@outerlayer/cli 0.23.0 → 0.25.0

package/dist/{chunk-CBCKD6DO.js → chunk-D4AMAEZ7.js}

@@ -21971,14 +21971,14 @@ var ModelRegistryImpl = class {
 };
 var models_default = {
   version: "1.0.0",
-  generatedAt: "2026-10-14T04:11:40.017Z",
+  generatedAt: "2026-10-15T03:53:58.240Z",
   sources: {
     litellm: {
-      fetchedAt: "2026-10-14T04:11:40.017Z",
-      modelCount: 1938
+      fetchedAt: "2026-10-15T03:53:58.240Z",
+      modelCount: 1937
     },
     openrouter: {
-      fetchedAt: "2026-10-14T04:11:40.017Z",
+      fetchedAt: "2026-10-15T03:53:58.240Z",
       modelCount: 205
     }
   },
@@ -50707,7 +50707,8 @@ var models_default = {
       },
       capabilities: {
         vision: true
-      }
+      },
+      deprecationDate: "2025-11-14"
     },
     "gemini-2.5-flash-native-audio-latest": {
       provider: "google",
@@ -52816,8 +52817,8 @@ var models_default = {
         "max_tokens"
       ],
       pricing: {
-        inputCostPerToken: 2e-6,
-        outputCostPerToken: 1e-5
+        inputCostPerToken: 4e-6,
+        outputCostPerToken: 2e-5
       },
       context: {
         maxInputTokens: 105e4,
@@ -54011,8 +54012,8 @@ var models_default = {
         "max_tokens"
       ],
       pricing: {
-        inputCostPerToken: 1e-6,
-        outputCostPerToken: 5e-6
+        inputCostPerToken: 2e-6,
+        outputCostPerToken: 1e-5
       },
       context: {
         maxInputTokens: 105e4,
@@ -54033,8 +54034,8 @@ var models_default = {
         "max_tokens"
       ],
       pricing: {
-        inputCostPerToken: 1e-6,
-        outputCostPerToken: 5e-6
+        inputCostPerToken: 2e-6,
+        outputCostPerToken: 1e-5
       },
       context: {
         maxInputTokens: 105e4,

package/dist/{chunk-XACXXKQ5.js → chunk-DEBOL6ON.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZI2ZVWKT.js';
 import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-XGPC3IOR.js → chunk-FXUVXSY2.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-MQ743JX3.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-QS43O4DR.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-M4B6QKNZ.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-URWYRAIC.js';
+import { withTokenHeader } from './chunk-2K3TCQHW.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-6AOZD3LY.js → chunk-HBLLZLOH.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-ZLZ3XVPI.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-QS43O4DR.js';
-import { resolveRepoIdentity } from './chunk-CBCKD6DO.js';
+import { autoConnect, detectActiveSession } from './chunk-HWEIFHSW.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-M4B6QKNZ.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-ZLZ3XVPI.js → chunk-HWEIFHSW.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-GXV73IIS.js';
-import { resolveGatewayCredentials } from './chunk-QS43O4DR.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-6CNHXHI2.js';
+import { resolveGatewayCredentials } from './chunk-M4B6QKNZ.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-CBCKD6DO.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';

package/dist/{chunk-D64E222W.js → chunk-IDJIWKTY.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-ZLZ3XVPI.js';
+import { autoConnect, detectActiveSession } from './chunk-HWEIFHSW.js';
 import { acquireSpoolLockAt } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QS43O4DR.js';
-import { resolveRepoIdentity } from './chunk-CBCKD6DO.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-OBCFK4QD.js → chunk-IGRRD7PX.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-V5CG75NX.js';
+import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { runnerDir } from './chunk-IHNQWF6F.js';
+import { runnerDir } from './chunk-ZI2ZVWKT.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 
@@ -16,16 +16,19 @@ function escapeUnitPath(path) {
   return path.replace(/%/g, "%%").replace(/ /g, "\\x20");
 }
 function runnerUnit(unit) {
+  const helperService = unit.helper === void 0 ? void 0 : `${unit.helper.unit}.service`;
   return `${UNIT_MARKER}
 [Unit]
 Description=OuterLayer runner
-After=network-online.target${unit.docker ? " docker.service" : ""}
+After=network-online.target${unit.docker ? " docker.service" : ""}${helperService === void 0 ? "" : ` ${helperService}`}
 Wants=network-online.target
-${unit.docker ? "Requires=docker.service\n" : ""}
+${helperService === void 0 ? "" : `Wants=${helperService}
+`}${unit.docker ? "Requires=docker.service\n" : ""}
 [Service]
 User=${unit.user}
 ExecStart=${unit.execStart}
-EnvironmentFile=-${escapeUnitPath(`${unit.configDir}/runner.env`)}
+${unit.helper === void 0 ? "" : `Environment=OUTERLAYER_HELPER_SOCKET=${unit.helper.socket}
+`}EnvironmentFile=-${escapeUnitPath(`${unit.configDir}/runner.env`)}
 Restart=on-failure
 RestartForceExitStatus=75
 RestartSec=30
@@ -143,7 +146,8 @@ function installService(request, deps) {
     configDir: dirname(request.configPath),
     execStart: request.execStart,
     timeLimitMinutes: request.timeLimitMinutes,
-    docker: kind === "container" || kind === "vm" || builtinKind(request.hooks.cleanup) === "container" || builtinKind(request.hooks.cleanup) === "vm"
+    docker: kind === "container" || kind === "vm" || builtinKind(request.hooks.cleanup) === "container" || builtinKind(request.hooks.cleanup) === "vm",
+    ...request.helperSocket !== void 0 && request.helperUnit !== void 0 ? { helper: { unit: request.helperUnit, socket: request.helperSocket } } : {}
   });
   if (request.print === true) return outcome(true, "printed", [], unit);
   if (own) return outcome(false, "refused", [OWN_HOOKS]);
@@ -274,4 +278,4 @@ function uninstallService(request, deps) {
   return outcome(true, "removed", lines);
 }
 
-export { DEFAULT_UNIT_NAME, RUNNER_RESERVE_BYTES, VM_SERVICE_NAME, checkFit, installService, realTaskScheduler, uninstallService, unitPathFor };
+export { DEFAULT_UNIT_NAME, RUNNER_RESERVE_BYTES, UNIT_MARKER, VM_SERVICE_NAME, checkFit, installService, realTaskScheduler, uninstallService, unitPathFor };

package/dist/{chunk-GISNHSYL.js → chunk-JGD5TWQ2.js}

@@ -30,12 +30,14 @@ var UNKNOWN_TRANSPORT_REASON = "the runner cannot tell how this build reaches it
 var COMMAND_LOST_REASON = "the build's command ended without recording an exit code";
 var CONTAINER_STOPPED_REASON = "the build's container stopped while no runner was managing it";
 var UNKNOWN_TRACKING_REASON = "the runner cannot tell how this build is tracked";
+var DOCKER_DESKTOP_REASON = "Docker Desktop is accepted only for a runner in the runner image, so container builds here need Docker Engine: install it (on Windows, inside WSL2), run the runner image, or use builtin:process";
 var RUNNER_WORDED_REASONS = /* @__PURE__ */ new Set([
   MALFORMED_REASON,
   UNKNOWN_TRANSPORT_REASON,
   COMMAND_LOST_REASON,
   CONTAINER_STOPPED_REASON,
-  UNKNOWN_TRACKING_REASON
+  UNKNOWN_TRACKING_REASON,
+  DOCKER_DESKTOP_REASON
 ]);
 
-export { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON, JOIN_DIR, JOIN_SOCKET, JOIN_WAIT_MS, MALFORMED_REASON, MAX_MALFORMED_SESSIONS, MAX_OPEN_STREAMS, RELAY_ID, RELAY_USER, RUNNER_WORDED_REASONS, SESSION_WINDOW, STREAM_WINDOW, TARGET_CLAUDE, TARGET_GATEWAY, TARGET_LEASE, TARGET_TUNNEL, UNKNOWN_TRACKING_REASON, UNKNOWN_TRANSPORT_REASON, destinationTarget, targetOfPath };
+export { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON, DOCKER_DESKTOP_REASON, JOIN_DIR, JOIN_SOCKET, JOIN_WAIT_MS, MALFORMED_REASON, MAX_MALFORMED_SESSIONS, MAX_OPEN_STREAMS, RELAY_ID, RELAY_USER, RUNNER_WORDED_REASONS, SESSION_WINDOW, STREAM_WINDOW, TARGET_CLAUDE, TARGET_GATEWAY, TARGET_LEASE, TARGET_TUNNEL, UNKNOWN_TRACKING_REASON, UNKNOWN_TRANSPORT_REASON, destinationTarget, targetOfPath };

package/dist/{chunk-2TT7DEMZ.js → chunk-JKILLWZF.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-C2XZBNHY.js';
-import { MIN_ENGINE_MAJOR } from './chunk-BOG4ENP7.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-4AVDD7VX.js';
-import { runnerCredentialProblem } from './chunk-V5CG75NX.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-IHNQWF6F.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-VNGENFOG.js';
+import { MIN_ENGINE_MAJOR } from './chunk-XHXDCYSK.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-ZGMQQWCV.js';
+import { runnerCredentialProblem } from './chunk-JWRX5ZTT.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZI2ZVWKT.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 
@@ -22,7 +22,7 @@ function isolationNote(machine) {
 }
 function processRefusal(machine) {
   const reach = reachDockerStep(machine);
-  const needs = machine.platform === "darwin" ? "Isolated builds on a Mac run in a Linux VM: run this again with --vm." : reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then run this again.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, then run this again from a WSL2 shell.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it, then run this again.`;
+  const needs = machine.platform === "darwin" ? "Isolated builds on a Mac run in the runner image on Docker Desktop (https://docs.outerlayer.ai/run-the-runner-in-a-container) or in a Linux VM: run this again with --vm." : reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then run this again.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, then run this again from a WSL2 shell.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it, then run this again.`;
   return `This machine has ${describeMachineDocker(machine)}, so it cannot isolate a build. ${needs} To run builds as processes under this user instead, where a build can read this user's files and the runner's Claude credential, run this again with --allow-process-builds.`;
 }
 function isPlaceholderCommand(command) {
@@ -102,15 +102,15 @@ function prepareRunnerInit(configPath, opts = {}) {
   }
   const hooks = opts.requireContainer !== true && supportsMicroVmBuilds(machine) ? "builtin:vm" : supportsContainerBuilds(machine) ? "builtin:container" : "builtin:process";
   if (hooks === "builtin:process" && opts.allowProcess !== true) throw new RunnerInitError(processRefusal(machine));
-  if (agent === "claude" && credential === void 0 && !hasStoredCredential(configPath)) {
+  if (agent === "claude" && credential === void 0 && opts.credentialInEnvironment !== true && !hasStoredCredential(configPath)) {
     throw new RunnerInitError(
       "--agent claude needs Claude's credential, and none was piped on stdin or is in the runner.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
     );
   }
-  return { configPath, config, carried, credential, agent, machine, hooks, needsKey };
+  return { configPath, config, carried, credential, agent, machine, hooks, needsKey, host: opts.host };
 }
 function writeRunnerInit(prepared, runnerKey) {
-  const { configPath, config, carried, credential, agent, machine, hooks } = prepared;
+  const { configPath, config, carried, credential, agent, machine, hooks, host } = prepared;
   if (prepared.needsKey && runnerKey === void 0) {
     throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was pasted.`);
   }
@@ -130,10 +130,12 @@ function writeRunnerInit(prepared, runnerKey) {
       amend: PLACEHOLDER_COMMAND
     },
     ...carried,
+    ...host === void 0 ? {} : { name: host },
     // The agent was named on this command line, so its commands win over any the hand-off carried.
     ...agent === void 0 ? {} : { commands: { ...AGENT_COMMANDS[agent] } },
     hooks: { provision: hooks, cleanup: hooks }
   };
+  if (host !== void 0) delete config.runner.host;
   mkdirSync(dirname(configPath), { recursive: true });
   const stored = credential === void 0 ? void 0 : { variable: credential.variable, path: storeClaudeCredential(configPath, credential) };
   writeFileSync(configPath, `${JSON.stringify(config, null, 2)}

package/dist/{chunk-V5CG75NX.js → chunk-JWRX5ZTT.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-URWYRAIC.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-2K3TCQHW.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';
@@ -92,6 +92,7 @@ function runnerVmOf(configPath) {
   }
 }
 var RUNNER_KEYS = [
+  "name",
   "host",
   "queues",
   "concurrency",
@@ -212,6 +213,9 @@ function loadRunnerConfig(configPath) {
   if (runner.autoUpdate !== void 0 && typeof runner.autoUpdate !== "boolean") {
     fail(configPath, "runner.autoUpdate", "must be true or false");
   }
+  if (runner.name !== void 0 && runner.host !== void 0 && runner.name !== runner.host) {
+    fail(configPath, "runner.name", `is "${runner.name}" and runner.host is "${runner.host}"; set runner.name only, since runner.host is its earlier name`);
+  }
   const queues = runner.queues && runner.queues.length > 0 ? runner.queues : [...RUNNER_QUEUES];
   for (const queue of queues) {
     if (!RUNNER_QUEUES.includes(queue)) {
@@ -241,7 +245,7 @@ function loadRunnerConfig(configPath) {
     appId: config.appId,
     repos: config.repos,
     scrub: config.scrub,
-    host: runner.host ?? hostname(),
+    host: runner.name ?? runner.host ?? hostname(),
     queues,
     concurrency: runner.concurrency ?? DEFAULT_CONCURRENCY,
     pollSeconds: runner.pollSeconds ?? DEFAULT_POLL_SECONDS,

package/dist/{chunk-XOEV4FVK.js → chunk-K5WVK7IC.js}

@@ -628,7 +628,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-SEYCOZFH.js');
+  const { governanceOf } = await import('./control-plane-launch-ZFT6SI4N.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;