@outerlayer/cli 0.30.2-next.20261020115557 → 0.31.0-next.20261020121516

package/dist/{agent-setup-ZNYAXAWI.js → agent-setup-E7CMDUR5.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-I3WLYIIW.js';
+export { keepHandWritten, runAgentSetup } from './chunk-XAV6XCI2.js';
 import './chunk-XB7TRWI2.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-XTKH5VAC.js';
 import './chunk-QDDPVBIS.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-DLY22KHX.js';
+import './chunk-NIS2PIS4.js';
 import './chunk-V6IYYQU3.js';
-import './chunk-AM3GMWQK.js';
+import './chunk-F3EF56LQ.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-IRF2FKB5.js';
-import './chunk-SOWXLIDN.js';
-import './chunk-WHCDULC4.js';
+import './chunk-APSYTJ6I.js';
+import './chunk-KP6R7CV3.js';
+import './chunk-HDSDUTX4.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-AKKVPUGK.js';

package/dist/{bridge-FI7OF2H3.js → bridge-3EG6Q34K.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-TN2XMMD7.js';
-import './chunk-WHCDULC4.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-XTNMIV77.js';
+import './chunk-HDSDUTX4.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-PXRDWSN4.js → build-7QD3VJ6U.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-U5DC57AF.js';
-import './chunk-IRTZYDZO.js';
+export { buildRepositoryImage } from './chunk-Z7HAIZ6X.js';
+import './chunk-T5TBGOT6.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-SJZL5F3F.js';
-import './chunk-SOWXLIDN.js';
-import './chunk-WHCDULC4.js';
+import './chunk-KP6R7CV3.js';
+import './chunk-HDSDUTX4.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-20T11:57:23.004Z+c47cb0f","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-20T12:16:40.068Z+9978d2e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-UNVHUZL7.js → builder-JG34X757.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-7YSR636F.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-CBEM7ZWX.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
 import './chunk-FTGJ3DPV.js';
-import './chunk-IRF2FKB5.js';
-import './chunk-SOWXLIDN.js';
-import './chunk-WHCDULC4.js';
+import './chunk-APSYTJ6I.js';
+import './chunk-KP6R7CV3.js';
+import './chunk-HDSDUTX4.js';
 import './chunk-IWFYKNAO.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';

package/dist/{check-N3XNBPDH.js → check-EP4F6VOP.js}

@@ -1,60 +1,60 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-EEZO2T24.js';
-import './chunk-B7NT4YZ3.js';
+import { probeCredentials } from './chunk-BPPWINVG.js';
+import './chunk-HB6SACVH.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-6C5MZ7UG.js';
-import './chunk-QWJBTFAF.js';
+import './chunk-TZQIEUDE.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-44CGGHJF.js';
-import './chunk-6CNNRO53.js';
+import './chunk-X7UUIHGH.js';
+import './chunk-RJYKTWUP.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-ZNMVBHGJ.js';
-import './chunk-DBELICD6.js';
-import './chunk-PS3AHE6C.js';
+import './chunk-V52SJHWK.js';
+import './chunk-A4UGPQXT.js';
+import './chunk-A2737R27.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-TN2XMMD7.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ERXY3FXG.js';
+import './chunk-XTNMIV77.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-53SPRUEA.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LJIFCG4G.js';
+import './chunk-ZZSQYOY5.js';
 import './chunk-TBT347UY.js';
-import './chunk-IUV6MUQB.js';
-import './chunk-3XUZPSBV.js';
-import './chunk-5VWKCY2E.js';
-import './chunk-MBVSVQVH.js';
-import './chunk-TKJISBV6.js';
-import './chunk-4SE6GXQA.js';
-import './chunk-D3LS7E7U.js';
+import './chunk-Y5OU66XJ.js';
+import './chunk-P2EVMNU6.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-VJ4PORHS.js';
+import './chunk-QQGZ5THT.js';
+import './chunk-HIGJTX5U.js';
+import './chunk-YIOUHJQM.js';
+import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
-import './chunk-5HZDPOJI.js';
-import './chunk-3F7RC3UA.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-2ZMJFGOZ.js';
+import './chunk-NJS7JJYN.js';
+import { DEFAULT_UNIT_NAME } from './chunk-RQGHHEM7.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-P7BEZAEU.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-U5DC57AF.js';
-import './chunk-IRTZYDZO.js';
+import './chunk-Z7HAIZ6X.js';
+import './chunk-T5TBGOT6.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-7YSR636F.js';
+import './chunk-CBEM7ZWX.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-4OKXGZM3.js';
-import './chunk-SJ4DX2AD.js';
-import './chunk-3YLHIXLR.js';
+import './chunk-MIVAWAMF.js';
+import './chunk-OSVS2QVP.js';
+import './chunk-GIRXO5HA.js';
 import './chunk-HSUUTD4E.js';
 import './chunk-FTGJ3DPV.js';
 import './chunk-QDDPVBIS.js';
 import './chunk-G2RRBBOX.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-DLY22KHX.js';
+import './chunk-NIS2PIS4.js';
 import './chunk-V6IYYQU3.js';
-import './chunk-AM3GMWQK.js';
+import './chunk-F3EF56LQ.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-IRF2FKB5.js';
-import './chunk-SOWXLIDN.js';
-import { claudeEnvPath } from './chunk-WHCDULC4.js';
-import './chunk-RJDJFRRY.js';
+import './chunk-APSYTJ6I.js';
+import './chunk-KP6R7CV3.js';
+import { claudeEnvPath } from './chunk-HDSDUTX4.js';
+import './chunk-WRW6QCI6.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -106,6 +106,19 @@ async function runRunnerCheck(configPath, deps = {}) {
   if (modeProblems.length > 0) {
     return { ok: false, check: "permission mode", message: `${configPath}: ${permissionModeProblem(modeProblems)}` };
   }
+  if (config.managed === true) {
+    const files = [join(dirname(configPath), "runner.env"), claudeEnvPath(configPath)];
+    const env = {};
+    for (const path of files) {
+      const fromFile = readRunnerEnv(path);
+      if ("error" in fromFile) return { ok: false, check: "managed", message: `${configPath}: ${path} could not be read to look for a Claude credential: ${fromFile.error}` };
+      Object.assign(env, fromFile.env);
+    }
+    Object.assign(env, deps.env ?? process.env);
+    const asked = await (deps.helper ?? (() => probeHelper(env[HELPER_ENV] ?? helperSocketPath(DEFAULT_UNIT_NAME))))();
+    const unmet = managedProblems(managedFactsOf(config, { env, jailer: asked.ok ? "usable" : { problem: asked.detail } }))[0];
+    if (unmet !== void 0) return { ok: false, check: "managed", message: `${configPath}: ${unmet.reason}` };
+  }
   let credentialLine;
   if (needsClaudeCredential(config.hooks)) {
     const env = deps.env ?? process.env;

package/dist/{chunk-B5CQJBZ2.js → chunk-2DH7VRLQ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-SJ4DX2AD.js';
+import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-OSVS2QVP.js';
 import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-AM3GMWQK.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F3EF56LQ.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-MBZTX4V2.js → chunk-4XPAQXJF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
 import { isAgentsMdLayout } from './chunk-QDDPVBIS.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-AM3GMWQK.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-F3EF56LQ.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-UAFMC3PL.js';

package/dist/chunk-53SPRUEA.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { isPlaceholderCommand } from './chunk-Y5OU66XJ.js';
+import { describeCallFailure } from './chunk-YIOUHJQM.js';
+import { checkFit } from './chunk-RQGHHEM7.js';
+import { builtinKind } from './chunk-P7BEZAEU.js';
+import { WorkCommandError, getJson } from './chunk-MIVAWAMF.js';
+import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
+import { signerFor } from './chunk-APSYTJ6I.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-HDSDUTX4.js';
+import { closeSync, openSync, constants } from 'fs';
+import { totalmem } from 'os';
+
+createRequire(import.meta.url);
+
+// src/runner/host-setup.ts
+function placeholderQueues(config) {
+  return config.queues.filter((queue) => {
+    const command = config.commands[queue];
+    return command !== void 0 && isPlaceholderCommand(command);
+  });
+}
+function placeholderProblem(queues) {
+  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
+  return `${keys} ${queues.length === 1 ? "is" : "are"} still the placeholder \`runner init\` wrote, which fails every item. Edit ${queues.length === 1 ? "it" : "them"} to start your agent on item $OUTERLAYER_WORK`;
+}
+var CLAUDE_PERMISSION_MODES = ["acceptEdits", "auto", "bypassPermissions", "default", "dontAsk", "manual", "plan"];
+var CLAUDE_COMMAND = /(?:^|[;&|(])\s*(?:(?:exec|env|nohup|time)\s+)*(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:\S*\/)?claude\s/;
+var PERMISSION_MODE_FLAG = /--permission-mode(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s;&|()]+))/g;
+function permissionModeProblems(config) {
+  const problems = [];
+  for (const queue of config.queues) {
+    const command = config.commands[queue];
+    if (command === void 0 || !CLAUDE_COMMAND.test(command)) continue;
+    for (const match of command.matchAll(PERMISSION_MODE_FLAG)) {
+      const value = match[1] ?? match[2] ?? match[3] ?? "";
+      if (value.includes("$") || value.includes("`") || CLAUDE_PERMISSION_MODES.includes(value)) continue;
+      problems.push({ queue, command, value });
+    }
+  }
+  return problems;
+}
+function permissionModeProblem(problems) {
+  return problems.map(({ queue, command, value }) => `runner.commands.${queue} is \`${command}\`, and \`${value}\` is not a permission mode Claude Code accepts (${CLAUDE_PERMISSION_MODES.join(", ")}). The command would fail only when a build ran it`).join(". ");
+}
+var FORMER_AMEND_COMMAND = /(^|["'\s])\/amend(?=["'\s]|$)/g;
+function currentSkillCommand(command) {
+  return command.replace(FORMER_AMEND_COMMAND, "$1/outerlayer-amend");
+}
+function formerSkillQueues(config) {
+  return config.queues.filter((queue) => {
+    const command = config.commands[queue];
+    return command !== void 0 && currentSkillCommand(command) !== command;
+  });
+}
+function formerSkillProblem(queues) {
+  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
+  return `${keys} ${queues.length === 1 ? "starts" : "start"} /amend, which is now /outerlayer-amend. The runner runs /outerlayer-amend in its place; edit the config to say so`;
+}
+function needsClaudeCredential(hooks) {
+  return builtinKind(hooks.provision) !== "own";
+}
+var CREDENTIAL_FIX = "Run `claude setup-token`, then pipe the token it prints (or an Anthropic API key) to `outerlayer runner init --agent claude`, which stores it in the claude.env beside the config. Or start the runner with CLAUDE_CODE_OAUTH_TOKEN (or ANTHROPIC_API_KEY) set";
+function claudeCredentialCheck(env, options = {}) {
+  const name = "Claude credential";
+  if (options.service !== void 0) {
+    const { unit, variables } = options.service;
+    if (variables.length === 0) {
+      return {
+        name,
+        status: "fail",
+        detail: `the service ${unit} has no Claude credential: neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set in its claude.env or runner.env, so every build fails at provision as agent_credential_missing`,
+        fix: `${CREDENTIAL_FIX}, then restart the service: sudo systemctl restart ${unit}.`
+      };
+    }
+    return { name, status: "pass", detail: `${variables[0]} is set in the claude.env or runner.env of the service ${unit}` };
+  }
+  const held = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
+  if (held === void 0) {
+    return {
+      name,
+      status: "fail",
+      detail: `neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set, so every build fails at provision as agent_credential_missing`,
+      fix: `${CREDENTIAL_FIX}.`
+    };
+  }
+  const sameVariables = options.shell === true ? "; the runner must be started with the same variable" : "";
+  return { name, status: "pass", detail: `${held.variable} is set${sameVariables}` };
+}
+function missingPermissionOf(err) {
+  if (!(err instanceof WorkCommandError) || err.status !== 403) return void 0;
+  const permission = /missing required permission '([^']+)'/i.exec(err.message)?.[1];
+  return permission === void 0 ? void 0 : sanitizeTerminal(permission);
+}
+function missingPermissionFix(permission) {
+  return `use a key that holds ${permission}: create one with the Runner preset on the factory's API keys page, then run \`outerlayer login\` with it`;
+}
+async function claimPermissionProblem(config, fetchImpl = fetch) {
+  const unverified = (what, err) => ({
+    status: "unverified",
+    reason: sanitizeTerminal(`${what}: ${err instanceof Error ? describeCallFailure(err) : String(err)}`)
+  });
+  let signer;
+  try {
+    signer = await signerFor(config.configPath);
+  } catch (err) {
+    return unverified("this host's key could not be read, so whether the runner key can claim work was not checked", err);
+  }
+  try {
+    await getJson(config.url, "/v1/runner/host-key", config.apiKey, config.appId, fetchImpl, signer);
+    return { status: "ok" };
+  } catch (err) {
+    const permission = missingPermissionOf(err);
+    if (permission === void 0) return unverified("the host-key call did not say whether the runner key can claim work", err);
+    return { status: "lacks", problem: `the runner key lacks ${permission}, which a runner needs to claim work: ${missingPermissionFix(permission)}` };
+  }
+}
+function openKvm() {
+  try {
+    closeSync(openSync("/dev/kvm", constants.O_RDWR));
+    return "usable";
+  } catch (err) {
+    return err.code === "ENOENT" ? "absent" : "no-permission";
+  }
+}
+function realBlockedProbes() {
+  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown" };
+}
+var DEFAULT_BUILD_MEMORY = "8g";
+function managedProblems(facts) {
+  const problems = [];
+  if (builtinKind(facts.provision) !== "vm") {
+    problems.push({
+      condition: "jailer",
+      reason: `a managed runner needs builtin:vm hooks, and runner.hooks.provision is ${facts.provision}. Without them builds would run without the jailer. Set runner.hooks.provision and runner.hooks.cleanup to builtin:vm`
+    });
+  } else if (facts.jailer === "usable") ; else if (facts.jailer === "unknown") {
+    problems.push({ condition: "jailer", reason: "the runner has not yet asked the root helper whether builds run under the jailer, so builds would run without the jailer until it answers" });
+  } else {
+    const { problem } = facts.jailer;
+    const advice = problem.includes("pins no helper") || problem.includes("runner install") ? "" : ". Run `outerlayer runner install --service --replace` to install the root helper, then restart the service";
+    problems.push({ condition: "jailer", reason: `builds would run without the jailer, which a managed runner does not allow: ${problem}${advice}` });
+  }
+  if (facts.credentials.has("CLAUDE_CODE_OAUTH_TOKEN")) {
+    problems.push({
+      condition: "credential",
+      reason: "CLAUDE_CODE_OAUTH_TOKEN is set in the runner's environment or credentials directory, and a managed runner accepts only ANTHROPIC_API_KEY. Remove CLAUDE_CODE_OAUTH_TOKEN from the claude.env and runner.env beside the config, store ANTHROPIC_API_KEY, then restart the service"
+    });
+  } else if (!facts.credentials.has("ANTHROPIC_API_KEY")) {
+    problems.push({
+      condition: "credential",
+      reason: "there is no Claude credential in the runner's environment, and a managed runner needs ANTHROPIC_API_KEY. Store ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+    });
+  }
+  if (facts.allowHosts === void 0) {
+    problems.push({
+      condition: "allowHosts",
+      reason: "runner.build.allowHosts is not set, and a managed runner needs it so that a build reaches only the public hosts it lists. List the hosts your builds need; an empty list allows none"
+    });
+  }
+  return problems;
+}
+function managedFactsOf(config, probes) {
+  return {
+    provision: config.hooks.provision,
+    jailer: probes.jailer ?? "unknown",
+    credentials: claudeCredentialVariablesSet(probes.env),
+    allowHosts: config.build?.allowHosts
+  };
+}
+function checkBlocked(config, probes) {
+  const placeholders = placeholderQueues(config);
+  if (placeholders.length > 0) return { reason: `${placeholderProblem(placeholders)}. The runner takes work again once the config is edited` };
+  if (config.managed === true) {
+    const unmet = managedProblems(managedFactsOf(config, probes))[0];
+    if (unmet !== void 0) return { reason: unmet.reason };
+  }
+  const kind = builtinKind(config.hooks.provision);
+  if (kind === "container" || kind === "vm") {
+    const fit = checkFit({
+      concurrency: config.concurrency,
+      buildMemory: config.build?.memory ?? DEFAULT_BUILD_MEMORY,
+      usableBytes: probes.totalMemoryBytes()
+    });
+    if (!fit.fits) return { reason: `${fit.message}. Lower runner.concurrency or runner.build.memory` };
+  }
+  const kvm = kind === "vm" ? probes.kvm() : "usable";
+  if (kvm === "absent") {
+    return { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" };
+  }
+  if (kvm !== "usable") {
+    return {
+      reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
+    };
+  }
+  if (kind === "container" || kind === "vm") {
+    const builder = probes.imageBuilder;
+    if (builder === "unknown") {
+      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
+    }
+    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
+  }
+  if (kind !== "own" && claudeCredential(probes.env) === void 0) {
+    return {
+      reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+    };
+  }
+  return void 0;
+}
+
+export { checkBlocked, claimPermissionProblem, claudeCredentialCheck, currentSkillCommand, formerSkillProblem, formerSkillQueues, managedFactsOf, managedProblems, missingPermissionFix, missingPermissionOf, needsClaudeCredential, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, realBlockedProbes };

package/dist/{chunk-YVY3IVYV.js → chunk-77F7NGAZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-VL3CF4DZ.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-LJIFCG4G.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-ZBN4JGTJ.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-ZZSQYOY5.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-SOWXLIDN.js';
+import { RUNNER_DIR_MODE } from './chunk-KP6R7CV3.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-PS3AHE6C.js → chunk-A2737R27.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-SJ4DX2AD.js';
+import { autoConnect, detectActiveSession } from './chunk-OSVS2QVP.js';
 import { acquireSpoolLockAt } from './chunk-HSUUTD4E.js';
 import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-AM3GMWQK.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F3EF56LQ.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-IWFYKNAO.js';

package/dist/{chunk-DBELICD6.js → chunk-A4UGPQXT.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-PS3AHE6C.js';
+import { uploadSpooledSteps } from './chunk-A2737R27.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-HSUUTD4E.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-AM3GMWQK.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F3EF56LQ.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-IRF2FKB5.js';
-import { writeSyncStatus, spoolDir } from './chunk-RJDJFRRY.js';
+import { signerFor, signRunnerRequest } from './chunk-APSYTJ6I.js';
+import { writeSyncStatus, spoolDir } from './chunk-WRW6QCI6.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';

package/dist/{chunk-IRF2FKB5.js → chunk-APSYTJ6I.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';