@outerlayer/cli 0.32.0-next.20261020183646 → 0.32.0-next.20261020194118

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-20T18:47:15.319Z+d39f74e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-20T19:43:21.965Z+8773b66","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-OL7QVTHJ.js → check-LKB5L6SJ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-NYZAIBNV.js';
-import './chunk-CWAZNCFQ.js';
+import { probeCredentials } from './chunk-ORLL2A45.js';
+import './chunk-P7RX33YS.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-WHSYPR3U.js';
 import './chunk-E7R2GIAW.js';
@@ -11,21 +11,21 @@ import './chunk-ZVB57WI6.js';
 import './chunk-X7UUIHGH.js';
 import './chunk-RJYKTWUP.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-W4ICX5WW.js';
-import './chunk-IBG2ESJX.js';
-import './chunk-JCCUTTRI.js';
+import './chunk-JFLVUA43.js';
+import './chunk-KCB6V5XH.js';
+import './chunk-XKZPL3GE.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-XTNMIV77.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-KHINKAHX.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-NMF4EUVS.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-ZZSQYOY5.js';
 import './chunk-TBT347UY.js';
-import './chunk-4NOO2ZFW.js';
-import './chunk-ETVHXBCZ.js';
-import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-76QNSSOZ.js';
+import './chunk-4TIZUKGG.js';
+import './chunk-C4C34DUG.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-WWHWF3KZ.js';
+import './chunk-SXJVL7NS.js';
 import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-NJS7JJYN.js';
@@ -39,9 +39,9 @@ import './chunk-OGFGZQA3.js';
 import './chunk-2JPVI45I.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-GPRIHEGQ.js';
-import './chunk-4EU4X2ML.js';
-import './chunk-7UD5ONVI.js';
+import './chunk-U4HMGT3L.js';
+import './chunk-3DSC2FN3.js';
+import './chunk-IGIGNYZK.js';
 import './chunk-HSUUTD4E.js';
 import './chunk-V36AOTBP.js';
 import './chunk-QDDPVBIS.js';

package/dist/{chunk-4EU4X2ML.js → chunk-3DSC2FN3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-7UD5ONVI.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-IGIGNYZK.js';
 import { resolveRepoIdentity } from './chunk-V36AOTBP.js';
 import { resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';

package/dist/{chunk-5FHNQST3.js → chunk-4I3ZDQFU.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-4EU4X2ML.js';
+import { autoConnect, detectActiveSession } from './chunk-3DSC2FN3.js';
 import { resolveRepoIdentity } from './chunk-V36AOTBP.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';

package/dist/{chunk-4NOO2ZFW.js → chunk-4TIZUKGG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-ETVHXBCZ.js';
-import { MIN_ENGINE_MAJOR } from './chunk-76QNSSOZ.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-C4C34DUG.js';
+import { MIN_ENGINE_MAJOR } from './chunk-OYSZGHJF.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-NJS7JJYN.js';
 import { runnerCredentialProblem } from './chunk-P7BEZAEU.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';

package/dist/{chunk-ETVHXBCZ.js → chunk-C4C34DUG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-76QNSSOZ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-OYSZGHJF.js';
 import { runnerImageVersion } from './chunk-YV7WULXQ.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-SJZL5F3F.js';
 import { spawnSync } from 'child_process';

package/dist/{chunk-7UD5ONVI.js → chunk-IGIGNYZK.js}

@@ -6,9 +6,11 @@ import { isAgentsMdLayout } from './chunk-QDDPVBIS.js';
 import { DEFAULT_DASHBOARD } from './chunk-G2RRBBOX.js';
 import { cliFetch, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
+import { lstatSync } from 'fs';
+import { join, relative } from 'path';
 import { createInterface } from 'readline/promises';
 
 createRequire(import.meta.url);
@@ -72,6 +74,63 @@ function inAgentsMdLayout(cwd) {
 function commitLineFor(cwd) {
   return inAgentsMdLayout(cwd) ? AGENTS_LAYOUT_COMMIT_LINE : COMMIT_LINE;
 }
+function setupPathsFor(root) {
+  return isAgentsMdLayout(root) ? ["AGENTS.md", ".agents", ".claude/skills", ".mcp.json", ".outerlayer"] : [".outerlayer"];
+}
+var MAX_IGNORED_NAMED = 10;
+function gitOutput(root, args) {
+  try {
+    return execFileSync("git", args, { cwd: root, encoding: "utf8", stdio: "pipe", timeout: REQUEST_TIMEOUT_MS, maxBuffer: 256 * 1024 * 1024 });
+  } catch {
+    return "";
+  }
+}
+function isGitIgnored(root, path) {
+  return gitOutput(root, ["check-ignore", "--", path]) !== "";
+}
+function ignoredFilesIn(root, path) {
+  return gitOutput(root, ["ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "--", path]).split("\n").filter((line) => line !== "");
+}
+function existsOnDisk(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function commitCommandsFor(cwd) {
+  const dirs = findGitDirs(cwd);
+  if (dirs === void 0) return commitLineFor(cwd);
+  const root = dirs.repoRoot;
+  const ignored = [];
+  const add = [];
+  const omitted = [];
+  for (const path of setupPathsFor(root)) {
+    if (!existsOnDisk(join(root, path))) continue;
+    if (isGitIgnored(root, path)) ignored.push(path);
+    else {
+      add.push(relative(cwd, join(root, path)));
+      const inside = ignoredFilesIn(root, path);
+      ignored.push(...inside.slice(0, MAX_IGNORED_NAMED));
+      if (inside.length > MAX_IGNORED_NAMED) {
+        omitted.push(`Git ignores ${inside.length - MAX_IGNORED_NAMED} more files or folders in ${path}, so the commit leaves them out.`);
+      }
+    }
+  }
+  const lines = ignored.map(
+    (path) => `Git ignores ${path}, so the commit leaves it out. A build reads the repository from the git host, so a file that is never committed never reaches a build.`
+  );
+  lines.push(...omitted);
+  if (add.length === 0) return lines.join("\n");
+  lines.push(
+    "Commit and push the setup so the factory reads your policy and skills. No checks run on a pull request until the policy is on the branch it targets.",
+    `  git add ${add.join(" ")}`,
+    '  git commit -m "Add OuterLayer setup"',
+    "  git push"
+  );
+  return lines.join("\n");
+}
 function hasUncommittedPolicy(cwd) {
   const paths = inAgentsMdLayout(cwd) ? AGENTS_LAYOUT_COMMIT_PATHS : COMMIT_PATHS;
   try {
@@ -327,4 +386,4 @@ ${commitLineFor(deps.cwd)}
   return r.code;
 }
 
-export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitLineFor, dashboardBase, fetchFactories, hasUncommittedPolicy, isLinkedRepository, listText, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, slug, workPageUrl };
+export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitCommandsFor, commitLineFor, dashboardBase, fetchFactories, hasUncommittedPolicy, isLinkedRepository, listText, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, slug, workPageUrl };

package/dist/{chunk-E3XOQJKZ.js → chunk-ITOWHQSZ.js}

@@ -2,8 +2,8 @@
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-BCWVTWS7.js';
 import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-4XPAQXJF.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-GPRIHEGQ.js';
-import { isLinkedRepository } from './chunk-7UD5ONVI.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-U4HMGT3L.js';
+import { isLinkedRepository } from './chunk-IGIGNYZK.js';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-V36AOTBP.js';
 import { C } from './chunk-ANPNT6PM.js';
@@ -1211,7 +1211,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-KCEZ7EFR.js');
+    const { runnerHostChecks } = await import('./doctor-NGBSBISG.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{chunk-W4ICX5WW.js → chunk-JFLVUA43.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-IBG2ESJX.js';
+import { LiveUploader } from './chunk-KCB6V5XH.js';
 import { CaptureDaemon } from './chunk-V36AOTBP.js';
 import { spoolDir } from './chunk-WRW6QCI6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-IBG2ESJX.js → chunk-KCB6V5XH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-JCCUTTRI.js';
+import { uploadSpooledSteps } from './chunk-XKZPL3GE.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-HSUUTD4E.js';

package/dist/{chunk-KHINKAHX.js → chunk-NMF4EUVS.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-4NOO2ZFW.js';
-import { describeCallFailure } from './chunk-WWHWF3KZ.js';
+import { isPlaceholderCommand } from './chunk-4TIZUKGG.js';
+import { describeCallFailure } from './chunk-SXJVL7NS.js';
 import { checkFit } from './chunk-RQGHHEM7.js';
 import { builtinKind } from './chunk-P7BEZAEU.js';
-import { WorkCommandError, getJson } from './chunk-GPRIHEGQ.js';
+import { WorkCommandError, getJson } from './chunk-U4HMGT3L.js';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
 import { signerFor } from './chunk-APSYTJ6I.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-HDSDUTX4.js';

package/dist/{chunk-NYZAIBNV.js → chunk-ORLL2A45.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-CWAZNCFQ.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-P7RX33YS.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fitImageBuildMemory } from './chunk-WHSYPR3U.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
@@ -8,12 +8,12 @@ import { RUNNER_PROTOCOL } from './chunk-WRU3K5AN.js';
 import { writePendingUpdate } from './chunk-TZQIEUDE.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-X7UUIHGH.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-KHINKAHX.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-NMF4EUVS.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-ZZSQYOY5.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-76QNSSOZ.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-WWHWF3KZ.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-OYSZGHJF.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-SXJVL7NS.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-YV7WULXQ.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-P7BEZAEU.js';
@@ -21,7 +21,7 @@ import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-2JPVI45I.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-GPRIHEGQ.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-U4HMGT3L.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-APSYTJ6I.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-KP6R7CV3.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-HDSDUTX4.js';
@@ -1751,7 +1751,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-I37TTGHI.js');
+  const { postJson: postJson2 } = await import('./work-cmd-B7YCAK5M.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2932,7 +2932,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-OL7QVTHJ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-LKB5L6SJ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-76QNSSOZ.js → chunk-OYSZGHJF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { execCapture } from './chunk-QQGZ5THT.js';
 import { GUEST_CID } from './chunk-HIGJTX5U.js';
-import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-WWHWF3KZ.js';
+import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-SXJVL7NS.js';
 import { runnerImageVersion } from './chunk-YV7WULXQ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-Z7HAIZ6X.js';
@@ -11,7 +11,7 @@ import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-2JPVI45I.js';
 import { readDu } from './chunk-YJLHUKYS.js';
 import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-SJZL5F3F.js';
-import { WorkCommandError } from './chunk-GPRIHEGQ.js';
+import { WorkCommandError } from './chunk-U4HMGT3L.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-V36AOTBP.js';
 import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-KP6R7CV3.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-HDSDUTX4.js';
@@ -2684,7 +2684,6 @@ var RELAY_ATTEMPTS = 20;
 var RELAY_WAIT_MS = 500;
 var BUSY_IMAGE_WAIT_MS = 5e3;
 var VOLUME_REMOVE_ATTEMPTS = 4;
-var WORKFLOW_PERMISSION_REASON = "workflow_permission_required";
 function withTunnelLog(opts, log) {
   return { ...opts, tunnelOptions: { log, ...opts?.tunnelOptions } };
 }

package/dist/{chunk-CWAZNCFQ.js → chunk-P7RX33YS.js}

@@ -3,20 +3,20 @@ import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-RJYKTWUP.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-W4ICX5WW.js';
-import { installScrubContext } from './chunk-IBG2ESJX.js';
+import { senderPidfile } from './chunk-JFLVUA43.js';
+import { installScrubContext } from './chunk-KCB6V5XH.js';
 import { writeDockerClientConfig } from './chunk-XTNMIV77.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-76QNSSOZ.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-OYSZGHJF.js';
 import { waitForAgent, vmExecArgs } from './chunk-QQGZ5THT.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-HIGJTX5U.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-WWHWF3KZ.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-SXJVL7NS.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-P7BEZAEU.js';
 import { readBranchHead, fetchCommit, diffBetween } from './chunk-Z7HAIZ6X.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-2JPVI45I.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-SJZL5F3F.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-GPRIHEGQ.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-U4HMGT3L.js';
 import { planArtifactUpload } from './chunk-HSUUTD4E.js';
 import { scrubText } from './chunk-V36AOTBP.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
@@ -1378,6 +1378,9 @@ function decideFromEvaluation(read) {
 function incompleteReason(reason, judgeNotRun) {
   return judgeNotRun === void 0 ? reason : `the judge did not run (${judgeNotRun}) \xB7 ${reason}`;
 }
+function unfinishedRelease(verdictReason, learned) {
+  return learned === WORKFLOW_PERMISSION_REASON ? { outcome: "failed", reason: WORKFLOW_PERMISSION_REASON } : { outcome: "incomplete", reason: verdictReason };
+}
 function waitMs(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -3229,8 +3232,12 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       sleep: deps.sleep ?? waitMs
     });
     if (decision.outcome === "incomplete") {
-      outcome = "incomplete";
-      verdictReason = scrubReason(incompleteReason(decision.reason, job.judgeNotRun), config);
+      const release2 = unfinishedRelease(
+        scrubReason(incompleteReason(decision.reason, job.judgeNotRun), config),
+        deps.container?.credentials.get(jobDirPath)?.reason
+      );
+      outcome = release2.outcome;
+      verdictReason = release2.reason;
       log.error(`${tag} the command exited 0 but the item is not done: ${verdictReason}`);
     }
   }

package/dist/{chunk-WWHWF3KZ.js → chunk-SXJVL7NS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-GPRIHEGQ.js';
+import { WorkCommandError, postJson } from './chunk-U4HMGT3L.js';
 import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-NIS2PIS4.js';
 import { signingFetchFor } from './chunk-F3EF56LQ.js';
 import { signerFor } from './chunk-APSYTJ6I.js';
@@ -107,6 +107,7 @@ var REVOKE_TIMEOUT_MS = 15e3;
 function isDue(expiresAtMs, nowMs) {
   return nowMs >= expiresAtMs - 10 * 6e4;
 }
+var WORKFLOW_PERMISSION_REASON = "workflow_permission_required";
 function classifyRefusal(err) {
   if (!(err instanceof WorkCommandError)) return { kind: "retry" };
   if (err.status === 401 || err.code === "claim_expired" || err.code === "claim_not_held") return { kind: "lease_lost" };
@@ -515,4 +516,4 @@ async function imageTargetFor(input) {
   return { ok: true, repository: resolved.source.repository, pinned: { commit: resolved.source.sha, ref: resolved.source.ref } };
 }
 
-export { BuildTokens, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };
+export { BuildTokens, WORKFLOW_PERMISSION_REASON, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };

package/dist/{chunk-GPRIHEGQ.js → chunk-U4HMGT3L.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-4EU4X2ML.js';
-import { workPageUrl } from './chunk-7UD5ONVI.js';
+import { detectActiveSession, autoConnect } from './chunk-3DSC2FN3.js';
+import { workPageUrl } from './chunk-IGIGNYZK.js';
 import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
 import { resolveRepoIdentity } from './chunk-V36AOTBP.js';
 import { C } from './chunk-ANPNT6PM.js';

package/dist/{chunk-JCCUTTRI.js → chunk-XKZPL3GE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-4EU4X2ML.js';
+import { autoConnect, detectActiveSession } from './chunk-3DSC2FN3.js';
 import { acquireSpoolLockAt } from './chunk-HSUUTD4E.js';
 import { resolveRepoIdentity } from './chunk-V36AOTBP.js';
 import { C } from './chunk-ANPNT6PM.js';

package/dist/{chunk-YQTQQTYK.js → chunk-ZWBRHH3L.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-4EU4X2ML.js';
+import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-3DSC2FN3.js';
 import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-V36AOTBP.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F3EF56LQ.js';