@outerlayer/cli 0.27.1 → 0.28.2

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @outerlayer/cli
 
+## 0.28.2
+
+### Patch Changes
+
+- b61b6ba: `outerlayer sync` uploads a helper agent as finished once its parent session was told it stopped, even while the parent still runs. Before, each `sync` uploaded every helper of a running session as open, so finished helpers read as running until the whole session ended.
+- fc2ba91: A container build's downloads arrive whole, so package installs no longer fail with aborted requests. A burst of connections no longer drops the build's link to the runner.
+
+## 0.28.1
+
+### Patch Changes
+
+- 69efa74: With built-in hooks, no process the runner starts holds Claude's credential in its environment, Firecracker included. The runner keeps the credential in memory and loads it from `claude.env` with systemd's `LoadCredential=` on systemd 247 or later. The credential file stays readable by the runner's account, so a process that runs as that account and opens files can still read it. Run `outerlayer runner install --service --replace` to move an existing host.
+- 69efa74: On Windows, `outerlayer runner install --service` turns off WSL2 interop, the Windows `PATH` and drive automount in the runner's distribution. They apply when the distribution restarts. When `schtasks.exe` cannot start, setup and uninstall print the `schtasks` command to run from Windows.
+
+## 0.28.0
+
+### Minor Changes
+
+- 1c544ef: MicroVM builds on one host share its disk by weight, and `outerlayer doctor` says when the disk ignores that weight. A microVM that the runner starts itself keeps at most 8 MiB of console output.
+
+  Run `outerlayer runner install --service --replace` on a host with the root helper. It installs the helper that sets this weight.
+
+### Patch Changes
+
+- 8196214: `outerlayer doctor` warns on its `MicroVM jailer` line when microVM builds cannot survive a runner restart for two more reasons. One is that the running runner started before its unit was replaced, so it cannot keep a build's sockets in the descriptor store; the fix is one `sudo systemctl restart outerlayer-runner` while no build runs. The other is a systemd older than 254. In both cases every build ends with its runner, and an update waits for every build.
+
+## 0.27.3
+
+### Patch Changes
+
+- 0335339: `outerlayer init --update` changes each path to a removed maintained skill folder to `~/.agents/skills/`. It does this in `AGENTS.md`, `CLAUDE.md` and the Markdown files of the repository's skills. Before, it changed only the pointer to the core in an edited `build`, so a link anywhere else pointed at nothing. Validator and policy files are not changed. When it removes the maintained skills, it also asks the gateway for the factory's runner hosts. It names each host on a CLI older than 0.27.0, so you know whether the removal is safe to commit. `outerlayer doctor` reports the same two things.
+
+## 0.27.2
+
+### Patch Changes
+
+- df7c184: The CLI tells you when a newer CLI version is available. It prints one line after a command in a terminal and adds one line to the agent's context at session start. It reads the version from the `OuterLayer-CLI-Version` header of gateway answers it already receives, so it sends no extra request. At session start it also tells you when the maintained skills in `~/.agents/skills/` come from another CLI version. `OUTERLAYER_NO_UPDATE_NOTICE` turns off the notices of a newer CLI version.
+- 3992a42: The page on running the runner in a container states the memory, disk and CPUs that Docker Desktop must give the runner. A container build's CPU limit never exceeds the number of CPUs the runner can use.
+
 ## 0.27.1
 
 ### Patch Changes

package/README.md

@@ -336,6 +336,12 @@ content:
   GitHub App permissions each connected repository's installation has not
   accepted, and whether each default branch requires a pull request. The
   request carries nothing about the host, and the gateway stores nothing.
+- **`outerlayer init --update`**, when it removes the maintained skills a
+  repository commits, and **`outerlayer doctor`**, in a repository that still
+  commits them, ask your gateway (`GET /v1/hosts`, with the saved login or
+  key) for the factory's runner hosts and the CLI version each one reported.
+  The request carries nothing about this machine, and the gateway stores
+  nothing.
 - **`outerlayer runner check`** also asks your gateway (`GET /v1/runner/host-key`,
   with the runner key, signed with the host key) whether the key holds
   `work.claim`, so a key that cannot claim is named before the host takes work.

package/dist/{agent-setup-UW36TAQM.js → agent-setup-YVR5RO56.js}

@@ -1,18 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-FP23SVDD.js';
-import './chunk-WUL2OP5A.js';
-import './chunk-XZ6Q6ZNR.js';
-import './chunk-LOKSLO25.js';
-import './chunk-BPKO76QR.js';
-import './chunk-MHX7YX7Y.js';
-import './chunk-BWH36FOC.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-7OUOLGUV.js';
+export { keepHandWritten, runAgentSetup } from './chunk-QJFDAKRF.js';
+import './chunk-QKXF7CLR.js';
 import './chunk-KT4CN6OU.js';
+import './chunk-SATUCMAJ.js';
+import './chunk-5B7BEQPR.js';
 import './chunk-ANPNT6PM.js';
+import './chunk-4XN5FRRJ.js';
+import './chunk-P2RWZCV7.js';
+import './chunk-7CK2TJFB.js';
 import './chunk-PJDQPF5N.js';
+import './chunk-YL2VDSNF.js';
+import './chunk-5K3KB4YR.js';
+import './chunk-HXAEQPZR.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-JGML2VUN.js';
+import './chunk-5BHIBJDA.js';
+import './chunk-CDDED64E.js';
+import './chunk-RA3O54FC.js';
 import './chunk-CRB3POP4.js';
 import './chunk-VWFOKRYS.js';
 import './chunk-YQR6E6OV.js';
@@ -20,10 +26,7 @@ import './chunk-TUSYOL2O.js';
 import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-RA3O54FC.js';
-import './chunk-Y4OKEFAX.js';
-import './chunk-RHAGBUL5.js';
-import './chunk-2I3LIRZP.js';
+import './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{bridge-B5VJVECY.js → bridge-WW2V7DTB.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-XS3FDWSZ.js';
-import './chunk-2I3LIRZP.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-ZTY7HHYB.js';
+import './chunk-HXAEQPZR.js';
+import './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-5FRC3RKM.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { buildRepositoryImage } from './chunk-T2QSWFSU.js';
+import './chunk-NUHZV3A4.js';
+import './chunk-JBJTC3UU.js';
+export { RecipeError } from './chunk-SJZL5F3F.js';
+import './chunk-5K3KB4YR.js';
+import './chunk-HXAEQPZR.js';
+import './chunk-XD4ZCMA4.js';
+import './chunk-JGD5TWQ2.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-17T02:13:52.216Z+7e5bff4","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-17T15:23:11.099Z+00ea5d3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-6Y6ZWGNH.js → builder-4F2XNSFC.js}

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-EX5MQYEF.js';
-import './chunk-2BTFKNTR.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-VC5J7QPV.js';
 import './chunk-YJLHUKYS.js';
-import './chunk-QE3UQAHK.js';
+import './chunk-SJZL5F3F.js';
+import './chunk-UHU7H57K.js';
+import './chunk-YL2VDSNF.js';
+import './chunk-5K3KB4YR.js';
+import './chunk-HXAEQPZR.js';
 import './chunk-QZBXLLTV.js';
-import './chunk-Y4OKEFAX.js';
-import './chunk-RHAGBUL5.js';
-import './chunk-2I3LIRZP.js';
+import './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{check-YTXFVWK7.js → check-YEI6TCUH.js}

@@ -1,65 +1,69 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-5VMDGJGH.js';
-import './chunk-6VFH52MP.js';
-import './chunk-RHGF73IU.js';
-import './chunk-ZVB57WI6.js';
-import './chunk-ABXQBEYK.js';
+import { probeCredentials } from './chunk-O65LES4V.js';
+import './chunk-KU7QL4XW.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-YETTWTAY.js';
+import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
-import './chunk-Y7ZCHBYB.js';
-import './chunk-6KKM7VGZ.js';
-import './chunk-XS3FDWSZ.js';
-import './chunk-VS27BP3E.js';
-import './chunk-O2IJTY7L.js';
+import './chunk-IVX3U7KV.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-66T6XJAB.js';
+import './chunk-N7WAEEIU.js';
+import './chunk-SFJXGISY.js';
+import './chunk-MKIC65SD.js';
+import './chunk-TVZAC2NP.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ZFBJUOYT.js';
-import './chunk-MATUHHN4.js';
+import './chunk-ZTY7HHYB.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-6S4V4UIC.js';
 import './chunk-YYYRBYWG.js';
+import './chunk-GUXWQIEY.js';
 import './chunk-TBT347UY.js';
-import './chunk-64GMBWAK.js';
-import './chunk-B7DJVG25.js';
-import './chunk-R7SGBXUD.js';
-import './chunk-WSYXLLA5.js';
-import './chunk-M3MHHIUW.js';
+import './chunk-MNHMUZGC.js';
+import './chunk-HOB7Z4JQ.js';
+import './chunk-GLL4TN2M.js';
+import './chunk-MHAR6S7B.js';
+import './chunk-WWQVKFN6.js';
+import './chunk-USJZ2LDK.js';
+import './chunk-Z3ASAXVU.js';
 import './chunk-TQMI335S.js';
-import './chunk-GFUE5TKO.js';
-import './chunk-7AQ5AM7U.js';
-import './chunk-YB3CSYXX.js';
-import { parseRunnerEnv } from './chunk-STSLH5EJ.js';
-import './chunk-HWDYLXHH.js';
-import './chunk-D7ECMB7B.js';
+import './chunk-F4FA3ZUT.js';
+import './chunk-MQHTM4YJ.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-55XLX5PA.js';
+import './chunk-UXYLWVTQ.js';
+import './chunk-T2QSWFSU.js';
+import './chunk-NUHZV3A4.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-EX5MQYEF.js';
-import './chunk-2BTFKNTR.js';
-import './chunk-XBPUTQ7E.js';
-import './chunk-GLUKDQS4.js';
-import './chunk-55GNQPO6.js';
-import './chunk-2F762IXY.js';
-import './chunk-N4D5TMVU.js';
+import './chunk-VC5J7QPV.js';
+import './chunk-YJLHUKYS.js';
+import './chunk-SJZL5F3F.js';
+import './chunk-X52PMPOM.js';
+import './chunk-LNIFYSNK.js';
+import './chunk-VU7ZJPIR.js';
 import './chunk-BUP5N3X6.js';
-import './chunk-LOKSLO25.js';
-import './chunk-6BLXUD56.js';
+import './chunk-UHU7H57K.js';
+import './chunk-5B7BEQPR.js';
+import './chunk-HOU33DW5.js';
 import './chunk-G2JWZDFA.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-EPPIISRD.js';
-import './chunk-UXYLWVTQ.js';
-import './chunk-YJLHUKYS.js';
-import './chunk-BPKO76QR.js';
-import './chunk-MHX7YX7Y.js';
-import './chunk-BWH36FOC.js';
-import './chunk-DJHNEGNM.js';
+import './chunk-ANPNT6PM.js';
+import './chunk-4XN5FRRJ.js';
+import './chunk-P2RWZCV7.js';
+import './chunk-7CK2TJFB.js';
+import './chunk-PJDQPF5N.js';
+import './chunk-YL2VDSNF.js';
+import './chunk-5K3KB4YR.js';
+import { claudeEnvPath } from './chunk-HXAEQPZR.js';
+import './chunk-DKWQMPSL.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-6TRNCUM4.js';
+import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-7OUOLGUV.js';
-import './chunk-QE3UQAHK.js';
-import './chunk-ANPNT6PM.js';
-import './chunk-PJDQPF5N.js';
+import './chunk-JGML2VUN.js';
+import './chunk-5BHIBJDA.js';
+import './chunk-CDDED64E.js';
+import './chunk-RA3O54FC.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
@@ -69,10 +73,7 @@ import './chunk-TUSYOL2O.js';
 import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-RA3O54FC.js';
-import './chunk-Y4OKEFAX.js';
-import './chunk-RHAGBUL5.js';
-import './chunk-2I3LIRZP.js';
+import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
@@ -107,28 +108,36 @@ async function runRunnerCheck(configPath, deps = {}) {
   let credentialLine;
   if (needsClaudeCredential(config.hooks)) {
     const env = deps.env ?? process.env;
-    const runnerEnvPath = join(dirname(configPath), "runner.env");
-    const inShell = claudeCredentialCheck(env);
+    const files = [claudeEnvPath(configPath), join(dirname(configPath), "runner.env")];
+    const inShell = claudeCredentialCheck(env, { ignoreHeld: true });
     let credential = inShell;
+    let foundIn;
     if (inShell.status !== "pass") {
-      const fromFile = readRunnerEnv(runnerEnvPath);
-      if ("error" in fromFile) {
-        return {
-          ok: false,
-          check: "claude credential",
-          message: `the Claude credential is not in this shell, and ${runnerEnvPath} could not be read to look for it: ${fromFile.error}`
-        };
+      for (const path of files) {
+        const fromFile = readRunnerEnv(path);
+        if ("error" in fromFile) {
+          return {
+            ok: false,
+            check: "claude credential",
+            message: `the Claude credential is not in this shell, and ${path} could not be read to look for it: ${fromFile.error}`
+          };
+        }
+        const found = claudeCredentialCheck(fromFile.env, { ignoreHeld: true });
+        if (found.status === "pass") {
+          credential = found;
+          foundIn = path;
+          break;
+        }
       }
-      credential = claudeCredentialCheck(fromFile.env);
     }
     if (credential.status === "fail") {
       return {
         ok: false,
         check: "claude credential",
-        message: `${credential.detail}, in this shell or in ${runnerEnvPath}. ${credential.fix}`
+        message: `${credential.detail}, in this shell or in ${files.join(" or ")}. ${credential.fix}`
       };
     }
-    credentialLine = `claude credential   ${credential.detail}${inShell.status === "pass" ? "" : ` (read from ${runnerEnvPath})`}`;
+    credentialLine = `claude credential   ${credential.detail}${foundIn === void 0 ? "" : ` (read from ${foundIn})`}`;
   }
   const probe = await probeCredentials(config, deps.fetchImpl);
   if (!probe.ok && probe.fatal) return { ok: false, check: "credentials", message: probe.reason };

package/dist/{chunk-LPFOWUHG.js → chunk-25X2PJDI.js}

@@ -1,17 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills } from './chunk-P33PZIWS.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-55GNQPO6.js';
-import { isLinkedRepository } from './chunk-N4D5TMVU.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-ITAIEJ2T.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-QBQHQEUG.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-X52PMPOM.js';
+import { isLinkedRepository } from './chunk-VU7ZJPIR.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { checkFormerSkillNames } from './chunk-MHX7YX7Y.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-BWH36FOC.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-DJHNEGNM.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-UHU7H57K.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { checkFormerSkillNames } from './chunk-P2RWZCV7.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-7CK2TJFB.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-DKWQMPSL.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-QE3UQAHK.js';
-import { C } from './chunk-ANPNT6PM.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-URIZRCRY.js';
 import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
@@ -207,7 +208,12 @@ function checkRenamedSkills(cwd) {
 function checkBuildSkillState(cwd, home) {
   const dirs = findGitDirs(cwd ?? process.cwd());
   if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return [];
-  return [...checkBuildSkill(dirs.repoRoot), ...checkMachineSkills({ repoRoot: dirs.repoRoot, home }), ...checkCommittedMaintainedSkills(dirs.repoRoot)];
+  return [
+    ...checkBuildSkill(dirs.repoRoot),
+    ...checkMachineSkills({ repoRoot: dirs.repoRoot, home }),
+    ...checkCommittedMaintainedSkills(dirs.repoRoot),
+    ...checkMaintainedReferences(dirs.repoRoot)
+  ];
 }
 function checkInstalledCli(home, cwd) {
   const name = "Installed CLI";
@@ -1174,19 +1180,20 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-TWS5VZEN.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-5QYIKYUP.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
   checks.push(...credential);
   if (credential[0]?.status === "pass") checks.push(...await githubAppChecks(), ...await governanceChecks());
+  if (credential[0]?.status === "pass") checks.push(...await fleetCheck());
   const runnerVm = runnerVmOf(configPath);
   if (runnerVm !== void 0) {
     const { realLima } = await import('./lima-7NPCNGWT.js');
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-Y4NCNSJM.js');
+    const { runnerHostChecks } = await import('./doctor-DQWRUAEB.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1220,8 +1227,8 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectService, realInspectProbes } = await import('./inspect-IPFA7AAT.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-6OIY3KHZ.js');
+      const { inspectService, realInspectProbes } = await import('./inspect-L7JIBK3Y.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-35SAMY75.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-BPKO76QR.js → chunk-4XN5FRRJ.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-MHX7YX7Y.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-BWH36FOC.js';
+import { removeRetiredSkills } from './chunk-P2RWZCV7.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-7CK2TJFB.js';
+import { withTokenHeader } from './chunk-HXAEQPZR.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-7OUOLGUV.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-JGML2VUN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-2I3LIRZP.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-EPPIISRD.js → chunk-55XLX5PA.js}

@@ -2,8 +2,8 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-HXAEQPZR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-2I3LIRZP.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';

package/dist/{chunk-LOKSLO25.js → chunk-5B7BEQPR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-7OUOLGUV.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-JGML2VUN.js';
 import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-RKOTJQVG.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';

package/dist/chunk-5BHIBJDA.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { MAINTAINED_SKILLS, maintainedLineVersion } from './chunk-CDDED64E.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { mkdirSync, writeFileSync, renameSync, rmSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+createRequire(import.meta.url);
+var PLAIN_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+var NO_UPDATE_NOTICE_VARIABLE = "OUTERLAYER_NO_UPDATE_NOTICE";
+function cliVersionRecordPath(home) {
+  return join(home, ".outerlayer", "cli-version.json");
+}
+function readRecordedVersion(home) {
+  try {
+    const parsed = JSON.parse(readFileSync(cliVersionRecordPath(home), "utf8"));
+    return typeof parsed.version === "string" && PLAIN_VERSION.test(parsed.version) ? parsed.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function recordCliVersion(home, version) {
+  try {
+    if (!PLAIN_VERSION.test(version) || readRecordedVersion(home) === version) return;
+    const file = cliVersionRecordPath(home);
+    mkdirSync(dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify({ version })}
+`);
+    renameSync(temporary, file);
+  } catch {
+  }
+}
+function removeRecordedVersion(home) {
+  try {
+    rmSync(cliVersionRecordPath(home));
+  } catch {
+  }
+}
+function comparePlainVersions(a, b) {
+  const parts = (version) => version.split(/[-+]/)[0].split(".").map(Number);
+  const pa = parts(a);
+  const pb = parts(b);
+  for (const i of [0, 1, 2]) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function newerRecordedVersion(home, running) {
+  const recorded = readRecordedVersion(home);
+  return recorded !== void 0 && comparePlainVersions(recorded, running) > 0 ? recorded : void 0;
+}
+function updateNoticeSkipped(top, hidden, argv) {
+  if (top === "daemon" || top === "watch" || top === "runner") return true;
+  if (hidden || argv.includes("--log-failures")) return true;
+  return top === "sync" && argv.includes("--quiet");
+}
+function isSet(env, name) {
+  return env[name] !== void 0 && env[name] !== "";
+}
+function updateNoticeSuppressed(env) {
+  return isSet(env, NO_UPDATE_NOTICE_VARIABLE);
+}
+function updateNoticeLine(recorded, running) {
+  return `Update available: OuterLayer CLI ${running} \u2192 ${recorded}. Run: npm install -g @outerlayer/cli@${recorded}`;
+}
+function isCommandInTerminal(input) {
+  return input.isTTY && !input.json && !isSet(input.env, "CI");
+}
+function updateNoticeContext(home, ownVersion, env) {
+  if (updateNoticeSuppressed(env)) return null;
+  const recorded = newerRecordedVersion(home, ownVersion);
+  if (recorded === void 0) return null;
+  return `A newer OuterLayer CLI is available: this machine runs ${ownVersion}, and the factory uses ${recorded}. Tell the person both versions, and ask them to run \`npm install -g @outerlayer/cli@${recorded}\`.`;
+}
+function staleMachineCopiesContext(home, ownVersion) {
+  for (const name of MAINTAINED_SKILLS) {
+    let text;
+    try {
+      text = readFileSync(join(home, ".agents", "skills", name, "SKILL.md"), "utf8");
+    } catch {
+      continue;
+    }
+    const version = maintainedLineVersion(text);
+    if (version === void 0 || version === ownVersion) continue;
+    const source = PLAIN_VERSION.test(version) ? `OuterLayer CLI ${version}` : "another OuterLayer CLI version";
+    return `The maintained skills in ~/.agents/skills/ come from ${source}, and this session runs ${ownVersion}. Tell the person that the maintained skills on this machine come from another CLI version, and ask them to run \`${cliInvocation()} init --local\`.`;
+  }
+  return null;
+}
+
+export { PLAIN_VERSION, isCommandInTerminal, newerRecordedVersion, recordCliVersion, removeRecordedVersion, staleMachineCopiesContext, updateNoticeContext, updateNoticeLine, updateNoticeSkipped, updateNoticeSuppressed };

package/dist/{chunk-RHAGBUL5.js → chunk-5K3KB4YR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-2I3LIRZP.js';
+import { BUILD_HOME } from './chunk-HXAEQPZR.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-ABXQBEYK.js → chunk-66T6XJAB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-ZFBJUOYT.js → chunk-6S4V4UIC.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-64GMBWAK.js';
-import { describeCallFailure } from './chunk-WSYXLLA5.js';
-import { WorkCommandError, getJson } from './chunk-55GNQPO6.js';
+import { isPlaceholderCommand } from './chunk-MNHMUZGC.js';
+import { describeCallFailure } from './chunk-USJZ2LDK.js';
+import { builtinKind } from './chunk-55XLX5PA.js';
+import { WorkCommandError, getJson } from './chunk-X52PMPOM.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { builtinKind } from './chunk-EPPIISRD.js';
-import { signerFor } from './chunk-Y4OKEFAX.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-2I3LIRZP.js';
+import { signerFor } from './chunk-YL2VDSNF.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-HXAEQPZR.js';
 
 createRequire(import.meta.url);
 
@@ -57,7 +57,7 @@ function formerSkillProblem(queues) {
 function needsClaudeCredential(hooks) {
   return builtinKind(hooks.provision) !== "own";
 }
-var CREDENTIAL_FIX = "Run `claude setup-token`, then start the runner with CLAUDE_CODE_OAUTH_TOKEN set to the token it prints (or ANTHROPIC_API_KEY set to an API key), for example with EnvironmentFile= in the runner's systemd unit";
+var CREDENTIAL_FIX = "Run `claude setup-token`, then pipe the token it prints (or an Anthropic API key) to `outerlayer runner init --agent claude`, which stores it in the claude.env beside the config. Or start the runner with CLAUDE_CODE_OAUTH_TOKEN (or ANTHROPIC_API_KEY) set";
 function claudeCredentialCheck(env, options = {}) {
   const name = "Claude credential";
   if (options.service !== void 0) {
@@ -66,13 +66,13 @@ function claudeCredentialCheck(env, options = {}) {
       return {
         name,
         status: "fail",
-        detail: `the service ${unit} has no Claude credential: neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set in its runner.env, so every build fails at provision as agent_credential_missing`,
+        detail: `the service ${unit} has no Claude credential: neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set in its claude.env or runner.env, so every build fails at provision as agent_credential_missing`,
         fix: `${CREDENTIAL_FIX}, then restart the service: sudo systemctl restart ${unit}.`
       };
     }
-    return { name, status: "pass", detail: `${variables[0]} is set in the runner.env of the service ${unit}` };
+    return { name, status: "pass", detail: `${variables[0]} is set in the claude.env or runner.env of the service ${unit}` };
   }
-  const held = claudeCredential(env);
+  const held = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
   if (held === void 0) {
     return {
       name,