@outerlayer/cli 0.24.0 → 0.25.0

package/dist/{container-start-OHBUZEJJ.js → container-start-X22OXY6E.js}

@@ -1,34 +1,34 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-BOQY756V.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-VBEXKEBV.js';
-import './chunk-GU4PKXN7.js';
-import { isAgentName, AGENT_COMMANDS } from './chunk-LBCZXXOX.js';
-import './chunk-DG2ULWM6.js';
-import './chunk-6MZSX4M7.js';
-import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-IDSHLKQA.js';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-JKILLWZF.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-VNGENFOG.js';
+import { MIN_ENGINE_MAJOR } from './chunk-XHXDCYSK.js';
+import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-5222PA6S.js';
 import './chunk-TQMI335S.js';
-import './chunk-TTLVQZSH.js';
-import './chunk-FWEWFW3F.js';
+import { isAgentName, AGENT_COMMANDS } from './chunk-ZGMQQWCV.js';
+import './chunk-IGRRD7PX.js';
+import './chunk-6MZSX4M7.js';
+import './chunk-AXPCGD46.js';
+import './chunk-DEBOL6ON.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-5XCAPBE2.js';
-import './chunk-3W333NFO.js';
-import './chunk-LY2L3O2O.js';
-import './chunk-PDIM5T65.js';
-import './chunk-TQ6Y7YV6.js';
-import './chunk-RVYOOYOA.js';
-import './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+import './chunk-QUGYGO6L.js';
+import './chunk-RGW7ERF3.js';
+import './chunk-7OWPLRJR.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-YMKQVCKC.js';
+import './chunk-X5LNCIZT.js';
+import './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import './chunk-D7X5ITVT.js';
+import './chunk-JWRX5ZTT.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-E4OUL7ZP.js';
+import './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import './chunk-FKXGQOF5.js';
+import './chunk-M4B6QKNZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
@@ -45,10 +45,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import { CLAUDE_CREDENTIAL_VARIABLES } from './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import { CLAUDE_CREDENTIAL_VARIABLES } from './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { existsSync, readFileSync } from 'fs';
 
@@ -57,9 +57,18 @@ var DOCKER_SOCKET = "/var/run/docker.sock";
 var REQUIRED = [
   ["OUTERLAYER_URL", "the factory's gateway address"],
   ["OUTERLAYER_APP_ID", "the factory's id"],
-  ["OUTERLAYER_API_KEY", "a runner key"],
-  ["OUTERLAYER_HOST", "the host name the factory shows"]
+  ["OUTERLAYER_API_KEY", "a runner key"]
 ];
+var NAME_VARIABLE = "OUTERLAYER_RUNNER_NAME";
+var OLD_NAME_VARIABLE = "OUTERLAYER_HOST";
+function runnerName(env) {
+  const name = set(env, NAME_VARIABLE);
+  const old = set(env, OLD_NAME_VARIABLE);
+  if (name !== void 0 && old !== void 0 && name !== old) {
+    return { name: void 0, conflict: `${NAME_VARIABLE} is ${name} and ${OLD_NAME_VARIABLE} is ${old}; set ${NAME_VARIABLE} only, since ${OLD_NAME_VARIABLE} is its earlier name` };
+  }
+  return { name: name ?? old };
+}
 var KEY_MIN_SHOWN = 16;
 var refuse = (message) => ({ ok: false, message });
 var set = (env, name) => {
@@ -83,11 +92,11 @@ function disagreements(config, env) {
   if (String(config.apiKey ?? "") !== key) {
     lines.push(`runner key: the volume has ${keyHint(String(config.apiKey ?? ""))}; the variables have ${keyHint(key)}`);
   }
-  const host = set(env, "OUTERLAYER_HOST");
+  const host = runnerName(env).name;
   const runner = config.runner;
-  const storedHost = runner?.host;
+  const storedHost = runner?.name ?? runner?.host;
   if (runner !== void 0 && storedHost !== host) {
-    lines.push(`host name: the volume has ${typeof storedHost === "string" ? storedHost : "none"}; the variables name ${host}`);
+    lines.push(`runner name: the volume has ${typeof storedHost === "string" ? storedHost : "none"}; the variables name ${host}`);
   }
   return lines;
 }
@@ -104,7 +113,10 @@ async function containerStart(deps) {
   if (version === void 0) {
     return refuse(`${IMAGE_VERSION_VARIABLE} is not set. This command is the runner container image's entrypoint; to run a runner on a machine, use \`outerlayer runner start\`.`);
   }
+  const named = runnerName(env);
+  if (named.conflict !== void 0) return refuse(named.conflict);
   const missing = REQUIRED.filter(([name]) => set(env, name) === void 0).map(([name, what]) => `${name} (${what})`);
+  if (named.name === void 0) missing.push(`${NAME_VARIABLE} (the runner's name, which the factory shows)`);
   const agent = set(env, "OUTERLAYER_AGENT") ?? "claude";
   if (!isAgentName(agent)) {
     return refuse(`OUTERLAYER_AGENT is ${agent}, and the image writes commands for ${Object.keys(AGENT_COMMANDS).join(", ")} only. Leave it unset to use claude.`);
@@ -121,19 +133,16 @@ async function containerStart(deps) {
       `${DOCKER_SOCKET} is not in the container. The runner starts each build as a container on the host's Docker, so start this container with -v ${DOCKER_SOCKET}:${DOCKER_SOCKET}.`
     );
   }
-  const machine = (deps.machine ?? (() => detectMachine()))();
-  if (machine.docker.kind === "desktop") {
-    return refuse("Docker Desktop is not supported yet. The Docker behind the socket is Docker Desktop; run the runner image on a Linux host with Docker Engine.");
-  }
+  const machine = { ...(deps.machine ?? (() => detectMachine()))(), inImage: true };
   if (!supportsContainerBuilds(machine)) {
     return refuse(
-      `The container reaches ${describeMachineDocker(machine)} through ${DOCKER_SOCKET}, and builds need Docker Engine in a version that isolates a build. Check that the socket is the host's Docker Engine and that it is running.`
+      `The container reaches ${describeMachineDocker(machine)} through ${DOCKER_SOCKET}, and builds need Docker Engine in a version that isolates a build (${MIN_ENGINE_MAJOR} or later), on Docker Engine or Docker Desktop. Check that the socket is the host's Docker and that it is running.`
     );
   }
   const url = set(env, "OUTERLAYER_URL");
   const appId = set(env, "OUTERLAYER_APP_ID");
   const apiKey = set(env, "OUTERLAYER_API_KEY");
-  const host = set(env, "OUTERLAYER_HOST");
+  const host = named.name;
   if (existsSync(configPath)) {
     const stored = readConfig(configPath);
     if (stored instanceof RunnerInitError) return refuse(stored.message);

package/dist/{control-plane-launch-GKGI6HJA.js → control-plane-launch-ZFT6SI4N.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseOwnerRepo, lookupGoverningSource, defaultGitRunner, materializeContext } from './chunk-E4OUL7ZP.js';
+import { parseOwnerRepo, lookupGoverningSource, defaultGitRunner, materializeContext } from './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-FKXGQOF5.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-M4B6QKNZ.js';
 import './chunk-ZJSNLVCE.js';
 import { layoutRefusalMessage, unsupportedLayout, sharedSkillNames, skillConflictMessage, composeDelivery } from './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
@@ -17,10 +17,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, mkdirSync, mkdtempSync, cpSync, renameSync, writeFileSync, rmSync, readdirSync } from 'fs';

package/dist/{docker-RKGBJESN.js → docker-PQHWAY5J.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { childEnvironment, createDockerHost, spawnRun } from './chunk-5XCAPBE2.js';
-import './chunk-3W333NFO.js';
+export { childEnvironment, createDockerHost, spawnRun } from './chunk-QUGYGO6L.js';
+import './chunk-RGW7ERF3.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-D4AMAEZ7.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{doctor-DOAFZV4O.js → doctor-73GNT4VV.js}

@@ -1,39 +1,39 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-5ECUMU53.js';
+import { launcherCheck } from './chunk-ATGHVEU4.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-VPUNOGXO.js';
+import './chunk-QMQC6JCO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { launcherCheck } from './chunk-HHXBOTRO.js';
-import './chunk-VV7ZD5LR.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-BOQY756V.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-VBEXKEBV.js';
-import { MIN_ENGINE_MAJOR } from './chunk-GU4PKXN7.js';
-import './chunk-LBCZXXOX.js';
-import './chunk-DG2ULWM6.js';
-import './chunk-6MZSX4M7.js';
-import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-IDSHLKQA.js';
+import './chunk-JKILLWZF.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-VNGENFOG.js';
+import { MIN_ENGINE_MAJOR, probeHelper, helperSocketPath } from './chunk-XHXDCYSK.js';
+import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-5222PA6S.js';
 import './chunk-TQMI335S.js';
-import './chunk-TTLVQZSH.js';
-import './chunk-FWEWFW3F.js';
+import './chunk-ZGMQQWCV.js';
+import './chunk-IGRRD7PX.js';
+import './chunk-6MZSX4M7.js';
+import './chunk-AXPCGD46.js';
+import './chunk-DEBOL6ON.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-5XCAPBE2.js';
-import { locateRecipe, assertBuildable, readRecipe, RecipeError, CLAUDE_CODE_VERSION } from './chunk-3W333NFO.js';
-import './chunk-LY2L3O2O.js';
-import './chunk-PDIM5T65.js';
-import './chunk-TQ6Y7YV6.js';
-import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-RVYOOYOA.js';
-import './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-QUGYGO6L.js';
+import { locateRecipe, assertBuildable, readRecipe, RecipeError, CLAUDE_CODE_VERSION } from './chunk-RGW7ERF3.js';
+import './chunk-7OWPLRJR.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-YMKQVCKC.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-X5LNCIZT.js';
+import './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { builtinKind } from './chunk-D7X5ITVT.js';
+import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { allowHostProblem, MAX_ALLOW_HOSTS } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { defaultGitRunner } from './chunk-E4OUL7ZP.js';
+import { defaultGitRunner } from './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import { defaultFetch } from './chunk-FKXGQOF5.js';
+import { defaultFetch } from './chunk-M4B6QKNZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
@@ -50,10 +50,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import { loadHostKey } from './chunk-PVRBE7S4.js';
-import { runnerDir, hostKeyPath, jobsDir } from './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import { loadHostKey } from './chunk-ZODVSFI4.js';
+import { runnerDir, hostKeyPath, jobsDir } from './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { spawnSync } from 'child_process';
 import { existsSync, readdirSync, statSync, readFileSync } from 'fs';
@@ -126,6 +126,27 @@ function delegationCheck(service) {
     fix: "run `outerlayer runner install --service --replace` to write the unit this CLI generates, which sets Delegate=yes"
   };
 }
+var REINSTALL = "run `outerlayer runner install --service --replace` to install the root helper that starts each microVM build under Firecracker's jailer";
+function helperCheck(facts) {
+  const name = "MicroVM jailer";
+  if (facts.present) {
+    return {
+      name,
+      status: "pass",
+      detail: `each microVM build runs under Firecracker's jailer (Firecracker ${facts.firecracker}), as a user of its own with no credentials, no shared group and no network, so a build that escaped its microVM would reach none of the runner's credentials`
+    };
+  }
+  const reaches = "a build that escaped its microVM would run as the runner's account and reach what that account holds: the Claude credential, the runner key, the host key, the host's `gh` login and its membership of the `docker` group";
+  if (facts.reason === "unpinned") {
+    return { name, status: "warn", detail: `this release of the CLI pins no root helper, so Firecracker runs as the runner's account: ${reaches}` };
+  }
+  return {
+    name,
+    status: "warn",
+    detail: `no usable root helper runs for this runner, so Firecracker runs as the runner's account: ${reaches} (${facts.detail})`,
+    fix: REINSTALL
+  };
+}
 
 // src/runner/image/doctor.ts
 var LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
@@ -205,6 +226,7 @@ async function pinCheck(fetchImpl) {
   }
   return { name, status: "pass", detail: `images pin Claude Code ${CLAUDE_CODE_VERSION}; latest is ${latest}` };
 }
+var RUNNER_IMAGE_GUIDE = "https://docs.outerlayer.ai/run-the-runner-in-a-container";
 function isolationCheck(machine, hooks) {
   const name = "Build isolation";
   const kind = builtinKind(hooks.provision);
@@ -213,7 +235,8 @@ function isolationCheck(machine, hooks) {
   if (kind === "container") {
     if (can) {
       const where = machine.platform === "wsl2" ? " inside WSL2" : "";
-      return { name, status: "pass", detail: `builtin:container: builds run in containers (isolation: container) on Docker Engine ${machine.docker.version}${where}` };
+      const docker = machine.docker.kind === "desktop" ? "Docker Desktop with engine" : "Docker Engine";
+      return { name, status: "pass", detail: `builtin:container: builds run in containers (isolation: container) on ${docker} ${machine.docker.version}${where}` };
     }
     return {
       name,
@@ -247,7 +270,7 @@ function isolationCheck(machine, hooks) {
         name,
         status: "warn",
         detail: "builtin:process: builds are not isolated: they run as processes under this user (isolation: shared-user), and macOS cannot run container builds itself",
-        fix: "run outerlayer runner init --vm to run the runner in a Linux VM, where builds run in containers (isolation: container)"
+        fix: `run the runner image on Docker Desktop (${RUNNER_IMAGE_GUIDE}), or run outerlayer runner init --vm to run the runner in a Linux VM; either way builds run in containers (isolation: container)`
       };
     }
     if (can) {
@@ -259,7 +282,7 @@ function isolationCheck(machine, hooks) {
       };
     }
     const reach = reachDockerStep(machine);
-    const fix = reach !== void 0 ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container` : machine.platform === "windows" ? `install Docker Engine inside WSL2 (version ${MIN_ENGINE_MAJOR} or later), run the runner from a WSL2 shell, and set both hooks to builtin:container; Docker Desktop cannot isolate builds` : machine.docker.kind === "desktop" ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later, not Docker Desktop: install it and set both hooks to builtin:container` : `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it and set both hooks to builtin:container`;
+    const fix = reach !== void 0 ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container` : machine.platform === "windows" ? `install Docker Engine inside WSL2 (version ${MIN_ENGINE_MAJOR} or later), run the runner from a WSL2 shell, and set both hooks to builtin:container; or run the runner image on Docker Desktop (${RUNNER_IMAGE_GUIDE})` : machine.docker.kind === "desktop" ? `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: install it and set both hooks to builtin:container, or run the runner image on Docker Desktop (${RUNNER_IMAGE_GUIDE})` : `isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it and set both hooks to builtin:container`;
     return {
       name,
       status: "warn",
@@ -502,6 +525,21 @@ function allowHostsCheck(configPath, allowHosts) {
     fix: reached.length === 0 ? "list the public hosts your builds need in runner.build.allowHosts; once a few builds have run, doctor lists the hosts they reached" : `review the hosts past builds reached and set runner.build.allowHosts to the ones they need: ${JSON.stringify(reached)}`
   };
 }
+function runnerNameCheck(configPath) {
+  let runner;
+  try {
+    runner = JSON.parse(readFileSync(configPath, "utf8")).runner;
+  } catch {
+    return void 0;
+  }
+  if (runner?.host === void 0 || runner.name !== void 0) return void 0;
+  return {
+    name: "Runner name",
+    status: "warn",
+    detail: "the config names this runner with runner.host, the earlier name of runner.name; it still works",
+    fix: "rename runner.host to runner.name in the config file"
+  };
+}
 function launcherCheckOf(env) {
   return launcherCheck({ home: env.home ?? homeFromEnv(), PATH: env.PATH ?? process.env.PATH });
 }
@@ -513,6 +551,10 @@ function runnerImageCheck(env) {
   if (advice === void 0) return { name, status: "pass", detail: `runs ${imageTag(version)}` };
   return advice.reason === "refused" ? { name, status: "fail", detail: `the factory refuses this runner as too old, so it claims nothing (image ${version})`, fix: pullInstruction(advice.tag) } : { name, status: "warn", detail: `the factory names a newer version than the ${version} this image runs`, fix: pullInstruction(advice.tag) };
 }
+async function helperFactsOf(env) {
+  const probe = await (env.helper ?? (() => probeHelper(env.service === void 0 ? void 0 : helperSocketPath(env.service.unit))))();
+  return probe.ok ? { present: true, firecracker: probe.firecracker } : { present: false, reason: probe.reason, detail: probe.detail };
+}
 async function runnerHostChecks(env) {
   const dockerAvailable = env.dockerAvailable ?? (() => spawnSync("docker", ["info"], { stdio: "ignore" }).status === 0);
   const devcontainerRunnable = env.devcontainerRunnable ?? (() => devcontainerCliRunnable());
@@ -522,18 +564,22 @@ async function runnerHostChecks(env) {
     (owner) => directories(join(reposDir, owner)).filter((name) => existsSync(join(reposDir, owner, name, ".git"))).map((name) => recipeCheck(reposDir, owner, name))
   ) : [];
   const imageCheck = runnerImageCheck(env);
+  const nameCheck = runnerNameCheck(env.configPath);
+  const machine = () => env.machine ?? detectMachine({ env: env.env });
   return [
     ...imageCheck === void 0 ? [] : [imageCheck],
+    ...nameCheck === void 0 ? [] : [nameCheck],
     dockerAvailable() ? { name: "Docker Engine", status: "pass", detail: "reachable" } : {
       name: "Docker Engine",
       status: "warn",
       detail: "docker info failed, so `outerlayer runner image` cannot build",
       fix: "start Docker, or give this user access to its socket"
     },
-    ...env.hooks === void 0 ? [] : [isolationCheck(env.machine ?? detectMachine(), env.hooks)],
+    ...env.hooks === void 0 ? [] : [isolationCheck(machine(), env.hooks)],
     ...env.hooks !== void 0 && builtinKind(env.hooks.provision) === "vm" ? [
-      kvmCheck(env.machine ?? detectMachine(), env.service),
+      kvmCheck(machine(), env.service),
       ...env.service === void 0 ? [] : [delegationCheck(env.service)],
+      helperCheck(await helperFactsOf(env)),
       ...env.runner === void 0 ? [] : [memoryCheck({ concurrency: env.runner.concurrency, buildMemory: env.runner.buildMemory, hostMemory: env.hostMemory ?? totalmem() })]
     ] : [],
     ...env.hooks !== void 0 && ["container", "vm"].includes(builtinKind(env.hooks.provision)) ? [imageBuildLimitCheck(await (env.buildx ?? (() => buildxState(spawnRun)))(), env.runner?.buildMemory)] : [],

package/dist/{emit-artifact-cmd-VZHIDPXQ.js → emit-artifact-cmd-AIOTX6YT.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-D7K446H6.js';
-import './chunk-F7Y2USIM.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-YTTHDPWF.js';
+import './chunk-IDJIWKTY.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
-import { detectActiveSession, autoConnect } from './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+import { detectActiveSession, autoConnect } from './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FKXGQOF5.js';
-import './chunk-755WXDBI.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
+import './chunk-K5WVK7IC.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-DYEFPYME.js';
 import './chunk-BKO6JEZI.js';
@@ -30,10 +30,10 @@ import './chunk-RKOTJQVG.js';
 import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { createHash, randomUUID } from 'crypto';
 import { statSync, readFileSync, mkdirSync, existsSync, writeFileSync, renameSync, unlinkSync } from 'fs';

package/dist/{emit-criteria-cmd-SYLBCWHW.js → emit-criteria-cmd-7PJINOHA.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+import { detectActiveSession, autoConnect } from './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FKXGQOF5.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
 import './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
 import { C } from './chunk-ANPNT6PM.js';
@@ -20,10 +20,10 @@ import './chunk-RKOTJQVG.js';
 import { CriteriaListSchema } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 

package/dist/{emit-finding-cmd-52M43NPC.js → emit-finding-cmd-JRDSZ4DR.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FKXGQOF5.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-D4AMAEZ7.js';
@@ -21,10 +21,10 @@ import './chunk-RKOTJQVG.js';
 import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync, existsSync } from 'fs';
 import { join, dirname, basename } from 'path';

package/dist/{emit-result-cmd-BTMTGDAV.js → emit-result-cmd-ZGF6Q6OP.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectCi } from './chunk-D7K446H6.js';
-import './chunk-F7Y2USIM.js';
+import { detectCi } from './chunk-YTTHDPWF.js';
+import './chunk-IDJIWKTY.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
-import { detectActiveSession, autoConnect } from './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+import { detectActiveSession, autoConnect } from './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FKXGQOF5.js';
-import './chunk-755WXDBI.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
+import './chunk-K5WVK7IC.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-DYEFPYME.js';
 import './chunk-BKO6JEZI.js';
@@ -30,10 +30,10 @@ import './chunk-RKOTJQVG.js';
 import { EmittedNameSchema, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { randomUUID } from 'crypto';
 import { readFileSync } from 'fs';

package/dist/{emit-step-cmd-6XTJITZT.js → emit-step-cmd-DUR34STQ.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { EmitStepError, runEmitStep, uploadSpooledSteps } from './chunk-F7Y2USIM.js';
+export { EmitStepError, runEmitStep, uploadSpooledSteps } from './chunk-IDJIWKTY.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+import './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import './chunk-FKXGQOF5.js';
+import './chunk-M4B6QKNZ.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-D4AMAEZ7.js';
 import './chunk-ANPNT6PM.js';
@@ -21,10 +21,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{exec-client-CKPK62K2.js → exec-client-S5IA7JRG.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { CAPTURE_LIMIT_BYTES, ExecConnectionError, HANDSHAKE_TIMEOUT_MS, execCapture, runExec, runVmExec, vmExecArgs, waitForAgent } from './chunk-LY2L3O2O.js';
-import './chunk-PDIM5T65.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+export { CAPTURE_LIMIT_BYTES, ExecConnectionError, HANDSHAKE_TIMEOUT_MS, execCapture, runExec, runVmExec, vmExecArgs, waitForAgent } from './chunk-7OWPLRJR.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{governing-source-GWN7GVEN.js → governing-source-DKJABQAT.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { imageTargetFor, pinnedSourceOf, resolveGoverningSource } from './chunk-TQ6Y7YV6.js';
-import './chunk-RVYOOYOA.js';
-import './chunk-F2W2IYNP.js';
-import './chunk-V5Q3S4NM.js';
+export { imageTargetFor, pinnedSourceOf, resolveGoverningSource } from './chunk-YMKQVCKC.js';
+import './chunk-X5LNCIZT.js';
+import './chunk-HWEIFHSW.js';
+import './chunk-6CNHXHI2.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
-import './chunk-E4OUL7ZP.js';
+import './chunk-FXUVXSY2.js';
 import './chunk-MQ743JX3.js';
-import './chunk-FKXGQOF5.js';
+import './chunk-M4B6QKNZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
@@ -26,10 +26,10 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-PVRBE7S4.js';
-import './chunk-KF37SUDM.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-ZODVSFI4.js';
+import './chunk-ZI2ZVWKT.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{guest-init-ZBL5CN7Y.js → guest-init-TOSKPGPF.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-A62QFN2M.js';
-import './chunk-CZUH2SLQ.js';
+export { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-2N72GPS2.js';
+import './chunk-UNF7MWEL.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-PDIM5T65.js';
-import './chunk-BN3CSI7S.js';
-import './chunk-GISNHSYL.js';
+import './chunk-XGJUNNXL.js';
+import './chunk-2K3TCQHW.js';
+import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);