@outerlayer/cli 0.26.3 → 0.27.0

package/dist/{chunk-MLD2NA7N.js → chunk-7AQ5AM7U.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-JWRX5ZTT.js';
-import { parseSize } from './chunk-7RQ73DLO.js';
-import { runnerDir } from './chunk-L4CW6LZQ.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-YB3CSYXX.js';
+import { builtinKind } from './chunk-EPPIISRD.js';
+import { parseSize } from './chunk-YJLHUKYS.js';
+import { runnerDir } from './chunk-RHAGBUL5.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
 
@@ -28,6 +29,7 @@ ${helperService === void 0 ? "" : `Wants=${helperService}
 User=${unit.user}
 ExecStart=${unit.execStart}
 ${unit.helper === void 0 ? "" : `Environment=OUTERLAYER_HELPER_SOCKET=${unit.helper.socket}
+`}${unit.fdStore === void 0 ? "" : `Environment=${FD_STORE_ENV}=${unit.fdStore}
 `}EnvironmentFile=-${escapeUnitPath(`${unit.configDir}/runner.env`)}
 Restart=on-failure
 RestartForceExitStatus=75
@@ -37,7 +39,10 @@ KillMode=mixed
 TimeoutStopSec=${unit.timeLimitMinutes + STOP_MARGIN_MINUTES}min
 OOMPolicy=continue
 Delegate=yes
-
+${unit.fdStore === void 0 ? "" : `NotifyAccess=all
+FileDescriptorStoreMax=${unit.fdStore}
+FileDescriptorStorePreserve=yes
+`}
 [Install]
 WantedBy=multi-user.target
 `;
@@ -147,7 +152,9 @@ function installService(request, deps) {
     execStart: request.execStart,
     timeLimitMinutes: request.timeLimitMinutes,
     docker: kind === "container" || kind === "vm" || builtinKind(request.hooks.cleanup) === "container" || builtinKind(request.hooks.cleanup) === "vm",
-    ...request.helperSocket !== void 0 && request.helperUnit !== void 0 ? { helper: { unit: request.helperUnit, socket: request.helperSocket } } : {}
+    ...request.helperSocket !== void 0 && request.helperUnit !== void 0 ? { helper: { unit: request.helperUnit, socket: request.helperSocket } } : {},
+    // A microVM build under the helper keeps its sockets in the descriptor store, so the runner can restart and the build goes on.
+    ...kind === "vm" && request.helperSocket !== void 0 && request.helperUnit !== void 0 ? { fdStore: Math.max(1, request.concurrency) * FD_SLOTS_PER_BUILD } : {}
   });
   if (request.print === true) return outcome(true, "printed", [], unit);
   if (own) return outcome(false, "refused", [OWN_HOOKS]);

package/dist/{chunk-HBISTTG3.js → chunk-7OUOLGUV.js}

@@ -13,13 +13,20 @@ function templateClassLine(version) {
   return `<!-- yours to edit. Copied once from the default template by outerlayer init ${version}; never overwritten. -->`;
 }
 function maintainedClassLine(version, base) {
+  if (base === MACHINE_SKILL_PATH) return `<!-- maintained by OuterLayer ${version}. Edits are overwritten by the next outerlayer command. -->`;
   const command = base === AGENTS_SKILLS_BASE ? "outerlayer init --update" : "outerlayer context emit";
   return `<!-- maintained by OuterLayer ${version}. Edits are overwritten on the next ${command}. -->`;
 }
 var OUTERLAYER_SKILLS_BASE = ".outerlayer/skills";
 var AGENTS_SKILLS_BASE = ".agents/skills";
+var MACHINE_SKILL_PATH = "~/.agents/skills";
+var MAINTAINED_SKILL_PATH_IN_PACK = new RegExp(`${OUTERLAYER_SKILLS_BASE.replace(".", "\\.")}/(outerlayer-[a-z]+)/`, "g");
 function rewriteSkillPaths(content, base) {
-  return base === OUTERLAYER_SKILLS_BASE ? content : content.split(`${OUTERLAYER_SKILLS_BASE}/`).join(`${base}/`);
+  if (base === OUTERLAYER_SKILLS_BASE) return content;
+  if (base === MACHINE_SKILL_PATH) {
+    return content.replace(MAINTAINED_SKILL_PATH_IN_PACK, `${MACHINE_SKILL_PATH}/$1/`).split(`${OUTERLAYER_SKILLS_BASE}/`).join(`${AGENTS_SKILLS_BASE}/`);
+  }
+  return content.split(`${OUTERLAYER_SKILLS_BASE}/`).join(`${base}/`);
 }
 function restoreSkillPaths(content, base) {
   return base === OUTERLAYER_SKILLS_BASE ? content : content.split(`${base}/`).join(`${OUTERLAYER_SKILLS_BASE}/`);
@@ -74,6 +81,9 @@ function loadTemplateFiles(packRoot = resolvePackRoot(), version = resolvePackag
 function loadMaintainedFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion(), base = OUTERLAYER_SKILLS_BASE) {
   return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version, base);
 }
+function loadMachineSkillFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion()) {
+  return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version, MACHINE_SKILL_PATH).map((file) => ({ ...file, path: file.path.slice(skillDir(file.skill, MACHINE_SKILL_PATH).length + 1) }));
+}
 function writeMaintainedFiles(repoRoot, files) {
   const created = [];
   const rewritten = [];
@@ -92,19 +102,20 @@ function maintainedFilesForExistingSkills(repoRoot, files, base = OUTERLAYER_SKI
     (file) => existsSync(join(repoRoot, skillDir(file.skill, base))) || formerNameExists(repoRoot, file.skill, base) || requiredByBuild(repoRoot, file.skill, base)
   );
 }
+var RELATIVE_CORE = "../outerlayer-build/SKILL.md";
 function namesCore(text) {
   return text.includes("outerlayer-build");
 }
 function requiredByBuild(repoRoot, skill, base) {
   if (skill !== "outerlayer-build") return false;
-  const named = (file) => {
+  const named = (file, pattern = "outerlayer-build") => {
     try {
-      return namesCore(readFileSync(file, "utf8"));
+      return readFileSync(file, "utf8").includes(pattern);
     } catch {
       return false;
     }
   };
-  if (named(join(repoRoot, skillDir("build", base), "SKILL.md"))) return true;
+  if (named(join(repoRoot, skillDir("build", base), "SKILL.md"), RELATIVE_CORE)) return true;
   const dir = join(repoRoot, ".outerlayer", "validators");
   try {
     return readdirSync(dir).some((name) => name.endsWith(".yaml") && named(join(dir, name)));
@@ -119,6 +130,10 @@ var FORMER_MAINTAINED_NAMES = {
   outerlayer: "outerlayer-cli"
 };
 var MAINTAINED_LINE = /^<!-- maintained by OuterLayer \S+?\. /m;
+var MAINTAINED_LINE_VERSION = /^<!-- maintained by OuterLayer (\S+?)\. /m;
+function maintainedLineVersion(text) {
+  return MAINTAINED_LINE_VERSION.exec(text)?.[1];
+}
 function isMaintainedCopy(repoRoot, skill, base = OUTERLAYER_SKILLS_BASE) {
   try {
     return MAINTAINED_LINE.test(readFileSync(join(repoRoot, skillDir(skill, base), "SKILL.md"), "utf8"));
@@ -130,4 +145,4 @@ function formerNameExists(repoRoot, skill, base) {
   return Object.entries(FORMER_MAINTAINED_NAMES).some(([former, current]) => current === skill && isMaintainedCopy(repoRoot, former, base));
 }
 
-export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MAINTAINED_SKILLS, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };
+export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MACHINE_SKILL_PATH, MAINTAINED_SKILLS, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMachineSkillFiles, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, maintainedLineVersion, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };

package/dist/{chunk-6FAP657M.js → chunk-ABXQBEYK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-TSW4DGV2.js → chunk-B6K7R5UY.js}

@@ -264,10 +264,10 @@ function guestAssetsPinned(arch) {
 var JAILER_BINARY_SHA256 = {
   x86_64: "65ef226e96f0ceda55ba643f445801ef2cc0ea667ef67cad8ac4f406c9c8434f"
 };
-var HOST_HELPER_ASSETS_VERSION = "5";
+var HOST_HELPER_ASSETS_VERSION = "8";
 var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;
 var HOST_HELPER_SHA256 = {
-  x86_64: "f2ec1c6a7ff29353045fad617ac1a6bf0155d6f3eb6a6259272a15342feaf957"
+  x86_64: "7c3a80da5e68adf3eb1eb407df0c770ccef589eb2da2f11735a9f9c05dc0d650"
 };
 function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
   return hashes[arch] !== "0".repeat(64);

package/dist/chunk-BM7EC3OZ.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { MAINTAINED_SKILLS, loadMachineSkillFiles, resolvePackRoot, maintainedLineVersion } from './chunk-7OUOLGUV.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { randomBytes } from 'crypto';
+import { existsSync, symlinkSync, lstatSync, readFileSync, mkdirSync, realpathSync, rmSync, renameSync, writeFileSync, cpSync } from 'fs';
+import { join, resolve, dirname, relative } from 'path';
+
+createRequire(import.meta.url);
+var machineSkillsBase = (home) => join(home, ".agents", "skills");
+var claudeSkillsBase = (home) => join(home, ".claude", "skills");
+var errorMessage = (err) => err instanceof Error ? err.message : String(err);
+var defaultLink = (target, path) => {
+  if (process.platform === "win32") symlinkSync(resolve(dirname(path), target), path, "junction");
+  else symlinkSync(target, path, "dir");
+};
+function installedVersion(folder) {
+  try {
+    return maintainedLineVersion(readFileSync(join(folder, "SKILL.md"), "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function entryExists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function folderExists(path) {
+  try {
+    return lstatSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function tempName(base, label) {
+  return join(base, `.${label}-${process.pid}-${randomBytes(4).toString("hex")}`);
+}
+var REPLACE_ATTEMPTS = 3;
+function replaceWith(final, build) {
+  const base = dirname(final);
+  mkdirSync(base, { recursive: true });
+  const temporary = tempName(base, "tmp");
+  try {
+    build(temporary);
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        renameSync(temporary, final);
+        return;
+      } catch (err) {
+        if (attempt >= REPLACE_ATTEMPTS - 1) throw err;
+        const old = tempName(base, "old");
+        try {
+          renameSync(final, old);
+          rmSync(old, { recursive: true, force: true });
+        } catch {
+        }
+      }
+    }
+  } finally {
+    rmSync(temporary, { recursive: true, force: true });
+  }
+}
+function writeSkill(final, files) {
+  replaceWith(final, (temporary) => {
+    for (const file of files) {
+      const abs = join(temporary, file.path);
+      mkdirSync(dirname(abs), { recursive: true });
+      writeFileSync(abs, file.content);
+    }
+  });
+}
+function sameFolder(a, b) {
+  try {
+    return realpathSync(a) === realpathSync(b);
+  } catch {
+    return false;
+  }
+}
+function linksTo(entry, target) {
+  try {
+    return lstatSync(entry).isSymbolicLink() && sameFolder(entry, target);
+  } catch {
+    return false;
+  }
+}
+function reachFromClaude(home, name, version, link, mode) {
+  const claude = claudeSkillsBase(home);
+  const folder = join(machineSkillsBase(home), name);
+  if (sameFolder(claude, machineSkillsBase(home))) return;
+  const entry = join(claude, name);
+  if (mode === "refresh" && !entryExists(entry)) return;
+  if (linksTo(entry, folder)) return;
+  if (folderExists(entry) && installedVersion(entry) === version) return;
+  mkdirSync(claude, { recursive: true });
+  try {
+    const temporary = tempName(claude, "tmp");
+    try {
+      link(relative(realpathSync(claude), realpathSync(folder)), temporary);
+      rmSync(entry, { recursive: true, force: true });
+      renameSync(temporary, entry);
+    } finally {
+      rmSync(temporary, { recursive: true, force: true });
+    }
+  } catch {
+    replaceWith(entry, (temporary) => cpSync(folder, temporary, { recursive: true }));
+  }
+}
+function installMachineSkills(opts) {
+  const result = { written: [], failures: [] };
+  const version = opts.version ?? resolvePackageVersion();
+  const base = machineSkillsBase(opts.home);
+  const link = opts.link ?? defaultLink;
+  let files;
+  const filesOf = (name) => {
+    files ??= loadMachineSkillFiles(opts.packRoot ?? resolvePackRoot(), version);
+    return files.filter((file) => file.skill === name);
+  };
+  for (const name of MAINTAINED_SKILLS) {
+    const folder = join(base, name);
+    try {
+      if (opts.mode === "refresh" && !folderExists(folder)) continue;
+      if (installedVersion(folder) !== version) {
+        writeSkill(folder, filesOf(name));
+        result.written.push(name);
+      }
+    } catch (err) {
+      result.failures.push(`${folder}: ${errorMessage(err)}`);
+      continue;
+    }
+    try {
+      reachFromClaude(opts.home, name, version, link, opts.mode);
+    } catch (err) {
+      result.failures.push(`${join(claudeSkillsBase(opts.home), name)}: ${errorMessage(err)}`);
+    }
+  }
+  return result;
+}
+function machineSkillsState(home, version = resolvePackageVersion()) {
+  return MAINTAINED_SKILLS.map((name) => {
+    const folder = join(machineSkillsBase(home), name);
+    if (!existsSync(join(folder, "SKILL.md"))) return { name, state: "missing" };
+    return { name, state: installedVersion(folder) === version ? "current" : "stale" };
+  });
+}
+function staleClaudeSkills(home, version = resolvePackageVersion()) {
+  const claude = claudeSkillsBase(home);
+  if (sameFolder(claude, machineSkillsBase(home))) return [];
+  return MAINTAINED_SKILLS.filter((name) => {
+    const entry = join(claude, name);
+    if (!entryExists(entry)) return false;
+    if (linksTo(entry, join(machineSkillsBase(home), name))) return false;
+    return installedVersion(entry) !== version;
+  });
+}
+function setupMachineSkills(home = homeFromEnv()) {
+  try {
+    return installMachineSkills({ home, mode: "setup" });
+  } catch (err) {
+    return { written: [], failures: [errorMessage(err)] };
+  }
+}
+function refreshMachineSkills(home = homeFromEnv()) {
+  try {
+    installMachineSkills({ home, mode: "refresh" });
+  } catch {
+  }
+}
+function machineRefreshSkipped(commandNames, hidden, argv) {
+  const top = commandNames.at(-1);
+  if (top === "daemon" || top === "watch" || commandNames[0] === "daemon" || commandNames[0] === "watch") return true;
+  if (hidden) return true;
+  if (argv.includes("--log-failures")) return true;
+  return top === "sync" && argv.includes("--quiet");
+}
+
+export { installMachineSkills, machineRefreshSkipped, machineSkillsState, refreshMachineSkills, setupMachineSkills, staleClaudeSkills };

package/dist/{chunk-W3NVHOCS.js → chunk-BPKO76QR.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-MQ743JX3.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { removeRetiredSkills } from './chunk-MHX7YX7Y.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-BWH36FOC.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-HBISTTG3.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-7OUOLGUV.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-2K3TCQHW.js';
+import { withTokenHeader } from './chunk-2I3LIRZP.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-QRZLUUNN.js → chunk-BWH36FOC.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { signRunnerRequest, signerFor } from './chunk-F6DIHHBS.js';
+import { signRunnerRequest, signerFor } from './chunk-Y4OKEFAX.js';
 
 createRequire(import.meta.url);
 
@@ -27,7 +27,12 @@ function unauthorizedMessage(credential) {
 }
 function resolveGatewayCredentials(sources = {}) {
   const env = sources.env ?? process.env;
-  const config = readCloudConfig(sources.home ?? homeFromEnv(env));
+  let config;
+  try {
+    config = readCloudConfigStrict(sources.home ?? homeFromEnv(env));
+  } catch (err) {
+    return { ok: false, message: err.message, kind: "key" };
+  }
   const url = sources.url ?? env.OUTERLAYER_URL ?? config.url;
   const key = sources.apiKey ?? (env.OUTERLAYER_API_KEY || void 0) ?? config.apiKey;
   const kind = key ? "key" : "login";

package/dist/{chunk-PYSKSROG.js → chunk-D7ECMB7B.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
-import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -11,7 +11,7 @@ function readPidFile(path) {
   try {
     const parsed = JSON.parse(readFileSync(path, "utf8"));
     if (typeof parsed.pid !== "number" || typeof parsed.start !== "string") return null;
-    return { pid: parsed.pid, start: parsed.start };
+    return { pid: parsed.pid, start: parsed.start, ...parsed.leaves === true ? { leaves: true } : {} };
   } catch {
     return null;
   }
@@ -39,4 +39,4 @@ function claimPidFile(path, self, isSameProcessFn = isSameProcess) {
   writePidFile(path, self);
 }
 
-export { RunnerAlreadyRunningError, claimPidFile, readPidFile, releasePidFile };
+export { RunnerAlreadyRunningError, claimPidFile, readPidFile, releasePidFile, writePidFile };

package/dist/{chunk-FO7F6QSV.js → chunk-DJHNEGNM.js}

@@ -554,6 +554,24 @@ function writeSessionStartContext(event, home, cwd, write, systemMessage, extraP
   } catch {
   }
 }
+var MACHINE_CORE = "~/.agents/skills/outerlayer-build/SKILL.md";
+var BUILD_SKILL_FILES = [".agents/skills/build/SKILL.md", ".outerlayer/skills/build/SKILL.md", ".claude/skills/build/SKILL.md"];
+function machineSkillsContext(home, cwd) {
+  for (let dir = cwd; ; dir = join(dir, "..")) {
+    for (const file of BUILD_SKILL_FILES) {
+      let text;
+      try {
+        text = readFileSync(join(dir, file), "utf8");
+      } catch {
+        continue;
+      }
+      if (!text.includes(MACHINE_CORE)) return null;
+      if (existsSync(join(home, ".agents", "skills", "outerlayer-build", "SKILL.md"))) return null;
+      return `This repository's build skill reads ${MACHINE_CORE}, and that file does not exist. Tell the person that the maintained skills are not installed on this machine, and ask them to run \`${cliInvocation()} init --local\`.`;
+    }
+    if (join(dir, "..") === dir) return null;
+  }
+}
 var HEAL_RETRY_INTERVAL_MS = 6 * 60 * 60 * 1e3;
 function healFailureMarkerPath(home, repoRoot) {
   const key = createHash("sha256").update(repoRoot).digest("hex").slice(0, 16);
@@ -664,7 +682,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-654RV5PO.js');
+  const { governanceOf } = await import('./control-plane-launch-DBQA3KLJ.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;
@@ -735,6 +753,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
     let workLaunchMessage;
     let hookErrorsMessage;
     let renewalHookMessage;
+    let machineSkillsMessage;
     if (resolvedEvent === "SessionStart") {
       const hookErrorsBytes = fileSizeBytes(join(dir, "hook-errors.log"));
       const hookErrorsSeen = hookErrorsSeenBytes(home);
@@ -752,6 +771,11 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
           logHookError(home, err);
         }
       }
+      try {
+        machineSkillsMessage = machineSkillsContext(home, sessionCwd) ?? void 0;
+      } catch (err) {
+        logHookError(home, err);
+      }
       try {
         deadHooksMessage = deadHooksAutoHealContext(sessionCwd, home) ?? void 0;
       } catch (err) {
@@ -776,7 +800,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       sessionCwd,
       (out) => process.stdout.write(out),
       missingPlane?.person,
-      [missingPlane?.agent, deadHooksMessage, workLaunchMessage, hookErrorsMessage, renewalHookMessage].filter(
+      [missingPlane?.agent, machineSkillsMessage, deadHooksMessage, workLaunchMessage, hookErrorsMessage, renewalHookMessage].filter(
         (s) => s !== void 0
       )
     );
@@ -810,4 +834,4 @@ function recordLinkExitFailure(argv, home = homeFromEnv(), target = process) {
   });
 }
 
-export { AUTO_SYNC_DEBOUNCE_MS, DUPLICATE_RUN_WINDOW_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, isDuplicateRun, logHookError, markWorkLeaseRenewed, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, recordLinkExitFailure, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };
+export { AUTO_SYNC_DEBOUNCE_MS, DUPLICATE_RUN_WINDOW_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, isDuplicateRun, logHookError, machineSkillsContext, markWorkLeaseRenewed, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, recordLinkExitFailure, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };

package/dist/{chunk-TPAF24PK.js → chunk-E5IJ5533.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-HXFRJKMU.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { autoConnect, detectActiveSession } from './chunk-2F762IXY.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-BWH36FOC.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-JWRX5ZTT.js → chunk-EPPIISRD.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
-import { parseSize } from './chunk-7RQ73DLO.js';
+import { parseSize } from './chunk-YJLHUKYS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-2K3TCQHW.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-2I3LIRZP.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';

package/dist/{chunk-6M4LNO22.js → chunk-FP23SVDD.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-WX2WEERU.js';
-import { installStarterPack } from './chunk-VJBFQP3H.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-W3NVHOCS.js';
-import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
+import { runEmit } from './chunk-WUL2OP5A.js';
+import { installStarterPack } from './chunk-XZ6Q6ZNR.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-LOKSLO25.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-BPKO76QR.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-7OUOLGUV.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-JKNYTNYD.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-VWFOKRYS.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';

package/dist/{chunk-GOSFARMS.js → chunk-G2JWZDFA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig, removeCloudConfigKeys } from './chunk-EABW6AJQ.js';
+import { readCloudConfigStrict, removeCloudConfigKeys } from './chunk-PJDQPF5N.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -27,7 +27,14 @@ async function revokeTokenOnDashboard(fetchImpl, dashboard, token) {
 }
 async function runLogoutCommand(deps) {
   const home = deps.home ?? homeFromEnv();
-  const config = readCloudConfig(home);
+  let config;
+  try {
+    config = readCloudConfigStrict(home);
+  } catch (err) {
+    deps.stderr.write(`${C.red}\u2717${C.reset} ${err.message}
+`);
+    return 1;
+  }
   const token = config.accountToken;
   if (!token) {
     deps.stdout.write("Not logged in.\n");

package/dist/{chunk-XFGL53GU.js → chunk-G3EZA6MK.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-VJBFQP3H.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-XZ6Q6ZNR.js';
+import { skillsBaseFor, isAgentsMdLayout } from './chunk-LOKSLO25.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
-import { skillsBaseFor, isAgentsMdLayout } from './chunk-JKNYTNYD.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, namesCore, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-HBISTTG3.js';
+import { machineSkillsState, staleClaudeSkills } from './chunk-BM7EC3OZ.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, AGENTS_SKILLS_BASE, MAINTAINED_SKILLS, isMaintainedCopy, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-7OUOLGUV.js';
+import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { hasSymlinkComponent } from './chunk-VWFOKRYS.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
@@ -190,6 +191,7 @@ function checkStarterFiles(cwd, opts = {}) {
   return { checks: [{ name: NAME, status: "warn", detail: parts.join("; "), fix }], mcpOutdated };
 }
 var BUILD_PHASES = ["Intake", "Criteria", "Implement", "Review", "Pull request", "Evidence"];
+var MACHINE_CORE = `${MACHINE_SKILL_PATH}/outerlayer-build/SKILL.md`;
 var CHANGES_HEADING = "## Changes for this repository";
 var NAME2 = "Build skill";
 function changeHeadings(text) {
@@ -226,10 +228,13 @@ var read = (abs) => {
     return void 0;
   }
 };
+function buildsOf(repoRoot, folders) {
+  const source = `${folders[0]}/build/SKILL.md`;
+  return (existsSync(join(repoRoot, source)) ? [source] : folders.slice(1).map((f) => `${f}/build/SKILL.md`)).map((path) => ({ path, text: read(join(repoRoot, path)) })).filter((b) => b.text !== void 0);
+}
 function checkBuildSkill(repoRoot) {
   const folders = [".outerlayer/skills", ...skillsFolders()];
-  const source = `${folders[0]}/build/SKILL.md`;
-  const builds = (existsSync(join(repoRoot, source)) ? [source] : folders.slice(1).map((f) => `${f}/build/SKILL.md`)).map((path) => ({ path, text: read(join(repoRoot, path)) })).filter((b) => b.text !== void 0);
+  const builds = buildsOf(repoRoot, folders);
   const checks = [];
   const detached = builds.filter((b) => !namesCore(b.text));
   if (detached.length > 0) {
@@ -255,7 +260,8 @@ ${shortBuild()}`
   const agentsMd = isAgentsMdLayout(repoRoot);
   const seen = /* @__PURE__ */ new Set();
   const lacking = folders.filter((folder) => {
-    if (!namesCore(read(join(repoRoot, folder, "build", "SKILL.md")) ?? "") || existsSync(join(repoRoot, folder, "outerlayer-build", "SKILL.md"))) return false;
+    const text = read(join(repoRoot, folder, "build", "SKILL.md")) ?? "";
+    if (!namesCore(text) || text.includes(MACHINE_CORE) || existsSync(join(repoRoot, folder, "outerlayer-build", "SKILL.md"))) return false;
     let key = folder;
     try {
       key = realpathSync(join(repoRoot, folder));
@@ -275,5 +281,47 @@ ${shortBuild()}`
   }
   return checks;
 }
+function committedMaintainedFolders(repoRoot) {
+  const found = [];
+  for (const base of [AGENTS_SKILLS_BASE, ".claude/skills"]) {
+    for (const name of MAINTAINED_SKILLS) {
+      const folder = skillDir(name, base);
+      if (!hasSymlinkComponent(repoRoot, folder) && isMaintainedCopy(repoRoot, name, base)) found.push(folder);
+    }
+  }
+  return found;
+}
+function checkCommittedMaintainedSkills(repoRoot) {
+  if (!isAgentsMdLayout(repoRoot)) return [];
+  const folders = committedMaintainedFolders(repoRoot);
+  if (folders.length === 0) return [];
+  return [
+    {
+      name: "Committed maintained skills",
+      status: "warn",
+      detail: `${folders.join(", ")} ${folders.length === 1 ? "is a maintained skill" : "are maintained skills"} that every machine keeps in ${MACHINE_SKILL_PATH}/ now`,
+      fix: `Run \`${cliInvocation()} init --update\` to remove ${folders.length === 1 ? "it" : "them"}, then commit. Before you commit, every machine and runner host must run this CLI version or later, and each machine a person works on must run \`${cliInvocation()} init --local\`.`
+    }
+  ];
+}
+function checkMachineSkills(opts) {
+  const build = buildsOf(opts.repoRoot, [".outerlayer/skills", ...skillsFolders()]).find((b) => b.text.includes(MACHINE_CORE));
+  if (build === void 0) return [];
+  const problems = machineSkillsState(opts.home, opts.version).filter((s) => s.state !== "current");
+  const claudeStale = staleClaudeSkills(opts.home, opts.version);
+  if (problems.length === 0 && claudeStale.length === 0) return [];
+  const parts = [
+    ...problems.map((s) => `${MACHINE_SKILL_PATH}/${s.name} ${s.state === "missing" ? "is missing" : "is from another CLI version"}`),
+    ...claudeStale.map((name) => `~/.claude/skills/${name} is not this CLI version's copy`)
+  ];
+  return [
+    {
+      name: "Maintained skills on this machine",
+      status: "warn",
+      detail: `${build.path} reads ${MACHINE_CORE}, but ${parts.join(", ")}`,
+      fix: `Run \`${cliInvocation()} init --local\` on this machine. If it reports a failed write, fix the permissions on the folder it names first.`
+    }
+  ];
+}
 
-export { canonical, checkBuildSkill, checkStarterFiles, contentHash, contextIsGoverned, inspectStarterFiles, readShippedManifest, skillsFolders };
+export { canonical, checkBuildSkill, checkCommittedMaintainedSkills, checkMachineSkills, checkStarterFiles, committedMaintainedFolders, contentHash, contextIsGoverned, inspectStarterFiles, readShippedManifest, skillsFolders };

package/dist/{chunk-5PMQDQFV.js → chunk-GFUE5TKO.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-MLD2NA7N.js';
-import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import { RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { DEFAULT_UNIT_NAME } from './chunk-7AQ5AM7U.js';
+import { parseRunnerEnv } from './chunk-STSLH5EJ.js';
+import { RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';