@outerlayer/cli 0.26.0 → 0.26.2

package/dist/{chunk-4QKHBDEN.js → chunk-OL2O5PEI.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { senderPidfile } from './chunk-XBCJI6SV.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-2N72GPS2.js';
+import { senderPidfile } from './chunk-V5LUWRCV.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-MWPBF2XG.js';
 import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
-import { installScrubContext } from './chunk-ITP76BST.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-6WZKI6LQ.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-AINUN2TT.js';
+import { installScrubContext } from './chunk-U2FSJBNI.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-GUT4IU7K.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-DJILFADE.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-7I6GZSN3.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-4R24DSL2.js';
-import { waitForAgent, vmExecArgs } from './chunk-HPOEVC2V.js';
-import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-XGJUNNXL.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-WVM6PM2N.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-DZUANBKP.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-KZLLLARE.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-FI66JNLT.js';
+import { waitForAgent, vmExecArgs } from './chunk-MXTN35XN.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-XLC7KEUV.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-DXHISLCI.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-GMPXOQTH.js';
 import { planArtifactUpload } from './chunk-BUP5N3X6.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
@@ -31,6 +31,8 @@ import { existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSy
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
 import { randomBytes, createHash } from 'crypto';
+import { once } from 'events';
+import { createServer } from 'net';
 import { pathToFileURL } from 'url';
 
 createRequire(import.meta.url);
@@ -95,6 +97,21 @@ function judgeProbe(probe, missedBefore) {
   if (probe.alive) return { kind: "running" };
   return missedBefore ? { kind: "lost" } : { kind: "recheck" };
 }
+async function serveLease(socketPath, channel, makeServer = createServer) {
+  const server = makeServer((socket) => channel.accept(socket));
+  rmSync(socketPath, { force: true });
+  server.listen(socketPath);
+  await once(server, "listening");
+  server.on("error", () => void 0);
+  return {
+    ...channel,
+    close() {
+      channel.close();
+      server.close();
+      rmSync(socketPath, { force: true });
+    }
+  };
+}
 function unitNameFor(buildId) {
   return `outerlayer-build-${buildId}`;
 }
@@ -121,7 +138,7 @@ async function startJailed(input) {
       if (err.code !== "ENOENT") throw err;
     }
   }
-  return input.client.start({ build: input.buildId, kind: input.kind });
+  return input.client.start({ build: input.buildId, kind: input.kind, ...input.timeLimitMinutes === void 0 ? {} : { timeLimitMinutes: input.timeLimitMinutes } });
 }
 async function startJailedInto(state, input, save) {
   state.jailed = { unit: unitNameFor(state.buildId), chroot: "" };
@@ -358,15 +375,33 @@ async function provisionMicroVm(input) {
     diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: true });
+  const served = input.leaseTimeLeftMs === void 0 ? links : [...links, LEASE_LINK];
+  if (input.leaseTimeLeftMs !== void 0) {
+    try {
+      const channel = createLeaseChannel(input.leaseTimeLeftMs);
+      const served2 = await serveLease(join(buildDir2, LEASE_LINK.socket), { ...channel, accept: (stream) => runtime.leases.get(buildId)?.accept(stream) });
+      runtime.leases.set(buildId, { ...channel, close: served2.close });
+    } catch (err) {
+      return bail(`the lease stream could not start: ${describeCallFailure(err)}`);
+    }
+  }
   const configPath = join(buildDir2, "vm.json");
   const helper = await helperFor(runtime, (line) => log.line(`${tag} ${line}`));
   try {
-    if (helper === void 0) linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
+    if (helper === void 0) linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links: served });
     await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
     writeFileSync(
       configPath,
       JSON.stringify(
-        machineConfig(limits, { kernel: assets.kernel, rootfs: state.rootfs, buildDisk: state.buildDisk, vsock: state.vsockPath, relayPorts: links.map((link) => link.port), docker: report.docker }),
+        machineConfig(limits, {
+          kernel: assets.kernel,
+          rootfs: state.rootfs,
+          buildDisk: state.buildDisk,
+          vsock: state.vsockPath,
+          relayPorts: links.map((link) => link.port),
+          ...input.leaseTimeLeftMs === void 0 ? {} : { leasePort: LEASE_LINK.port },
+          docker: report.docker
+        }),
         null,
         2
       ),
@@ -387,7 +422,11 @@ async function provisionMicroVm(input) {
   const consolePath = join(jobDir, "vm-console.log");
   if (helper !== void 0) {
     try {
-      await startJailedInto(state, { client: helper, kind: "build", kernel: assets.kernel, rootfs: state.rootfs, sockets: links.map((link) => link.socket) }, () => input.save(state, environment));
+      await startJailedInto(
+        state,
+        { client: helper, kind: "build", kernel: assets.kernel, rootfs: state.rootfs, sockets: served.map((link) => link.socket), timeLimitMinutes: config.timeLimitMinutes },
+        () => input.save(state, environment)
+      );
     } catch (err) {
       return bail(`the microVM did not start under the jailer: ${describeCallFailure(err)}`);
     }
@@ -813,7 +852,11 @@ async function startCheckMicroVm(input) {
   const boot = async () => {
     if (helper !== void 0) {
       try {
-        await startJailedInto(state, { client: helper, kind: "check", kernel: assets.kernel, rootfs: state.rootfs, sockets: links.map((link) => link.socket) }, () => input.save(state));
+        await startJailedInto(
+          state,
+          { client: helper, kind: "check", kernel: assets.kernel, rootfs: state.rootfs, sockets: links.map((link) => link.socket), timeLimitMinutes: config.timeLimitMinutes },
+          () => input.save(state)
+        );
       } catch (err) {
         return `the microVM did not start under the jailer: ${describeCallFailure(err)}`;
       }
@@ -903,6 +946,8 @@ async function cleanupMicroVm(runtime, state, jobDir) {
     }
   }
   if (state.buildDisk !== void 0) deleteBuildDisk(state.buildDisk);
+  runtime.leases.get(state.buildId)?.close();
+  runtime.leases.delete(state.buildId);
   const tunnel = runtime.tunnels.get(state.buildId);
   if (tunnel !== void 0) {
     runtime.tunnels.delete(state.buildId);

package/dist/{chunk-ARMZI56S.js → chunk-PCY7IGSL.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-6S3UEBLB.js';
-import { MIN_ENGINE_MAJOR } from './chunk-6WZKI6LQ.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RO3BRAO6.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GUT4IU7K.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-5PMQDQFV.js';
 import { runnerCredentialProblem } from './chunk-JWRX5ZTT.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';

package/dist/{chunk-GJZEUQ6D.js → chunk-QRZLUUNN.js}

@@ -13,7 +13,15 @@ createRequire(import.meta.url);
 var MISSING_HELP = `Run \`${cliInvocation()} login\` to sign in, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`;
 var NO_FACTORY_MESSAGE = `you are logged in, but no factory is chosen for this repository. Run \`${cliInvocation()} connect\` to choose one, or pass --app-id / set OUTERLAYER_APP_ID.`;
 var NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE = "you are logged in, but this directory is not in a git repository, so no factory is chosen. Pass --app-id / set OUTERLAYER_APP_ID, or run this from inside a connected repository.";
+var ORIGIN_MISMATCH_MESSAGE = "the gateway address is not the one your saved credential belongs to. A saved login or key is only sent to the address it was created for, so nothing can redirect it \u2014 or the session transcripts a sync carries with it \u2014 to a host set through OUTERLAYER_URL or --url. To call a different gateway, pass its own key too: --url <addr> --api-key <key>, or set OUTERLAYER_API_KEY beside OUTERLAYER_URL.";
 var LOGIN_TOKEN_PREFIX = "olu_";
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
 function unauthorizedMessage(credential) {
   return credential.startsWith(LOGIN_TOKEN_PREFIX) ? `not authorized \u2014 the login is expired or was revoked. Run \`${cliInvocation()} login\` to sign in again.` : "not authorized \u2014 the API key is unknown, expired, or bound to a different factory. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.";
 }
@@ -26,6 +34,11 @@ function resolveGatewayCredentials(sources = {}) {
   const credential = key ?? config.accountToken;
   const cwd = sources.cwd ?? process.cwd();
   const appId = sources.appId ?? (env.OUTERLAYER_APP_ID || void 0) ?? (kind === "key" ? config.appId : readRepoConnection(cwd)?.appId);
+  const suppliedKey = sources.apiKey !== void 0 || Boolean(env.OUTERLAYER_API_KEY);
+  const savedCredential = credential != null && !suppliedKey && (credential === config.apiKey || credential === config.accountToken);
+  if (savedCredential && url && config.url && !sameOrigin(url, config.url)) {
+    return { ok: false, message: ORIGIN_MISMATCH_MESSAGE, url, credential, appId, kind };
+  }
   if (credential && url && !appId && kind === "login") {
     const message = findGitDirs(cwd) === void 0 ? NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE : NO_FACTORY_MESSAGE;
     return { ok: false, message, url, credential, appId, kind };

package/dist/{chunk-6S3UEBLB.js → chunk-RO3BRAO6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-6WZKI6LQ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GUT4IU7K.js';
 import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-4R24DSL2.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-FI66JNLT.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-G2T4HCGT.js → chunk-TEVO3RUV.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { DEFAULT_DASHBOARD } from './chunk-XSPA5ODY.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-GJZEUQ6D.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { remoteLookupFailed } from './chunk-QE3UQAHK.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';

package/dist/{chunk-TI33WRBT.js → chunk-TODY3MTS.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-ARMZI56S.js';
-import { describeCallFailure } from './chunk-WVM6PM2N.js';
-import { WorkCommandError, getJson } from './chunk-DZUANBKP.js';
+import { isPlaceholderCommand } from './chunk-PCY7IGSL.js';
+import { describeCallFailure } from './chunk-DXHISLCI.js';
+import { WorkCommandError, getJson } from './chunk-GMPXOQTH.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { signerFor } from './chunk-F6DIHHBS.js';

package/dist/{chunk-CLUUAX6O.js → chunk-TPAF24PK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-FQCLEH34.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-GJZEUQ6D.js';
+import { autoConnect, detectActiveSession } from './chunk-HXFRJKMU.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-ITP76BST.js → chunk-U2FSJBNI.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-P7UQZFNY.js';
+import { uploadSpooledSteps } from './chunk-EORWWFPA.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-GJZEUQ6D.js';
-import { writeSyncStatus, spoolDir } from './chunk-C3AMVSMS.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QRZLUUNN.js';
+import { writeSyncStatus, spoolDir } from './chunk-2EAVBJMO.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
-import { hookExecSpoolPath } from './chunk-DYEFPYME.js';
+import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QE3UQAHK.js';

package/dist/{chunk-GNPTU4BM.js → chunk-URIZRCRY.js}

@@ -49,6 +49,7 @@ function isScriptBin(bin) {
 function cliCommand(cliBin) {
   return isScriptBin(cliBin) ? `node ${quoteBin(cliBin)}` : quoteBin(cliBin);
 }
+var PORTABLE_BIN = "outerlayer";
 function isOurBin(bin, cliBin) {
   if (cliBin !== void 0 && normalizeBinPath(bin) === normalizeBinPath(cliBin)) return true;
   const parts = bin.replace(/\\/g, "/").split("/");
@@ -398,4 +399,4 @@ function unwrapHooks(settings, cliBin) {
   return { next, changed, unwrapped };
 }
 
-export { AUTO_WRAP_EVENTS, REGISTERED_EVENTS, SettingsParseError, cliBinResolvable, cliCommand, decodeWrappedCommand, encodeWrappedCommand, isOurHookCommand, isOurHookCommandFor, isOurStatuslineSlot, isWrapped, listHookCandidates, mergeHooks, mergeStatusline, ourCommandBins, ourDirectScriptBins, parseLifecycleHookCommand, readSettings, removeHooks, removeStatusline, repointWrappedHooks, settingsPath, statuslineCommand, statuslineWrappedOriginal, unwrapHooks, wrapHooks, wrappedOriginalCommand, writeSettings };
+export { AUTO_WRAP_EVENTS, PORTABLE_BIN, REGISTERED_EVENTS, SettingsParseError, cliBinResolvable, cliCommand, decodeWrappedCommand, encodeWrappedCommand, isOurHookCommand, isOurHookCommandFor, isOurStatuslineSlot, isWrapped, listHookCandidates, mergeHooks, mergeStatusline, ourCommandBins, ourDirectScriptBins, parseLifecycleHookCommand, readSettings, removeHooks, removeStatusline, repointWrappedHooks, settingsPath, statuslineCommand, statuslineWrappedOriginal, unwrapHooks, wrapHooks, wrappedOriginalCommand, writeSettings };

package/dist/{chunk-XBCJI6SV.js → chunk-V5LUWRCV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-ITP76BST.js';
-import { spoolDir } from './chunk-C3AMVSMS.js';
+import { LiveUploader } from './chunk-U2FSJBNI.js';
+import { spoolDir } from './chunk-2EAVBJMO.js';
 import { CaptureDaemon } from './chunk-QE3UQAHK.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-D4UDE2AP.js → chunk-W3NVHOCS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-MQ743JX3.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-GJZEUQ6D.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-XK7FRM5J.js → chunk-WA7R6U2F.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned, checkBuildSkill } from './chunk-XFGL53GU.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-DZUANBKP.js';
-import { isLinkedRepository } from './chunk-G2T4HCGT.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-GMPXOQTH.js';
+import { isLinkedRepository } from './chunk-TEVO3RUV.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { checkFormerSkillNames } from './chunk-MQ743JX3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-GJZEUQ6D.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-C3AMVSMS.js';
-import { readStatuslineState, STATE_FRESH_MS } from './chunk-DXDF43YG.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-QRZLUUNN.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-2EAVBJMO.js';
+import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-GNPTU4BM.js';
+import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-URIZRCRY.js';
 import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
 import { deadHooksState, preparePackageManagerCommand } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1186,7 +1186,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-AXJQQBKY.js');
+    const { runnerHostChecks } = await import('./doctor-3LCCPBX6.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{chunk-XGJUNNXL.js → chunk-XLC7KEUV.js}

@@ -6,8 +6,10 @@ import { join } from 'path';
 
 createRequire(import.meta.url);
 var EXEC_PORT = 1024;
+var LEASE_PORT = 3125;
 var GUEST_CID = 3;
 var MAX_SOCKET_PATH = 107;
+var LEASE_LINK = { port: LEASE_PORT, socket: "lease.sock" };
 function vsockLinks(input) {
   return [
     { port: RELAY_PORT, socket: "tunnel.sock" },
@@ -39,4 +41,4 @@ function socketPathProblem(buildDir) {
   return `the build directory ${buildDir} is too deep for the microVM's sockets: a socket path holds at most ${MAX_SOCKET_PATH} bytes and the longest here is ${longest}; move the runner's config file closer to the root`;
 }
 
-export { EXEC_PORT, GUEST_CID, linkVsockSockets, socketPathProblem, vsockLinks };
+export { EXEC_PORT, GUEST_CID, LEASE_LINK, linkVsockSockets, socketPathProblem, vsockLinks };

package/dist/{claude-launcher-FXFXYW2E.js → claude-launcher-O2U6P6ZD.js}

@@ -236,7 +236,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-FRK5IZXC.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-654RV5PO.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);