@outerlayer/cli 0.26.4 → 0.27.0

package/dist/{command-E5OG5NCH.js → command-B2T7VR77.js}

@@ -1,45 +1,46 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runRunnerInstall, launcherSummary, restartNote } from './chunk-Y4BXRVDI.js';
-import './chunk-K4FXNMV5.js';
-import { currentLink, execStartCommand } from './chunk-7Z2WMXM5.js';
-import { detectMachine } from './chunk-EHBDYLM6.js';
-import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-SBW4K3XZ.js';
-import './chunk-2J46BQ5Y.js';
+import { runRunnerInstall, launcherSummary, restartNote } from './chunk-QKIQ2R7F.js';
+import './chunk-QHH4OSD4.js';
+import { currentLink, execStartCommand } from './chunk-MATUHHN4.js';
+import { detectMachine } from './chunk-UQYBCJ2L.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-YF56R4DV.js';
+import './chunk-WSYXLLA5.js';
+import './chunk-M3MHHIUW.js';
 import './chunk-TQMI335S.js';
-import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-6SPXKRQR.js';
-import './chunk-GFHLEVUE.js';
-import './chunk-IZAOO5AR.js';
+import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-7AQ5AM7U.js';
+import './chunk-YB3CSYXX.js';
+import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
+import './chunk-24ID7EQ2.js';
+import './chunk-D7ECMB7B.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import { readJobFile } from './chunk-QUP6CVBQ.js';
+import { readJobFile } from './chunk-JH2GQU5T.js';
 import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-B6K7R5UY.js';
-import './chunk-MXTN35XN.js';
-import './chunk-XLC7KEUV.js';
-import './chunk-OZKEEXVH.js';
-import './chunk-6CGXSMKX.js';
-import './chunk-H57M3HC7.js';
-import './chunk-PZA6ZFYW.js';
+import './chunk-XBPUTQ7E.js';
+import './chunk-GLUKDQS4.js';
+import './chunk-55GNQPO6.js';
+import './chunk-2F762IXY.js';
+import './chunk-N4D5TMVU.js';
 import './chunk-BUP5N3X6.js';
+import './chunk-LOKSLO25.js';
 import './chunk-6BLXUD56.js';
 import './chunk-G2JWZDFA.js';
-import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-JWRX5ZTT.js';
+import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-EPPIISRD.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-7RQ73DLO.js';
+import './chunk-YJLHUKYS.js';
 import { realLima } from './chunk-77MM5RYD.js';
-import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
-import './chunk-4UFSTKE5.js';
-import './chunk-MQ743JX3.js';
-import './chunk-MCSINUVC.js';
+import './chunk-BPKO76QR.js';
+import './chunk-MHX7YX7Y.js';
+import './chunk-BWH36FOC.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-VPEGE3QZ.js';
+import './chunk-6TRNCUM4.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
+import './chunk-7OUOLGUV.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-JKNYTNYD.js';
-import './chunk-HBISTTG3.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
 import './chunk-YQR6E6OV.js';
@@ -47,9 +48,9 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-GWRDL75D.js';
-import { runnerDir } from './chunk-F3BBEBPL.js';
-import './chunk-2K3TCQHW.js';
+import './chunk-Y4OKEFAX.js';
+import { runnerDir } from './chunk-RHAGBUL5.js';
+import './chunk-2I3LIRZP.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { userInfo, totalmem, tmpdir } from 'os';

package/dist/{config-JJ3EO7SB.js → config-TWS5VZEN.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf } from './chunk-JWRX5ZTT.js';
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf } from './chunk-EPPIISRD.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-7RQ73DLO.js';
+import './chunk-YJLHUKYS.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-2K3TCQHW.js';
+import './chunk-2I3LIRZP.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{connect-cmd-SL4S5HJM.js → connect-cmd-HGS7YPA2.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitLineFor, listText as factoryListText, slug as factorySlug, fetchFactories, hasUncommittedPolicy, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory } from './chunk-PZA6ZFYW.js';
+export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitLineFor, listText as factoryListText, slug as factorySlug, fetchFactories, hasUncommittedPolicy, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory } from './chunk-N4D5TMVU.js';
 import './chunk-BUP5N3X6.js';
+import './chunk-LOKSLO25.js';
 import './chunk-6BLXUD56.js';
 import './chunk-G2JWZDFA.js';
-import './chunk-MCSINUVC.js';
+import './chunk-BWH36FOC.js';
 import './chunk-BJ3KTMDH.js';
+import './chunk-7OUOLGUV.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-JKNYTNYD.js';
-import './chunk-HBISTTG3.js';
 import './chunk-CRB3POP4.js';
 import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-GWRDL75D.js';
-import './chunk-F3BBEBPL.js';
-import './chunk-2K3TCQHW.js';
+import './chunk-Y4OKEFAX.js';
+import './chunk-RHAGBUL5.js';
+import './chunk-2I3LIRZP.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{container-start-IA2HK4QI.js → container-start-JE7HTKZG.js}

@@ -1,43 +1,44 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-OQUD3UYF.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-EHBDYLM6.js';
-import { MIN_ENGINE_MAJOR } from './chunk-SBW4K3XZ.js';
-import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-2J46BQ5Y.js';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-QIVOTQOQ.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-UQYBCJ2L.js';
+import { MIN_ENGINE_MAJOR } from './chunk-YF56R4DV.js';
+import './chunk-WSYXLLA5.js';
+import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-M3MHHIUW.js';
 import './chunk-TQMI335S.js';
-import { isAgentName, AGENT_COMMANDS } from './chunk-VGHKTSHU.js';
-import './chunk-6SPXKRQR.js';
-import './chunk-6MZSX4M7.js';
-import './chunk-GFHLEVUE.js';
-import './chunk-IZAOO5AR.js';
+import { isAgentName, AGENT_COMMANDS } from './chunk-GFUE5TKO.js';
+import './chunk-7AQ5AM7U.js';
+import './chunk-YB3CSYXX.js';
+import './chunk-STSLH5EJ.js';
+import './chunk-24ID7EQ2.js';
+import './chunk-D7ECMB7B.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-QUP6CVBQ.js';
+import './chunk-JH2GQU5T.js';
 import './chunk-B6K7R5UY.js';
-import './chunk-MXTN35XN.js';
-import './chunk-XLC7KEUV.js';
-import './chunk-OZKEEXVH.js';
-import './chunk-6CGXSMKX.js';
-import './chunk-H57M3HC7.js';
-import './chunk-PZA6ZFYW.js';
+import './chunk-XBPUTQ7E.js';
+import './chunk-GLUKDQS4.js';
+import './chunk-55GNQPO6.js';
+import './chunk-2F762IXY.js';
+import './chunk-N4D5TMVU.js';
 import './chunk-BUP5N3X6.js';
+import './chunk-LOKSLO25.js';
 import './chunk-6BLXUD56.js';
 import './chunk-G2JWZDFA.js';
-import './chunk-JWRX5ZTT.js';
+import './chunk-EPPIISRD.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-7RQ73DLO.js';
-import './chunk-4UFSTKE5.js';
-import './chunk-MQ743JX3.js';
-import './chunk-MCSINUVC.js';
+import './chunk-YJLHUKYS.js';
+import './chunk-BPKO76QR.js';
+import './chunk-MHX7YX7Y.js';
+import './chunk-BWH36FOC.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-VPEGE3QZ.js';
+import './chunk-6TRNCUM4.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
+import './chunk-7OUOLGUV.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-JKNYTNYD.js';
-import './chunk-HBISTTG3.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
 import './chunk-YQR6E6OV.js';
@@ -45,9 +46,9 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-GWRDL75D.js';
-import './chunk-F3BBEBPL.js';
-import { CLAUDE_CREDENTIAL_VARIABLES } from './chunk-2K3TCQHW.js';
+import './chunk-Y4OKEFAX.js';
+import './chunk-RHAGBUL5.js';
+import { CLAUDE_CREDENTIAL_VARIABLES } from './chunk-2I3LIRZP.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { existsSync, readFileSync } from 'fs';

package/dist/{control-plane-launch-JIQOE6BP.js → control-plane-launch-DBQA3KLJ.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseOwnerRepo, lookupGoverningSource, defaultGitRunner, materializeContext } from './chunk-4UFSTKE5.js';
-import './chunk-MQ743JX3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-MCSINUVC.js';
+import { parseOwnerRepo, lookupGoverningSource, defaultGitRunner, materializeContext } from './chunk-BPKO76QR.js';
+import './chunk-MHX7YX7Y.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-BWH36FOC.js';
 import './chunk-ZJSNLVCE.js';
-import { layoutRefusalMessage, unsupportedLayout, sharedSkillNames, skillConflictMessage, composeDelivery } from './chunk-VPEGE3QZ.js';
+import { layoutRefusalMessage, unsupportedLayout, sharedSkillNames, skillConflictMessage, composeDelivery } from './chunk-6TRNCUM4.js';
 import './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import './chunk-7OUOLGUV.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-HBISTTG3.js';
 import './chunk-CRB3POP4.js';
 import { cleanupEarlierCopies } from './chunk-VWFOKRYS.js';
 import { readSourceCache, readDeliveryRecord, isSourceCacheFresh, writeDeliveryRecord, writeSourceCache, SOURCE_CACHE_TTL_SUCCESS_MS, clearDegraded, removeLauncherDeliveryRecord } from './chunk-YQR6E6OV.js';
@@ -17,9 +17,9 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-GWRDL75D.js';
-import './chunk-F3BBEBPL.js';
-import './chunk-2K3TCQHW.js';
+import './chunk-Y4OKEFAX.js';
+import './chunk-RHAGBUL5.js';
+import './chunk-2I3LIRZP.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { execFileSync } from 'child_process';

package/dist/{docker-KKE5Q5S2.js → docker-MJEEHUUA.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { childEnvironment, createDockerHost, spawnRun } from './chunk-QUP6CVBQ.js';
+export { childEnvironment, createDockerHost, spawnRun } from './chunk-JH2GQU5T.js';
 import './chunk-B6K7R5UY.js';
-import './chunk-7RQ73DLO.js';
+import './chunk-YJLHUKYS.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-GWRDL75D.js';
-import './chunk-F3BBEBPL.js';
-import './chunk-2K3TCQHW.js';
+import './chunk-Y4OKEFAX.js';
+import './chunk-RHAGBUL5.js';
+import './chunk-2I3LIRZP.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{doctor-U2N7AF3N.js → doctor-6ZIF2BRZ.js}

@@ -1,48 +1,49 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherCheck } from './chunk-K4FXNMV5.js';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-UOGQZQXN.js';
-import './chunk-7Z2WMXM5.js';
+import { launcherCheck } from './chunk-QHH4OSD4.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-WVDP6HVZ.js';
+import './chunk-MATUHHN4.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-OQUD3UYF.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-EHBDYLM6.js';
-import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-SBW4K3XZ.js';
-import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-2J46BQ5Y.js';
+import './chunk-QIVOTQOQ.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-UQYBCJ2L.js';
+import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-YF56R4DV.js';
+import './chunk-WSYXLLA5.js';
+import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-M3MHHIUW.js';
 import './chunk-TQMI335S.js';
-import './chunk-VGHKTSHU.js';
-import './chunk-6SPXKRQR.js';
-import './chunk-6MZSX4M7.js';
-import './chunk-GFHLEVUE.js';
-import './chunk-IZAOO5AR.js';
+import './chunk-GFUE5TKO.js';
+import './chunk-7AQ5AM7U.js';
+import './chunk-YB3CSYXX.js';
+import './chunk-STSLH5EJ.js';
+import './chunk-24ID7EQ2.js';
+import './chunk-D7ECMB7B.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-QUP6CVBQ.js';
+import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-JH2GQU5T.js';
 import { locateRecipe, assertBuildable, readRecipe, RecipeError, FIRECRACKER_VERSION, CLAUDE_CODE_VERSION } from './chunk-B6K7R5UY.js';
-import './chunk-MXTN35XN.js';
-import './chunk-XLC7KEUV.js';
-import './chunk-OZKEEXVH.js';
-import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-6CGXSMKX.js';
-import './chunk-H57M3HC7.js';
-import './chunk-PZA6ZFYW.js';
+import './chunk-XBPUTQ7E.js';
+import './chunk-GLUKDQS4.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-55GNQPO6.js';
+import './chunk-2F762IXY.js';
+import './chunk-N4D5TMVU.js';
 import './chunk-BUP5N3X6.js';
+import './chunk-LOKSLO25.js';
 import './chunk-6BLXUD56.js';
 import './chunk-G2JWZDFA.js';
-import { builtinKind } from './chunk-JWRX5ZTT.js';
+import { builtinKind } from './chunk-EPPIISRD.js';
 import { allowHostProblem, MAX_ALLOW_HOSTS } from './chunk-UXYLWVTQ.js';
-import { parseSize } from './chunk-7RQ73DLO.js';
-import { defaultGitRunner } from './chunk-4UFSTKE5.js';
-import './chunk-MQ743JX3.js';
-import { defaultFetch } from './chunk-MCSINUVC.js';
+import { parseSize } from './chunk-YJLHUKYS.js';
+import { defaultGitRunner } from './chunk-BPKO76QR.js';
+import './chunk-MHX7YX7Y.js';
+import { defaultFetch } from './chunk-BWH36FOC.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-VPEGE3QZ.js';
+import './chunk-6TRNCUM4.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
+import './chunk-7OUOLGUV.js';
 import { compareVersions } from './chunk-QE3UQAHK.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-JKNYTNYD.js';
-import './chunk-HBISTTG3.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
 import './chunk-YQR6E6OV.js';
@@ -50,9 +51,9 @@ import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import { loadHostKey } from './chunk-GWRDL75D.js';
-import { runnerDir, buildsDir, hostKeyPath, jobsDir } from './chunk-F3BBEBPL.js';
-import './chunk-2K3TCQHW.js';
+import { loadHostKey } from './chunk-Y4OKEFAX.js';
+import { runnerDir, buildsDir, hostKeyPath, jobsDir } from './chunk-RHAGBUL5.js';
+import './chunk-2I3LIRZP.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { spawnSync } from 'child_process';
@@ -61,6 +62,136 @@ import { totalmem, tmpdir } from 'os';
 import { join } from 'path';
 
 createRequire(import.meta.url);
+var NESTED_FILES = [
+  { module: "kvm_intel", feature: "VMX", path: "/sys/module/kvm_intel/parameters/nested" },
+  { module: "kvm_amd", feature: "SVM", path: "/sys/module/kvm_amd/parameters/nested" }
+];
+var VMSCAPE_FILE = "/sys/devices/system/cpu/vulnerabilities/vmscape";
+var readText = (path) => readFileSync(path, "utf8");
+var reasonOf = (err) => err instanceof Error ? err.message : String(err);
+function nestedVirtualizationCheck(probes = {}) {
+  const name = "Nested virtualization";
+  const read = probes.readHostFile ?? readText;
+  const found = NESTED_FILES.flatMap((file) => {
+    try {
+      return [{ ...file, value: read(file.path).trim() }];
+    } catch {
+      return [];
+    }
+  });
+  const on = found.find((file) => file.value === "Y" || file.value === "1");
+  if (on !== void 0) {
+    return {
+      name,
+      status: "warn",
+      detail: `${on.module} allows nested virtualization (${on.path} is ${on.value}), so every microVM build sees ${on.feature} and can use the nested-virtualization code in this host's kernel`,
+      fix: `add \`options ${on.module} nested=0\` to a file in /etc/modprobe.d, then reboot, or reload ${on.module} while no microVM runs`
+    };
+  }
+  const odd = found.find((file) => !["N", "0"].includes(file.value));
+  if (odd !== void 0) {
+    return {
+      name,
+      status: "warn",
+      detail: `${odd.path} holds "${odd.value}", which doctor does not know, so it cannot tell whether microVM builds see ${odd.feature}`,
+      fix: `check that the ${odd.module} module is loaded and reports nested as Y, N, 1 or 0`
+    };
+  }
+  if (found.length === 0) {
+    return {
+      name,
+      status: "warn",
+      detail: `doctor could not read either ${NESTED_FILES[0].path} or ${NESTED_FILES[1].path}, so it cannot tell whether microVM builds see VMX or SVM`,
+      fix: "check that the kvm_intel or kvm_amd module is loaded"
+    };
+  }
+  const first = found[0];
+  return { name, status: "pass", detail: `${first.module} does not allow nested virtualization (${first.path} is ${first.value}), so no microVM build sees ${first.feature}` };
+}
+function vmscapeCheck(probes = {}) {
+  const name = "VMScape";
+  let value;
+  try {
+    value = (probes.readHostFile ?? readText)(VMSCAPE_FILE).trim();
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return {
+        name,
+        status: "skipped",
+        detail: `this kernel does not report VMScape, so doctor cannot tell whether this host is exposed. Kernels without the September 2025 fix have no ${VMSCAPE_FILE}`,
+        fix: "update the kernel. A kernel with the fix reports VMScape in that file"
+      };
+    }
+    return unknownVmscape(name, `${VMSCAPE_FILE} cannot be read: ${reasonOf(err)}`);
+  }
+  if (value === "Not affected" || value.startsWith("Mitigation:")) {
+    return { name, status: "pass", detail: `the kernel reports VMScape (CVE-2025-40300) as "${value}"` };
+  }
+  if (value.startsWith("Vulnerable")) {
+    return {
+      name,
+      status: "warn",
+      detail: `the kernel reports VMScape (CVE-2025-40300) as "${value}", so a microVM build can influence branch prediction in the Firecracker process that runs it`,
+      fix: "boot without vmscape=off or mitigations=off. Load current CPU microcode. Use a kernel built with the VMScape mitigation"
+    };
+  }
+  return unknownVmscape(name, `${VMSCAPE_FILE} holds "${value}", which doctor does not know`);
+}
+function unknownVmscape(name, reason) {
+  return { name, status: "warn", detail: `${reason}, so doctor cannot tell whether this host is exposed to VMScape (CVE-2025-40300)` };
+}
+function parseRuncVersion(text) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-rc\.(\d+))?/.exec(text.trim());
+  if (match === null) return void 0;
+  return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), candidate: match[4] === void 0 ? Infinity : Number(match[4]) };
+}
+var atLeast = (version, floor) => {
+  for (const key of ["major", "minor", "patch", "candidate"]) {
+    if (version[key] !== floor[key]) return version[key] > floor[key];
+  }
+  return true;
+};
+function runcIsFixed(version) {
+  if (version.minor === 2) return atLeast(version, { major: 1, minor: 2, patch: 8, candidate: Infinity });
+  if (version.minor === 3) return atLeast(version, { major: 1, minor: 3, patch: 3, candidate: Infinity });
+  return atLeast(version, { major: 1, minor: 4, patch: 0, candidate: 3 });
+}
+function dockerServerComponents() {
+  const result = spawnSync("docker", ["version", "--format", "{{json .Server.Components}}"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
+  return result.status === 0 ? result.stdout : void 0;
+}
+function runcVersionOf(output) {
+  if (output === void 0) return void 0;
+  try {
+    const components = JSON.parse(output);
+    const runc = components.find((c) => c?.Name === "runc");
+    return typeof runc?.Version === "string" && runc.Version !== "" ? runc.Version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function runcCheck(probes = {}) {
+  const name = "runc";
+  const reported = runcVersionOf((probes.dockerServerComponents ?? dockerServerComponents)());
+  const version = reported === void 0 ? void 0 : parseRuncVersion(reported);
+  if (version === void 0) {
+    return {
+      name,
+      status: "warn",
+      detail: reported === void 0 ? "doctor could not read the version of runc that Docker uses, so it cannot tell whether container builds run under a fixed runc" : `doctor could not read the version of runc that Docker uses: it reports "${reported}"`,
+      fix: "check that Docker Engine is reachable and that its default runtime is runc: `docker info --format '{{.DefaultRuntime}}'`"
+    };
+  }
+  if (runcIsFixed(version)) {
+    return { name, status: "pass", detail: `Docker starts containers with runc ${reported}, which fixes CVE-2025-31133, CVE-2025-52565 and CVE-2025-52881` };
+  }
+  return {
+    name,
+    status: "warn",
+    detail: `Docker starts containers with runc ${reported}. That version is older than the releases that fix the container-escape bugs CVE-2025-31133, CVE-2025-52565 and CVE-2025-52881. Every container build runs under it`,
+    fix: "update to runc 1.3.3 or later (runc 1.2.8 on the 1.2 series), for example with Docker's containerd.io package. A distribution package can carry the fix under an older number, so check the distribution's advisory first"
+  };
+}
 
 // src/runner/microvm/doctor.ts
 var GIB = 1024 ** 3;
@@ -140,6 +271,14 @@ function helperCheck(facts) {
   if (facts.present && facts.firecracker !== FIRECRACKER_VERSION) {
     return { name, status: "warn", detail: helperFirecrackerNote(facts.firecracker), fix: REINSTALL };
   }
+  if (facts.present && facts.fdStoreMax === 0) {
+    return {
+      name,
+      status: "warn",
+      detail: `microVM builds will not survive a restart of the runner: the service's unit sets FileDescriptorStoreMax=0, so the sockets a build reaches the runner on are lost when the runner stops, and every build ends with its runner`,
+      fix: "run `outerlayer runner install --service --replace` to write the unit this CLI generates, which keeps those sockets in the service manager's descriptor store"
+    };
+  }
   if (facts.present) {
     return {
       name,
@@ -149,12 +288,12 @@ function helperCheck(facts) {
   }
   const reaches = "a build that escaped its microVM would run as the runner's account and reach what that account holds: the Claude credential, the runner key, the host key, the host's `gh` login and its membership of the `docker` group";
   if (facts.reason === "unpinned") {
-    return { name, status: "warn", detail: `this release of the CLI pins no root helper, so Firecracker runs as the runner's account: ${reaches}` };
+    return { name, status: "warn", detail: `this release of the CLI pins no root helper, so Firecracker runs as the runner's account: ${reaches}. microVM builds will not survive a restart of the runner: a build ends with its runner` };
   }
   return {
     name,
     status: "warn",
-    detail: `no usable root helper runs for this runner, so Firecracker runs as the runner's account: ${reaches} (${facts.detail})`,
+    detail: `no usable root helper runs for this runner, so Firecracker runs as the runner's account: ${reaches} (${facts.detail}). microVM builds will not survive a restart of the runner: a build ends with its runner`,
     fix: REINSTALL
   };
 }
@@ -567,7 +706,12 @@ async function helperFactsOf(env) {
   if (!probe.ok) return { present: false, reason: probe.reason, detail: probe.detail };
   const builds = buildsDir(env.configPath);
   const stat = statSync(builds, { throwIfNoEntry: false });
-  return { present: true, firecracker: probe.firecracker, ...stat !== void 0 && (stat.mode & 18) !== 0 ? { writableBuildsDir: builds } : {} };
+  return {
+    present: true,
+    firecracker: probe.firecracker,
+    ...stat !== void 0 && (stat.mode & 18) !== 0 ? { writableBuildsDir: builds } : {},
+    ...env.service?.fdStoreMax === void 0 ? {} : { fdStoreMax: env.service.fdStoreMax }
+  };
 }
 async function runnerHostChecks(env) {
   const dockerAvailable = env.dockerAvailable ?? (() => spawnSync("docker", ["info"], { stdio: "ignore" }).status === 0);
@@ -594,8 +738,11 @@ async function runnerHostChecks(env) {
       kvmCheck(machine(), env.service),
       ...env.service === void 0 ? [] : [delegationCheck(env.service)],
       helperCheck(await helperFactsOf(env)),
+      nestedVirtualizationCheck(env),
+      vmscapeCheck(env),
       ...env.runner === void 0 ? [] : [memoryCheck({ concurrency: env.runner.concurrency, buildMemory: env.runner.buildMemory, hostMemory: env.hostMemory ?? totalmem() })]
     ] : [],
+    ...env.hooks !== void 0 && builtinKind(env.hooks.provision) === "container" ? [runcCheck(env)] : [],
     ...env.hooks !== void 0 && ["container", "vm"].includes(builtinKind(env.hooks.provision)) ? [imageBuildLimitCheck(await (env.buildx ?? (() => buildxState(spawnRun)))(), env.runner?.buildMemory)] : [],
     ...env.runner !== void 0 && env.hooks !== void 0 && ["container", "vm"].includes(builtinKind(env.hooks.provision)) ? [allowHostsCheck(env.configPath, env.runner.allowHosts)] : [],
     ...env.runner?.minFreeDisk === void 0 ? [] : [freeDiskCheck(env.configPath, env.runner.minFreeDisk, env.freeBytes ?? freeBytes)],

package/dist/{emit-artifact-cmd-SDG5H6D7.js → emit-artifact-cmd-ALDK55Y2.js}

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-VQ7OAG6H.js';
-import './chunk-WK35HB56.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-VS27BP3E.js';
+import './chunk-O2IJTY7L.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
-import { detectActiveSession, autoConnect } from './chunk-H57M3HC7.js';
-import './chunk-PZA6ZFYW.js';
+import { detectActiveSession, autoConnect } from './chunk-2F762IXY.js';
+import './chunk-N4D5TMVU.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-BUP5N3X6.js';
+import './chunk-LOKSLO25.js';
 import './chunk-6BLXUD56.js';
 import './chunk-G2JWZDFA.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-MCSINUVC.js';
-import './chunk-UZEQVPKF.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-BWH36FOC.js';
+import './chunk-DJHNEGNM.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
+import './chunk-7OUOLGUV.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-JKNYTNYD.js';
-import './chunk-HBISTTG3.js';
 import './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
@@ -30,9 +30,9 @@ import './chunk-RKOTJQVG.js';
 import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
-import './chunk-GWRDL75D.js';
-import './chunk-F3BBEBPL.js';
-import './chunk-2K3TCQHW.js';
+import './chunk-Y4OKEFAX.js';
+import './chunk-RHAGBUL5.js';
+import './chunk-2I3LIRZP.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { createHash, randomUUID } from 'crypto';

package/dist/{emit-cmd-WQH2NK7H.js → emit-cmd-VAQHRWJR.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { EMIT_NOT_NEEDED_NOTICE, EmitError, inspectReplacedOutputs, runEmit } from './chunk-WX2WEERU.js';
-import './chunk-MQ743JX3.js';
+export { EMIT_NOT_NEEDED_NOTICE, EmitError, inspectReplacedOutputs, runEmit } from './chunk-WUL2OP5A.js';
+import './chunk-LOKSLO25.js';
+import './chunk-MHX7YX7Y.js';
+import './chunk-7OUOLGUV.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-JKNYTNYD.js';
-import './chunk-HBISTTG3.js';
 import './chunk-CRB3POP4.js';
 import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';