@outerlayer/cli 0.23.0 → 0.25.0

package/dist/container-start-X22OXY6E.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-JKILLWZF.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-VNGENFOG.js';
+import { MIN_ENGINE_MAJOR } from './chunk-XHXDCYSK.js';
+import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-5222PA6S.js';
+import './chunk-TQMI335S.js';
+import { isAgentName, AGENT_COMMANDS } from './chunk-ZGMQQWCV.js';
+import './chunk-IGRRD7PX.js';
+import './chunk-6MZSX4M7.js';
+import './chunk-AXPCGD46.js';
+import './chunk-DEBOL6ON.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-OGFGZQA3.js';
+import './chunk-QUGYGO6L.js';
+import './chunk-RGW7ERF3.js';
+import './chunk-7OWPLRJR.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-YMKQVCKC.js';
+import './chunk-X5LNCIZT.js';
+import './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
+import './chunk-BUP5N3X6.js';
+import './chunk-XSPA5ODY.js';
+import './chunk-GOSFARMS.js';
+import './chunk-JWRX5ZTT.js';
+import './chunk-UXYLWVTQ.js';
+import './chunk-7RQ73DLO.js';
+import './chunk-FXUVXSY2.js';
+import './chunk-MQ743JX3.js';
+import './chunk-M4B6QKNZ.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-VPEGE3QZ.js';
+import './chunk-HCVLP7XA.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-D4AMAEZ7.js';
+import './chunk-ANPNT6PM.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
+import './chunk-WZBHBH3J.js';
+import './chunk-CRB3POP4.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-RKOTJQVG.js';
+import './chunk-QZBXLLTV.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-RA3O54FC.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import { CLAUDE_CREDENTIAL_VARIABLES } from './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
+import './chunk-Z5GEFMRW.js';
+import { existsSync, readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+var DOCKER_SOCKET = "/var/run/docker.sock";
+var REQUIRED = [
+  ["OUTERLAYER_URL", "the factory's gateway address"],
+  ["OUTERLAYER_APP_ID", "the factory's id"],
+  ["OUTERLAYER_API_KEY", "a runner key"]
+];
+var NAME_VARIABLE = "OUTERLAYER_RUNNER_NAME";
+var OLD_NAME_VARIABLE = "OUTERLAYER_HOST";
+function runnerName(env) {
+  const name = set(env, NAME_VARIABLE);
+  const old = set(env, OLD_NAME_VARIABLE);
+  if (name !== void 0 && old !== void 0 && name !== old) {
+    return { name: void 0, conflict: `${NAME_VARIABLE} is ${name} and ${OLD_NAME_VARIABLE} is ${old}; set ${NAME_VARIABLE} only, since ${OLD_NAME_VARIABLE} is its earlier name` };
+  }
+  return { name: name ?? old };
+}
+var KEY_MIN_SHOWN = 16;
+var refuse = (message) => ({ ok: false, message });
+var set = (env, name) => {
+  const value = env[name]?.trim();
+  return value === void 0 || value === "" ? void 0 : value;
+};
+var keyHint = (key) => {
+  if (key === "") return "none";
+  return key.length < KEY_MIN_SHOWN ? `a ${key.length}-character key` : `\u2026${key.slice(-4)}`;
+};
+var withoutSlash = (url) => url.replace(/\/+$/, "");
+function disagreements(config, env) {
+  const lines = [];
+  const url = set(env, "OUTERLAYER_URL");
+  const appId = set(env, "OUTERLAYER_APP_ID");
+  const stored = { url: String(config.url ?? ""), appId: String(config.appId ?? "") };
+  if (withoutSlash(stored.url) !== withoutSlash(url) || stored.appId !== appId) {
+    lines.push(`factory: the volume has ${stored.url} (app ${stored.appId}); the variables name ${url} (app ${appId})`);
+  }
+  const key = set(env, "OUTERLAYER_API_KEY");
+  if (String(config.apiKey ?? "") !== key) {
+    lines.push(`runner key: the volume has ${keyHint(String(config.apiKey ?? ""))}; the variables have ${keyHint(key)}`);
+  }
+  const host = runnerName(env).name;
+  const runner = config.runner;
+  const storedHost = runner?.name ?? runner?.host;
+  if (runner !== void 0 && storedHost !== host) {
+    lines.push(`runner name: the volume has ${typeof storedHost === "string" ? storedHost : "none"}; the variables name ${host}`);
+  }
+  return lines;
+}
+function readConfig(configPath) {
+  try {
+    return JSON.parse(readFileSync(configPath, "utf8"));
+  } catch (err) {
+    return new RunnerInitError(`${configPath}: not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+}
+async function containerStart(deps) {
+  const { env, configPath } = deps;
+  const version = runnerImageVersion(env);
+  if (version === void 0) {
+    return refuse(`${IMAGE_VERSION_VARIABLE} is not set. This command is the runner container image's entrypoint; to run a runner on a machine, use \`outerlayer runner start\`.`);
+  }
+  const named = runnerName(env);
+  if (named.conflict !== void 0) return refuse(named.conflict);
+  const missing = REQUIRED.filter(([name]) => set(env, name) === void 0).map(([name, what]) => `${name} (${what})`);
+  if (named.name === void 0) missing.push(`${NAME_VARIABLE} (the runner's name, which the factory shows)`);
+  const agent = set(env, "OUTERLAYER_AGENT") ?? "claude";
+  if (!isAgentName(agent)) {
+    return refuse(`OUTERLAYER_AGENT is ${agent}, and the image writes commands for ${Object.keys(AGENT_COMMANDS).join(", ")} only. Leave it unset to use claude.`);
+  }
+  if (!CLAUDE_CREDENTIAL_VARIABLES.some((name) => set(env, name) !== void 0)) {
+    missing.push(`one Claude credential: ${CLAUDE_CREDENTIAL_VARIABLES.join(", ")}`);
+  }
+  if (missing.length > 0) {
+    return refuse(`the container needs these variables, and they are not set: ${missing.join("; ")}. Put them in the file you pass to docker run with --env-file.`);
+  }
+  const socketPresent = deps.socketPresent ?? existsSync;
+  if (!socketPresent(DOCKER_SOCKET)) {
+    return refuse(
+      `${DOCKER_SOCKET} is not in the container. The runner starts each build as a container on the host's Docker, so start this container with -v ${DOCKER_SOCKET}:${DOCKER_SOCKET}.`
+    );
+  }
+  const machine = { ...(deps.machine ?? (() => detectMachine()))(), inImage: true };
+  if (!supportsContainerBuilds(machine)) {
+    return refuse(
+      `The container reaches ${describeMachineDocker(machine)} through ${DOCKER_SOCKET}, and builds need Docker Engine in a version that isolates a build (${MIN_ENGINE_MAJOR} or later), on Docker Engine or Docker Desktop. Check that the socket is the host's Docker and that it is running.`
+    );
+  }
+  const url = set(env, "OUTERLAYER_URL");
+  const appId = set(env, "OUTERLAYER_APP_ID");
+  const apiKey = set(env, "OUTERLAYER_API_KEY");
+  const host = named.name;
+  if (existsSync(configPath)) {
+    const stored = readConfig(configPath);
+    if (stored instanceof RunnerInitError) return refuse(stored.message);
+    const different = disagreements(stored, env);
+    if (different.length > 0) {
+      return refuse(
+        `the config in the volume and the container's variables disagree, so the runner does not start:
+  ${different.join("\n  ")}
+Change the variables to match the volume, or use a new volume to make a new runner.`
+      );
+    }
+    if (stored.runner === void 0) {
+      try {
+        const prepared = prepareRunnerInit(configPath, { machine, requireContainer: true, agent, credentialInEnvironment: true, host });
+        writeRunnerInit(prepared);
+      } catch (err) {
+        if (err instanceof RunnerInitError) return refuse(err.message);
+        throw err;
+      }
+    }
+  } else {
+    try {
+      const prepared = prepareRunnerInit(configPath, { machine, requireContainer: true, agent, credentialInEnvironment: true, host, keyFromLogin: true });
+      writeRunnerInit(prepared, { url, apiKey, appId });
+    } catch (err) {
+      if (err instanceof RunnerInitError) return refuse(err.message);
+      throw err;
+    }
+  }
+  await deps.start(configPath, { fetchImpl: deps.fetchImpl ?? fetch, image: { version, ...deps.exit === void 0 ? {} : { exit: deps.exit } } });
+  return { ok: true };
+}
+
+export { containerStart };

package/dist/{control-plane-launch-SEYCOZFH.js → control-plane-launch-ZFT6SI4N.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseOwnerRepo, lookupGoverningSource, defaultGitRunner, materializeContext } from './chunk-XGPC3IOR.js';
+import { parseOwnerRepo, lookupGoverningSource, defaultGitRunner, materializeContext } from './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-QS43O4DR.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-M4B6QKNZ.js';
 import './chunk-ZJSNLVCE.js';
 import { layoutRefusalMessage, unsupportedLayout, sharedSkillNames, skillConflictMessage, composeDelivery } from './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
@@ -17,10 +17,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, mkdirSync, mkdtempSync, cpSync, renameSync, writeFileSync, rmSync, readdirSync } from 'fs';

package/dist/{dist-SOH3O24Y.js → dist-2APO44JG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { CaptureDaemon, PRICE_TABLE_SOURCE, SECRET_PATTERNS, SOURCE_ADAPTERS, SUPPORTED_VERSIONS, StatuslineAggregator, WARNING_CODES, claudeCodeAdapter, codexAdapter, codexSessionIdFromPath, compareVersions, completePrefix, computeStatuslineState, costOfUsage, cursorAdapter, cursorChatIdFromPath, defaultCodexSessionsDir, defaultCursorChatsDir, defaultCursorProjectsDir, defaultProjectsDir, defaultRawDir, enrichSessionRepo, findCodexRollouts, findCursorChats, findTranscripts, isNewerThanSupported, isPriceKnown, normalizeErrorSignature, normalizeRemote, parseCodexRollout, parseCursorChat, parseTranscript, readStatuslineState, readSyncWatermarkMs, remoteLookupFailed, resolvePrice, resolveRepoIdentity, rootChildIds, scanAll, scrubDeep, scrubText, sessionIdFromPath, setCustomScrubbers, setLocalIdentity, setRepoRoot, statuslineStatePath, tailTranscript, workspacesByHash, writeStatuslineState } from './chunk-CBCKD6DO.js';
+export { CaptureDaemon, PRICE_TABLE_SOURCE, SECRET_PATTERNS, SOURCE_ADAPTERS, SUPPORTED_VERSIONS, StatuslineAggregator, WARNING_CODES, claudeCodeAdapter, codexAdapter, codexSessionIdFromPath, compareVersions, completePrefix, computeStatuslineState, costOfUsage, cursorAdapter, cursorChatIdFromPath, defaultCodexSessionsDir, defaultCursorChatsDir, defaultCursorProjectsDir, defaultProjectsDir, defaultRawDir, enrichSessionRepo, findCodexRollouts, findCursorChats, findTranscripts, isNewerThanSupported, isPriceKnown, normalizeErrorSignature, normalizeRemote, parseCodexRollout, parseCursorChat, parseTranscript, readStatuslineState, readSyncWatermarkMs, remoteLookupFailed, resolvePrice, resolveRepoIdentity, rootChildIds, scanAll, scrubDeep, scrubText, sessionIdFromPath, setCustomScrubbers, setLocalIdentity, setRepoRoot, statuslineStatePath, tailTranscript, workspacesByHash, writeStatuslineState } from './chunk-D4AMAEZ7.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{docker-KMK4LOET.js → docker-PQHWAY5J.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { childEnvironment, createDockerHost, spawnRun } from './chunk-OGMZJWWD.js';
-import './chunk-3W333NFO.js';
+export { childEnvironment, createDockerHost, spawnRun } from './chunk-QUGYGO6L.js';
+import './chunk-RGW7ERF3.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-CBCKD6DO.js';
+import './chunk-D4AMAEZ7.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{doctor-4H77CEB7.js → doctor-73GNT4VV.js}

@@ -1,44 +1,47 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-G3LHWUBK.js';
+import { launcherCheck } from './chunk-ATGHVEU4.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-VPUNOGXO.js';
+import './chunk-QMQC6JCO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { launcherCheck } from './chunk-EFB3FGLC.js';
-import './chunk-276D7BJ7.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-2TT7DEMZ.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-C2XZBNHY.js';
-import { MIN_ENGINE_MAJOR } from './chunk-BOG4ENP7.js';
-import './chunk-4AVDD7VX.js';
-import './chunk-OBCFK4QD.js';
+import './chunk-JKILLWZF.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-VNGENFOG.js';
+import { MIN_ENGINE_MAJOR, probeHelper, helperSocketPath } from './chunk-XHXDCYSK.js';
+import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-5222PA6S.js';
+import './chunk-TQMI335S.js';
+import './chunk-ZGMQQWCV.js';
+import './chunk-IGRRD7PX.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-QILR6TZP.js';
-import './chunk-XACXXKQ5.js';
+import './chunk-AXPCGD46.js';
+import './chunk-DEBOL6ON.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-OGMZJWWD.js';
-import { locateRecipe, assertBuildable, readRecipe, RecipeError, CLAUDE_CODE_VERSION } from './chunk-3W333NFO.js';
-import './chunk-NYTZ7HVN.js';
-import './chunk-2Q3PZ42G.js';
-import './chunk-KGKFEONR.js';
-import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-C64D7HR3.js';
-import './chunk-ZLZ3XVPI.js';
-import './chunk-GXV73IIS.js';
+import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-QUGYGO6L.js';
+import { locateRecipe, assertBuildable, readRecipe, RecipeError, CLAUDE_CODE_VERSION } from './chunk-RGW7ERF3.js';
+import './chunk-7OWPLRJR.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-YMKQVCKC.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-X5LNCIZT.js';
+import './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { builtinKind } from './chunk-V5CG75NX.js';
+import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { allowHostProblem, MAX_ALLOW_HOSTS } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { defaultGitRunner } from './chunk-XGPC3IOR.js';
+import { defaultGitRunner } from './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import { defaultFetch } from './chunk-QS43O4DR.js';
+import { defaultFetch } from './chunk-M4B6QKNZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import { compareVersions } from './chunk-CBCKD6DO.js';
+import { compareVersions } from './chunk-D4AMAEZ7.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
 import './chunk-HBISTTG3.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
@@ -47,10 +50,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import { loadHostKey } from './chunk-OW52QLK3.js';
-import { runnerDir, hostKeyPath, jobsDir } from './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import { loadHostKey } from './chunk-ZODVSFI4.js';
+import { runnerDir, hostKeyPath, jobsDir } from './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { spawnSync } from 'child_process';
 import { existsSync, readdirSync, statSync, readFileSync } from 'fs';
@@ -123,6 +126,27 @@ function delegationCheck(service) {
     fix: "run `outerlayer runner install --service --replace` to write the unit this CLI generates, which sets Delegate=yes"
   };
 }
+var REINSTALL = "run `outerlayer runner install --service --replace` to install the root helper that starts each microVM build under Firecracker's jailer";
+function helperCheck(facts) {
+  const name = "MicroVM jailer";
+  if (facts.present) {
+    return {
+      name,
+      status: "pass",
+      detail: `each microVM build runs under Firecracker's jailer (Firecracker ${facts.firecracker}), as a user of its own with no credentials, no shared group and no network, so a build that escaped its microVM would reach none of the runner's credentials`
+    };
+  }
+  const reaches = "a build that escaped its microVM would run as the runner's account and reach what that account holds: the Claude credential, the runner key, the host key, the host's `gh` login and its membership of the `docker` group";
+  if (facts.reason === "unpinned") {
+    return { name, status: "warn", detail: `this release of the CLI pins no root helper, so Firecracker runs as the runner's account: ${reaches}` };
+  }
+  return {
+    name,
+    status: "warn",
+    detail: `no usable root helper runs for this runner, so Firecracker runs as the runner's account: ${reaches} (${facts.detail})`,
+    fix: REINSTALL
+  };
+}
 
 // src/runner/image/doctor.ts
 var LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
@@ -202,6 +226,7 @@ async function pinCheck(fetchImpl) {
   }
   return { name, status: "pass", detail: `images pin Claude Code ${CLAUDE_CODE_VERSION}; latest is ${latest}` };
 }
+var RUNNER_IMAGE_GUIDE = "https://docs.outerlayer.ai/run-the-runner-in-a-container";
 function isolationCheck(machine, hooks) {
   const name = "Build isolation";
   const kind = builtinKind(hooks.provision);
@@ -210,7 +235,8 @@ function isolationCheck(machine, hooks) {
   if (kind === "container") {
     if (can) {
       const where = machine.platform === "wsl2" ? " inside WSL2" : "";
-      return { name, status: "pass", detail: `builtin:container: builds run in containers (isolation: container) on Docker Engine ${machine.docker.version}${where}` };
+      const docker = machine.docker.kind === "desktop" ? "Docker Desktop with engine" : "Docker Engine";
+      return { name, status: "pass", detail: `builtin:container: builds run in containers (isolation: container) on ${docker} ${machine.docker.version}${where}` };
     }
     return {
       name,
@@ -244,7 +270,7 @@ function isolationCheck(machine, hooks) {
         name,
         status: "warn",
         detail: "builtin:process: builds are not isolated: they run as processes under this user (isolation: shared-user), and macOS cannot run container builds itself",
-        fix: "run outerlayer runner init --vm to run the runner in a Linux VM, where builds run in containers (isolation: container)"
+        fix: `run the runner image on Docker Desktop (${RUNNER_IMAGE_GUIDE}), or run outerlayer runner init --vm to run the runner in a Linux VM; either way builds run in containers (isolation: container)`
       };
     }
     if (can) {
@@ -256,7 +282,7 @@ function isolationCheck(machine, hooks) {
       };
     }
     const reach = reachDockerStep(machine);
-    const fix = reach !== void 0 ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container` : machine.platform === "windows" ? `install Docker Engine inside WSL2 (version ${MIN_ENGINE_MAJOR} or later), run the runner from a WSL2 shell, and set both hooks to builtin:container; Docker Desktop cannot isolate builds` : machine.docker.kind === "desktop" ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later, not Docker Desktop: install it and set both hooks to builtin:container` : `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it and set both hooks to builtin:container`;
+    const fix = reach !== void 0 ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container` : machine.platform === "windows" ? `install Docker Engine inside WSL2 (version ${MIN_ENGINE_MAJOR} or later), run the runner from a WSL2 shell, and set both hooks to builtin:container; or run the runner image on Docker Desktop (${RUNNER_IMAGE_GUIDE})` : machine.docker.kind === "desktop" ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: install it and set both hooks to builtin:container, or run the runner image on Docker Desktop (${RUNNER_IMAGE_GUIDE})` : `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it and set both hooks to builtin:container`;
     return {
       name,
       status: "warn",
@@ -499,9 +525,36 @@ function allowHostsCheck(configPath, allowHosts) {
     fix: reached.length === 0 ? "list the public hosts your builds need in runner.build.allowHosts; once a few builds have run, doctor lists the hosts they reached" : `review the hosts past builds reached and set runner.build.allowHosts to the ones they need: ${JSON.stringify(reached)}`
   };
 }
+function runnerNameCheck(configPath) {
+  let runner;
+  try {
+    runner = JSON.parse(readFileSync(configPath, "utf8")).runner;
+  } catch {
+    return void 0;
+  }
+  if (runner?.host === void 0 || runner.name !== void 0) return void 0;
+  return {
+    name: "Runner name",
+    status: "warn",
+    detail: "the config names this runner with runner.host, the earlier name of runner.name; it still works",
+    fix: "rename runner.host to runner.name in the config file"
+  };
+}
 function launcherCheckOf(env) {
   return launcherCheck({ home: env.home ?? homeFromEnv(), PATH: env.PATH ?? process.env.PATH });
 }
+function runnerImageCheck(env) {
+  const version = runnerImageVersion(env.env ?? process.env);
+  if (version === void 0) return void 0;
+  const name = "Runner image";
+  const advice = imageAdvice(version, readUpdateStatus(runnerDir(env.configPath)));
+  if (advice === void 0) return { name, status: "pass", detail: `runs ${imageTag(version)}` };
+  return advice.reason === "refused" ? { name, status: "fail", detail: `the factory refuses this runner as too old, so it claims nothing (image ${version})`, fix: pullInstruction(advice.tag) } : { name, status: "warn", detail: `the factory names a newer version than the ${version} this image runs`, fix: pullInstruction(advice.tag) };
+}
+async function helperFactsOf(env) {
+  const probe = await (env.helper ?? (() => probeHelper(env.service === void 0 ? void 0 : helperSocketPath(env.service.unit))))();
+  return probe.ok ? { present: true, firecracker: probe.firecracker } : { present: false, reason: probe.reason, detail: probe.detail };
+}
 async function runnerHostChecks(env) {
   const dockerAvailable = env.dockerAvailable ?? (() => spawnSync("docker", ["info"], { stdio: "ignore" }).status === 0);
   const devcontainerRunnable = env.devcontainerRunnable ?? (() => devcontainerCliRunnable());
@@ -510,17 +563,23 @@ async function runnerHostChecks(env) {
   const recipes = existsSync(reposDir) ? directories(reposDir).flatMap(
     (owner) => directories(join(reposDir, owner)).filter((name) => existsSync(join(reposDir, owner, name, ".git"))).map((name) => recipeCheck(reposDir, owner, name))
   ) : [];
+  const imageCheck = runnerImageCheck(env);
+  const nameCheck = runnerNameCheck(env.configPath);
+  const machine = () => env.machine ?? detectMachine({ env: env.env });
   return [
+    ...imageCheck === void 0 ? [] : [imageCheck],
+    ...nameCheck === void 0 ? [] : [nameCheck],
     dockerAvailable() ? { name: "Docker Engine", status: "pass", detail: "reachable" } : {
       name: "Docker Engine",
       status: "warn",
       detail: "docker info failed, so `outerlayer runner image` cannot build",
       fix: "start Docker, or give this user access to its socket"
     },
-    ...env.hooks === void 0 ? [] : [isolationCheck(env.machine ?? detectMachine(), env.hooks)],
+    ...env.hooks === void 0 ? [] : [isolationCheck(machine(), env.hooks)],
     ...env.hooks !== void 0 && builtinKind(env.hooks.provision) === "vm" ? [
-      kvmCheck(env.machine ?? detectMachine(), env.service),
+      kvmCheck(machine(), env.service),
       ...env.service === void 0 ? [] : [delegationCheck(env.service)],
+      helperCheck(await helperFactsOf(env)),
       ...env.runner === void 0 ? [] : [memoryCheck({ concurrency: env.runner.concurrency, buildMemory: env.runner.buildMemory, hostMemory: env.hostMemory ?? totalmem() })]
     ] : [],
     ...env.hooks !== void 0 && ["container", "vm"].includes(builtinKind(env.hooks.provision)) ? [imageBuildLimitCheck(await (env.buildx ?? (() => buildxState(spawnRun)))(), env.runner?.buildMemory)] : [],

package/dist/{emit-artifact-cmd-XCZ3ALLV.js → emit-artifact-cmd-AIOTX6YT.js}

@@ -1,36 +1,39 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-DJYOCD65.js';
-import './chunk-D64E222W.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-YTTHDPWF.js';
+import './chunk-IDJIWKTY.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
-import { detectActiveSession, autoConnect } from './chunk-ZLZ3XVPI.js';
-import './chunk-GXV73IIS.js';
+import { detectActiveSession, autoConnect } from './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QS43O4DR.js';
-import './chunk-XOEV4FVK.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
+import './chunk-K5WVK7IC.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-DYEFPYME.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-CBCKD6DO.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
 import './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import './chunk-GNPTU4BM.js';
 import './chunk-TUSYOL2O.js';
+import './chunk-RKOTJQVG.js';
 import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { createHash, randomUUID } from 'crypto';
 import { statSync, readFileSync, mkdirSync, existsSync, writeFileSync, renameSync, unlinkSync } from 'fs';

package/dist/{emit-criteria-cmd-JE72JHKJ.js → emit-criteria-cmd-7PJINOHA.js}

@@ -1,26 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-ZLZ3XVPI.js';
-import './chunk-GXV73IIS.js';
+import { detectActiveSession, autoConnect } from './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QS43O4DR.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
 import './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-CBCKD6DO.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
+import './chunk-RKOTJQVG.js';
 import { CriteriaListSchema } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 

package/dist/{emit-finding-cmd-ILIDRMYN.js → emit-finding-cmd-JRDSZ4DR.js}

@@ -1,27 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-ZLZ3XVPI.js';
-import './chunk-GXV73IIS.js';
+import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QS43O4DR.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-CBCKD6DO.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import './chunk-RKOTJQVG.js';
 import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync, existsSync } from 'fs';
 import { join, dirname, basename } from 'path';

package/dist/{emit-result-cmd-WPKG5YAS.js → emit-result-cmd-ZGF6Q6OP.js}

@@ -1,36 +1,39 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectCi } from './chunk-DJYOCD65.js';
-import './chunk-D64E222W.js';
+import { detectCi } from './chunk-YTTHDPWF.js';
+import './chunk-IDJIWKTY.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
-import { detectActiveSession, autoConnect } from './chunk-ZLZ3XVPI.js';
-import './chunk-GXV73IIS.js';
+import { detectActiveSession, autoConnect } from './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QS43O4DR.js';
-import './chunk-XOEV4FVK.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
+import './chunk-K5WVK7IC.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-DYEFPYME.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-CBCKD6DO.js';
+import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
 import './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
 import './chunk-GNPTU4BM.js';
 import './chunk-TUSYOL2O.js';
+import './chunk-RKOTJQVG.js';
 import { EmittedNameSchema, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-OW52QLK3.js';
-import './chunk-IHNQWF6F.js';
-import './chunk-URWYRAIC.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { randomUUID } from 'crypto';
 import { readFileSync } from 'fs';