@outerlayer/cli 0.28.3 → 0.29.0

package/dist/{chunk-EZ3DZXUH.js → chunk-7H7RUQCZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-DSKOHPXN.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-6NFXOQKZ.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-OKAJSYZ2.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-23PFIW35.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-DWVAG73B.js';
+import { RUNNER_DIR_MODE } from './chunk-PAHZQQB3.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-LRFU6RPD.js → chunk-A2E7MU2H.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-ILU6664L.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-M4QY7YZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { writePendingUpdate } from './chunk-HWOU2HDH.js';
+import { writePendingUpdate } from './chunk-MX3PPJNS.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-QBF462QH.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-SVODOMYC.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-3KMYWLMK.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-WEMNLTWB.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-6NFXOQKZ.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-23PFIW35.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-4SJ57DH7.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-JZJLKTZT.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-O47BTZSN.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-MO2NI6W6.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-SN3C57RV.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-GI73HOI2.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { checkFit } from './chunk-JYVBEWBC.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-YYGXCRIW.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-M6NNXKRM.js';
+import { checkFit } from './chunk-GG3WS4C5.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-NAHTO4XM.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-CU7TJL6S.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-MFI55TNI.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-BFA2LNJG.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-X7SFJZIG.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-R7TMTFJP.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-DWVAG73B.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, claudeCredential, currentClaudeCredential } from './chunk-N5EEEKT6.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6AG2XW5S.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-SHVE5JZO.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-PAHZQQB3.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, claudeCredential, currentClaudeCredential } from './chunk-C7F6U2YZ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-XD4ZCMA4.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
@@ -1140,17 +1140,21 @@ function deriveRepo(item) {
   const repoPart = hash === -1 ? item.trackerKey : item.trackerKey.slice(0, hash);
   return repoPart === "" ? void 0 : `${host}/${repoPart}`;
 }
-async function listStartable(config, queue, fetchImpl) {
+async function listStartable(config, queue, fetchImpl, cursor = null) {
   const query = queue === "amend" ? "needs=amend&startable=true" : "startable=true";
   const page = await getJson(
     config.url,
-    `/v1/work-items?${query}`,
+    `/v1/work-items?${query}${cursor === null ? "" : `&cursor=${encodeURIComponent(cursor)}`}`,
     config.apiKey,
     config.appId,
     fetchImpl,
     await signerFor(config.configPath)
   );
-  return Array.isArray(page.data) ? page.data : [];
+  const next = page.pagination?.cursor;
+  return {
+    items: Array.isArray(page.data) ? page.data : [],
+    cursor: typeof next === "string" && next !== "" && next !== cursor ? next : null
+  };
 }
 function reloadConfig(state) {
   let mtimeMs;
@@ -1735,35 +1739,39 @@ async function runTick(state) {
     let claimed = false;
     for (const queue of QUEUE_ORDER) {
       if (!state.config.queues.includes(queue)) continue;
-      let items;
-      try {
-        items = await listStartable(state.config, queue, state.deps.fetchImpl);
-        reportRepeating(state, "the work item list", void 0);
-        state.lastWorkRequest = { ok: true };
-      } catch (err) {
-        state.lastWorkRequest = workRequestFromFailure(err);
-        reportRepeating(state, "the work item list", `list failed: ${describeCallFailure(err)} \xB7 retrying next tick`);
-        return;
-      }
-      for (const item of items) {
-        if (item.startable === false) continue;
-        if (!repoFilter.allows(deriveRepo(item))) {
-          filtered++;
-          continue;
-        }
-        const attempt = await tryClaimAndStart(state, item, queue);
-        if (attempt.kind === "started") {
-          claimed = true;
-          break;
-        }
-        if (attempt.kind === "outdated" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch" || attempt.kind === "unreadable_repositories") {
+      let cursor = null;
+      do {
+        let page;
+        try {
+          page = await listStartable(state.config, queue, state.deps.fetchImpl, cursor);
+          reportRepeating(state, "the work item list", void 0);
+          state.lastWorkRequest = { ok: true };
+        } catch (err) {
+          state.lastWorkRequest = workRequestFromFailure(err);
+          reportRepeating(state, "the work item list", `list failed: ${describeCallFailure(err)} \xB7 retrying next tick`);
           return;
         }
-        if (attempt.kind === "error") {
-          log.error(`claim for #${item.number} failed: ${attempt.reason} \xB7 retrying next tick`);
-          return;
+        cursor = page.cursor;
+        for (const item of page.items) {
+          if (item.startable === false) continue;
+          if (!repoFilter.allows(deriveRepo(item))) {
+            filtered++;
+            continue;
+          }
+          const attempt = await tryClaimAndStart(state, item, queue);
+          if (attempt.kind === "started") {
+            claimed = true;
+            break;
+          }
+          if (attempt.kind === "outdated" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch" || attempt.kind === "unreadable_repositories") {
+            return;
+          }
+          if (attempt.kind === "error") {
+            log.error(`claim for #${item.number} failed: ${attempt.reason} \xB7 retrying next tick`);
+            return;
+          }
         }
-      }
+      } while (!claimed && cursor !== null);
       if (claimed) break;
     }
     if (!claimed) break;
@@ -1779,7 +1787,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-FOI74X5B.js');
+  const { postJson: postJson2 } = await import('./work-cmd-XLVQDNTC.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2955,7 +2963,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-F2TJCQ7S.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-5XB22HKS.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-MFI55TNI.js → chunk-BFA2LNJG.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { RecipeError, BUILDKIT_IMAGE } from './chunk-SJZL5F3F.js';
-import { compareVersions } from './chunk-UHU7H57K.js';
-import { ensureHostKey } from './chunk-R7TMTFJP.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-DWVAG73B.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-N5EEEKT6.js';
+import { compareVersions } from './chunk-LKN4J37L.js';
+import { ensureHostKey } from './chunk-SHVE5JZO.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PAHZQQB3.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-C7F6U2YZ.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';
@@ -155,8 +155,10 @@ var JUDGE_DIR = "/outerlayer/judge";
 var JUDGE_HOME = `${JUDGE_DIR}/home`;
 var JUDGE_TREE = `${JUDGE_DIR}/tree`;
 var JUDGE_REPORT = `${JUDGE_DIR}/report.html`;
+var JUDGE_ITEMS = `${JUDGE_DIR}/items.json`;
 var JUDGE_PROGRAM = "/opt/outerlayer/claude/bin/claude";
 var MAX_REPORT_BYTES = 5 * 1024 * 1024;
+var MAX_ITEMS_BYTES = 1024 * 1024;
 var JUDGE_MAX_TURNS = 60;
 var JUDGE_PATH = "/opt/outerlayer/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var JUDGE_TOOLS = "Read,Grep,Glob,Write";
@@ -184,7 +186,7 @@ function judgeCommand(input) {
     JUDGE_TOOLS,
     "--allowedTools",
     // A path that starts with two slashes is absolute in a permission rule.
-    `Read(/${JUDGE_DIR}/**),Edit(/${JUDGE_REPORT})`,
+    `Read(/${JUDGE_DIR}/**),Edit(/${JUDGE_REPORT}),Edit(/${JUDGE_ITEMS})`,
     "--add-dir",
     JUDGE_TREE,
     "--permission-mode",
@@ -197,6 +199,20 @@ function judgeCommand(input) {
   ];
   return { argv, env, cwd: JUDGE_DIR };
 }
+function withAnswerProtocol(brief, subjects) {
+  const inputs = subjects === "criteria" ? `\`${JUDGE_DIR}/criteria.json\` lists the criteria to judge, \`${JUDGE_DIR}/citations.json\` the tests that cite each one, \`${JUDGE_DIR}/diff.patch\` the change and \`${JUDGE_TREE}/\` the files of the pushed commit.` : `\`${JUDGE_DIR}/diff.patch\` holds the change and \`${JUDGE_TREE}/\` the files of the pushed commit.`;
+  const items = subjects === "criteria" ? `one entry per criterion in criteria.json, with its id: \`{"items":[{"id":"<criterion id>","result":"pass"|"fail","reason":"<one to three sentences>"}]}\`. A criterion you do not list fails.` : `your overall result and, when you judged separate parts, one entry per part with an id you choose (a file path or a short name): \`{"result":"pass"|"fail","items":[{"id":"<part>","result":"pass"|"fail","reason":"<one to three sentences>"}]}\`. A failing part fails the whole.`;
+  return `${brief.trimEnd()}
+
+## How to answer
+
+This section comes from the factory host and overrides any other answer format above. ${inputs}
+
+Write your answer as JSON to \`${JUDGE_ITEMS}\`: ${items} A reason quotes the decisive assertion or names what is missing.
+
+Then end your reply with one line \`unmet: <id>\` for each failing ${subjects === "criteria" ? "criterion" : "part"}, and a final line that is exactly \`result: pass\` or \`result: fail\`.
+`;
+}
 var HASH_SCRIPT = 'const fs=require("fs"),c=require("crypto");const p=fs.realpathSync(process.argv[1]);process.stdout.write(c.createHash("sha256").update(fs.readFileSync(p)).digest("hex")+" "+p+"\\n")';
 var HASH_ARGV = ["/opt/outerlayer/bin/node", "-e", HASH_SCRIPT, JUDGE_PROGRAM];
 function parseProgramHash(stdout) {
@@ -715,4 +731,4 @@ ${result.stderr}`)) throw outOfMemory(builder, req.logPath);
   };
 }
 
-export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, isOutOfMemory, judgeCommand, parseProgramHash, pathLabelValue, prepareRunArgs, proxyEnvironment, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, writeJobFile };
+export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, isOutOfMemory, judgeCommand, parseProgramHash, pathLabelValue, prepareRunArgs, proxyEnvironment, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };

package/dist/{chunk-N5EEEKT6.js → chunk-C7F6U2YZ.js}

@@ -558,6 +558,7 @@ function primaryOf(repositories) {
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
 var EVAL_INPUT_DIR = `${JOB_MOUNT}/eval-input`;
+var CHECK_ITEMS_FILE = "/tmp/outerlayer-check-items.json";
 var BUILD_HOME = "/build/home";
 var CHECKOUT_DIR = "/build/work/checkout";
 var REPOS_DIR = "/build/work/repos";
@@ -713,7 +714,7 @@ function checkEnvironment(input) {
     imageEnv: input.imageEnv
   });
   const withheld = /* @__PURE__ */ new Set(["OUTERLAYER_URL", "OUTERLAYER_API_KEY", ...CLAUDE_CREDENTIAL_VARIABLES]);
-  const literals = { OUTERLAYER_EVAL_INPUT: EVAL_INPUT_DIR };
+  const literals = { OUTERLAYER_EVAL_INPUT: EVAL_INPUT_DIR, OUTERLAYER_CHECK_ITEMS: CHECK_ITEMS_FILE };
   for (const [name, value] of Object.entries(env.literals)) if (!withheld.has(name)) literals[name] = value;
   const passed = {};
   for (const [name, value] of Object.entries(env.passed)) if (!withheld.has(name)) passed[name] = value;
@@ -752,4 +753,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };

package/dist/{chunk-M6NNXKRM.js → chunk-CU7TJL6S.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PAHZQQB3.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-T7LJ6AIC.js → chunk-D3D2CERC.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-EPGMCEVP.js';
-import { MIN_ENGINE_MAJOR } from './chunk-4SJ57DH7.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-AV5MJY45.js';
-import { runnerCredentialProblem } from './chunk-YYGXCRIW.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-2YLKMVFV.js';
+import { MIN_ENGINE_MAJOR } from './chunk-MO2NI6W6.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-IGEJUPDE.js';
+import { runnerCredentialProblem } from './chunk-NAHTO4XM.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PAHZQQB3.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-RKOTJQVG.js → chunk-DXI6A6JN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-QZBXLLTV.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-JL6VZHAJ.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);
@@ -7954,6 +7954,7 @@ function normalizeRepoName(repo) {
   return repo.trim().toLowerCase();
 }
 var CONTEXT_PIN_FILENAME = ".outerlayer-pin.json";
+var JUDGE_SUBJECTS = ["criteria", "none"];
 var MAX_BRIEF_LENGTH = 300;
 var MAX_COMMAND_LENGTH = 2e3;
 var EXTENDS_PROBLEM = '"extends" is not a policy key \u2014 every check is a file in .outerlayer/validators/. Run outerlayer init --template default to write .outerlayer/validators/code-review.yaml, then delete the extends line';
@@ -8208,6 +8209,7 @@ var CUSTOM_KEYS = /* @__PURE__ */ new Set([
   "needs"
 ]);
 function parseCustomFile(file, problems) {
+  var _a;
   const fail = (problem) => {
     problems.push({ file: file.path, problem });
     return null;
@@ -8350,8 +8352,12 @@ function parseCustomFile(file, problems) {
         return fail(`"${id}" run declares both "judge" and "command" \u2014 a host check has one or the other`);
       }
       const rawJudge = run["judge"];
-      if (!isRecord(rawJudge) || Object.keys(rawJudge).some((key) => key !== "brief")) {
-        return fail(`"${id}" run.judge must be a mapping with a "brief"`);
+      if (!isRecord(rawJudge) || Object.keys(rawJudge).some((key) => key !== "brief" && key !== "subjects")) {
+        return fail(`"${id}" run.judge must be a mapping with a "brief" and, optionally, "subjects"`);
+      }
+      const rawSubjects = (_a = rawJudge["subjects"]) != null ? _a : "criteria";
+      if (typeof rawSubjects !== "string" || !JUDGE_SUBJECTS.includes(rawSubjects)) {
+        return fail(`"${id}" run.judge.subjects must be one of ${JUDGE_SUBJECTS.map((value) => `"${value}"`).join(", ")}`);
       }
       const brief = rawJudge["brief"];
       if (typeof brief !== "string" || brief.trim() === "" || brief.length > MAX_BRIEF_LENGTH || brief.startsWith("/") || brief.split("/").includes("..")) {
@@ -8359,7 +8365,7 @@ function parseCustomFile(file, problems) {
           `"${id}" run.judge.brief must be a relative path inside the repository, of at most ${MAX_BRIEF_LENGTH} characters, with no ".." segment`
         );
       }
-      judge = { brief: brief.trim() };
+      judge = { brief: brief.trim(), subjects: rawSubjects };
       runWhere = "host";
     } else if (where === "host") {
       const rawCommand = run["command"];

package/dist/{chunk-KJIUFOC4.js → chunk-F72ABZRD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-R7TMTFJP.js';
+import { signRunnerRequest, signerFor } from './chunk-SHVE5JZO.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-UXLLWIA2.js → chunk-FA6XWYRH.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-QKXF7CLR.js';
+import { runEmit } from './chunk-GJOF6357.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { installStarterPack } from './chunk-SATUCMAJ.js';
-import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-5B7BEQPR.js';
+import { installStarterPack } from './chunk-25Z6SBMQ.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-427AVP6J.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-TG7FAHRP.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-JGML2VUN.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-H6DGJBXG.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-NX2G6PH6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-VWFOKRYS.js';
+import { linkedAgentsPath } from './chunk-42TFWHFF.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { generatedHeaderSource } from './chunk-RKOTJQVG.js';
+import { generatedHeaderSource } from './chunk-DXI6A6JN.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-P2RWZCV7.js → chunk-FUGRIAG7.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-JGML2VUN.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-NX2G6PH6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-RKOTJQVG.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-DXI6A6JN.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-JYVBEWBC.js → chunk-GG3WS4C5.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-YYGXCRIW.js';
+import { builtinKind } from './chunk-NAHTO4XM.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { runnerDir } from './chunk-DWVAG73B.js';
-import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-N5EEEKT6.js';
+import { runnerDir } from './chunk-PAHZQQB3.js';
+import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-C7F6U2YZ.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-O47BTZSN.js → chunk-GI73HOI2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PAHZQQB3.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-2BZTGJII.js → chunk-GJJDPZS2.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-VM6BX2WJ.js';
+import { uploadSpooledSteps } from './chunk-UPKFSNSU.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-UHU7H57K.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-6XQPCQBW.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-LKN4J37L.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-KJIUFOC4.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F72ABZRD.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-R7TMTFJP.js';
-import { writeSyncStatus, spoolDir } from './chunk-OOUHNKKX.js';
+import { signerFor, signRunnerRequest } from './chunk-SHVE5JZO.js';
+import { writeSyncStatus, spoolDir } from './chunk-IG45QISA.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
@@ -17,7 +17,7 @@ import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-JL6VZHAJ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { dirname, basename, join, sep } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';

package/dist/{chunk-QKXF7CLR.js → chunk-GJOF6357.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-5B7BEQPR.js';
+import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-427AVP6J.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-P2RWZCV7.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-JGML2VUN.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-FUGRIAG7.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-NX2G6PH6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-RKOTJQVG.js';
+import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-DXI6A6JN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-TG7FAHRP.js → chunk-H6DGJBXG.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-P2RWZCV7.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-KJIUFOC4.js';
-import { withTokenHeader } from './chunk-N5EEEKT6.js';
+import { removeRetiredSkills } from './chunk-FUGRIAG7.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-F72ABZRD.js';
+import { withTokenHeader } from './chunk-C7F6U2YZ.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-JGML2VUN.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-NX2G6PH6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
-import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-RKOTJQVG.js';
+import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-DXI6A6JN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';

package/dist/{chunk-QFNFBQCG.js → chunk-HRWL7NSJ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { remoteLookupFailed } from './chunk-UHU7H57K.js';
-import { isAgentsMdLayout } from './chunk-5B7BEQPR.js';
-import { DEFAULT_DASHBOARD } from './chunk-HOU33DW5.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-KJIUFOC4.js';
+import { sanitizeTerminal } from './chunk-6XQPCQBW.js';
+import { remoteLookupFailed } from './chunk-LKN4J37L.js';
+import { isAgentsMdLayout } from './chunk-427AVP6J.js';
+import { DEFAULT_DASHBOARD } from './chunk-VY4YVFL5.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-F72ABZRD.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/chunk-I3LTIAOR.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/zod-problem.ts
+function zodProblem(issues) {
+  return issues.slice(0, 1).map((issue) => `${issue.path.map(String).join(".")}: ${issue.message}`).join("");
+}
+
+export { zodProblem };

package/dist/{chunk-OOUHNKKX.js → chunk-IG45QISA.js}

@@ -680,11 +680,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-LTH77FC3.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-MV3X6NSF.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-TIK265OT.js');
+  const { governanceOf } = await import('./control-plane-launch-5FZ6LJOC.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-AV5MJY45.js → chunk-IGEJUPDE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-JYVBEWBC.js';
-import { RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
-import { claudeEnvPath, withoutCredentialLines } from './chunk-N5EEEKT6.js';
+import { DEFAULT_UNIT_NAME } from './chunk-GG3WS4C5.js';
+import { RUNNER_FILE_MODE } from './chunk-PAHZQQB3.js';
+import { claudeEnvPath, withoutCredentialLines } from './chunk-C7F6U2YZ.js';
 import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-QZBXLLTV.js → chunk-JL6VZHAJ.js}

@@ -22278,6 +22278,43 @@ var ArtifactTombstoneRecordSchema = external_exports.looseObject({
   t: external_exports.string()
 });
 external_exports.union([ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema]);
+var CHECK_ITEM_RESULTS = ["pass", "fail", "skipped"];
+var CHECK_ITEMS_MAX = 500;
+var CHECK_ITEM_ID_MAX_LENGTH = 200;
+var CHECK_ITEM_REASON_MAX_LENGTH = 1e3;
+var CHECK_ITEM_REFS_MAX = 20;
+var CHECK_ITEM_REF_PATH_MAX_LENGTH = 500;
+var ONE_LINE = /^[^\u0000-\u001f\u007f]+$/;
+var CheckItemRefSchema = external_exports.object({
+  path: external_exports.string().min(1).max(CHECK_ITEM_REF_PATH_MAX_LENGTH).regex(ONE_LINE, "must be one line").refine((path) => !path.startsWith("/") && !path.split(/[\\/]/).includes(".."), {
+    message: "must be a relative path with no '..' segment"
+  }),
+  line: external_exports.number().int().positive().optional(),
+  /** Only an https link: it becomes an href on a page. */
+  href: external_exports.string().max(1e3).refine((href) => href.startsWith("https://") && !/\s/.test(href), { message: "must be an https:// URL with no whitespace" }).optional()
+});
+var CheckItemSchema = external_exports.object({
+  /** What the item is about, unique within the check. */
+  id: external_exports.string().min(1).max(CHECK_ITEM_ID_MAX_LENGTH).regex(ONE_LINE, "must be one line"),
+  /** The acceptance criterion the item is about, when it is about one. */
+  criterion: ArtifactCriterionIdSchema.optional(),
+  result: external_exports.enum(CHECK_ITEM_RESULTS),
+  /** Why, in a sentence or three. */
+  reason: external_exports.string().max(CHECK_ITEM_REASON_MAX_LENGTH).optional(),
+  refs: external_exports.array(CheckItemRefSchema).max(CHECK_ITEM_REFS_MAX).optional(),
+  /** The sha256 of what the check item was judged on. A judge that sees the same inputs again keeps its result. */
+  inputs: external_exports.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase sha256 hex digest").optional()
+});
+var CheckItemsSchema = external_exports.array(CheckItemSchema).max(CHECK_ITEMS_MAX).superRefine((items, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, item] of items.entries()) {
+    if (seen.has(item.id)) ctx.addIssue({ code: "custom", path: [index, "id"], message: `repeats the id ${JSON.stringify(item.id)}` });
+    seen.add(item.id);
+  }
+});
+function itemsAllowResult(result, items) {
+  return result === "fail" || !(items != null ? items : []).some((item) => item.result === "fail");
+}
 var EMITTED_RESULTS = ["pass", "fail"];
 var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings", "step"];
 var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).superRefine((name, ctx) => {
@@ -22579,4 +22616,4 @@ xmlchars/xmlns/1.0/ed3.js:
    *)
 */
 
-export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CLI_LOGIN_KIND, CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CliLoginRefusalSchema, CliLoginStartedSchema, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };
+export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CHECK_ITEM_REASON_MAX_LENGTH, CLI_LOGIN_KIND, CLI_LOGIN_MACHINE_NAME_MAX, CheckItemsSchema, CliLoginPollResponseSchema, CliLoginRefusalSchema, CliLoginStartedSchema, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, itemsAllowResult, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };

package/dist/{chunk-RXFKXZJS.js → chunk-KBIJZAH4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-N5EEEKT6.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-C7F6U2YZ.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);