@outerlayer/cli 0.27.1 → 0.28.1

package/dist/{chunk-R7SGBXUD.js → chunk-IKXY47R5.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-WSYXLLA5.js';
-import { runnerImageVersion } from './chunk-M3MHHIUW.js';
-import { realFdStorePort } from './chunk-YB3CSYXX.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-HWDYLXHH.js';
+import { execCapture } from './chunk-MHAR6S7B.js';
+import { GUEST_CID } from './chunk-WWQVKFN6.js';
+import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-USJZ2LDK.js';
+import { runnerImageVersion } from './chunk-Z3ASAXVU.js';
+import { hostAllowed } from './chunk-UXYLWVTQ.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-T2QSWFSU.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-EX5MQYEF.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-2BTFKNTR.js';
-import { execCapture } from './chunk-XBPUTQ7E.js';
-import { GUEST_CID } from './chunk-GLUKDQS4.js';
-import { WorkCommandError } from './chunk-55GNQPO6.js';
-import { hostAllowed } from './chunk-UXYLWVTQ.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-VC5J7QPV.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { sharedSkillNames, skillConflictMessage } from './chunk-6TRNCUM4.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-SJZL5F3F.js';
+import { WorkCommandError } from './chunk-X52PMPOM.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-UHU7H57K.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-5K3KB4YR.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-HXAEQPZR.js';
+import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QE3UQAHK.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
 import { downconvertSession } from './chunk-QZBXLLTV.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-RHAGBUL5.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-2I3LIRZP.js';
+import { realFdStorePort } from './chunk-XD4ZCMA4.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-JGD5TWQ2.js';
-import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream } from 'fs';
-import { join, dirname, basename } from 'path';
+import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream, writeSync } from 'fs';
+import { join, dirname, resolve, basename } from 'path';
 import { isIP, createConnection, connect, createServer as createServer$1 } from 'net';
 import { spawnSync, spawn } from 'child_process';
 import { availableParallelism, networkInterfaces } from 'os';
@@ -51,7 +51,8 @@ function prepareRunnerCgroup(setup) {
   if (root === void 0) return void 0;
   const { fs } = setup;
   if (!fs.exists(root) || !fs.writable(join(root, "cgroup.procs"))) return void 0;
-  if (!(fs.read(join(root, "cgroup.controllers")) ?? "").split(/\s+/).includes("memory")) return void 0;
+  const controllers = (fs.read(join(root, "cgroup.controllers")) ?? "").split(/\s+/);
+  if (!controllers.includes("memory")) return void 0;
   for (const name of fs.list(root)) {
     if (!name.startsWith(BUILD_PREFIX)) continue;
     try {
@@ -61,7 +62,7 @@ function prepareRunnerCgroup(setup) {
   }
   if (!fs.exists(join(root, LEAF))) fs.mkdir(join(root, LEAF));
   fs.write(join(root, LEAF, "cgroup.procs"), String(setup.pid));
-  fs.write(join(root, "cgroup.subtree_control"), "+memory");
+  fs.write(join(root, "cgroup.subtree_control"), controllers.includes("io") ? "+memory +io" : "+memory");
   return { root };
 }
 var BUILD_RECLAIM_HEADROOM_BYTES = 256 * 1024 ** 2;
@@ -161,7 +162,7 @@ var START_TIMEOUT_MS = 12e4;
 var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
 var MAX_REPLY_BYTES = 1024 * 1024;
 function ask(socketPath, request, timeoutMs) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const conn = createConnection(socketPath);
     let text = "";
     let settled = false;
@@ -187,7 +188,7 @@ function ask(socketPath, request, timeoutMs) {
           return reject(new Error(`the helper at ${socketPath} sent a reply that is not JSON`));
         }
         if (reply.status === "refused") return reject(new HelperRefusal(String(reply.code ?? "refused"), String(reply.reason ?? "the helper refused the request")));
-        resolve(reply);
+        resolve2(reply);
       });
     });
     conn.on("error", (err) => settle(() => reject(new Error(`the helper at ${socketPath} did not answer: ${err.message}`))));
@@ -374,6 +375,10 @@ function formatCpuList(cores) {
   }
   return parts.join(",");
 }
+function capCpus(wanted, cpuset) {
+  const cores = cpuset === void 0 ? void 0 : parseCpuList(cpuset);
+  return cores === void 0 ? wanted : Math.min(wanted, cores.length);
+}
 function usableCpus(deps = {}) {
   try {
     const status = (deps.readStatus ?? (() => readFileSync("/proc/self/status", "utf8")))();
@@ -643,9 +648,9 @@ function createContainerHost(deps = {}) {
         stderr = (stderr + chunk.toString()).slice(-400);
       });
       child.stderr?.on("error", () => void 0);
-      const exited = new Promise((resolve) => {
-        child.once("error", () => resolve(-1));
-        child.once("close", (code) => resolve(code ?? -1));
+      const exited = new Promise((resolve2) => {
+        child.once("error", () => resolve2(-1));
+        child.once("close", (code) => resolve2(code ?? -1));
       });
       child.stdin.on("error", () => void 0);
       return { stdin: child.stdin, stdout: child.stdout, exited, kill: () => void child.kill("SIGKILL"), stderrTail: () => stderr };
@@ -717,7 +722,7 @@ function converterArgs(dest, memoryBytes, extra, script) {
 }
 var firstLine2 = (text) => text.trim().split("\n")[0] ?? "";
 function exportInto(container, converter) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const exporter = spawn("docker", ["export", container], { stdio: ["ignore", "pipe", "pipe"], env: childEnvironment(process.env) });
     const writer = spawn("docker", converter, { stdio: ["pipe", "ignore", "pipe"], env: childEnvironment(process.env) });
     const errors = [];
@@ -734,7 +739,7 @@ function exportInto(container, converter) {
       if (code !== 0 && failure2 === void 0) failure2 = `${name} exited ${code}`;
       exits += 1;
       if (exits < 2) return;
-      if (failure2 === void 0) resolve();
+      if (failure2 === void 0) resolve2();
       else reject(new Error(`${failure2}: ${firstLine2(errors.join("\n"))}`));
     };
     exporter.once("exit", (code) => done("docker export", code));
@@ -819,6 +824,46 @@ async function createBuildDisk(input) {
 function deleteBuildDisk(path) {
   rmSync(path, { force: true });
 }
+var CONSOLE_CUT_NOTE = "[outerlayer runner: cut the console at 8 MiB; the microVM keeps running]\n";
+function pumpConsole(fd, streams) {
+  const cap = 8 * 1024 ** 2;
+  let written = 0;
+  let lastByte = 10;
+  let cut = false;
+  const append = (data) => {
+    try {
+      writeSync(fd, data);
+    } catch {
+    }
+  };
+  const onData = (chunk) => {
+    if (cut) return;
+    const room = cap - written;
+    if (chunk.length <= room) {
+      append(chunk);
+      written += chunk.length;
+      lastByte = chunk[chunk.length - 1] ?? lastByte;
+      return;
+    }
+    const head = chunk.subarray(0, room);
+    append(head);
+    if (head.length > 0) lastByte = head[head.length - 1];
+    append(Buffer.from(`${lastByte === 10 ? "" : "\n"}${CONSOLE_CUT_NOTE}`));
+    written = cap;
+    cut = true;
+  };
+  let open = streams.length;
+  for (const stream of streams) {
+    stream.on("data", onData);
+    stream.on("error", () => void 0);
+    stream.once("close", () => {
+      open -= 1;
+      if (open === 0) closeSync(fd);
+    });
+  }
+}
+
+// src/runner/microvm/firecracker.ts
 var clearBit = (bit) => `0b${"x".repeat(31 - bit)}0${"x".repeat(bit)}`;
 var CPU_TEMPLATE = {
   cpuid_modifiers: [
@@ -859,8 +904,9 @@ function machineConfig(limits2, paths) {
 }
 function firecrackerCommand(input) {
   const args = ["--no-api", "--config-file", input.configPath];
-  if (input.cgroup === void 0) return { command: input.binary, args };
-  return { command: "sh", args: ["-c", 'echo $$ > "$1/cgroup.procs" && shift && exec "$@"', "sh", input.cgroup, input.binary, ...args] };
+  const binary = resolve(input.binary);
+  if (input.cgroup === void 0) return { command: binary, args };
+  return { command: "/bin/sh", args: ["-c", 'echo $$ > "$1/cgroup.procs" && shift && exec "$@"', "sh", input.cgroup, binary, ...args] };
 }
 var STOP_WAIT_MS = 1e4;
 var POLL_MS = 20;
@@ -874,6 +920,7 @@ function isZombie(pid) {
 }
 function createFirecrackerHost(options = {}) {
   const launch = options.launch ?? firecrackerCommand;
+  const spawnChild = options.spawnChild ?? spawn;
   const exits = /* @__PURE__ */ new Map();
   const alive = (vm) => isSameProcess(vm.pid, vm.start) && !isZombie(vm.pid);
   return {
@@ -881,18 +928,22 @@ function createFirecrackerHost(options = {}) {
       const { command, args } = launch(input);
       mkdirSync(dirname(input.consolePath), { recursive: true });
       const consoleFd = openSync(input.consolePath, "a", 384);
+      let pumping = false;
       try {
-        const child = spawn(command, args, { detached: true, stdio: ["ignore", consoleFd, consoleFd] });
+        const child = spawnChild(command, args, { detached: true, stdio: ["ignore", "pipe", "pipe"], env: {} });
+        pumpConsole(consoleFd, [child.stdout, child.stderr]);
+        pumping = true;
+        for (const stream of [child.stdout, child.stderr]) stream.unref?.();
         const failed = new Promise((_resolve, reject) => child.once("error", reject));
         const pid = child.pid;
         if (pid === void 0) return await failed;
-        exits.set(pid, new Promise((resolve) => child.once("exit", () => resolve())));
+        exits.set(pid, new Promise((resolve2) => child.once("exit", () => resolve2())));
         child.unref();
         const start = startTimeOf(pid);
         if (start === null) throw new Error(`${command} exited as soon as it started; its console is at ${input.consolePath}`);
         return { pid, start };
       } finally {
-        closeSync(consoleFd);
+        if (!pumping) closeSync(consoleFd);
       }
     },
     async stop(vm) {
@@ -903,8 +954,8 @@ function createFirecrackerHost(options = {}) {
       }
       const exited = exits.get(vm.pid);
       const deadline = Date.now() + STOP_WAIT_MS;
-      if (exited !== void 0) await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, STOP_WAIT_MS))]);
-      while (alive(vm) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+      if (exited !== void 0) await Promise.race([exited, new Promise((resolve2) => setTimeout(resolve2, STOP_WAIT_MS))]);
+      while (alive(vm) && Date.now() < deadline) await new Promise((resolve2) => setTimeout(resolve2, POLL_MS));
       exits.delete(vm.pid);
     },
     alive
@@ -1366,11 +1417,11 @@ function serveSession(transport, services, opts = {}) {
     session.setLocalWindowSize(SESSION_WINDOW);
   } catch {
   }
-  const ended = new Promise((resolve) => {
+  const ended = new Promise((resolve2) => {
     session.on("error", (err) => {
       if (typeof err.code === "string" && err.code.startsWith("ERR_HTTP2_")) malformed = true;
     });
-    session.on("close", () => resolve({ malformed, served }));
+    session.on("close", () => resolve2({ malformed, served }));
   });
   session.on("stream", (stream, headers) => {
     stream.on("error", noop);
@@ -1404,14 +1455,14 @@ var JOINED_AFTER_MS = 2e3;
 var EXIT_WAIT_MS = 5e3;
 function exitedWithin(stream, ms) {
   let timer;
-  const late = new Promise((resolve) => {
-    timer = setTimeout(() => resolve(void 0), ms);
+  const late = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2(void 0), ms);
     timer.unref();
   });
   return Promise.race([stream.exited, late]).finally(() => clearTimeout(timer));
 }
 function superviseRelay(input) {
-  const sleep = input.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const exitWaitMs = input.exitWaitMs ?? EXIT_WAIT_MS;
   let closed = false;
   let fatal;
@@ -1461,7 +1512,7 @@ function superviseRelay(input) {
         input.log?.(`could not join the relay in ${input.container}${status === 0 || status === void 0 ? "" : ` (exec exited ${status})`}${reason === "" ? "" : `: ${reason}`} \xB7 trying again`);
       }
       if (closed) return;
-      await Promise.race([sleep(backoff), new Promise((resolve) => wake = resolve)]);
+      await Promise.race([sleep(backoff), new Promise((resolve2) => wake = resolve2)]);
       backoff = Math.min(backoff * 2, LONGEST_BACKOFF_MS);
     }
   })();
@@ -1652,9 +1703,9 @@ async function git(args, cwd, env, input) {
     if (size < maxOutputBytes) out.push(chunk);
     size += chunk.length;
   });
-  const closed = new Promise((resolve, reject) => {
+  const closed = new Promise((resolve2, reject) => {
     child.once("error", reject);
-    child.once("close", (status) => resolve(status));
+    child.once("close", (status) => resolve2(status));
   });
   if (input !== void 0) {
     await pipeline(input, child.stdin).catch(() => void 0);
@@ -1851,14 +1902,14 @@ async function drain(req) {
   }
 }
 function readPrefix(req, gzip) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const held = [];
     const finish = (section) => {
       req.off("data", onData);
       req.off("end", onEnd);
       req.off("error", reject);
       req.pause();
-      resolve({ held, section });
+      resolve2({ held, section });
     };
     const onData = (chunk) => {
       held.push(chunk);
@@ -1872,19 +1923,19 @@ function readPrefix(req, gzip) {
   });
 }
 function readBody(req, limit) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     let size = 0;
     req.on("data", (chunk) => {
       size += chunk.length;
       if (size > limit) {
         req.pause();
-        resolve(void 0);
+        resolve2(void 0);
         return;
       }
       chunks.push(chunk);
     });
-    req.once("end", () => resolve(Buffer.concat(chunks)));
+    req.once("end", () => resolve2(Buffer.concat(chunks)));
     req.once("error", reject);
   });
 }
@@ -1898,7 +1949,7 @@ function createGitRemote(options) {
     const { route, res } = input;
     const url = new URL(`${gitUrl}/${route.owner}/${route.name}.git/${route.kind === "info-refs" ? "info/refs" : route.kind === "lfs-batch" ? "info/lfs/objects/batch" : `git-${route.kind}`}${route.search === "" ? "" : `?${route.search}`}`);
     const send = url.protocol === "https:" ? request$1 : request;
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const upstream = send(url, { method: input.method, headers: { ...input.headers, connection: "close" } }, (answer) => {
         const headers = {};
         for (const [name, value] of Object.entries(answer.headers)) {
@@ -1920,18 +1971,18 @@ function createGitRemote(options) {
         });
         answer.once("end", () => {
           res.end();
-          resolve();
+          resolve2();
         });
         answer.once("error", () => {
           res.destroy();
-          resolve();
+          resolve2();
         });
       });
       upstream.on("error", (err) => {
         log(`could not reach GitHub for ${route.kind}: ${err.message}`);
         if (res.headersSent) res.destroy();
         else plain(res, 502, "the runner could not reach GitHub\n");
-        resolve();
+        resolve2();
       });
       res.once("close", () => upstream.destroy());
       input.feed(upstream);
@@ -2249,7 +2300,7 @@ async function startTunnel(socketPath, opts = {}) {
   if (Buffer.byteLength(socketPath) > MAX_SOCKET_PATH_BYTES) {
     throw new Error(`${socketPath} is too long for a Unix socket; keep the runner's config file nearer the root of the filesystem`);
   }
-  const resolve = opts.resolve ?? systemResolve;
+  const resolve2 = opts.resolve ?? systemResolve;
   const openConnection = opts.connect ?? ((t) => connect({ host: t.address, port: t.port }));
   const ownAddresses = opts.hostAddresses ?? systemHostAddresses;
   const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
@@ -2333,7 +2384,7 @@ async function startTunnel(socketPath, opts = {}) {
     }
     let addresses;
     try {
-      addresses = await resolve(host);
+      addresses = await resolve2(host);
     } catch {
       return { ok: false, status: 502, body: `could not resolve ${host}
 ` };
@@ -2534,7 +2585,7 @@ function createContainerRuntime(opts = {}) {
     )),
     startTunnel: opts.startTunnel ?? startTunnel,
     tunnelOptions: opts.tunnelOptions,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms))),
     hostEnv: opts.hostEnv ?? process.env,
     platform: opts.platform ?? process.platform,
     credentials: opts.credentials ?? /* @__PURE__ */ new Map(),
@@ -2835,7 +2886,7 @@ async function provisionContainer(input) {
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset: state.cpuset };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: capCpus(config.build?.cpus ?? 4, state.cpuset), pids: config.build?.pids ?? 4096, cpuset: state.cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
@@ -3017,8 +3068,8 @@ async function stopContainer(runtime, state) {
 var DISK_CHECK_MS = 12e4;
 async function measureDisk(runtime, state) {
   let timer;
-  const late = new Promise((resolve) => {
-    timer = setTimeout(() => resolve({ failure: "du ran past 2 minutes" }), DISK_CHECK_MS);
+  const late = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2({ failure: "du ran past 2 minutes" }), DISK_CHECK_MS);
   });
   try {
     const run = runtime.host.exec(
@@ -3306,7 +3357,7 @@ async function startCheckContainer(input) {
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: capCpus(config.build?.cpus ?? 4, cpuset), pids: config.build?.pids ?? 4096, cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the check environment's volume", volume);

package/dist/{chunk-P33PZIWS.js → chunk-ITAIEJ2T.js}

@@ -1,18 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-XZ6Q6ZNR.js';
-import { skillsBaseFor, isAgentsMdLayout } from './chunk-LOKSLO25.js';
-import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { machineSkillsState, staleClaudeSkills } from './chunk-IMOB4IOI.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, AGENTS_SKILLS_BASE, MAINTAINED_SKILLS, isMaintainedCopy, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-7OUOLGUV.js';
 import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-SATUCMAJ.js';
+import { skillsBaseFor } from './chunk-5B7BEQPR.js';
+import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-JGML2VUN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { hasSymlinkComponent } from './chunk-VWFOKRYS.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-RKOTJQVG.js';
 import { createHash } from 'crypto';
-import { existsSync, readFileSync, realpathSync } from 'fs';
-import { join, dirname } from 'path';
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
 
 createRequire(import.meta.url);
 var SHIPPED_MANIFEST = "shipped.json";
@@ -190,138 +188,5 @@ function checkStarterFiles(cwd, opts = {}) {
   const fix = actionable ? `Run \`${UPDATE}\` to update the outdated files and write the missing ones. It never changes a file you edited.${compare}` : "Reinstall the CLI: `npm install -g @outerlayer/cli`, or run it with `npx -y @outerlayer/cli`.";
   return { checks: [{ name: NAME, status: "warn", detail: parts.join("; "), fix }], mcpOutdated };
 }
-var BUILD_PHASES = ["Intake", "Criteria", "Implement", "Review", "Pull request", "Evidence"];
-var MACHINE_CORE = `${MACHINE_SKILL_PATH}/outerlayer-build/SKILL.md`;
-var CHANGES_HEADING = "## Changes for this repository";
-var NAME2 = "Build skill";
-function changeHeadings(text) {
-  const lines = text.split(/\r?\n/);
-  const start = lines.findIndex((line) => line.trim() === CHANGES_HEADING);
-  if (start === -1) return [];
-  const headings = [];
-  for (const line of lines.slice(start + 1)) {
-    if (/^## /.test(line)) break;
-    const match = /^### (.+?)\s*$/.exec(line);
-    if (match) headings.push(match[1]);
-  }
-  return headings;
-}
-function skillsFolders() {
-  const probe = `${skillDir("probe")}/SKILL.md`;
-  const compiled = emitTree({
-    entries: classifyTree([probe]).entries,
-    contents: /* @__PURE__ */ new Map([[probe, "---\nname: probe\ndescription: probe\n---\n"]]),
-    assetPaths: [],
-    targets: [...ALL_TARGET_IDS]
-  });
-  return [...new Set(compiled.files.map((file) => dirname(dirname(file.path))))].sort();
-}
-function shortBuild() {
-  const file = loadTemplateFiles().find((f) => f.path === `${skillDir("build")}/SKILL.md`);
-  if (file === void 0) return "";
-  return splitRawFile(file.content).body.split("\n").filter((line) => !line.startsWith("<!--")).join("\n").trim();
-}
-var read = (abs) => {
-  try {
-    return readFileSync(abs, "utf8");
-  } catch {
-    return void 0;
-  }
-};
-function buildsOf(repoRoot, folders) {
-  const source = `${folders[0]}/build/SKILL.md`;
-  return (existsSync(join(repoRoot, source)) ? [source] : folders.slice(1).map((f) => `${f}/build/SKILL.md`)).map((path) => ({ path, text: read(join(repoRoot, path)) })).filter((b) => b.text !== void 0);
-}
-function checkBuildSkill(repoRoot) {
-  const folders = [".outerlayer/skills", ...skillsFolders()];
-  const builds = buildsOf(repoRoot, folders);
-  const checks = [];
-  const detached = builds.filter((b) => !namesCore(b.text));
-  if (detached.length > 0) {
-    checks.push({
-      name: NAME2,
-      status: "warn",
-      detail: `${detached.map((b) => b.path).join(", ")} does not name outerlayer-build, so it gets no updates from the core`,
-      fix: `Move to the short build, and put your own changes under the name of the phase each applies to:
-
-${shortBuild()}`
-    });
-  }
-  for (const build of builds.filter((b) => namesCore(b.text))) {
-    const unknown = changeHeadings(build.text).filter((heading) => !BUILD_PHASES.includes(heading));
-    if (unknown.length === 0) continue;
-    checks.push({
-      name: NAME2,
-      status: "warn",
-      detail: `${build.path} has ${unknown.map((h) => `"${h}"`).join(", ")} under "Changes for this repository", which matches no phase`,
-      fix: `Rename each heading to a phase: ${BUILD_PHASES.join(", ")}.`
-    });
-  }
-  const agentsMd = isAgentsMdLayout(repoRoot);
-  const seen = /* @__PURE__ */ new Set();
-  const lacking = folders.filter((folder) => {
-    const text = read(join(repoRoot, folder, "build", "SKILL.md")) ?? "";
-    if (!namesCore(text) || text.includes(MACHINE_CORE) || existsSync(join(repoRoot, folder, "outerlayer-build", "SKILL.md"))) return false;
-    let key = folder;
-    try {
-      key = realpathSync(join(repoRoot, folder));
-    } catch {
-    }
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-  if (lacking.length > 0) {
-    checks.push({
-      name: NAME2,
-      status: "warn",
-      detail: `${lacking.join(", ")} holds build with no outerlayer-build beside it`,
-      fix: `Run \`${cliInvocation()} ${agentsMd ? "init --update" : "context emit"}\` to write outerlayer-build, then commit.`
-    });
-  }
-  return checks;
-}
-function committedMaintainedFolders(repoRoot) {
-  const found = [];
-  for (const base of [AGENTS_SKILLS_BASE, ".claude/skills"]) {
-    for (const name of MAINTAINED_SKILLS) {
-      const folder = skillDir(name, base);
-      if (!hasSymlinkComponent(repoRoot, folder) && isMaintainedCopy(repoRoot, name, base)) found.push(folder);
-    }
-  }
-  return found;
-}
-function checkCommittedMaintainedSkills(repoRoot) {
-  if (!isAgentsMdLayout(repoRoot)) return [];
-  const folders = committedMaintainedFolders(repoRoot);
-  if (folders.length === 0) return [];
-  return [
-    {
-      name: "Committed maintained skills",
-      status: "warn",
-      detail: `${folders.join(", ")} ${folders.length === 1 ? "is a maintained skill" : "are maintained skills"} that every machine keeps in ${MACHINE_SKILL_PATH}/ now`,
-      fix: `Run \`${cliInvocation()} init --update\` to remove ${folders.length === 1 ? "it" : "them"}, then commit. Before you commit, every machine and runner host must run this CLI version or later, and each machine a person works on must run \`${cliInvocation()} init --local\`.`
-    }
-  ];
-}
-function checkMachineSkills(opts) {
-  const build = buildsOf(opts.repoRoot, [".outerlayer/skills", ...skillsFolders()]).find((b) => b.text.includes(MACHINE_CORE));
-  if (build === void 0) return [];
-  const problems = machineSkillsState(opts.home, opts.version).filter((s) => s.state !== "current");
-  const claudeStale = staleClaudeSkills(opts.home, opts.version);
-  if (problems.length === 0 && claudeStale.length === 0) return [];
-  const parts = [
-    ...problems.map((s) => `${MACHINE_SKILL_PATH}/${s.name} ${s.state === "missing" ? "is missing" : "is from another CLI version"}`),
-    ...claudeStale.map((name) => `~/.claude/skills/${name} is not this CLI version's copy`)
-  ];
-  return [
-    {
-      name: "Maintained skills on this machine",
-      status: "warn",
-      detail: `${build.path} reads ${MACHINE_CORE}, but ${parts.join(", ")}`,
-      fix: `Run \`${cliInvocation()} init --local\` on this machine. If it reports a failed write, fix the permissions on the folder it names first.`
-    }
-  ];
-}
 
-export { canonical, checkBuildSkill, checkCommittedMaintainedSkills, checkMachineSkills, checkStarterFiles, committedMaintainedFolders, contentHash, contextIsGoverned, inspectStarterFiles, readShippedManifest, skillsFolders };
+export { canonical, checkStarterFiles, contentHash, contextIsGoverned, inspectStarterFiles, readShippedManifest };

package/dist/{chunk-RHGF73IU.js → chunk-IVX3U7KV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-7OUOLGUV.js → chunk-JGML2VUN.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-RKOTJQVG.js';
+import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { splitRawFile } from './chunk-RKOTJQVG.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 
 createRequire(import.meta.url);
 var TEMPLATE_SKILLS = ["spec", "writing-specs", "writing-tests", "build"];
-var MAINTAINED_SKILLS = ["outerlayer-evidence", "outerlayer-amend", "outerlayer-findings", "outerlayer-cli", "outerlayer-build"];
 function templateClassLine(version) {
   return `<!-- yours to edit. Copied once from the default template by outerlayer init ${version}; never overwritten. -->`;
 }
@@ -130,10 +130,6 @@ var FORMER_MAINTAINED_NAMES = {
   outerlayer: "outerlayer-cli"
 };
 var MAINTAINED_LINE = /^<!-- maintained by OuterLayer \S+?\. /m;
-var MAINTAINED_LINE_VERSION = /^<!-- maintained by OuterLayer (\S+?)\. /m;
-function maintainedLineVersion(text) {
-  return MAINTAINED_LINE_VERSION.exec(text)?.[1];
-}
 function isMaintainedCopy(repoRoot, skill, base = OUTERLAYER_SKILLS_BASE) {
   try {
     return MAINTAINED_LINE.test(readFileSync(join(repoRoot, skillDir(skill, base), "SKILL.md"), "utf8"));
@@ -145,4 +141,4 @@ function formerNameExists(repoRoot, skill, base) {
   return Object.entries(FORMER_MAINTAINED_NAMES).some(([former, current]) => current === skill && isMaintainedCopy(repoRoot, former, base));
 }
 
-export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MACHINE_SKILL_PATH, MAINTAINED_SKILLS, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMachineSkillFiles, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, maintainedLineVersion, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };
+export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MACHINE_SKILL_PATH, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMachineSkillFiles, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };