@outerlayer/cli 0.28.3 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @outerlayer/cli
 
+## 0.29.0
+
+### Minor Changes
+
+- 8ed2acc: The host's criteria judge records one check item per criterion, with its result and reason, and judges again only the criteria whose tests changed. `outerlayer emit <name> --items <file>` sends check items from CI, a host command writes them to the file `OUTERLAYER_CHECK_ITEMS` names, and `outerlayer work status` lists the failing ones. A judge check can set `subjects: none` to judge the change with no criteria.
+
+### Patch Changes
+
+- 3a2c7ea: A command in a microVM build that finishes at once no longer fails now and then with `write EPIPE` from the exec agent. The runner sends a command's request and its known input to the guest in one write.
+- c6533fc: A runner reads past the first page of startable work, so a runner limited to some repositories finds their work however long the queue is. It takes work in the order the gateway lists it, which is now the order each build was asked for.
+- 86d956d: The tracker adapters name an issue's labels `labels` instead of `tags`. The label names they read from GitHub, Linear and Jira are unchanged.
+
+## 0.28.4
+
+### Patch Changes
+
+- eabcfe6: `outerlayer doctor` passes on a runner that uses a Runner key. It leaves out the Claude Code version and last-sync checks for builds in containers or microVMs. The runner no longer logs a failed relay join while the build's relay is still starting.
+- 1cde310: A container build's finished connections free their place at once, so a large package install no longer runs out of connections and fails partway through.
+
 ## 0.28.3
 
 ### Patch Changes

package/dist/{agent-setup-IDF3EXM4.js → agent-setup-S3KI7TER.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-UXLLWIA2.js';
-import './chunk-QKXF7CLR.js';
+export { keepHandWritten, runAgentSetup } from './chunk-FA6XWYRH.js';
+import './chunk-GJOF6357.js';
 import './chunk-KT4CN6OU.js';
-import './chunk-SATUCMAJ.js';
-import './chunk-5B7BEQPR.js';
+import './chunk-25Z6SBMQ.js';
+import './chunk-427AVP6J.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-TG7FAHRP.js';
-import './chunk-P2RWZCV7.js';
-import './chunk-KJIUFOC4.js';
+import './chunk-H6DGJBXG.js';
+import './chunk-FUGRIAG7.js';
+import './chunk-F72ABZRD.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-R7TMTFJP.js';
-import './chunk-DWVAG73B.js';
-import './chunk-N5EEEKT6.js';
+import './chunk-SHVE5JZO.js';
+import './chunk-PAHZQQB3.js';
+import './chunk-C7F6U2YZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-JGML2VUN.js';
+import './chunk-NX2G6PH6.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
 import './chunk-CRB3POP4.js';
-import './chunk-VWFOKRYS.js';
+import './chunk-42TFWHFF.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-RKOTJQVG.js';
-import './chunk-QZBXLLTV.js';
+import './chunk-DXI6A6JN.js';
+import './chunk-JL6VZHAJ.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';

package/dist/{artifact-link-cmd-LEI6EOZE.js → artifact-link-cmd-LIJEXVN5.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-BUP5N3X6.js';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-6XQPCQBW.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import './chunk-QZBXLLTV.js';
+import './chunk-JL6VZHAJ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{bridge-JN3VJ23L.js → bridge-CP25XV3W.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-RXFKXZJS.js';
-import './chunk-N5EEEKT6.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-KBIJZAH4.js';
+import './chunk-C7F6U2YZ.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-JCYOHPLL.js → build-ZS4Y5MJU.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-TCBVV2JK.js';
-import './chunk-M6NNXKRM.js';
+export { buildRepositoryImage } from './chunk-V47KJGNE.js';
+import './chunk-CU7TJL6S.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-SJZL5F3F.js';
-import './chunk-DWVAG73B.js';
-import './chunk-N5EEEKT6.js';
+import './chunk-PAHZQQB3.js';
+import './chunk-C7F6U2YZ.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-17T16:34:27.736Z+686145e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-19T13:07:50.023Z+2340eef","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-HCTVP2O7.js → builder-FDUOMHY3.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-MFI55TNI.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-BFA2LNJG.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-UHU7H57K.js';
-import './chunk-R7TMTFJP.js';
-import './chunk-DWVAG73B.js';
-import './chunk-N5EEEKT6.js';
-import './chunk-QZBXLLTV.js';
+import './chunk-LKN4J37L.js';
+import './chunk-SHVE5JZO.js';
+import './chunk-PAHZQQB3.js';
+import './chunk-C7F6U2YZ.js';
+import './chunk-JL6VZHAJ.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-F2TJCQ7S.js → check-5XB22HKS.js}

@@ -1,66 +1,67 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-LRFU6RPD.js';
-import './chunk-ILU6664L.js';
+import { probeCredentials } from './chunk-A2E7MU2H.js';
+import './chunk-M4QY7YZ5.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
-import './chunk-HWOU2HDH.js';
+import './chunk-MX3PPJNS.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-QBF462QH.js';
-import './chunk-OO6OADZN.js';
-import './chunk-YTR435DO.js';
-import './chunk-2BZTGJII.js';
-import './chunk-VM6BX2WJ.js';
+import './chunk-3KMYWLMK.js';
+import './chunk-OD6WUNKZ.js';
+import './chunk-I3LTIAOR.js';
+import './chunk-PP7C7JQO.js';
+import './chunk-GJJDPZS2.js';
+import './chunk-UPKFSNSU.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-RXFKXZJS.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-SVODOMYC.js';
+import './chunk-KBIJZAH4.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-WEMNLTWB.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-6NFXOQKZ.js';
+import './chunk-23PFIW35.js';
 import './chunk-TBT347UY.js';
-import './chunk-T7LJ6AIC.js';
-import './chunk-EPGMCEVP.js';
-import './chunk-4SJ57DH7.js';
-import './chunk-WL3QF3QF.js';
-import './chunk-DIQN5SEL.js';
-import './chunk-JZJLKTZT.js';
-import './chunk-O47BTZSN.js';
+import './chunk-D3D2CERC.js';
+import './chunk-2YLKMVFV.js';
+import './chunk-MO2NI6W6.js';
+import './chunk-77YT7YC4.js';
+import './chunk-YSH4KCUJ.js';
+import './chunk-SN3C57RV.js';
+import './chunk-GI73HOI2.js';
 import './chunk-TQMI335S.js';
-import './chunk-AV5MJY45.js';
-import './chunk-JYVBEWBC.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-YYGXCRIW.js';
+import './chunk-IGEJUPDE.js';
+import './chunk-GG3WS4C5.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-NAHTO4XM.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-TCBVV2JK.js';
-import './chunk-M6NNXKRM.js';
+import './chunk-V47KJGNE.js';
+import './chunk-CU7TJL6S.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-MFI55TNI.js';
+import './chunk-BFA2LNJG.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-X7SFJZIG.js';
-import './chunk-NMIYK2G2.js';
-import './chunk-QFNFBQCG.js';
-import './chunk-BUP5N3X6.js';
-import './chunk-UHU7H57K.js';
-import './chunk-5B7BEQPR.js';
-import './chunk-HOU33DW5.js';
+import './chunk-6AG2XW5S.js';
+import './chunk-PGA5BVHQ.js';
+import './chunk-HRWL7NSJ.js';
+import './chunk-6XQPCQBW.js';
+import './chunk-LKN4J37L.js';
+import './chunk-427AVP6J.js';
+import './chunk-VY4YVFL5.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-TG7FAHRP.js';
-import './chunk-P2RWZCV7.js';
-import './chunk-KJIUFOC4.js';
+import './chunk-H6DGJBXG.js';
+import './chunk-FUGRIAG7.js';
+import './chunk-F72ABZRD.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-R7TMTFJP.js';
-import './chunk-DWVAG73B.js';
-import { claudeEnvPath } from './chunk-N5EEEKT6.js';
-import './chunk-OOUHNKKX.js';
+import './chunk-SHVE5JZO.js';
+import './chunk-PAHZQQB3.js';
+import { claudeEnvPath } from './chunk-C7F6U2YZ.js';
+import './chunk-IG45QISA.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-JGML2VUN.js';
+import './chunk-NX2G6PH6.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -70,8 +71,8 @@ import './chunk-CRB3POP4.js';
 import './chunk-URIZRCRY.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-RKOTJQVG.js';
-import './chunk-QZBXLLTV.js';
+import './chunk-DXI6A6JN.js';
+import './chunk-JL6VZHAJ.js';
 import './chunk-VNVZDWO3.js';
 import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';

package/dist/{chunk-6NFXOQKZ.js → chunk-23PFIW35.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PAHZQQB3.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-SATUCMAJ.js → chunk-25Z6SBMQ.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-JGML2VUN.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-NX2G6PH6.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-VWFOKRYS.js';
+import { linkedAgentsPath } from './chunk-42TFWHFF.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-W7BH5YN6.js → chunk-2KOXAMMB.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned } from './chunk-ITAIEJ2T.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-TOHKSZKI.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-X7SFJZIG.js';
-import { isLinkedRepository } from './chunk-QFNFBQCG.js';
-import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-UHU7H57K.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-MZJAIRXM.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-TZGQQY7Y.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-6AG2XW5S.js';
+import { isLinkedRepository } from './chunk-HRWL7NSJ.js';
+import { sanitizeTerminal } from './chunk-6XQPCQBW.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-LKN4J37L.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { checkFormerSkillNames } from './chunk-P2RWZCV7.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-KJIUFOC4.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-OOUHNKKX.js';
+import { checkFormerSkillNames } from './chunk-FUGRIAG7.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-F72ABZRD.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-IG45QISA.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -176,17 +176,18 @@ function runDoctor(env = {}) {
   const home = env.home ?? homeFromEnv();
   const now = env.now ?? Date.now;
   const laptop = env.runnerHost !== true;
+  const buildsInOwnImages = env.runnerHost === true && (env.runnerHooks === "builtin:container" || env.runnerHooks === "builtin:vm");
   const transcripts = laptop ? scanTranscripts(home) : void 0;
   const starter = laptop ? checkStarterFiles(env.cwd) : void 0;
   return [
     ...laptop ? [checkClaudeDir(home), checkTranscripts(transcripts, now), ...checkHooks(home, env.cwd, transcripts, now)] : [LAPTOP_CHECKS_NOT_APPLICABLE],
     ...checkDeadHooksState(env.cwd),
     ...laptop ? [checkSpoolWritable(home)] : [],
-    checkLastSync(home, now),
+    ...buildsInOwnImages ? [] : [checkLastSync(home, now)],
     ...laptop ? [checkDaemon(home)] : [],
     checkCleanupPeriod(home),
     checkDiskHeadroom(home),
-    checkClaudeVersion(env),
+    ...buildsInOwnImages ? [] : [checkClaudeVersion(env)],
     checkSettingsValid(home, env.cwd),
     ...laptop ? checkStatusline(home, now, env.cwd) : [],
     ...checkInstalls(env),
@@ -920,6 +921,7 @@ var CREDENTIAL_CHECK_TIMEOUT_MS = 15e3;
 var LOGIN_FIX = `Run \`${cliInvocation()} login\` to sign in again.`;
 var CONNECT_FIX = `Run \`${cliInvocation()} connect\` to choose a factory for this repository.`;
 var SETUP_PANEL_FIX = "Link the repository on the factory's setup panel in the dashboard.";
+var RUNNER_KEY_PATH = "/v1/runner/host-key";
 var MINT_KEY_FIX = "Mint a key for a factory that exists: dashboard \u2192 Settings \u2192 API keys.";
 async function askGateway(fetchImpl, url, path, credential, appId) {
   const headers = { authorization: `Bearer ${credential}` };
@@ -1019,7 +1021,7 @@ async function loginChecks(fetchImpl, url, token, appId, local, inRepository) {
   const fix = elsewhere === void 0 ? SETUP_PANEL_FIX : `Run \`${cliInvocation()} connect --factory ${factorySlug(elsewhere)}\` to use the factory this repository is linked to.`;
   return [login, factoryCheck, { name: "Repository", status: "warn", detail: `${shown} is not linked to ${factorySlug(factory)}`, fix }];
 }
-async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
+async function factoryKeyChecks(fetchImpl, url, key, appId, source, local, runnerHost) {
   const name = "Factory key";
   if (appId === void 0) {
     return withSkippedRest(
@@ -1028,7 +1030,7 @@ async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
     );
   }
   const factoryPath = `/v1/apps/${encodeURIComponent(appId)}`;
-  const reply = await askGateway(fetchImpl, url, factoryPath, key, appId);
+  const reply = await askGateway(fetchImpl, url, runnerHost ? RUNNER_KEY_PATH : factoryPath, key, appId);
   const unanswered = unansweredDetail(reply);
   if (unanswered !== void 0) {
     return withSkippedRest({ name, status: "warn", detail: unanswered, fix: NETWORK_FIX }, "the factory key check did not finish");
@@ -1051,10 +1053,11 @@ async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
   const accepted = { name, status: "pass", detail: `the gateway accepts the key from ${source}` };
   const shownAppId = sanitizeTerminal(appId);
   if (status === 403 && /missing required permission/i.test(message)) {
-    const permission = /'([^']+)'/.exec(message)?.[1] ?? "factory.read";
+    const permission = /'([^']+)'/.exec(message)?.[1] ?? (runnerHost ? "work.claim" : "factory.read");
+    const cannot = runnerHost ? `the key lacks a permission that a runner needs for the factory ${shownAppId}` : `the key cannot read the factory ${shownAppId}`;
     return [
       accepted,
-      { name: "Factory", status: "fail", detail: `the key cannot read the factory ${shownAppId}: ${message}`, fix: `Use a key that holds ${permission}.` },
+      { name: "Factory", status: "fail", detail: `${cannot}: ${message}`, fix: `Use a key that holds ${permission}.` },
       skippedCheck("Repository", "the factory check failed")
     ];
   }
@@ -1082,6 +1085,10 @@ async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
       "the factory key check did not finish"
     );
   }
+  if (runnerHost) {
+    const factory2 = { name: "Factory", status: "pass", detail: `the factory ${shownAppId} accepts this runner key` };
+    return withRepository(fetchImpl, url, key, appId, factoryPath, local, accepted, factory2);
+  }
   const row = body?.data;
   if (typeof row?.id !== "string") {
     return withSkippedRest(
@@ -1091,6 +1098,9 @@ async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
   }
   const label = [row.display_name, row.name].find((v) => typeof v === "string") ?? appId;
   const factory = { name: "Factory", status: "pass", detail: `${sanitizeTerminal(label)} (${shownAppId}) is readable with this key` };
+  return withRepository(fetchImpl, url, key, appId, factoryPath, local, accepted, factory);
+}
+async function withRepository(fetchImpl, url, key, appId, factoryPath, local, accepted, factory) {
   if (local === void 0) return [accepted, factory, skippedCheck("Repository", "not inside a git repository with a remote")];
   const links = await askGateway(fetchImpl, url, `${factoryPath}/git/links`, key, appId);
   const shown = sanitizeTerminal(local);
@@ -1122,7 +1132,7 @@ async function credentialChecks(options = {}) {
     return loginChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, local, findGitDirs(cwd) !== void 0);
   }
   const source = env.OUTERLAYER_API_KEY ? "OUTERLAYER_API_KEY" : "~/.outerlayer/config.json";
-  return factoryKeyChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, source, local);
+  return factoryKeyChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, source, local, options.runnerHost === true);
 }
 function governedDetail(source) {
   return `governed by ${sanitizeTerminal(source.repository)} (ref ${sanitizeTerminal(source.ref)}, stored commit ${sanitizeTerminal(source.sha.slice(0, 7))})`;
@@ -1180,10 +1190,18 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-TNV5HHLO.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-HJQ4YE57.js');
   const configPath = defaultRunnerConfigPath();
-  const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
-  const credential = await credentialChecks();
+  const runnerHost = hasRunnerBlock(configPath);
+  const hooks = (() => {
+    try {
+      return runnerHost ? loadRunnerConfig(configPath).hooks : void 0;
+    } catch {
+      return void 0;
+    }
+  })();
+  const checks = runDoctor({ runnerHost, ...hooks === void 0 ? {} : { runnerHooks: hooks.provision } });
+  const credential = await credentialChecks({ runnerHost });
   checks.push(...credential);
   if (credential[0]?.status === "pass") checks.push(...await githubAppChecks(), ...await governanceChecks());
   if (credential[0]?.status === "pass") checks.push(...await fleetCheck());
@@ -1193,14 +1211,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-3SRHLRF5.js');
-    const hooks = (() => {
-      try {
-        return loadRunnerConfig(configPath).hooks;
-      } catch {
-        return void 0;
-      }
-    })();
+    const { runnerHostChecks } = await import('./doctor-VXDBXKSL.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1228,7 +1239,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-L7JIBK3Y.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-NPTR35MG.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-GODA5G7U.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-EPGMCEVP.js → chunk-2YLKMVFV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-4SJ57DH7.js';
-import { runnerImageVersion } from './chunk-O47BTZSN.js';
+import { MIN_ENGINE_MAJOR } from './chunk-MO2NI6W6.js';
+import { runnerImageVersion } from './chunk-GI73HOI2.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-SJZL5F3F.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-QBF462QH.js → chunk-3KMYWLMK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PAHZQQB3.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-5B7BEQPR.js → chunk-427AVP6J.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-JGML2VUN.js';
-import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-RKOTJQVG.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-NX2G6PH6.js';
+import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-DXI6A6JN.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';
 

package/dist/{chunk-VWFOKRYS.js → chunk-42TFWHFF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
 import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import { CONTEXT_PIN_FILENAME } from './chunk-RKOTJQVG.js';
+import { CONTEXT_PIN_FILENAME } from './chunk-DXI6A6JN.js';
 import { execFileSync } from 'child_process';
 import { lstatSync, existsSync, unlinkSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';

package/dist/{chunk-X7SFJZIG.js → chunk-6AG2XW5S.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-NMIYK2G2.js';
-import { workPageUrl } from './chunk-QFNFBQCG.js';
-import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { resolveRepoIdentity } from './chunk-UHU7H57K.js';
+import { detectActiveSession, autoConnect } from './chunk-PGA5BVHQ.js';
+import { workPageUrl } from './chunk-HRWL7NSJ.js';
+import { sanitizeTerminal } from './chunk-6XQPCQBW.js';
+import { resolveRepoIdentity } from './chunk-LKN4J37L.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-KJIUFOC4.js';
-import { signRunnerRequest } from './chunk-R7TMTFJP.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-F72ABZRD.js';
+import { signRunnerRequest } from './chunk-SHVE5JZO.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -428,7 +428,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-UJPAWDAO.js');
+      const { logHookError } = await import('./hook-fast-JKYCVO4R.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -534,14 +534,33 @@ function repositoryDisconnectedLine(data) {
 
 `;
 }
+function failingChecksSection(data) {
+  const checks = data.checks;
+  if (!Array.isArray(checks)) return "";
+  const failing = checks.filter((check) => check.result === "fail");
+  if (failing.length === 0) return "";
+  const lines = failing.flatMap((check) => {
+    const body = typeof check.body === "string" && check.body !== "" ? `: ${sanitizeTerminal(check.body)}` : "";
+    const items = Array.isArray(check.items) ? check.items : [];
+    return [
+      `  ${sanitizeTerminal(String(check.name))}${body}`,
+      ...items.filter((item) => item.result === "fail").map((item) => `    ${sanitizeTerminal(String(item.id))}${typeof item.reason === "string" ? `  ${C.dim}${sanitizeTerminal(item.reason)}${C.reset}` : ""}`)
+    ];
+  });
+  return `
+
+Failing checks
+${lines.join("\n")}`;
+}
 function statusOutput(data, json) {
   if (json) return JSON.stringify(data);
   const document = mergedUnverifiedLine(data) + repositoryDisconnectedLine(data) + JSON.stringify(data, null, 2);
+  const checks = failingChecksSection(data);
   const criteria = data.criteria;
-  if (criteria === void 0) return document;
+  if (criteria === void 0) return `${document}${checks}`;
   if (criteria === null || !Array.isArray(criteria.items)) return `${document}
 
-Criteria: none recorded`;
+Criteria: none recorded${checks}`;
   const mark = criteria.drafted === true ? ` ${C.dim}(drafted by the build)${C.reset}` : "";
   const lines = criteria.items.map((item) => {
     const proof = typeof item.proof === "string" ? ` ${C.dim}[proof: ${sanitizeTerminal(item.proof)}]${C.reset}` : "";
@@ -550,7 +569,7 @@ Criteria: none recorded`;
   return `${document}
 
 Criteria${mark}
-${lines.join("\n")}`;
+${lines.join("\n")}${checks}`;
 }
 async function runWorkStatus(opts) {
   const cwd = opts.cwd ?? process.cwd();

package/dist/{chunk-BUP5N3X6.js → chunk-6XQPCQBW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-QZBXLLTV.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-JL6VZHAJ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-WL3QF3QF.js → chunk-77YT7YC4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-DIQN5SEL.js';
+import { EXEC_PORT } from './chunk-YSH4KCUJ.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);
@@ -81,21 +81,24 @@ function runExec(socketPath, request, io = {}) {
       killed = true;
       send(FRAME.kill, Buffer.alloc(0));
     }
-    const pumpStdin = async () => {
+    const chunks = (buffer) => Array.from({ length: Math.ceil(buffer.length / CHUNK_BYTES) }, (_unused, i) => buffer.subarray(i * CHUNK_BYTES, (i + 1) * CHUNK_BYTES));
+    const sendRequest = () => {
       const stdin = io.stdin;
-      const chunks = (buffer) => Array.from({ length: Math.ceil(buffer.length / CHUNK_BYTES) }, (_unused, i) => buffer.subarray(i * CHUNK_BYTES, (i + 1) * CHUNK_BYTES));
+      if (stdin !== void 0 && typeof stdin !== "string" && !Buffer.isBuffer(stdin)) {
+        send(FRAME.request, encodeRequest(request));
+        void pumpStdin(stdin);
+        return;
+      }
+      const input = stdin === void 0 ? [] : chunks(Buffer.from(stdin)).map((chunk) => encodeFrame(FRAME.stdin, chunk));
+      socket.write(Buffer.concat([encodeFrame(FRAME.request, encodeRequest(request)), ...input, encodeFrame(FRAME.stdin, Buffer.alloc(0))]));
+    };
+    const pumpStdin = async (stdin) => {
       try {
-        if (stdin === void 0) {
-        } else if (typeof stdin === "string" || Buffer.isBuffer(stdin)) {
-          for (const chunk of chunks(Buffer.from(stdin))) send(FRAME.stdin, chunk);
-        } else {
-          stdinIterator = stdin.iterator({ destroyOnReturn: false });
-          for (; ; ) {
-            const next = await stdinIterator.next();
-            if (next.done === true || settled) break;
-            for (const chunk of chunks(Buffer.from(next.value))) {
-              if (!send(FRAME.stdin, chunk)) await new Promise((done) => socket.once("drain", () => done()));
-            }
+        const iterator = stdin.iterator({ destroyOnReturn: false });
+        stdinIterator = iterator;
+        for await (const value of iterator) {
+          for (const chunk of chunks(Buffer.from(value))) {
+            if (!send(FRAME.stdin, chunk)) await new Promise((done) => socket.once("drain", () => done()));
           }
         }
       } catch {
@@ -143,9 +146,8 @@ function runExec(socketPath, request, io = {}) {
       }
       greeted = true;
       clearTimeout(handshakeTimer);
-      send(FRAME.request, encodeRequest(request));
+      sendRequest();
       if (io.signal?.aborted === true) kill();
-      void pumpStdin();
       const rest = greeting.subarray(newline + 1);
       if (rest.length > 0) onFrames(rest);
     });