@outerlayer/cli 0.22.0 → 0.22.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @outerlayer/cli
 
+## 0.22.2
+
+### Patch Changes
+
+- c523c60: The `outerlayer-build` skill tells its agents to wait for a command that runs past the shell's timeout. A build no longer reports a mutation run as over budget while that run is still going.
+- 2d1bbb2: The CLI names itself and its version in the `User-Agent` of every request it sends to OuterLayer, as `outerlayer-cli/<version>`.
+- 3eae44d: `outerlayer init` keeps every other key of a hook it wraps, such as `timeout`. `outerlayer hooks unwrap` gives the hook back as you wrote it. A hook that runs no command, such as a `prompt` hook, stays as you wrote it. Before, such a hook stopped `init` before the agent setup and doctor steps. A second `init` says again to commit and push `.outerlayer/` while its files are not committed.
+- 750d20b: The amend and build skills merge the base branch into a pull request that has a merge conflict. They no longer rebase it.
+- 641eb3c: In a microVM build, containers and `docker build` steps reach public hosts through the runner's tunnel, under the same `allowHosts` list.
+
+## 0.22.1
+
+### Patch Changes
+
+- 53b61f7: The `outerlayer-amend` skill watches the pull request's checks after it pushes. It fixes a failed check its own change caused, at most twice, and names any check still red in its report.
+- 75f786b: The runner's image build downloads tini and gh through the proxy your Docker client is set up to use. Before, those two downloads ignored the proxy. The image build then failed on a host that reaches the internet only through one.
+
 ## 0.22.0
 
 ### Minor Changes

package/README.md

@@ -221,7 +221,10 @@ content:
   helper from github.com, and checks each against a sha256 pinned in the CLI;
   the requests send nothing about the host. The build reaches the network only
   through the same tunnel a container build uses, which the runner serves on
-  Unix sockets and the guest reaches over vsock. The guest's exec agent accepts
+  Unix sockets and the guest reaches over vsock. In a build with Docker, the
+  guest forwards the proxy connections of containers and `docker build` steps
+  from `172.17.0.1:3128` to that tunnel, so the same refusals apply to them.
+  The guest's exec agent accepts
   connections from the host only, and the runner runs every step of the build
   through it, including the build's command (`outerlayer vm-exec` on the host).
 - **`outerlayer runner start` with `builtin:container` hooks** runs each

package/dist/{agent-setup-XAJH6MPW.js → agent-setup-KXPDPTAJ.js}

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-JVB63NIB.js';
+export { keepHandWritten, runAgentSetup } from './chunk-4OYKJJ2V.js';
 import './chunk-XCRZTXRL.js';
-import './chunk-KOQELWQ6.js';
+import './chunk-SNVXHNU7.js';
 import './chunk-USWVXQIH.js';
-import './chunk-VWLOQ6FI.js';
-import './chunk-NTRCK4NH.js';
+import './chunk-QS43O4DR.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-DIB2WLBL.js';
@@ -19,9 +18,9 @@ import './chunk-WFSUUUAN.js';
 import './chunk-7VUK5RFS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-KDHYLBRR.js';
-import './chunk-KIGSGZBB.js';
-import './chunk-V7MQKOZY.js';
+import './chunk-OW52QLK3.js';
+import './chunk-IHNQWF6F.js';
+import './chunk-URWYRAIC.js';
 import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/bridge-QFN3KJP6.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-WXJXHZVB.js';
+import './chunk-URWYRAIC.js';
+import './chunk-GISNHSYL.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{build-GTMEADQD.js → build-6WRNZPVR.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-IRBNIRQJ.js';
+export { buildRepositoryImage } from './chunk-3AZYLAJC.js';
 export { RecipeError } from './chunk-3W333NFO.js';
-import './chunk-ZFLOGMUC.js';
+import './chunk-XACXXKQ5.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-KIGSGZBB.js';
-import './chunk-V7MQKOZY.js';
+import './chunk-IHNQWF6F.js';
+import './chunk-URWYRAIC.js';
 import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-14T18:45:24.867Z+6bab5c0","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-15T01:34:44.161Z+28a91ce","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-OAUSTZHL.js → builder-G3MLDMTI.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-WERZMIKA.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-XR56WEA5.js';
 import './chunk-3W333NFO.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-AEKSX4EY.js';
 import './chunk-7VUK5RFS.js';
-import './chunk-KDHYLBRR.js';
-import './chunk-KIGSGZBB.js';
-import './chunk-V7MQKOZY.js';
+import './chunk-OW52QLK3.js';
+import './chunk-IHNQWF6F.js';
+import './chunk-URWYRAIC.js';
 import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{check-3YHMJQ3P.js → check-N6WLZCER.js}

@@ -1,53 +1,53 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-22DYXLU7.js';
-import './chunk-FGW2774C.js';
+import { probeCredentials } from './chunk-2CPOAPU4.js';
+import './chunk-KOIMUHIS.js';
+import './chunk-UF5L4BAI.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-I2UOAV7X.js';
 import './chunk-YETTWTAY.js';
 import './chunk-TPKYTORP.js';
-import './chunk-KPBQYEND.js';
-import './chunk-2J5JGLW5.js';
-import './chunk-ATRIVTRE.js';
-import './chunk-UD3EXMKB.js';
-import './chunk-34XORKFD.js';
-import './chunk-G2WME4RG.js';
+import './chunk-CQAEV3Z5.js';
+import './chunk-4542B3RR.js';
+import './chunk-SFHR45FA.js';
+import './chunk-WXJXHZVB.js';
+import './chunk-U6RKHNC7.js';
+import './chunk-JD6GWYY7.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-WMHYIBJW.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-IPS2JCHK.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-4NM3I3VV.js';
+import './chunk-276D7BJ7.js';
 import './chunk-TBT347UY.js';
-import './chunk-4QKLMNI3.js';
-import './chunk-7V7KG3YM.js';
-import './chunk-I66MQDXH.js';
+import './chunk-ZCXP35T3.js';
+import './chunk-4AVDD7VX.js';
+import './chunk-OBCFK4QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-EXV37PKS.js';
-import './chunk-VX74ND77.js';
-import './chunk-IRBNIRQJ.js';
+import './chunk-FVDVC2GF.js';
+import './chunk-WKSBSEWT.js';
+import './chunk-3AZYLAJC.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-WERZMIKA.js';
+import './chunk-XR56WEA5.js';
 import './chunk-3W333NFO.js';
-import './chunk-PHHBYAL6.js';
-import './chunk-BLW6GPBZ.js';
-import './chunk-C3OVGKVJ.js';
-import './chunk-2HT2XGJX.js';
-import './chunk-QOALB6ZD.js';
-import './chunk-JRCSET55.js';
+import './chunk-NYTZ7HVN.js';
+import './chunk-2Q3PZ42G.js';
+import './chunk-IMCVQF5F.js';
+import './chunk-FQE5RDHI.js';
+import './chunk-B42BIYC6.js';
+import './chunk-EMUNEAQK.js';
 import './chunk-G3IJ3N6F.js';
 import './chunk-EAQSOE62.js';
 import './chunk-F35VMF5M.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-2CMJLYV6.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-V5CG75NX.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-ZFLOGMUC.js';
+import './chunk-XACXXKQ5.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-KOQELWQ6.js';
+import './chunk-SNVXHNU7.js';
 import './chunk-USWVXQIH.js';
-import './chunk-VWLOQ6FI.js';
-import './chunk-NTRCK4NH.js';
-import './chunk-6IO62VJS.js';
+import './chunk-QS43O4DR.js';
+import './chunk-HWZCE745.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-F7CU5ABH.js';
+import './chunk-DYEFPYME.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-ZNPE7FW5.js';
 import './chunk-HCVLP7XA.js';
@@ -59,16 +59,16 @@ import './chunk-ANPNT6PM.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
-import './chunk-5QRP3MVS.js';
+import './chunk-GNPTU4BM.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
 import './chunk-WFSUUUAN.js';
 import './chunk-7VUK5RFS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-KDHYLBRR.js';
-import './chunk-KIGSGZBB.js';
-import './chunk-V7MQKOZY.js';
+import './chunk-OW52QLK3.js';
+import './chunk-IHNQWF6F.js';
+import './chunk-URWYRAIC.js';
 import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';

package/dist/{chunk-4NM3I3VV.js → chunk-276D7BJ7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KIGSGZBB.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-22DYXLU7.js → chunk-2CPOAPU4.js}

@@ -1,29 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-FGW2774C.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-KOIMUHIS.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UF5L4BAI.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { writePendingUpdate } from './chunk-KPBQYEND.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-2J5JGLW5.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-WMHYIBJW.js';
+import { writePendingUpdate } from './chunk-CQAEV3Z5.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-IPS2JCHK.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-4NM3I3VV.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-276D7BJ7.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { checkFit } from './chunk-I66MQDXH.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-VX74ND77.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-WERZMIKA.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-C3OVGKVJ.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-2HT2XGJX.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-2CMJLYV6.js';
+import { checkFit } from './chunk-OBCFK4QD.js';
+import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-WKSBSEWT.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-XR56WEA5.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-IMCVQF5F.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-FQE5RDHI.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-V5CG75NX.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
-import { claimPidFile, readPidFile, releasePidFile } from './chunk-ZFLOGMUC.js';
+import { claimPidFile, readPidFile, releasePidFile } from './chunk-XACXXKQ5.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-KDHYLBRR.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-KIGSGZBB.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-V7MQKOZY.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-OW52QLK3.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-IHNQWF6F.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-URWYRAIC.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-GISNHSYL.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, rmSync, closeSync, openSync, constants, lstatSync } from 'fs';
@@ -1552,7 +1552,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-L6WMPAA2.js');
+  const { postJson: postJson2 } = await import('./work-cmd-SM6DY2WK.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2521,7 +2521,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-3YHMJQ3P.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-N6WLZCER.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-BLW6GPBZ.js → chunk-2Q3PZ42G.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-V7MQKOZY.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-URWYRAIC.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-IRBNIRQJ.js → chunk-3AZYLAJC.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-3W333NFO.js';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-ZFLOGMUC.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-XACXXKQ5.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-KIGSGZBB.js';
-import { withGitConfig, tokenHeader } from './chunk-V7MQKOZY.js';
+import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-URWYRAIC.js';
 import { RELAY_ID, RELAY_USER } from './chunk-GISNHSYL.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
@@ -176,7 +176,7 @@ function toolsDockerfile(parts) {
       ["SessionStart", "SessionEnd", "Stop", "PostToolUse"].map((event) => [event, [{ hooks: [{ type: "command", command: `outerlayer hook ${event}` }] }]])
     )
   });
-  const download = `node -e 'fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return r.arrayBuffer()}).then((b)=>require("fs").writeFileSync(process.argv[2],Buffer.from(b)))'`;
+  const download = `NODE_USE_ENV_PROXY=1 node ${PROXY_WARNING_FLAG} -e 'fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return r.arrayBuffer()}).then((b)=>require("fs").writeFileSync(process.argv[2],Buffer.from(b)))'`;
   return [
     `FROM ${recipeImage} AS recipe`,
     `FROM ${nodeImage} AS stage`,

package/dist/{chunk-ATRIVTRE.js → chunk-4542B3RR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-34XORKFD.js';
-import { spoolDir } from './chunk-6IO62VJS.js';
+import { LiveUploader } from './chunk-U6RKHNC7.js';
+import { spoolDir } from './chunk-HWZCE745.js';
 import { CaptureDaemon } from './chunk-AEKSX4EY.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-7V7KG3YM.js → chunk-4AVDD7VX.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-I66MQDXH.js';
+import { DEFAULT_UNIT_NAME } from './chunk-OBCFK4QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import { RUNNER_FILE_MODE } from './chunk-KIGSGZBB.js';
+import { RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-JVB63NIB.js → chunk-4OYKJJ2V.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { runEmit } from './chunk-XCRZTXRL.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-KOQELWQ6.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-SNVXHNU7.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-DIB2WLBL.js';
 import { installStarterPack } from './chunk-V7SAQ645.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-5OCIHFGE.js';

package/dist/{chunk-QOALB6ZD.js → chunk-B42BIYC6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-JRCSET55.js';
-import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-EMUNEAQK.js';
+import { resolveGatewayCredentials } from './chunk-QS43O4DR.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-AEKSX4EY.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-G6DZCKA6.js → chunk-BVR6MQLS.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-QOALB6ZD.js';
-import { defaultFetch } from './chunk-VWLOQ6FI.js';
-import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
+import { autoConnect, detectActiveSession } from './chunk-B42BIYC6.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-QS43O4DR.js';
 import { resolveRepoIdentity } from './chunk-AEKSX4EY.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-KPBQYEND.js → chunk-CQAEV3Z5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KIGSGZBB.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-IZSVXRDR.js → chunk-DXDF43YG.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { recordReportedCost } from './chunk-BKO6JEZI.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { decodeWrappedCommand } from './chunk-5QRP3MVS.js';
+import { decodeWrappedCommand } from './chunk-GNPTU4BM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync } from 'fs';
 import { spawn } from 'child_process';

package/dist/{chunk-F7CU5ABH.js → chunk-DYEFPYME.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { decodeWrappedCommand } from './chunk-5QRP3MVS.js';
+import { decodeWrappedCommand } from './chunk-GNPTU4BM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, appendFileSync, writeFileSync } from 'fs';
 import { spawn } from 'child_process';

package/dist/{chunk-LOB2SUM3.js → chunk-EFB3FGLC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-4NM3I3VV.js';
+import { currentLink } from './chunk-276D7BJ7.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-JRCSET55.js → chunk-EMUNEAQK.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
 import { DEFAULT_DASHBOARD } from './chunk-EAQSOE62.js';
-import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-QS43O4DR.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { remoteLookupFailed } from './chunk-AEKSX4EY.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
@@ -89,7 +89,7 @@ function result(code, outcome, reason, text) {
 ` };
 }
 function realConnectDeps() {
-  return { fetchImpl: fetch, env: process.env, prompt: promptOnTerminal, now: () => /* @__PURE__ */ new Date() };
+  return { fetchImpl: cliFetch, env: process.env, prompt: promptOnTerminal, now: () => /* @__PURE__ */ new Date() };
 }
 async function promptOnTerminal(question, io = { input: process.stdin, output: process.stderr }) {
   const rl = createInterface(io);
@@ -315,4 +315,4 @@ ${COMMIT_LINE}
   return r.code;
 }
 
-export { COMMIT_LINE, autoConnectedLine, dashboardBase, fetchFactories, isLinkedRepository, listText, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, slug, workPageUrl };
+export { COMMIT_LINE, autoConnectedLine, dashboardBase, fetchFactories, hasUncommittedPolicy, isLinkedRepository, listText, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, slug, workPageUrl };

package/dist/{chunk-2HT2XGJX.js → chunk-FQE5RDHI.js}

@@ -1,16 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-QOALB6ZD.js';
-import { workPageUrl } from './chunk-JRCSET55.js';
+import { detectActiveSession, autoConnect } from './chunk-B42BIYC6.js';
+import { workPageUrl } from './chunk-EMUNEAQK.js';
 import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
-import { defaultFetch } from './chunk-VWLOQ6FI.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-NTRCK4NH.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-QS43O4DR.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-AEKSX4EY.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signRunnerRequest } from './chunk-KDHYLBRR.js';
+import { signRunnerRequest } from './chunk-OW52QLK3.js';
 
 createRequire(import.meta.url);
 
@@ -428,7 +427,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-WFB2ZMRB.js');
+      const { logHookError } = await import('./hook-fast-QUGEI2IT.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-EXV37PKS.js → chunk-FVDVC2GF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-VX74ND77.js';
+import { MIN_ENGINE_MAJOR } from './chunk-WKSBSEWT.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-3W333NFO.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-5QRP3MVS.js → chunk-GNPTU4BM.js}

@@ -220,13 +220,16 @@ function encodeWrappedCommand(command) {
 function decodeWrappedCommand(id) {
   return Buffer.from(id, "base64").toString("utf8");
 }
+function runsCommand(h) {
+  return typeof h.command === "string";
+}
 function listHookCandidates(settings, cliBin) {
   const out = [];
   const hooks = settings?.hooks ?? {};
   for (const event of Object.keys(hooks)) {
     (hooks[event] ?? []).forEach((matcher, matcherIndex) => {
       matcher.hooks.forEach((h, hookIndex) => {
-        if (isOurHookCommandFor(h, cliBin)) return;
+        if (!runsCommand(h) || isOurHookCommandFor(h, cliBin)) return;
         const original = wrappedOriginalCommand(h, cliBin);
         out.push({
           event,
@@ -245,12 +248,14 @@ function wrapHookCommand(cliBin, h, opts = {}) {
   if (isWrapped(h, cliBin)) return h;
   const id = encodeWrappedCommand(h.command);
   const flag = opts.captureOutput ? " --capture-output" : "";
-  return { type: "command", command: `${cliCommand(cliBin)} hook-wrap --id ${id}${flag}`, [WRAP_MARKER]: h.command };
+  return { ...h, command: `${cliCommand(cliBin)} hook-wrap --id ${id}${flag}`, [WRAP_MARKER]: h.command };
 }
 function unwrapHookCommand(h, cliBin) {
   const original = wrappedOriginalCommand(h, cliBin);
   if (original === null) return h;
-  return { type: "command", command: original };
+  const restored = { ...h, command: original };
+  delete restored[WRAP_MARKER];
+  return restored;
 }
 var AUTO_WRAP_EVENTS = ["PreToolUse", "PostToolUse"];
 function wrapHooks(settings, cliBin, opts = {}) {
@@ -268,7 +273,7 @@ function wrapHooks(settings, cliBin, opts = {}) {
       const matcher = matchers[mi];
       for (let hi = 0; hi < matcher.hooks.length; hi++) {
         const h = matcher.hooks[hi];
-        if (isOurHookCommandFor(h, cliBin) || isWrapped(h, cliBin)) continue;
+        if (!runsCommand(h) || isOurHookCommandFor(h, cliBin) || isWrapped(h, cliBin)) continue;
         const candidate = {
           event,
           matcherIndex: mi,

package/dist/{chunk-6IO62VJS.js → chunk-HWZCE745.js}

@@ -429,7 +429,7 @@ async function handleWorkLaunch(sessionId, home, env, spawnImpl = spawnDetached,
 }
 async function missingRenewalHookContext(home, cwd) {
   try {
-    const { settingsPath, readSettings, isOurHookCommand } = await import('./settings-J2652U5N.js');
+    const { settingsPath, readSettings, isOurHookCommand } = await import('./settings-AKYEOCC2.js');
     const userSettings = readSettings(settingsPath("user", { home }));
     const projectSettings = readSettings(settingsPath("project", { cwd }));
     if (userSettings === null && projectSettings === null) return void 0;
@@ -628,7 +628,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-SZTE4TUS.js');
+  const { governanceOf } = await import('./control-plane-launch-HE6OSWKO.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-KIGSGZBB.js → chunk-IHNQWF6F.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-V7MQKOZY.js';
+import { BUILD_HOME } from './chunk-URWYRAIC.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-C3OVGKVJ.js → chunk-IMCVQF5F.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-2HT2XGJX.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-KOQELWQ6.js';
-import { signingFetchFor } from './chunk-VWLOQ6FI.js';
+import { WorkCommandError, postJson } from './chunk-FQE5RDHI.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-SNVXHNU7.js';
+import { signingFetchFor } from './chunk-QS43O4DR.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-ZNPE7FW5.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
-import { signerFor } from './chunk-KDHYLBRR.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir } from './chunk-KIGSGZBB.js';
+import { signerFor } from './chunk-OW52QLK3.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir } from './chunk-IHNQWF6F.js';
 import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, lstatSync } from 'fs';
 import { relative, join, dirname } from 'path';
 

package/dist/{chunk-WMHYIBJW.js → chunk-IPS2JCHK.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-4QKLMNI3.js';
-import { describeCallFailure } from './chunk-C3OVGKVJ.js';
-import { WorkCommandError, getJson } from './chunk-2HT2XGJX.js';
+import { isPlaceholderCommand } from './chunk-ZCXP35T3.js';
+import { describeCallFailure } from './chunk-IMCVQF5F.js';
+import { WorkCommandError, getJson } from './chunk-FQE5RDHI.js';
 import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
-import { builtinKind } from './chunk-2CMJLYV6.js';
-import { signerFor } from './chunk-KDHYLBRR.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-V7MQKOZY.js';
+import { builtinKind } from './chunk-V5CG75NX.js';
+import { signerFor } from './chunk-OW52QLK3.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-URWYRAIC.js';
 
 createRequire(import.meta.url);