@outerlayer/cli 0.22.2 → 0.24.0

package/dist/{chunk-B42BIYC6.js → chunk-F2W2IYNP.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-EMUNEAQK.js';
-import { resolveGatewayCredentials } from './chunk-QS43O4DR.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-V5Q3S4NM.js';
+import { resolveGatewayCredentials } from './chunk-FKXGQOF5.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-AEKSX4EY.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';

package/dist/{chunk-JD6GWYY7.js → chunk-F7Y2USIM.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-B42BIYC6.js';
-import { acquireSpoolLockAt } from './chunk-G3IJ3N6F.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QS43O4DR.js';
-import { resolveRepoIdentity } from './chunk-AEKSX4EY.js';
+import { autoConnect, detectActiveSession } from './chunk-F2W2IYNP.js';
+import { acquireSpoolLockAt } from './chunk-BUP5N3X6.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FKXGQOF5.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { StepNameSchema, StepBodySchema } from './chunk-7VUK5RFS.js';
+import { StepNameSchema, StepBodySchema } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';
 import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, appendFileSync } from 'fs';

package/dist/{chunk-QS43O4DR.js → chunk-FKXGQOF5.js}

@@ -5,7 +5,7 @@ import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { signRunnerRequest, signerFor } from './chunk-OW52QLK3.js';
+import { signRunnerRequest, signerFor } from './chunk-PVRBE7S4.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-JV4YGAAW.js → chunk-FQPN5S4Q.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { compareVersions } from './chunk-I2UOAV7X.js';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-EFB3FGLC.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-276D7BJ7.js';
-import { RUNNER_DIR_MODE } from './chunk-IHNQWF6F.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-HHXBOTRO.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-VV7ZD5LR.js';
+import { compareVersions } from './chunk-TQMI335S.js';
+import { RUNNER_DIR_MODE } from './chunk-KF37SUDM.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-XACXXKQ5.js → chunk-FWEWFW3F.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
 import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-WKSBSEWT.js → chunk-GU4PKXN7.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3AZYLAJC.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTLVQZSH.js';
+import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-XR56WEA5.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-5XCAPBE2.js';
 import { RecipeError, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-3W333NFO.js';
-import { execCapture } from './chunk-NYTZ7HVN.js';
-import { GUEST_CID } from './chunk-2Q3PZ42G.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-IMCVQF5F.js';
-import { WorkCommandError } from './chunk-FQE5RDHI.js';
+import { execCapture } from './chunk-LY2L3O2O.js';
+import { GUEST_CID } from './chunk-PDIM5T65.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-TQ6Y7YV6.js';
+import { WorkCommandError } from './chunk-RVYOOYOA.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
-import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { sharedSkillNames, skillConflictMessage } from './chunk-ZNPE7FW5.js';
+import { sharedSkillNames, skillConflictMessage } from './chunk-VPEGE3QZ.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-AEKSX4EY.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-WFSUUUAN.js';
-import { downconvertSession } from './chunk-7VUK5RFS.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-IHNQWF6F.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-URWYRAIC.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-D4AMAEZ7.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
+import { downconvertSession } from './chunk-QZBXLLTV.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-KF37SUDM.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BN3CSI7S.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-GISNHSYL.js';
 import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { join, dirname, basename } from 'path';

package/dist/{chunk-2CPOAPU4.js → chunk-H6IUKXXI.js}

@@ -1,29 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-KOIMUHIS.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UF5L4BAI.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-6GSA2SKT.js';
+import { writePendingUpdate } from './chunk-NGZID7UI.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-NTQTDCYR.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { writePendingUpdate } from './chunk-CQAEV3Z5.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-IPS2JCHK.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-5ECUMU53.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-276D7BJ7.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-VV7ZD5LR.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { checkFit } from './chunk-OBCFK4QD.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-WKSBSEWT.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-XR56WEA5.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-IMCVQF5F.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-FQE5RDHI.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-V5CG75NX.js';
-import { exceedsDisk } from './chunk-7RQ73DLO.js';
-import { claimPidFile, readPidFile, releasePidFile } from './chunk-XACXXKQ5.js';
+import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-GU4PKXN7.js';
+import { checkFit } from './chunk-DG2ULWM6.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-IDSHLKQA.js';
+import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
+import { claimPidFile, readPidFile, releasePidFile } from './chunk-FWEWFW3F.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-5XCAPBE2.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-TQ6Y7YV6.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-RVYOOYOA.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-D7X5ITVT.js';
+import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-OW52QLK3.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-IHNQWF6F.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-URWYRAIC.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-PVRBE7S4.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-KF37SUDM.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-BN3CSI7S.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-GISNHSYL.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, rmSync, closeSync, openSync, constants, lstatSync } from 'fs';
@@ -1165,6 +1166,10 @@ function selfUpdateBlocker(configPath, entryPath, own) {
   return void 0;
 }
 function considerNamedVersion(state, named) {
+  if (state.deps.image !== void 0) {
+    considerNamedImage(state, named);
+    return;
+  }
   const update = state.deps.update;
   if (update === void 0 || named === void 0) return;
   const configPath = state.config.configPath;
@@ -1187,6 +1192,34 @@ function considerNamedVersion(state, named) {
     logOf(state).line(`this runner cannot update itself to ${named}: ${blocker}`);
   }
 }
+function considerNamedImage(state, named) {
+  if (named !== void 0 && !isVersion(named)) named = void 0;
+  if (named !== void 0) state.imageNamed = named;
+  recordImageStatus(state);
+  const own = ownVersionOf(state.deps);
+  if (named === void 0 || state.imageLogged === named || (compareVersions(own, named) ?? 0) >= 0) return;
+  state.imageLogged = named;
+  logOf(state).line(`the factory names ${named}, newer than the ${own} this image runs \xB7 ${pullInstruction(imageTag(named))}`);
+}
+function recordImageStatus(state) {
+  if (state.deps.image === void 0) return;
+  const named = state.imageNamed;
+  const record = {
+    own: ownVersionOf(state.deps),
+    ...named === void 0 ? {} : { named, tag: imageTag(named) },
+    upgradeRequired: state.upgradeRefused === true,
+    at: nowOf(state).toISOString()
+  };
+  const key = JSON.stringify({ ...record, at: void 0 });
+  if (state.imageRecord === key) return;
+  try {
+    writeUpdateStatus(runnerDir(state.config.configPath), record);
+    state.imageRecord = key;
+    reportRepeating(state, "the update-status.json record", void 0);
+  } catch (err) {
+    reportRepeating(state, "the update-status.json record", `could not write update-status.json (${describeCallFailure(err)}): \`runner status\` will not name the image to pull`);
+  }
+}
 function adoptUpdateWait(state, version, nowMs) {
   const previous = state.updateWait;
   const wait = { version, sinceMs: previous?.sinceMs ?? nowMs, holdSinceMs: previous?.holdSinceMs };
@@ -1488,6 +1521,7 @@ async function housekeepingPass(state) {
 async function runTick(state) {
   state.restarting = false;
   state.holdingForUpdate = false;
+  if (state.draining === true) return;
   reloadConfig(state);
   if (restartOntoInstalled(state)) {
     state.restarting = true;
@@ -1552,7 +1586,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-SM6DY2WK.js');
+  const { postJson: postJson2 } = await import('./work-cmd-APXSER2D.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1589,14 +1623,21 @@ async function tryClaimAndStart(state, item, queue) {
       return { kind: "signature" };
     }
     if (claim.code === "runner_upgrade_required") {
-      reportRepeating(state, "the runner protocol", claim.message ?? claim.reason);
+      const tag = tagToPull(state.imageNamed);
+      reportRepeating(
+        state,
+        "the runner protocol",
+        state.deps.image === void 0 ? claim.message ?? claim.reason : `${claim.message ?? claim.reason} \xB7 ${pullInstruction(tag)}`
+      );
       state.upgradeRefused = true;
+      recordImageStatus(state);
       return { kind: "outdated" };
     }
     return { kind: "error", reason: `${claim.reason} (${claim.attempts} attempt(s))` };
   }
   reportRepeating(state, "the runner protocol", void 0);
   state.upgradeRefused = false;
+  recordImageStatus(state);
   reportRepeating(state, "the request signature", void 0);
   const { data } = claim.value;
   const claimId = data.id === void 0 || data.id === null ? "" : String(data.id);
@@ -2521,7 +2562,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-N6WLZCER.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-YYKNYFNI.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2625,8 +2666,9 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const probeTimer = setInterval(() => {
     for (const active of state.jobs.values()) void probeBuild(state, active);
   }, deps.probeIntervalMs ?? PROBE_INTERVAL_MS);
-  const onSigterm = () => void drain();
+  const onSigterm = () => deps.image === void 0 ? void drain() : leave();
   const onSigusr1 = () => void stopNow();
+  const onSigusr2 = () => drainKeepingUp();
   const onSigint = () => {
     interrupts++;
     if (interrupts === 1) {
@@ -2639,6 +2681,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const detachSignals = () => {
     process.off("SIGTERM", onSigterm);
     process.off("SIGUSR1", onSigusr1);
+    process.off("SIGUSR2", onSigusr2);
     process.off("SIGINT", onSigint);
   };
   const stopIntake = () => {
@@ -2685,6 +2728,19 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     }
     finish2();
   };
+  const drainKeepingUp = () => {
+    if (state.draining === true) return;
+    state.draining = true;
+    stopIntake();
+    log.line(`stopping: taking no more work, ${state.jobs.size} build(s) still managed \xB7 docker stop ends this container`);
+  };
+  const leave = () => {
+    if (exited) return;
+    log.line(`stopping: leaving ${state.jobs.size} running build(s) for the next runner to adopt`);
+    state.draining = true;
+    finish2();
+    deps.image?.exit?.(0);
+  };
   const stopNow = async () => {
     if (stopping) return;
     stopping = true;
@@ -2705,6 +2761,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const handle = { state, drain, stopNow, close };
   process.on("SIGTERM", onSigterm);
   process.on("SIGUSR1", onSigusr1);
+  if (deps.image !== void 0) process.on("SIGUSR2", onSigusr2);
   process.on("SIGINT", onSigint);
   deps.onReady?.();
   await tick(state);
@@ -2717,7 +2774,8 @@ function describeWaiting(active, nowMs) {
 }
 var RunnerStartError = class extends Error {
 };
-async function requestStop(configPath, stopNow = false, pollMs = 5e3) {
+async function requestStop(configPath, stopNow = false, pollMs = 5e3, options = {}) {
+  const kill = options.kill ?? ((pid, signal2) => process.kill(pid, signal2));
   const entry = readPidFile(pidFilePath(configPath));
   if (!entry) {
     process.stdout.write("no runner is running on this config\n");
@@ -2729,9 +2787,9 @@ async function requestStop(configPath, stopNow = false, pollMs = 5e3) {
 `);
     return;
   }
-  const signal = stopNow ? "SIGUSR1" : "SIGTERM";
+  const signal = stopNow ? "SIGUSR1" : options.image === true ? "SIGUSR2" : "SIGTERM";
   try {
-    process.kill(entry.pid, signal);
+    kill(entry.pid, signal);
   } catch (err) {
     const code = err?.code;
     if (code === "EPERM") {
@@ -2744,6 +2802,14 @@ async function requestStop(configPath, stopNow = false, pollMs = 5e3) {
 `);
     return;
   }
+  if (signal === "SIGUSR2") {
+    process.stdout.write(
+      `sent SIGUSR2 to runner pid ${entry.pid}: it takes no more work and keeps managing its builds.
+The container stays up. Run \`outerlayer runner status\` to see what is left, then \`docker stop\` the container once nothing is.
+`
+    );
+    return;
+  }
   process.stdout.write(
     stopNow ? `sent SIGUSR1 to runner pid ${entry.pid}, stopping now
 ` : `sent SIGTERM to runner pid ${entry.pid}, draining

package/dist/{chunk-5OCIHFGE.js → chunk-HBISTTG3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-WFSUUUAN.js';
+import { splitRawFile } from './chunk-RKOTJQVG.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
@@ -12,17 +12,26 @@ var MAINTAINED_SKILLS = ["outerlayer-evidence", "outerlayer-amend", "outerlayer-
 function templateClassLine(version) {
   return `<!-- yours to edit. Copied once from the default template by outerlayer init ${version}; never overwritten. -->`;
 }
-function maintainedClassLine(version) {
-  return `<!-- maintained by OuterLayer ${version}. Edits are overwritten on the next outerlayer context emit. -->`;
+function maintainedClassLine(version, base) {
+  const command = base === AGENTS_SKILLS_BASE ? "outerlayer init --update" : "outerlayer context emit";
+  return `<!-- maintained by OuterLayer ${version}. Edits are overwritten on the next ${command}. -->`;
+}
+var OUTERLAYER_SKILLS_BASE = ".outerlayer/skills";
+var AGENTS_SKILLS_BASE = ".agents/skills";
+function rewriteSkillPaths(content, base) {
+  return base === OUTERLAYER_SKILLS_BASE ? content : content.split(`${OUTERLAYER_SKILLS_BASE}/`).join(`${base}/`);
+}
+function restoreSkillPaths(content, base) {
+  return base === OUTERLAYER_SKILLS_BASE ? content : content.split(`${base}/`).join(`${OUTERLAYER_SKILLS_BASE}/`);
 }
 function resolvePackRoot(entryPath = fileURLToPath(import.meta.url)) {
   return join(dirname(dirname(entryPath)), "skill-pack");
 }
-function skillDir(skill) {
-  return `.outerlayer/skills/${skill}`;
+function skillDir(skill, base = OUTERLAYER_SKILLS_BASE) {
+  return `${base}/${skill}`;
 }
-function renderSkillFile(skillClass, content, version) {
-  const line = skillClass === "maintained" ? maintainedClassLine(version) : templateClassLine(version);
+function renderSkillFile(skillClass, content, version, base) {
+  const line = skillClass === "maintained" ? maintainedClassLine(version, base) : templateClassLine(version);
   const { frontmatterInner, body } = splitRawFile(content);
   if (frontmatterInner === null) return `${line}
 ${content}`;
@@ -42,7 +51,7 @@ function filesUnder(dir, base = dir) {
 function orderSkillFiles(relPaths) {
   return [...relPaths.filter((p) => p === "SKILL.md"), ...relPaths.filter((p) => p !== "SKILL.md")];
 }
-function loadClass(packRoot, skillClass, names, version) {
+function loadClass(packRoot, skillClass, names, version, base) {
   const files = [];
   for (const skill of names) {
     const dir = join(packRoot, skillClass, skill);
@@ -52,18 +61,18 @@ function loadClass(packRoot, skillClass, names, version) {
       files.push({
         skill,
         skillClass,
-        path: `${skillDir(skill)}/${rel}`,
-        content: rel === "SKILL.md" ? renderSkillFile(skillClass, raw, version) : raw
+        path: `${skillDir(skill, base)}/${rel}`,
+        content: rewriteSkillPaths(rel === "SKILL.md" ? renderSkillFile(skillClass, raw, version, base) : raw, base)
       });
     }
   }
   return files;
 }
-function loadTemplateFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion()) {
-  return loadClass(packRoot, "template", TEMPLATE_SKILLS, version);
+function loadTemplateFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion(), base = OUTERLAYER_SKILLS_BASE) {
+  return loadClass(packRoot, "template", TEMPLATE_SKILLS, version, base);
 }
-function loadMaintainedFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion()) {
-  return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version);
+function loadMaintainedFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion(), base = OUTERLAYER_SKILLS_BASE) {
+  return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version, base);
 }
 function writeMaintainedFiles(repoRoot, files) {
   const created = [];
@@ -78,15 +87,15 @@ function writeMaintainedFiles(repoRoot, files) {
   }
   return { created, rewritten };
 }
-function maintainedFilesForExistingSkills(repoRoot, files) {
+function maintainedFilesForExistingSkills(repoRoot, files, base = OUTERLAYER_SKILLS_BASE) {
   return files.filter(
-    (file) => existsSync(join(repoRoot, skillDir(file.skill))) || formerNameExists(repoRoot, file.skill) || requiredByBuild(repoRoot, file.skill)
+    (file) => existsSync(join(repoRoot, skillDir(file.skill, base))) || formerNameExists(repoRoot, file.skill, base) || requiredByBuild(repoRoot, file.skill, base)
   );
 }
 function namesCore(text) {
   return text.includes("outerlayer-build");
 }
-function requiredByBuild(repoRoot, skill) {
+function requiredByBuild(repoRoot, skill, base) {
   if (skill !== "outerlayer-build") return false;
   const named = (file) => {
     try {
@@ -95,7 +104,7 @@ function requiredByBuild(repoRoot, skill) {
       return false;
     }
   };
-  if (named(join(repoRoot, skillDir("build"), "SKILL.md"))) return true;
+  if (named(join(repoRoot, skillDir("build", base), "SKILL.md"))) return true;
   const dir = join(repoRoot, ".outerlayer", "validators");
   try {
     return readdirSync(dir).some((name) => name.endsWith(".yaml") && named(join(dir, name)));
@@ -110,15 +119,15 @@ var FORMER_MAINTAINED_NAMES = {
   outerlayer: "outerlayer-cli"
 };
 var MAINTAINED_LINE = /^<!-- maintained by OuterLayer \S+?\. /m;
-function isMaintainedCopy(repoRoot, skill) {
+function isMaintainedCopy(repoRoot, skill, base = OUTERLAYER_SKILLS_BASE) {
   try {
-    return MAINTAINED_LINE.test(readFileSync(join(repoRoot, skillDir(skill), "SKILL.md"), "utf8"));
+    return MAINTAINED_LINE.test(readFileSync(join(repoRoot, skillDir(skill, base), "SKILL.md"), "utf8"));
   } catch {
     return false;
   }
 }
-function formerNameExists(repoRoot, skill) {
-  return Object.entries(FORMER_MAINTAINED_NAMES).some(([former, current]) => current === skill && isMaintainedCopy(repoRoot, former));
+function formerNameExists(repoRoot, skill, base) {
+  return Object.entries(FORMER_MAINTAINED_NAMES).some(([former, current]) => current === skill && isMaintainedCopy(repoRoot, former, base));
 }
 
-export { FORMER_MAINTAINED_NAMES, MAINTAINED_SKILLS, TEMPLATE_SKILLS, isMaintainedCopy, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, namesCore, resolvePackRoot, skillDir, writeMaintainedFiles };
+export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MAINTAINED_SKILLS, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };

package/dist/{chunk-EFB3FGLC.js → chunk-HHXBOTRO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-276D7BJ7.js';
+import { currentLink } from './chunk-VV7ZD5LR.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/chunk-IDSHLKQA.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { isVersion, compareVersions } from './chunk-TQMI335S.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
+import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var FILE = "update-status.json";
+var TAG_SHAPE = /^[\w./-]+:[\w.+-]+$/;
+function readUpdateStatus(runnerDirPath) {
+  try {
+    const raw = JSON.parse(readFileSync(join(runnerDirPath, FILE), "utf8"));
+    if (typeof raw.own !== "string" || typeof raw.at !== "string") return void 0;
+    const named = typeof raw.named === "string" && isVersion(raw.named) ? raw.named : void 0;
+    return {
+      own: raw.own,
+      ...named === void 0 ? {} : { named },
+      ...named !== void 0 && typeof raw.tag === "string" && TAG_SHAPE.test(raw.tag) ? { tag: raw.tag } : {},
+      upgradeRequired: raw.upgradeRequired === true,
+      at: raw.at
+    };
+  } catch {
+    return void 0;
+  }
+}
+function writeUpdateStatus(runnerDirPath, record) {
+  mkdirSync(runnerDirPath, { recursive: true, mode: RUNNER_DIR_MODE });
+  const path = join(runnerDirPath, FILE);
+  const temp = `${path}.partial-${process.pid}`;
+  writeFileSync(temp, JSON.stringify(record, null, 2), { mode: RUNNER_FILE_MODE });
+  renameSync(temp, path);
+}
+
+// src/runner/image-tag.ts
+var IMAGE_REPOSITORY = "ghcr.io/outerlayerai/runner";
+var IMAGE_VERSION_VARIABLE = "OUTERLAYER_RUNNER_IMAGE";
+var UNNAMED_VERSION = "<version>";
+function imageTag(version) {
+  return `${IMAGE_REPOSITORY}:${version}`;
+}
+function tagToPull(named) {
+  return imageTag(named === void 0 ? UNNAMED_VERSION : named);
+}
+function runnerImageVersion(env = process.env) {
+  const value = env[IMAGE_VERSION_VARIABLE]?.trim();
+  return value === void 0 || value === "" ? void 0 : value;
+}
+function imageAdvice(ownVersion, record) {
+  if (record === void 0 || record.own !== ownVersion) return void 0;
+  const tag = tagToPull(record.named);
+  if (record.upgradeRequired) return { tag, reason: "refused" };
+  if (record.named !== void 0 && (compareVersions(ownVersion, record.named) ?? 0) < 0) return { tag, reason: "newer" };
+  return void 0;
+}
+function pullInstruction(tag) {
+  return `docker pull ${tag}, then recreate the container with the same volume`;
+}
+function readImageStatus(runnerDirPath, env = process.env) {
+  const version = runnerImageVersion(env);
+  if (version === void 0) return void 0;
+  const update = imageAdvice(version, readUpdateStatus(runnerDirPath));
+  return update === void 0 ? { version } : { version, update };
+}
+
+export { IMAGE_VERSION_VARIABLE, imageAdvice, imageTag, pullInstruction, readImageStatus, readUpdateStatus, runnerImageVersion, tagToPull, writeUpdateStatus };