@outerlayer/cli 0.30.2-next.20261020115557 → 0.31.0-next.20261020133458

package/dist/{agent-setup-ZNYAXAWI.js → agent-setup-E7CMDUR5.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-I3WLYIIW.js';
+export { keepHandWritten, runAgentSetup } from './chunk-XAV6XCI2.js';
 import './chunk-XB7TRWI2.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-XTKH5VAC.js';
 import './chunk-QDDPVBIS.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-DLY22KHX.js';
+import './chunk-NIS2PIS4.js';
 import './chunk-V6IYYQU3.js';
-import './chunk-AM3GMWQK.js';
+import './chunk-F3EF56LQ.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-IRF2FKB5.js';
-import './chunk-SOWXLIDN.js';
-import './chunk-WHCDULC4.js';
+import './chunk-APSYTJ6I.js';
+import './chunk-KP6R7CV3.js';
+import './chunk-HDSDUTX4.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-AKKVPUGK.js';

package/dist/{bridge-FI7OF2H3.js → bridge-3EG6Q34K.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-TN2XMMD7.js';
-import './chunk-WHCDULC4.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-XTNMIV77.js';
+import './chunk-HDSDUTX4.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-PXRDWSN4.js → build-7QD3VJ6U.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-U5DC57AF.js';
-import './chunk-IRTZYDZO.js';
+export { buildRepositoryImage } from './chunk-Z7HAIZ6X.js';
+import './chunk-T5TBGOT6.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-SJZL5F3F.js';
-import './chunk-SOWXLIDN.js';
-import './chunk-WHCDULC4.js';
+import './chunk-KP6R7CV3.js';
+import './chunk-HDSDUTX4.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-20T11:57:23.004Z+c47cb0f","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-20T13:36:31.668Z+91a9738","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-UNVHUZL7.js → builder-REQJGZJP.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-7YSR636F.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-2JPVI45I.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-FTGJ3DPV.js';
-import './chunk-IRF2FKB5.js';
-import './chunk-SOWXLIDN.js';
-import './chunk-WHCDULC4.js';
+import './chunk-V36AOTBP.js';
+import './chunk-APSYTJ6I.js';
+import './chunk-KP6R7CV3.js';
+import './chunk-HDSDUTX4.js';
 import './chunk-IWFYKNAO.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';

package/dist/{check-N3XNBPDH.js → check-UUWPPYC3.js}

@@ -1,60 +1,60 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-EEZO2T24.js';
-import './chunk-B7NT4YZ3.js';
+import { probeCredentials } from './chunk-KQLUUTLC.js';
+import './chunk-SNLMMLDD.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-6C5MZ7UG.js';
-import './chunk-QWJBTFAF.js';
+import './chunk-TZQIEUDE.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-44CGGHJF.js';
-import './chunk-6CNNRO53.js';
+import './chunk-X7UUIHGH.js';
+import './chunk-RJYKTWUP.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-ZNMVBHGJ.js';
-import './chunk-DBELICD6.js';
-import './chunk-PS3AHE6C.js';
+import './chunk-W4ICX5WW.js';
+import './chunk-IBG2ESJX.js';
+import './chunk-JCCUTTRI.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-TN2XMMD7.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ERXY3FXG.js';
+import './chunk-XTNMIV77.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-GYCKMZQJ.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LJIFCG4G.js';
+import './chunk-ZZSQYOY5.js';
 import './chunk-TBT347UY.js';
-import './chunk-IUV6MUQB.js';
-import './chunk-3XUZPSBV.js';
-import './chunk-5VWKCY2E.js';
-import './chunk-MBVSVQVH.js';
-import './chunk-TKJISBV6.js';
-import './chunk-4SE6GXQA.js';
-import './chunk-D3LS7E7U.js';
+import './chunk-ZD7J35IX.js';
+import './chunk-S4IJPYDV.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-XU5O5JCZ.js';
+import './chunk-QQGZ5THT.js';
+import './chunk-HIGJTX5U.js';
+import './chunk-WWHWF3KZ.js';
+import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
-import './chunk-5HZDPOJI.js';
-import './chunk-3F7RC3UA.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-2ZMJFGOZ.js';
+import './chunk-NJS7JJYN.js';
+import { DEFAULT_UNIT_NAME } from './chunk-RQGHHEM7.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-P7BEZAEU.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-U5DC57AF.js';
-import './chunk-IRTZYDZO.js';
+import './chunk-Z7HAIZ6X.js';
+import './chunk-T5TBGOT6.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-7YSR636F.js';
+import './chunk-2JPVI45I.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-4OKXGZM3.js';
-import './chunk-SJ4DX2AD.js';
-import './chunk-3YLHIXLR.js';
+import './chunk-GPRIHEGQ.js';
+import './chunk-4EU4X2ML.js';
+import './chunk-7UD5ONVI.js';
 import './chunk-HSUUTD4E.js';
-import './chunk-FTGJ3DPV.js';
+import './chunk-V36AOTBP.js';
 import './chunk-QDDPVBIS.js';
 import './chunk-G2RRBBOX.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-DLY22KHX.js';
+import './chunk-NIS2PIS4.js';
 import './chunk-V6IYYQU3.js';
-import './chunk-AM3GMWQK.js';
+import './chunk-F3EF56LQ.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-IRF2FKB5.js';
-import './chunk-SOWXLIDN.js';
-import { claudeEnvPath } from './chunk-WHCDULC4.js';
-import './chunk-RJDJFRRY.js';
+import './chunk-APSYTJ6I.js';
+import './chunk-KP6R7CV3.js';
+import { claudeEnvPath } from './chunk-HDSDUTX4.js';
+import './chunk-WRW6QCI6.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -106,6 +106,19 @@ async function runRunnerCheck(configPath, deps = {}) {
   if (modeProblems.length > 0) {
     return { ok: false, check: "permission mode", message: `${configPath}: ${permissionModeProblem(modeProblems)}` };
   }
+  if (config.managed === true) {
+    const files = [join(dirname(configPath), "runner.env"), claudeEnvPath(configPath)];
+    const env = {};
+    for (const path of files) {
+      const fromFile = readRunnerEnv(path);
+      if ("error" in fromFile) return { ok: false, check: "managed", message: `${configPath}: ${path} could not be read to look for a Claude credential: ${fromFile.error}` };
+      Object.assign(env, fromFile.env);
+    }
+    Object.assign(env, deps.env ?? process.env);
+    const asked = await (deps.helper ?? (() => probeHelper(env[HELPER_ENV] ?? helperSocketPath(DEFAULT_UNIT_NAME))))();
+    const unmet = managedProblems(managedFactsOf(config, { env, jailer: asked.ok ? "usable" : { problem: asked.detail } }))[0];
+    if (unmet !== void 0) return { ok: false, check: "managed", message: `${configPath}: ${unmet.reason}` };
+  }
   let credentialLine;
   if (needsClaudeCredential(config.hooks)) {
     const env = deps.env ?? process.env;

package/dist/{chunk-7YSR636F.js → chunk-2JPVI45I.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { RecipeError, BUILDKIT_IMAGE } from './chunk-SJZL5F3F.js';
-import { compareVersions } from './chunk-FTGJ3DPV.js';
-import { ensureHostKey } from './chunk-IRF2FKB5.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-SOWXLIDN.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-WHCDULC4.js';
+import { compareVersions } from './chunk-V36AOTBP.js';
+import { ensureHostKey } from './chunk-APSYTJ6I.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-KP6R7CV3.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-HDSDUTX4.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';

package/dist/{chunk-SJ4DX2AD.js → chunk-4EU4X2ML.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-3YLHIXLR.js';
-import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
-import { resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-7UD5ONVI.js';
+import { resolveRepoIdentity } from './chunk-V36AOTBP.js';
+import { resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-MBZTX4V2.js → chunk-4XPAQXJF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
 import { isAgentsMdLayout } from './chunk-QDDPVBIS.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-AM3GMWQK.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-F3EF56LQ.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-UAFMC3PL.js';

package/dist/{chunk-TGUWHA27.js → chunk-5FHNQST3.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-SJ4DX2AD.js';
-import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
+import { autoConnect, detectActiveSession } from './chunk-4EU4X2ML.js';
+import { resolveRepoIdentity } from './chunk-V36AOTBP.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-YVY3IVYV.js → chunk-77F7NGAZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-VL3CF4DZ.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-LJIFCG4G.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-ZBN4JGTJ.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-ZZSQYOY5.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-SOWXLIDN.js';
+import { RUNNER_DIR_MODE } from './chunk-KP6R7CV3.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-3YLHIXLR.js → chunk-7UD5ONVI.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
-import { remoteLookupFailed } from './chunk-FTGJ3DPV.js';
+import { remoteLookupFailed } from './chunk-V36AOTBP.js';
 import { isAgentsMdLayout } from './chunk-QDDPVBIS.js';
 import { DEFAULT_DASHBOARD } from './chunk-G2RRBBOX.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-IRF2FKB5.js → chunk-APSYTJ6I.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-HMAYAMOQ.js → chunk-D7O7LA2O.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-BCWVTWS7.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-MBZTX4V2.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-4OKXGZM3.js';
-import { isLinkedRepository } from './chunk-3YLHIXLR.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-4XPAQXJF.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-GPRIHEGQ.js';
+import { isLinkedRepository } from './chunk-7UD5ONVI.js';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-FTGJ3DPV.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-V36AOTBP.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { checkFormerSkillNames } from './chunk-V6IYYQU3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-AM3GMWQK.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-RJDJFRRY.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-F3EF56LQ.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-WRW6QCI6.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1190,7 +1190,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-VM6GKCCE.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-3JRFDYZL.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1211,7 +1211,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-5K4UTAT3.js');
+    const { runnerHostChecks } = await import('./doctor-XZ47GD4V.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1229,8 +1229,8 @@ async function gatherDoctorChecks() {
     })();
     const runner = (() => {
       try {
-        const { concurrency, build, housekeeping } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g", minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts };
+        const { concurrency, build, housekeeping, managed } = loadRunnerConfig(configPath);
+        return { concurrency, buildMemory: build?.memory ?? "8g", minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...managed === true ? { managed } : {} };
       } catch {
         return void 0;
       }
@@ -1239,7 +1239,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-L7JIBK3Y.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-GZ27NW6U.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-OIRIEOS7.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-AM3GMWQK.js → chunk-F3EF56LQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-IRF2FKB5.js';
+import { signRunnerRequest, signerFor } from './chunk-APSYTJ6I.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-4OKXGZM3.js → chunk-GPRIHEGQ.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-SJ4DX2AD.js';
-import { workPageUrl } from './chunk-3YLHIXLR.js';
+import { detectActiveSession, autoConnect } from './chunk-4EU4X2ML.js';
+import { workPageUrl } from './chunk-7UD5ONVI.js';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
-import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
+import { resolveRepoIdentity } from './chunk-V36AOTBP.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-AM3GMWQK.js';
-import { signRunnerRequest } from './chunk-IRF2FKB5.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-F3EF56LQ.js';
+import { signRunnerRequest } from './chunk-APSYTJ6I.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -441,7 +441,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-A2N3PSXI.js');
+      const { logHookError } = await import('./hook-fast-UFHR6EKZ.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/chunk-GYCKMZQJ.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { isPlaceholderCommand } from './chunk-ZD7J35IX.js';
+import { describeCallFailure } from './chunk-WWHWF3KZ.js';
+import { checkFit } from './chunk-RQGHHEM7.js';
+import { builtinKind } from './chunk-P7BEZAEU.js';
+import { WorkCommandError, getJson } from './chunk-GPRIHEGQ.js';
+import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
+import { signerFor } from './chunk-APSYTJ6I.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-HDSDUTX4.js';
+import { closeSync, openSync, constants } from 'fs';
+import { totalmem } from 'os';
+
+createRequire(import.meta.url);
+
+// src/runner/host-setup.ts
+function placeholderQueues(config) {
+  return config.queues.filter((queue) => {
+    const command = config.commands[queue];
+    return command !== void 0 && isPlaceholderCommand(command);
+  });
+}
+function placeholderProblem(queues) {
+  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
+  return `${keys} ${queues.length === 1 ? "is" : "are"} still the placeholder \`runner init\` wrote, which fails every item. Edit ${queues.length === 1 ? "it" : "them"} to start your agent on item $OUTERLAYER_WORK`;
+}
+var CLAUDE_PERMISSION_MODES = ["acceptEdits", "auto", "bypassPermissions", "default", "dontAsk", "manual", "plan"];
+var CLAUDE_COMMAND = /(?:^|[;&|(])\s*(?:(?:exec|env|nohup|time)\s+)*(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:\S*\/)?claude\s/;
+var PERMISSION_MODE_FLAG = /--permission-mode(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s;&|()]+))/g;
+function permissionModeProblems(config) {
+  const problems = [];
+  for (const queue of config.queues) {
+    const command = config.commands[queue];
+    if (command === void 0 || !CLAUDE_COMMAND.test(command)) continue;
+    for (const match of command.matchAll(PERMISSION_MODE_FLAG)) {
+      const value = match[1] ?? match[2] ?? match[3] ?? "";
+      if (value.includes("$") || value.includes("`") || CLAUDE_PERMISSION_MODES.includes(value)) continue;
+      problems.push({ queue, command, value });
+    }
+  }
+  return problems;
+}
+function permissionModeProblem(problems) {
+  return problems.map(({ queue, command, value }) => `runner.commands.${queue} is \`${command}\`, and \`${value}\` is not a permission mode Claude Code accepts (${CLAUDE_PERMISSION_MODES.join(", ")}). The command would fail only when a build ran it`).join(". ");
+}
+var FORMER_AMEND_COMMAND = /(^|["'\s])\/amend(?=["'\s]|$)/g;
+function currentSkillCommand(command) {
+  return command.replace(FORMER_AMEND_COMMAND, "$1/outerlayer-amend");
+}
+function formerSkillQueues(config) {
+  return config.queues.filter((queue) => {
+    const command = config.commands[queue];
+    return command !== void 0 && currentSkillCommand(command) !== command;
+  });
+}
+function formerSkillProblem(queues) {
+  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
+  return `${keys} ${queues.length === 1 ? "starts" : "start"} /amend, which is now /outerlayer-amend. The runner runs /outerlayer-amend in its place; edit the config to say so`;
+}
+function needsClaudeCredential(hooks) {
+  return builtinKind(hooks.provision) !== "own";
+}
+var CREDENTIAL_FIX = "Run `claude setup-token`, then pipe the token it prints (or an Anthropic API key) to `outerlayer runner init --agent claude`, which stores it in the claude.env beside the config. Or start the runner with CLAUDE_CODE_OAUTH_TOKEN (or ANTHROPIC_API_KEY) set";
+function claudeCredentialCheck(env, options = {}) {
+  const name = "Claude credential";
+  if (options.service !== void 0) {
+    const { unit, variables } = options.service;
+    if (variables.length === 0) {
+      return {
+        name,
+        status: "fail",
+        detail: `the service ${unit} has no Claude credential: neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set in its claude.env or runner.env, so every build fails at provision as agent_credential_missing`,
+        fix: `${CREDENTIAL_FIX}, then restart the service: sudo systemctl restart ${unit}.`
+      };
+    }
+    return { name, status: "pass", detail: `${variables[0]} is set in the claude.env or runner.env of the service ${unit}` };
+  }
+  const held = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
+  if (held === void 0) {
+    return {
+      name,
+      status: "fail",
+      detail: `neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set, so every build fails at provision as agent_credential_missing`,
+      fix: `${CREDENTIAL_FIX}.`
+    };
+  }
+  const sameVariables = options.shell === true ? "; the runner must be started with the same variable" : "";
+  return { name, status: "pass", detail: `${held.variable} is set${sameVariables}` };
+}
+function missingPermissionOf(err) {
+  if (!(err instanceof WorkCommandError) || err.status !== 403) return void 0;
+  const permission = /missing required permission '([^']+)'/i.exec(err.message)?.[1];
+  return permission === void 0 ? void 0 : sanitizeTerminal(permission);
+}
+function missingPermissionFix(permission) {
+  return `use a key that holds ${permission}: create one with the Runner preset on the factory's API keys page, then run \`outerlayer login\` with it`;
+}
+async function claimPermissionProblem(config, fetchImpl = fetch) {
+  const unverified = (what, err) => ({
+    status: "unverified",
+    reason: sanitizeTerminal(`${what}: ${err instanceof Error ? describeCallFailure(err) : String(err)}`)
+  });
+  let signer;
+  try {
+    signer = await signerFor(config.configPath);
+  } catch (err) {
+    return unverified("this host's key could not be read, so whether the runner key can claim work was not checked", err);
+  }
+  try {
+    await getJson(config.url, "/v1/runner/host-key", config.apiKey, config.appId, fetchImpl, signer);
+    return { status: "ok" };
+  } catch (err) {
+    const permission = missingPermissionOf(err);
+    if (permission === void 0) return unverified("the host-key call did not say whether the runner key can claim work", err);
+    return { status: "lacks", problem: `the runner key lacks ${permission}, which a runner needs to claim work: ${missingPermissionFix(permission)}` };
+  }
+}
+function openKvm() {
+  try {
+    closeSync(openSync("/dev/kvm", constants.O_RDWR));
+    return "usable";
+  } catch (err) {
+    return err.code === "ENOENT" ? "absent" : "no-permission";
+  }
+}
+function realBlockedProbes() {
+  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown" };
+}
+var DEFAULT_BUILD_MEMORY = "8g";
+function managedProblems(facts) {
+  const problems = [];
+  if (builtinKind(facts.provision) !== "vm") {
+    problems.push({
+      condition: "jailer",
+      reason: `a managed runner needs builtin:vm hooks, and runner.hooks.provision is ${facts.provision}. Without them builds would run without the jailer. Set runner.hooks.provision and runner.hooks.cleanup to builtin:vm`
+    });
+  } else if (facts.jailer === "usable") ; else if (facts.jailer === "unknown") {
+    problems.push({ condition: "jailer", reason: "the runner has not yet asked the root helper whether builds run under the jailer, so builds would run without the jailer until it answers" });
+  } else {
+    const { problem } = facts.jailer;
+    const advice = problem.includes("pins no helper") || problem.includes("runner install") ? "" : ". Run `outerlayer runner install --service --replace` to install the root helper, then restart the service";
+    problems.push({ condition: "jailer", reason: `builds would run without the jailer, which a managed runner does not allow: ${problem}${advice}` });
+  }
+  if (facts.credentials.has("CLAUDE_CODE_OAUTH_TOKEN")) {
+    problems.push({
+      condition: "credential",
+      reason: "CLAUDE_CODE_OAUTH_TOKEN is set in the runner's environment or credentials directory, and a managed runner accepts only ANTHROPIC_API_KEY. Remove CLAUDE_CODE_OAUTH_TOKEN from the claude.env and runner.env beside the config, store ANTHROPIC_API_KEY, then restart the service"
+    });
+  } else if (!facts.credentials.has("ANTHROPIC_API_KEY")) {
+    problems.push({
+      condition: "credential",
+      reason: "there is no Claude credential in the runner's environment, and a managed runner needs ANTHROPIC_API_KEY. Store ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+    });
+  }
+  if (facts.allowHosts === void 0) {
+    problems.push({
+      condition: "allowHosts",
+      reason: "runner.build.allowHosts is not set, and a managed runner needs it so that a build reaches only the public hosts it lists. List the hosts your builds need; an empty list allows none"
+    });
+  }
+  return problems;
+}
+function managedFactsOf(config, probes) {
+  return {
+    provision: config.hooks.provision,
+    jailer: probes.jailer ?? "unknown",
+    credentials: claudeCredentialVariablesSet(probes.env),
+    allowHosts: config.build?.allowHosts
+  };
+}
+function checkBlocked(config, probes) {
+  const placeholders = placeholderQueues(config);
+  if (placeholders.length > 0) return { reason: `${placeholderProblem(placeholders)}. The runner takes work again once the config is edited` };
+  if (config.managed === true) {
+    const unmet = managedProblems(managedFactsOf(config, probes))[0];
+    if (unmet !== void 0) return { reason: unmet.reason };
+  }
+  const kind = builtinKind(config.hooks.provision);
+  if (kind === "container" || kind === "vm") {
+    const fit = checkFit({
+      concurrency: config.concurrency,
+      buildMemory: config.build?.memory ?? DEFAULT_BUILD_MEMORY,
+      usableBytes: probes.totalMemoryBytes()
+    });
+    if (!fit.fits) return { reason: `${fit.message}. Lower runner.concurrency or runner.build.memory` };
+  }
+  const kvm = kind === "vm" ? probes.kvm() : "usable";
+  if (kvm === "absent") {
+    return { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" };
+  }
+  if (kvm !== "usable") {
+    return {
+      reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
+    };
+  }
+  if (kind === "container" || kind === "vm") {
+    const builder = probes.imageBuilder;
+    if (builder === "unknown") {
+      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
+    }
+    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
+  }
+  if (kind !== "own" && claudeCredential(probes.env) === void 0) {
+    return {
+      reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+    };
+  }
+  return void 0;
+}
+
+export { checkBlocked, claimPermissionProblem, claudeCredentialCheck, currentSkillCommand, formerSkillProblem, formerSkillQueues, managedFactsOf, managedProblems, missingPermissionFix, missingPermissionOf, needsClaudeCredential, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, realBlockedProbes };

package/dist/{chunk-WHCDULC4.js → chunk-HDSDUTX4.js}

@@ -40,6 +40,22 @@ function readClaudeCredential(env) {
     return void 0;
   }
 }
+function claudeCredentialVariablesSet(env, options = {}) {
+  const found = /* @__PURE__ */ new Set();
+  const add = (values) => {
+    for (const variable of FORWARDED) if ((values[variable] ?? "") !== "") found.add(variable);
+  };
+  add(env);
+  const directory = env.CREDENTIALS_DIRECTORY;
+  if (directory) {
+    try {
+      add(parseRunnerEnv(readFileSync(join(directory, CLAUDE_CREDENTIAL_ID), "utf8")));
+    } catch {
+    }
+  }
+  if (options.ignoreHeld !== true && held !== void 0) found.add(held.variable);
+  return found;
+}
 var complained = /* @__PURE__ */ new Set();
 function complain(path, reason) {
   if (complained.has(path)) return;
@@ -756,4 +772,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };