@outerlayer/cli 0.25.0 → 0.25.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @outerlayer/cli
 
+## 0.25.1
+
+### Patch Changes
+
+- 86089fa: `outerlayer runner install --service` installs the root helper on Linux. Each microVM build then runs under Firecracker's jailer, as a user of its own. A build that escapes its microVM reaches none of the runner's credentials. On a host whose service an earlier release installed, run `outerlayer runner install --service --replace` to add the helper.
+
 ## 0.25.0
 
 ### Minor Changes

package/dist/{build-Q2OBF77R.js → build-YYVAJ75G.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-AXPCGD46.js';
+export { buildRepositoryImage } from './chunk-Q435LWVN.js';
 import './chunk-DEBOL6ON.js';
 import './chunk-JBJTC3UU.js';
-export { RecipeError } from './chunk-RGW7ERF3.js';
+export { RecipeError } from './chunk-APBTVIM4.js';
 import './chunk-ZI2ZVWKT.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-15T19:23:43.029Z+b0b505b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-16T12:01:15.085Z+0bf4474","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-PRSCX5AH.js → builder-MNUJS4RG.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-QUGYGO6L.js';
-import './chunk-RGW7ERF3.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-N3VSI5ZI.js';
+import './chunk-APBTVIM4.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-D4AMAEZ7.js';
+import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-ZODVSFI4.js';
 import './chunk-ZI2ZVWKT.js';

package/dist/{check-EPYRTE3R.js → check-C6HEFW6R.js}

@@ -1,43 +1,43 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-L2FZLBF7.js';
-import './chunk-3I44PQ26.js';
+import { probeCredentials } from './chunk-F57CLUH7.js';
+import './chunk-A6ORKBVJ.js';
 import './chunk-XRYUJTAT.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-O2WYUIK7.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
 import './chunk-TPKYTORP.js';
-import './chunk-34ANPNVB.js';
+import './chunk-VAMUWK55.js';
 import './chunk-2N72GPS2.js';
 import './chunk-UNF7MWEL.js';
-import './chunk-YTTHDPWF.js';
-import './chunk-IDJIWKTY.js';
+import './chunk-C36EOUUU.js';
+import './chunk-H6ZFLIX3.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-VPUNOGXO.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-24LQ34XL.js';
 import './chunk-QMQC6JCO.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-JKILLWZF.js';
-import './chunk-VNGENFOG.js';
-import './chunk-XHXDCYSK.js';
+import './chunk-OEU4JSDE.js';
+import './chunk-S6AWZKJN.js';
+import './chunk-ENFBARQP.js';
 import './chunk-5222PA6S.js';
 import './chunk-TQMI335S.js';
 import './chunk-ZGMQQWCV.js';
 import './chunk-IGRRD7PX.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-AXPCGD46.js';
+import './chunk-Q435LWVN.js';
 import './chunk-DEBOL6ON.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-QUGYGO6L.js';
-import './chunk-RGW7ERF3.js';
-import './chunk-7OWPLRJR.js';
+import './chunk-N3VSI5ZI.js';
+import './chunk-APBTVIM4.js';
+import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
-import './chunk-YMKQVCKC.js';
-import './chunk-X5LNCIZT.js';
-import './chunk-HWEIFHSW.js';
-import './chunk-6CNHXHI2.js';
+import './chunk-3FNPTQRH.js';
+import './chunk-CQRIZNE6.js';
+import './chunk-3WZ5ECSM.js';
+import './chunk-SNQR2EYI.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
@@ -54,7 +54,7 @@ import './chunk-BKO6JEZI.js';
 import './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-D4AMAEZ7.js';
+import './chunk-QE3UQAHK.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-JKNYTNYD.js';

package/dist/{chunk-HBLLZLOH.js → chunk-23SPSYXZ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-HWEIFHSW.js';
+import { autoConnect, detectActiveSession } from './chunk-3WZ5ECSM.js';
 import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-M4B6QKNZ.js';
-import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
+import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-VPUNOGXO.js → chunk-24LQ34XL.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-JKILLWZF.js';
-import { describeCallFailure } from './chunk-YMKQVCKC.js';
-import { WorkCommandError, getJson } from './chunk-X5LNCIZT.js';
+import { isPlaceholderCommand } from './chunk-OEU4JSDE.js';
+import { describeCallFailure } from './chunk-3FNPTQRH.js';
+import { WorkCommandError, getJson } from './chunk-CQRIZNE6.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { signerFor } from './chunk-ZODVSFI4.js';

package/dist/{chunk-YMKQVCKC.js → chunk-3FNPTQRH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-X5LNCIZT.js';
+import { WorkCommandError, postJson } from './chunk-CQRIZNE6.js';
 import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-FXUVXSY2.js';
 import { signingFetchFor } from './chunk-M4B6QKNZ.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-VPEGE3QZ.js';

package/dist/{chunk-HWEIFHSW.js → chunk-3WZ5ECSM.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-6CNHXHI2.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-SNQR2EYI.js';
 import { resolveGatewayCredentials } from './chunk-M4B6QKNZ.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
+import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';

package/dist/{chunk-3I44PQ26.js → chunk-A6ORKBVJ.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { senderPidfile } from './chunk-34ANPNVB.js';
+import { senderPidfile } from './chunk-VAMUWK55.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-2N72GPS2.js';
 import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
-import { installScrubContext } from './chunk-YTTHDPWF.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-XHXDCYSK.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-AXPCGD46.js';
+import { installScrubContext } from './chunk-C36EOUUU.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-ENFBARQP.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-Q435LWVN.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-QUGYGO6L.js';
-import { CLAUDE_CODE_VERSION } from './chunk-RGW7ERF3.js';
-import { waitForAgent, vmExecArgs } from './chunk-7OWPLRJR.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-N3VSI5ZI.js';
+import { CLAUDE_CODE_VERSION } from './chunk-APBTVIM4.js';
+import { waitForAgent, vmExecArgs } from './chunk-HPOEVC2V.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-XGJUNNXL.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-YMKQVCKC.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-X5LNCIZT.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-3FNPTQRH.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-CQRIZNE6.js';
 import { planArtifactUpload } from './chunk-BUP5N3X6.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { scrubText } from './chunk-D4AMAEZ7.js';
+import { scrubText } from './chunk-QE3UQAHK.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolvePackRoot } from './chunk-HBISTTG3.js';
 import { parsePolicy } from './chunk-RKOTJQVG.js';
@@ -214,6 +214,11 @@ async function helperFor(runtime, log) {
   else if (probe.unreachable === true) log(`${probe.detail}, so this build runs without the jailer`);
   return void 0;
 }
+function silence(runtime, state, lastError, console) {
+  if (!vmAlive(runtime, state)) return `it exited before its exec agent answered; ${console}`;
+  const last = lastError === void 0 ? "" : `; the last connection to its exec agent failed: ${describeCallFailure(lastError)}`;
+  return `its exec agent did not answer; ${console}${last}`;
+}
 function consoleNote(state, consolePath) {
   return state.jailed === void 0 ? `its console is in ${consolePath}` : `its console output is in the journal of the unit ${state.jailed.unit}`;
 }
@@ -386,10 +391,10 @@ async function provisionMicroVm(input) {
     input.save(state, environment);
   }
   if (input.aborted()) return bail("", true);
-  const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep });
+  let lastError;
+  const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep, onFailure: (err) => lastError = err });
   if (!ready) {
-    const why = vmAlive(runtime, state) ? "its exec agent did not answer" : "it exited before its exec agent answered";
-    return bail(`the microVM did not start: ${why}; ${consoleNote(state, consolePath)}`);
+    return bail(`the microVM did not start: ${silence(runtime, state, lastError, consoleNote(state, consolePath))}`);
   }
   let pushes = Promise.resolve();
   let firstWriteFailure;
@@ -812,10 +817,10 @@ async function startCheckMicroVm(input) {
       input.save(state);
     }
     if (abandoned()) return ABANDONED;
-    const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep });
+    let lastError;
+    const ready = await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep: runtime.sleep, onFailure: (err) => lastError = err });
     if (!ready) {
-      const why = vmAlive(runtime, state) ? "its exec agent did not answer" : "it exited before its exec agent answered";
-      return `the microVM did not start: ${why}; ${consoleNote(state, consolePath)}`;
+      return `the microVM did not start: ${silence(runtime, state, lastError, consoleNote(state, consolePath))}`;
     }
     if (built.docker === true) return waitForDocker(runtime, state, agentUser, () => /* @__PURE__ */ new Date());
     return void 0;

package/dist/{chunk-RGW7ERF3.js → chunk-APBTVIM4.js}

@@ -264,10 +264,10 @@ function guestAssetsPinned(arch) {
 var JAILER_BINARY_SHA256 = {
   x86_64: "99832d2270741af67ffacd46da716b4b016338541af5a742907ab965b2e9ac9e"
 };
-var HOST_HELPER_ASSETS_VERSION = "2";
+var HOST_HELPER_ASSETS_VERSION = "4";
 var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;
 var HOST_HELPER_SHA256 = {
-  x86_64: "0000000000000000000000000000000000000000000000000000000000000000"
+  x86_64: "5c9d9e46daf165411ebe594fa28f4adc6b363989d77673c7651ab6dccb808684"
 };
 function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
   return hashes[arch] !== "0".repeat(64);

package/dist/{chunk-YTTHDPWF.js → chunk-C36EOUUU.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-IDJIWKTY.js';
+import { uploadSpooledSteps } from './chunk-H6ZFLIX3.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
@@ -10,7 +10,7 @@ import { readLatestProvenanceForSession, readContextProvenance } from './chunk-Z
 import { hookExecSpoolPath } from './chunk-DYEFPYME.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-D4AMAEZ7.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-X5LNCIZT.js → chunk-CQRIZNE6.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-HWEIFHSW.js';
-import { workPageUrl } from './chunk-6CNHXHI2.js';
+import { detectActiveSession, autoConnect } from './chunk-3WZ5ECSM.js';
+import { workPageUrl } from './chunk-SNQR2EYI.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-M4B6QKNZ.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
+import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-XHXDCYSK.js → chunk-ENFBARQP.js}

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { runnerImageVersion } from './chunk-5222PA6S.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-AXPCGD46.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-Q435LWVN.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-QUGYGO6L.js';
-import { hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-RGW7ERF3.js';
-import { execCapture } from './chunk-7OWPLRJR.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-N3VSI5ZI.js';
+import { hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-APBTVIM4.js';
+import { execCapture } from './chunk-HPOEVC2V.js';
 import { GUEST_CID } from './chunk-XGJUNNXL.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-YMKQVCKC.js';
-import { WorkCommandError } from './chunk-X5LNCIZT.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-3FNPTQRH.js';
+import { WorkCommandError } from './chunk-CQRIZNE6.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-VPEGE3QZ.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-D4AMAEZ7.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QE3UQAHK.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
 import { downconvertSession } from './chunk-QZBXLLTV.js';
 import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-ZI2ZVWKT.js';

package/dist/{chunk-L2FZLBF7.js → chunk-F57CLUH7.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-3I44PQ26.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-A6ORKBVJ.js';
 import { writePendingUpdate } from './chunk-XRYUJTAT.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-O2WYUIK7.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-VPUNOGXO.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-24LQ34XL.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-QMQC6JCO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-XHXDCYSK.js';
+import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-ENFBARQP.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-5222PA6S.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { checkFit } from './chunk-IGRRD7PX.js';
 import { claimPidFile, readPidFile, releasePidFile } from './chunk-DEBOL6ON.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-QUGYGO6L.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-YMKQVCKC.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-X5LNCIZT.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-N3VSI5ZI.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-3FNPTQRH.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-CQRIZNE6.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWRX5ZTT.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -1746,7 +1746,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-LRAXUOJV.js');
+  const { postJson: postJson2 } = await import('./work-cmd-6HARIBMW.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2730,7 +2730,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-EPYRTE3R.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-C6HEFW6R.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-IDJIWKTY.js → chunk-H6ZFLIX3.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-HWEIFHSW.js';
+import { autoConnect, detectActiveSession } from './chunk-3WZ5ECSM.js';
 import { acquireSpoolLockAt } from './chunk-BUP5N3X6.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-M4B6QKNZ.js';
-import { resolveRepoIdentity } from './chunk-D4AMAEZ7.js';
+import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-7OWPLRJR.js → chunk-HPOEVC2V.js}

@@ -173,7 +173,8 @@ async function waitForAgent(socketPath, options) {
     try {
       await execCapture(socketPath, { argv: ["true"], user: "root", cwd: "/", env: {} });
       return true;
-    } catch {
+    } catch (err) {
+      options.onFailure?.(err);
       await options.sleep(options.delayMs);
     }
   }

package/dist/{chunk-VMF5LK3D.js → chunk-I25F6YVP.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned, checkBuildSkill } from './chunk-XFGL53GU.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-X5LNCIZT.js';
-import { isLinkedRepository } from './chunk-6CNHXHI2.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-CQRIZNE6.js';
+import { isLinkedRepository } from './chunk-SNQR2EYI.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { checkFormerSkillNames } from './chunk-MQ743JX3.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-M4B6QKNZ.js';
@@ -10,7 +10,7 @@ import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_ST
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-DXDF43YG.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-D4AMAEZ7.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-GNPTU4BM.js';
@@ -1186,7 +1186,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-73GNT4VV.js');
+    const { runnerHostChecks } = await import('./doctor-S6YCZGUU.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{chunk-QUGYGO6L.js → chunk-N3VSI5ZI.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError, BUILDKIT_IMAGE } from './chunk-RGW7ERF3.js';
+import { RecipeError, BUILDKIT_IMAGE } from './chunk-APBTVIM4.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { compareVersions } from './chunk-D4AMAEZ7.js';
+import { compareVersions } from './chunk-QE3UQAHK.js';
 import { ensureHostKey } from './chunk-ZODVSFI4.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-ZI2ZVWKT.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-2K3TCQHW.js';

package/dist/{chunk-JKILLWZF.js → chunk-OEU4JSDE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-VNGENFOG.js';
-import { MIN_ENGINE_MAJOR } from './chunk-XHXDCYSK.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-S6AWZKJN.js';
+import { MIN_ENGINE_MAJOR } from './chunk-ENFBARQP.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-ZGMQQWCV.js';
 import { runnerCredentialProblem } from './chunk-JWRX5ZTT.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZI2ZVWKT.js';

package/dist/{chunk-AXPCGD46.js → chunk-Q435LWVN.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-DEBOL6ON.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-RGW7ERF3.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-APBTVIM4.js';
 import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-ZI2ZVWKT.js';
 import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-2K3TCQHW.js';
 import { RELAY_ID, RELAY_USER } from './chunk-JGD5TWQ2.js';