@outerlayer/cli 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @outerlayer/cli
 
+## 0.22.0
+
+### Minor Changes
+
+- 520123a: The build process now ships as a maintained `outerlayer-build` skill that `outerlayer init --update` rewrites with each CLI release. Your repository's `build` skill keeps only your own changes to it, and `outerlayer doctor` reports a `build` skill that no longer points at the maintained one. Run `outerlayer init --update` after upgrading to move to the new layout.
+
+### Patch Changes
+
+- 807c89d: `outerlayer work build --instructions <text>` gives the agent that runs a host build instructions from you, up to 2000 characters. The build skill reads them at intake as guidance; the issue and its criteria win when the two disagree. With `--local`, the command refuses `--instructions` before any network call.
+- 540fd26: A container build keeps running when its runner restarts or crashes, and the runner picks it up when it comes back.
+- 1a8d9ac: `outerlayer doctor` names its checks `Control plane` and `Control plane degradation`, the term the dashboard uses.
+- 5301041: On a macOS runner, a container build's session that breaks HTTP/2 framing now ends at once and counts toward ending the build. Before, the session stayed open, so a build that kept breaking framing was never ended.
+- 8697753: A container or microVM build whose command fails at once ends without a 30-second wait for its session sender. The runner asks the sender to stop again each second until the request reaches it.
+- 5301041: The runner logs a line for each repository a claim left out because its GitHub organization's App installation is suspended, and builds in the repositories it was given. It now reports runner protocol 22.
+
+## 0.21.0
+
+### Minor Changes
+
+- befe174: A container build receives its gh configuration, commit hooks, staged context and check input through `docker exec`, into `/outerlayer/job` inside the container. Nothing from the runner's disk is mounted into it. A build an older runner started keeps its mount until it ends.
+- 5481fcb: A container build reaches the runner through `docker exec`, with no socket shared through the runner's disk. The relay in the build runs as its own user, which the agent cannot be. A build an older runner started keeps working after the runner updates.
+
+### Patch Changes
+
+- f046dea: A control plane or repository can keep its skills in `.agents/skills/`. `outerlayer claude` and host builds give them to Claude Code under their own names. Every host build now starts its agent through `outerlayer claude`.
+
 ## 0.20.0
 
 ### Minor Changes

package/README.md

@@ -225,10 +225,20 @@ content:
   connections from the host only, and the runner runs every step of the build
   through it, including the build's command (`outerlayer vm-exec` on the host).
 - **`outerlayer runner start` with `builtin:container` hooks** runs each
-  build in its own Docker container, which has no network but loopback. The
-  build reaches the network only through a tunnel the runner serves on a
-  Unix socket, which the container's own `outerlayer broker-relay` process
-  reaches from loopback. The tunnel refuses loopback, private, link-local,
+  build in its own Docker container, which has no network but loopback. A
+  container build reaches the runner through `docker exec`: the runner starts
+  `outerlayer broker-relay join` in the container and serves one HTTP/2
+  session over that process's standard input and output. The container's own
+  `outerlayer broker-relay` process, which runs as a separate unprivileged
+  user, sends each loopback connection to the runner as one stream, and no
+  socket file is shared between the runner and the container. The build's
+  files (gh's configuration with the read token, the commit hooks, the staged
+  context, a check's input) are copied into `/outerlayer/job` by piping a tar
+  stream into `docker exec -i` running `outerlayer receive-files` as that
+  unprivileged user, so nothing from the runner's disk is mounted into the
+  container and the agent cannot change what it reads. (A build an older
+  runner started keeps its mounted folder and its Unix sockets until it ends.) The build
+  reaches the network only through a tunnel the runner serves. The tunnel refuses loopback, private, link-local,
   shared-address, multicast and unique-local addresses and the host's own,
   and it terminates no TLS. The tunnel also serves the build a local git
   remote. Git in the container still shows
@@ -438,7 +448,7 @@ before it gives up.
 | `outerlayer runner check [--config <path>]` | Validates the config, the hooks and the key, prints the settings the runner would use, and exits non-zero on a problem. Takes no work and writes no pid file. |
 | `outerlayer runner start [--config <path>]` | Runs the loop: claim work, run it, sync, clean up, report, release with an outcome. Repeat. Reads the `runner` block from the config file (default `~/.outerlayer/config.json`). Refuses to start on a bad config, an unrunnable hook, or a refused key. |
 | `outerlayer runner image --repository <owner/name> [--remote <url>] [--config <path>] [--json]` | Builds the image a repository's builds run in. Fetches the head of the default branch into the runner's cache, builds its `.devcontainer/devcontainer.json` with the devcontainer CLI, ignores every setting that reaches the host or widens the container's privileges, and adds this CLI and a pinned Claude Code. Reuses the image until the recipe or the tools change, keeps the newest three, and writes `recipe.json` beside the image record. Refuses a Compose recipe (`recipe_needs_docker`) and a repository with only named configurations (`recipe_ambiguous`). |
-| `outerlayer runner stop [--config <path>] [--now]` | Takes no more work and waits for running jobs to finish, naming each every five seconds. `--now` ends them immediately with outcome `stopped`. Ctrl-C on a foreground runner drains; a second one stops now. |
+| `outerlayer runner stop [--config <path>] [--now]` | Takes no more work and waits for running jobs to finish, naming each every five seconds. `--now` ends them immediately with outcome `stopped`. Ctrl-C on a foreground runner drains; a second one stops now. A container build keeps running when its runner restarts or crashes, and stops when its lease expires with no runner. |
 | `outerlayer runner status [--config <path>] [--recent] [--json]` | A header naming the runner's own state, then a row per running job — item, queue, stage, elapsed, started, lease, job directory. `--recent` adds finished jobs, newest first, capped at 20, with their outcomes. |
 | `outerlayer runner logs <item> [--config <path>] [-f]` | Prints the newest attempt's log for one item, following it with `-f`. |
 

package/dist/{agent-setup-AM42SA2D.js → agent-setup-XAJH6MPW.js}

@@ -1,27 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-CGGPS7SI.js';
-import './chunk-5VML45HH.js';
-import './chunk-YVZJ6GKF.js';
-import './chunk-6X4SQ5MY.js';
-import './chunk-ANPNT6PM.js';
-import './chunk-EAEELQVQ.js';
-import './chunk-7UWVLZXD.js';
-import './chunk-FVMYKL6L.js';
+export { keepHandWritten, runAgentSetup } from './chunk-JVB63NIB.js';
+import './chunk-XCRZTXRL.js';
+import './chunk-KOQELWQ6.js';
+import './chunk-USWVXQIH.js';
+import './chunk-VWLOQ6FI.js';
 import './chunk-NTRCK4NH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-NNLA7LLQ.js';
+import './chunk-DIB2WLBL.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-V7SAQ645.js';
+import './chunk-5OCIHFGE.js';
+import './chunk-ANPNT6PM.js';
 import './chunk-CRB3POP4.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-WFSUUUAN.js';
 import './chunk-7VUK5RFS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-M2ZWWTWZ.js';
-import './chunk-N2PXGQRL.js';
-import './chunk-BQXFBI7T.js';
+import './chunk-KDHYLBRR.js';
+import './chunk-KIGSGZBB.js';
+import './chunk-V7MQKOZY.js';
+import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/build-GTMEADQD.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { buildRepositoryImage } from './chunk-IRBNIRQJ.js';
+export { RecipeError } from './chunk-3W333NFO.js';
+import './chunk-ZFLOGMUC.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-KIGSGZBB.js';
+import './chunk-V7MQKOZY.js';
+import './chunk-GISNHSYL.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/build-command-ND2ENDBS.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import './chunk-Z5GEFMRW.js';
+import { spawn } from 'child_process';
+import { mkdirSync, openSync, closeSync, writeFileSync, renameSync } from 'fs';
+import { constants } from 'os';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var COMMAND_LOG_FILE = "command.log";
+var COMMAND_PID_FILE = "command.pid";
+var COMMAND_EXIT_FILE = "exit-code";
+var NOT_FOUND = 127;
+var NOT_RUNNABLE = 126;
+function writeWhole(dir, name, text) {
+  const partial = join(dir, `${name}.partial`);
+  writeFileSync(partial, text);
+  renameSync(partial, join(dir, name));
+}
+function runBuildCommand(input) {
+  const { dir, argv } = input;
+  mkdirSync(dir, { recursive: true });
+  writeWhole(dir, COMMAND_PID_FILE, `${process.pid}
+`);
+  const log = openSync(join(dir, COMMAND_LOG_FILE), "a");
+  return new Promise((resolve) => {
+    const [program, ...args] = argv;
+    const child = spawn(program, args, { stdio: ["ignore", log, log], env: process.env });
+    const forwarded = ["SIGTERM", "SIGINT", "SIGHUP"];
+    const forward = (signal) => void child.kill(signal);
+    for (const signal of forwarded) process.on(signal, forward);
+    let settled = false;
+    const finish = (status) => {
+      if (settled) return;
+      settled = true;
+      for (const signal of forwarded) process.off(signal, forward);
+      closeSync(log);
+      try {
+        writeWhole(dir, COMMAND_EXIT_FILE, `${status}
+`);
+      } catch {
+      }
+      resolve(status);
+    };
+    child.once("error", (err) => finish(err.code === "ENOENT" ? NOT_FOUND : NOT_RUNNABLE));
+    child.once("close", (code, signal) => finish(code ?? 128 + (signal === null ? 0 : constants.signals[signal] ?? 0)));
+  });
+}
+
+export { runBuildCommand };

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-14T00:32:09.011Z+25b1e13","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-14T18:45:24.867Z+6bab5c0","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-C4QNTYMS.js → builder-OAUSTZHL.js}

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-3UZTIRLF.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-WERZMIKA.js';
+import './chunk-3W333NFO.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-CX22S5BA.js';
-import './chunk-QNLX477Q.js';
+import './chunk-AEKSX4EY.js';
 import './chunk-7VUK5RFS.js';
-import './chunk-N2PXGQRL.js';
-import './chunk-BQXFBI7T.js';
+import './chunk-KDHYLBRR.js';
+import './chunk-KIGSGZBB.js';
+import './chunk-V7MQKOZY.js';
+import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{check-BR5D27CX.js → check-3YHMJQ3P.js}

@@ -1,77 +1,75 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-AD3EYI7P.js';
-import './chunk-B6SCN5NY.js';
-import './chunk-SADUQSO4.js';
-import './chunk-MTP2QEVO.js';
-import './chunk-S5PCA3SN.js';
+import { probeCredentials } from './chunk-22DYXLU7.js';
+import './chunk-FGW2774C.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-YETTWTAY.js';
 import './chunk-I2UOAV7X.js';
-import './chunk-ZX4I2MEK.js';
-import './chunk-JHGEBPLE.js';
-import './chunk-XNGMQ27R.js';
-import './chunk-R22NZSGA.js';
-import './chunk-KYS3TQAG.js';
+import './chunk-YETTWTAY.js';
+import './chunk-TPKYTORP.js';
+import './chunk-KPBQYEND.js';
+import './chunk-2J5JGLW5.js';
+import './chunk-ATRIVTRE.js';
+import './chunk-UD3EXMKB.js';
+import './chunk-34XORKFD.js';
+import './chunk-G2WME4RG.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-GEMQLBMW.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-WMHYIBJW.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-AMFWYESY.js';
+import './chunk-4NM3I3VV.js';
 import './chunk-TBT347UY.js';
-import './chunk-PIZRPNKR.js';
-import './chunk-7YP7T6GV.js';
-import './chunk-LW7G5TJB.js';
-import './chunk-3ZR7Y23Y.js';
-import './chunk-OGFGZQA3.js';
-import './chunk-VMJPFQNE.js';
-import './chunk-3UZTIRLF.js';
-import './chunk-GGOMT6KF.js';
-import './chunk-X5H2WYMB.js';
-import './chunk-XZ4H4X5F.js';
-import './chunk-QEFKA2QD.js';
+import './chunk-4QKLMNI3.js';
+import './chunk-7V7KG3YM.js';
+import './chunk-I66MQDXH.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-FBTGMSQF.js';
-import './chunk-IF2OSI5T.js';
-import './chunk-CG36IONK.js';
+import './chunk-EXV37PKS.js';
+import './chunk-VX74ND77.js';
+import './chunk-IRBNIRQJ.js';
+import './chunk-OGFGZQA3.js';
+import './chunk-WERZMIKA.js';
+import './chunk-3W333NFO.js';
+import './chunk-PHHBYAL6.js';
+import './chunk-BLW6GPBZ.js';
+import './chunk-C3OVGKVJ.js';
+import './chunk-2HT2XGJX.js';
+import './chunk-QOALB6ZD.js';
+import './chunk-JRCSET55.js';
 import './chunk-G3IJ3N6F.js';
-import './chunk-BM63HB2M.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-P53VEAOF.js';
+import './chunk-EAQSOE62.js';
+import './chunk-F35VMF5M.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-2CMJLYV6.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-3CWUOFV6.js';
-import './chunk-QOZKPLVJ.js';
-import './chunk-CX22S5BA.js';
-import './chunk-ECODQ7II.js';
+import './chunk-ZFLOGMUC.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-PSN33ERW.js';
+import './chunk-KOQELWQ6.js';
+import './chunk-USWVXQIH.js';
+import './chunk-VWLOQ6FI.js';
+import './chunk-NTRCK4NH.js';
+import './chunk-6IO62VJS.js';
+import './chunk-ZJSNLVCE.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-QNLX477Q.js';
-import './chunk-GOSFARMS.js';
+import './chunk-ZNPE7FW5.js';
+import './chunk-HCVLP7XA.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-AEKSX4EY.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-5OCIHFGE.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
-import './chunk-5QRP3MVS.js';
-import './chunk-LLM3I5YU.js';
-import './chunk-EAEELQVQ.js';
-import './chunk-7UWVLZXD.js';
-import './chunk-FVMYKL6L.js';
-import './chunk-NTRCK4NH.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-G2YNJIGF.js';
-import './chunk-NNLA7LLQ.js';
-import './chunk-EABW6AJQ.js';
 import './chunk-CRB3POP4.js';
+import './chunk-5QRP3MVS.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
 import './chunk-WFSUUUAN.js';
 import './chunk-7VUK5RFS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-M2ZWWTWZ.js';
-import './chunk-N2PXGQRL.js';
-import './chunk-BQXFBI7T.js';
+import './chunk-KDHYLBRR.js';
+import './chunk-KIGSGZBB.js';
+import './chunk-V7MQKOZY.js';
+import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 import { join, dirname } from 'path';