@outerlayer/cli 0.26.1 → 0.26.3

package/dist/{chunk-IIFMFX6J.js → chunk-XDHYZWEK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-PNHNKMA3.js';
-import { spoolDir } from './chunk-QIIMZC7W.js';
+import { LiveUploader } from './chunk-2AKDF6C2.js';
+import { spoolDir } from './chunk-FO7F6QSV.js';
 import { CaptureDaemon } from './chunk-QE3UQAHK.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-TBJ7KO2A.js → chunk-XF77SNB4.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-GAWZ7ATV.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-SKZG7SAN.js';
 import { writePendingUpdate } from './chunk-TKL74NLB.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-6FAP657M.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-BMWIUSTZ.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-ZPXI7LMG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-4IFKLYMM.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-ILL2CWOU.js';
+import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-VHVFU6QU.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-665QWBNW.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { checkFit } from './chunk-MLD2NA7N.js';
 import { claimPidFile, readPidFile, releasePidFile } from './chunk-PYSKSROG.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-7I6GZSN3.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-D7V33CAH.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-XPKI5OMT.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-ZLEXMZFW.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-J7BXZLSO.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-UKCNOAO6.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWRX5ZTT.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -1057,6 +1057,9 @@ function attemptLogsOf(state) {
 function nowOf(state) {
   return (state.deps.now ?? (() => /* @__PURE__ */ new Date()))();
 }
+function leaseTimeLeftFor(state, active) {
+  return () => (state.deps.leaseTimeLeftMs ?? leaseTimeLeftMs)(active.job, nowOf(state).getTime());
+}
 function runtimeOf(state) {
   state.containerRuntime ??= createContainerRuntime(state.deps.container);
   return state.containerRuntime;
@@ -1746,7 +1749,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-TGSNYPSG.js');
+  const { postJson: postJson2 } = await import('./work-cmd-UQ45HDM4.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2030,7 +2033,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       aborted: () => active.ending,
       deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
       fetchImpl: state.deps.fetchImpl,
-      now: state.deps.now
+      now: state.deps.now,
+      leaseTimeLeftMs: leaseTimeLeftFor(state, active)
     }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
@@ -2430,6 +2434,7 @@ async function renewLeaseIfDue(state, active, nowMs) {
     writeJobFile(join(active.dirPath, "job.json"), active.job);
     log.line(`${tag} lease renewed \xB7 expires ${formatClock(new Date(nowMs + LEASE_SECONDS * 1e3), new Date(nowMs))}`);
     if (active.job.container !== void 0) state.containerRuntime?.leases.get(active.job.container.buildId)?.publish();
+    if (active.job.microvm !== void 0) state.containerRuntime?.leases.get(active.job.microvm.buildId)?.publish();
   } else {
     log.error(`${tag} renew did not land \xB7 retrying in ${RENEW_INTERVAL_SECONDS / 60}m`);
   }
@@ -2730,7 +2735,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-3CBJVXZD.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-WJJ325EQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -3015,4 +3020,4 @@ function runnerProcessState(configPath) {
   return isSameProcess(entry.pid, entry.start) ? { state: "running", pid: entry.pid } : { state: "stale", pid: entry.pid };
 }
 
-export { RunnerStartError, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick };
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick };

package/dist/{chunk-XGJUNNXL.js → chunk-XLC7KEUV.js}

@@ -6,8 +6,10 @@ import { join } from 'path';
 
 createRequire(import.meta.url);
 var EXEC_PORT = 1024;
+var LEASE_PORT = 3125;
 var GUEST_CID = 3;
 var MAX_SOCKET_PATH = 107;
+var LEASE_LINK = { port: LEASE_PORT, socket: "lease.sock" };
 function vsockLinks(input) {
   return [
     { port: RELAY_PORT, socket: "tunnel.sock" },
@@ -39,4 +41,4 @@ function socketPathProblem(buildDir) {
   return `the build directory ${buildDir} is too deep for the microVM's sockets: a socket path holds at most ${MAX_SOCKET_PATH} bytes and the longest here is ${longest}; move the runner's config file closer to the root`;
 }
 
-export { EXEC_PORT, GUEST_CID, linkVsockSockets, socketPathProblem, vsockLinks };
+export { EXEC_PORT, GUEST_CID, LEASE_LINK, linkVsockSockets, socketPathProblem, vsockLinks };

package/dist/{chunk-7I6GZSN3.js → chunk-ZLEXMZFW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError, BUILDKIT_IMAGE } from './chunk-4R24DSL2.js';
+import { RecipeError, BUILDKIT_IMAGE } from './chunk-TSW4DGV2.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { compareVersions } from './chunk-QE3UQAHK.js';
 import { ensureHostKey } from './chunk-F6DIHHBS.js';

package/dist/{chunk-BMWIUSTZ.js → chunk-ZPXI7LMG.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-JUTN2HUP.js';
-import { describeCallFailure } from './chunk-D7V33CAH.js';
-import { WorkCommandError, getJson } from './chunk-XPKI5OMT.js';
+import { isPlaceholderCommand } from './chunk-W7LGHNXT.js';
+import { describeCallFailure } from './chunk-J7BXZLSO.js';
+import { WorkCommandError, getJson } from './chunk-UKCNOAO6.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { signerFor } from './chunk-F6DIHHBS.js';

package/dist/{cli-7HVTFJZO.js → cli-2UUJM3AE.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-GQOT37HL.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-K7FCZCLQ.js';
 import './chunk-XFGL53GU.js';
 import './chunk-VJBFQP3H.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-XPKI5OMT.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-UKCNOAO6.js';
 import './chunk-HXFRJKMU.js';
 import './chunk-TEVO3RUV.js';
 import './chunk-BUP5N3X6.js';
@@ -11,9 +11,9 @@ import './chunk-XSPA5ODY.js';
 import './chunk-GOSFARMS.js';
 import './chunk-MQ743JX3.js';
 import './chunk-QRZLUUNN.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-QIIMZC7W.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-FO7F6QSV.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-DXDF43YG.js';
+import './chunk-I7RZHMXW.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -25,7 +25,7 @@ import { FIRST_VERSION_READING_AGENTS_SKILLS } from './chunk-JKNYTNYD.js';
 import './chunk-HBISTTG3.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation, packageRunnerOf } from './chunk-CRB3POP4.js';
-import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-GNPTU4BM.js';
+import { settingsPath, readSettings, SettingsParseError, listHookCandidates, PORTABLE_BIN, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-URIZRCRY.js';
 import './chunk-VWFOKRYS.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { removeJournalHooks, removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
@@ -3597,10 +3597,10 @@ function ensureGitignore(cwd) {
 `);
   return true;
 }
-function orgRolloutSnippet(cliBin) {
+function orgRolloutSnippet() {
   const hooks = {};
   for (const event of REGISTERED_EVENTS) {
-    hooks[event] = [{ hooks: [{ type: "command", command: `${cliCommand(cliBin)} hook ${event}` }] }];
+    hooks[event] = [{ hooks: [{ type: "command", command: `${PORTABLE_BIN} hook ${event}` }] }];
   }
   const managed = JSON.stringify({ hooks }, null, 2);
   return [
@@ -3612,11 +3612,13 @@ function orgRolloutSnippet(cliBin) {
     "  macOS (MDM):    /Library/Application Support/ClaudeCode/managed-settings.json",
     "                  (domain com.anthropic.claudecode)",
     "  Linux:          /etc/claude-code/managed-settings.json",
-    "  Windows (GPO):  HKLM\\SOFTWARE\\Policies\\ClaudeCode",
+    "  Windows (GPO):  HKLM\\SOFTWARE\\Policies\\ClaudeCode, as a REG_SZ value named Settings",
     "",
     "managed-settings.json:",
     managed,
     "",
+    "The hooks run `outerlayer` from the PATH, so install the CLI on every machine first:",
+    "  npm install -g @outerlayer/cli",
     `Each developer still runs \`${cliInvocation()} login\` once to attribute sessions.`
   ].join("\n");
 }
@@ -3750,7 +3752,7 @@ async function installHooks(opts, resolvedBin, connected, starterTemplate, withN
   const scope = opts.project ? "project" : "user";
   let cliBin;
   try {
-    cliBin = initHookBin({ home: homeFromEnv(), runningBin: resolvedBin, remove: opts.remove === true });
+    cliBin = scope === "project" ? PORTABLE_BIN : initHookBin({ home: homeFromEnv(), runningBin: resolvedBin, remove: opts.remove === true });
   } catch (err) {
     const text = `could not copy the CLI to ~/.outerlayer/cli: ${err instanceof Error ? err.message : String(err)}
   Hooks were not changed. Fix the permissions on ~/.outerlayer, then re-run ${C.yellow}${cliInvocation()} init${C.reset}.`;
@@ -3883,7 +3885,7 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
     }
     const cliBin = resolveCliBin();
     if (opts.org) {
-      process.stdout.write(orgRolloutSnippet(cliBin) + "\n");
+      process.stdout.write(orgRolloutSnippet() + "\n");
       return;
     }
     if (opts.remove || opts.local) {
@@ -3898,12 +3900,12 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-54DMRBNO.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-SQKWPACS.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + (shell?.text ?? ""));
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-54DMRBNO.js');
+    const { runInitCommand } = await import('./init-cmd-SQKWPACS.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4041,7 +4043,7 @@ code is 1: revoke the token on /profile/security.
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-VCLCOME6.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-GT2WTQRA.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4072,7 +4074,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-SVGL24OX.js');
+    const { runWatch } = await import('./watch-JED7SYAA.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4133,7 +4135,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("vm-exec", { hidden: true }).description("run a command in a microVM build's guest through its exec agent").requiredOption("--socket <path>", "the Unix socket Firecracker serves the build's vsock device on").option("--user <user>", "the user to run as", "").option("--cwd <dir>", "the working directory", "/").option("--env <NAME=value>", "an environment value the command line carries; repeatable", (value, previous) => [...previous, value], []).option("--pass <NAME>", "an environment variable whose value is read from this process; repeatable", (value, previous) => [...previous, value], []).argument("<argv...>", "the command and its arguments").action(async (argv2, opts) => {
-    const { runVmExec } = await import('./exec-client-KH33DICR.js');
+    const { runVmExec } = await import('./exec-client-J6L5FDRR.js');
     const env = {};
     for (const entry of opts.env) {
       const eq = entry.indexOf("=");
@@ -4162,7 +4164,7 @@ code is 1: revoke the token on /profile/security.
     process.exitCode = await runBuildCommand({ dir: opts.dir, argv: command });
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-P5GVOIUY.js');
+    const { runSessionSender } = await import('./session-sender-VH2EKAT5.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4170,7 +4172,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("vm-init", { hidden: true }).description("lay out a microVM build's guest; the guest helper runs it").action(async () => {
-    const { realGuestHost, runGuestInit } = await import('./guest-init-TOSKPGPF.js');
+    const { realGuestHost, runGuestInit } = await import('./guest-init-CXIHA5VI.js');
     const { readFileSync: readFileSync3 } = await import('fs');
     try {
       runGuestInit(realGuestHost(), readFileSync3("/proc/cmdline", "utf8"));
@@ -4252,7 +4254,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-NEICBIDU.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-HRTXGZLK.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4302,7 +4304,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-SFUSDWZM.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-XXTCHP6V.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4530,9 +4532,9 @@ function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
   const run = async (action) => {
-    const { WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
-      await action(await import('./spec-cmd-HMFW552G.js'));
+      await action(await import('./spec-cmd-BOUPLX7X.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4574,7 +4576,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4597,7 +4599,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4621,8 +4623,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-O3FVX6M4.js');
-    const { WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-I7NNSNDP.js');
+    const { WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4643,8 +4645,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-O3FVX6M4.js');
-    const { WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-I7NNSNDP.js');
+    const { WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4668,8 +4670,8 @@ still running, or that an older runner released, has no log and the
 command exits 1.
 `
   ).action(async (opts) => {
-    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-2RMJFVNZ.js');
-    const { WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-YIQJVENH.js');
+    const { WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkLogs(opts);
     } catch (err) {
@@ -4692,8 +4694,8 @@ item is not built again until a new build request. Exits 1 when no host
 build is running for the item.
 `
   ).action(async (opts) => {
-    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-TNJYBLMN.js');
-    const { WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-GN2WX73C.js');
+    const { WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkStop(opts);
     } catch (err) {
@@ -4714,7 +4716,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4726,7 +4728,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4738,7 +4740,7 @@ live addition remains on it.
     }
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4759,7 +4761,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-WQF5RTCT.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-MY4N74HA.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4779,7 +4781,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-WQF5RTCT.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-MY4N74HA.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4811,7 +4813,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-WQF5RTCT.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-MY4N74HA.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4863,8 +4865,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-5EP7BKRE.js');
-    const { WorkCommandError } = await import('./work-cmd-TGSNYPSG.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-VP5NNTCW.js');
+    const { WorkCommandError } = await import('./work-cmd-UQ45HDM4.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4881,7 +4883,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-JJ3EO7SB.js');
-    const { start, RunnerStartError } = await import('./loop-6JKW5QR5.js');
+    const { start, RunnerStartError } = await import('./loop-OE32U2IZ.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BY5Z6YH7.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4900,8 +4902,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-JJ3EO7SB.js');
-    const { containerStart } = await import('./container-start-SCCR2PRD.js');
-    const { start, RunnerStartError } = await import('./loop-6JKW5QR5.js');
+    const { containerStart } = await import('./container-start-AUJHF2BC.js');
+    const { start, RunnerStartError } = await import('./loop-OE32U2IZ.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BY5Z6YH7.js');
     try {
       const result = await containerStart({
@@ -4921,7 +4923,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { runRunnerCheck } = await import('./check-3CBJVXZD.js');
+    const { runRunnerCheck } = await import('./check-WJJ325EQ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4955,7 +4957,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-2Q5UDZUO.js');
+        const { installServiceCommand } = await import('./command-GQBHC53U.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5011,7 +5013,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { uninstallServiceCommand } = await import('./command-2Q5UDZUO.js');
+    const { uninstallServiceCommand } = await import('./command-GQBHC53U.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5039,10 +5041,10 @@ already in runner.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-JJ3EO7SB.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-UMON3HZK.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-FUNSJ564.js');
-    const { detectMachine } = await import('./machine-XF55O56X.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-NEUTUGEQ.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-KIGYMLDM.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-AZVXBQIB.js');
+    const { detectMachine } = await import('./machine-L7INJ4JN.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-UZWRJMPZ.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-2D7MPOIJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5193,7 +5195,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-2Q5UDZUO.js');
+        const { installServiceCommand } = await import('./command-GQBHC53U.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5238,10 +5240,10 @@ Next:
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-JK2DLT6X.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-EBQYXL7Y.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-4X2A5HDY.js');
-    const { builderSpec } = await import('./builder-TMA25KRR.js');
+    const { createDockerHost } = await import('./docker-NYAIIX2F.js');
+    const { builderSpec } = await import('./builder-WEGLC2F2.js');
     const { loadRunnerConfig } = await import('./config-JJ3EO7SB.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
@@ -5253,11 +5255,11 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-NH6RLVMI.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-YYENYKDH.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
-      const { imageTargetFor } = await import('./governing-source-J5DF65X5.js');
+      const { imageTargetFor } = await import('./governing-source-PTJ6EAA3.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5321,7 +5323,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { requestStop } = await import('./loop-6JKW5QR5.js');
+    const { requestStop } = await import('./loop-OE32U2IZ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-5SJ6ZKT7.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5329,8 +5331,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-JJ3EO7SB.js');
     const { jobsDir, runnerDir } = await import('./paths-ZC6BMWMT.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-6JKW5QR5.js');
-    const { renderStatus } = await import('./status-ULZVKQ7G.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-OE32U2IZ.js');
+    const { renderStatus } = await import('./status-3WC2IGVI.js');
     const { readHousekeepingRecord } = await import('./record-K23IN6QN.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5390,7 +5392,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-JJ3EO7SB.js');
-    const { listJobFiles } = await import('./loop-6JKW5QR5.js');
+    const { listJobFiles } = await import('./loop-OE32U2IZ.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-VN2HKDSH.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5483,14 +5485,14 @@ ${C.dim}${file.path}${C.reset}
       fail("--no-input forbids prompting; pass --all to wrap every candidate without being asked.");
       return;
     }
+    const scope = opts.project ? "project" : "user";
     let cliBin;
     try {
-      cliBin = initHookBin({ home: homeFromEnv(), runningBin: resolveCliBin(), remove: false });
+      cliBin = scope === "project" ? PORTABLE_BIN : initHookBin({ home: homeFromEnv(), runningBin: resolveCliBin(), remove: false });
     } catch (err) {
       fail(`could not copy the CLI to ~/.outerlayer/cli: ${err instanceof Error ? err.message : String(err)}`);
       return;
     }
-    const scope = opts.project ? "project" : "user";
     const path2 = settingsPath(scope);
     let settings;
     try {

package/dist/{command-2Q5UDZUO.js → command-GQBHC53U.js}

@@ -3,21 +3,21 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-JF572PM5.js';
 import './chunk-KDDFI5MR.js';
 import { currentLink, execStartCommand } from './chunk-4IFKLYMM.js';
-import { detectMachine } from './chunk-7NKVMAP6.js';
-import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-ILL2CWOU.js';
+import { detectMachine } from './chunk-364XDGOK.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-VHVFU6QU.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-MLD2NA7N.js';
-import './chunk-AINUN2TT.js';
+import './chunk-7LVF4E5V.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import { readJobFile } from './chunk-7I6GZSN3.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-4R24DSL2.js';
-import './chunk-HPOEVC2V.js';
-import './chunk-XGJUNNXL.js';
-import './chunk-D7V33CAH.js';
-import './chunk-XPKI5OMT.js';
+import { readJobFile } from './chunk-ZLEXMZFW.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-TSW4DGV2.js';
+import './chunk-MXTN35XN.js';
+import './chunk-XLC7KEUV.js';
+import './chunk-J7BXZLSO.js';
+import './chunk-UKCNOAO6.js';
 import './chunk-HXFRJKMU.js';
 import './chunk-TEVO3RUV.js';
 import './chunk-BUP5N3X6.js';