@outerlayer/cli 0.33.0-next.20261021171323 → 0.33.0-next.20261021194303

package/README.md

@@ -228,7 +228,11 @@ content:
   downloads a guest kernel and a guest helper from the releases of the public
   repository `outerlayerai/guest-assets` on github.com. The runner checks each
   file against a sha256 pinned in the CLI, and the requests send nothing about
-  the host. The microVM reaches the network only
+  the host. An image build in a builder microVM also needs the files of the
+  runner's tools layer, which the runner downloads on the host. It gets `gh`,
+  `tini` and FFmpeg from github.com. It gets the narration voice pack from
+  huggingface.co and registry.npmjs.org. Each file is checked against a sha256
+  pinned in the CLI. The microVM reaches the network only
   through the same tunnel a container build uses, which the runner serves on
   Unix sockets and the guest reaches over vsock. In a build with Docker, the
   guest forwards the proxy connections of containers and `docker build` steps

package/dist/{agent-setup-NSUX64RU.js → agent-setup-P5PWEGZM.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-OX7CHZTJ.js';
+export { keepHandWritten, runAgentSetup } from './chunk-5ZUT3IK3.js';
 import './chunk-GI6LOIHS.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-QCDVKCHA.js';
 import './chunk-ZAJKEHIE.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-D73OLAYE.js';
+import './chunk-WRX2MCDV.js';
 import './chunk-FE3RTGJN.js';
-import './chunk-F3EF56LQ.js';
+import './chunk-VQ2JGZSC.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-APSYTJ6I.js';
-import './chunk-KP6R7CV3.js';
+import './chunk-JT3YO5MH.js';
+import './chunk-ESP5VZBD.js';
 import './chunk-HDSDUTX4.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';

package/dist/{build-HU24C46Z.js → build-SK5BYBER.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-BSHUTMXV.js';
-import './chunk-T5TBGOT6.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-TPGHCH2H.js';
+import './chunk-IPJ6HR7E.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-3Z3MPR55.js';
-import './chunk-LK2S5XZH.js';
-import './chunk-KP6R7CV3.js';
+import './chunk-LHYO4RDP.js';
+import './chunk-ESP5VZBD.js';
 import './chunk-HDSDUTX4.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-21T17:15:21.001Z+04c1646","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-21T19:45:38.796Z+9eb87e9","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-VFREWHZA.js → builder-X4PIGYS6.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-ZZWWKBLL.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-KUOY5UIR.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-LK2S5XZH.js';
-import './chunk-GKNF4D62.js';
-import './chunk-APSYTJ6I.js';
-import './chunk-KP6R7CV3.js';
+import './chunk-LHYO4RDP.js';
+import './chunk-XT5SOJRC.js';
+import './chunk-JT3YO5MH.js';
+import './chunk-ESP5VZBD.js';
 import './chunk-HDSDUTX4.js';
 import './chunk-3WW2TL7V.js';
 import './chunk-XD4ZCMA4.js';

package/dist/{check-3TQJDGKM.js → check-DPVNDAQQ.js}

@@ -1,62 +1,62 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-LAS3DOTW.js';
-import './chunk-TI5Y242B.js';
-import './chunk-X7UUIHGH.js';
+import { probeCredentials } from './chunk-ENV3AIWQ.js';
+import './chunk-TGXYNEI7.js';
+import './chunk-LH3KULPL.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-WHSYPR3U.js';
+import './chunk-M5ZXOQYS.js';
 import './chunk-YKYCE4HY.js';
-import './chunk-TZQIEUDE.js';
+import './chunk-CNRMP6EN.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-RJYKTWUP.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-AR6UB2BP.js';
-import './chunk-VXYPD33W.js';
-import './chunk-7LP3F2QH.js';
+import './chunk-UVZ43SW3.js';
+import './chunk-NNNUME4Y.js';
+import './chunk-4OKOLFPH.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-XTNMIV77.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-KQON2T4A.js';
-import './chunk-YYYRBYWG.js';
-import './chunk-ZZSQYOY5.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-OVSUSOHL.js';
+import './chunk-3VGDZ23W.js';
 import './chunk-TBT347UY.js';
-import './chunk-CI6PRMWZ.js';
-import './chunk-LQFDTQC2.js';
-import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-G7QBSH3X.js';
+import './chunk-CG5TWQ23.js';
+import './chunk-XQTT3222.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-BBK62GXM.js';
+import './chunk-2PGI6RDE.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-BXA6JLHQ.js';
-import './chunk-IWYS4ERC.js';
+import './chunk-LTZVMKQS.js';
+import './chunk-533QGXGZ.js';
 import './chunk-TQMI335S.js';
-import './chunk-NJS7JJYN.js';
-import { DEFAULT_UNIT_NAME } from './chunk-RQGHHEM7.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-P7BEZAEU.js';
+import './chunk-52C3SSNF.js';
+import { DEFAULT_UNIT_NAME } from './chunk-HBBCQ5NE.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-ALSE7YKX.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-BSHUTMXV.js';
-import './chunk-T5TBGOT6.js';
+import './chunk-TPGHCH2H.js';
+import './chunk-IPJ6HR7E.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-ZZWWKBLL.js';
+import './chunk-KUOY5UIR.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-LK2S5XZH.js';
-import './chunk-SOTJ2V3A.js';
-import './chunk-JKXTG3BV.js';
-import './chunk-HPOW2VCB.js';
+import './chunk-LHYO4RDP.js';
+import './chunk-XRZGT54P.js';
+import './chunk-ZPW6PUNK.js';
+import './chunk-VFW6I4GG.js';
 import './chunk-3H7NZPYG.js';
-import './chunk-GKNF4D62.js';
+import './chunk-XT5SOJRC.js';
 import './chunk-ZAJKEHIE.js';
 import './chunk-6C3ZVE62.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-D73OLAYE.js';
+import './chunk-WRX2MCDV.js';
 import './chunk-FE3RTGJN.js';
-import './chunk-F3EF56LQ.js';
+import './chunk-VQ2JGZSC.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-APSYTJ6I.js';
-import './chunk-KP6R7CV3.js';
+import './chunk-JT3YO5MH.js';
+import './chunk-ESP5VZBD.js';
 import { claudeEnvPath } from './chunk-HDSDUTX4.js';
-import './chunk-NHXJU7CM.js';
+import './chunk-OXSFOLWE.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';

package/dist/chunk-2PGI6RDE.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { createHash } from 'crypto';
+import { createReadStream, mkdirSync, rmSync, renameSync, existsSync, statSync, createWriteStream } from 'fs';
+import { dirname } from 'path';
+import { once } from 'events';
+
+createRequire(import.meta.url);
+var VoiceDownloadError = class extends Error {
+  constructor(message, retryable = false) {
+    super(message);
+    this.retryable = retryable;
+  }
+};
+async function sha256OfFile(path) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+}
+function withoutCredentials(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    return parsed.toString();
+  } catch {
+    return "(an invalid URL)";
+  }
+}
+var ATTEMPTS = 3;
+async function requestRest(params) {
+  const { url, part, name, fetchImpl, progress } = params;
+  const offset = existsSync(part) ? statSync(part).size : 0;
+  const response = await fetchImpl(url, offset > 0 ? { headers: { range: `bytes=${offset}-` } } : {});
+  if (response.status === 416 && offset > 0) {
+    await response.body?.cancel();
+    return;
+  }
+  if (!response.ok || response.body === null) {
+    await response.body?.cancel();
+    throw new VoiceDownloadError(`cannot download ${name} from ${withoutCredentials(url)}: the server answered ${response.status}`, response.status >= 500);
+  }
+  const resumed = response.status === 206;
+  const start = resumed ? offset : 0;
+  const total = Number(response.headers.get("content-length") ?? 0) + start;
+  const out = createWriteStream(part, { flags: resumed ? "a" : "w" });
+  let written = start;
+  let lastReport = 0;
+  try {
+    for await (const chunk of response.body) {
+      if (!out.write(chunk)) await once(out, "drain");
+      written += chunk.length;
+      const now = Date.now();
+      if (progress !== void 0 && now - lastReport >= 1e3) {
+        lastReport = now;
+        progress(`  downloading ${name}: ${(written / 1048576).toFixed(0)}${total > start ? ` of ${(total / 1048576).toFixed(0)}` : ""} MiB`);
+      }
+    }
+  } finally {
+    out.end();
+    await once(out, "close");
+  }
+}
+async function downloadPinned(params) {
+  const { url, dest, sha256, name } = params;
+  mkdirSync(dirname(dest), { recursive: true });
+  const part = `${dest}.part`;
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      await requestRest({ ...params, part });
+      break;
+    } catch (err) {
+      const refused = err instanceof VoiceDownloadError && !err.retryable;
+      if (refused || attempt === ATTEMPTS) {
+        throw err instanceof VoiceDownloadError ? err : new VoiceDownloadError(`cannot download ${name} from ${withoutCredentials(url)}: ${String(err)}`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, params.retryDelayMs ?? 500));
+    }
+  }
+  const digest = await sha256OfFile(part);
+  if (digest !== sha256) {
+    rmSync(part, { force: true });
+    throw new VoiceDownloadError(
+      `the downloaded ${name} has sha256 ${digest}, not the pinned ${sha256} \u2014 it was discarded and ${params.stopped ?? "nothing was spoken"}`
+    );
+  }
+  renameSync(part, dest);
+}
+
+export { VoiceDownloadError, downloadPinned, sha256OfFile };

package/dist/{chunk-ZZSQYOY5.js → chunk-3VGDZ23W.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-7LP3F2QH.js → chunk-4OKOLFPH.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-JKXTG3BV.js';
+import { autoConnect, detectActiveSession } from './chunk-ZPW6PUNK.js';
 import { acquireSpoolLockAt } from './chunk-3H7NZPYG.js';
-import { resolveRepoIdentity } from './chunk-GKNF4D62.js';
+import { resolveRepoIdentity } from './chunk-XT5SOJRC.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F3EF56LQ.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-VQ2JGZSC.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-3WW2TL7V.js';

package/dist/{chunk-NJS7JJYN.js → chunk-52C3SSNF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-RQGHHEM7.js';
-import { RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { DEFAULT_UNIT_NAME } from './chunk-HBBCQ5NE.js';
+import { RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { claudeEnvPath, withoutCredentialLines } from './chunk-HDSDUTX4.js';
 import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';

package/dist/{chunk-IWYS4ERC.js → chunk-533QGXGZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-54GBOMDW.js → chunk-543ZX5TM.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-JKXTG3BV.js';
-import { resolveRepoIdentity } from './chunk-GKNF4D62.js';
+import { autoConnect, detectActiveSession } from './chunk-ZPW6PUNK.js';
+import { resolveRepoIdentity } from './chunk-XT5SOJRC.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-VQ2JGZSC.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-OX7CHZTJ.js → chunk-5ZUT3IK3.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-QCDVKCHA.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-ZAJKEHIE.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-D73OLAYE.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-WRX2MCDV.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-YW4PEGLN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-WXEPMPHK.js';

package/dist/{chunk-ZBN4JGTJ.js → chunk-A3H27SYX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-ZZSQYOY5.js';
+import { currentLink } from './chunk-3VGDZ23W.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-P7BEZAEU.js → chunk-ALSE7YKX.js}

@@ -35,7 +35,11 @@ var DEFAULT_CHECK_TIME_LIMIT_MINUTES = 10;
 var CHECKS_KEYS = ["timeLimitMinutes"];
 var MAX_CHECK_TIME_LIMIT_MINUTES = 240;
 var DEFAULT_BUILD = { memory: "8g", cpus: 4, pids: 4096, disk: "40g", variables: [] };
-var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts"];
+function imageBuildOf(config) {
+  if (builtinKind(config.hooks.provision) !== "vm") return "host";
+  return config.build?.imageBuild ?? "vm";
+}
+var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts", "imageBuild"];
 var HOUSEKEEPING_KEYS = ["jobsKeepDays", "buildCacheMax", "minFreeDisk"];
 var DEFAULT_JOBS_KEEP_DAYS = 30;
 var DEFAULT_BUILD_CACHE_MAX = "20g";
@@ -396,6 +400,9 @@ function resolveBuild(configPath, block) {
       if (!allowHosts.includes(host)) allowHosts.push(host);
     }
   }
+  if (given.imageBuild !== void 0 && given.imageBuild !== "vm" && given.imageBuild !== "host") {
+    fail(configPath, "runner.build.imageBuild", "must be vm or host");
+  }
   return {
     memory: given.memory ?? DEFAULT_BUILD.memory,
     cpus: given.cpus ?? DEFAULT_BUILD.cpus,
@@ -403,8 +410,9 @@ function resolveBuild(configPath, block) {
     disk: given.disk ?? DEFAULT_BUILD.disk,
     variables,
     ...destinations.length === 0 ? {} : { destinations },
-    ...allowHosts === void 0 ? {} : { allowHosts }
+    ...allowHosts === void 0 ? {} : { allowHosts },
+    ...given.imageBuild === void 0 ? {} : { imageBuild: given.imageBuild }
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };