@outerlayer/cli 0.27.1 → 0.28.2

package/dist/{chunk-B7DJVG25.js → chunk-HOB7Z4JQ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-R7SGBXUD.js';
-import { runnerImageVersion } from './chunk-M3MHHIUW.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-2BTFKNTR.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GLL4TN2M.js';
+import { runnerImageVersion } from './chunk-Z3ASAXVU.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-SJZL5F3F.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-2I3LIRZP.js → chunk-HXAEQPZR.js}

@@ -1,13 +1,93 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-JGD5TWQ2.js';
-import { existsSync, unlinkSync, chmodSync } from 'fs';
+import { readFileSync, existsSync, unlinkSync, chmodSync } from 'fs';
+import { join, dirname } from 'path';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
 import { createServer as createServer$1 } from 'net';
-import { join } from 'path';
 
 createRequire(import.meta.url);
+var CLAUDE_CREDENTIAL_ID = "claude";
+var CLAUDE_ENV_FILE = "claude.env";
+function claudeEnvPath(configPath) {
+  return join(dirname(configPath), CLAUDE_ENV_FILE);
+}
+var CLAUDE_CREDENTIAL_VARIABLES = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var FORWARDED = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+function firstOf(values, source) {
+  for (const variable of FORWARDED) {
+    const value = values[variable];
+    if (value !== void 0 && value !== "") return { variable, value, source };
+  }
+  return void 0;
+}
+function readClaudeCredential(env) {
+  const fromEnvironment = firstOf(env, "environment");
+  if (fromEnvironment !== void 0) return fromEnvironment;
+  const directory = env.CREDENTIALS_DIRECTORY;
+  if (directory === void 0 || directory === "") return void 0;
+  const path = join(directory, CLAUDE_CREDENTIAL_ID);
+  try {
+    const text = readFileSync(path, "utf8");
+    const found = firstOf(parseRunnerEnv(text), "credentials-directory");
+    if (found === void 0 && text.trim() !== "") complain(path, "it sets neither CLAUDE_CODE_OAUTH_TOKEN nor ANTHROPIC_API_KEY, each as NAME=value");
+    return found;
+  } catch (err) {
+    if (err.code !== "ENOENT") complain(path, `it could not be read (${err instanceof Error ? err.message : String(err)})`);
+    return void 0;
+  }
+}
+var complained = /* @__PURE__ */ new Set();
+function complain(path, reason) {
+  if (complained.has(path)) return;
+  complained.add(path);
+  process.stderr.write(`the Claude credential file ${path} holds no usable credential: ${reason}
+`);
+}
+var held;
+var removedValues = /* @__PURE__ */ new Set();
+function holdClaudeCredential(env = process.env) {
+  held ??= readClaudeCredential(env);
+  for (const name of CLAUDE_CREDENTIAL_VARIABLES) {
+    const value = env[name];
+    if (value !== void 0 && value !== "") removedValues.add(value);
+    delete env[name];
+  }
+  return held;
+}
+function takeClaudeCredential(env, hooks) {
+  return /^builtin:(container|process|vm)$/.test(hooks.provision) ? holdClaudeCredential(env) : void 0;
+}
+function removedClaudeCredentialValues() {
+  return [...removedValues];
+}
+function heldClaudeCredential() {
+  return held;
+}
+function currentClaudeCredential(env) {
+  return held ?? readClaudeCredential(env);
+}
+var SETS = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=/;
+function credentialLineIn(text) {
+  const set = parseRunnerEnv(text);
+  const lines = text.split("\n");
+  for (const variable of FORWARDED) {
+    if ((set[variable] ?? "") === "") continue;
+    const line = lines.find((candidate) => (parseRunnerEnv(candidate)[variable] ?? "") !== "");
+    return line.replace(/^\s*(?:export\s+)?/, "").trimEnd();
+  }
+  return void 0;
+}
+function withoutCredentialLines(text) {
+  const lines = text.split("\n");
+  const kept = lines.filter((line) => !CLAUDE_CREDENTIAL_VARIABLES.includes(SETS.exec(line)?.[1] ?? ""));
+  if (kept.length === lines.length) return void 0;
+  while (kept[kept.length - 1] === "") kept.pop();
+  return kept.length === 0 ? "" : `${kept.join("\n")}
+`;
+}
 
 // src/runner/builtin-destinations.ts
 var GATEWAY_DESTINATION = "gateway";
@@ -23,16 +103,27 @@ var OAUTH_PLACEHOLDER = "sk-ant-oat01-placeholder-not-a-real-token";
 var API_KEY_PLACEHOLDER = "sk-ant-api03-placeholder-not-a-real-key";
 var ITEM_KEY_PLACEHOLDER = "olitem_placeholder-not-a-real-key";
 var ITEM_KEY_VARIABLE = "OUTERLAYER_ITEM_KEY";
-var CLAUDE_CREDENTIAL_VARIABLES = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
-function claudeCredential(hostEnv) {
-  const held = (name) => hostEnv[name] !== void 0 && hostEnv[name] !== "";
-  if (held("CLAUDE_CODE_OAUTH_TOKEN")) return { variable: "CLAUDE_CODE_OAUTH_TOKEN", placeholder: OAUTH_PLACEHOLDER };
-  if (held("ANTHROPIC_API_KEY")) return { variable: "ANTHROPIC_API_KEY", placeholder: API_KEY_PLACEHOLDER };
-  return void 0;
+function claudeCredential(hostEnv, options = {}) {
+  const credential = options.ignoreHeld === true ? readClaudeCredential(hostEnv) : currentClaudeCredential(hostEnv);
+  if (credential === void 0) return void 0;
+  return { variable: credential.variable, placeholder: credential.variable === "CLAUDE_CODE_OAUTH_TOKEN" ? OAUTH_PLACEHOLDER : API_KEY_PLACEHOLDER };
 }
 function gatewayUpstream(gatewayUrl) {
   return `${new URL(gatewayUrl).origin}/`;
 }
+function forwardedEnvironment(hostEnv) {
+  const env = {};
+  for (const name of ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"]) {
+    Object.defineProperty(env, name, {
+      enumerable: true,
+      get: () => {
+        const current = currentClaudeCredential(hostEnv);
+        return current !== void 0 && current.variable === name ? current.value : hostEnv[name];
+      }
+    });
+  }
+  return env;
+}
 function builtInDestinations(input) {
   const credential = claudeCredential(input.hostEnv);
   const apiKeyMode = credential?.variable === "ANTHROPIC_API_KEY";
@@ -55,7 +146,7 @@ function builtInDestinations(input) {
         header: apiKeyMode ? { name: "x-api-key", value: "${ANTHROPIC_API_KEY}", variables: ["ANTHROPIC_API_KEY"] } : { name: "Authorization", value: "Bearer ${CLAUDE_CODE_OAUTH_TOKEN}", variables: ["CLAUDE_CODE_OAUTH_TOKEN"] },
         env: {}
       },
-      hostEnv: input.hostEnv,
+      hostEnv: forwardedEnvironment(input.hostEnv),
       // A build's own key in either header would sit beside the runner's, and the upstream takes one of them.
       drop: ["x-api-key", "authorization"],
       socket: CLAUDE_SOCKET
@@ -661,4 +752,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, commitIdentityRecord, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };

package/dist/{chunk-P33PZIWS.js → chunk-ITAIEJ2T.js}

@@ -1,18 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-XZ6Q6ZNR.js';
-import { skillsBaseFor, isAgentsMdLayout } from './chunk-LOKSLO25.js';
-import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { machineSkillsState, staleClaudeSkills } from './chunk-IMOB4IOI.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, AGENTS_SKILLS_BASE, MAINTAINED_SKILLS, isMaintainedCopy, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-7OUOLGUV.js';
 import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-SATUCMAJ.js';
+import { skillsBaseFor } from './chunk-5B7BEQPR.js';
+import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-JGML2VUN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { hasSymlinkComponent } from './chunk-VWFOKRYS.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-RKOTJQVG.js';
 import { createHash } from 'crypto';
-import { existsSync, readFileSync, realpathSync } from 'fs';
-import { join, dirname } from 'path';
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
 
 createRequire(import.meta.url);
 var SHIPPED_MANIFEST = "shipped.json";
@@ -190,138 +188,5 @@ function checkStarterFiles(cwd, opts = {}) {
   const fix = actionable ? `Run \`${UPDATE}\` to update the outdated files and write the missing ones. It never changes a file you edited.${compare}` : "Reinstall the CLI: `npm install -g @outerlayer/cli`, or run it with `npx -y @outerlayer/cli`.";
   return { checks: [{ name: NAME, status: "warn", detail: parts.join("; "), fix }], mcpOutdated };
 }
-var BUILD_PHASES = ["Intake", "Criteria", "Implement", "Review", "Pull request", "Evidence"];
-var MACHINE_CORE = `${MACHINE_SKILL_PATH}/outerlayer-build/SKILL.md`;
-var CHANGES_HEADING = "## Changes for this repository";
-var NAME2 = "Build skill";
-function changeHeadings(text) {
-  const lines = text.split(/\r?\n/);
-  const start = lines.findIndex((line) => line.trim() === CHANGES_HEADING);
-  if (start === -1) return [];
-  const headings = [];
-  for (const line of lines.slice(start + 1)) {
-    if (/^## /.test(line)) break;
-    const match = /^### (.+?)\s*$/.exec(line);
-    if (match) headings.push(match[1]);
-  }
-  return headings;
-}
-function skillsFolders() {
-  const probe = `${skillDir("probe")}/SKILL.md`;
-  const compiled = emitTree({
-    entries: classifyTree([probe]).entries,
-    contents: /* @__PURE__ */ new Map([[probe, "---\nname: probe\ndescription: probe\n---\n"]]),
-    assetPaths: [],
-    targets: [...ALL_TARGET_IDS]
-  });
-  return [...new Set(compiled.files.map((file) => dirname(dirname(file.path))))].sort();
-}
-function shortBuild() {
-  const file = loadTemplateFiles().find((f) => f.path === `${skillDir("build")}/SKILL.md`);
-  if (file === void 0) return "";
-  return splitRawFile(file.content).body.split("\n").filter((line) => !line.startsWith("<!--")).join("\n").trim();
-}
-var read = (abs) => {
-  try {
-    return readFileSync(abs, "utf8");
-  } catch {
-    return void 0;
-  }
-};
-function buildsOf(repoRoot, folders) {
-  const source = `${folders[0]}/build/SKILL.md`;
-  return (existsSync(join(repoRoot, source)) ? [source] : folders.slice(1).map((f) => `${f}/build/SKILL.md`)).map((path) => ({ path, text: read(join(repoRoot, path)) })).filter((b) => b.text !== void 0);
-}
-function checkBuildSkill(repoRoot) {
-  const folders = [".outerlayer/skills", ...skillsFolders()];
-  const builds = buildsOf(repoRoot, folders);
-  const checks = [];
-  const detached = builds.filter((b) => !namesCore(b.text));
-  if (detached.length > 0) {
-    checks.push({
-      name: NAME2,
-      status: "warn",
-      detail: `${detached.map((b) => b.path).join(", ")} does not name outerlayer-build, so it gets no updates from the core`,
-      fix: `Move to the short build, and put your own changes under the name of the phase each applies to:
-
-${shortBuild()}`
-    });
-  }
-  for (const build of builds.filter((b) => namesCore(b.text))) {
-    const unknown = changeHeadings(build.text).filter((heading) => !BUILD_PHASES.includes(heading));
-    if (unknown.length === 0) continue;
-    checks.push({
-      name: NAME2,
-      status: "warn",
-      detail: `${build.path} has ${unknown.map((h) => `"${h}"`).join(", ")} under "Changes for this repository", which matches no phase`,
-      fix: `Rename each heading to a phase: ${BUILD_PHASES.join(", ")}.`
-    });
-  }
-  const agentsMd = isAgentsMdLayout(repoRoot);
-  const seen = /* @__PURE__ */ new Set();
-  const lacking = folders.filter((folder) => {
-    const text = read(join(repoRoot, folder, "build", "SKILL.md")) ?? "";
-    if (!namesCore(text) || text.includes(MACHINE_CORE) || existsSync(join(repoRoot, folder, "outerlayer-build", "SKILL.md"))) return false;
-    let key = folder;
-    try {
-      key = realpathSync(join(repoRoot, folder));
-    } catch {
-    }
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-  if (lacking.length > 0) {
-    checks.push({
-      name: NAME2,
-      status: "warn",
-      detail: `${lacking.join(", ")} holds build with no outerlayer-build beside it`,
-      fix: `Run \`${cliInvocation()} ${agentsMd ? "init --update" : "context emit"}\` to write outerlayer-build, then commit.`
-    });
-  }
-  return checks;
-}
-function committedMaintainedFolders(repoRoot) {
-  const found = [];
-  for (const base of [AGENTS_SKILLS_BASE, ".claude/skills"]) {
-    for (const name of MAINTAINED_SKILLS) {
-      const folder = skillDir(name, base);
-      if (!hasSymlinkComponent(repoRoot, folder) && isMaintainedCopy(repoRoot, name, base)) found.push(folder);
-    }
-  }
-  return found;
-}
-function checkCommittedMaintainedSkills(repoRoot) {
-  if (!isAgentsMdLayout(repoRoot)) return [];
-  const folders = committedMaintainedFolders(repoRoot);
-  if (folders.length === 0) return [];
-  return [
-    {
-      name: "Committed maintained skills",
-      status: "warn",
-      detail: `${folders.join(", ")} ${folders.length === 1 ? "is a maintained skill" : "are maintained skills"} that every machine keeps in ${MACHINE_SKILL_PATH}/ now`,
-      fix: `Run \`${cliInvocation()} init --update\` to remove ${folders.length === 1 ? "it" : "them"}, then commit. Before you commit, every machine and runner host must run this CLI version or later, and each machine a person works on must run \`${cliInvocation()} init --local\`.`
-    }
-  ];
-}
-function checkMachineSkills(opts) {
-  const build = buildsOf(opts.repoRoot, [".outerlayer/skills", ...skillsFolders()]).find((b) => b.text.includes(MACHINE_CORE));
-  if (build === void 0) return [];
-  const problems = machineSkillsState(opts.home, opts.version).filter((s) => s.state !== "current");
-  const claudeStale = staleClaudeSkills(opts.home, opts.version);
-  if (problems.length === 0 && claudeStale.length === 0) return [];
-  const parts = [
-    ...problems.map((s) => `${MACHINE_SKILL_PATH}/${s.name} ${s.state === "missing" ? "is missing" : "is from another CLI version"}`),
-    ...claudeStale.map((name) => `~/.claude/skills/${name} is not this CLI version's copy`)
-  ];
-  return [
-    {
-      name: "Maintained skills on this machine",
-      status: "warn",
-      detail: `${build.path} reads ${MACHINE_CORE}, but ${parts.join(", ")}`,
-      fix: `Run \`${cliInvocation()} init --local\` on this machine. If it reports a failed write, fix the permissions on the folder it names first.`
-    }
-  ];
-}
 
-export { canonical, checkBuildSkill, checkCommittedMaintainedSkills, checkMachineSkills, checkStarterFiles, committedMaintainedFolders, contentHash, contextIsGoverned, inspectStarterFiles, readShippedManifest, skillsFolders };
+export { canonical, checkStarterFiles, contentHash, contextIsGoverned, inspectStarterFiles, readShippedManifest };

package/dist/{chunk-RHGF73IU.js → chunk-IVX3U7KV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-7OUOLGUV.js → chunk-JGML2VUN.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-RKOTJQVG.js';
+import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { splitRawFile } from './chunk-RKOTJQVG.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 
 createRequire(import.meta.url);
 var TEMPLATE_SKILLS = ["spec", "writing-specs", "writing-tests", "build"];
-var MAINTAINED_SKILLS = ["outerlayer-evidence", "outerlayer-amend", "outerlayer-findings", "outerlayer-cli", "outerlayer-build"];
 function templateClassLine(version) {
   return `<!-- yours to edit. Copied once from the default template by outerlayer init ${version}; never overwritten. -->`;
 }
@@ -130,10 +130,6 @@ var FORMER_MAINTAINED_NAMES = {
   outerlayer: "outerlayer-cli"
 };
 var MAINTAINED_LINE = /^<!-- maintained by OuterLayer \S+?\. /m;
-var MAINTAINED_LINE_VERSION = /^<!-- maintained by OuterLayer (\S+?)\. /m;
-function maintainedLineVersion(text) {
-  return MAINTAINED_LINE_VERSION.exec(text)?.[1];
-}
 function isMaintainedCopy(repoRoot, skill, base = OUTERLAYER_SKILLS_BASE) {
   try {
     return MAINTAINED_LINE.test(readFileSync(join(repoRoot, skillDir(skill, base), "SKILL.md"), "utf8"));
@@ -145,4 +141,4 @@ function formerNameExists(repoRoot, skill, base) {
   return Object.entries(FORMER_MAINTAINED_NAMES).some(([former, current]) => current === skill && isMaintainedCopy(repoRoot, former, base));
 }
 
-export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MACHINE_SKILL_PATH, MAINTAINED_SKILLS, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMachineSkillFiles, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, maintainedLineVersion, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };
+export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MACHINE_SKILL_PATH, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMachineSkillFiles, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };

package/dist/{chunk-6VFH52MP.js → chunk-KU7QL4XW.js}

@@ -1,32 +1,33 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { senderPidfile } from './chunk-Y7ZCHBYB.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-6KKM7VGZ.js';
-import { writeDockerClientConfig } from './chunk-XS3FDWSZ.js';
-import { installScrubContext } from './chunk-VS27BP3E.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-R7SGBXUD.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-WSYXLLA5.js';
-import { fdName } from './chunk-YB3CSYXX.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-HWDYLXHH.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-N7WAEEIU.js';
+import { senderPidfile } from './chunk-SFJXGISY.js';
+import { installScrubContext } from './chunk-MKIC65SD.js';
+import { writeDockerClientConfig } from './chunk-ZTY7HHYB.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-GLL4TN2M.js';
+import { waitForAgent, vmExecArgs } from './chunk-MHAR6S7B.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-WWQVKFN6.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-USJZ2LDK.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-55XLX5PA.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-T2QSWFSU.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR, COMMAND_DIR } from './chunk-EX5MQYEF.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-2BTFKNTR.js';
-import { waitForAgent, vmExecArgs } from './chunk-XBPUTQ7E.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-GLUKDQS4.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-55GNQPO6.js';
-import { planArtifactUpload } from './chunk-BUP5N3X6.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-EPPIISRD.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR, COMMAND_DIR } from './chunk-VC5J7QPV.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { resolvePackRoot, MAINTAINED_SKILLS } from './chunk-7OUOLGUV.js';
-import { scrubText } from './chunk-QE3UQAHK.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-SJZL5F3F.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-X52PMPOM.js';
+import { planArtifactUpload } from './chunk-BUP5N3X6.js';
+import { scrubText } from './chunk-UHU7H57K.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
+import { signerFor } from './chunk-YL2VDSNF.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-5K3KB4YR.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-HXAEQPZR.js';
+import { resolvePackRoot } from './chunk-JGML2VUN.js';
+import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
+import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-Y4OKEFAX.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-RHAGBUL5.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2I3LIRZP.js';
+import { fdName } from './chunk-XD4ZCMA4.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-JGD5TWQ2.js';
 import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, readdirSync, linkSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';
@@ -2420,7 +2421,8 @@ function mergeScrubConfig(a, b) {
 function releaseScrub(config, home) {
   const merged = mergeScrubConfig(config.scrub, readCloudConfig(home).scrub);
   const secrets = [...headerVariables(config.build?.destinations), ...CLAUDE_CREDENTIAL_VARIABLES].map((name) => process.env[name] ?? "");
-  return { literals: [...scrubList(merged?.literals), ...secrets], patterns: scrubList(merged?.patterns) };
+  const held = [currentClaudeCredential(process.env)?.value, ...removedClaudeCredentialValues()].filter((value) => value !== void 0);
+  return { literals: [...scrubList(merged?.literals), ...secrets, ...held], patterns: scrubList(merged?.patterns) };
 }
 function transcriptScrub(config, secrets) {
   const base = releaseScrub(config, homeFromEnv());

package/dist/{chunk-2F762IXY.js → chunk-LNIFYSNK.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-N4D5TMVU.js';
-import { resolveGatewayCredentials } from './chunk-BWH36FOC.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-VU7ZJPIR.js';
+import { resolveRepoIdentity } from './chunk-UHU7H57K.js';
+import { resolveGatewayCredentials } from './chunk-7CK2TJFB.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';

package/dist/{chunk-XBPUTQ7E.js → chunk-MHAR6S7B.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-GLUKDQS4.js';
+import { EXEC_PORT } from './chunk-WWQVKFN6.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-VS27BP3E.js → chunk-MKIC65SD.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-O2IJTY7L.js';
+import { uploadSpooledSteps } from './chunk-TVZAC2NP.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-BWH36FOC.js';
-import { writeSyncStatus, spoolDir } from './chunk-DJHNEGNM.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-UHU7H57K.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7CK2TJFB.js';
+import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
+import { signerFor, signRunnerRequest } from './chunk-YL2VDSNF.js';
+import { writeSyncStatus, spoolDir } from './chunk-DKWQMPSL.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QE3UQAHK.js';
-import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signerFor, signRunnerRequest } from './chunk-Y4OKEFAX.js';
-import { dirname, basename, join } from 'path';
+import { dirname, basename, join, sep } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';
 import { hostname, userInfo } from 'os';
@@ -834,6 +834,49 @@ var LiveUploader = class {
     }
   }
 };
+var NOTICE = /<task-id>(?:\s|\\n)*([\w-]+)(?:\s|\\n)*<\/task-id>(?:(?!<task-notification>)[\s\S])*?<status>(?:\s|\\n)*(completed|failed|killed|stopped|cancelled|canceled|error)(?:\s|\\n)*<\/status>/gi;
+var cache = /* @__PURE__ */ new Map();
+function parentTranscriptOf(subagentFile) {
+  const segments = subagentFile.split(sep);
+  const at = segments.lastIndexOf("subagents");
+  if (at < 2) return void 0;
+  return join(segments.slice(0, at - 1).join(sep), `${segments[at - 1]}.jsonl`);
+}
+function endNotices(text) {
+  const endedAt = /* @__PURE__ */ new Map();
+  for (const raw of text.split("\n")) {
+    if (!raw.includes("<task-notification>")) continue;
+    let line;
+    try {
+      line = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (line.type !== "user" || typeof line.timestamp !== "string") continue;
+    for (const [, id] of raw.matchAll(NOTICE)) endedAt.set(id, [...endedAt.get(id) ?? [], line.timestamp]);
+  }
+  return endedAt;
+}
+function noticesIn(parentFile) {
+  try {
+    const { size, mtimeMs } = statSync(parentFile);
+    const key = `${parentFile}\0${size}\0${mtimeMs}`;
+    const known = cache.get(key) ?? endNotices(readFileSync(parentFile, "utf8"));
+    cache.set(key, known);
+    return known;
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+function subagentEndedInParent(subagentFile, lastActivityAt) {
+  const parent = parentTranscriptOf(subagentFile);
+  if (parent === void 0) return false;
+  const notices = noticesIn(parent).get(basename(subagentFile, ".jsonl").replace(/^agent-/, "")) ?? [];
+  return notices.some((at) => lastActivityAt === void 0 || Date.parse(at) >= Date.parse(lastActivityAt));
+}
+function runningForParent(entry, lastActivityAt) {
+  return !entry.isSubagent || !subagentEndedInParent(entry.file, lastActivityAt);
+}
 
 // src/skip-verdict.ts
 var RESUME_WINDOW_MS = 14 * 24 * 60 * 60 * 1e3;
@@ -1206,7 +1249,7 @@ async function runSyncInner(opts, stats) {
         applyContextProvenance(session, contextSourceBySessionId.get(session.id));
         applyReportedCost(session, home);
         const gated = prepareSessionForUpload(session, tier, envVars);
-        const liveEntry = liveUploads[gated.id];
+        const liveEntry = runningForParent(entry, gated.endedAt) ? liveUploads[gated.id] : void 0;
         const daemonIsStreaming = liveEntry !== void 0 && !liveEntry.ended && !liveEntry.failed;
         if (daemonIsStreaming && !sessionHasEnded(home, gated.subagent?.parentSessionId ?? gated.id)) {
           const gatedTurns = gated.turns ?? [];

package/dist/{chunk-64GMBWAK.js → chunk-MNHMUZGC.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-B7DJVG25.js';
-import { MIN_ENGINE_MAJOR } from './chunk-R7SGBXUD.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-GFUE5TKO.js';
-import { runnerCredentialProblem } from './chunk-EPPIISRD.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-HOB7Z4JQ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GLL4TN2M.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-F4FA3ZUT.js';
+import { runnerCredentialProblem } from './chunk-55XLX5PA.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 
@@ -104,7 +104,7 @@ function prepareRunnerInit(configPath, opts = {}) {
   if (hooks === "builtin:process" && opts.allowProcess !== true) throw new RunnerInitError(processRefusal(machine));
   if (agent === "claude" && credential === void 0 && opts.credentialInEnvironment !== true && !hasStoredCredential(configPath)) {
     throw new RunnerInitError(
-      "--agent claude needs Claude's credential, and none was piped on stdin or is in the runner.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
+      "--agent claude needs Claude's credential, and none was piped on stdin or is in the claude.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
     );
   }
   return { configPath, config, carried, credential, agent, machine, hooks, needsKey, host: opts.host };