@outerlayer/cli 0.23.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @outerlayer/cli
 
+## 0.25.0
+
+### Minor Changes
+
+- 7b6c7bf: `outerlayer runner service install` now installs a small root helper beside the runner's service on Linux hosts that run builds in a microVM. The helper starts each build's virtual machine inside a jail, so the runner service itself needs no extra privileges. `runner service uninstall` removes the helper with the service.
+
+### Patch Changes
+
+- 479fd90: The `outerlayer-build` skill no longer tells each agent to read the repository's instructions file first. The instructions are already loaded in every agent's context. In a governed repository they live outside the checkout, so agents searched the checkout and found no file, or an unrelated `AGENTS.md`. The briefs now say not to look.
+- d579555: The runner image now runs container builds on Docker Desktop. A Mac can isolate builds without the Lima VM. Use Docker Desktop with engine 26 or later. A runner installed directly on a Mac or Windows machine still refuses Docker Desktop. Its message tells you to run the runner image. `outerlayer runner doctor` now passes the build isolation check for the runner image on Docker Desktop.
+- da8d0ca: Name a runner with `runner.name` in its config file, or with `OUTERLAYER_RUNNER_NAME` in the runner container image. The earlier names, `runner.host` and `OUTERLAYER_HOST`, still work. When both names are set to different values, the runner refuses to start and names both. `outerlayer runner init` writes `runner.name`. `outerlayer doctor` warns, without failing, when a config still uses `runner.host`. `outerlayer runner check` labels the value `name`, not `host`.
+- 173ff52: A service runner whose running builds are all container builds in their command stage now updates as soon as a new version arrives, without waiting for those builds to end. The builds keep running and the new version takes them over. A runner started by hand, and a runner with any other build running, still waits. `outerlayer runner status` names each build an update waits for and why.
+- f861486: `outerlayer work build` links the item page by the item's number, such as `/work/305`, not by its long id.
+- 8c0970a: `outerlayer work status` starts with "Merged, unverified" when the item's pull request merged before its checks or review passed. The stage still reads `review`, as before. `--json` output is unchanged.
+
+## 0.24.0
+
+### Minor Changes
+
+- 910c7a6: The runner ships as a container image, `ghcr.io/outerlayerai/runner`. Start it with one `docker run`; its builds survive the container restarting. A new command, `outerlayer runner container-start`, is the image's entrypoint. A runner in the image never updates itself: `runner status` and `doctor` name the image tag to pull.
+
+### Patch Changes
+
+- 9201346: In a repository that keeps its skills in `.agents/skills/`, `outerlayer init` and `outerlayer connect` say to commit and push `AGENTS.md`, `.agents/`, `.mcp.json` and `.claude/skills` with `.outerlayer/`. They say it again while any of them is not committed. `outerlayer init --update` says the same when it updates the starter files of such a repository.
+- 37af3f6: `outerlayer init --update` no longer moves a committed skill, `AGENTS.md` or `.outerlayer/mcp.json` to a path that git ignores. The next commit would have deleted the file from the repository. The command leaves the file, names the ignored path, and does not set the layout until `.gitignore` has an exception.
+
 ## 0.23.0
 
 ### Minor Changes

package/README.md

@@ -165,6 +165,10 @@ content:
   fetches the package's dependencies, and both npm runs use this user's npm
   configuration, including any registry token in `~/.npmrc`. Set
   `runner.autoUpdate` to `false` to stop them.
+  `outerlayer runner container-start`, the runner image's entrypoint, writes
+  the config from its environment variables with no network call. It then
+  runs `outerlayer runner start`, which makes the calls above. In the image
+  the runner never calls the npm registry. It logs the image tag to pull.
   `runner check` makes a list call and a host-key lookup to confirm the key
   works and sends nothing else; `runner status` and `runner logs` make no network call at all.
   On a runner host, any command that uses the saved runner key signs each
@@ -227,6 +231,15 @@ content:
   The guest's exec agent accepts
   connections from the host only, and the runner runs every step of the build
   through it, including the build's command (`outerlayer vm-exec` on the host).
+  With the root helper installed, the runner asks it over a Unix socket that only
+  the runner's account can open to start each microVM build under Firecracker's
+  jailer. That socket is local, and nothing about the host leaves the machine
+  through it.
+- **`outerlayer runner install --service` with `builtin:vm` hooks** downloads the
+  root helper from github.com on each install, from the same public guest assets
+  repository, and checks it against a sha256 pinned in the CLI. The request
+  sends nothing about the host. The helper starts as root, and its one job is
+  to start, stop, report and list microVM builds.
 - **`outerlayer runner start` with `builtin:container` hooks** runs each
   build in its own Docker container, which has no network but loopback. A
   container build reaches the runner through `docker exec`: the runner starts

package/dist/{agent-setup-SNDCEHG2.js → agent-setup-PDIIGMKE.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-ZKWKQIJU.js';
+export { keepHandWritten, runAgentSetup } from './chunk-4S4VBDSO.js';
 import './chunk-WX2WEERU.js';
 import './chunk-VJBFQP3H.js';
-import './chunk-XGPC3IOR.js';
+import './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import './chunk-QS43O4DR.js';
+import './chunk-M4B6QKNZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-YVZJ6GKF.js';
@@ -21,10 +21,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{bridge-QFN3KJP6.js → bridge-5KZ36YDG.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-WXJXHZVB.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-UNF7MWEL.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/build-Q2OBF77R.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { buildRepositoryImage } from './chunk-AXPCGD46.js';
+import './chunk-DEBOL6ON.js';
+import './chunk-JBJTC3UU.js';
+export { RecipeError } from './chunk-RGW7ERF3.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-15T02:32:03.730Z+264fcdb","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-15T19:23:43.029Z+b0b505b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-7FBQAWQZ.js → builder-PRSCX5AH.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-OGMZJWWD.js';
-import './chunk-3W333NFO.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-QUGYGO6L.js';
+import './chunk-RGW7ERF3.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-CBCKD6DO.js';
+import './chunk-D4AMAEZ7.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{check-3CGLWMHM.js → check-EPYRTE3R.js}

@@ -1,60 +1,63 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-TFGXOHF6.js';
-import './chunk-QSEPKZXR.js';
-import './chunk-CQAEV3Z5.js';
-import './chunk-UF5L4BAI.js';
+import { probeCredentials } from './chunk-L2FZLBF7.js';
+import './chunk-3I44PQ26.js';
+import './chunk-XRYUJTAT.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-O2WYUIK7.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
-import './chunk-I2UOAV7X.js';
 import './chunk-TPKYTORP.js';
-import './chunk-WY7HFY62.js';
-import './chunk-Z42JY3LQ.js';
-import './chunk-WXJXHZVB.js';
-import './chunk-DJYOCD65.js';
-import './chunk-D64E222W.js';
+import './chunk-34ANPNVB.js';
+import './chunk-2N72GPS2.js';
+import './chunk-UNF7MWEL.js';
+import './chunk-YTTHDPWF.js';
+import './chunk-IDJIWKTY.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-G3LHWUBK.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-VPUNOGXO.js';
+import './chunk-QMQC6JCO.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-276D7BJ7.js';
 import './chunk-TBT347UY.js';
-import './chunk-2TT7DEMZ.js';
-import './chunk-C2XZBNHY.js';
-import './chunk-BOG4ENP7.js';
-import './chunk-4AVDD7VX.js';
-import './chunk-OBCFK4QD.js';
+import './chunk-JKILLWZF.js';
+import './chunk-VNGENFOG.js';
+import './chunk-XHXDCYSK.js';
+import './chunk-5222PA6S.js';
+import './chunk-TQMI335S.js';
+import './chunk-ZGMQQWCV.js';
+import './chunk-IGRRD7PX.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-QILR6TZP.js';
-import './chunk-XACXXKQ5.js';
+import './chunk-AXPCGD46.js';
+import './chunk-DEBOL6ON.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-OGMZJWWD.js';
-import './chunk-3W333NFO.js';
-import './chunk-NYTZ7HVN.js';
-import './chunk-2Q3PZ42G.js';
-import './chunk-KGKFEONR.js';
-import './chunk-C64D7HR3.js';
-import './chunk-ZLZ3XVPI.js';
-import './chunk-GXV73IIS.js';
+import './chunk-QUGYGO6L.js';
+import './chunk-RGW7ERF3.js';
+import './chunk-7OWPLRJR.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-YMKQVCKC.js';
+import './chunk-X5LNCIZT.js';
+import './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-V5CG75NX.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-JWRX5ZTT.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-XGPC3IOR.js';
+import './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import './chunk-QS43O4DR.js';
-import './chunk-XOEV4FVK.js';
+import './chunk-M4B6QKNZ.js';
+import './chunk-K5WVK7IC.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-DYEFPYME.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-CBCKD6DO.js';
+import './chunk-D4AMAEZ7.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
 import './chunk-HBISTTG3.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
@@ -66,10 +69,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 import { join, dirname } from 'path';
@@ -136,7 +139,7 @@ async function runRunnerCheck(configPath, deps = {}) {
   const formerSkill = formerSkillQueues(config);
   const lines = [
     `config              ${configPath}`,
-    `host                ${config.host}`,
+    `name                ${config.host}`,
     `queues              ${config.queues.join(", ")}`,
     `concurrency         ${config.concurrency}`,
     `poll                ${config.pollSeconds}s`,

package/dist/{chunk-URWYRAIC.js → chunk-2K3TCQHW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-GISNHSYL.js';
+import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-JGD5TWQ2.js';
 import { existsSync, unlinkSync, chmodSync } from 'fs';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
@@ -71,8 +71,6 @@ function builtInEnvironment(localFor, credential) {
     CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
   };
 }
-
-// src/runner/destinations.ts
 var MAX_RELEASED_DESTINATIONS = 20;
 var MAX_DESTINATIONS = MAX_RELEASED_DESTINATIONS - BUILT_IN_NAMES.length;
 var DESTINATION_BASE_PORT = 3129;

package/dist/{chunk-Z42JY3LQ.js → chunk-2N72GPS2.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-WXJXHZVB.js';
+import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-UNF7MWEL.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { EXEC_PORT } from './chunk-2Q3PZ42G.js';
-import { RELAY_PORT } from './chunk-URWYRAIC.js';
+import { EXEC_PORT } from './chunk-XGJUNNXL.js';
+import { RELAY_PORT } from './chunk-2K3TCQHW.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-WY7HFY62.js → chunk-34ANPNVB.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-DJYOCD65.js';
-import { spoolDir } from './chunk-XOEV4FVK.js';
-import { CaptureDaemon } from './chunk-CBCKD6DO.js';
+import { LiveUploader } from './chunk-YTTHDPWF.js';
+import { spoolDir } from './chunk-K5WVK7IC.js';
+import { CaptureDaemon } from './chunk-D4AMAEZ7.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';