@outerlayer/cli 0.22.2 → 0.24.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @outerlayer/cli
 
+## 0.24.0
+
+### Minor Changes
+
+- 910c7a6: The runner ships as a container image, `ghcr.io/outerlayerai/runner`. Start it with one `docker run`; its builds survive the container restarting. A new command, `outerlayer runner container-start`, is the image's entrypoint. A runner in the image never updates itself: `runner status` and `doctor` name the image tag to pull.
+
+### Patch Changes
+
+- 9201346: In a repository that keeps its skills in `.agents/skills/`, `outerlayer init` and `outerlayer connect` say to commit and push `AGENTS.md`, `.agents/`, `.mcp.json` and `.claude/skills` with `.outerlayer/`. They say it again while any of them is not committed. `outerlayer init --update` says the same when it updates the starter files of such a repository.
+- 37af3f6: `outerlayer init --update` no longer moves a committed skill, `AGENTS.md` or `.outerlayer/mcp.json` to a path that git ignores. The next commit would have deleted the file from the repository. The command leaves the file, names the ignored path, and does not set the layout until `.gitignore` has an exception.
+
+## 0.23.0
+
+### Minor Changes
+
+- 9e49a10: `outerlayer init` keeps instructions in `AGENTS.md` and skills in `.agents/skills/`, with a `.claude/skills` link to `../.agents/skills`. Nothing generated is committed. `outerlayer init --update` moves an existing repository to this layout and removes the generated copies. It never deletes a file you edited. In a repository that uses only Claude Code or Codex, `outerlayer context emit` prints a notice that names `init --update`.
+
+### Patch Changes
+
+- 9810558: The build skill's criteria judge marks a criterion not satisfied when its test checks a stand-in for the outcome, such as the arguments a program starts with, or when the judge's own reason says part of the outcome is not asserted. The implementer and test-strength reviewer briefs say the same: a test proves a criterion only when it runs the code that produces the outcome.
+
 ## 0.22.2
 
 ### Patch Changes

package/README.md

@@ -165,6 +165,10 @@ content:
   fetches the package's dependencies, and both npm runs use this user's npm
   configuration, including any registry token in `~/.npmrc`. Set
   `runner.autoUpdate` to `false` to stop them.
+  `outerlayer runner container-start`, the runner image's entrypoint, writes
+  the config from its environment variables with no network call. It then
+  runs `outerlayer runner start`, which makes the calls above. In the image
+  the runner never calls the npm registry. It logs the image tag to pull.
   `runner check` makes a list call and a host-key lookup to confirm the key
   works and sends nothing else; `runner status` and `runner logs` make no network call at all.
   On a runner host, any command that uses the saved runner key signs each

package/dist/agent-setup-QQYRBPK2.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { keepHandWritten, runAgentSetup } from './chunk-WH2QV3UL.js';
+import './chunk-WX2WEERU.js';
+import './chunk-VJBFQP3H.js';
+import './chunk-E4OUL7ZP.js';
+import './chunk-MQ743JX3.js';
+import './chunk-FKXGQOF5.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-YVZJ6GKF.js';
+import './chunk-ANPNT6PM.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
+import './chunk-CRB3POP4.js';
+import './chunk-VWFOKRYS.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-TUSYOL2O.js';
+import './chunk-RKOTJQVG.js';
+import './chunk-QZBXLLTV.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-RA3O54FC.js';
+import './chunk-PVRBE7S4.js';
+import './chunk-KF37SUDM.js';
+import './chunk-BN3CSI7S.js';
+import './chunk-GISNHSYL.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{artifact-link-cmd-OWRI5AJX.js → artifact-link-cmd-LEI6EOZE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-G3IJ3N6F.js';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-BUP5N3X6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import './chunk-7VUK5RFS.js';
+import './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{bridge-QFN3KJP6.js → bridge-4ZARDVGS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-WXJXHZVB.js';
-import './chunk-URWYRAIC.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-CZUH2SLQ.js';
+import './chunk-BN3CSI7S.js';
 import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{build-6WRNZPVR.js → build-OVZIT2G2.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-3AZYLAJC.js';
-export { RecipeError } from './chunk-3W333NFO.js';
-import './chunk-XACXXKQ5.js';
+export { buildRepositoryImage } from './chunk-TTLVQZSH.js';
+import './chunk-FWEWFW3F.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
+export { RecipeError } from './chunk-3W333NFO.js';
+import './chunk-KF37SUDM.js';
+import './chunk-BN3CSI7S.js';
 import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-15T01:34:44.161Z+28a91ce","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-15T12:32:52.123Z+e9e62b5","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-G3MLDMTI.js → builder-MECDEKXX.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-XR56WEA5.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-5XCAPBE2.js';
 import './chunk-3W333NFO.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-AEKSX4EY.js';
-import './chunk-7VUK5RFS.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
+import './chunk-D4AMAEZ7.js';
+import './chunk-QZBXLLTV.js';
+import './chunk-PVRBE7S4.js';
+import './chunk-KF37SUDM.js';
+import './chunk-BN3CSI7S.js';
 import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{check-N6WLZCER.js → check-YYKNYFNI.js}

@@ -1,74 +1,76 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-2CPOAPU4.js';
-import './chunk-KOIMUHIS.js';
-import './chunk-UF5L4BAI.js';
+import { probeCredentials } from './chunk-H6IUKXXI.js';
+import './chunk-6GSA2SKT.js';
+import './chunk-NGZID7UI.js';
+import './chunk-NTQTDCYR.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-I2UOAV7X.js';
 import './chunk-YETTWTAY.js';
 import './chunk-TPKYTORP.js';
-import './chunk-CQAEV3Z5.js';
-import './chunk-4542B3RR.js';
-import './chunk-SFHR45FA.js';
-import './chunk-WXJXHZVB.js';
-import './chunk-U6RKHNC7.js';
-import './chunk-JD6GWYY7.js';
+import './chunk-W7O4LA4E.js';
+import './chunk-A62QFN2M.js';
+import './chunk-CZUH2SLQ.js';
+import './chunk-D7K446H6.js';
+import './chunk-F7Y2USIM.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-IPS2JCHK.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-5ECUMU53.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-276D7BJ7.js';
+import './chunk-VV7ZD5LR.js';
 import './chunk-TBT347UY.js';
-import './chunk-ZCXP35T3.js';
-import './chunk-4AVDD7VX.js';
-import './chunk-OBCFK4QD.js';
+import './chunk-BOQY756V.js';
+import './chunk-VBEXKEBV.js';
+import './chunk-GU4PKXN7.js';
+import './chunk-LBCZXXOX.js';
+import './chunk-DG2ULWM6.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-FVDVC2GF.js';
-import './chunk-WKSBSEWT.js';
-import './chunk-3AZYLAJC.js';
+import './chunk-IDSHLKQA.js';
+import './chunk-TQMI335S.js';
+import './chunk-TTLVQZSH.js';
+import './chunk-FWEWFW3F.js';
+import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-XR56WEA5.js';
+import './chunk-5XCAPBE2.js';
 import './chunk-3W333NFO.js';
-import './chunk-NYTZ7HVN.js';
-import './chunk-2Q3PZ42G.js';
-import './chunk-IMCVQF5F.js';
-import './chunk-FQE5RDHI.js';
-import './chunk-B42BIYC6.js';
-import './chunk-EMUNEAQK.js';
-import './chunk-G3IJ3N6F.js';
-import './chunk-EAQSOE62.js';
-import './chunk-F35VMF5M.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-V5CG75NX.js';
+import './chunk-LY2L3O2O.js';
+import './chunk-PDIM5T65.js';
+import './chunk-TQ6Y7YV6.js';
+import './chunk-RVYOOYOA.js';
+import './chunk-F2W2IYNP.js';
+import './chunk-V5Q3S4NM.js';
+import './chunk-BUP5N3X6.js';
+import './chunk-XSPA5ODY.js';
+import './chunk-GOSFARMS.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-D7X5ITVT.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-XACXXKQ5.js';
-import './chunk-JBJTC3UU.js';
-import './chunk-SNVXHNU7.js';
-import './chunk-USWVXQIH.js';
-import './chunk-QS43O4DR.js';
-import './chunk-HWZCE745.js';
+import './chunk-E4OUL7ZP.js';
+import './chunk-MQ743JX3.js';
+import './chunk-FKXGQOF5.js';
+import './chunk-755WXDBI.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-DYEFPYME.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-ZNPE7FW5.js';
+import './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-AEKSX4EY.js';
-import './chunk-EABW6AJQ.js';
-import './chunk-5OCIHFGE.js';
+import './chunk-D4AMAEZ7.js';
 import './chunk-ANPNT6PM.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
 import './chunk-GNPTU4BM.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-WFSUUUAN.js';
-import './chunk-7VUK5RFS.js';
+import './chunk-RKOTJQVG.js';
+import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
+import './chunk-PVRBE7S4.js';
+import './chunk-KF37SUDM.js';
+import './chunk-BN3CSI7S.js';
 import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';

package/dist/{chunk-IPS2JCHK.js → chunk-5ECUMU53.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-ZCXP35T3.js';
-import { describeCallFailure } from './chunk-IMCVQF5F.js';
-import { WorkCommandError, getJson } from './chunk-FQE5RDHI.js';
-import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
-import { builtinKind } from './chunk-V5CG75NX.js';
-import { signerFor } from './chunk-OW52QLK3.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-URWYRAIC.js';
+import { isPlaceholderCommand } from './chunk-BOQY756V.js';
+import { describeCallFailure } from './chunk-TQ6Y7YV6.js';
+import { WorkCommandError, getJson } from './chunk-RVYOOYOA.js';
+import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
+import { builtinKind } from './chunk-D7X5ITVT.js';
+import { signerFor } from './chunk-PVRBE7S4.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-BN3CSI7S.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-XR56WEA5.js → chunk-5XCAPBE2.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { RecipeError, BUILDKIT_IMAGE } from './chunk-3W333NFO.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { compareVersions } from './chunk-AEKSX4EY.js';
-import { ensureHostKey } from './chunk-OW52QLK3.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-IHNQWF6F.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-URWYRAIC.js';
+import { compareVersions } from './chunk-D4AMAEZ7.js';
+import { ensureHostKey } from './chunk-PVRBE7S4.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-KF37SUDM.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BN3CSI7S.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-GISNHSYL.js';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';

package/dist/{chunk-KOIMUHIS.js → chunk-6GSA2SKT.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { senderPidfile } from './chunk-4542B3RR.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-SFHR45FA.js';
-import { writeDockerClientConfig } from './chunk-WXJXHZVB.js';
-import { installScrubContext } from './chunk-U6RKHNC7.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-WKSBSEWT.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-3AZYLAJC.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-XR56WEA5.js';
+import { senderPidfile } from './chunk-W7O4LA4E.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-A62QFN2M.js';
+import { writeDockerClientConfig } from './chunk-CZUH2SLQ.js';
+import { installScrubContext } from './chunk-D7K446H6.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-GU4PKXN7.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-TTLVQZSH.js';
+import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-5XCAPBE2.js';
 import { CLAUDE_CODE_VERSION } from './chunk-3W333NFO.js';
-import { waitForAgent, vmExecArgs } from './chunk-NYTZ7HVN.js';
-import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-2Q3PZ42G.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-IMCVQF5F.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-FQE5RDHI.js';
-import { planArtifactUpload } from './chunk-G3IJ3N6F.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-V5CG75NX.js';
+import { waitForAgent, vmExecArgs } from './chunk-LY2L3O2O.js';
+import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-PDIM5T65.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-TQ6Y7YV6.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-RVYOOYOA.js';
+import { planArtifactUpload } from './chunk-BUP5N3X6.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-D7X5ITVT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { scrubText } from './chunk-AEKSX4EY.js';
+import { scrubText } from './chunk-D4AMAEZ7.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { resolvePackRoot } from './chunk-5OCIHFGE.js';
-import { parsePolicy } from './chunk-WFSUUUAN.js';
+import { resolvePackRoot } from './chunk-HBISTTG3.js';
+import { parsePolicy } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-OW52QLK3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-IHNQWF6F.js';
-import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-URWYRAIC.js';
+import { signerFor } from './chunk-PVRBE7S4.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-KF37SUDM.js';
+import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BN3CSI7S.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-GISNHSYL.js';
 import { existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, rmSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';

package/dist/{chunk-HWZCE745.js → chunk-755WXDBI.js}

@@ -624,11 +624,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-DSA3HGQU.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-LTH77FC3.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-HE6OSWKO.js');
+  const { governanceOf } = await import('./control-plane-launch-GKGI6HJA.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-SFHR45FA.js → chunk-A62QFN2M.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-WXJXHZVB.js';
-import { EXEC_PORT } from './chunk-2Q3PZ42G.js';
+import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-CZUH2SLQ.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-URWYRAIC.js';
+import { EXEC_PORT } from './chunk-PDIM5T65.js';
+import { RELAY_PORT } from './chunk-BN3CSI7S.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-URWYRAIC.js → chunk-BN3CSI7S.js}

@@ -71,8 +71,6 @@ function builtInEnvironment(localFor, credential) {
     CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
   };
 }
-
-// src/runner/destinations.ts
 var MAX_RELEASED_DESTINATIONS = 20;
 var MAX_DESTINATIONS = MAX_RELEASED_DESTINATIONS - BUILT_IN_NAMES.length;
 var DESTINATION_BASE_PORT = 3129;

package/dist/{chunk-ZCXP35T3.js → chunk-BOQY756V.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-4AVDD7VX.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-FVDVC2GF.js';
-import { MIN_ENGINE_MAJOR } from './chunk-WKSBSEWT.js';
-import { runnerCredentialProblem } from './chunk-V5CG75NX.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-VBEXKEBV.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GU4PKXN7.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-LBCZXXOX.js';
+import { runnerCredentialProblem } from './chunk-D7X5ITVT.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 
@@ -102,15 +102,15 @@ function prepareRunnerInit(configPath, opts = {}) {
   }
   const hooks = opts.requireContainer !== true && supportsMicroVmBuilds(machine) ? "builtin:vm" : supportsContainerBuilds(machine) ? "builtin:container" : "builtin:process";
   if (hooks === "builtin:process" && opts.allowProcess !== true) throw new RunnerInitError(processRefusal(machine));
-  if (agent === "claude" && credential === void 0 && !hasStoredCredential(configPath)) {
+  if (agent === "claude" && credential === void 0 && opts.credentialInEnvironment !== true && !hasStoredCredential(configPath)) {
     throw new RunnerInitError(
       "--agent claude needs Claude's credential, and none was piped on stdin or is in the runner.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
     );
   }
-  return { configPath, config, carried, credential, agent, machine, hooks, needsKey };
+  return { configPath, config, carried, credential, agent, machine, hooks, needsKey, host: opts.host };
 }
 function writeRunnerInit(prepared, runnerKey) {
-  const { configPath, config, carried, credential, agent, machine, hooks } = prepared;
+  const { configPath, config, carried, credential, agent, machine, hooks, host } = prepared;
   if (prepared.needsKey && runnerKey === void 0) {
     throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was pasted.`);
   }
@@ -130,6 +130,7 @@ function writeRunnerInit(prepared, runnerKey) {
       amend: PLACEHOLDER_COMMAND
     },
     ...carried,
+    ...host === void 0 ? {} : { host },
     // The agent was named on this command line, so its commands win over any the hand-off carried.
     ...agent === void 0 ? {} : { commands: { ...AGENT_COMMANDS[agent] } },
     hooks: { provision: hooks, cleanup: hooks }

package/dist/{chunk-BVR6MQLS.js → chunk-BUBCPP3F.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-B42BIYC6.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-QS43O4DR.js';
-import { resolveRepoIdentity } from './chunk-AEKSX4EY.js';
+import { autoConnect, detectActiveSession } from './chunk-F2W2IYNP.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-FKXGQOF5.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-G3IJ3N6F.js → chunk-BUP5N3X6.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-7VUK5RFS.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-WXJXHZVB.js → chunk-CZUH2SLQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-URWYRAIC.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-BN3CSI7S.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-AEKSX4EY.js → chunk-D4AMAEZ7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-7VUK5RFS.js';
+import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-QZBXLLTV.js';
 import { createHash } from 'crypto';
 import { readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, renameSync, unlinkSync, writeFileSync, stat as stat$1, unwatchFile, watchFile, watch as watch$1 } from 'fs';
 import { type, homedir } from 'os';
@@ -21971,14 +21971,14 @@ var ModelRegistryImpl = class {
 };
 var models_default = {
   version: "1.0.0",
-  generatedAt: "2026-10-14T04:11:40.017Z",
+  generatedAt: "2026-10-15T03:53:58.240Z",
   sources: {
     litellm: {
-      fetchedAt: "2026-10-14T04:11:40.017Z",
-      modelCount: 1938
+      fetchedAt: "2026-10-15T03:53:58.240Z",
+      modelCount: 1937
     },
     openrouter: {
-      fetchedAt: "2026-10-14T04:11:40.017Z",
+      fetchedAt: "2026-10-15T03:53:58.240Z",
       modelCount: 205
     }
   },
@@ -50707,7 +50707,8 @@ var models_default = {
       },
       capabilities: {
         vision: true
-      }
+      },
+      deprecationDate: "2025-11-14"
     },
     "gemini-2.5-flash-native-audio-latest": {
       provider: "google",
@@ -52816,8 +52817,8 @@ var models_default = {
         "max_tokens"
       ],
       pricing: {
-        inputCostPerToken: 2e-6,
-        outputCostPerToken: 1e-5
+        inputCostPerToken: 4e-6,
+        outputCostPerToken: 2e-5
       },
       context: {
         maxInputTokens: 105e4,
@@ -54011,8 +54012,8 @@ var models_default = {
         "max_tokens"
       ],
       pricing: {
-        inputCostPerToken: 1e-6,
-        outputCostPerToken: 5e-6
+        inputCostPerToken: 2e-6,
+        outputCostPerToken: 1e-5
       },
       context: {
         maxInputTokens: 105e4,
@@ -54033,8 +54034,8 @@ var models_default = {
         "max_tokens"
       ],
       pricing: {
-        inputCostPerToken: 1e-6,
-        outputCostPerToken: 5e-6
+        inputCostPerToken: 2e-6,
+        outputCostPerToken: 1e-5
       },
       context: {
         maxInputTokens: 105e4,

package/dist/{chunk-U6RKHNC7.js → chunk-D7K446H6.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-JD6GWYY7.js';
+import { uploadSpooledSteps } from './chunk-F7Y2USIM.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-G3IJ3N6F.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QS43O4DR.js';
-import { writeSyncStatus, spoolDir } from './chunk-HWZCE745.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FKXGQOF5.js';
+import { writeSyncStatus, spoolDir } from './chunk-755WXDBI.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-DYEFPYME.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-AEKSX4EY.js';
-import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
+import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-7VUK5RFS.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signerFor, signRunnerRequest } from './chunk-OW52QLK3.js';
+import { signerFor, signRunnerRequest } from './chunk-PVRBE7S4.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';

package/dist/{chunk-V5CG75NX.js → chunk-D7X5ITVT.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-URWYRAIC.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BN3CSI7S.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';

package/dist/{chunk-OBCFK4QD.js → chunk-DG2ULWM6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-V5CG75NX.js';
+import { builtinKind } from './chunk-D7X5ITVT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { runnerDir } from './chunk-IHNQWF6F.js';
+import { runnerDir } from './chunk-KF37SUDM.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 

package/dist/{chunk-SNVXHNU7.js → chunk-E4OUL7ZP.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-USWVXQIH.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-QS43O4DR.js';
+import { removeRetiredSkills } from './chunk-MQ743JX3.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-FKXGQOF5.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-5OCIHFGE.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
-import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-WFSUUUAN.js';
+import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-URWYRAIC.js';
+import { withTokenHeader } from './chunk-BN3CSI7S.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';