@outerlayer/cli 0.23.0 → 0.24.0

package/dist/{chunk-BOG4ENP7.js → chunk-GU4PKXN7.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-QILR6TZP.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTLVQZSH.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-OGMZJWWD.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-5XCAPBE2.js';
 import { RecipeError, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-3W333NFO.js';
-import { execCapture } from './chunk-NYTZ7HVN.js';
-import { GUEST_CID } from './chunk-2Q3PZ42G.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-KGKFEONR.js';
-import { WorkCommandError } from './chunk-C64D7HR3.js';
+import { execCapture } from './chunk-LY2L3O2O.js';
+import { GUEST_CID } from './chunk-PDIM5T65.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-TQ6Y7YV6.js';
+import { WorkCommandError } from './chunk-RVYOOYOA.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-VPEGE3QZ.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-CBCKD6DO.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-D4AMAEZ7.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
 import { downconvertSession } from './chunk-QZBXLLTV.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-IHNQWF6F.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-URWYRAIC.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-KF37SUDM.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BN3CSI7S.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-GISNHSYL.js';
 import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { join, dirname, basename } from 'path';

package/dist/{chunk-TFGXOHF6.js → chunk-H6IUKXXI.js}

@@ -1,29 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-QSEPKZXR.js';
-import { writePendingUpdate } from './chunk-CQAEV3Z5.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UF5L4BAI.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-6GSA2SKT.js';
+import { writePendingUpdate } from './chunk-NGZID7UI.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-NTQTDCYR.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
-import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-G3LHWUBK.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-5ECUMU53.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-276D7BJ7.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-VV7ZD5LR.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-BOG4ENP7.js';
-import { checkFit } from './chunk-OBCFK4QD.js';
-import { claimPidFile, readPidFile, releasePidFile } from './chunk-XACXXKQ5.js';
+import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-GU4PKXN7.js';
+import { checkFit } from './chunk-DG2ULWM6.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-IDSHLKQA.js';
+import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
+import { claimPidFile, readPidFile, releasePidFile } from './chunk-FWEWFW3F.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-OGMZJWWD.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-KGKFEONR.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-C64D7HR3.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-V5CG75NX.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-5XCAPBE2.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-TQ6Y7YV6.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-RVYOOYOA.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-D7X5ITVT.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-OW52QLK3.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-IHNQWF6F.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-URWYRAIC.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-PVRBE7S4.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-KF37SUDM.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-BN3CSI7S.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-GISNHSYL.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, rmSync, closeSync, openSync, constants, lstatSync } from 'fs';
@@ -1165,6 +1166,10 @@ function selfUpdateBlocker(configPath, entryPath, own) {
   return void 0;
 }
 function considerNamedVersion(state, named) {
+  if (state.deps.image !== void 0) {
+    considerNamedImage(state, named);
+    return;
+  }
   const update = state.deps.update;
   if (update === void 0 || named === void 0) return;
   const configPath = state.config.configPath;
@@ -1187,6 +1192,34 @@ function considerNamedVersion(state, named) {
     logOf(state).line(`this runner cannot update itself to ${named}: ${blocker}`);
   }
 }
+function considerNamedImage(state, named) {
+  if (named !== void 0 && !isVersion(named)) named = void 0;
+  if (named !== void 0) state.imageNamed = named;
+  recordImageStatus(state);
+  const own = ownVersionOf(state.deps);
+  if (named === void 0 || state.imageLogged === named || (compareVersions(own, named) ?? 0) >= 0) return;
+  state.imageLogged = named;
+  logOf(state).line(`the factory names ${named}, newer than the ${own} this image runs \xB7 ${pullInstruction(imageTag(named))}`);
+}
+function recordImageStatus(state) {
+  if (state.deps.image === void 0) return;
+  const named = state.imageNamed;
+  const record = {
+    own: ownVersionOf(state.deps),
+    ...named === void 0 ? {} : { named, tag: imageTag(named) },
+    upgradeRequired: state.upgradeRefused === true,
+    at: nowOf(state).toISOString()
+  };
+  const key = JSON.stringify({ ...record, at: void 0 });
+  if (state.imageRecord === key) return;
+  try {
+    writeUpdateStatus(runnerDir(state.config.configPath), record);
+    state.imageRecord = key;
+    reportRepeating(state, "the update-status.json record", void 0);
+  } catch (err) {
+    reportRepeating(state, "the update-status.json record", `could not write update-status.json (${describeCallFailure(err)}): \`runner status\` will not name the image to pull`);
+  }
+}
 function adoptUpdateWait(state, version, nowMs) {
   const previous = state.updateWait;
   const wait = { version, sinceMs: previous?.sinceMs ?? nowMs, holdSinceMs: previous?.holdSinceMs };
@@ -1488,6 +1521,7 @@ async function housekeepingPass(state) {
 async function runTick(state) {
   state.restarting = false;
   state.holdingForUpdate = false;
+  if (state.draining === true) return;
   reloadConfig(state);
   if (restartOntoInstalled(state)) {
     state.restarting = true;
@@ -1552,7 +1586,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-FMPDXPU6.js');
+  const { postJson: postJson2 } = await import('./work-cmd-APXSER2D.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1589,14 +1623,21 @@ async function tryClaimAndStart(state, item, queue) {
       return { kind: "signature" };
     }
     if (claim.code === "runner_upgrade_required") {
-      reportRepeating(state, "the runner protocol", claim.message ?? claim.reason);
+      const tag = tagToPull(state.imageNamed);
+      reportRepeating(
+        state,
+        "the runner protocol",
+        state.deps.image === void 0 ? claim.message ?? claim.reason : `${claim.message ?? claim.reason} \xB7 ${pullInstruction(tag)}`
+      );
       state.upgradeRefused = true;
+      recordImageStatus(state);
       return { kind: "outdated" };
     }
     return { kind: "error", reason: `${claim.reason} (${claim.attempts} attempt(s))` };
   }
   reportRepeating(state, "the runner protocol", void 0);
   state.upgradeRefused = false;
+  recordImageStatus(state);
   reportRepeating(state, "the request signature", void 0);
   const { data } = claim.value;
   const claimId = data.id === void 0 || data.id === null ? "" : String(data.id);
@@ -2521,7 +2562,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-3CGLWMHM.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-YYKNYFNI.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2625,8 +2666,9 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const probeTimer = setInterval(() => {
     for (const active of state.jobs.values()) void probeBuild(state, active);
   }, deps.probeIntervalMs ?? PROBE_INTERVAL_MS);
-  const onSigterm = () => void drain();
+  const onSigterm = () => deps.image === void 0 ? void drain() : leave();
   const onSigusr1 = () => void stopNow();
+  const onSigusr2 = () => drainKeepingUp();
   const onSigint = () => {
     interrupts++;
     if (interrupts === 1) {
@@ -2639,6 +2681,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const detachSignals = () => {
     process.off("SIGTERM", onSigterm);
     process.off("SIGUSR1", onSigusr1);
+    process.off("SIGUSR2", onSigusr2);
     process.off("SIGINT", onSigint);
   };
   const stopIntake = () => {
@@ -2685,6 +2728,19 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     }
     finish2();
   };
+  const drainKeepingUp = () => {
+    if (state.draining === true) return;
+    state.draining = true;
+    stopIntake();
+    log.line(`stopping: taking no more work, ${state.jobs.size} build(s) still managed \xB7 docker stop ends this container`);
+  };
+  const leave = () => {
+    if (exited) return;
+    log.line(`stopping: leaving ${state.jobs.size} running build(s) for the next runner to adopt`);
+    state.draining = true;
+    finish2();
+    deps.image?.exit?.(0);
+  };
   const stopNow = async () => {
     if (stopping) return;
     stopping = true;
@@ -2705,6 +2761,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const handle = { state, drain, stopNow, close };
   process.on("SIGTERM", onSigterm);
   process.on("SIGUSR1", onSigusr1);
+  if (deps.image !== void 0) process.on("SIGUSR2", onSigusr2);
   process.on("SIGINT", onSigint);
   deps.onReady?.();
   await tick(state);
@@ -2717,7 +2774,8 @@ function describeWaiting(active, nowMs) {
 }
 var RunnerStartError = class extends Error {
 };
-async function requestStop(configPath, stopNow = false, pollMs = 5e3) {
+async function requestStop(configPath, stopNow = false, pollMs = 5e3, options = {}) {
+  const kill = options.kill ?? ((pid, signal2) => process.kill(pid, signal2));
   const entry = readPidFile(pidFilePath(configPath));
   if (!entry) {
     process.stdout.write("no runner is running on this config\n");
@@ -2729,9 +2787,9 @@ async function requestStop(configPath, stopNow = false, pollMs = 5e3) {
 `);
     return;
   }
-  const signal = stopNow ? "SIGUSR1" : "SIGTERM";
+  const signal = stopNow ? "SIGUSR1" : options.image === true ? "SIGUSR2" : "SIGTERM";
   try {
-    process.kill(entry.pid, signal);
+    kill(entry.pid, signal);
   } catch (err) {
     const code = err?.code;
     if (code === "EPERM") {
@@ -2744,6 +2802,14 @@ async function requestStop(configPath, stopNow = false, pollMs = 5e3) {
 `);
     return;
   }
+  if (signal === "SIGUSR2") {
+    process.stdout.write(
+      `sent SIGUSR2 to runner pid ${entry.pid}: it takes no more work and keeps managing its builds.
+The container stays up. Run \`outerlayer runner status\` to see what is left, then \`docker stop\` the container once nothing is.
+`
+    );
+    return;
+  }
   process.stdout.write(
     stopNow ? `sent SIGUSR1 to runner pid ${entry.pid}, stopping now
 ` : `sent SIGTERM to runner pid ${entry.pid}, draining

package/dist/{chunk-EFB3FGLC.js → chunk-HHXBOTRO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-276D7BJ7.js';
+import { currentLink } from './chunk-VV7ZD5LR.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/chunk-IDSHLKQA.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { isVersion, compareVersions } from './chunk-TQMI335S.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
+import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var FILE = "update-status.json";
+var TAG_SHAPE = /^[\w./-]+:[\w.+-]+$/;
+function readUpdateStatus(runnerDirPath) {
+  try {
+    const raw = JSON.parse(readFileSync(join(runnerDirPath, FILE), "utf8"));
+    if (typeof raw.own !== "string" || typeof raw.at !== "string") return void 0;
+    const named = typeof raw.named === "string" && isVersion(raw.named) ? raw.named : void 0;
+    return {
+      own: raw.own,
+      ...named === void 0 ? {} : { named },
+      ...named !== void 0 && typeof raw.tag === "string" && TAG_SHAPE.test(raw.tag) ? { tag: raw.tag } : {},
+      upgradeRequired: raw.upgradeRequired === true,
+      at: raw.at
+    };
+  } catch {
+    return void 0;
+  }
+}
+function writeUpdateStatus(runnerDirPath, record) {
+  mkdirSync(runnerDirPath, { recursive: true, mode: RUNNER_DIR_MODE });
+  const path = join(runnerDirPath, FILE);
+  const temp = `${path}.partial-${process.pid}`;
+  writeFileSync(temp, JSON.stringify(record, null, 2), { mode: RUNNER_FILE_MODE });
+  renameSync(temp, path);
+}
+
+// src/runner/image-tag.ts
+var IMAGE_REPOSITORY = "ghcr.io/outerlayerai/runner";
+var IMAGE_VERSION_VARIABLE = "OUTERLAYER_RUNNER_IMAGE";
+var UNNAMED_VERSION = "<version>";
+function imageTag(version) {
+  return `${IMAGE_REPOSITORY}:${version}`;
+}
+function tagToPull(named) {
+  return imageTag(named === void 0 ? UNNAMED_VERSION : named);
+}
+function runnerImageVersion(env = process.env) {
+  const value = env[IMAGE_VERSION_VARIABLE]?.trim();
+  return value === void 0 || value === "" ? void 0 : value;
+}
+function imageAdvice(ownVersion, record) {
+  if (record === void 0 || record.own !== ownVersion) return void 0;
+  const tag = tagToPull(record.named);
+  if (record.upgradeRequired) return { tag, reason: "refused" };
+  if (record.named !== void 0 && (compareVersions(ownVersion, record.named) ?? 0) < 0) return { tag, reason: "newer" };
+  return void 0;
+}
+function pullInstruction(tag) {
+  return `docker pull ${tag}, then recreate the container with the same volume`;
+}
+function readImageStatus(runnerDirPath, env = process.env) {
+  const version = runnerImageVersion(env);
+  if (version === void 0) return void 0;
+  const update = imageAdvice(version, readUpdateStatus(runnerDirPath));
+  return update === void 0 ? { version } : { version, update };
+}
+
+export { IMAGE_VERSION_VARIABLE, imageAdvice, imageTag, pullInstruction, readImageStatus, readUpdateStatus, runnerImageVersion, tagToPull, writeUpdateStatus };

package/dist/{chunk-IHNQWF6F.js → chunk-KF37SUDM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-URWYRAIC.js';
+import { BUILD_HOME } from './chunk-BN3CSI7S.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-4AVDD7VX.js → chunk-LBCZXXOX.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-OBCFK4QD.js';
+import { DEFAULT_UNIT_NAME } from './chunk-DG2ULWM6.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import { RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-NYTZ7HVN.js → chunk-LY2L3O2O.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-2Q3PZ42G.js';
+import { EXEC_PORT } from './chunk-PDIM5T65.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-CQAEV3Z5.js → chunk-NGZID7UI.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-UF5L4BAI.js → chunk-NTQTDCYR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-2Q3PZ42G.js → chunk-PDIM5T65.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-URWYRAIC.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-BN3CSI7S.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-OW52QLK3.js → chunk-PVRBE7S4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-C64D7HR3.js → chunk-RVYOOYOA.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-ZLZ3XVPI.js';
-import { workPageUrl } from './chunk-GXV73IIS.js';
+import { detectActiveSession, autoConnect } from './chunk-F2W2IYNP.js';
+import { workPageUrl } from './chunk-V5Q3S4NM.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-QS43O4DR.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-FKXGQOF5.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-CBCKD6DO.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signRunnerRequest } from './chunk-OW52QLK3.js';
+import { signRunnerRequest } from './chunk-PVRBE7S4.js';
 
 createRequire(import.meta.url);
 
@@ -427,7 +427,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-27SHD72I.js');
+      const { logHookError } = await import('./hook-fast-3JL4PXLG.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-KGKFEONR.js → chunk-TQ6Y7YV6.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-C64D7HR3.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-XGPC3IOR.js';
-import { signingFetchFor } from './chunk-QS43O4DR.js';
+import { WorkCommandError, postJson } from './chunk-RVYOOYOA.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-E4OUL7ZP.js';
+import { signingFetchFor } from './chunk-FKXGQOF5.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-VPEGE3QZ.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
-import { signerFor } from './chunk-OW52QLK3.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir } from './chunk-IHNQWF6F.js';
+import { signerFor } from './chunk-PVRBE7S4.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir } from './chunk-KF37SUDM.js';
 import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, lstatSync } from 'fs';
 import { relative, join, dirname } from 'path';
 

package/dist/{chunk-I2UOAV7X.js → chunk-TQMI335S.js}

@@ -9,6 +9,9 @@ function parse(version) {
   if (match === null) return void 0;
   return { core: [Number(match[1]), Number(match[2]), Number(match[3])], pre: match[4] };
 }
+function isVersion(text) {
+  return parse(text) !== void 0;
+}
 function comparePre(a, b) {
   const left = a.split(".");
   const right = b.split(".");
@@ -130,4 +133,4 @@ function satisfiesRange(version, range) {
   return anyUnreadable ? void 0 : false;
 }
 
-export { compareVersions, satisfiesRange };
+export { compareVersions, isVersion, satisfiesRange };

package/dist/{chunk-QILR6TZP.js → chunk-TTLVQZSH.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-XACXXKQ5.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-FWEWFW3F.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-3W333NFO.js';
-import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
-import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-URWYRAIC.js';
+import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
+import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-BN3CSI7S.js';
 import { RELAY_ID, RELAY_USER } from './chunk-GISNHSYL.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';

package/dist/{chunk-GXV73IIS.js → chunk-V5Q3S4NM.js}

@@ -2,10 +2,11 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { DEFAULT_DASHBOARD } from './chunk-XSPA5ODY.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-QS43O4DR.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-FKXGQOF5.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { remoteLookupFailed } from './chunk-CBCKD6DO.js';
+import { remoteLookupFailed } from './chunk-D4AMAEZ7.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { isAgentsMdLayout } from './chunk-JKNYTNYD.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { createInterface } from 'readline/promises';
@@ -61,9 +62,20 @@ Then run \`${cliInvocation()} connect\` again.
 // src/connect-cmd.ts
 var REQUEST_TIMEOUT_MS = 15e3;
 var COMMIT_LINE = "Commit and push .outerlayer/ so the factory reads your policy and skills. No checks run on your pull requests until the policy is on your default branch.";
+var AGENTS_LAYOUT_COMMIT_LINE = "Commit and push .outerlayer/, AGENTS.md, .agents/, .mcp.json and .claude/skills so the factory reads your policy and skills. No checks run on your pull requests until the policy is on your default branch.";
+var COMMIT_PATHS = [":/.outerlayer"];
+var AGENTS_LAYOUT_COMMIT_PATHS = [":/.outerlayer", ":/AGENTS.md", ":/.agents", ":/.mcp.json", ":/.claude/skills"];
+function inAgentsMdLayout(cwd) {
+  const dirs = findGitDirs(cwd);
+  return dirs !== void 0 && isAgentsMdLayout(dirs.repoRoot);
+}
+function commitLineFor(cwd) {
+  return inAgentsMdLayout(cwd) ? AGENTS_LAYOUT_COMMIT_LINE : COMMIT_LINE;
+}
 function hasUncommittedPolicy(cwd) {
+  const paths = inAgentsMdLayout(cwd) ? AGENTS_LAYOUT_COMMIT_PATHS : COMMIT_PATHS;
   try {
-    const status = execFileSync("git", ["status", "--porcelain", "--untracked-files=all", "--", ":/.outerlayer"], {
+    const status = execFileSync("git", ["status", "--porcelain", "--untracked-files=all", "--", ...paths], {
       cwd,
       encoding: "utf8",
       stdio: "pipe",
@@ -303,7 +315,7 @@ function connectDocument(r) {
 async function runConnectCommand(flags, deps, out) {
   const base = await runConnect(flags, deps);
   const r = base.outcome === "done" && hasUncommittedPolicy(deps.cwd) ? { ...base, text: `${base.text}
-${COMMIT_LINE}
+${commitLineFor(deps.cwd)}
 ` } : base;
   if (flags.json) {
     out.stdout.write(`${JSON.stringify(connectDocument(r), null, 2)}
@@ -315,4 +327,4 @@ ${COMMIT_LINE}
   return r.code;
 }
 
-export { COMMIT_LINE, autoConnectedLine, dashboardBase, fetchFactories, hasUncommittedPolicy, isLinkedRepository, listText, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, slug, workPageUrl };
+export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitLineFor, dashboardBase, fetchFactories, hasUncommittedPolicy, isLinkedRepository, listText, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, slug, workPageUrl };

package/dist/{chunk-C2XZBNHY.js → chunk-VBEXKEBV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-BOG4ENP7.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GU4PKXN7.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-3W333NFO.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-276D7BJ7.js → chunk-VV7ZD5LR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KF37SUDM.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-WY7HFY62.js → chunk-W7O4LA4E.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-DJYOCD65.js';
-import { spoolDir } from './chunk-XOEV4FVK.js';
-import { CaptureDaemon } from './chunk-CBCKD6DO.js';
+import { LiveUploader } from './chunk-D7K446H6.js';
+import { spoolDir } from './chunk-755WXDBI.js';
+import { CaptureDaemon } from './chunk-D4AMAEZ7.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-ZKWKQIJU.js → chunk-WH2QV3UL.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { runEmit } from './chunk-WX2WEERU.js';
 import { installStarterPack } from './chunk-VJBFQP3H.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-XGPC3IOR.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-E4OUL7ZP.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-JKNYTNYD.js';