@outerlayer/cli 0.28.3 → 0.28.4

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @outerlayer/cli
 
+## 0.28.4
+
+### Patch Changes
+
+- eabcfe6: `outerlayer doctor` passes on a runner that uses a Runner key. It leaves out the Claude Code version and last-sync checks for builds in containers or microVMs. The runner no longer logs a failed relay join while the build's relay is still starting.
+- 1cde310: A container build's finished connections free their place at once, so a large package install no longer runs out of connections and fails partway through.
+
 ## 0.28.3
 
 ### Patch Changes

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-17T16:34:27.736Z+686145e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-17T18:42:55.566Z+c3e29e0","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-F2TJCQ7S.js → check-WJ4X2Q44.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-LRFU6RPD.js';
-import './chunk-ILU6664L.js';
+import { probeCredentials } from './chunk-NVUO52YW.js';
+import './chunk-6P2Z5AUY.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
@@ -14,13 +14,13 @@ import './chunk-2BZTGJII.js';
 import './chunk-VM6BX2WJ.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-RXFKXZJS.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-SVODOMYC.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ERVZGWUR.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-6NFXOQKZ.js';
 import './chunk-TBT347UY.js';
-import './chunk-T7LJ6AIC.js';
-import './chunk-EPGMCEVP.js';
-import './chunk-4SJ57DH7.js';
+import './chunk-KBB3CQTW.js';
+import './chunk-W3K6GBXY.js';
+import './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/{chunk-4SJ57DH7.js → chunk-5Q4NDYQP.js}

@@ -20,7 +20,7 @@ import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
 import { downconvertSession } from './chunk-QZBXLLTV.js';
 import { realFdStorePort } from './chunk-XD4ZCMA4.js';
-import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
+import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream, writeSync } from 'fs';
 import { join, dirname, resolve, basename } from 'path';
 import { isIP, createConnection, connect, createServer as createServer$1 } from 'net';
@@ -1488,6 +1488,7 @@ var FIRST_BACKOFF_MS = 200;
 var LONGEST_BACKOFF_MS = 5e3;
 var JOINED_AFTER_MS = 2e3;
 var EXIT_WAIT_MS = 5e3;
+var SOCKET_NOT_READY = /\b(ENOENT|ECONNREFUSED)\b/;
 function exitedWithin(stream, ms) {
   let timer;
   const late = new Promise((resolve2) => {
@@ -1499,6 +1500,8 @@ function exitedWithin(stream, ms) {
 function superviseRelay(input) {
   const sleep = input.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const exitWaitMs = input.exitWaitMs ?? EXIT_WAIT_MS;
+  const now = input.now ?? Date.now;
+  const startedAt = now();
   let closed = false;
   let fatal;
   let running;
@@ -1542,9 +1545,12 @@ function superviseRelay(input) {
           return;
         }
       } else if (!joined && !failing) {
-        failing = true;
         const reason = stream.stderrTail?.().trim() ?? "";
-        input.log?.(`could not join the relay in ${input.container}${status === 0 || status === void 0 ? "" : ` (exec exited ${status})`}${reason === "" ? "" : `: ${reason}`} \xB7 trying again`);
+        const starting = SOCKET_NOT_READY.test(reason) && now() - startedAt < JOIN_WAIT_MS;
+        if (!starting) {
+          failing = true;
+          input.log?.(`could not join the relay in ${input.container}${status === 0 || status === void 0 ? "" : ` (exec exited ${status})`}${reason === "" ? "" : `: ${reason}`} \xB7 trying again`);
+        }
       }
       if (closed) return;
       await Promise.race([sleep(backoff), new Promise((resolve2) => wake = resolve2)]);
@@ -2525,6 +2531,7 @@ ${body}`);
       upstream.on("error", (err) => client.destroy(err));
       upstream.on("close", () => {
         if (!upstream.readableEnded && !client.writableEnded) client.destroy(abortedError("the tunnel closed the connection to the server before it ended"));
+        else client.resume();
       });
       client.once("end", () => {
         upstream.destroy();

package/dist/{chunk-ILU6664L.js → chunk-6P2Z5AUY.js}

@@ -5,7 +5,7 @@ import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-OO6OADZN.js';
 import { senderPidfile } from './chunk-YTR435DO.js';
 import { installScrubContext } from './chunk-2BZTGJII.js';
 import { writeDockerClientConfig } from './chunk-RXFKXZJS.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-4SJ57DH7.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-5Q4NDYQP.js';
 import { waitForAgent, vmExecArgs } from './chunk-WL3QF3QF.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-DIQN5SEL.js';
 import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-JZJLKTZT.js';

package/dist/{chunk-SVODOMYC.js → chunk-ERVZGWUR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-T7LJ6AIC.js';
+import { isPlaceholderCommand } from './chunk-KBB3CQTW.js';
 import { describeCallFailure } from './chunk-JZJLKTZT.js';
 import { builtinKind } from './chunk-YYGXCRIW.js';
 import { WorkCommandError, getJson } from './chunk-X7SFJZIG.js';

package/dist/{chunk-W7BH5YN6.js → chunk-FTNCNEWE.js}

@@ -176,17 +176,18 @@ function runDoctor(env = {}) {
   const home = env.home ?? homeFromEnv();
   const now = env.now ?? Date.now;
   const laptop = env.runnerHost !== true;
+  const buildsInOwnImages = env.runnerHost === true && (env.runnerHooks === "builtin:container" || env.runnerHooks === "builtin:vm");
   const transcripts = laptop ? scanTranscripts(home) : void 0;
   const starter = laptop ? checkStarterFiles(env.cwd) : void 0;
   return [
     ...laptop ? [checkClaudeDir(home), checkTranscripts(transcripts, now), ...checkHooks(home, env.cwd, transcripts, now)] : [LAPTOP_CHECKS_NOT_APPLICABLE],
     ...checkDeadHooksState(env.cwd),
     ...laptop ? [checkSpoolWritable(home)] : [],
-    checkLastSync(home, now),
+    ...buildsInOwnImages ? [] : [checkLastSync(home, now)],
     ...laptop ? [checkDaemon(home)] : [],
     checkCleanupPeriod(home),
     checkDiskHeadroom(home),
-    checkClaudeVersion(env),
+    ...buildsInOwnImages ? [] : [checkClaudeVersion(env)],
     checkSettingsValid(home, env.cwd),
     ...laptop ? checkStatusline(home, now, env.cwd) : [],
     ...checkInstalls(env),
@@ -920,6 +921,7 @@ var CREDENTIAL_CHECK_TIMEOUT_MS = 15e3;
 var LOGIN_FIX = `Run \`${cliInvocation()} login\` to sign in again.`;
 var CONNECT_FIX = `Run \`${cliInvocation()} connect\` to choose a factory for this repository.`;
 var SETUP_PANEL_FIX = "Link the repository on the factory's setup panel in the dashboard.";
+var RUNNER_KEY_PATH = "/v1/runner/host-key";
 var MINT_KEY_FIX = "Mint a key for a factory that exists: dashboard \u2192 Settings \u2192 API keys.";
 async function askGateway(fetchImpl, url, path, credential, appId) {
   const headers = { authorization: `Bearer ${credential}` };
@@ -1019,7 +1021,7 @@ async function loginChecks(fetchImpl, url, token, appId, local, inRepository) {
   const fix = elsewhere === void 0 ? SETUP_PANEL_FIX : `Run \`${cliInvocation()} connect --factory ${factorySlug(elsewhere)}\` to use the factory this repository is linked to.`;
   return [login, factoryCheck, { name: "Repository", status: "warn", detail: `${shown} is not linked to ${factorySlug(factory)}`, fix }];
 }
-async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
+async function factoryKeyChecks(fetchImpl, url, key, appId, source, local, runnerHost) {
   const name = "Factory key";
   if (appId === void 0) {
     return withSkippedRest(
@@ -1028,7 +1030,7 @@ async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
     );
   }
   const factoryPath = `/v1/apps/${encodeURIComponent(appId)}`;
-  const reply = await askGateway(fetchImpl, url, factoryPath, key, appId);
+  const reply = await askGateway(fetchImpl, url, runnerHost ? RUNNER_KEY_PATH : factoryPath, key, appId);
   const unanswered = unansweredDetail(reply);
   if (unanswered !== void 0) {
     return withSkippedRest({ name, status: "warn", detail: unanswered, fix: NETWORK_FIX }, "the factory key check did not finish");
@@ -1051,10 +1053,11 @@ async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
   const accepted = { name, status: "pass", detail: `the gateway accepts the key from ${source}` };
   const shownAppId = sanitizeTerminal(appId);
   if (status === 403 && /missing required permission/i.test(message)) {
-    const permission = /'([^']+)'/.exec(message)?.[1] ?? "factory.read";
+    const permission = /'([^']+)'/.exec(message)?.[1] ?? (runnerHost ? "work.claim" : "factory.read");
+    const cannot = runnerHost ? `the key lacks a permission that a runner needs for the factory ${shownAppId}` : `the key cannot read the factory ${shownAppId}`;
     return [
       accepted,
-      { name: "Factory", status: "fail", detail: `the key cannot read the factory ${shownAppId}: ${message}`, fix: `Use a key that holds ${permission}.` },
+      { name: "Factory", status: "fail", detail: `${cannot}: ${message}`, fix: `Use a key that holds ${permission}.` },
       skippedCheck("Repository", "the factory check failed")
     ];
   }
@@ -1082,6 +1085,10 @@ async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
       "the factory key check did not finish"
     );
   }
+  if (runnerHost) {
+    const factory2 = { name: "Factory", status: "pass", detail: `the factory ${shownAppId} accepts this runner key` };
+    return withRepository(fetchImpl, url, key, appId, factoryPath, local, accepted, factory2);
+  }
   const row = body?.data;
   if (typeof row?.id !== "string") {
     return withSkippedRest(
@@ -1091,6 +1098,9 @@ async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
   }
   const label = [row.display_name, row.name].find((v) => typeof v === "string") ?? appId;
   const factory = { name: "Factory", status: "pass", detail: `${sanitizeTerminal(label)} (${shownAppId}) is readable with this key` };
+  return withRepository(fetchImpl, url, key, appId, factoryPath, local, accepted, factory);
+}
+async function withRepository(fetchImpl, url, key, appId, factoryPath, local, accepted, factory) {
   if (local === void 0) return [accepted, factory, skippedCheck("Repository", "not inside a git repository with a remote")];
   const links = await askGateway(fetchImpl, url, `${factoryPath}/git/links`, key, appId);
   const shown = sanitizeTerminal(local);
@@ -1122,7 +1132,7 @@ async function credentialChecks(options = {}) {
     return loginChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, local, findGitDirs(cwd) !== void 0);
   }
   const source = env.OUTERLAYER_API_KEY ? "OUTERLAYER_API_KEY" : "~/.outerlayer/config.json";
-  return factoryKeyChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, source, local);
+  return factoryKeyChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, source, local, options.runnerHost === true);
 }
 function governedDetail(source) {
   return `governed by ${sanitizeTerminal(source.repository)} (ref ${sanitizeTerminal(source.ref)}, stored commit ${sanitizeTerminal(source.sha.slice(0, 7))})`;
@@ -1182,8 +1192,16 @@ function doctorExitCode(checks) {
 async function gatherDoctorChecks() {
   const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-TNV5HHLO.js');
   const configPath = defaultRunnerConfigPath();
-  const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
-  const credential = await credentialChecks();
+  const runnerHost = hasRunnerBlock(configPath);
+  const hooks = (() => {
+    try {
+      return runnerHost ? loadRunnerConfig(configPath).hooks : void 0;
+    } catch {
+      return void 0;
+    }
+  })();
+  const checks = runDoctor({ runnerHost, ...hooks === void 0 ? {} : { runnerHooks: hooks.provision } });
+  const credential = await credentialChecks({ runnerHost });
   checks.push(...credential);
   if (credential[0]?.status === "pass") checks.push(...await githubAppChecks(), ...await governanceChecks());
   if (credential[0]?.status === "pass") checks.push(...await fleetCheck());
@@ -1193,14 +1211,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-3SRHLRF5.js');
-    const hooks = (() => {
-      try {
-        return loadRunnerConfig(configPath).hooks;
-      } catch {
-        return void 0;
-      }
-    })();
+    const { runnerHostChecks } = await import('./doctor-PKMAUDTU.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{chunk-T7LJ6AIC.js → chunk-KBB3CQTW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-EPGMCEVP.js';
-import { MIN_ENGINE_MAJOR } from './chunk-4SJ57DH7.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-W3K6GBXY.js';
+import { MIN_ENGINE_MAJOR } from './chunk-5Q4NDYQP.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-AV5MJY45.js';
 import { runnerCredentialProblem } from './chunk-YYGXCRIW.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';

package/dist/{chunk-LRFU6RPD.js → chunk-NVUO52YW.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-ILU6664L.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-6P2Z5AUY.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
 import { writePendingUpdate } from './chunk-HWOU2HDH.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-QBF462QH.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-SVODOMYC.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-ERVZGWUR.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-6NFXOQKZ.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-4SJ57DH7.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-5Q4NDYQP.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-JZJLKTZT.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-O47BTZSN.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
@@ -2955,7 +2955,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-F2TJCQ7S.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-WJ4X2Q44.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-EPGMCEVP.js → chunk-W3K6GBXY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-4SJ57DH7.js';
+import { MIN_ENGINE_MAJOR } from './chunk-5Q4NDYQP.js';
 import { runnerImageVersion } from './chunk-O47BTZSN.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-SJZL5F3F.js';
 import { spawnSync } from 'child_process';

package/dist/{cli-5LLFR2SX.js → cli-X3JGBH2D.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-W7BH5YN6.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-FTNCNEWE.js';
 import './chunk-ITAIEJ2T.js';
 import './chunk-TOHKSZKI.js';
 import './chunk-KT4CN6OU.js';
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-XSOVMNNE.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-GJR37XGU.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-XSOVMNNE.js');
+    const { runInitCommand } = await import('./init-cmd-GJR37XGU.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4910,7 +4910,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-TNV5HHLO.js');
-    const { start, RunnerStartError } = await import('./loop-QQBLJ7GN.js');
+    const { start, RunnerStartError } = await import('./loop-DO46LFUH.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-3FT5OLUE.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4929,8 +4929,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-TNV5HHLO.js');
-    const { containerStart } = await import('./container-start-YG45GLFE.js');
-    const { start, RunnerStartError } = await import('./loop-QQBLJ7GN.js');
+    const { containerStart } = await import('./container-start-3MXIUNE2.js');
+    const { start, RunnerStartError } = await import('./loop-DO46LFUH.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-3FT5OLUE.js');
     try {
       const result = await containerStart({
@@ -4950,7 +4950,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-TNV5HHLO.js');
-    const { runRunnerCheck } = await import('./check-F2TJCQ7S.js');
+    const { runRunnerCheck } = await import('./check-WJ4X2Q44.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4984,7 +4984,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-YXOMIXOJ.js');
+        const { installServiceCommand } = await import('./command-NLWZT7KR.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5040,7 +5040,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-TNV5HHLO.js');
-    const { uninstallServiceCommand } = await import('./command-YXOMIXOJ.js');
+    const { uninstallServiceCommand } = await import('./command-NLWZT7KR.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5068,10 +5068,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-TNV5HHLO.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-HQW3LHIF.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-SICUOQY5.js');
-    const { detectMachine } = await import('./machine-ATDPHWL5.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-XP55Q4ZT.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-Q6JV7IGF.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-UP5YBUHR.js');
+    const { detectMachine } = await import('./machine-HZGUBOUH.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-HENNITCI.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-2Z2DVSUJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5222,7 +5222,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-YXOMIXOJ.js');
+        const { installServiceCommand } = await import('./command-NLWZT7KR.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5350,7 +5350,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-TNV5HHLO.js');
-    const { requestStop } = await import('./loop-QQBLJ7GN.js');
+    const { requestStop } = await import('./loop-DO46LFUH.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-TEOKZVD5.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5358,8 +5358,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-TNV5HHLO.js');
     const { jobsDir, runnerDir } = await import('./paths-2VSGK6E2.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-QQBLJ7GN.js');
-    const { renderStatus } = await import('./status-AI22UPKC.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-DO46LFUH.js');
+    const { renderStatus } = await import('./status-2ICTDC2R.js');
     const { readHousekeepingRecord } = await import('./record-7SSRLSI2.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5419,7 +5419,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-TNV5HHLO.js');
-    const { listJobFiles } = await import('./loop-QQBLJ7GN.js');
+    const { listJobFiles } = await import('./loop-DO46LFUH.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-Z4L4I3OR.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-YXOMIXOJ.js → command-NLWZT7KR.js}

@@ -3,8 +3,8 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-EZ3DZXUH.js';
 import './chunk-DSKOHPXN.js';
 import { currentLink, execStartCommand } from './chunk-6NFXOQKZ.js';
-import { detectMachine } from './chunk-EPGMCEVP.js';
-import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-4SJ57DH7.js';
+import { detectMachine } from './chunk-W3K6GBXY.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/{container-start-YG45GLFE.js → container-start-3MXIUNE2.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-T7LJ6AIC.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-EPGMCEVP.js';
-import { MIN_ENGINE_MAJOR } from './chunk-4SJ57DH7.js';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-KBB3CQTW.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-W3K6GBXY.js';
+import { MIN_ENGINE_MAJOR } from './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/{doctor-3SRHLRF5.js → doctor-PKMAUDTU.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launcherCheck } from './chunk-DSKOHPXN.js';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-SVODOMYC.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-ERVZGWUR.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import './chunk-6NFXOQKZ.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-T7LJ6AIC.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-EPGMCEVP.js';
-import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-4SJ57DH7.js';
+import './chunk-KBB3CQTW.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-W3K6GBXY.js';
+import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-UJPAWDAO.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-5LLFR2SX.js');
+var { runCli } = await import('./cli-X3JGBH2D.js');
 await runCli(process.argv);

package/dist/{init-XP55Q4ZT.js → init-HENNITCI.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-E7R2GIAW.js';
-import { RunnerInitError, readConfigObject } from './chunk-T7LJ6AIC.js';
-import './chunk-EPGMCEVP.js';
-import './chunk-4SJ57DH7.js';
+import { RunnerInitError, readConfigObject } from './chunk-KBB3CQTW.js';
+import './chunk-W3K6GBXY.js';
+import './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/{init-HQW3LHIF.js → init-Q6JV7IGF.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-T7LJ6AIC.js';
-import './chunk-EPGMCEVP.js';
-import './chunk-4SJ57DH7.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-KBB3CQTW.js';
+import './chunk-W3K6GBXY.js';
+import './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/{init-cmd-XSOVMNNE.js → init-cmd-GJR37XGU.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-W7BH5YN6.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-FTNCNEWE.js';
 import './chunk-ITAIEJ2T.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-TOHKSZKI.js';

package/dist/{loop-QQBLJ7GN.js → loop-DO46LFUH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, start, tick, watchTick } from './chunk-LRFU6RPD.js';
-import './chunk-ILU6664L.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, start, tick, watchTick } from './chunk-NVUO52YW.js';
+import './chunk-6P2Z5AUY.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
@@ -14,13 +14,13 @@ import './chunk-2BZTGJII.js';
 import './chunk-VM6BX2WJ.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-RXFKXZJS.js';
-import './chunk-SVODOMYC.js';
+import './chunk-ERVZGWUR.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-6NFXOQKZ.js';
 import './chunk-TBT347UY.js';
-import './chunk-T7LJ6AIC.js';
-import './chunk-EPGMCEVP.js';
-import './chunk-4SJ57DH7.js';
+import './chunk-KBB3CQTW.js';
+import './chunk-W3K6GBXY.js';
+import './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/{machine-ATDPHWL5.js → machine-HZGUBOUH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-EPGMCEVP.js';
-import './chunk-4SJ57DH7.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-W3K6GBXY.js';
+import './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/{runner-key-SICUOQY5.js → runner-key-UP5YBUHR.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-T7LJ6AIC.js';
-import './chunk-EPGMCEVP.js';
-import './chunk-4SJ57DH7.js';
+import { readConfigObject, RunnerInitError } from './chunk-KBB3CQTW.js';
+import './chunk-W3K6GBXY.js';
+import './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import './chunk-JZJLKTZT.js';

package/dist/{status-AI22UPKC.js → status-2ICTDC2R.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-ILU6664L.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-6P2Z5AUY.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import './chunk-OO6OADZN.js';
 import './chunk-YTR435DO.js';
@@ -10,7 +10,7 @@ import './chunk-ESVW4MJY.js';
 import './chunk-RXFKXZJS.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import { LEASE_SECONDS } from './chunk-4SJ57DH7.js';
+import { LEASE_SECONDS } from './chunk-5Q4NDYQP.js';
 import './chunk-WL3QF3QF.js';
 import './chunk-DIQN5SEL.js';
 import { formatDuration, formatClock, relativeToRunner } from './chunk-JZJLKTZT.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.28.3",
+  "version": "0.28.4",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",