@outerlayer/cli 0.25.2 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @outerlayer/cli
 
+## 0.26.0
+
+### Minor Changes
+
+- 9dab934: Remove `outerlayer import capture`, `outerlayer import ruler` and `outerlayer hooks install-git`. `outerlayer init` installs the maintained skills, and `outerlayer init --update` refreshes them. `outerlayer init` and `outerlayer sync` remove the git hooks that an earlier version installed.
+
+### Patch Changes
+
+- 847b8eb: MicroVM builds use Firecracker 1.17.0. On a host with the root helper, run `outerlayer runner install --service --replace` so its builds use it too. Until then, `outerlayer doctor` and each build's log say the helper runs an older Firecracker.
+- 0405fed: MicroVM builds no longer stop after a CLI update that pins a new Firecracker, guest kernel or guest helper. The runner keeps each file under its pinned hash and downloads the new one.
+
 ## 0.25.2
 
 ### Patch Changes

package/README.md

@@ -437,7 +437,6 @@ before it gives up.
 | `outerlayer daemon` | Run the copy-out daemon in the foreground (`--once` for a single sweep, which uploads nothing). Once cloud credentials exist, it also streams a launched session's new turns as they land — see Privacy, above. `outerlayer watch` is the former name and still works, with a warning. |
 | `outerlayer doctor` | Check the installation: hooks, status-line freshness, sync health and, with a factory key, the GitHub App access builds need. `--json` prints the checks and a summary for scripts. |
 | `outerlayer context emit [--check]` | Compile `.outerlayer/` into each configured target tool's native files (targets come from `.outerlayer/config.json`). `--check` computes outputs and diffs against disk without writing (CI mode). Bare `outerlayer emit` with no name still compiles, with a deprecation warning. |
-| `outerlayer import ruler` | Port a `.ruler/` tree ([Ruler](https://github.com/intellectronica/ruler)) into the equivalent `.outerlayer/` tree — mostly a rename; never overwrites an existing `.outerlayer/`. |
 | `outerlayer hooks wrap` / `outerlayer hooks unwrap` | Auto-wrap (or undo wrapping) `PreToolUse`/`PostToolUse` hooks for execution evidence — one spawn per firing. |
 | `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. A JUnit XML file bound with `--for` proves a criterion that declares `test` proof; `--test <name[=path:line]>` binds only the named tests. |
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |

package/dist/{build-ONH22PN5.js → build-JK2DLT6X.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-3RBQSPW5.js';
+export { buildRepositoryImage } from './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
-export { RecipeError } from './chunk-APBTVIM4.js';
+export { RecipeError } from './chunk-4R24DSL2.js';
 import './chunk-L4CW6LZQ.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-16T13:07:36.429Z+ced0b55","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-16T14:55:16.789Z+b8b6796","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-WPULEVMY.js → builder-TMA25KRR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';

package/dist/{check-SSEVZJN5.js → check-FAGTKWHT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-WMEADVIX.js';
-import './chunk-CP24ZXXR.js';
+import { probeCredentials } from './chunk-DVAAATJP.js';
+import './chunk-4QKHBDEN.js';
 import './chunk-TKL74NLB.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-6FAP657M.js';
@@ -14,24 +14,24 @@ import './chunk-UNF7MWEL.js';
 import './chunk-ITP76BST.js';
 import './chunk-P7UQZFNY.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-Z453MOUL.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-TI33WRBT.js';
 import './chunk-4IFKLYMM.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-QBENN6GA.js';
-import './chunk-PCADYUQT.js';
-import './chunk-Z6SWQV77.js';
+import './chunk-ARMZI56S.js';
+import './chunk-6S3UEBLB.js';
+import './chunk-6WZKI6LQ.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import './chunk-5PMQDQFV.js';
 import './chunk-MLD2NA7N.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+import './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';

package/dist/{chunk-CP24ZXXR.js → chunk-4QKHBDEN.js}

@@ -5,11 +5,11 @@ import { senderPidfile } from './chunk-XBCJI6SV.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-2N72GPS2.js';
 import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
 import { installScrubContext } from './chunk-ITP76BST.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-Z6SWQV77.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-3RBQSPW5.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-6WZKI6LQ.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-AINUN2TT.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-F4267APM.js';
-import { CLAUDE_CODE_VERSION } from './chunk-APBTVIM4.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-7I6GZSN3.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-4R24DSL2.js';
 import { waitForAgent, vmExecArgs } from './chunk-HPOEVC2V.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-XGJUNNXL.js';
 import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-WVM6PM2N.js';
@@ -214,7 +214,10 @@ function makeBuildsDirPrivate(buildDir2) {
 }
 async function helperFor(runtime, log) {
   const probe = await runtime.vm.helper.probe();
-  if (probe.ok) return probe.client;
+  if (probe.ok) {
+    if (probe.firecracker !== FIRECRACKER_VERSION) log(`${helperFirecrackerNote(probe.firecracker)}; run \`outerlayer runner install --service --replace\` to update it`);
+    return probe.client;
+  }
   if (probe.reason === "unsupported") log(probe.detail);
   else if (probe.unreachable === true) log(`${probe.detail}, so this build runs without the jailer`);
   return void 0;

package/dist/{chunk-APBTVIM4.js → chunk-4R24DSL2.js}

@@ -242,12 +242,12 @@ var MICROVM_ARCHES = ["x86_64"];
 function firecrackerArch(nodeArch) {
   return nodeArch === "x64" ? "x86_64" : nodeArch === "arm64" ? "aarch64" : nodeArch;
 }
-var FIRECRACKER_VERSION = "1.16.2";
+var FIRECRACKER_VERSION = "1.17.0";
 var FIRECRACKER_SHA256 = {
-  x86_64: "32e3cdcd4081f91fe2b024a266f57dcb3b4e5fec5033e0cb22467ad7f7820bda"
+  x86_64: "06094a1108ae9e82aa4c23a775aa92758f53f1175d422270d9d6162cb9ade558"
 };
 var FIRECRACKER_BINARY_SHA256 = {
-  x86_64: "8227875ceda44177a4d501052dae4a2f9d7837362f5399f02cf0748e68418377"
+  x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
 var GUEST_ASSETS_VERSION = "1";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
@@ -262,7 +262,7 @@ function guestAssetsPinned(arch) {
   return GUEST_KERNEL_SHA256[arch] !== zero && GUEST_HELPER_SHA256[arch] !== zero;
 }
 var JAILER_BINARY_SHA256 = {
-  x86_64: "99832d2270741af67ffacd46da716b4b016338541af5a742907ab965b2e9ac9e"
+  x86_64: "65ef226e96f0ceda55ba643f445801ef2cc0ea667ef67cad8ac4f406c9c8434f"
 };
 var HOST_HELPER_ASSETS_VERSION = "4";
 var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;

package/dist/{chunk-PCADYUQT.js → chunk-6S3UEBLB.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-Z6SWQV77.js';
+import { MIN_ENGINE_MAJOR } from './chunk-6WZKI6LQ.js';
 import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-APBTVIM4.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-4R24DSL2.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-Z6SWQV77.js → chunk-6WZKI6LQ.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3RBQSPW5.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-AINUN2TT.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-F4267APM.js';
-import { hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-APBTVIM4.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-7I6GZSN3.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-4R24DSL2.js';
 import { execCapture } from './chunk-HPOEVC2V.js';
 import { GUEST_CID } from './chunk-XGJUNNXL.js';
 import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-WVM6PM2N.js';
@@ -213,6 +213,9 @@ function helperClient(socketPath, options = {}) {
     }
   };
 }
+function helperFirecrackerNote(helperFirecracker) {
+  return `the root helper runs Firecracker ${helperFirecracker}, not the ${FIRECRACKER_VERSION} this release pins, so microVM builds run under the jailer with Firecracker ${helperFirecracker}`;
+}
 function reinstallMessage(protocol) {
   const spoken = protocol === void 0 ? "a protocol it does not name" : `protocol ${protocol}`;
   return `the root helper speaks ${spoken}, which this runner does not support, so microVM builds run without the jailer; run \`outerlayer runner install --service --replace\` to install the helper that goes with this release`;
@@ -476,8 +479,12 @@ async function download(file, url, fetchImpl) {
   if (!response.ok) throw new AssetError(file, `${file} could not be downloaded from ${url}: the server answered ${response.status}`);
   return Buffer.from(await response.arrayBuffer());
 }
+function keptPath(dir, sha256, name) {
+  mkdirSync(join(dir, sha256), { recursive: true, mode: RUNNER_DIR_MODE });
+  return join(dir, sha256, name);
+}
 async function ensureFile(dir, file, pin, fetchImpl, mode) {
-  const path = join(dir, file);
+  const path = keptPath(dir, pin.sha256, file);
   if (existsSync(path)) {
     const actual2 = sha256Of(readFileSync(path));
     if (actual2 !== pin.sha256) throw pinProblem(file, pin.sha256, actual2, `at ${path}`);
@@ -499,7 +506,7 @@ function extractWithTar(arch, program = "firecracker") {
 }
 async function ensureFirecracker(input) {
   const { dir, arch, pins, fetchImpl } = input;
-  const firecracker = join(dir, "firecracker");
+  const firecracker = keptPath(dir, pins.firecracker.binarySha256, "firecracker");
   if (existsSync(firecracker)) {
     const actual = sha256Of(readFileSync(firecracker));
     if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `at ${firecracker}`);
@@ -549,7 +556,7 @@ async function ensureJailer(options) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const dir = vmAssetsDir(options.runnerDir);
   mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const jailer = join(dir, "jailer");
+  const jailer = keptPath(dir, expected, "jailer");
   if (existsSync(jailer)) {
     const actual = sha256Of(readFileSync(jailer));
     if (actual !== expected) throw pinProblem("jailer", expected, actual, `at ${jailer}`);
@@ -3304,4 +3311,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };

package/dist/{chunk-F4267APM.js → chunk-7I6GZSN3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError, BUILDKIT_IMAGE } from './chunk-APBTVIM4.js';
+import { RecipeError, BUILDKIT_IMAGE } from './chunk-4R24DSL2.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { compareVersions } from './chunk-QE3UQAHK.js';
 import { ensureHostKey } from './chunk-F6DIHHBS.js';

package/dist/{chunk-3RBQSPW5.js → chunk-AINUN2TT.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-PYSKSROG.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-APBTVIM4.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-4R24DSL2.js';
 import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
 import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-2K3TCQHW.js';
 import { RELAY_ID, RELAY_USER } from './chunk-JGD5TWQ2.js';

package/dist/{chunk-QBENN6GA.js → chunk-ARMZI56S.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-PCADYUQT.js';
-import { MIN_ENGINE_MAJOR } from './chunk-Z6SWQV77.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-6S3UEBLB.js';
+import { MIN_ENGINE_MAJOR } from './chunk-6WZKI6LQ.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-5PMQDQFV.js';
 import { runnerCredentialProblem } from './chunk-JWRX5ZTT.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';

package/dist/{chunk-WMEADVIX.js → chunk-DVAAATJP.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-CP24ZXXR.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-4QKHBDEN.js';
 import { writePendingUpdate } from './chunk-TKL74NLB.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-6FAP657M.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-Z453MOUL.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-TI33WRBT.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-4IFKLYMM.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-Z6SWQV77.js';
+import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-6WZKI6LQ.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-665QWBNW.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { checkFit } from './chunk-MLD2NA7N.js';
 import { claimPidFile, readPidFile, releasePidFile } from './chunk-PYSKSROG.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-F4267APM.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-7I6GZSN3.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-WVM6PM2N.js';
 import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DZUANBKP.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWRX5ZTT.js';
@@ -2730,7 +2730,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-SSEVZJN5.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-FAGTKWHT.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-Z453MOUL.js → chunk-TI33WRBT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-QBENN6GA.js';
+import { isPlaceholderCommand } from './chunk-ARMZI56S.js';
 import { describeCallFailure } from './chunk-WVM6PM2N.js';
 import { WorkCommandError, getJson } from './chunk-DZUANBKP.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';

package/dist/{chunk-WXKAHUGA.js → chunk-XK7FRM5J.js}

@@ -1186,7 +1186,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-EI22PDR5.js');
+    const { runnerHostChecks } = await import('./doctor-AXJQQBKY.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{cli-ZBZFCRTK.js → cli-CD4UNXBY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-WXKAHUGA.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-XK7FRM5J.js';
 import './chunk-XFGL53GU.js';
 import './chunk-VJBFQP3H.js';
 import { verifiedTrackerNames, TRACKERS } from './chunk-DZUANBKP.js';
@@ -3898,12 +3898,12 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-ZGQ6HMZD.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-KNYXSA6O.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + (shell?.text ?? ""));
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-ZGQ6HMZD.js');
+    const { runInitCommand } = await import('./init-cmd-KNYXSA6O.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4187,7 +4187,6 @@ code is 1: revoke the token on /profile/security.
     }
   });
   registerEmitCommands(program2);
-  registerImportCommands(program2);
   registerHooksCommands(program2);
   registerMcpCommands(program2);
   registerContextCommands(program2);
@@ -4882,7 +4881,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-JJ3EO7SB.js');
-    const { start, RunnerStartError } = await import('./loop-JTKSTVDV.js');
+    const { start, RunnerStartError } = await import('./loop-HTWKPG3J.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BY5Z6YH7.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4901,8 +4900,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-JJ3EO7SB.js');
-    const { containerStart } = await import('./container-start-L6LCWH6Z.js');
-    const { start, RunnerStartError } = await import('./loop-JTKSTVDV.js');
+    const { containerStart } = await import('./container-start-NRPEMKKE.js');
+    const { start, RunnerStartError } = await import('./loop-HTWKPG3J.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BY5Z6YH7.js');
     try {
       const result = await containerStart({
@@ -4922,7 +4921,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { runRunnerCheck } = await import('./check-SSEVZJN5.js');
+    const { runRunnerCheck } = await import('./check-FAGTKWHT.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4956,7 +4955,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-A2XBWQGB.js');
+        const { installServiceCommand } = await import('./command-A54TSZWD.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5012,7 +5011,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { uninstallServiceCommand } = await import('./command-A2XBWQGB.js');
+    const { uninstallServiceCommand } = await import('./command-A54TSZWD.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5040,10 +5039,10 @@ already in runner.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-JJ3EO7SB.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-ZN47OUB3.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-ENQLA4Q6.js');
-    const { detectMachine } = await import('./machine-RCIMAKOA.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-MRREKVT5.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-IFQCZKY6.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-3HAVHQZI.js');
+    const { detectMachine } = await import('./machine-AYYL2WXW.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-5WVPLO3G.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-2D7MPOIJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5194,7 +5193,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-A2XBWQGB.js');
+        const { installServiceCommand } = await import('./command-A54TSZWD.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5239,10 +5238,10 @@ Next:
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-ONH22PN5.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-JK2DLT6X.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-FATVQG5M.js');
-    const { builderSpec } = await import('./builder-WPULEVMY.js');
+    const { createDockerHost } = await import('./docker-4X2A5HDY.js');
+    const { builderSpec } = await import('./builder-TMA25KRR.js');
     const { loadRunnerConfig } = await import('./config-JJ3EO7SB.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
@@ -5254,7 +5253,7 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-C2O6Q3RR.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-NH6RLVMI.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
@@ -5322,7 +5321,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { requestStop } = await import('./loop-JTKSTVDV.js');
+    const { requestStop } = await import('./loop-HTWKPG3J.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-5SJ6ZKT7.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5330,8 +5329,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-JJ3EO7SB.js');
     const { jobsDir, runnerDir } = await import('./paths-ZC6BMWMT.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-JTKSTVDV.js');
-    const { renderStatus } = await import('./status-OTZ3VX47.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-HTWKPG3J.js');
+    const { renderStatus } = await import('./status-IAXWRX7B.js');
     const { readHousekeepingRecord } = await import('./record-K23IN6QN.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5391,7 +5390,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { listJobFiles } = await import('./loop-JTKSTVDV.js');
+    const { listJobFiles } = await import('./loop-HTWKPG3J.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-VN2HKDSH.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5426,23 +5425,6 @@ function registerHooksCommands(program2) {
     "after",
     "\n`init` auto-wraps PreToolUse/PostToolUse hooks; these subcommands cover the\nrest: manual re-scans, other events, and undo.\n"
   );
-  hooksCmd.command("install-git").description("Remove the git hooks an earlier version installed in this repo").addHelpText(
-    "after",
-    "\nEarlier versions installed a pre-commit guard and commit journal hooks. This removes\nthe ones OuterLayer wrote and leaves any hook it did not write untouched.\n"
-  ).action(() => {
-    const removal = removeJournalHooks(process.cwd());
-    if (removal.removed) {
-      process.stdout.write(`${C.green}\u2713${C.reset} removed the commit journal hooks an earlier version installed \u2192 ${removal.path}
-`);
-    }
-    const guard = removePreCommitGuardHook(process.cwd());
-    if (guard.removed) {
-      process.stdout.write(`${C.green}\u2713${C.reset} removed the pre-commit guard an earlier version installed \u2192 ${guard.path}
-`);
-    }
-    if (!removal.removed && !guard.removed) process.stdout.write(`${C.dim}No git hooks from an earlier version were found.${C.reset}
-`);
-  });
   hooksCmd.command("status").description("List hook entries in user and project settings, marking the wrapped ones").option("--json", "machine-readable JSON output").action((opts) => {
     const report = [];
     for (const scope of ["user", "project"]) {
@@ -5648,37 +5630,6 @@ caller from the bearer token, the gateway answers 401 without that header.
     }
   });
 }
-function registerImportCommands(program2) {
-  const importCmd = program2.command("import").description("Import an existing config format into .outerlayer/");
-  importCmd.command("ruler").description("Port a .ruler/ tree into the equivalent .outerlayer/ tree").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText("after", "\nRuler: https://github.com/intellectronica/ruler. Mostly a rename.\n").action(async (opts) => {
-    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-VJOHOJQ7.js');
-    try {
-      const result = runImportRuler({ cwd: opts.dir, json: opts.json });
-      if (result.exitCode !== 0) process.exitCode = result.exitCode;
-    } catch (err) {
-      if (err instanceof ImportRulerError) {
-        fail(err.message);
-        return;
-      }
-      throw err;
-    }
-  });
-  importCmd.command("capture").description("Install the maintained skills into .outerlayer/").option("--dir <path>", "repo root to write into (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
-    "after",
-    "\nInstalls the five maintained skills (outerlayer-evidence, outerlayer-amend,\nouterlayer-findings, outerlayer-cli, outerlayer-build) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
-  ).action(async (opts) => {
-    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-TCOKNVBM.js');
-    try {
-      runImportCapture({ cwd: opts.dir, json: opts.json });
-    } catch (err) {
-      if (err instanceof ImportCaptureError) {
-        fail(err.message);
-        return;
-      }
-      throw err;
-    }
-  });
-}
 function registerContextCommands(program2) {
   const contextCmd = program2.command("context").description("Compile agent context");
   contextCmd.command("emit").description("Compile .outerlayer/ into each configured target tool's native files").option("--check", "compare against disk, write nothing, exit 1 on drift (CI mode)").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(

package/dist/{command-A2XBWQGB.js → command-A54TSZWD.js}

@@ -3,17 +3,17 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-JF572PM5.js';
 import './chunk-KDDFI5MR.js';
 import { currentLink, execStartCommand } from './chunk-4IFKLYMM.js';
-import { detectMachine } from './chunk-PCADYUQT.js';
-import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-Z6SWQV77.js';
+import { detectMachine } from './chunk-6S3UEBLB.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-6WZKI6LQ.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-MLD2NA7N.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import { readJobFile } from './chunk-F4267APM.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-APBTVIM4.js';
+import { readJobFile } from './chunk-7I6GZSN3.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';

package/dist/{container-start-L6LCWH6Z.js → container-start-NRPEMKKE.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-QBENN6GA.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-PCADYUQT.js';
-import { MIN_ENGINE_MAJOR } from './chunk-Z6SWQV77.js';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-ARMZI56S.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-6S3UEBLB.js';
+import { MIN_ENGINE_MAJOR } from './chunk-6WZKI6LQ.js';
 import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import { isAgentName, AGENT_COMMANDS } from './chunk-5PMQDQFV.js';
 import './chunk-MLD2NA7N.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+import './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';

package/dist/{docker-FATVQG5M.js → docker-4X2A5HDY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { childEnvironment, createDockerHost, spawnRun } from './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+export { childEnvironment, createDockerHost, spawnRun } from './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';

package/dist/{doctor-EI22PDR5.js → doctor-AXJQQBKY.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launcherCheck } from './chunk-KDDFI5MR.js';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-Z453MOUL.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-TI33WRBT.js';
 import './chunk-4IFKLYMM.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-QBENN6GA.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-PCADYUQT.js';
-import { MIN_ENGINE_MAJOR, probeHelper, helperSocketPath } from './chunk-Z6SWQV77.js';
+import './chunk-ARMZI56S.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-6S3UEBLB.js';
+import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-6WZKI6LQ.js';
 import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import './chunk-5PMQDQFV.js';
 import './chunk-MLD2NA7N.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-F4267APM.js';
-import { locateRecipe, assertBuildable, readRecipe, RecipeError, CLAUDE_CODE_VERSION } from './chunk-APBTVIM4.js';
+import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-7I6GZSN3.js';
+import { locateRecipe, assertBuildable, readRecipe, RecipeError, FIRECRACKER_VERSION, CLAUDE_CODE_VERSION } from './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';
@@ -137,6 +137,9 @@ function helperCheck(facts) {
       fix: `run \`chmod 700 ${facts.writableBuildsDir}\``
     };
   }
+  if (facts.present && facts.firecracker !== FIRECRACKER_VERSION) {
+    return { name, status: "warn", detail: helperFirecrackerNote(facts.firecracker), fix: REINSTALL };
+  }
   if (facts.present) {
     return {
       name,

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-GD7F2EBL.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-ZBZFCRTK.js');
+var { runCli } = await import('./cli-CD4UNXBY.js');
 await runCli(process.argv);

package/dist/{init-MRREKVT5.js → init-5WVPLO3G.js}

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-YETTWTAY.js';
-import { RunnerInitError, readConfigObject } from './chunk-QBENN6GA.js';
-import './chunk-PCADYUQT.js';
-import './chunk-Z6SWQV77.js';
+import { RunnerInitError, readConfigObject } from './chunk-ARMZI56S.js';
+import './chunk-6S3UEBLB.js';
+import './chunk-6WZKI6LQ.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import './chunk-5PMQDQFV.js';
 import { checkFit, VM_SERVICE_NAME, RUNNER_RESERVE_BYTES } from './chunk-MLD2NA7N.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+import './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';

package/dist/{init-ZN47OUB3.js → init-IFQCZKY6.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-QBENN6GA.js';
-import './chunk-PCADYUQT.js';
-import './chunk-Z6SWQV77.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-ARMZI56S.js';
+import './chunk-6S3UEBLB.js';
+import './chunk-6WZKI6LQ.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import './chunk-5PMQDQFV.js';
 import './chunk-MLD2NA7N.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+import './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';

package/dist/{init-cmd-ZGQ6HMZD.js → init-cmd-KNYXSA6O.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-WXKAHUGA.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-XK7FRM5J.js';
 import './chunk-XFGL53GU.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-VJBFQP3H.js';

package/dist/{loop-JTKSTVDV.js → loop-HTWKPG3J.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick } from './chunk-WMEADVIX.js';
-import './chunk-CP24ZXXR.js';
+export { RunnerStartError, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick } from './chunk-DVAAATJP.js';
+import './chunk-4QKHBDEN.js';
 import './chunk-TKL74NLB.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-6FAP657M.js';
@@ -14,24 +14,24 @@ import './chunk-UNF7MWEL.js';
 import './chunk-ITP76BST.js';
 import './chunk-P7UQZFNY.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-Z453MOUL.js';
+import './chunk-TI33WRBT.js';
 import './chunk-4IFKLYMM.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-QBENN6GA.js';
-import './chunk-PCADYUQT.js';
-import './chunk-Z6SWQV77.js';
+import './chunk-ARMZI56S.js';
+import './chunk-6S3UEBLB.js';
+import './chunk-6WZKI6LQ.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import './chunk-5PMQDQFV.js';
 import './chunk-MLD2NA7N.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+import './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';

package/dist/{machine-RCIMAKOA.js → machine-AYYL2WXW.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-PCADYUQT.js';
-import './chunk-Z6SWQV77.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-6S3UEBLB.js';
+import './chunk-6WZKI6LQ.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+import './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';

package/dist/{runner-identity-C2O6Q3RR.js → runner-identity-NH6RLVMI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RUNNER_LABEL, builderNameFor, dockerIdentity, ensureRunnerIdentity, pathLabelValue, readRunnerIdentity } from './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+export { RUNNER_LABEL, builderNameFor, dockerIdentity, ensureRunnerIdentity, pathLabelValue, readRunnerIdentity } from './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';

package/dist/{runner-key-ENQLA4Q6.js → runner-key-3HAVHQZI.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-QBENN6GA.js';
-import './chunk-PCADYUQT.js';
-import './chunk-Z6SWQV77.js';
+import { readConfigObject, RunnerInitError } from './chunk-ARMZI56S.js';
+import './chunk-6S3UEBLB.js';
+import './chunk-6WZKI6LQ.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import './chunk-5PMQDQFV.js';
 import './chunk-MLD2NA7N.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+import './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import './chunk-WVM6PM2N.js';

package/dist/{status-OTZ3VX47.js → status-IAXWRX7B.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-CP24ZXXR.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-4QKHBDEN.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import './chunk-XBCJI6SV.js';
 import './chunk-2N72GPS2.js';
@@ -10,15 +10,15 @@ import './chunk-P7UQZFNY.js';
 import './chunk-ESVW4MJY.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import { LEASE_SECONDS } from './chunk-Z6SWQV77.js';
+import { LEASE_SECONDS } from './chunk-6WZKI6LQ.js';
 import { pullInstruction } from './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
-import './chunk-3RBQSPW5.js';
+import './chunk-AINUN2TT.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-F4267APM.js';
-import './chunk-APBTVIM4.js';
+import './chunk-7I6GZSN3.js';
+import './chunk-4R24DSL2.js';
 import './chunk-HPOEVC2V.js';
 import './chunk-XGJUNNXL.js';
 import { formatDuration, formatClock, relativeToRunner } from './chunk-WVM6PM2N.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.25.2",
-  "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, work, spec, runner, hooks, mcp, import, context. Capture and sync coding-agent sessions, and record proof of factory work.",
+  "version": "0.26.0",
+  "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",
   "repository": {

package/dist/import-capture-cmd-TCOKNVBM.js

@@ -1,73 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { C } from './chunk-ANPNT6PM.js';
-import { skillsBaseFor, isAgentsMdLayout } from './chunk-JKNYTNYD.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
-import { cliInvocation } from './chunk-CRB3POP4.js';
-import './chunk-RKOTJQVG.js';
-import './chunk-QZBXLLTV.js';
-import './chunk-VNVZDWO3.js';
-import './chunk-RA3O54FC.js';
-import './chunk-Z5GEFMRW.js';
-import { statSync, existsSync, readFileSync, writeFileSync } from 'fs';
-import { join } from 'path';
-
-createRequire(import.meta.url);
-var ImportCaptureError = class extends Error {
-};
-var SNIPPET_FILE = "outerlayer-evidence/references/agents-snippet.md";
-var AGENTS_MD_MARKER = "<!-- outerlayer:capture-pack -->";
-function runImportCapture(opts = {}) {
-  const cwd = opts.cwd ?? process.cwd();
-  let cwdStat;
-  try {
-    cwdStat = statSync(cwd);
-  } catch {
-    throw new ImportCaptureError(`no such directory: ${cwd}`);
-  }
-  if (!cwdStat.isDirectory()) throw new ImportCaptureError(`not a directory: ${cwd}`);
-  const base = skillsBaseFor(cwd);
-  const SNIPPET_PATH = `${base}/${SNIPPET_FILE}`;
-  const AGENTS_MD_PATH = isAgentsMdLayout(cwd) ? "AGENTS.md" : ".outerlayer/AGENTS.md";
-  const bundle = loadMaintainedFiles(void 0, void 0, base);
-  const { created: files, rewritten } = writeMaintainedFiles(cwd, bundle);
-  const snippet = bundle.find((f) => f.path === SNIPPET_PATH)?.content ?? "";
-  let appendedAgentsMd = false;
-  const agentsMdAbs = join(cwd, AGENTS_MD_PATH);
-  if (existsSync(agentsMdAbs)) {
-    const existing = readFileSync(agentsMdAbs, "utf8");
-    if (!existing.includes(AGENTS_MD_MARKER)) {
-      writeFileSync(agentsMdAbs, existing + "\n" + snippet);
-      appendedAgentsMd = true;
-    }
-  }
-  let output;
-  if (opts.json) {
-    output = JSON.stringify({ files, rewritten, appendedAgentsMd });
-  } else {
-    const lines = [
-      ...files.map((f) => `${C.green}\u2713${C.reset} wrote ${f}`),
-      ...rewritten.map((f) => `${C.yellow}!${C.reset} rewrote ${f} to match this CLI's bundle (local edits were overwritten)`)
-    ];
-    if (appendedAgentsMd) lines.push(`${C.green}\u2713${C.reset} appended the evidence snippet to ${AGENTS_MD_PATH}`);
-    if (files.length === 0 && rewritten.length === 0 && !appendedAgentsMd) {
-      lines.push(`${C.dim}capture pack already installed \u2014 nothing to write${C.reset}`);
-    }
-    if (!isAgentsMdLayout(cwd)) {
-      lines.push(`Run ${C.yellow}\`${cliInvocation()} context emit\`${C.reset} to compile the pack into your agent's native files.`);
-    }
-    output = lines.join("\n");
-  }
-  if (!opts.quiet) {
-    process.stdout.write(output + "\n");
-    if (!opts.json && !appendedAgentsMd && !existsSync(agentsMdAbs)) {
-      process.stdout.write(
-        `${C.dim}  no ${AGENTS_MD_PATH} to append to \u2014 paste ${SNIPPET_PATH} into your instructions file if your harness reads no skills${C.reset}
-`
-      );
-    }
-  }
-  return { files, rewritten, appendedAgentsMd, output };
-}
-
-export { ImportCaptureError, runImportCapture };

package/dist/import-ruler-cmd-VJOHOJQ7.js

@@ -1,173 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { C } from './chunk-ANPNT6PM.js';
-import './chunk-CRB3POP4.js';
-import { normalizePath } from './chunk-RKOTJQVG.js';
-import './chunk-QZBXLLTV.js';
-import './chunk-VNVZDWO3.js';
-import './chunk-Z5GEFMRW.js';
-import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
-import { join, dirname } from 'path';
-
-createRequire(import.meta.url);
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
-var ImportRulerError = class extends Error {
-};
-function toRepoRelative(base, name) {
-  return normalizePath(`${base}/${name}`);
-}
-function discoverRulerDirs(repoRoot) {
-  const out = [];
-  walk(repoRoot, repoRoot, "", out);
-  return out.sort();
-}
-function walk(dirAbs, repoRoot, dirRel, out) {
-  let entries;
-  try {
-    entries = readdirSync(dirAbs, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (entry.isSymbolicLink() || !entry.isDirectory()) continue;
-    if (SKIP_DIRS.has(entry.name)) continue;
-    const childRel = dirRel === "" ? entry.name : toRepoRelative(dirRel, entry.name);
-    if (entry.name === ".ruler") {
-      out.push(childRel);
-      continue;
-    }
-    walk(join(dirAbs, entry.name), repoRoot, childRel, out);
-  }
-}
-function collectFilesRecursively(dirAbs, dirRel) {
-  const out = [];
-  let entries;
-  try {
-    entries = readdirSync(dirAbs, { withFileTypes: true });
-  } catch {
-    return out;
-  }
-  for (const entry of entries) {
-    if (entry.isSymbolicLink()) continue;
-    const childRel = toRepoRelative(dirRel, entry.name);
-    const childAbs = join(dirAbs, entry.name);
-    if (entry.isDirectory()) out.push(...collectFilesRecursively(childAbs, childRel));
-    else if (entry.isFile()) out.push(childRel);
-  }
-  return out;
-}
-function catalogRulerDir(repoRoot, rulerDirRel) {
-  const abs = join(repoRoot, rulerDirRel);
-  const catalog = { otherMd: [], unmapped: [] };
-  const mdFilenames = [];
-  let entries;
-  try {
-    entries = readdirSync(abs, { withFileTypes: true });
-  } catch {
-    entries = [];
-  }
-  for (const entry of entries) {
-    if (entry.isSymbolicLink()) continue;
-    const childRel = toRepoRelative(rulerDirRel, entry.name);
-    if (entry.isDirectory()) {
-      catalog.unmapped.push(...collectFilesRecursively(join(abs, entry.name), childRel));
-      continue;
-    }
-    if (!entry.isFile()) continue;
-    if (entry.name === "AGENTS.md") catalog.agentsMd = readFileSync(join(abs, entry.name), "utf8");
-    else if (entry.name === "mcp.json") catalog.mcpJson = readFileSync(join(abs, entry.name), "utf8");
-    else if (entry.name === "ruler.toml") catalog.rulerTomlPath = childRel;
-    else if (entry.name.endsWith(".md")) mdFilenames.push(entry.name);
-    else catalog.unmapped.push(childRel);
-  }
-  catalog.otherMd = mdFilenames.sort((a, b) => a.localeCompare(b)).map((filename) => ({ filename, content: readFileSync(join(abs, filename), "utf8") }));
-  return catalog;
-}
-function scopeOf(rulerDirRel) {
-  if (rulerDirRel === ".ruler") return "";
-  return rulerDirRel.slice(0, rulerDirRel.length - "/.ruler".length);
-}
-function outerlayerDirFor(scopePath) {
-  return scopePath === "" ? ".outerlayer" : `${scopePath}/.outerlayer`;
-}
-function writeOutFile(repoRoot, relPath, content) {
-  const abs = join(repoRoot, relPath);
-  mkdirSync(dirname(abs), { recursive: true });
-  writeFileSync(abs, content);
-}
-function renderSuccess(scopes, warnings) {
-  const warningSuffix = warnings.length > 0 ? `, ${warnings.length} warning${warnings.length === 1 ? "" : "s"}` : "";
-  const lines = [`${C.green}\u2713${C.reset} imported ${scopes.length} .ruler/ scope${scopes.length === 1 ? "" : "s"}${warningSuffix}`];
-  for (const s of scopes) {
-    const written = [s.agentsMdWritten, s.mcpWritten].filter((p) => p !== void 0);
-    lines.push(`  ${C.dim}${s.scopePath === "" ? "(root)" : s.scopePath}${C.reset} \u2192 ${written.join(", ") || "nothing to import"}`);
-  }
-  return lines.join("\n");
-}
-function runImportRuler(opts = {}) {
-  const cwd = opts.cwd ?? process.cwd();
-  if (!existsSync(cwd)) throw new ImportRulerError(`no such directory: ${cwd}`);
-  const rulerDirs = discoverRulerDirs(cwd);
-  if (rulerDirs.length === 0) {
-    const output2 = opts.json ? JSON.stringify({ scopes: [], warnings: [] }) : `${C.dim}no .ruler/ directories found \u2014 nothing to import${C.reset}`;
-    if (!opts.quiet) process.stdout.write(output2 + "\n");
-    return { scopes: [], warnings: [], output: output2, exitCode: 0 };
-  }
-  const conflicts = rulerDirs.map((rel) => outerlayerDirFor(scopeOf(rel))).filter((outerlayerRel) => existsSync(join(cwd, outerlayerRel)));
-  if (conflicts.length > 0) {
-    throw new ImportRulerError(
-      `refusing to import \u2014 .outerlayer/ already exists at: ${conflicts.join(", ")} (never overwritten; remove it first to replace it)`
-    );
-  }
-  const scopes = [];
-  const warnings = [];
-  for (const rulerDirRel of rulerDirs) {
-    const scopePath = scopeOf(rulerDirRel);
-    const outerlayerRel = outerlayerDirFor(scopePath);
-    const catalog = catalogRulerDir(cwd, rulerDirRel);
-    const scope = { scopePath };
-    if (catalog.agentsMd !== void 0 || catalog.otherMd.length > 0) {
-      let content = catalog.agentsMd ?? "";
-      for (const { filename, content: mdContent } of catalog.otherMd) {
-        content += `
-
-<!-- imported from .ruler/${filename} -->
-
-${mdContent}`;
-      }
-      const agentsPath = toRepoRelative(outerlayerRel, "AGENTS.md");
-      writeOutFile(cwd, agentsPath, content);
-      scope.agentsMdWritten = agentsPath;
-    }
-    if (catalog.mcpJson !== void 0) {
-      const mcpPath = toRepoRelative(outerlayerRel, "mcp.json");
-      writeOutFile(cwd, mcpPath, catalog.mcpJson);
-      scope.mcpWritten = mcpPath;
-    }
-    if (catalog.rulerTomlPath !== void 0) {
-      warnings.push({
-        code: "ruler_toml_not_imported",
-        path: catalog.rulerTomlPath,
-        message: `${catalog.rulerTomlPath} was not imported \u2014 target selection now lives in .outerlayer/config.json; per-tool config is superseded`
-      });
-    }
-    for (const path of catalog.unmapped) {
-      warnings.push({ code: "unmapped_file", path, message: `${path} has no .outerlayer/ equivalent \u2014 not imported` });
-    }
-    scopes.push(scope);
-  }
-  warnings.sort((a, b) => a.path.localeCompare(b.path));
-  const output = opts.json ? JSON.stringify({ scopes, warnings }) : renderSuccess(scopes, warnings);
-  if (!opts.quiet) {
-    if (opts.json) {
-      process.stdout.write(output + "\n");
-    } else {
-      process.stdout.write(output + "\n");
-      for (const w of warnings) process.stderr.write(`  ${C.yellow}!${C.reset} ${w.path}: ${w.message}
-`);
-    }
-  }
-  return { scopes, warnings, output, exitCode: 0 };
-}
-
-export { ImportRulerError, runImportRuler };