@outerlayer/cli 0.26.3 → 0.26.4

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @outerlayer/cli
 
+## 0.26.4
+
+### Patch Changes
+
+- f9ed270: A `~/.outerlayer/config.json` that is not valid JSON is no longer written over. `login`, `logout` and every command that uses the saved login stop with an error that names the file, so a hand-set key such as `autoSync`, `repos` or the runner block is never lost.
+- 1fc1f42: The root helper that `outerlayer runner install --service` installs can point a running microVM build at the runner's new sockets, which a runner that starts again needs to reach that build.
+- fe4299b: The runner keeps a governed build's context on the host after it delivers it. The judge and the host's checks read their definitions from that copy, at the commit the build was given. Before, they fetched the control plane again with a new token, and the gateway refused it for an amend whose own push resolved the merge conflict that started it. The judge and the checks then never ran. When the judge cannot read its definitions, the item's reason now says so first. The runner also asks for the read token of every repository in a claim when it claims the item, so a refusal ends the attempt before the image build.
+- 5f01c67: Stub the systemd service probes once for every unit test, and write the NUL separator in `doctor` as an escape.
+
 ## 0.26.3
 
 ### Patch Changes

package/dist/{agent-setup-PZYQWN4H.js → agent-setup-5DXPEO64.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-6M4LNO22.js';
+export { keepHandWritten, runAgentSetup } from './chunk-KNBWOL2B.js';
 import './chunk-WX2WEERU.js';
 import './chunk-VJBFQP3H.js';
-import './chunk-W3NVHOCS.js';
+import './chunk-4UFSTKE5.js';
 import './chunk-MQ743JX3.js';
-import './chunk-QRZLUUNN.js';
+import './chunk-MCSINUVC.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-YVZJ6GKF.js';
+import './chunk-KT4CN6OU.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EABW6AJQ.js';
+import './chunk-PJDQPF5N.js';
 import './chunk-JKNYTNYD.js';
 import './chunk-HBISTTG3.js';
 import './chunk-CRB3POP4.js';
@@ -21,8 +21,8 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-F6DIHHBS.js';
-import './chunk-L4CW6LZQ.js';
+import './chunk-GWRDL75D.js';
+import './chunk-F3BBEBPL.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-EBQYXL7Y.js → build-F5QWH7G5.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-7LVF4E5V.js';
-import './chunk-PYSKSROG.js';
+export { buildRepositoryImage } from './chunk-GFHLEVUE.js';
+import './chunk-IZAOO5AR.js';
 import './chunk-JBJTC3UU.js';
-export { RecipeError } from './chunk-TSW4DGV2.js';
-import './chunk-L4CW6LZQ.js';
+export { RecipeError } from './chunk-B6K7R5UY.js';
+import './chunk-F3BBEBPL.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-16T19:10:06.995Z+98c3824","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-16T21:01:44.837Z+065fff7","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-WEGLC2F2.js → builder-KDUXCHTY.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-ZLEXMZFW.js';
-import './chunk-TSW4DGV2.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-QUP6CVBQ.js';
+import './chunk-B6K7R5UY.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-F6DIHHBS.js';
-import './chunk-L4CW6LZQ.js';
+import './chunk-GWRDL75D.js';
+import './chunk-F3BBEBPL.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-WJJ325EQ.js → check-ZSYCR5WG.js}

@@ -1,53 +1,53 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-XF77SNB4.js';
-import './chunk-SKZG7SAN.js';
-import './chunk-TKL74NLB.js';
+import { probeCredentials } from './chunk-V3YJFEZA.js';
+import './chunk-27RDUTQH.js';
+import './chunk-OFTFW7TH.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-6FAP657M.js';
+import './chunk-NWPRNKZ5.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
 import './chunk-TPKYTORP.js';
-import './chunk-XDHYZWEK.js';
+import './chunk-Q2SVLBMI.js';
 import './chunk-MWPBF2XG.js';
 import './chunk-UNF7MWEL.js';
-import './chunk-2AKDF6C2.js';
-import './chunk-EORWWFPA.js';
+import './chunk-VQ7OAG6H.js';
+import './chunk-WK35HB56.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ZPXI7LMG.js';
-import './chunk-4IFKLYMM.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-UOGQZQXN.js';
+import './chunk-7Z2WMXM5.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-W7LGHNXT.js';
-import './chunk-364XDGOK.js';
-import './chunk-VHVFU6QU.js';
-import './chunk-665QWBNW.js';
+import './chunk-OQUD3UYF.js';
+import './chunk-EHBDYLM6.js';
+import './chunk-SBW4K3XZ.js';
+import './chunk-2J46BQ5Y.js';
 import './chunk-TQMI335S.js';
-import './chunk-5PMQDQFV.js';
-import './chunk-MLD2NA7N.js';
+import './chunk-VGHKTSHU.js';
+import './chunk-6SPXKRQR.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-7LVF4E5V.js';
-import './chunk-PYSKSROG.js';
+import './chunk-GFHLEVUE.js';
+import './chunk-IZAOO5AR.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-ZLEXMZFW.js';
-import './chunk-TSW4DGV2.js';
+import './chunk-QUP6CVBQ.js';
+import './chunk-B6K7R5UY.js';
 import './chunk-MXTN35XN.js';
 import './chunk-XLC7KEUV.js';
-import './chunk-J7BXZLSO.js';
-import './chunk-UKCNOAO6.js';
-import './chunk-HXFRJKMU.js';
-import './chunk-TEVO3RUV.js';
+import './chunk-OZKEEXVH.js';
+import './chunk-6CGXSMKX.js';
+import './chunk-H57M3HC7.js';
+import './chunk-PZA6ZFYW.js';
 import './chunk-BUP5N3X6.js';
-import './chunk-XSPA5ODY.js';
-import './chunk-GOSFARMS.js';
+import './chunk-6BLXUD56.js';
+import './chunk-G2JWZDFA.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-JWRX5ZTT.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-W3NVHOCS.js';
+import './chunk-4UFSTKE5.js';
 import './chunk-MQ743JX3.js';
-import './chunk-QRZLUUNN.js';
-import './chunk-FO7F6QSV.js';
+import './chunk-MCSINUVC.js';
+import './chunk-UZEQVPKF.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -56,7 +56,7 @@ import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EABW6AJQ.js';
+import './chunk-PJDQPF5N.js';
 import './chunk-JKNYTNYD.js';
 import './chunk-HBISTTG3.js';
 import './chunk-T2Q7ISPE.js';
@@ -69,8 +69,8 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-F6DIHHBS.js';
-import './chunk-L4CW6LZQ.js';
+import './chunk-GWRDL75D.js';
+import './chunk-F3BBEBPL.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{chunk-SKZG7SAN.js → chunk-27RDUTQH.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { senderPidfile } from './chunk-XDHYZWEK.js';
+import { senderPidfile } from './chunk-Q2SVLBMI.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-MWPBF2XG.js';
 import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
-import { installScrubContext } from './chunk-2AKDF6C2.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-VHVFU6QU.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-7LVF4E5V.js';
+import { installScrubContext } from './chunk-VQ7OAG6H.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-SBW4K3XZ.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-GFHLEVUE.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-ZLEXMZFW.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TSW4DGV2.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-QUP6CVBQ.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-B6K7R5UY.js';
 import { waitForAgent, vmExecArgs } from './chunk-MXTN35XN.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-XLC7KEUV.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-J7BXZLSO.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-UKCNOAO6.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-OZKEEXVH.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6CGXSMKX.js';
 import { planArtifactUpload } from './chunk-BUP5N3X6.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { scrubText } from './chunk-QE3UQAHK.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { resolvePackRoot } from './chunk-HBISTTG3.js';
 import { parsePolicy } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-F6DIHHBS.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-L4CW6LZQ.js';
+import { signerFor } from './chunk-GWRDL75D.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-F3BBEBPL.js';
 import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2K3TCQHW.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-JGD5TWQ2.js';
 import { existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, rmSync, readdirSync, linkSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
@@ -539,7 +539,8 @@ async function provisionMicroVm(input) {
         return { ok: false, reason: `context_unavailable: ${describeCallFailure(err)}` };
       }
     },
-    removeStagedContext: () => removeStagedContext(buildDir2)
+    removeStagedContext: () => removeStagedContext(buildDir2),
+    keepIn: jobDir
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
@@ -1236,6 +1237,9 @@ function decideFromEvaluation(read) {
   }
   return { outcome: "incomplete", reason: fit("the item's verdict is not passing: ", [evaluation.sentence || evaluation.verdict]) };
 }
+function incompleteReason(reason, judgeNotRun) {
+  return judgeNotRun === void 0 ? reason : `the judge did not run (${judgeNotRun}) \xB7 ${reason}`;
+}
 function waitMs(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -1460,6 +1464,8 @@ async function readDefinitions(input, repository, scratch, token, tokens) {
   const stage = deps.stage ?? stageGovernedContext;
   const controlPlaneUrl = (controlPlane) => deps.runtime.remoteFor?.(controlPlane) ?? `${deps.runtime.github.gitUrl}/${controlPlane}.git`;
   const governing = (job.container ?? job.microvm)?.governing;
+  const kept = keptContextTree(input.jobDir, governing);
+  if (kept !== void 0) return { ok: true, checks: checksIn(kept, deps.log, tag) };
   const staged = await stage({
     config,
     repository,
@@ -1918,6 +1924,7 @@ async function runJudge(input) {
   if (!definitions.ok) {
     rmSync(scratch, { recursive: true, force: true });
     log.line(`${tag} judge not run: the definitions could not be read: ${definitions.reason}`);
+    job.judgeNotRun = `the definitions could not be read: ${definitions.reason}`;
     const passed = await retrySend(() => hostPassedNames(config, job.item, deps.fetchImpl), { now: deps.now });
     if (!passed.ok) {
       log.error(`${tag} the item's host results could not be read, so none was failed: ${passed.reason}`);
@@ -2667,6 +2674,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       log.error(`${tag} the host's checks stopped: ${describeCallFailure(err)} \xB7 continuing`);
     }
   }
+  removeKeptContext(jobDirPath);
   let outOfMemory;
   if ((vmBuild?.state.cgroup !== void 0 || vmBuild?.state.jailed !== void 0) && outcome !== void 0 && outcome !== "ok" && ending?.reason === void 0) {
     try {
@@ -2783,7 +2791,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     });
     if (decision.outcome === "incomplete") {
       outcome = "incomplete";
-      verdictReason = scrubReason(decision.reason, config);
+      verdictReason = scrubReason(incompleteReason(decision.reason, job.judgeNotRun), config);
       log.error(`${tag} the command exited 0 but the item is not done: ${verdictReason}`);
     }
   }

package/dist/{chunk-665QWBNW.js → chunk-2J46BQ5Y.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-W3NVHOCS.js → chunk-4UFSTKE5.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-MQ743JX3.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-MCSINUVC.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-XSPA5ODY.js → chunk-6BLXUD56.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { revokeTokenOnDashboard } from './chunk-GOSFARMS.js';
+import { revokeTokenOnDashboard } from './chunk-G2JWZDFA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { readCloudConfigStrict, CloudConfigError, readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -404,6 +404,7 @@ Waiting for approval...
 async function runLoginCommand(flags, deps) {
   const home = deps.home ?? homeFromEnv();
   try {
+    readCloudConfigStrict(home);
     if (flags.check !== void 0) {
       purgeExpiredPending(home, deps.now(), flags.check);
       return await runCheck(flags, deps, home, flags.check);
@@ -425,7 +426,7 @@ async function runLoginCommand(flags, deps) {
     purgeExpiredPending(home, deps.now());
     return await runBrowserLogin(flags, deps, home);
   } catch (err) {
-    if (err instanceof LoginError) return fail(deps, err.message);
+    if (err instanceof LoginError || err instanceof CloudConfigError) return fail(deps, err.message);
     throw err;
   }
 }

package/dist/{chunk-UKCNOAO6.js → chunk-6CGXSMKX.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-HXFRJKMU.js';
-import { workPageUrl } from './chunk-TEVO3RUV.js';
+import { detectActiveSession, autoConnect } from './chunk-H57M3HC7.js';
+import { workPageUrl } from './chunk-PZA6ZFYW.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-QRZLUUNN.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-MCSINUVC.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signRunnerRequest } from './chunk-F6DIHHBS.js';
+import { signRunnerRequest } from './chunk-GWRDL75D.js';
 
 createRequire(import.meta.url);
 
@@ -428,7 +428,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-SDFXJEAW.js');
+      const { logHookError } = await import('./hook-fast-XMZFMBKC.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-MLD2NA7N.js → chunk-6SPXKRQR.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { runnerDir } from './chunk-L4CW6LZQ.js';
+import { runnerDir } from './chunk-F3BBEBPL.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 

package/dist/{chunk-XFGL53GU.js → chunk-6WTAYEKJ.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-VJBFQP3H.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
+import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
 import { skillsBaseFor, isAgentsMdLayout } from './chunk-JKNYTNYD.js';
 import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, namesCore, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-4IFKLYMM.js → chunk-7Z2WMXM5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-TSW4DGV2.js → chunk-B6K7R5UY.js}

@@ -264,10 +264,10 @@ function guestAssetsPinned(arch) {
 var JAILER_BINARY_SHA256 = {
   x86_64: "65ef226e96f0ceda55ba643f445801ef2cc0ea667ef67cad8ac4f406c9c8434f"
 };
-var HOST_HELPER_ASSETS_VERSION = "5";
+var HOST_HELPER_ASSETS_VERSION = "8";
 var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;
 var HOST_HELPER_SHA256 = {
-  x86_64: "f2ec1c6a7ff29353045fad617ac1a6bf0155d6f3eb6a6259272a15342feaf957"
+  x86_64: "7c3a80da5e68adf3eb1eb407df0c770ccef589eb2da2f11735a9f9c05dc0d650"
 };
 function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
   return hashes[arch] !== "0".repeat(64);

package/dist/{chunk-364XDGOK.js → chunk-EHBDYLM6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-VHVFU6QU.js';
-import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-TSW4DGV2.js';
+import { MIN_ENGINE_MAJOR } from './chunk-SBW4K3XZ.js';
+import { runnerImageVersion } from './chunk-2J46BQ5Y.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-B6K7R5UY.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-L4CW6LZQ.js → chunk-F3BBEBPL.js}

@@ -52,6 +52,9 @@ function contextHomeDir(configPath) {
 function stagedContextDir(buildDirPath) {
   return join(buildDirPath, "context");
 }
+function keptContextDir(jobDirPath) {
+  return join(jobDirPath, "governed-context");
+}
 function runnerDirOfBuild(buildDirPath) {
   return dirname(dirname(buildDirPath));
 }
@@ -81,4 +84,4 @@ function deliveryDir(repository, sha) {
   return `${BUILD_HOME}/.outerlayer/context/${repository}/${sha}`;
 }
 
-export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, buildsDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };
+export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, buildsDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, keptContextDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };

package/dist/{chunk-GOSFARMS.js → chunk-G2JWZDFA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig, removeCloudConfigKeys } from './chunk-EABW6AJQ.js';
+import { readCloudConfigStrict, removeCloudConfigKeys } from './chunk-PJDQPF5N.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -27,7 +27,14 @@ async function revokeTokenOnDashboard(fetchImpl, dashboard, token) {
 }
 async function runLogoutCommand(deps) {
   const home = deps.home ?? homeFromEnv();
-  const config = readCloudConfig(home);
+  let config;
+  try {
+    config = readCloudConfigStrict(home);
+  } catch (err) {
+    deps.stderr.write(`${C.red}\u2717${C.reset} ${err.message}
+`);
+    return 1;
+  }
   const token = config.accountToken;
   if (!token) {
     deps.stdout.write("Not logged in.\n");

package/dist/{chunk-7LVF4E5V.js → chunk-GFHLEVUE.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-PYSKSROG.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-IZAOO5AR.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-TSW4DGV2.js';
-import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-B6K7R5UY.js';
+import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-2K3TCQHW.js';
 import { RELAY_ID, RELAY_USER } from './chunk-JGD5TWQ2.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';

package/dist/{chunk-F6DIHHBS.js → chunk-GWRDL75D.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-HXFRJKMU.js → chunk-H57M3HC7.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-TEVO3RUV.js';
-import { resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-PZA6ZFYW.js';
+import { resolveGatewayCredentials } from './chunk-MCSINUVC.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-PYSKSROG.js → chunk-IZAOO5AR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-KDDFI5MR.js → chunk-K4FXNMV5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-4IFKLYMM.js';
+import { currentLink } from './chunk-7Z2WMXM5.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-6M4LNO22.js → chunk-KNBWOL2B.js}

@@ -2,8 +2,8 @@
 import { createRequire } from 'node:module';
 import { runEmit } from './chunk-WX2WEERU.js';
 import { installStarterPack } from './chunk-VJBFQP3H.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-W3NVHOCS.js';
-import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-4UFSTKE5.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-JKNYTNYD.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-HBISTTG3.js';

package/dist/{chunk-YVZJ6GKF.js → chunk-KT4CN6OU.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { existsSync, writeFileSync, readFileSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-QRZLUUNN.js → chunk-MCSINUVC.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { signRunnerRequest, signerFor } from './chunk-F6DIHHBS.js';
+import { signRunnerRequest, signerFor } from './chunk-GWRDL75D.js';
 
 createRequire(import.meta.url);
 
@@ -27,7 +27,12 @@ function unauthorizedMessage(credential) {
 }
 function resolveGatewayCredentials(sources = {}) {
   const env = sources.env ?? process.env;
-  const config = readCloudConfig(sources.home ?? homeFromEnv(env));
+  let config;
+  try {
+    config = readCloudConfigStrict(sources.home ?? homeFromEnv(env));
+  } catch (err) {
+    return { ok: false, message: err.message, kind: "key" };
+  }
   const url = sources.url ?? env.OUTERLAYER_URL ?? config.url;
   const key = sources.apiKey ?? (env.OUTERLAYER_API_KEY || void 0) ?? config.apiKey;
   const kind = key ? "key" : "login";

package/dist/{chunk-6FAP657M.js → chunk-NWPRNKZ5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-TPAF24PK.js → chunk-O4362FPA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-HXFRJKMU.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { autoConnect, detectActiveSession } from './chunk-H57M3HC7.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-MCSINUVC.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-TKL74NLB.js → chunk-OFTFW7TH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-W7LGHNXT.js → chunk-OQUD3UYF.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-364XDGOK.js';
-import { MIN_ENGINE_MAJOR } from './chunk-VHVFU6QU.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-5PMQDQFV.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-EHBDYLM6.js';
+import { MIN_ENGINE_MAJOR } from './chunk-SBW4K3XZ.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-VGHKTSHU.js';
 import { runnerCredentialProblem } from './chunk-JWRX5ZTT.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';