }
+  const status = env.lima.status(instance);
+  if (status === void 0) {
+    return {
+      name,
+      status: "fail",
+      detail: `${instance} does not exist, so the runner is not running`,
+      fix: `run outerlayer login, remove the runnerVm key from ${configPath}, and run outerlayer runner init --vm`
+    };
+  }
+  if (status === "Stopped") {
+    return { name, status: "fail", detail: `${instance} is stopped, so the runner is not running`, fix: `limactl start ${instance}` };
+  }
+  if (status !== "Running") return { name, status: "warn", detail: `${instance} is ${status}`, fix: `limactl list ${instance}` };
+  const agent = launchAgentPath(env.home);
+  if (!existsSync(agent)) {
+    return {
+      name,
+      status: "warn",
+      detail: `${instance} is running, but nothing starts it at login`,
+      fix: `${agent} is missing: restore it, or run limactl start ${instance} after each login`
+    };
+  }
+  return {
+    name,
+    status: "pass",
+    detail: `${instance} is running, and the runner lives inside it (limactl shell ${instance} outerlayer runner status); it starts at login`
+  };
+}
+
+export { runnerVmCheck };

package/dist/doctor-UFVL4PZY.js

@@ -0,0 +1,426 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-7YIOOFVJ.js';
+import { RepoFilter } from './chunk-TBT347UY.js';
+import './chunk-CBZB6XY6.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-L2DBRKRA.js';
+import { MIN_ENGINE_MAJOR } from './chunk-7A6RVXPZ.js';
+import { CLAUDE_CODE_VERSION } from './chunk-ZNA27WEV.js';
+import './chunk-N5FOE5PS.js';
+import './chunk-OGFGZQA3.js';
+import { resolveDevcontainerCli } from './chunk-774HEQL6.js';
+import { locateRecipe, assertBuildable, readRecipe, RecipeError } from './chunk-QOZKPLVJ.js';
+import './chunk-W4SQCOZU.js';
+import './chunk-B2G7JHHB.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-5DLBAXY5.js';
+import './chunk-BFESLKPP.js';
+import './chunk-6Y63SXFO.js';
+import { compareVersions } from './chunk-G7FSV7JX.js';
+import { builtinKind } from './chunk-5Y3QQRUH.js';
+import { parseSize } from './chunk-F6GFZXZ3.js';
+import './chunk-AUFG23AA.js';
+import './chunk-WZBHBH3J.js';
+import { defaultGitRunner } from './chunk-XDDW4FRS.js';
+import './chunk-WIOZAJ2W.js';
+import './chunk-WO2BXCTQ.js';
+import './chunk-EMY4I27X.js';
+import './chunk-ZJSNLVCE.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-RA3O54FC.js';
+import { loadHostKey } from './chunk-M5POMKKW.js';
+import { runnerDir, hostKeyPath } from './chunk-ZM2IMMYN.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+import { spawnSync } from 'child_process';
+import { existsSync, readdirSync, statSync } from 'fs';
+import { totalmem, tmpdir } from 'os';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+
+// src/runner/microvm/doctor.ts
+var GIB = 1024 ** 3;
+var gib = (bytes) => `${Number((bytes / GIB).toFixed(1))} GiB`;
+function kvmCheck(machine) {
+  const name = "KVM";
+  const kvm = machine.kvm;
+  if (kvm?.state === "usable") return { name, status: "pass", detail: "this user can open /dev/kvm, so each build runs in a microVM of its own" };
+  if (kvm?.state === "no-permission") {
+    const group = kvm.group ?? "kvm";
+    return {
+      name,
+      status: "fail",
+      detail: "/dev/kvm exists but this user cannot read and write it, so every build fails at provision",
+      fix: `sudo usermod -aG ${group} $USER, then log in again so the runner's service starts with the group; or set both hooks to builtin:container`
+    };
+  }
+  return {
+    name,
+    status: "fail",
+    detail: "this machine has no /dev/kvm, so builtin:vm cannot start a microVM and every build fails at provision",
+    fix: "run the runner on a host with KVM (bare metal, or a cloud instance that allows nested virtualization), or set both hooks to builtin:container"
+  };
+}
+function memoryCheck(input) {
+  const name = "MicroVM memory";
+  const perBuild = parseSize(input.buildMemory);
+  if (perBuild === void 0) {
+    return {
+      name,
+      status: "warn",
+      detail: `runner.build.memory is ${JSON.stringify(input.buildMemory)}, which is not a size, so the memory the microVMs need cannot be compared with this host's`,
+      fix: 'set runner.build.memory to a size such as "8g"'
+    };
+  }
+  const needed = input.concurrency * perBuild;
+  if (needed <= input.hostMemory) {
+    return { name, status: "pass", detail: `${input.concurrency} concurrent build(s) of ${gib(perBuild)} need up to ${gib(needed)}, and this host has ${gib(input.hostMemory)}` };
+  }
+  return {
+    name,
+    status: "warn",
+    detail: `runner.concurrency ${input.concurrency} times runner.build.memory ${input.buildMemory} is ${gib(needed)}, more than this host's ${gib(input.hostMemory)}; memory a build touches stays resident until its microVM stops`,
+    fix: "lower runner.concurrency or runner.build.memory, or run the runner on a host with more memory"
+  };
+}
+
+// src/runner/image/doctor.ts
+var LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
+var REGISTRY_TIMEOUT_MS = 5e3;
+var directories = (dir) => readdirSync(dir).sort().filter((entry) => statSync(join(dir, entry)).isDirectory());
+function devcontainerCliRunnable(resolveCli = resolveDevcontainerCli) {
+  try {
+    resolveCli();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function recipeCheck(reposDir, owner, name) {
+  const checkout = join(reposDir, owner, name);
+  const label = `Image recipe: ${owner}/${name}`;
+  try {
+    const location = locateRecipe(checkout);
+    if (location.kind === "default") {
+      return {
+        name: label,
+        status: "warn",
+        detail: "no devcontainer file, so builds use the default image",
+        fix: "add .devcontainer/devcontainer.json to the repository's default branch"
+      };
+    }
+    assertBuildable(checkout, location, readRecipe(checkout, location));
+    return { name: label, status: "pass", detail: `built from ${location.path}` };
+  } catch (err) {
+    if (err instanceof RecipeError && err.code === "recipe_needs_docker") {
+      return {
+        name: label,
+        status: "warn",
+        detail: "the recipe uses Docker Compose (dockerComposeFile), and container builds cannot use it",
+        fix: "describe the build with image or build in .devcontainer/devcontainer.json"
+      };
+    }
+    if (err instanceof RecipeError && err.code === "recipe_ambiguous") {
+      return {
+        name: label,
+        status: "warn",
+        detail: "only named configurations exist, and the runner cannot choose one",
+        fix: "add .devcontainer/devcontainer.json to the repository's default branch"
+      };
+    }
+    const reason = err instanceof Error ? err.message : String(err);
+    return { name: label, status: "warn", detail: `the recipe cannot be built: ${reason}`, fix: "fix .devcontainer/devcontainer.json on the default branch" };
+  }
+}
+async function pinCheck(fetchImpl) {
+  const name = "Claude Code pin";
+  const unknown = (why) => ({
+    name,
+    status: "warn",
+    detail: `could not read the latest release: ${why}`,
+    fix: "check the host's network access to registry.npmjs.org"
+  });
+  let latest;
+  try {
+    const response = await fetchImpl(LATEST_URL, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS)
+    });
+    if (!response.ok) return unknown(`the registry answered ${response.status}`);
+    latest = (await response.json()).version;
+  } catch (err) {
+    return unknown(err instanceof Error ? err.message : String(err));
+  }
+  if (typeof latest !== "string") return unknown("the registry's answer named no version");
+  if (compareVersions(latest, CLAUDE_CODE_VERSION) > 0) {
+    return {
+      name,
+      status: "warn",
+      detail: `images pin Claude Code ${CLAUDE_CODE_VERSION}, behind the latest release ${latest}`,
+      fix: "update the outerlayer CLI; the pin moves with each release"
+    };
+  }
+  return { name, status: "pass", detail: `images pin Claude Code ${CLAUDE_CODE_VERSION}; latest is ${latest}` };
+}
+function isolationCheck(machine, hooks) {
+  const name = "Build isolation";
+  const kind = builtinKind(hooks.provision);
+  const can = supportsContainerBuilds(machine);
+  const has = describeMachineDocker(machine);
+  if (kind === "container") {
+    if (can) {
+      const where = machine.platform === "wsl2" ? " inside WSL2" : "";
+      return { name, status: "pass", detail: `builtin:container: builds run in containers (isolation: container) on Docker Engine ${machine.docker.version}${where}` };
+    }
+    return {
+      name,
+      status: "fail",
+      detail: `builtin:container needs Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2, and this machine has ${has}, so every build fails at provision`,
+      fix: `${reachDockerStep(machine) ?? `install Docker Engine${machine.platform === "windows" ? " inside WSL2" : ""} and run the runner where it is`}, or set both hooks to builtin:process to run builds as processes (isolation: shared-user)`
+    };
+  }
+  if (kind === "vm") {
+    if (supportsMicroVmBuilds(machine)) {
+      return { name, status: "pass", detail: `builtin:vm: each build runs in a Firecracker microVM of its own (isolation: vm), with Docker Engine ${machine.docker.version} building the image` };
+    }
+    if (machine.platform === "linux" && machine.kvm?.state === "usable" && can && microVmArchSupported(machine) && !microVmAssetsPinned(machine)) {
+      return {
+        name,
+        status: "fail",
+        detail: "builtin:vm cannot run yet: this CLI release has no published guest kernel and helper, so every build would fail their hash check at provision",
+        fix: "set both hooks to builtin:container to run builds in containers (isolation: container), or upgrade to a CLI release that publishes the guest assets"
+      };
+    }
+    return {
+      name,
+      status: "fail",
+      detail: `builtin:vm needs Linux (not WSL2) where this user can use /dev/kvm, Docker Engine ${MIN_ENGINE_MAJOR} or later, and an x86_64 CPU; this machine has ${has}${machine.kvm?.state === "usable" ? "" : " and no KVM this user can use"}, so every build fails at provision`,
+      fix: `${machine.kvm?.state === "usable" ? reachDockerStep(machine) ?? `install Docker Engine ${MIN_ENGINE_MAJOR} or later` : "see the KVM check"}, or set both hooks to builtin:container to run builds in containers (isolation: container)`
+    };
+  }
+  if (kind === "process") {
+    if (machine.platform === "darwin") {
+      return {
+        name,
+        status: "warn",
+        detail: "builtin:process: builds are not isolated: they run as processes under this user (isolation: shared-user), and macOS cannot run container builds itself",
+        fix: "run outerlayer runner init --vm to run the runner in a Linux VM, where builds run in containers (isolation: container)"
+      };
+    }
+    if (can) {
+      return {
+        name,
+        status: "warn",
+        detail: "builtin:process: builds run as processes under this user (isolation: shared-user), though this machine has Docker Engine and could isolate them",
+        fix: "set runner.hooks.provision and runner.hooks.cleanup to builtin:container"
+      };
+    }
+    const reach = reachDockerStep(machine);
+    const fix = reach !== void 0 ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container` : machine.platform === "windows" ? `install Docker Engine inside WSL2 (version ${MIN_ENGINE_MAJOR} or later), run the runner from a WSL2 shell, and set both hooks to builtin:container; Docker Desktop cannot isolate builds` : machine.docker.kind === "desktop" ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later, not Docker Desktop: install it and set both hooks to builtin:container` : `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it and set both hooks to builtin:container`;
+    return {
+      name,
+      status: "warn",
+      detail: `builtin:process: builds run as processes under this user (isolation: shared-user); this machine has ${has}`,
+      fix
+    };
+  }
+  return {
+    name,
+    status: "pass",
+    detail: "your own hooks: each attempt records the isolation your provision hook reports in provision.out, and shared-user when it reports none"
+  };
+}
+async function hostKeyBindingCheck(configPath, gateway, fetchImpl) {
+  const name = "Host key binding";
+  let hostKey;
+  try {
+    hostKey = await loadHostKey(configPath);
+  } catch (err) {
+    return {
+      name,
+      status: "fail",
+      detail: err instanceof Error ? err.message : String(err),
+      fix: `${hostKeyPath(configPath)} is damaged; restore it from a backup, or delete it so the runner makes a new host key (a member then clears the old binding on the API keys page)`
+    };
+  }
+  if (hostKey === void 0) {
+    return {
+      name,
+      status: "warn",
+      detail: "this runner has no host key yet",
+      fix: "run outerlayer runner init, or start the runner: it makes the key on first use"
+    };
+  }
+  try {
+    const { data } = await getJson(gateway.url, "/v1/runner/host-key", gateway.apiKey, gateway.appId, fetchImpl, hostKey.signer);
+    const binding = data;
+    if (binding.bound !== true) {
+      return {
+        name,
+        status: "pass",
+        detail: `not yet bound: the runner key binds to this host's key (${hostKey.fingerprint}) on its first claim`
+      };
+    }
+    if (binding.fingerprint === hostKey.fingerprint) {
+      return { name, status: "pass", detail: `the runner key is bound to this host (${hostKey.fingerprint})` };
+    }
+    return boundElsewhere(name);
+  } catch (err) {
+    if (err instanceof WorkCommandError) {
+      if (err.code === "runner_key_signature_invalid") return boundElsewhere(name);
+      const refusal = signatureRefusalMessage(err.code);
+      if (refusal !== void 0) {
+        return { name, status: "fail", detail: `the gateway refused this host's signature (${err.code})`, fix: refusal };
+      }
+      const permission = missingPermissionOf(err);
+      if (permission !== void 0) {
+        return {
+          name,
+          status: "fail",
+          detail: `the runner key lacks ${permission}, which a runner needs to claim work`,
+          fix: missingPermissionFix(permission)
+        };
+      }
+      if (err.status === 403) {
+        return {
+          name,
+          status: "fail",
+          detail: `the gateway refused the runner key (403)`,
+          fix: "the gateway did not name a missing permission: check what the key may do on the factory's API keys page, and that it belongs to this factory"
+        };
+      }
+      if (err.status === 401) {
+        return {
+          name,
+          status: "fail",
+          detail: `the gateway refused the runner key (401)`,
+          fix: "the gateway does not accept this key: create a new one on the factory's API keys page and run outerlayer login"
+        };
+      }
+    }
+    const reason = err instanceof Error ? err.message : String(err);
+    return { name, status: "warn", detail: `could not read the binding: ${reason}`, fix: "check the host's network access to the gateway" };
+  }
+}
+function boundElsewhere(name) {
+  return {
+    name,
+    status: "fail",
+    detail: "the runner key is bound to another host's key, so the gateway refuses every request from this host",
+    fix: "a member clears the binding on the factory's API keys page (Clear host key); this host's next claim then binds its own key"
+  };
+}
+var CONTROL_PLANE_CHECK = "Control plane access";
+async function controlPlaneAccessCheck(env, fetchImpl) {
+  const name = CONTROL_PLANE_CHECK;
+  const git = env.git ?? defaultGitRunner;
+  const include = env.repos?.include ?? [];
+  const hostKey = await loadHostKey(env.configPath).catch(() => void 0);
+  const signer = hostKey?.signer;
+  const failures = [];
+  const warnings = [];
+  const readable = [];
+  const repositories = [];
+  let listFactory = include.length === 0;
+  for (const entry of include) {
+    if (entry.includes("*")) {
+      listFactory = true;
+      continue;
+    }
+    const parts = entry.split("/");
+    const [host, owner, repo] = parts;
+    if (parts.length !== 3 || !host || !owner || !repo) {
+      warnings.push(`${entry} is not a single repository, so its control plane cannot be checked`);
+      continue;
+    }
+    repositories.push({ host, repository: `${owner}/${repo}` });
+  }
+  if (listFactory) {
+    try {
+      const { data } = await getJson(env.gateway.url, "/v1/repositories/access", env.gateway.apiKey, env.gateway.appId, fetchImpl, signer);
+      const filter = new RepoFilter(env.repos);
+      if (!Array.isArray(data)) {
+        warnings.push("the gateway's answer listed no repositories");
+      } else {
+        for (const row of data) {
+          if (typeof row.repository !== "string") continue;
+          const known = repositories.some((r) => r.host === "github.com" && r.repository === row.repository);
+          if (!known && filter.allows(`github.com/${row.repository}`)) repositories.push({ host: "github.com", repository: row.repository });
+        }
+      }
+    } catch (err) {
+      warnings.push(`could not list the factory's repositories: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const { host, repository } of repositories) {
+    let sources;
+    try {
+      const { data } = await getJson(env.gateway.url, `/v1/context/source?repo=${encodeURIComponent(repository)}`, env.gateway.apiKey, env.gateway.appId, fetchImpl, signer);
+      sources = data.sources ?? [];
+    } catch (err) {
+      warnings.push(`could not ask the gateway which repository governs ${repository}: ${err instanceof Error ? err.message : String(err)}`);
+      continue;
+    }
+    for (const source of sources) {
+      const url = env.controlPlaneUrl?.(source.repository, host) ?? `https://${host}/${source.repository}.git`;
+      const listed = git(["ls-remote", url, source.ref], { cwd: tmpdir(), timeoutMs: 15e3 });
+      if (listed.ok) {
+        readable.push(source.repository);
+      } else {
+        failures.push({
+          detail: `this host's git login cannot read ${source.repository}, the control plane named for ${repository}, so container builds of ${repository} fail at provision`,
+          fix: `give the git login this host uses (not the GitHub App) read access to ${source.repository}, then run outerlayer doctor again; builds fetch it over HTTPS`
+        });
+      }
+    }
+  }
+  if (failures.length > 0) {
+    return { name, status: "fail", detail: failures.map((f) => f.detail).join("; "), fix: [...new Set(failures.map((f) => f.fix))].join("; ") };
+  }
+  if (warnings.length > 0) {
+    return { name, status: "warn", detail: warnings.join("; "), fix: "list each repository in repos.include as host/owner/name, and check the host's network access to the gateway" };
+  }
+  return {
+    name,
+    status: "pass",
+    detail: readable.length > 0 ? `this host's git login reads ${[...new Set(readable)].join(", ")}` : repositories.length === 0 ? "the factory has no repositories this runner builds" : `no control plane governs ${repositories.length === 1 ? "the repository" : "any of the repositories"} ${listFactory ? "connected to the factory" : "in repos.include"}`
+  };
+}
+async function runnerHostChecks(env) {
+  const dockerAvailable = env.dockerAvailable ?? (() => spawnSync("docker", ["info"], { stdio: "ignore" }).status === 0);
+  const devcontainerRunnable = env.devcontainerRunnable ?? (() => devcontainerCliRunnable());
+  const reposDir = join(runnerDir(env.configPath), "repos");
+  const recipes = existsSync(reposDir) ? directories(reposDir).flatMap(
+    (owner) => directories(join(reposDir, owner)).filter((name) => existsSync(join(reposDir, owner, name, ".git"))).map((name) => recipeCheck(reposDir, owner, name))
+  ) : [];
+  return [
+    dockerAvailable() ? { name: "Docker Engine", status: "pass", detail: "reachable" } : {
+      name: "Docker Engine",
+      status: "warn",
+      detail: "docker info failed, so `outerlayer runner image` cannot build",
+      fix: "start Docker, or give this user access to its socket"
+    },
+    ...env.hooks === void 0 ? [] : [isolationCheck(env.machine ?? detectMachine(), env.hooks)],
+    ...env.hooks !== void 0 && builtinKind(env.hooks.provision) === "vm" ? [
+      kvmCheck(env.machine ?? detectMachine()),
+      ...env.runner === void 0 ? [] : [memoryCheck({ concurrency: env.runner.concurrency, buildMemory: env.runner.buildMemory, hostMemory: env.hostMemory ?? totalmem() })]
+    ] : [],
+    ...env.hooks !== void 0 && needsClaudeCredential(env.hooks) ? [claudeCredentialCheck(env.env ?? process.env, { shell: true })] : [],
+    ...env.gateway === void 0 ? [] : [await hostKeyBindingCheck(env.configPath, env.gateway, env.fetchImpl ?? defaultFetch)],
+    ...env.gateway === void 0 || env.hooks === void 0 || !["container", "vm"].includes(builtinKind(env.hooks.provision)) ? [] : [await controlPlaneAccessCheck({ ...env, gateway: env.gateway }, env.fetchImpl ?? defaultFetch)],
+    devcontainerRunnable() ? { name: "Devcontainer CLI", status: "pass", detail: "installed beside the outerlayer CLI" } : {
+      name: "Devcontainer CLI",
+      status: "fail",
+      detail: "the devcontainer CLI the outerlayer CLI depends on is not installed",
+      fix: "run yarn install in the checkout this CLI was built from"
+    },
+    ...recipes,
+    await pinCheck(env.fetchImpl ?? defaultFetch)
+  ];
+}
+
+export { devcontainerCliRunnable, runnerHostChecks };