@outerlayer/cli 0.26.2 → 0.26.4

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @outerlayer/cli
 
+## 0.26.4
+
+### Patch Changes
+
+- f9ed270: A `~/.outerlayer/config.json` that is not valid JSON is no longer written over. `login`, `logout` and every command that uses the saved login stop with an error that names the file, so a hand-set key such as `autoSync`, `repos` or the runner block is never lost.
+- 1fc1f42: The root helper that `outerlayer runner install --service` installs can point a running microVM build at the runner's new sockets, which a runner that starts again needs to reach that build.
+- fe4299b: The runner keeps a governed build's context on the host after it delivers it. The judge and the host's checks read their definitions from that copy, at the commit the build was given. Before, they fetched the control plane again with a new token, and the gateway refused it for an amend whose own push resolved the merge conflict that started it. The judge and the checks then never ran. When the judge cannot read its definitions, the item's reason now says so first. The runner also asks for the read token of every repository in a claim when it claims the item, so a refusal ends the attempt before the image build.
+- 5f01c67: Stub the systemd service probes once for every unit test, and write the NUL separator in `doctor` as an escape.
+
+## 0.26.3
+
+### Patch Changes
+
+- bdf88b4: MicroVM builds boot a Linux 6.18 guest kernel, the newer of the two guest kernels Firecracker 1.17 supports.
+- bdfdf7b: A machine with OuterLayer's hooks in both managed settings and user settings records each hook event once. Claude Code starts both copies of the hook; the second one does nothing, so the session's warnings appear once and Work is called once.
+
 ## 0.26.2
 
 ### Patch Changes

package/dist/{agent-setup-PZYQWN4H.js → agent-setup-5DXPEO64.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-6M4LNO22.js';
+export { keepHandWritten, runAgentSetup } from './chunk-KNBWOL2B.js';
 import './chunk-WX2WEERU.js';
 import './chunk-VJBFQP3H.js';
-import './chunk-W3NVHOCS.js';
+import './chunk-4UFSTKE5.js';
 import './chunk-MQ743JX3.js';
-import './chunk-QRZLUUNN.js';
+import './chunk-MCSINUVC.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-YVZJ6GKF.js';
+import './chunk-KT4CN6OU.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EABW6AJQ.js';
+import './chunk-PJDQPF5N.js';
 import './chunk-JKNYTNYD.js';
 import './chunk-HBISTTG3.js';
 import './chunk-CRB3POP4.js';
@@ -21,8 +21,8 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-F6DIHHBS.js';
-import './chunk-L4CW6LZQ.js';
+import './chunk-GWRDL75D.js';
+import './chunk-F3BBEBPL.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-AW4A2QPK.js → build-F5QWH7G5.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-DJILFADE.js';
-import './chunk-PYSKSROG.js';
+export { buildRepositoryImage } from './chunk-GFHLEVUE.js';
+import './chunk-IZAOO5AR.js';
 import './chunk-JBJTC3UU.js';
-export { RecipeError } from './chunk-FI66JNLT.js';
-import './chunk-L4CW6LZQ.js';
+export { RecipeError } from './chunk-B6K7R5UY.js';
+import './chunk-F3BBEBPL.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-16T18:16:32.915Z+7b81ff6","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-16T21:01:44.837Z+065fff7","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-TDCBQ2RD.js → builder-KDUXCHTY.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-KZLLLARE.js';
-import './chunk-FI66JNLT.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-QUP6CVBQ.js';
+import './chunk-B6K7R5UY.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-F6DIHHBS.js';
-import './chunk-L4CW6LZQ.js';
+import './chunk-GWRDL75D.js';
+import './chunk-F3BBEBPL.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-KL3LDAI3.js → check-ZSYCR5WG.js}

@@ -1,53 +1,53 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-6OYAW5SF.js';
-import './chunk-OL2O5PEI.js';
-import './chunk-TKL74NLB.js';
+import { probeCredentials } from './chunk-V3YJFEZA.js';
+import './chunk-27RDUTQH.js';
+import './chunk-OFTFW7TH.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-6FAP657M.js';
+import './chunk-NWPRNKZ5.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
 import './chunk-TPKYTORP.js';
-import './chunk-V5LUWRCV.js';
+import './chunk-Q2SVLBMI.js';
 import './chunk-MWPBF2XG.js';
 import './chunk-UNF7MWEL.js';
-import './chunk-U2FSJBNI.js';
-import './chunk-EORWWFPA.js';
+import './chunk-VQ7OAG6H.js';
+import './chunk-WK35HB56.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-TODY3MTS.js';
-import './chunk-4IFKLYMM.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-UOGQZQXN.js';
+import './chunk-7Z2WMXM5.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-PCY7IGSL.js';
-import './chunk-RO3BRAO6.js';
-import './chunk-GUT4IU7K.js';
-import './chunk-665QWBNW.js';
+import './chunk-OQUD3UYF.js';
+import './chunk-EHBDYLM6.js';
+import './chunk-SBW4K3XZ.js';
+import './chunk-2J46BQ5Y.js';
 import './chunk-TQMI335S.js';
-import './chunk-5PMQDQFV.js';
-import './chunk-MLD2NA7N.js';
+import './chunk-VGHKTSHU.js';
+import './chunk-6SPXKRQR.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-DJILFADE.js';
-import './chunk-PYSKSROG.js';
+import './chunk-GFHLEVUE.js';
+import './chunk-IZAOO5AR.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-KZLLLARE.js';
-import './chunk-FI66JNLT.js';
+import './chunk-QUP6CVBQ.js';
+import './chunk-B6K7R5UY.js';
 import './chunk-MXTN35XN.js';
 import './chunk-XLC7KEUV.js';
-import './chunk-DXHISLCI.js';
-import './chunk-GMPXOQTH.js';
-import './chunk-HXFRJKMU.js';
-import './chunk-TEVO3RUV.js';
+import './chunk-OZKEEXVH.js';
+import './chunk-6CGXSMKX.js';
+import './chunk-H57M3HC7.js';
+import './chunk-PZA6ZFYW.js';
 import './chunk-BUP5N3X6.js';
-import './chunk-XSPA5ODY.js';
-import './chunk-GOSFARMS.js';
+import './chunk-6BLXUD56.js';
+import './chunk-G2JWZDFA.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-JWRX5ZTT.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-W3NVHOCS.js';
+import './chunk-4UFSTKE5.js';
 import './chunk-MQ743JX3.js';
-import './chunk-QRZLUUNN.js';
-import './chunk-2EAVBJMO.js';
+import './chunk-MCSINUVC.js';
+import './chunk-UZEQVPKF.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -56,7 +56,7 @@ import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EABW6AJQ.js';
+import './chunk-PJDQPF5N.js';
 import './chunk-JKNYTNYD.js';
 import './chunk-HBISTTG3.js';
 import './chunk-T2Q7ISPE.js';
@@ -69,8 +69,8 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-F6DIHHBS.js';
-import './chunk-L4CW6LZQ.js';
+import './chunk-GWRDL75D.js';
+import './chunk-F3BBEBPL.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{chunk-OL2O5PEI.js → chunk-27RDUTQH.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { senderPidfile } from './chunk-V5LUWRCV.js';
+import { senderPidfile } from './chunk-Q2SVLBMI.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-MWPBF2XG.js';
 import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
-import { installScrubContext } from './chunk-U2FSJBNI.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-GUT4IU7K.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-DJILFADE.js';
+import { installScrubContext } from './chunk-VQ7OAG6H.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-SBW4K3XZ.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-GFHLEVUE.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-KZLLLARE.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-FI66JNLT.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-QUP6CVBQ.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-B6K7R5UY.js';
 import { waitForAgent, vmExecArgs } from './chunk-MXTN35XN.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-XLC7KEUV.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-DXHISLCI.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-GMPXOQTH.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-OZKEEXVH.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6CGXSMKX.js';
 import { planArtifactUpload } from './chunk-BUP5N3X6.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { scrubText } from './chunk-QE3UQAHK.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { resolvePackRoot } from './chunk-HBISTTG3.js';
 import { parsePolicy } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-F6DIHHBS.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-L4CW6LZQ.js';
+import { signerFor } from './chunk-GWRDL75D.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-F3BBEBPL.js';
 import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2K3TCQHW.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-JGD5TWQ2.js';
 import { existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, rmSync, readdirSync, linkSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
@@ -539,7 +539,8 @@ async function provisionMicroVm(input) {
         return { ok: false, reason: `context_unavailable: ${describeCallFailure(err)}` };
       }
     },
-    removeStagedContext: () => removeStagedContext(buildDir2)
+    removeStagedContext: () => removeStagedContext(buildDir2),
+    keepIn: jobDir
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
@@ -1236,6 +1237,9 @@ function decideFromEvaluation(read) {
   }
   return { outcome: "incomplete", reason: fit("the item's verdict is not passing: ", [evaluation.sentence || evaluation.verdict]) };
 }
+function incompleteReason(reason, judgeNotRun) {
+  return judgeNotRun === void 0 ? reason : `the judge did not run (${judgeNotRun}) \xB7 ${reason}`;
+}
 function waitMs(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -1460,6 +1464,8 @@ async function readDefinitions(input, repository, scratch, token, tokens) {
   const stage = deps.stage ?? stageGovernedContext;
   const controlPlaneUrl = (controlPlane) => deps.runtime.remoteFor?.(controlPlane) ?? `${deps.runtime.github.gitUrl}/${controlPlane}.git`;
   const governing = (job.container ?? job.microvm)?.governing;
+  const kept = keptContextTree(input.jobDir, governing);
+  if (kept !== void 0) return { ok: true, checks: checksIn(kept, deps.log, tag) };
   const staged = await stage({
     config,
     repository,
@@ -1918,6 +1924,7 @@ async function runJudge(input) {
   if (!definitions.ok) {
     rmSync(scratch, { recursive: true, force: true });
     log.line(`${tag} judge not run: the definitions could not be read: ${definitions.reason}`);
+    job.judgeNotRun = `the definitions could not be read: ${definitions.reason}`;
     const passed = await retrySend(() => hostPassedNames(config, job.item, deps.fetchImpl), { now: deps.now });
     if (!passed.ok) {
       log.error(`${tag} the item's host results could not be read, so none was failed: ${passed.reason}`);
@@ -2667,6 +2674,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       log.error(`${tag} the host's checks stopped: ${describeCallFailure(err)} \xB7 continuing`);
     }
   }
+  removeKeptContext(jobDirPath);
   let outOfMemory;
   if ((vmBuild?.state.cgroup !== void 0 || vmBuild?.state.jailed !== void 0) && outcome !== void 0 && outcome !== "ok" && ending?.reason === void 0) {
     try {
@@ -2783,7 +2791,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     });
     if (decision.outcome === "incomplete") {
       outcome = "incomplete";
-      verdictReason = scrubReason(decision.reason, config);
+      verdictReason = scrubReason(incompleteReason(decision.reason, job.judgeNotRun), config);
       log.error(`${tag} the command exited 0 but the item is not done: ${verdictReason}`);
     }
   }

package/dist/{chunk-665QWBNW.js → chunk-2J46BQ5Y.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-W3NVHOCS.js → chunk-4UFSTKE5.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-MQ743JX3.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-MCSINUVC.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-XSPA5ODY.js → chunk-6BLXUD56.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { revokeTokenOnDashboard } from './chunk-GOSFARMS.js';
+import { revokeTokenOnDashboard } from './chunk-G2JWZDFA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { readCloudConfigStrict, CloudConfigError, readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -404,6 +404,7 @@ Waiting for approval...
 async function runLoginCommand(flags, deps) {
   const home = deps.home ?? homeFromEnv();
   try {
+    readCloudConfigStrict(home);
     if (flags.check !== void 0) {
       purgeExpiredPending(home, deps.now(), flags.check);
       return await runCheck(flags, deps, home, flags.check);
@@ -425,7 +426,7 @@ async function runLoginCommand(flags, deps) {
     purgeExpiredPending(home, deps.now());
     return await runBrowserLogin(flags, deps, home);
   } catch (err) {
-    if (err instanceof LoginError) return fail(deps, err.message);
+    if (err instanceof LoginError || err instanceof CloudConfigError) return fail(deps, err.message);
     throw err;
   }
 }

package/dist/{chunk-GMPXOQTH.js → chunk-6CGXSMKX.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-HXFRJKMU.js';
-import { workPageUrl } from './chunk-TEVO3RUV.js';
+import { detectActiveSession, autoConnect } from './chunk-H57M3HC7.js';
+import { workPageUrl } from './chunk-PZA6ZFYW.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-QRZLUUNN.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-MCSINUVC.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signRunnerRequest } from './chunk-F6DIHHBS.js';
+import { signRunnerRequest } from './chunk-GWRDL75D.js';
 
 createRequire(import.meta.url);
 
@@ -428,7 +428,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-LZSHEKUA.js');
+      const { logHookError } = await import('./hook-fast-XMZFMBKC.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-MLD2NA7N.js → chunk-6SPXKRQR.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { runnerDir } from './chunk-L4CW6LZQ.js';
+import { runnerDir } from './chunk-F3BBEBPL.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 

package/dist/{chunk-XFGL53GU.js → chunk-6WTAYEKJ.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-VJBFQP3H.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
+import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
 import { skillsBaseFor, isAgentsMdLayout } from './chunk-JKNYTNYD.js';
 import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, namesCore, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-4IFKLYMM.js → chunk-7Z2WMXM5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-FI66JNLT.js → chunk-B6K7R5UY.js}

@@ -249,10 +249,10 @@ var FIRECRACKER_SHA256 = {
 var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
-var GUEST_ASSETS_VERSION = "6";
+var GUEST_ASSETS_VERSION = "7";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
-  x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
+  x86_64: "8552fad4bdea1d49f3e7d2aa500ce3f8918fcd2fc66779fd83235949688a39bb"
 };
 var GUEST_HELPER_SHA256 = {
   x86_64: "0ae934d3ad3f2a94abffcc3f044ba633b1a523dc17ff0c2bc322ed7d7fc505ea"
@@ -264,10 +264,10 @@ function guestAssetsPinned(arch) {
 var JAILER_BINARY_SHA256 = {
   x86_64: "65ef226e96f0ceda55ba643f445801ef2cc0ea667ef67cad8ac4f406c9c8434f"
 };
-var HOST_HELPER_ASSETS_VERSION = "5";
+var HOST_HELPER_ASSETS_VERSION = "8";
 var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;
 var HOST_HELPER_SHA256 = {
-  x86_64: "f2ec1c6a7ff29353045fad617ac1a6bf0155d6f3eb6a6259272a15342feaf957"
+  x86_64: "7c3a80da5e68adf3eb1eb407df0c770ccef589eb2da2f11735a9f9c05dc0d650"
 };
 function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
   return hashes[arch] !== "0".repeat(64);

package/dist/{chunk-RO3BRAO6.js → chunk-EHBDYLM6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-GUT4IU7K.js';
-import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-FI66JNLT.js';
+import { MIN_ENGINE_MAJOR } from './chunk-SBW4K3XZ.js';
+import { runnerImageVersion } from './chunk-2J46BQ5Y.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-B6K7R5UY.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-L4CW6LZQ.js → chunk-F3BBEBPL.js}

@@ -52,6 +52,9 @@ function contextHomeDir(configPath) {
 function stagedContextDir(buildDirPath) {
   return join(buildDirPath, "context");
 }
+function keptContextDir(jobDirPath) {
+  return join(jobDirPath, "governed-context");
+}
 function runnerDirOfBuild(buildDirPath) {
   return dirname(dirname(buildDirPath));
 }
@@ -81,4 +84,4 @@ function deliveryDir(repository, sha) {
   return `${BUILD_HOME}/.outerlayer/context/${repository}/${sha}`;
 }
 
-export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, buildsDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };
+export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, buildsDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, keptContextDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };

package/dist/{chunk-GOSFARMS.js → chunk-G2JWZDFA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig, removeCloudConfigKeys } from './chunk-EABW6AJQ.js';
+import { readCloudConfigStrict, removeCloudConfigKeys } from './chunk-PJDQPF5N.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -27,7 +27,14 @@ async function revokeTokenOnDashboard(fetchImpl, dashboard, token) {
 }
 async function runLogoutCommand(deps) {
   const home = deps.home ?? homeFromEnv();
-  const config = readCloudConfig(home);
+  let config;
+  try {
+    config = readCloudConfigStrict(home);
+  } catch (err) {
+    deps.stderr.write(`${C.red}\u2717${C.reset} ${err.message}
+`);
+    return 1;
+  }
   const token = config.accountToken;
   if (!token) {
     deps.stdout.write("Not logged in.\n");

package/dist/{chunk-DJILFADE.js → chunk-GFHLEVUE.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-PYSKSROG.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-IZAOO5AR.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-FI66JNLT.js';
-import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-B6K7R5UY.js';
+import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-2K3TCQHW.js';
 import { RELAY_ID, RELAY_USER } from './chunk-JGD5TWQ2.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';

package/dist/{chunk-F6DIHHBS.js → chunk-GWRDL75D.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-HXFRJKMU.js → chunk-H57M3HC7.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-TEVO3RUV.js';
-import { resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-PZA6ZFYW.js';
+import { resolveGatewayCredentials } from './chunk-MCSINUVC.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-PYSKSROG.js → chunk-IZAOO5AR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-KDDFI5MR.js → chunk-K4FXNMV5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-4IFKLYMM.js';
+import { currentLink } from './chunk-7Z2WMXM5.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-6M4LNO22.js → chunk-KNBWOL2B.js}

@@ -2,8 +2,8 @@
 import { createRequire } from 'node:module';
 import { runEmit } from './chunk-WX2WEERU.js';
 import { installStarterPack } from './chunk-VJBFQP3H.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-W3NVHOCS.js';
-import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-4UFSTKE5.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-JKNYTNYD.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-HBISTTG3.js';

package/dist/{chunk-YVZJ6GKF.js → chunk-KT4CN6OU.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { existsSync, writeFileSync, readFileSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-QRZLUUNN.js → chunk-MCSINUVC.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { signRunnerRequest, signerFor } from './chunk-F6DIHHBS.js';
+import { signRunnerRequest, signerFor } from './chunk-GWRDL75D.js';
 
 createRequire(import.meta.url);
 
@@ -27,7 +27,12 @@ function unauthorizedMessage(credential) {
 }
 function resolveGatewayCredentials(sources = {}) {
   const env = sources.env ?? process.env;
-  const config = readCloudConfig(sources.home ?? homeFromEnv(env));
+  let config;
+  try {
+    config = readCloudConfigStrict(sources.home ?? homeFromEnv(env));
+  } catch (err) {
+    return { ok: false, message: err.message, kind: "key" };
+  }
   const url = sources.url ?? env.OUTERLAYER_URL ?? config.url;
   const key = sources.apiKey ?? (env.OUTERLAYER_API_KEY || void 0) ?? config.apiKey;
   const kind = key ? "key" : "login";

package/dist/{chunk-6FAP657M.js → chunk-NWPRNKZ5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-TPAF24PK.js → chunk-O4362FPA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-HXFRJKMU.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { autoConnect, detectActiveSession } from './chunk-H57M3HC7.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-MCSINUVC.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-TKL74NLB.js → chunk-OFTFW7TH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';