@outerlayer/cli 0.28.1 → 0.28.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @outerlayer/cli
 
+## 0.28.2
+
+### Patch Changes
+
+- b61b6ba: `outerlayer sync` uploads a helper agent as finished once its parent session was told it stopped, even while the parent still runs. Before, each `sync` uploaded every helper of a running session as open, so finished helpers read as running until the whole session ended.
+- fc2ba91: A container build's downloads arrive whole, so package installs no longer fail with aborted requests. A burst of connections no longer drops the build's link to the runner.
+
 ## 0.28.1
 
 ### Patch Changes

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-17T13:49:00.892Z+55dd868","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-17T15:23:11.099Z+00ea5d3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-NDDOASVO.js → check-YEI6TCUH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-7UGFIWIW.js';
-import './chunk-KVDVNOUK.js';
+import { probeCredentials } from './chunk-O65LES4V.js';
+import './chunk-KU7QL4XW.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
@@ -9,18 +9,18 @@ import './chunk-IVX3U7KV.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-66T6XJAB.js';
 import './chunk-N7WAEEIU.js';
-import './chunk-QWAYRAUX.js';
-import './chunk-2YSCKEL2.js';
+import './chunk-SFJXGISY.js';
+import './chunk-MKIC65SD.js';
 import './chunk-TVZAC2NP.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-ZTY7HHYB.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-W3FSGH2M.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-6S4V4UIC.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-GUXWQIEY.js';
 import './chunk-TBT347UY.js';
-import './chunk-R7SS5RLJ.js';
-import './chunk-T57XUI6N.js';
-import './chunk-IKXY47R5.js';
+import './chunk-MNHMUZGC.js';
+import './chunk-HOB7Z4JQ.js';
+import './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{chunk-6BWJQGTV.js → chunk-25X2PJDI.js}

@@ -1193,7 +1193,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-QPQDF7FB.js');
+    const { runnerHostChecks } = await import('./doctor-DQWRUAEB.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{chunk-W3FSGH2M.js → chunk-6S4V4UIC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-R7SS5RLJ.js';
+import { isPlaceholderCommand } from './chunk-MNHMUZGC.js';
 import { describeCallFailure } from './chunk-USJZ2LDK.js';
 import { builtinKind } from './chunk-55XLX5PA.js';
 import { WorkCommandError, getJson } from './chunk-X52PMPOM.js';

package/dist/{chunk-IKXY47R5.js → chunk-GLL4TN2M.js}

@@ -1363,6 +1363,29 @@ async function resolveAgentUser(input) {
 var noop = () => void 0;
 var FRAME_HEADER_BYTES = 9;
 var GOAWAY_FRAME = 7;
+function describeGoawayCode(code) {
+  const names = [
+    "NO_ERROR",
+    "PROTOCOL_ERROR",
+    "INTERNAL_ERROR",
+    "FLOW_CONTROL_ERROR",
+    "SETTINGS_TIMEOUT",
+    "STREAM_CLOSED",
+    "FRAME_SIZE_ERROR",
+    "REFUSED_STREAM",
+    "CANCEL",
+    "COMPRESSION_ERROR",
+    "CONNECT_ERROR",
+    "ENHANCE_YOUR_CALM",
+    "INADEQUATE_SECURITY",
+    "HTTP_1_1_REQUIRED"
+  ];
+  const name = names[code];
+  return name === void 0 ? `error code ${code}` : `${name} (${code})`;
+}
+function goawayNote(label, code) {
+  return code === void 0 ? "" : ` \xB7 ${label} ${describeGoawayCode(code)}`;
+}
 function watchSentGoaway(onError) {
   let head = Buffer.alloc(0);
   let want = FRAME_HEADER_BYTES;
@@ -1385,7 +1408,10 @@ function watchSentGoaway(onError) {
         want = FRAME_HEADER_BYTES + 8;
         continue;
       }
-      if (want > FRAME_HEADER_BYTES && head.readUInt32BE(FRAME_HEADER_BYTES + 4) !== http2.constants.NGHTTP2_NO_ERROR) onError();
+      if (want > FRAME_HEADER_BYTES) {
+        const code = head.readUInt32BE(FRAME_HEADER_BYTES + 4);
+        if (code !== http2.constants.NGHTTP2_NO_ERROR) onError(code);
+      }
       skip = length - (want - FRAME_HEADER_BYTES);
       head = Buffer.alloc(0);
       want = FRAME_HEADER_BYTES;
@@ -1397,9 +1423,11 @@ function serveSession(transport, services, opts = {}) {
   let open = 0;
   let served = 0;
   let malformed = false;
+  let goawayCode;
   transport.on("error", noop);
-  const watch = watchSentGoaway(() => {
+  const watch = watchSentGoaway((code) => {
     malformed = true;
+    goawayCode ??= code;
     setImmediate(() => session.destroy());
   });
   const outbound = new Transform({
@@ -1421,7 +1449,10 @@ function serveSession(transport, services, opts = {}) {
     session.on("error", (err) => {
       if (typeof err.code === "string" && err.code.startsWith("ERR_HTTP2_")) malformed = true;
     });
-    session.on("close", () => resolve2({ malformed, served }));
+    session.on("goaway", (code) => {
+      if (code !== http2.constants.NGHTTP2_NO_ERROR) goawayCode ??= code;
+    });
+    session.on("close", () => resolve2({ malformed, served, goawayCode }));
   });
   session.on("stream", (stream, headers) => {
     stream.on("error", noop);
@@ -1495,14 +1526,14 @@ function superviseRelay(input) {
       if (joined) {
         backoff = FIRST_BACKOFF_MS;
         failing = false;
-        if (!closed) input.log?.(`the session with ${input.container} ended \xB7 joining again`);
+        if (!closed) input.log?.(`the session with ${input.container} ended \xB7 joining again${goawayNote("GOAWAY", end.goawayCode)}`);
       }
       if (!end.malformed && end.served > 0) malformedInARow = 0;
       if (end.malformed) {
         malformedInARow++;
         if (malformedInARow >= MAX_MALFORMED_SESSIONS) {
           fatal = MALFORMED_REASON;
-          input.log?.(`the session with ${input.container} broke HTTP/2 framing ${malformedInARow} times in a row \xB7 ending the build`);
+          input.log?.(`the session with ${input.container} broke HTTP/2 framing ${malformedInARow} times in a row${goawayNote("last GOAWAY", end.goawayCode)} \xB7 ending the build`);
           input.onFatal?.(fatal);
           return;
         }
@@ -2279,6 +2310,9 @@ var CONNECT_TIMEOUT_MS = 3e4;
 var NOT_ALLOWED_RANGE = "not-allowed";
 var NOT_RESOLVED = "not resolved";
 var IDLE_TIMEOUT_MS = 10 * 6e4;
+var STALLED_RESPONSE_MS = 6e4;
+var MAX_BAD_GATEWAY_LINES = 10;
+var BAD_GATEWAY_WINDOW_MS = 1e4;
 async function systemResolve(host) {
   const found = await lookup(host, { all: true, verbatim: true });
   return found.map((a) => ({ address: a.address }));
@@ -2286,6 +2320,13 @@ async function systemResolve(host) {
 function systemHostAddresses() {
   return Object.values(networkInterfaces()).flatMap((list) => (list ?? []).map((i) => i.address));
 }
+function errorCode(err) {
+  const code = err?.code;
+  return typeof code === "string" ? code : "unknown";
+}
+function abortedError(message) {
+  return Object.assign(new Error(message), { code: "ECONNABORTED" });
+}
 function normalize(address) {
   const zone = address.indexOf("%");
   return (zone === -1 ? address : address.slice(0, zone)).toLowerCase();
@@ -2305,6 +2346,26 @@ async function startTunnel(socketPath, opts = {}) {
   const ownAddresses = opts.hostAddresses ?? systemHostAddresses;
   const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
   const idleTimeoutMs = opts.idleTimeoutMs ?? IDLE_TIMEOUT_MS;
+  const stalledResponseMs = opts.stalledResponseMs ?? STALLED_RESPONSE_MS;
+  let windowStartedMs = 0;
+  let linesInWindow = 0;
+  let suppressed = 0;
+  const logBadGateway = (what) => {
+    if (opts.log === void 0) return;
+    const now = Date.now();
+    if (now - windowStartedMs >= BAD_GATEWAY_WINDOW_MS) {
+      windowStartedMs = now;
+      linesInWindow = 0;
+    }
+    if (linesInWindow >= MAX_BAD_GATEWAY_LINES) {
+      suppressed++;
+      return;
+    }
+    linesInWindow++;
+    const more = suppressed === 0 ? "" : ` (${suppressed} more 502 lines were not written)`;
+    suppressed = 0;
+    opts.log(`tunnel answered 502: ${what}${more}`);
+  };
   const hosts = [];
   const seen = /* @__PURE__ */ new Set();
   const extraHosts = /* @__PURE__ */ new Set();
@@ -2376,7 +2437,7 @@ async function startTunnel(socketPath, opts = {}) {
     }
     persist();
   };
-  async function decide(host) {
+  async function decide(host, port) {
     if (opts.allowHosts !== void 0 && !hostAllowed(host, opts.allowHosts)) {
       refused2(host, NOT_RESOLVED, NOT_ALLOWED_RANGE);
       return { ok: false, status: 403, body: `refused: ${host} is not in runner.build.allowHosts
@@ -2385,12 +2446,16 @@ async function startTunnel(socketPath, opts = {}) {
     let addresses;
     try {
       addresses = await resolve2(host);
-    } catch {
+    } catch (err) {
+      logBadGateway(`could not resolve ${host}:${port}, ${errorCode(err)}`);
       return { ok: false, status: 502, body: `could not resolve ${host}
 ` };
     }
-    if (addresses.length === 0) return { ok: false, status: 502, body: `${host} has no address
+    if (addresses.length === 0) {
+      logBadGateway(`${host}:${port} resolved to no address`);
+      return { ok: false, status: 502, body: `${host} has no address
 ` };
+    }
     const own = new Set(ownAddresses().map(normalize));
     let firstRefusal;
     for (const { address: address2 } of addresses) {
@@ -2432,36 +2497,70 @@ ${body}`);
       client.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
       return;
     }
-    const decision = await decide(target.host);
+    const decision = await decide(target.host, target.port);
     if (!decision.ok) {
       reply(client, decision.status, decision.body);
       return;
     }
     const upstream = openConnection({ address: decision.address, port: target.port });
     upstream.setTimeout(connectTimeoutMs);
-    const failed = () => {
+    const failed = (err) => {
       upstream.destroy();
+      logBadGateway(`could not connect to ${target.host}:${target.port}, ${err === void 0 ? "ETIMEDOUT" : errorCode(err)}`);
       reply(client, 502, `could not connect to ${target.host}
 `);
     };
+    const timedOut = () => failed();
     upstream.once("error", failed);
-    upstream.once("timeout", failed);
+    upstream.once("timeout", timedOut);
     client.on("close", () => upstream.destroy());
     const established = () => {
       upstream.removeListener("error", failed);
-      upstream.removeListener("timeout", failed);
+      upstream.removeListener("timeout", timedOut);
       upstream.setTimeout(idleTimeoutMs, () => upstream.destroy());
-      upstream.on("error", () => void 0);
-      upstream.on("close", () => client.destroy());
+      upstream.on("error", (err) => client.destroy(err));
+      upstream.on("close", () => {
+        if (!upstream.readableEnded && !client.writableEnded) client.destroy(abortedError("the tunnel closed the connection to the server before it ended"));
+      });
+      client.once("end", () => {
+        upstream.destroy();
+        client.end();
+      });
       reached(target.host);
       client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
       upstream.write(head);
+      releaseWhenStalled(client, upstream);
       upstream.pipe(client);
       client.pipe(upstream);
     };
     if (upstream.readyState === "open") established();
     else upstream.once("connect", established);
   }
+  function releaseWhenStalled(client, upstream) {
+    let delivered = 0;
+    upstream.on("data", (chunk) => delivered += chunk.length);
+    let read = delivered;
+    let timer;
+    const blocked = () => upstream.isPaused() || upstream.readableEnded;
+    const check = () => {
+      timer = void 0;
+      if (client.writableFinished || !blocked()) return;
+      if (delivered > read) {
+        read = delivered;
+        timer = setTimeout(check, stalledResponseMs);
+        return;
+      }
+      client.destroy(abortedError("the build stopped reading the response"));
+    };
+    const watch = () => {
+      if (timer !== void 0) return;
+      read = delivered;
+      timer = setTimeout(check, stalledResponseMs);
+    };
+    upstream.on("pause", watch);
+    upstream.on("end", watch);
+    client.once("close", () => clearTimeout(timer));
+  }
   async function proxyPlain(req, res) {
     if (opts.gitRemote !== void 0 && (req.url ?? "").startsWith("/")) {
       await opts.gitRemote(req, res);
@@ -2482,7 +2581,7 @@ ${body}`);
     }
     const host = url.hostname.replace(/^\[|\]$/g, "");
     const port = url.port === "" ? 80 : Number(url.port);
-    const decision = await decide(host);
+    const decision = await decide(host, port);
     if (!decision.ok) {
       res.writeHead(decision.status, { "Content-Type": "text/plain", Connection: "close" });
       res.end(decision.body);
@@ -2507,8 +2606,9 @@ ${body}`);
     );
     upstream.setTimeout(connectTimeoutMs, () => upstream.destroy());
     res.on("close", () => upstream.destroy());
-    upstream.on("error", () => {
+    upstream.on("error", (err) => {
       if (!res.headersSent) {
+        logBadGateway(`could not reach ${host}:${port}, ${errorCode(err)}`);
         res.writeHead(502, { "Content-Type": "text/plain", Connection: "close" });
         res.end(`could not reach ${host}
 `);
@@ -2561,6 +2661,9 @@ var RELAY_WAIT_MS = 500;
 var BUSY_IMAGE_WAIT_MS = 5e3;
 var VOLUME_REMOVE_ATTEMPTS = 4;
 var WORKFLOW_PERMISSION_REASON = "workflow_permission_required";
+function withTunnelLog(opts, log) {
+  return { ...opts, tunnelOptions: { log, ...opts?.tunnelOptions } };
+}
 function createContainerRuntime(opts = {}) {
   const { cli, remoteFor } = opts;
   return {
@@ -3421,4 +3524,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperFirecrackerNote, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, withTunnelLog, writeEvalInput };

package/dist/{chunk-T57XUI6N.js → chunk-HOB7Z4JQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-IKXY47R5.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GLL4TN2M.js';
 import { runnerImageVersion } from './chunk-Z3ASAXVU.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-SJZL5F3F.js';
 import { spawnSync } from 'child_process';

package/dist/{chunk-KVDVNOUK.js → chunk-KU7QL4XW.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-N7WAEEIU.js';
-import { senderPidfile } from './chunk-QWAYRAUX.js';
-import { installScrubContext } from './chunk-2YSCKEL2.js';
+import { senderPidfile } from './chunk-SFJXGISY.js';
+import { installScrubContext } from './chunk-MKIC65SD.js';
 import { writeDockerClientConfig } from './chunk-ZTY7HHYB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-IKXY47R5.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-GLL4TN2M.js';
 import { waitForAgent, vmExecArgs } from './chunk-MHAR6S7B.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-WWQVKFN6.js';
 import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-USJZ2LDK.js';

package/dist/{chunk-2YSCKEL2.js → chunk-MKIC65SD.js}

@@ -19,7 +19,7 @@ import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { dirname, basename, join } from 'path';
+import { dirname, basename, join, sep } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';
 import { hostname, userInfo } from 'os';
@@ -834,6 +834,49 @@ var LiveUploader = class {
     }
   }
 };
+var NOTICE = /<task-id>(?:\s|\\n)*([\w-]+)(?:\s|\\n)*<\/task-id>(?:(?!<task-notification>)[\s\S])*?<status>(?:\s|\\n)*(completed|failed|killed|stopped|cancelled|canceled|error)(?:\s|\\n)*<\/status>/gi;
+var cache = /* @__PURE__ */ new Map();
+function parentTranscriptOf(subagentFile) {
+  const segments = subagentFile.split(sep);
+  const at = segments.lastIndexOf("subagents");
+  if (at < 2) return void 0;
+  return join(segments.slice(0, at - 1).join(sep), `${segments[at - 1]}.jsonl`);
+}
+function endNotices(text) {
+  const endedAt = /* @__PURE__ */ new Map();
+  for (const raw of text.split("\n")) {
+    if (!raw.includes("<task-notification>")) continue;
+    let line;
+    try {
+      line = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (line.type !== "user" || typeof line.timestamp !== "string") continue;
+    for (const [, id] of raw.matchAll(NOTICE)) endedAt.set(id, [...endedAt.get(id) ?? [], line.timestamp]);
+  }
+  return endedAt;
+}
+function noticesIn(parentFile) {
+  try {
+    const { size, mtimeMs } = statSync(parentFile);
+    const key = `${parentFile}\0${size}\0${mtimeMs}`;
+    const known = cache.get(key) ?? endNotices(readFileSync(parentFile, "utf8"));
+    cache.set(key, known);
+    return known;
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+function subagentEndedInParent(subagentFile, lastActivityAt) {
+  const parent = parentTranscriptOf(subagentFile);
+  if (parent === void 0) return false;
+  const notices = noticesIn(parent).get(basename(subagentFile, ".jsonl").replace(/^agent-/, "")) ?? [];
+  return notices.some((at) => lastActivityAt === void 0 || Date.parse(at) >= Date.parse(lastActivityAt));
+}
+function runningForParent(entry, lastActivityAt) {
+  return !entry.isSubagent || !subagentEndedInParent(entry.file, lastActivityAt);
+}
 
 // src/skip-verdict.ts
 var RESUME_WINDOW_MS = 14 * 24 * 60 * 60 * 1e3;
@@ -1206,7 +1249,7 @@ async function runSyncInner(opts, stats) {
         applyContextProvenance(session, contextSourceBySessionId.get(session.id));
         applyReportedCost(session, home);
         const gated = prepareSessionForUpload(session, tier, envVars);
-        const liveEntry = liveUploads[gated.id];
+        const liveEntry = runningForParent(entry, gated.endedAt) ? liveUploads[gated.id] : void 0;
         const daemonIsStreaming = liveEntry !== void 0 && !liveEntry.ended && !liveEntry.failed;
         if (daemonIsStreaming && !sessionHasEnded(home, gated.subagent?.parentSessionId ?? gated.id)) {
           const gatedTurns = gated.turns ?? [];

package/dist/{chunk-R7SS5RLJ.js → chunk-MNHMUZGC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-T57XUI6N.js';
-import { MIN_ENGINE_MAJOR } from './chunk-IKXY47R5.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-HOB7Z4JQ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GLL4TN2M.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-F4FA3ZUT.js';
 import { runnerCredentialProblem } from './chunk-55XLX5PA.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';

package/dist/{chunk-7UGFIWIW.js → chunk-O65LES4V.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-KVDVNOUK.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-KU7QL4XW.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
 import { writePendingUpdate } from './chunk-IVX3U7KV.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-66T6XJAB.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-W3FSGH2M.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-6S4V4UIC.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-GUXWQIEY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, createContainerRuntime, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-IKXY47R5.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-GLL4TN2M.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-USJZ2LDK.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-Z3ASAXVU.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
@@ -1091,7 +1091,7 @@ function leaseTimeLeftFor(state, active) {
   return () => (state.deps.leaseTimeLeftMs ?? leaseTimeLeftMs)(active.job, nowOf(state).getTime());
 }
 function runtimeOf(state) {
-  state.containerRuntime ??= createContainerRuntime(state.deps.container);
+  state.containerRuntime ??= createContainerRuntime(withTunnelLog(state.deps.container, (line) => logOf(state).line(line)));
   return state.containerRuntime;
 }
 function finishDepsOf(state) {
@@ -2955,7 +2955,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-NDDOASVO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-YEI6TCUH.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -3270,4 +3270,4 @@ function runnerProcessState(configPath) {
   return isSameProcess(entry.pid, entry.start) ? { state: "running", pid: entry.pid } : { state: "stale", pid: entry.pid };
 }
 
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick };
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, start, tick, watchTick };

package/dist/{chunk-QWAYRAUX.js → chunk-SFJXGISY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-2YSCKEL2.js';
+import { LiveUploader } from './chunk-MKIC65SD.js';
 import { CaptureDaemon } from './chunk-UHU7H57K.js';
 import { spoolDir } from './chunk-DKWQMPSL.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{cli-QC6ZKHPK.js → cli-SCTKM2Y5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-6BWJQGTV.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-25X2PJDI.js';
 import './chunk-ITAIEJ2T.js';
 import './chunk-QBQHQEUG.js';
 import './chunk-KT4CN6OU.js';
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-K2IKTSXJ.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-L4VW3ZCT.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-K2IKTSXJ.js');
+    const { runInitCommand } = await import('./init-cmd-L4VW3ZCT.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4070,7 +4070,7 @@ code is 1: revoke the token on /profile/security.
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-TNOOUPY2.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-N4R7ST6X.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4101,7 +4101,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-HBNNYATF.js');
+    const { runWatch } = await import('./watch-L5MSAWEO.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4113,7 +4113,7 @@ code is 1: revoke the token on /profile/security.
   program2.command("claude [args...]").description("start Claude Code with the repository's control plane attached").allowUnknownOption().helpOption(false).action(() => {
   });
   const brokerRelay = program2.command("broker-relay", { hidden: true }).description("relay a build's loopback connections to the runner's tunnel and destinations").enablePositionalOptions().option("--port <port>", "the loopback port to listen on").option("--socket <path>", "the runner's tunnel socket").option("--join <path>", "the socket the runner's joining process connects to").option("--lease-watchdog", "exit when the runner's lease expiry passes; needs --join").option("--forward <port=target>", "also relay a loopback port to a destination; repeatable", (value, previous) => [...previous, value], []).action(async (opts) => {
-    const { startRelay, startSessionRelay } = await import('./relay-GFPPD6GF.js');
+    const { startRelay, startSessionRelay } = await import('./relay-FJ5K37Z5.js');
     const { TARGET_TUNNEL, targetOfPath } = await import('./relay-protocol-HELO5SNH.js');
     const port = Number(opts.port);
     if (!Number.isInteger(port) || port < 1 || port > 65535) {
@@ -4146,7 +4146,7 @@ code is 1: revoke the token on /profile/security.
     await startRelay({ port, socketPath: opts.socket, forwards: forwards.map((forward) => ({ port: forward.port, socketPath: forward.spec })) });
   });
   brokerRelay.command("join").description("carry the runner's session to the relay over standard input and output").option("--socket <path>", "the relay's joining socket", "/run/outerlayer-relay/join.sock").action(async (opts) => {
-    const { joinRelay } = await import('./relay-GFPPD6GF.js');
+    const { joinRelay } = await import('./relay-FJ5K37Z5.js');
     try {
       await joinRelay({ socketPath: opts.socket, input: process.stdin, output: process.stdout });
     } catch (err) {
@@ -4191,7 +4191,7 @@ code is 1: revoke the token on /profile/security.
     process.exitCode = await runBuildCommand({ dir: opts.dir, argv: command });
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-LFYMN6TT.js');
+    const { runSessionSender } = await import('./session-sender-UQ3VF732.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4281,7 +4281,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-BNS57DD3.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-TKA3GAN7.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4331,7 +4331,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-O3IBUMUY.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-SOXLBPQB.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4910,7 +4910,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-5QYIKYUP.js');
-    const { start, RunnerStartError } = await import('./loop-F5ASKFRJ.js');
+    const { start, RunnerStartError } = await import('./loop-QDV7T65M.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-CYCTH6NQ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4929,8 +4929,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-5QYIKYUP.js');
-    const { containerStart } = await import('./container-start-P7O5XGOB.js');
-    const { start, RunnerStartError } = await import('./loop-F5ASKFRJ.js');
+    const { containerStart } = await import('./container-start-7WLZMPEI.js');
+    const { start, RunnerStartError } = await import('./loop-QDV7T65M.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-CYCTH6NQ.js');
     try {
       const result = await containerStart({
@@ -4950,7 +4950,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
-    const { runRunnerCheck } = await import('./check-NDDOASVO.js');
+    const { runRunnerCheck } = await import('./check-YEI6TCUH.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4984,7 +4984,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-3F6GY4CK.js');
+        const { installServiceCommand } = await import('./command-PY3C2E4B.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5040,7 +5040,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
-    const { uninstallServiceCommand } = await import('./command-3F6GY4CK.js');
+    const { uninstallServiceCommand } = await import('./command-PY3C2E4B.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5068,10 +5068,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-5QYIKYUP.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-HHEAJDPN.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-Y76QXVNV.js');
-    const { detectMachine } = await import('./machine-6STGIRJJ.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-36XMFFRQ.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-5LHTF72R.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-M4N2BY5A.js');
+    const { detectMachine } = await import('./machine-PLNSGKNF.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-BTH5YPBC.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-EIB6WFPG.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5222,7 +5222,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-3F6GY4CK.js');
+        const { installServiceCommand } = await import('./command-PY3C2E4B.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5350,7 +5350,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
-    const { requestStop } = await import('./loop-F5ASKFRJ.js');
+    const { requestStop } = await import('./loop-QDV7T65M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-SS7YKJHN.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5358,8 +5358,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-5QYIKYUP.js');
     const { jobsDir, runnerDir } = await import('./paths-32DWGK35.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-F5ASKFRJ.js');
-    const { renderStatus } = await import('./status-OANG2EM3.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-QDV7T65M.js');
+    const { renderStatus } = await import('./status-PWMPP4ES.js');
     const { readHousekeepingRecord } = await import('./record-N4WPZCGK.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5419,7 +5419,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
-    const { listJobFiles } = await import('./loop-F5ASKFRJ.js');
+    const { listJobFiles } = await import('./loop-QDV7T65M.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-X2IRDP5T.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-3F6GY4CK.js → command-PY3C2E4B.js}

@@ -3,8 +3,8 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-ATJOFXTE.js';
 import './chunk-CTYSTE5C.js';
 import { currentLink, execStartCommand } from './chunk-GUXWQIEY.js';
-import { detectMachine } from './chunk-T57XUI6N.js';
-import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-IKXY47R5.js';
+import { detectMachine } from './chunk-HOB7Z4JQ.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{container-start-P7O5XGOB.js → container-start-7WLZMPEI.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-R7SS5RLJ.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-T57XUI6N.js';
-import { MIN_ENGINE_MAJOR } from './chunk-IKXY47R5.js';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-MNHMUZGC.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-HOB7Z4JQ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{doctor-QPQDF7FB.js → doctor-DQWRUAEB.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launcherCheck } from './chunk-CTYSTE5C.js';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-W3FSGH2M.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-6S4V4UIC.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import './chunk-GUXWQIEY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-R7SS5RLJ.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-T57XUI6N.js';
-import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-IKXY47R5.js';
+import './chunk-MNHMUZGC.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-HOB7Z4JQ.js';
+import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{emit-artifact-cmd-O3IBUMUY.js → emit-artifact-cmd-SOXLBPQB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-2YSCKEL2.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-MKIC65SD.js';
 import './chunk-TVZAC2NP.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';

package/dist/{emit-result-cmd-BNS57DD3.js → emit-result-cmd-TKA3GAN7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectCi } from './chunk-2YSCKEL2.js';
+import { detectCi } from './chunk-MKIC65SD.js';
 import './chunk-TVZAC2NP.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-EFC44SXV.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-QC6ZKHPK.js');
+var { runCli } = await import('./cli-SCTKM2Y5.js');
 await runCli(process.argv);

package/dist/{init-HHEAJDPN.js → init-5LHTF72R.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-R7SS5RLJ.js';
-import './chunk-T57XUI6N.js';
-import './chunk-IKXY47R5.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-MNHMUZGC.js';
+import './chunk-HOB7Z4JQ.js';
+import './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{init-36XMFFRQ.js → init-BTH5YPBC.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-E7R2GIAW.js';
-import { RunnerInitError, readConfigObject } from './chunk-R7SS5RLJ.js';
-import './chunk-T57XUI6N.js';
-import './chunk-IKXY47R5.js';
+import { RunnerInitError, readConfigObject } from './chunk-MNHMUZGC.js';
+import './chunk-HOB7Z4JQ.js';
+import './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{init-cmd-K2IKTSXJ.js → init-cmd-L4VW3ZCT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-6BWJQGTV.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-25X2PJDI.js';
 import './chunk-ITAIEJ2T.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-QBQHQEUG.js';

package/dist/{loop-F5ASKFRJ.js → loop-QDV7T65M.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick } from './chunk-7UGFIWIW.js';
-import './chunk-KVDVNOUK.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, start, tick, watchTick } from './chunk-O65LES4V.js';
+import './chunk-KU7QL4XW.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
@@ -9,18 +9,18 @@ import './chunk-IVX3U7KV.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-66T6XJAB.js';
 import './chunk-N7WAEEIU.js';
-import './chunk-QWAYRAUX.js';
-import './chunk-2YSCKEL2.js';
+import './chunk-SFJXGISY.js';
+import './chunk-MKIC65SD.js';
 import './chunk-TVZAC2NP.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-ZTY7HHYB.js';
-import './chunk-W3FSGH2M.js';
+import './chunk-6S4V4UIC.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-GUXWQIEY.js';
 import './chunk-TBT347UY.js';
-import './chunk-R7SS5RLJ.js';
-import './chunk-T57XUI6N.js';
-import './chunk-IKXY47R5.js';
+import './chunk-MNHMUZGC.js';
+import './chunk-HOB7Z4JQ.js';
+import './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{machine-6STGIRJJ.js → machine-PLNSGKNF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-T57XUI6N.js';
-import './chunk-IKXY47R5.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-HOB7Z4JQ.js';
+import './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{relay-GFPPD6GF.js → relay-FJ5K37Z5.js}

@@ -20,7 +20,7 @@ async function startRelay(opts) {
 }
 async function listenRelay(port, socketPath) {
   const open = /* @__PURE__ */ new Set();
-  const server = createServer((client) => {
+  const server = createServer({ allowHalfOpen: true }, (client) => {
     const upstream = connect(socketPath);
     open.add(client);
     client.on("error", () => void 0);
@@ -29,7 +29,9 @@ async function listenRelay(port, socketPath) {
       open.delete(client);
       upstream.destroy();
     });
-    upstream.on("close", () => client.destroy());
+    upstream.on("close", (hadError) => {
+      if (hadError) client.resetAndDestroy();
+    });
     client.pipe(upstream);
     upstream.pipe(client);
   });
@@ -99,9 +101,11 @@ async function startSessionRelay(opts) {
     }
     stream.on("error", noop);
     stream.on("response", noop);
-    stream.on("close", () => client.destroy());
+    stream.on("close", () => {
+      if (!stream.readableEnded) client.resetAndDestroy();
+    });
     client.on("close", () => {
-      if (!stream.destroyed) stream.close(http2.constants.NGHTTP2_CANCEL);
+      if (!stream.destroyed && !client.readableEnded) stream.close(http2.constants.NGHTTP2_CANCEL);
     });
     client.pipe(stream);
     stream.pipe(client);

package/dist/{runner-key-Y76QXVNV.js → runner-key-M4N2BY5A.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-R7SS5RLJ.js';
-import './chunk-T57XUI6N.js';
-import './chunk-IKXY47R5.js';
+import { readConfigObject, RunnerInitError } from './chunk-MNHMUZGC.js';
+import './chunk-HOB7Z4JQ.js';
+import './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import './chunk-USJZ2LDK.js';

package/dist/{session-sender-LFYMN6TT.js → session-sender-UQ3VF732.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { runSessionSender, senderPidfile, startSessionSender } from './chunk-QWAYRAUX.js';
-import './chunk-2YSCKEL2.js';
+export { runSessionSender, senderPidfile, startSessionSender } from './chunk-SFJXGISY.js';
+import './chunk-MKIC65SD.js';
 import './chunk-TVZAC2NP.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';

package/dist/{status-OANG2EM3.js → status-PWMPP4ES.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-KVDVNOUK.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-KU7QL4XW.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import './chunk-N7WAEEIU.js';
-import './chunk-QWAYRAUX.js';
-import './chunk-2YSCKEL2.js';
+import './chunk-SFJXGISY.js';
+import './chunk-MKIC65SD.js';
 import './chunk-TVZAC2NP.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-ZTY7HHYB.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import { LEASE_SECONDS } from './chunk-IKXY47R5.js';
+import { LEASE_SECONDS } from './chunk-GLL4TN2M.js';
 import './chunk-MHAR6S7B.js';
 import './chunk-WWQVKFN6.js';
 import { formatDuration, formatClock, relativeToRunner } from './chunk-USJZ2LDK.js';

package/dist/{sync-cmd-TNOOUPY2.js → sync-cmd-N4R7ST6X.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { CHUNK_PART_TARGET_BYTES, RETRYABLE_STATUSES, SyncConfigError, SyncTransportError, detectCi, isLoopbackUrl, resolveTier, runSync } from './chunk-2YSCKEL2.js';
+export { CHUNK_PART_TARGET_BYTES, RETRYABLE_STATUSES, SyncConfigError, SyncTransportError, detectCi, isLoopbackUrl, resolveTier, runSync } from './chunk-MKIC65SD.js';
 import './chunk-TVZAC2NP.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';

package/dist/{watch-HBNNYATF.js → watch-L5MSAWEO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-2YSCKEL2.js';
+import { LiveUploader } from './chunk-MKIC65SD.js';
 import './chunk-TVZAC2NP.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.28.1",
+  "version": "0.28.2",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",