@outerlayer/cli 0.27.1 → 0.28.1

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @outerlayer/cli
 
+## 0.28.1
+
+### Patch Changes
+
+- 69efa74: With built-in hooks, no process the runner starts holds Claude's credential in its environment, Firecracker included. The runner keeps the credential in memory and loads it from `claude.env` with systemd's `LoadCredential=` on systemd 247 or later. The credential file stays readable by the runner's account, so a process that runs as that account and opens files can still read it. Run `outerlayer runner install --service --replace` to move an existing host.
+- 69efa74: On Windows, `outerlayer runner install --service` turns off WSL2 interop, the Windows `PATH` and drive automount in the runner's distribution. They apply when the distribution restarts. When `schtasks.exe` cannot start, setup and uninstall print the `schtasks` command to run from Windows.
+
+## 0.28.0
+
+### Minor Changes
+
+- 1c544ef: MicroVM builds on one host share its disk by weight, and `outerlayer doctor` says when the disk ignores that weight. A microVM that the runner starts itself keeps at most 8 MiB of console output.
+
+  Run `outerlayer runner install --service --replace` on a host with the root helper. It installs the helper that sets this weight.
+
+### Patch Changes
+
+- 8196214: `outerlayer doctor` warns on its `MicroVM jailer` line when microVM builds cannot survive a runner restart for two more reasons. One is that the running runner started before its unit was replaced, so it cannot keep a build's sockets in the descriptor store; the fix is one `sudo systemctl restart outerlayer-runner` while no build runs. The other is a systemd older than 254. In both cases every build ends with its runner, and an update waits for every build.
+
+## 0.27.3
+
+### Patch Changes
+
+- 0335339: `outerlayer init --update` changes each path to a removed maintained skill folder to `~/.agents/skills/`. It does this in `AGENTS.md`, `CLAUDE.md` and the Markdown files of the repository's skills. Before, it changed only the pointer to the core in an edited `build`, so a link anywhere else pointed at nothing. Validator and policy files are not changed. When it removes the maintained skills, it also asks the gateway for the factory's runner hosts. It names each host on a CLI older than 0.27.0, so you know whether the removal is safe to commit. `outerlayer doctor` reports the same two things.
+
+## 0.27.2
+
+### Patch Changes
+
+- df7c184: The CLI tells you when a newer CLI version is available. It prints one line after a command in a terminal and adds one line to the agent's context at session start. It reads the version from the `OuterLayer-CLI-Version` header of gateway answers it already receives, so it sends no extra request. At session start it also tells you when the maintained skills in `~/.agents/skills/` come from another CLI version. `OUTERLAYER_NO_UPDATE_NOTICE` turns off the notices of a newer CLI version.
+- 3992a42: The page on running the runner in a container states the memory, disk and CPUs that Docker Desktop must give the runner. A container build's CPU limit never exceeds the number of CPUs the runner can use.
+
 ## 0.27.1
 
 ### Patch Changes

package/README.md

@@ -336,6 +336,12 @@ content:
   GitHub App permissions each connected repository's installation has not
   accepted, and whether each default branch requires a pull request. The
   request carries nothing about the host, and the gateway stores nothing.
+- **`outerlayer init --update`**, when it removes the maintained skills a
+  repository commits, and **`outerlayer doctor`**, in a repository that still
+  commits them, ask your gateway (`GET /v1/hosts`, with the saved login or
+  key) for the factory's runner hosts and the CLI version each one reported.
+  The request carries nothing about this machine, and the gateway stores
+  nothing.
 - **`outerlayer runner check`** also asks your gateway (`GET /v1/runner/host-key`,
   with the runner key, signed with the host key) whether the key holds
   `work.claim`, so a key that cannot claim is named before the host takes work.

package/dist/{agent-setup-UW36TAQM.js → agent-setup-YVR5RO56.js}

@@ -1,18 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-FP23SVDD.js';
-import './chunk-WUL2OP5A.js';
-import './chunk-XZ6Q6ZNR.js';
-import './chunk-LOKSLO25.js';
-import './chunk-BPKO76QR.js';
-import './chunk-MHX7YX7Y.js';
-import './chunk-BWH36FOC.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-7OUOLGUV.js';
+export { keepHandWritten, runAgentSetup } from './chunk-QJFDAKRF.js';
+import './chunk-QKXF7CLR.js';
 import './chunk-KT4CN6OU.js';
+import './chunk-SATUCMAJ.js';
+import './chunk-5B7BEQPR.js';
 import './chunk-ANPNT6PM.js';
+import './chunk-4XN5FRRJ.js';
+import './chunk-P2RWZCV7.js';
+import './chunk-7CK2TJFB.js';
 import './chunk-PJDQPF5N.js';
+import './chunk-YL2VDSNF.js';
+import './chunk-5K3KB4YR.js';
+import './chunk-HXAEQPZR.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-JGML2VUN.js';
+import './chunk-5BHIBJDA.js';
+import './chunk-CDDED64E.js';
+import './chunk-RA3O54FC.js';
 import './chunk-CRB3POP4.js';
 import './chunk-VWFOKRYS.js';
 import './chunk-YQR6E6OV.js';
@@ -20,10 +26,7 @@ import './chunk-TUSYOL2O.js';
 import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-RA3O54FC.js';
-import './chunk-Y4OKEFAX.js';
-import './chunk-RHAGBUL5.js';
-import './chunk-2I3LIRZP.js';
+import './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{bridge-B5VJVECY.js → bridge-WW2V7DTB.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-XS3FDWSZ.js';
-import './chunk-2I3LIRZP.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-ZTY7HHYB.js';
+import './chunk-HXAEQPZR.js';
+import './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-5FRC3RKM.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { buildRepositoryImage } from './chunk-T2QSWFSU.js';
+import './chunk-NUHZV3A4.js';
+import './chunk-JBJTC3UU.js';
+export { RecipeError } from './chunk-SJZL5F3F.js';
+import './chunk-5K3KB4YR.js';
+import './chunk-HXAEQPZR.js';
+import './chunk-XD4ZCMA4.js';
+import './chunk-JGD5TWQ2.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-17T02:13:52.216Z+7e5bff4","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-17T13:49:00.892Z+55dd868","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-6Y6ZWGNH.js → builder-4F2XNSFC.js}

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-EX5MQYEF.js';
-import './chunk-2BTFKNTR.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-VC5J7QPV.js';
 import './chunk-YJLHUKYS.js';
-import './chunk-QE3UQAHK.js';
+import './chunk-SJZL5F3F.js';
+import './chunk-UHU7H57K.js';
+import './chunk-YL2VDSNF.js';
+import './chunk-5K3KB4YR.js';
+import './chunk-HXAEQPZR.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-Y4OKEFAX.js';
-import './chunk-RHAGBUL5.js';
-import './chunk-2I3LIRZP.js';
+import './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{check-YTXFVWK7.js → check-NDDOASVO.js}

@@ -1,65 +1,69 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-5VMDGJGH.js';
-import './chunk-6VFH52MP.js';
-import './chunk-RHGF73IU.js';
-import './chunk-ZVB57WI6.js';
-import './chunk-ABXQBEYK.js';
+import { probeCredentials } from './chunk-7UGFIWIW.js';
+import './chunk-KVDVNOUK.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-YETTWTAY.js';
+import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
-import './chunk-Y7ZCHBYB.js';
-import './chunk-6KKM7VGZ.js';
-import './chunk-XS3FDWSZ.js';
-import './chunk-VS27BP3E.js';
-import './chunk-O2IJTY7L.js';
+import './chunk-IVX3U7KV.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-66T6XJAB.js';
+import './chunk-N7WAEEIU.js';
+import './chunk-QWAYRAUX.js';
+import './chunk-2YSCKEL2.js';
+import './chunk-TVZAC2NP.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ZFBJUOYT.js';
-import './chunk-MATUHHN4.js';
+import './chunk-ZTY7HHYB.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-W3FSGH2M.js';
 import './chunk-YYYRBYWG.js';
+import './chunk-GUXWQIEY.js';
 import './chunk-TBT347UY.js';
-import './chunk-64GMBWAK.js';
-import './chunk-B7DJVG25.js';
-import './chunk-R7SGBXUD.js';
-import './chunk-WSYXLLA5.js';
-import './chunk-M3MHHIUW.js';
+import './chunk-R7SS5RLJ.js';
+import './chunk-T57XUI6N.js';
+import './chunk-IKXY47R5.js';
+import './chunk-MHAR6S7B.js';
+import './chunk-WWQVKFN6.js';
+import './chunk-USJZ2LDK.js';
+import './chunk-Z3ASAXVU.js';
 import './chunk-TQMI335S.js';
-import './chunk-GFUE5TKO.js';
-import './chunk-7AQ5AM7U.js';
-import './chunk-YB3CSYXX.js';
-import { parseRunnerEnv } from './chunk-STSLH5EJ.js';
-import './chunk-HWDYLXHH.js';
-import './chunk-D7ECMB7B.js';
+import './chunk-F4FA3ZUT.js';
+import './chunk-MQHTM4YJ.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-55XLX5PA.js';
+import './chunk-UXYLWVTQ.js';
+import './chunk-T2QSWFSU.js';
+import './chunk-NUHZV3A4.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-EX5MQYEF.js';
-import './chunk-2BTFKNTR.js';
-import './chunk-XBPUTQ7E.js';
-import './chunk-GLUKDQS4.js';
-import './chunk-55GNQPO6.js';
-import './chunk-2F762IXY.js';
-import './chunk-N4D5TMVU.js';
+import './chunk-VC5J7QPV.js';
+import './chunk-YJLHUKYS.js';
+import './chunk-SJZL5F3F.js';
+import './chunk-X52PMPOM.js';
+import './chunk-LNIFYSNK.js';
+import './chunk-VU7ZJPIR.js';
 import './chunk-BUP5N3X6.js';
-import './chunk-LOKSLO25.js';
-import './chunk-6BLXUD56.js';
+import './chunk-UHU7H57K.js';
+import './chunk-5B7BEQPR.js';
+import './chunk-HOU33DW5.js';
 import './chunk-G2JWZDFA.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-EPPIISRD.js';
-import './chunk-UXYLWVTQ.js';
-import './chunk-YJLHUKYS.js';
-import './chunk-BPKO76QR.js';
-import './chunk-MHX7YX7Y.js';
-import './chunk-BWH36FOC.js';
-import './chunk-DJHNEGNM.js';
+import './chunk-ANPNT6PM.js';
+import './chunk-4XN5FRRJ.js';
+import './chunk-P2RWZCV7.js';
+import './chunk-7CK2TJFB.js';
+import './chunk-PJDQPF5N.js';
+import './chunk-YL2VDSNF.js';
+import './chunk-5K3KB4YR.js';
+import { claudeEnvPath } from './chunk-HXAEQPZR.js';
+import './chunk-DKWQMPSL.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-6TRNCUM4.js';
+import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-7OUOLGUV.js';
-import './chunk-QE3UQAHK.js';
-import './chunk-ANPNT6PM.js';
-import './chunk-PJDQPF5N.js';
+import './chunk-JGML2VUN.js';
+import './chunk-5BHIBJDA.js';
+import './chunk-CDDED64E.js';
+import './chunk-RA3O54FC.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
@@ -69,10 +73,7 @@ import './chunk-TUSYOL2O.js';
 import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-RA3O54FC.js';
-import './chunk-Y4OKEFAX.js';
-import './chunk-RHAGBUL5.js';
-import './chunk-2I3LIRZP.js';
+import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
@@ -107,28 +108,36 @@ async function runRunnerCheck(configPath, deps = {}) {
   let credentialLine;
   if (needsClaudeCredential(config.hooks)) {
     const env = deps.env ?? process.env;
-    const runnerEnvPath = join(dirname(configPath), "runner.env");
-    const inShell = claudeCredentialCheck(env);
+    const files = [claudeEnvPath(configPath), join(dirname(configPath), "runner.env")];
+    const inShell = claudeCredentialCheck(env, { ignoreHeld: true });
     let credential = inShell;
+    let foundIn;
     if (inShell.status !== "pass") {
-      const fromFile = readRunnerEnv(runnerEnvPath);
-      if ("error" in fromFile) {
-        return {
-          ok: false,
-          check: "claude credential",
-          message: `the Claude credential is not in this shell, and ${runnerEnvPath} could not be read to look for it: ${fromFile.error}`
-        };
+      for (const path of files) {
+        const fromFile = readRunnerEnv(path);
+        if ("error" in fromFile) {
+          return {
+            ok: false,
+            check: "claude credential",
+            message: `the Claude credential is not in this shell, and ${path} could not be read to look for it: ${fromFile.error}`
+          };
+        }
+        const found = claudeCredentialCheck(fromFile.env, { ignoreHeld: true });
+        if (found.status === "pass") {
+          credential = found;
+          foundIn = path;
+          break;
+        }
       }
-      credential = claudeCredentialCheck(fromFile.env);
     }
     if (credential.status === "fail") {
       return {
         ok: false,
         check: "claude credential",
-        message: `${credential.detail}, in this shell or in ${runnerEnvPath}. ${credential.fix}`
+        message: `${credential.detail}, in this shell or in ${files.join(" or ")}. ${credential.fix}`
       };
     }
-    credentialLine = `claude credential   ${credential.detail}${inShell.status === "pass" ? "" : ` (read from ${runnerEnvPath})`}`;
+    credentialLine = `claude credential   ${credential.detail}${foundIn === void 0 ? "" : ` (read from ${foundIn})`}`;
   }
   const probe = await probeCredentials(config, deps.fetchImpl);
   if (!probe.ok && probe.fatal) return { ok: false, check: "credentials", message: probe.reason };

package/dist/{chunk-VS27BP3E.js → chunk-2YSCKEL2.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-O2IJTY7L.js';
+import { uploadSpooledSteps } from './chunk-TVZAC2NP.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-BWH36FOC.js';
-import { writeSyncStatus, spoolDir } from './chunk-DJHNEGNM.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-UHU7H57K.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7CK2TJFB.js';
+import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
+import { signerFor, signRunnerRequest } from './chunk-YL2VDSNF.js';
+import { writeSyncStatus, spoolDir } from './chunk-DKWQMPSL.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QE3UQAHK.js';
-import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signerFor, signRunnerRequest } from './chunk-Y4OKEFAX.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';

package/dist/{chunk-BPKO76QR.js → chunk-4XN5FRRJ.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-MHX7YX7Y.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-BWH36FOC.js';
+import { removeRetiredSkills } from './chunk-P2RWZCV7.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-7CK2TJFB.js';
+import { withTokenHeader } from './chunk-HXAEQPZR.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-7OUOLGUV.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-JGML2VUN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-2I3LIRZP.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-EPPIISRD.js → chunk-55XLX5PA.js}

@@ -2,8 +2,8 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-HXAEQPZR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-2I3LIRZP.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';

package/dist/{chunk-LOKSLO25.js → chunk-5B7BEQPR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-7OUOLGUV.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-JGML2VUN.js';
 import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-RKOTJQVG.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';

package/dist/chunk-5BHIBJDA.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { MAINTAINED_SKILLS, maintainedLineVersion } from './chunk-CDDED64E.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { mkdirSync, writeFileSync, renameSync, rmSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+createRequire(import.meta.url);
+var PLAIN_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+var NO_UPDATE_NOTICE_VARIABLE = "OUTERLAYER_NO_UPDATE_NOTICE";
+function cliVersionRecordPath(home) {
+  return join(home, ".outerlayer", "cli-version.json");
+}
+function readRecordedVersion(home) {
+  try {
+    const parsed = JSON.parse(readFileSync(cliVersionRecordPath(home), "utf8"));
+    return typeof parsed.version === "string" && PLAIN_VERSION.test(parsed.version) ? parsed.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function recordCliVersion(home, version) {
+  try {
+    if (!PLAIN_VERSION.test(version) || readRecordedVersion(home) === version) return;
+    const file = cliVersionRecordPath(home);
+    mkdirSync(dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify({ version })}
+`);
+    renameSync(temporary, file);
+  } catch {
+  }
+}
+function removeRecordedVersion(home) {
+  try {
+    rmSync(cliVersionRecordPath(home));
+  } catch {
+  }
+}
+function comparePlainVersions(a, b) {
+  const parts = (version) => version.split(/[-+]/)[0].split(".").map(Number);
+  const pa = parts(a);
+  const pb = parts(b);
+  for (const i of [0, 1, 2]) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function newerRecordedVersion(home, running) {
+  const recorded = readRecordedVersion(home);
+  return recorded !== void 0 && comparePlainVersions(recorded, running) > 0 ? recorded : void 0;
+}
+function updateNoticeSkipped(top, hidden, argv) {
+  if (top === "daemon" || top === "watch" || top === "runner") return true;
+  if (hidden || argv.includes("--log-failures")) return true;
+  return top === "sync" && argv.includes("--quiet");
+}
+function isSet(env, name) {
+  return env[name] !== void 0 && env[name] !== "";
+}
+function updateNoticeSuppressed(env) {
+  return isSet(env, NO_UPDATE_NOTICE_VARIABLE);
+}
+function updateNoticeLine(recorded, running) {
+  return `Update available: OuterLayer CLI ${running} \u2192 ${recorded}. Run: npm install -g @outerlayer/cli@${recorded}`;
+}
+function isCommandInTerminal(input) {
+  return input.isTTY && !input.json && !isSet(input.env, "CI");
+}
+function updateNoticeContext(home, ownVersion, env) {
+  if (updateNoticeSuppressed(env)) return null;
+  const recorded = newerRecordedVersion(home, ownVersion);
+  if (recorded === void 0) return null;
+  return `A newer OuterLayer CLI is available: this machine runs ${ownVersion}, and the factory uses ${recorded}. Tell the person both versions, and ask them to run \`npm install -g @outerlayer/cli@${recorded}\`.`;
+}
+function staleMachineCopiesContext(home, ownVersion) {
+  for (const name of MAINTAINED_SKILLS) {
+    let text;
+    try {
+      text = readFileSync(join(home, ".agents", "skills", name, "SKILL.md"), "utf8");
+    } catch {
+      continue;
+    }
+    const version = maintainedLineVersion(text);
+    if (version === void 0 || version === ownVersion) continue;
+    const source = PLAIN_VERSION.test(version) ? `OuterLayer CLI ${version}` : "another OuterLayer CLI version";
+    return `The maintained skills in ~/.agents/skills/ come from ${source}, and this session runs ${ownVersion}. Tell the person that the maintained skills on this machine come from another CLI version, and ask them to run \`${cliInvocation()} init --local\`.`;
+  }
+  return null;
+}
+
+export { PLAIN_VERSION, isCommandInTerminal, newerRecordedVersion, recordCliVersion, removeRecordedVersion, staleMachineCopiesContext, updateNoticeContext, updateNoticeLine, updateNoticeSkipped, updateNoticeSuppressed };

package/dist/{chunk-RHAGBUL5.js → chunk-5K3KB4YR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-2I3LIRZP.js';
+import { BUILD_HOME } from './chunk-HXAEQPZR.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-ABXQBEYK.js → chunk-66T6XJAB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-LPFOWUHG.js → chunk-6BWJQGTV.js}

@@ -1,17 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills } from './chunk-P33PZIWS.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-55GNQPO6.js';
-import { isLinkedRepository } from './chunk-N4D5TMVU.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-ITAIEJ2T.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-QBQHQEUG.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-X52PMPOM.js';
+import { isLinkedRepository } from './chunk-VU7ZJPIR.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { checkFormerSkillNames } from './chunk-MHX7YX7Y.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-BWH36FOC.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-DJHNEGNM.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-UHU7H57K.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { checkFormerSkillNames } from './chunk-P2RWZCV7.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-7CK2TJFB.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-DKWQMPSL.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-QE3UQAHK.js';
-import { C } from './chunk-ANPNT6PM.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-URIZRCRY.js';
 import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
@@ -207,7 +208,12 @@ function checkRenamedSkills(cwd) {
 function checkBuildSkillState(cwd, home) {
   const dirs = findGitDirs(cwd ?? process.cwd());
   if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return [];
-  return [...checkBuildSkill(dirs.repoRoot), ...checkMachineSkills({ repoRoot: dirs.repoRoot, home }), ...checkCommittedMaintainedSkills(dirs.repoRoot)];
+  return [
+    ...checkBuildSkill(dirs.repoRoot),
+    ...checkMachineSkills({ repoRoot: dirs.repoRoot, home }),
+    ...checkCommittedMaintainedSkills(dirs.repoRoot),
+    ...checkMaintainedReferences(dirs.repoRoot)
+  ];
 }
 function checkInstalledCli(home, cwd) {
   const name = "Installed CLI";
@@ -1174,19 +1180,20 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-TWS5VZEN.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-5QYIKYUP.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
   checks.push(...credential);
   if (credential[0]?.status === "pass") checks.push(...await githubAppChecks(), ...await governanceChecks());
+  if (credential[0]?.status === "pass") checks.push(...await fleetCheck());
   const runnerVm = runnerVmOf(configPath);
   if (runnerVm !== void 0) {
     const { realLima } = await import('./lima-7NPCNGWT.js');
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-Y4NCNSJM.js');
+    const { runnerHostChecks } = await import('./doctor-QPQDF7FB.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1220,8 +1227,8 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectService, realInspectProbes } = await import('./inspect-IPFA7AAT.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-6OIY3KHZ.js');
+      const { inspectService, realInspectProbes } = await import('./inspect-L7JIBK3Y.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-35SAMY75.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-BWH36FOC.js → chunk-7CK2TJFB.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
+import { signRunnerRequest, signerFor } from './chunk-YL2VDSNF.js';
+import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
+import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { signRunnerRequest, signerFor } from './chunk-Y4OKEFAX.js';
 
 createRequire(import.meta.url);
 
@@ -122,10 +123,25 @@ function withCliUserAgent(base, userAgent = () => cliUserAgent()) {
     return base(input, { ...init, headers: withHeader(init?.headers, "user-agent", userAgent()) });
   });
 }
+function recordingCliVersion(base) {
+  return (async (input, init) => {
+    const response = await base(input, init);
+    try {
+      const header = response.headers.get("outerlayer-cli-version");
+      if (header !== null) {
+        if (PLAIN_VERSION.test(header)) recordCliVersion(homeFromEnv(), header);
+      } else if (response.ok && new Headers(input instanceof Request ? input.headers : init?.headers).get("authorization")?.startsWith("Bearer ")) {
+        removeRecordedVersion(homeFromEnv());
+      }
+    } catch {
+    }
+    return response;
+  });
+}
 function globalFetch(input, init) {
   return globalThis.fetch(input, init);
 }
-var cliFetch = withCliUserAgent(globalFetch);
+var cliFetch = recordingCliVersion(withCliUserAgent(globalFetch));
 var defaultFetch = signingFetch(cliFetch);
 
 export { cliFetch, defaultFetch, resolveGatewayCredentials, signingFetchFor, unauthorizedMessage };