@outerlayer/cli 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @outerlayer/cli
 
+## 0.25.0
+
+### Minor Changes
+
+- 7b6c7bf: `outerlayer runner service install` now installs a small root helper beside the runner's service on Linux hosts that run builds in a microVM. The helper starts each build's virtual machine inside a jail, so the runner service itself needs no extra privileges. `runner service uninstall` removes the helper with the service.
+
+### Patch Changes
+
+- 479fd90: The `outerlayer-build` skill no longer tells each agent to read the repository's instructions file first. The instructions are already loaded in every agent's context. In a governed repository they live outside the checkout, so agents searched the checkout and found no file, or an unrelated `AGENTS.md`. The briefs now say not to look.
+- d579555: The runner image now runs container builds on Docker Desktop. A Mac can isolate builds without the Lima VM. Use Docker Desktop with engine 26 or later. A runner installed directly on a Mac or Windows machine still refuses Docker Desktop. Its message tells you to run the runner image. `outerlayer runner doctor` now passes the build isolation check for the runner image on Docker Desktop.
+- da8d0ca: Name a runner with `runner.name` in its config file, or with `OUTERLAYER_RUNNER_NAME` in the runner container image. The earlier names, `runner.host` and `OUTERLAYER_HOST`, still work. When both names are set to different values, the runner refuses to start and names both. `outerlayer runner init` writes `runner.name`. `outerlayer doctor` warns, without failing, when a config still uses `runner.host`. `outerlayer runner check` labels the value `name`, not `host`.
+- 173ff52: A service runner whose running builds are all container builds in their command stage now updates as soon as a new version arrives, without waiting for those builds to end. The builds keep running and the new version takes them over. A runner started by hand, and a runner with any other build running, still waits. `outerlayer runner status` names each build an update waits for and why.
+- f861486: `outerlayer work build` links the item page by the item's number, such as `/work/305`, not by its long id.
+- 8c0970a: `outerlayer work status` starts with "Merged, unverified" when the item's pull request merged before its checks or review passed. The stage still reads `review`, as before. `--json` output is unchanged.
+
 ## 0.24.0
 
 ### Minor Changes

package/README.md

@@ -231,6 +231,15 @@ content:
   The guest's exec agent accepts
   connections from the host only, and the runner runs every step of the build
   through it, including the build's command (`outerlayer vm-exec` on the host).
+  With the root helper installed, the runner asks it over a Unix socket that only
+  the runner's account can open to start each microVM build under Firecracker's
+  jailer. That socket is local, and nothing about the host leaves the machine
+  through it.
+- **`outerlayer runner install --service` with `builtin:vm` hooks** downloads the
+  root helper from github.com on each install, from the same public guest assets
+  repository, and checks it against a sha256 pinned in the CLI. The request
+  sends nothing about the host. The helper starts as root, and its one job is
+  to start, stop, report and list microVM builds.
 - **`outerlayer runner start` with `builtin:container` hooks** runs each
   build in its own Docker container, which has no network but loopback. A
   container build reaches the runner through `docker exec`: the runner starts

package/dist/{agent-setup-QQYRBPK2.js → agent-setup-PDIIGMKE.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-WH2QV3UL.js';
+export { keepHandWritten, runAgentSetup } from './chunk-4S4VBDSO.js';
 import './chunk-WX2WEERU.js';
 import './chunk-VJBFQP3H.js';
-import './chunk-E4OUL7ZP.js';
+import './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import './chunk-FKXGQOF5.js';
+import './chunk-M4B6QKNZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-YVZJ6GKF.js';
@@ -21,10 +21,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{bridge-4ZARDVGS.js → bridge-5KZ36YDG.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-CZUH2SLQ.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-UNF7MWEL.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/build-Q2OBF77R.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { buildRepositoryImage } from './chunk-AXPCGD46.js';
+import './chunk-DEBOL6ON.js';
+import './chunk-JBJTC3UU.js';
+export { RecipeError } from './chunk-RGW7ERF3.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-15T12:32:52.123Z+e9e62b5","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-15T19:23:43.029Z+b0b505b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-MECDEKXX.js → builder-PRSCX5AH.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-5XCAPBE2.js';
-import './chunk-3W333NFO.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-QUGYGO6L.js';
+import './chunk-RGW7ERF3.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-D4AMAEZ7.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{check-YYKNYFNI.js → check-EPYRTE3R.js}

@@ -1,52 +1,53 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-H6IUKXXI.js';
-import './chunk-6GSA2SKT.js';
-import './chunk-NGZID7UI.js';
-import './chunk-NTQTDCYR.js';
+import { probeCredentials } from './chunk-L2FZLBF7.js';
+import './chunk-3I44PQ26.js';
+import './chunk-XRYUJTAT.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-O2WYUIK7.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
 import './chunk-TPKYTORP.js';
-import './chunk-W7O4LA4E.js';
-import './chunk-A62QFN2M.js';
-import './chunk-CZUH2SLQ.js';
-import './chunk-D7K446H6.js';
-import './chunk-F7Y2USIM.js';
+import './chunk-34ANPNVB.js';
+import './chunk-2N72GPS2.js';
+import './chunk-UNF7MWEL.js';
+import './chunk-YTTHDPWF.js';
+import './chunk-IDJIWKTY.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-5ECUMU53.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-VPUNOGXO.js';
+import './chunk-QMQC6JCO.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-VV7ZD5LR.js';
 import './chunk-TBT347UY.js';
-import './chunk-BOQY756V.js';
-import './chunk-VBEXKEBV.js';
-import './chunk-GU4PKXN7.js';
-import './chunk-LBCZXXOX.js';
-import './chunk-DG2ULWM6.js';
-import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-IDSHLKQA.js';
+import './chunk-JKILLWZF.js';
+import './chunk-VNGENFOG.js';
+import './chunk-XHXDCYSK.js';
+import './chunk-5222PA6S.js';
 import './chunk-TQMI335S.js';
-import './chunk-TTLVQZSH.js';
-import './chunk-FWEWFW3F.js';
+import './chunk-ZGMQQWCV.js';
+import './chunk-IGRRD7PX.js';
+import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
+import './chunk-AXPCGD46.js';
+import './chunk-DEBOL6ON.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-5XCAPBE2.js';
-import './chunk-3W333NFO.js';
-import './chunk-LY2L3O2O.js';
-import './chunk-PDIM5T65.js';
-import './chunk-TQ6Y7YV6.js';
-import './chunk-RVYOOYOA.js';
-import './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+import './chunk-QUGYGO6L.js';
+import './chunk-RGW7ERF3.js';
+import './chunk-7OWPLRJR.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-YMKQVCKC.js';
+import './chunk-X5LNCIZT.js';
+import './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-D7X5ITVT.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-JWRX5ZTT.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-E4OUL7ZP.js';
+import './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import './chunk-FKXGQOF5.js';
-import './chunk-755WXDBI.js';
+import './chunk-M4B6QKNZ.js';
+import './chunk-K5WVK7IC.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-DYEFPYME.js';
 import './chunk-BKO6JEZI.js';
@@ -68,10 +69,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 import { join, dirname } from 'path';
@@ -138,7 +139,7 @@ async function runRunnerCheck(configPath, deps = {}) {
   const formerSkill = formerSkillQueues(config);
   const lines = [
     `config              ${configPath}`,
-    `host                ${config.host}`,
+    `name                ${config.host}`,
     `queues              ${config.queues.join(", ")}`,
     `concurrency         ${config.concurrency}`,
     `poll                ${config.pollSeconds}s`,

package/dist/{chunk-BN3CSI7S.js → chunk-2K3TCQHW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-GISNHSYL.js';
+import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-JGD5TWQ2.js';
 import { existsSync, unlinkSync, chmodSync } from 'fs';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';

package/dist/{chunk-A62QFN2M.js → chunk-2N72GPS2.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-CZUH2SLQ.js';
+import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-UNF7MWEL.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { EXEC_PORT } from './chunk-PDIM5T65.js';
-import { RELAY_PORT } from './chunk-BN3CSI7S.js';
+import { EXEC_PORT } from './chunk-XGJUNNXL.js';
+import { RELAY_PORT } from './chunk-2K3TCQHW.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-W7O4LA4E.js → chunk-34ANPNVB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-D7K446H6.js';
-import { spoolDir } from './chunk-755WXDBI.js';
+import { LiveUploader } from './chunk-YTTHDPWF.js';
+import { spoolDir } from './chunk-K5WVK7IC.js';
 import { CaptureDaemon } from './chunk-D4AMAEZ7.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';