@outerlayer/cli 0.26.0 → 0.26.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @outerlayer/cli
 
+## 0.26.2
+
+### Patch Changes
+
+- 7c8012c: The hooks that `outerlayer init --org` prints, and the hooks and status line that `outerlayer init --project` and `outerlayer hooks wrap --project` write, run `outerlayer` from the PATH. They work on every machine, instead of naming the install path of the machine that wrote them. The `--org` snippet also names the Windows registry value, `Settings`, and says to install the CLI on each machine.
+- 3c1d9ee: A microVM build powers off when its lease runs out with no runner renewing it. A build started through the root helper ends at `runner.timeLimitMinutes` plus 10 minutes, even when no runner stops it.
+
+## 0.26.1
+
+### Patch Changes
+
+- a5a32a4: Pin a saved credential to its own gateway. A login or API key stored in the
+  config file is now sent only to the gateway address it was created for. If
+  `OUTERLAYER_URL` or `--url` names a different host and no key is supplied for
+  that call, the command refuses instead of sending the saved credential — and
+  the session transcripts a sync carries with it — to a host you did not choose.
+  To reach a different gateway, pass its own key: `--url <addr> --api-key <key>`,
+  or set `OUTERLAYER_API_KEY` beside `OUTERLAYER_URL`.
+
 ## 0.26.0
 
 ### Minor Changes

package/README.md

@@ -234,7 +234,9 @@ content:
   With the root helper installed, the runner asks it over a Unix socket that only
   the runner's account can open to start each microVM build under Firecracker's
   jailer. That socket is local, and nothing about the host leaves the machine
-  through it.
+  through it. The runner also serves a lease socket in each build's directory,
+  which the guest reaches over vsock. The runner writes only the time left on
+  the build's lease to it, and the guest powers off when that time runs out.
 - **`outerlayer runner install --service` with `builtin:vm` hooks** downloads the
   root helper from github.com on each install, from the same public guest assets
   repository, and checks it against a sha256 pinned in the CLI. The request

package/dist/{agent-setup-YHFZB2BC.js → agent-setup-PZYQWN4H.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-H3AEZIYB.js';
+export { keepHandWritten, runAgentSetup } from './chunk-6M4LNO22.js';
 import './chunk-WX2WEERU.js';
 import './chunk-VJBFQP3H.js';
-import './chunk-D4UDE2AP.js';
+import './chunk-W3NVHOCS.js';
 import './chunk-MQ743JX3.js';
-import './chunk-GJZEUQ6D.js';
+import './chunk-QRZLUUNN.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-YVZJ6GKF.js';

package/dist/{build-JK2DLT6X.js → build-AW4A2QPK.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-AINUN2TT.js';
+export { buildRepositoryImage } from './chunk-DJILFADE.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
-export { RecipeError } from './chunk-4R24DSL2.js';
+export { RecipeError } from './chunk-FI66JNLT.js';
 import './chunk-L4CW6LZQ.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-16T14:55:16.789Z+b8b6796","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-16T18:16:32.915Z+7b81ff6","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-TMA25KRR.js → builder-TDCBQ2RD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-7I6GZSN3.js';
-import './chunk-4R24DSL2.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-KZLLLARE.js';
+import './chunk-FI66JNLT.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';

package/dist/{check-FAGTKWHT.js → check-KL3LDAI3.js}

@@ -1,55 +1,55 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-DVAAATJP.js';
-import './chunk-4QKHBDEN.js';
+import { probeCredentials } from './chunk-6OYAW5SF.js';
+import './chunk-OL2O5PEI.js';
 import './chunk-TKL74NLB.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-6FAP657M.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
 import './chunk-TPKYTORP.js';
-import './chunk-XBCJI6SV.js';
-import './chunk-2N72GPS2.js';
+import './chunk-V5LUWRCV.js';
+import './chunk-MWPBF2XG.js';
 import './chunk-UNF7MWEL.js';
-import './chunk-ITP76BST.js';
-import './chunk-P7UQZFNY.js';
+import './chunk-U2FSJBNI.js';
+import './chunk-EORWWFPA.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-TI33WRBT.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-TODY3MTS.js';
 import './chunk-4IFKLYMM.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-ARMZI56S.js';
-import './chunk-6S3UEBLB.js';
-import './chunk-6WZKI6LQ.js';
+import './chunk-PCY7IGSL.js';
+import './chunk-RO3BRAO6.js';
+import './chunk-GUT4IU7K.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import './chunk-5PMQDQFV.js';
 import './chunk-MLD2NA7N.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-AINUN2TT.js';
+import './chunk-DJILFADE.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-7I6GZSN3.js';
-import './chunk-4R24DSL2.js';
-import './chunk-HPOEVC2V.js';
-import './chunk-XGJUNNXL.js';
-import './chunk-WVM6PM2N.js';
-import './chunk-DZUANBKP.js';
-import './chunk-FQCLEH34.js';
-import './chunk-G2T4HCGT.js';
+import './chunk-KZLLLARE.js';
+import './chunk-FI66JNLT.js';
+import './chunk-MXTN35XN.js';
+import './chunk-XLC7KEUV.js';
+import './chunk-DXHISLCI.js';
+import './chunk-GMPXOQTH.js';
+import './chunk-HXFRJKMU.js';
+import './chunk-TEVO3RUV.js';
 import './chunk-BUP5N3X6.js';
 import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-JWRX5ZTT.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-D4UDE2AP.js';
+import './chunk-W3NVHOCS.js';
 import './chunk-MQ743JX3.js';
-import './chunk-GJZEUQ6D.js';
-import './chunk-C3AMVSMS.js';
+import './chunk-QRZLUUNN.js';
+import './chunk-2EAVBJMO.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-DYEFPYME.js';
+import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-VPEGE3QZ.js';
 import './chunk-HCVLP7XA.js';
@@ -62,7 +62,7 @@ import './chunk-HBISTTG3.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
-import './chunk-GNPTU4BM.js';
+import './chunk-URIZRCRY.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
 import './chunk-RKOTJQVG.js';

package/dist/{chunk-C3AMVSMS.js → chunk-2EAVBJMO.js}

@@ -429,7 +429,7 @@ async function handleWorkLaunch(sessionId, home, env, spawnImpl = spawnDetached,
 }
 async function missingRenewalHookContext(home, cwd) {
   try {
-    const { settingsPath, readSettings, isOurHookCommand } = await import('./settings-AKYEOCC2.js');
+    const { settingsPath, readSettings, isOurHookCommand } = await import('./settings-3DBYKYQD.js');
     const userSettings = readSettings(settingsPath("user", { home }));
     const projectSettings = readSettings(settingsPath("project", { cwd }));
     if (userSettings === null && projectSettings === null) return void 0;
@@ -628,7 +628,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-FRK5IZXC.js');
+  const { governanceOf } = await import('./control-plane-launch-654RV5PO.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-DYEFPYME.js → chunk-2O5KA67H.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { decodeWrappedCommand } from './chunk-GNPTU4BM.js';
+import { decodeWrappedCommand } from './chunk-URIZRCRY.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, appendFileSync, writeFileSync } from 'fs';
 import { spawn } from 'child_process';

package/dist/{chunk-H3AEZIYB.js → chunk-6M4LNO22.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { runEmit } from './chunk-WX2WEERU.js';
 import { installStarterPack } from './chunk-VJBFQP3H.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-D4UDE2AP.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-W3NVHOCS.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-JKNYTNYD.js';

package/dist/{chunk-DVAAATJP.js → chunk-6OYAW5SF.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-4QKHBDEN.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-OL2O5PEI.js';
 import { writePendingUpdate } from './chunk-TKL74NLB.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-6FAP657M.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-TI33WRBT.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-TODY3MTS.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-4IFKLYMM.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-6WZKI6LQ.js';
+import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-GUT4IU7K.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-665QWBNW.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { checkFit } from './chunk-MLD2NA7N.js';
 import { claimPidFile, readPidFile, releasePidFile } from './chunk-PYSKSROG.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-7I6GZSN3.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-WVM6PM2N.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DZUANBKP.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-KZLLLARE.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-DXHISLCI.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-GMPXOQTH.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWRX5ZTT.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -1057,6 +1057,9 @@ function attemptLogsOf(state) {
 function nowOf(state) {
   return (state.deps.now ?? (() => /* @__PURE__ */ new Date()))();
 }
+function leaseTimeLeftFor(state, active) {
+  return () => (state.deps.leaseTimeLeftMs ?? leaseTimeLeftMs)(active.job, nowOf(state).getTime());
+}
 function runtimeOf(state) {
   state.containerRuntime ??= createContainerRuntime(state.deps.container);
   return state.containerRuntime;
@@ -1746,7 +1749,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-C3CFJZYD.js');
+  const { postJson: postJson2 } = await import('./work-cmd-SJB6N6FZ.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2030,7 +2033,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       aborted: () => active.ending,
       deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
       fetchImpl: state.deps.fetchImpl,
-      now: state.deps.now
+      now: state.deps.now,
+      leaseTimeLeftMs: leaseTimeLeftFor(state, active)
     }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
@@ -2430,6 +2434,7 @@ async function renewLeaseIfDue(state, active, nowMs) {
     writeJobFile(join(active.dirPath, "job.json"), active.job);
     log.line(`${tag} lease renewed \xB7 expires ${formatClock(new Date(nowMs + LEASE_SECONDS * 1e3), new Date(nowMs))}`);
     if (active.job.container !== void 0) state.containerRuntime?.leases.get(active.job.container.buildId)?.publish();
+    if (active.job.microvm !== void 0) state.containerRuntime?.leases.get(active.job.microvm.buildId)?.publish();
   } else {
     log.error(`${tag} renew did not land \xB7 retrying in ${RENEW_INTERVAL_SECONDS / 60}m`);
   }
@@ -2730,7 +2735,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-FAGTKWHT.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-KL3LDAI3.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -3015,4 +3020,4 @@ function runnerProcessState(configPath) {
   return isSameProcess(entry.pid, entry.start) ? { state: "running", pid: entry.pid } : { state: "stale", pid: entry.pid };
 }
 
-export { RunnerStartError, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick };
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick };

package/dist/{chunk-AINUN2TT.js → chunk-DJILFADE.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-PYSKSROG.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-4R24DSL2.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-FI66JNLT.js';
 import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
 import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-2K3TCQHW.js';
 import { RELAY_ID, RELAY_USER } from './chunk-JGD5TWQ2.js';

package/dist/{chunk-WVM6PM2N.js → chunk-DXHISLCI.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-DZUANBKP.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-D4UDE2AP.js';
-import { signingFetchFor } from './chunk-GJZEUQ6D.js';
+import { WorkCommandError, postJson } from './chunk-GMPXOQTH.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-W3NVHOCS.js';
+import { signingFetchFor } from './chunk-QRZLUUNN.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-VPEGE3QZ.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';

package/dist/{chunk-P7UQZFNY.js → chunk-EORWWFPA.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-FQCLEH34.js';
+import { autoConnect, detectActiveSession } from './chunk-HXFRJKMU.js';
 import { acquireSpoolLockAt } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-GJZEUQ6D.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QRZLUUNN.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-4R24DSL2.js → chunk-FI66JNLT.js}

@@ -249,13 +249,13 @@ var FIRECRACKER_SHA256 = {
 var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
-var GUEST_ASSETS_VERSION = "1";
+var GUEST_ASSETS_VERSION = "6";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
   x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
 };
 var GUEST_HELPER_SHA256 = {
-  x86_64: "4175e89ae8cb633113b5f69ef8b6e206093954411fe53edf86357bc1b7e822f9"
+  x86_64: "0ae934d3ad3f2a94abffcc3f044ba633b1a523dc17ff0c2bc322ed7d7fc505ea"
 };
 function guestAssetsPinned(arch) {
   const zero = "0".repeat(64);
@@ -264,10 +264,10 @@ function guestAssetsPinned(arch) {
 var JAILER_BINARY_SHA256 = {
   x86_64: "65ef226e96f0ceda55ba643f445801ef2cc0ea667ef67cad8ac4f406c9c8434f"
 };
-var HOST_HELPER_ASSETS_VERSION = "4";
+var HOST_HELPER_ASSETS_VERSION = "5";
 var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;
 var HOST_HELPER_SHA256 = {
-  x86_64: "5c9d9e46daf165411ebe594fa28f4adc6b363989d77673c7651ab6dccb808684"
+  x86_64: "f2ec1c6a7ff29353045fad617ac1a6bf0155d6f3eb6a6259272a15342feaf957"
 };
 function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
   return hashes[arch] !== "0".repeat(64);

package/dist/{chunk-DZUANBKP.js → chunk-GMPXOQTH.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-FQCLEH34.js';
-import { workPageUrl } from './chunk-G2T4HCGT.js';
+import { detectActiveSession, autoConnect } from './chunk-HXFRJKMU.js';
+import { workPageUrl } from './chunk-TEVO3RUV.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-GJZEUQ6D.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-QRZLUUNN.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
@@ -428,7 +428,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-GD7F2EBL.js');
+      const { logHookError } = await import('./hook-fast-LZSHEKUA.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-6WZKI6LQ.js → chunk-GUT4IU7K.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-AINUN2TT.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-DJILFADE.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-7I6GZSN3.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-4R24DSL2.js';
-import { execCapture } from './chunk-HPOEVC2V.js';
-import { GUEST_CID } from './chunk-XGJUNNXL.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-WVM6PM2N.js';
-import { WorkCommandError } from './chunk-DZUANBKP.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-KZLLLARE.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-FI66JNLT.js';
+import { execCapture } from './chunk-MXTN35XN.js';
+import { GUEST_CID } from './chunk-XLC7KEUV.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-DXHISLCI.js';
+import { WorkCommandError } from './chunk-GMPXOQTH.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-VPEGE3QZ.js';
@@ -196,8 +196,8 @@ function ask(socketPath, request, timeoutMs) {
 function helperClient(socketPath, options = {}) {
   const REQUEST_TIMEOUT_MS = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
   return {
-    async start({ build, kind }) {
-      const reply = await ask(socketPath, { v: 1, op: "start", build, kind }, START_TIMEOUT_MS);
+    async start({ build, kind, timeLimitMinutes }) {
+      const reply = await ask(socketPath, { v: 1, op: "start", build, kind, timeLimitMinutes }, START_TIMEOUT_MS);
       return { unit: String(reply.unit), chroot: String(reply.chroot), vsock: String(reply.vsock) };
     },
     async stop(build) {
@@ -412,11 +412,14 @@ function leaseExpiresAtMs(job) {
   const base = Date.parse(job.lastRenewAt ?? job.startedAt);
   return (Number.isFinite(base) ? base : Date.now()) + LEASE_SECONDS * 1e3;
 }
-function createLeaseChannel(expiryMs) {
+function leaseTimeLeftMs(job, nowMs) {
+  return Math.max(0, leaseExpiresAtMs(job) - nowMs);
+}
+function createLeaseChannel(valueMs) {
   const open = /* @__PURE__ */ new Set();
   let stopped = false;
   const write = (stream) => {
-    if (!stopped && !stream.destroyed && stream.writable) stream.write(`${Math.floor(expiryMs())}
+    if (!stopped && !stream.destroyed && stream.writable) stream.write(`${Math.floor(valueMs())}
 `);
   };
   return {
@@ -829,6 +832,7 @@ function machineConfig(limits2, paths) {
     "rootfstype=ext4",
     `init=${INIT}`,
     ...paths.relayPorts.length === 0 ? [] : [`outerlayer.relay=${paths.relayPorts.join(",")}`],
+    ...paths.leasePort === void 0 ? [] : [`outerlayer.lease=${paths.leasePort}`],
     ...paths.docker === true ? ["outerlayer.docker=1"] : []
   ];
   return {
@@ -3311,4 +3315,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };

package/dist/{chunk-FQCLEH34.js → chunk-HXFRJKMU.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-G2T4HCGT.js';
-import { resolveGatewayCredentials } from './chunk-GJZEUQ6D.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-TEVO3RUV.js';
+import { resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-DXDF43YG.js → chunk-I7RZHMXW.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { recordReportedCost } from './chunk-BKO6JEZI.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { decodeWrappedCommand } from './chunk-GNPTU4BM.js';
+import { decodeWrappedCommand } from './chunk-URIZRCRY.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync } from 'fs';
 import { spawn } from 'child_process';

package/dist/{chunk-7I6GZSN3.js → chunk-KZLLLARE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError, BUILDKIT_IMAGE } from './chunk-4R24DSL2.js';
+import { RecipeError, BUILDKIT_IMAGE } from './chunk-FI66JNLT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { compareVersions } from './chunk-QE3UQAHK.js';
 import { ensureHostKey } from './chunk-F6DIHHBS.js';

package/dist/{chunk-2N72GPS2.js → chunk-MWPBF2XG.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-UNF7MWEL.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { EXEC_PORT } from './chunk-XGJUNNXL.js';
+import { EXEC_PORT } from './chunk-XLC7KEUV.js';
 import { RELAY_PORT } from './chunk-2K3TCQHW.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';

package/dist/{chunk-HPOEVC2V.js → chunk-MXTN35XN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-XGJUNNXL.js';
+import { EXEC_PORT } from './chunk-XLC7KEUV.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);
@@ -41,8 +41,8 @@ var FrameDecoder = class {
   }
 };
 function encodeRequest(request) {
-  const { argv, user, cwd, env } = request;
-  return Buffer.from(JSON.stringify({ argv, user, cwd, env }), "utf8");
+  const { argv, user, cwd, env, detach } = request;
+  return Buffer.from(JSON.stringify({ argv, user, cwd, env, ...detach === void 0 ? {} : { detach } }), "utf8");
 }
 function decodeExit(payload) {
   if (payload.length !== 4) throw new ProtocolError(`an exit frame holds ${payload.length} bytes, not 4`);