@outerlayer/cli 0.31.1-next.20261020175049 → 0.32.0-next.20261020181613

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-20T17:53:05.492Z+6eed059","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-20T18:29:01.912Z+522c55a","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-7VFQC52N.js → check-OL7QVTHJ.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-WELXZD54.js';
+import { probeCredentials } from './chunk-NYZAIBNV.js';
 import './chunk-CWAZNCFQ.js';
 import './chunk-3JVYMD4G.js';
+import './chunk-WHSYPR3U.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-HZITEOLO.js';
+import './chunk-WRU3K5AN.js';
 import './chunk-TZQIEUDE.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-X7UUIHGH.js';
@@ -15,7 +16,7 @@ import './chunk-IBG2ESJX.js';
 import './chunk-JCCUTTRI.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-XTNMIV77.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-5L4JA6WI.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-KHINKAHX.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-ZZSQYOY5.js';
 import './chunk-TBT347UY.js';

package/dist/{chunk-AIN2UF6L.js → chunk-E3XOQJKZ.js}

@@ -1211,7 +1211,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-T6WNAW6E.js');
+    const { runnerHostChecks } = await import('./doctor-KCEZ7EFR.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{chunk-5L4JA6WI.js → chunk-KHINKAHX.js}

@@ -182,7 +182,10 @@ function checkBlocked(config, probes) {
       buildMemory: config.build?.memory ?? DEFAULT_BUILD_MEMORY,
       usableBytes: probes.totalMemoryBytes()
     });
-    if (!fit.fits) return { reason: `${fit.message}. Lower runner.concurrency or runner.build.memory` };
+    if (!fit.fits) {
+      const advice = probes.inImage === true ? "Set OUTERLAYER_BUILD_MEMORY or OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more memory" : `Lower runner.concurrency or runner.build.memory in ${config.configPath}`;
+      return { reason: `${fit.message}. ${advice}` };
+    }
   }
   const kvm = kind === "vm" ? probes.kvm() : "usable";
   if (kvm === "absent") {

package/dist/{chunk-WELXZD54.js → chunk-NYZAIBNV.js}

@@ -2,12 +2,13 @@
 import { createRequire } from 'node:module';
 import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-CWAZNCFQ.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
+import { fitImageBuildMemory } from './chunk-WHSYPR3U.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { RUNNER_PROTOCOL } from './chunk-HZITEOLO.js';
+import { RUNNER_PROTOCOL } from './chunk-WRU3K5AN.js';
 import { writePendingUpdate } from './chunk-TZQIEUDE.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-X7UUIHGH.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-5L4JA6WI.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-KHINKAHX.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-ZZSQYOY5.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
@@ -29,8 +30,8 @@ import { fdName } from './chunk-XD4ZCMA4.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
+import { totalmem, constants } from 'os';
 import { join, dirname } from 'path';
-import { constants } from 'os';
 
 createRequire(import.meta.url);
 
@@ -1124,13 +1125,17 @@ function reloadConfig(state) {
       logOf(state).error(`config re-read rejected: ${hookProblem} \xB7 keeping the last good config`);
       return;
     }
-    state.config = reloaded;
+    state.config = fitForImage(state.deps, reloaded).config;
     const timerNote = state.pollTimerSeconds !== void 0 && state.pollTimerSeconds !== reloaded.pollSeconds ? ` \xB7 still polling every ${state.pollTimerSeconds}s until the runner restarts` : "";
     logOf(state).line(`config re-read \xB7 ${describeConfig(reloaded)}${timerNote}`);
   } catch (err) {
     logOf(state).error(`config re-read rejected: ${describeCallFailure(err)} \xB7 keeping the last good config`);
   }
 }
+function fitForImage(deps, config) {
+  if (deps.image === void 0) return { config };
+  return fitImageBuildMemory(config, (deps.blocked?.totalMemoryBytes ?? totalmem)());
+}
 function describeConfig(config) {
   return `queues ${config.queues.join(",")} \xB7 concurrency ${config.concurrency} \xB7 poll ${config.pollSeconds}s`;
 }
@@ -1603,6 +1608,7 @@ function holdWhenBlocked(state, jailer) {
     ...state.deps.container?.hostEnv === void 0 ? {} : { env: state.deps.container.hostEnv },
     ...state.deps.blocked?.imageBuilder === void 0 ? { imageBuilder: imageBuilderState(state) } : {},
     ...jailer === void 0 ? {} : { jailer },
+    inImage: state.deps.image !== void 0,
     ...state.deps.blocked
   };
   const blocked = checkBlocked(state.config, probes);
@@ -2926,7 +2932,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-7VFQC52N.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-OL7QVTHJ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -2936,9 +2942,10 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       throw new RunnerStartError("went back to the previous version; restarting");
     }
   }
-  const config = loadRunnerConfig(configPath);
-  const hookProblem = checkHooks(config);
+  const loaded = loadRunnerConfig(configPath);
+  const hookProblem = checkHooks(loaded);
   if (hookProblem) throw new RunnerStartError(hookProblem);
+  const { config, note: fitNote } = fitForImage(deps, loaded);
   await ensureHostKey(configPath);
   if (builtinKind(config.hooks.provision) === "container" || builtinKind(config.hooks.provision) === "vm") {
     await ensureRunnerIdentity(configPath, {
@@ -2965,6 +2972,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   }
   const state = { config, jobs: /* @__PURE__ */ new Map(), deps, configMtimeMs };
   log.line(`runner ${config.host} started \xB7 config ${configPath} \xB7 ${describeConfig(config)}`);
+  if (fitNote !== void 0) log.line(fitNote);
   const leavesBuilds = await canLeaveBuilds(state);
   let sigusr2Target;
   let sigusr2Early = false;

package/dist/chunk-WHSYPR3U.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-RQGHHEM7.js';
+import { readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+var GIB = 1024 ** 3;
+var DEFAULT_GIB = 8;
+var MINIMUM_GIB = 4;
+var BUILD_MEMORY_VARIABLE = "OUTERLAYER_BUILD_MEMORY";
+function memoryIsSet(configPath) {
+  try {
+    const raw = JSON.parse(readFileSync(configPath, "utf8"));
+    return raw.runner.build.memory !== void 0;
+  } catch {
+    return false;
+  }
+}
+function gib(bytes) {
+  return `${Number((bytes / GIB).toFixed(1))} GiB`;
+}
+function fitImageBuildMemory(config, totalMemoryBytes) {
+  if (memoryIsSet(config.configPath)) return { config };
+  const current = config.build?.memory ?? `${DEFAULT_GIB}g`;
+  if (checkFit({ concurrency: config.concurrency, buildMemory: current, usableBytes: totalMemoryBytes }).fits) return { config };
+  const available = Math.max(0, totalMemoryBytes - RUNNER_RESERVE_BYTES);
+  const perBuild = Math.floor(available / config.concurrency / GIB);
+  if (perBuild < MINIMUM_GIB) return { config };
+  const memory = `${perBuild}g`;
+  return {
+    config: { ...config, build: { ...config.build, memory } },
+    note: `builds get ${memory} of memory to fit this machine's ${gib(totalMemoryBytes)}; set ${BUILD_MEMORY_VARIABLE} to choose another value`
+  };
+}
+
+export { BUILD_MEMORY_VARIABLE, fitImageBuildMemory };

package/dist/{chunk-HZITEOLO.js → chunk-WRU3K5AN.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 25;
+var RUNNER_PROTOCOL = 26;
 
 export { RUNNER_PROTOCOL };

package/dist/{cli-QHPN5BYY.js → cli-PYG5SDEC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-AIN2UF6L.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-E3XOQJKZ.js';
 import './chunk-BCWVTWS7.js';
 import './chunk-4XPAQXJF.js';
 import './chunk-KT4CN6OU.js';
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-R3PKRIHL.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-WHLP52BW.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-R3PKRIHL.js');
+    const { runInitCommand } = await import('./init-cmd-WHLP52BW.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4856,7 +4856,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-YNTKBRNL.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-YAJZJF6L.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4876,7 +4876,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-YNTKBRNL.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-YAJZJF6L.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4908,7 +4908,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-YNTKBRNL.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-YAJZJF6L.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4978,7 +4978,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-3JRFDYZL.js');
-    const { start, RunnerStartError } = await import('./loop-MNRD5W3W.js');
+    const { start, RunnerStartError } = await import('./loop-U4SWVDRP.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BMFAUQAI.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4997,8 +4997,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-3JRFDYZL.js');
-    const { containerStart } = await import('./container-start-2B3F3VUL.js');
-    const { start, RunnerStartError } = await import('./loop-MNRD5W3W.js');
+    const { containerStart } = await import('./container-start-J3ZZQED4.js');
+    const { start, RunnerStartError } = await import('./loop-U4SWVDRP.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BMFAUQAI.js');
     try {
       const result = await containerStart({
@@ -5018,7 +5018,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { runRunnerCheck } = await import('./check-7VFQC52N.js');
+    const { runRunnerCheck } = await import('./check-OL7QVTHJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5418,7 +5418,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { requestStop } = await import('./loop-MNRD5W3W.js');
+    const { requestStop } = await import('./loop-U4SWVDRP.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-OYT7UG7Y.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5426,7 +5426,7 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-3JRFDYZL.js');
     const { jobsDir, runnerDir } = await import('./paths-OK2EZS7W.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-MNRD5W3W.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-U4SWVDRP.js');
     const { renderStatus } = await import('./status-QVRUCO6L.js');
     const { readHousekeepingRecord } = await import('./record-26AH6WDB.js');
     const path2 = await import('path');
@@ -5487,7 +5487,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { listJobFiles } = await import('./loop-MNRD5W3W.js');
+    const { listJobFiles } = await import('./loop-U4SWVDRP.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-C3RJ3ZTC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{container-start-2B3F3VUL.js → container-start-J3ZZQED4.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { BUILD_MEMORY_VARIABLE } from './chunk-WHSYPR3U.js';
 import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-4NOO2ZFW.js';
 import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-ETVHXBCZ.js';
 import { MIN_ENGINE_MAJOR } from './chunk-76QNSSOZ.js';
@@ -17,7 +18,7 @@ import './chunk-T5TBGOT6.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-2JPVI45I.js';
-import './chunk-YJLHUKYS.js';
+import { parseSize } from './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
 import './chunk-GPRIHEGQ.js';
 import './chunk-4EU4X2ML.js';
@@ -52,7 +53,7 @@ import './chunk-VNVZDWO3.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
-import { existsSync, readFileSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync } from 'fs';
 
 createRequire(import.meta.url);
 var DOCKER_SOCKET = "/var/run/docker.sock";
@@ -81,6 +82,43 @@ var keyHint = (key) => {
   if (key === "") return "none";
   return key.length < KEY_MIN_SHOWN ? `a ${key.length}-character key` : `\u2026${key.slice(-4)}`;
 };
+var CONCURRENCY_VARIABLE = "OUTERLAYER_CONCURRENCY";
+function settingsOf(env) {
+  const memory = set(env, BUILD_MEMORY_VARIABLE);
+  if (memory !== void 0 && parseSize(memory) === void 0) {
+    return `${BUILD_MEMORY_VARIABLE} is ${memory}, which is not a size. Use a number with a unit, such as 6g or 512m.`;
+  }
+  const concurrency = set(env, CONCURRENCY_VARIABLE);
+  if (concurrency !== void 0 && !/^[1-9]\d*$/.test(concurrency)) {
+    return `${CONCURRENCY_VARIABLE} is ${concurrency}. It takes a positive integer, such as 2.`;
+  }
+  return { memory, concurrency: concurrency === void 0 ? void 0 : Number(concurrency) };
+}
+function writeSettings(configPath, settings) {
+  const config = readConfig(configPath);
+  if (config instanceof RunnerInitError) throw config;
+  const runner = config.runner ?? {};
+  if (runner.build !== void 0 && (typeof runner.build !== "object" || runner.build === null || Array.isArray(runner.build))) {
+    throw new RunnerInitError(`${configPath}: runner.build must be an object`);
+  }
+  const build = runner.build ?? {};
+  const lines = [];
+  if (settings.memory !== void 0 && build.memory !== settings.memory) {
+    lines.push(`runner.build.memory is ${settings.memory}${build.memory === void 0 ? "" : `, not ${String(build.memory)}`}, as ${BUILD_MEMORY_VARIABLE} says`);
+    build.memory = settings.memory;
+    runner.build = build;
+  }
+  if (settings.concurrency !== void 0 && runner.concurrency !== settings.concurrency) {
+    lines.push(`runner.concurrency is ${settings.concurrency}${runner.concurrency === void 0 ? "" : `, not ${String(runner.concurrency)}`}, as ${CONCURRENCY_VARIABLE} says`);
+    runner.concurrency = settings.concurrency;
+  }
+  if (lines.length > 0) {
+    config.runner = runner;
+    writeFileSync(configPath, `${JSON.stringify(config, null, 2)}
+`);
+  }
+  return lines;
+}
 var withoutSlash = (url) => url.replace(/\/+$/, "");
 function disagreements(config, env) {
   const lines = [];
@@ -130,6 +168,8 @@ async function containerStart(deps) {
   if (missing.length > 0) {
     return refuse(`the container needs these variables, and they are not set: ${missing.join("; ")}. Put them in the file you pass to docker run with --env-file.`);
   }
+  const settings = settingsOf(env);
+  if (typeof settings === "string") return refuse(settings);
   const socketPresent = deps.socketPresent ?? existsSync;
   if (!socketPresent(DOCKER_SOCKET)) {
     return refuse(
@@ -175,6 +215,13 @@ Change the variables to match the volume, or use a new volume to make a new runn
       throw err;
     }
   }
+  try {
+    for (const line of writeSettings(configPath, settings)) (deps.log ?? ((text) => process.stdout.write(`${text}
+`)))(line);
+  } catch (err) {
+    if (err instanceof RunnerInitError) return refuse(err.message);
+    throw err;
+  }
   await deps.start(configPath, { fetchImpl: deps.fetchImpl ?? fetch, image: { version, ...deps.exit === void 0 ? {} : { exit: deps.exit } } });
   return { ok: true };
 }

package/dist/{doctor-T6WNAW6E.js → doctor-KCEZ7EFR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, managedProblems, missingPermissionOf, missingPermissionFix } from './chunk-5L4JA6WI.js';
+import { needsClaudeCredential, claudeCredentialCheck, managedProblems, missingPermissionOf, missingPermissionFix } from './chunk-KHINKAHX.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { launcherCheck } from './chunk-ZBN4JGTJ.js';
 import './chunk-ZZSQYOY5.js';

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-UFHR6EKZ.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-QHPN5BYY.js');
+var { runCli } = await import('./cli-PYG5SDEC.js');
 await runCli(process.argv);

package/dist/{init-cmd-R3PKRIHL.js → init-cmd-WHLP52BW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-AIN2UF6L.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-E3XOQJKZ.js';
 import './chunk-BCWVTWS7.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-4XPAQXJF.js';

package/dist/{loop-MNRD5W3W.js → loop-U4SWVDRP.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, start, tick, watchTick } from './chunk-WELXZD54.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, start, tick, watchTick } from './chunk-NYZAIBNV.js';
 import './chunk-CWAZNCFQ.js';
 import './chunk-3JVYMD4G.js';
+import './chunk-WHSYPR3U.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-HZITEOLO.js';
+import './chunk-WRU3K5AN.js';
 import './chunk-TZQIEUDE.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-X7UUIHGH.js';
@@ -15,7 +16,7 @@ import './chunk-IBG2ESJX.js';
 import './chunk-JCCUTTRI.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-XTNMIV77.js';
-import './chunk-5L4JA6WI.js';
+import './chunk-KHINKAHX.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-ZZSQYOY5.js';
 import './chunk-TBT347UY.js';

package/dist/{work-claim-cmd-YNTKBRNL.js → work-claim-cmd-YAJZJF6L.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_PROTOCOL } from './chunk-HZITEOLO.js';
+import { RUNNER_PROTOCOL } from './chunk-WRU3K5AN.js';
 import { defaultRunnerConfigPath } from './chunk-P7BEZAEU.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.31.1-next.20261020175049",
+  "version": "0.32.0-next.20261020181613",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",