@outerlayer/cli 0.30.2-next.20261020101955 → 0.31.0-next.20261020121516

package/dist/{chunk-TR5T5Z2L.js → chunk-BPPWINVG.js}

@@ -1,86 +1,38 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-B7NT4YZ3.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-HB6SACVH.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { RUNNER_PROTOCOL } from './chunk-PP3CGEQZ.js';
-import { writePendingUpdate } from './chunk-QWJBTFAF.js';
+import { RUNNER_PROTOCOL } from './chunk-6C5MZ7UG.js';
+import { writePendingUpdate } from './chunk-TZQIEUDE.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-44CGGHJF.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-ERXY3FXG.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-X7UUIHGH.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-53SPRUEA.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-LJIFCG4G.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-ZZSQYOY5.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-5VWKCY2E.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-4SE6GXQA.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-D3LS7E7U.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-VJ4PORHS.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-YIOUHJQM.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-YV7WULXQ.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { checkFit } from './chunk-3F7RC3UA.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-2ZMJFGOZ.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-IRTZYDZO.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-P7BEZAEU.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-T5TBGOT6.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-7YSR636F.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-CBEM7ZWX.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-4OKXGZM3.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-IRF2FKB5.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-SOWXLIDN.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, claudeCredential, currentClaudeCredential } from './chunk-WHCDULC4.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-MIVAWAMF.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-APSYTJ6I.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-KP6R7CV3.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-HDSDUTX4.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-XD4ZCMA4.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
-import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, openSync, constants, lstatSync } from 'fs';
+import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
 import { join, dirname } from 'path';
-import { totalmem, constants as constants$1 } from 'os';
+import { constants } from 'os';
 
 createRequire(import.meta.url);
-function openKvm() {
-  try {
-    closeSync(openSync("/dev/kvm", constants.O_RDWR));
-    return "usable";
-  } catch (err) {
-    return err.code === "ENOENT" ? "absent" : "no-permission";
-  }
-}
-function realBlockedProbes() {
-  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown" };
-}
-var DEFAULT_BUILD_MEMORY = "8g";
-function checkBlocked(config, probes) {
-  const placeholders = placeholderQueues(config);
-  if (placeholders.length > 0) return { reason: `${placeholderProblem(placeholders)}. The runner takes work again once the config is edited` };
-  const kind = builtinKind(config.hooks.provision);
-  if (kind === "container" || kind === "vm") {
-    const fit = checkFit({
-      concurrency: config.concurrency,
-      buildMemory: config.build?.memory ?? DEFAULT_BUILD_MEMORY,
-      usableBytes: probes.totalMemoryBytes()
-    });
-    if (!fit.fits) return { reason: `${fit.message}. Lower runner.concurrency or runner.build.memory` };
-  }
-  const kvm = kind === "vm" ? probes.kvm() : "usable";
-  if (kvm === "absent") {
-    return { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" };
-  }
-  if (kvm !== "usable") {
-    return {
-      reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
-    };
-  }
-  if (kind === "container" || kind === "vm") {
-    const builder = probes.imageBuilder;
-    if (builder === "unknown") {
-      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
-    }
-    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
-  }
-  if (kind !== "own" && claudeCredential(probes.env) === void 0) {
-    return {
-      reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
-    };
-  }
-  return void 0;
-}
 
 // src/runner/heartbeat.ts
 var HEARTBEAT_TIMEOUT_MS = 1e4;
@@ -1053,7 +1005,7 @@ function linuxSignalName(number) {
   return names[number];
 }
 function hostSignalName(number) {
-  return Object.entries(constants$1.signals).find(([, value]) => value === number)?.[0];
+  return Object.entries(constants.signals).find(([, value]) => value === number)?.[0];
 }
 function notEndedByRunnerReason(exit, isolated) {
   if (exit.signal !== null) {
@@ -1641,11 +1593,16 @@ function imageBuilderState(state) {
   if (result === void 0) return "unknown";
   return result.ok ? "usable" : { problem: result.problem };
 }
-function holdWhenBlocked(state) {
+async function jailerState(state) {
+  const probe = await runtimeOf(state).vm.helper.probe();
+  return probe.ok ? "usable" : { problem: probe.detail };
+}
+function holdWhenBlocked(state, jailer) {
   const probes = {
     ...realBlockedProbes(),
     ...state.deps.container?.hostEnv === void 0 ? {} : { env: state.deps.container.hostEnv },
     ...state.deps.blocked?.imageBuilder === void 0 ? { imageBuilder: imageBuilderState(state) } : {},
+    ...jailer === void 0 ? {} : { jailer },
     ...state.deps.blocked
   };
   const blocked = checkBlocked(state.config, probes);
@@ -1728,7 +1685,8 @@ async function runTick(state) {
     state.holdingForUpdate = true;
     return;
   }
-  if (holdWhenBlocked(state)) return;
+  const jailer = state.config.managed === true && state.deps.blocked?.jailer === void 0 ? await jailerState(state) : void 0;
+  if (holdWhenBlocked(state, jailer)) return;
   if (holdOffForDisk(state)) return;
   const log = logOf(state);
   const repoFilter = new RepoFilter(state.config.repos);
@@ -1787,7 +1745,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-LXDWHKMQ.js');
+  const { postJson: postJson2 } = await import('./work-cmd-PHNJNLWA.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2968,7 +2926,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-Y6D7C66D.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-EP4F6VOP.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-7YSR636F.js → chunk-CBEM7ZWX.js}

@@ -3,9 +3,9 @@ import { createRequire } from 'node:module';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { RecipeError, BUILDKIT_IMAGE } from './chunk-SJZL5F3F.js';
 import { compareVersions } from './chunk-FTGJ3DPV.js';
-import { ensureHostKey } from './chunk-IRF2FKB5.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-SOWXLIDN.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-WHCDULC4.js';
+import { ensureHostKey } from './chunk-APSYTJ6I.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-KP6R7CV3.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-HDSDUTX4.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';

package/dist/{chunk-AM3GMWQK.js → chunk-F3EF56LQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-IRF2FKB5.js';
+import { signRunnerRequest, signerFor } from './chunk-APSYTJ6I.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-3YLHIXLR.js → chunk-GIRXO5HA.js}

@@ -4,7 +4,7 @@ import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
 import { remoteLookupFailed } from './chunk-FTGJ3DPV.js';
 import { isAgentsMdLayout } from './chunk-QDDPVBIS.js';
 import { DEFAULT_DASHBOARD } from './chunk-G2RRBBOX.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-B7NT4YZ3.js → chunk-HB6SACVH.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-6CNNRO53.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-RJYKTWUP.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-ZNMVBHGJ.js';
-import { installScrubContext } from './chunk-DBELICD6.js';
-import { writeDockerClientConfig } from './chunk-TN2XMMD7.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-5VWKCY2E.js';
-import { waitForAgent, vmExecArgs } from './chunk-MBVSVQVH.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-TKJISBV6.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-4SE6GXQA.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-2ZMJFGOZ.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-U5DC57AF.js';
+import { senderPidfile } from './chunk-V52SJHWK.js';
+import { installScrubContext } from './chunk-A4UGPQXT.js';
+import { writeDockerClientConfig } from './chunk-XTNMIV77.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-VJ4PORHS.js';
+import { waitForAgent, vmExecArgs } from './chunk-QQGZ5THT.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-HIGJTX5U.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-YIOUHJQM.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-P7BEZAEU.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-Z7HAIZ6X.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-7YSR636F.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-CBEM7ZWX.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-SJZL5F3F.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-4OKXGZM3.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-MIVAWAMF.js';
 import { planArtifactUpload } from './chunk-HSUUTD4E.js';
 import { scrubText } from './chunk-FTGJ3DPV.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-IRF2FKB5.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-SOWXLIDN.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-WHCDULC4.js';
+import { signerFor } from './chunk-APSYTJ6I.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-KP6R7CV3.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-HDSDUTX4.js';
 import { resolvePackRoot } from './chunk-AKKVPUGK.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -292,12 +292,14 @@ function makeBuildsDirPrivate(buildDir2) {
   const stat = statSync(builds);
   if (stat.uid === process.getuid?.() && (stat.mode & 18) !== 0) chmodSync(builds, 448);
 }
-async function helperFor(runtime, log) {
+var MANAGED_UNJAILED_REASON = "the root helper does not answer, and a managed runner starts no build without the jailer. The build did not start; restore the helper with `outerlayer runner install --service --replace`";
+async function helperFor(runtime, log, managed) {
   const probe = await runtime.vm.helper.probe();
   if (probe.ok) {
     if (probe.firecracker !== FIRECRACKER_VERSION) log(`${helperFirecrackerNote(probe.firecracker)}; run \`outerlayer runner install --service --replace\` to update it`);
     return probe.client;
   }
+  if (managed) return void 0;
   if (probe.reason === "unsupported") log(probe.detail);
   else if (probe.unreachable === true) log(`${probe.detail}, so this build runs without the jailer`);
   return void 0;
@@ -477,7 +479,8 @@ async function provisionMicroVm(input) {
     }
   }
   const configPath = join(buildDir2, "vm.json");
-  const helper = await helperFor(runtime, (line) => log.line(`${tag} ${line}`));
+  const helper = await helperFor(runtime, (line) => log.line(`${tag} ${line}`), config.managed === true);
+  if (helper === void 0 && config.managed === true) return bail(MANAGED_UNJAILED_REASON);
   try {
     if (helper === void 0) linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links: served });
     await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
@@ -955,7 +958,8 @@ async function startCheckMicroVm(input) {
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: false });
   const configPath = join(buildDir2, "vm.json");
-  const helper = await helperFor(runtime, (line) => log.line(`${tag} ${line}`));
+  const helper = await helperFor(runtime, (line) => log.line(`${tag} ${line}`), config.managed === true);
+  if (helper === void 0 && config.managed === true) return fail(MANAGED_UNJAILED_REASON);
   try {
     if (helper === void 0) linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
     await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });

package/dist/{chunk-WHCDULC4.js → chunk-HDSDUTX4.js}

@@ -40,6 +40,22 @@ function readClaudeCredential(env) {
     return void 0;
   }
 }
+function claudeCredentialVariablesSet(env, options = {}) {
+  const found = /* @__PURE__ */ new Set();
+  const add = (values) => {
+    for (const variable of FORWARDED) if ((values[variable] ?? "") !== "") found.add(variable);
+  };
+  add(env);
+  const directory = env.CREDENTIALS_DIRECTORY;
+  if (directory) {
+    try {
+      add(parseRunnerEnv(readFileSync(join(directory, CLAUDE_CREDENTIAL_ID), "utf8")));
+    } catch {
+    }
+  }
+  if (options.ignoreHeld !== true && held !== void 0) found.add(held.variable);
+  return found;
+}
 var complained = /* @__PURE__ */ new Set();
 function complain(path, reason) {
   if (complained.has(path)) return;
@@ -756,4 +772,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };

package/dist/{chunk-TKJISBV6.js → chunk-HIGJTX5U.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-WHCDULC4.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-HDSDUTX4.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-SOWXLIDN.js → chunk-KP6R7CV3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-WHCDULC4.js';
+import { BUILD_HOME } from './chunk-HDSDUTX4.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-TGUWHA27.js → chunk-MCOG33O7.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-SJ4DX2AD.js';
+import { autoConnect, detectActiveSession } from './chunk-OSVS2QVP.js';
 import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-4OKXGZM3.js → chunk-MIVAWAMF.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-SJ4DX2AD.js';
-import { workPageUrl } from './chunk-3YLHIXLR.js';
+import { detectActiveSession, autoConnect } from './chunk-OSVS2QVP.js';
+import { workPageUrl } from './chunk-GIRXO5HA.js';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
 import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-AM3GMWQK.js';
-import { signRunnerRequest } from './chunk-IRF2FKB5.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-F3EF56LQ.js';
+import { signRunnerRequest } from './chunk-APSYTJ6I.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -441,7 +441,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-A2N3PSXI.js');
+      const { logHookError } = await import('./hook-fast-UFHR6EKZ.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-DLY22KHX.js → chunk-NIS2PIS4.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-V6IYYQU3.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
-import { withTokenHeader } from './chunk-WHCDULC4.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
+import { withTokenHeader } from './chunk-HDSDUTX4.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-AKKVPUGK.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-5HZDPOJI.js → chunk-NJS7JJYN.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-3F7RC3UA.js';
-import { RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
-import { claudeEnvPath, withoutCredentialLines } from './chunk-WHCDULC4.js';
+import { DEFAULT_UNIT_NAME } from './chunk-RQGHHEM7.js';
+import { RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { claudeEnvPath, withoutCredentialLines } from './chunk-HDSDUTX4.js';
 import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-SJ4DX2AD.js → chunk-OSVS2QVP.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-3YLHIXLR.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-GIRXO5HA.js';
 import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
-import { resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
+import { resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-3XUZPSBV.js → chunk-P2EVMNU6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-5VWKCY2E.js';
-import { runnerImageVersion } from './chunk-D3LS7E7U.js';
+import { MIN_ENGINE_MAJOR } from './chunk-VJ4PORHS.js';
+import { runnerImageVersion } from './chunk-YV7WULXQ.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-SJZL5F3F.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-2ZMJFGOZ.js → chunk-P7BEZAEU.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-WHCDULC4.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-HDSDUTX4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
@@ -105,6 +105,7 @@ var RUNNER_KEYS = [
   "housekeeping",
   "checks",
   "autoUpdate",
+  "managed",
   "update"
 ];
 var UPDATE_KEYS = ["maxWaitHours"];
@@ -213,6 +214,9 @@ function loadRunnerConfig(configPath) {
   if (runner.autoUpdate !== void 0 && typeof runner.autoUpdate !== "boolean") {
     fail(configPath, "runner.autoUpdate", "must be true or false");
   }
+  if (runner.managed !== void 0 && typeof runner.managed !== "boolean") {
+    fail(configPath, "runner.managed", "must be true or false");
+  }
   if (runner.name !== void 0 && runner.host !== void 0 && runner.name !== runner.host) {
     fail(configPath, "runner.name", `is "${runner.name}" and runner.host is "${runner.host}"; set runner.name only, since runner.host is its earlier name`);
   }
@@ -266,7 +270,8 @@ function loadRunnerConfig(configPath) {
     // under; it opts in. The built-in hooks are the runner's own. Provision
     // and cleanup are built-in together or not at all (checkBuiltinHooks), so
     // provision alone tells which.
-    autoUpdate: runner.autoUpdate ?? builtinKind(runner.hooks.provision) !== "own"
+    autoUpdate: runner.autoUpdate ?? builtinKind(runner.hooks.provision) !== "own",
+    ...runner.managed === void 0 ? {} : { managed: runner.managed }
   };
 }
 function checkBuiltinHooks(configPath, hooks) {

package/dist/{chunk-MBVSVQVH.js → chunk-QQGZ5THT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-TKJISBV6.js';
+import { EXEC_PORT } from './chunk-HIGJTX5U.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-6CNNRO53.js → chunk-RJYKTWUP.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-TN2XMMD7.js';
-import { EXEC_PORT } from './chunk-TKJISBV6.js';
+import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-XTNMIV77.js';
+import { EXEC_PORT } from './chunk-HIGJTX5U.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-WHCDULC4.js';
+import { RELAY_PORT } from './chunk-HDSDUTX4.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-3F7RC3UA.js → chunk-RQGHHEM7.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-2ZMJFGOZ.js';
+import { builtinKind } from './chunk-P7BEZAEU.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { runnerDir } from './chunk-SOWXLIDN.js';
-import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-WHCDULC4.js';
+import { runnerDir } from './chunk-KP6R7CV3.js';
+import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-HDSDUTX4.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-IRTZYDZO.js → chunk-T5TBGOT6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-HMAYAMOQ.js → chunk-TYRORELN.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-BCWVTWS7.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-MBZTX4V2.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-4OKXGZM3.js';
-import { isLinkedRepository } from './chunk-3YLHIXLR.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-4XPAQXJF.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-MIVAWAMF.js';
+import { isLinkedRepository } from './chunk-GIRXO5HA.js';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { checkFormerSkillNames } from './chunk-V6IYYQU3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-AM3GMWQK.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-RJDJFRRY.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-F3EF56LQ.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-WRW6QCI6.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1190,7 +1190,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-VM6GKCCE.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-3JRFDYZL.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1211,7 +1211,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-5K4UTAT3.js');
+    const { runnerHostChecks } = await import('./doctor-XSYJJHMJ.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1229,8 +1229,8 @@ async function gatherDoctorChecks() {
     })();
     const runner = (() => {
       try {
-        const { concurrency, build, housekeeping } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g", minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts };
+        const { concurrency, build, housekeeping, managed } = loadRunnerConfig(configPath);
+        return { concurrency, buildMemory: build?.memory ?? "8g", minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...managed === true ? { managed } : {} };
       } catch {
         return void 0;
       }
@@ -1239,7 +1239,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-L7JIBK3Y.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-GZ27NW6U.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-OIRIEOS7.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-QWJBTFAF.js → chunk-TZQIEUDE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-ZNMVBHGJ.js → chunk-V52SJHWK.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-DBELICD6.js';
+import { LiveUploader } from './chunk-A4UGPQXT.js';
 import { CaptureDaemon } from './chunk-FTGJ3DPV.js';
-import { spoolDir } from './chunk-RJDJFRRY.js';
+import { spoolDir } from './chunk-WRW6QCI6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';