@outerlayer/cli 0.33.0-next.20261021171625 → 0.33.0-next.20261021223634

package/dist/{chunk-ZBN4JGTJ.js → chunk-A3H27SYX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-ZZSQYOY5.js';
+import { currentLink } from './chunk-3VGDZ23W.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-3WW2TL7V.js → chunk-AKHGQKNR.js}

@@ -22661,12 +22661,47 @@ var DemoChapterSchema = external_exports.strictObject(chapterFields).refine((cha
   message: "a chapter must end after it starts",
   path: ["end"]
 });
-var DemoManifestSchema = external_exports.strictObject({
-  schemaVersion: external_exports.literal(1),
+var DemoStillSchema = external_exports.strictObject({
+  /** The index, in the chapter's checks, of the check the still follows. */
+  check: external_exports.number().int().min(0),
+  /** The PNG file, as a path relative to the manifest's folder. */
+  file: external_exports.string().min(1).max(500),
+  /** SHA-256 of the PNG file's bytes, in lower-case hex. */
+  sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+});
+var chapterWithStillsFields = {
+  ...chapterFields,
+  stills: external_exports.array(DemoStillSchema).max(DEMO_CHECKS_MAX)
+};
+function stillsFollowPassedChecks(chapter, context) {
+  let previous = -1;
+  for (const [index, still] of chapter.stills.entries()) {
+    const check2 = chapter.checks[still.check];
+    if (check2 === void 0 || !check2.passed) {
+      context.addIssue({ code: "custom", path: ["stills", index, "check"], message: "a still must follow a check that passed" });
+    } else if (still.check <= previous) {
+      context.addIssue({ code: "custom", path: ["stills", index, "check"], message: "stills must follow distinct checks, in order" });
+    }
+    previous = still.check;
+  }
+}
+var endsAfterStart = (chapter) => chapter.end > chapter.start;
+var DemoChapterV2Schema = external_exports.strictObject(chapterWithStillsFields).refine(endsAfterStart, { message: "a chapter must end after it starts", path: ["end"] }).superRefine(stillsFollowPassedChecks);
+var manifestFields = {
   /** The recorded video, as a path relative to the manifest's folder. */
-  video: external_exports.string().min(1).max(500),
+  video: external_exports.string().min(1).max(500)
+};
+var DemoManifestV1Schema = external_exports.strictObject({
+  schemaVersion: external_exports.literal(1),
+  ...manifestFields,
   chapters: external_exports.array(DemoChapterSchema).min(1).max(DEMO_CHAPTERS_MAX)
 });
+var DemoManifestV2Schema = external_exports.strictObject({
+  schemaVersion: external_exports.literal(2),
+  ...manifestFields,
+  chapters: external_exports.array(DemoChapterV2Schema).min(1).max(DEMO_CHAPTERS_MAX)
+});
+var DemoManifestSchema = external_exports.discriminatedUnion("schemaVersion", [DemoManifestV1Schema, DemoManifestV2Schema]);
 var DemoRecordChapterSchema = external_exports.strictObject({
   ...chapterFields,
   /** The `clientArtifactId` of the chapter's clip. */
@@ -22674,10 +22709,35 @@ var DemoRecordChapterSchema = external_exports.strictObject({
   /** True when the clip was bound to the chapter's criterion: every check passed. */
   bound: external_exports.boolean()
 });
-external_exports.strictObject({
+var DemoComparableSchema = external_exports.enum(["yes", "no", "not checked"]);
+var DemoRegionSchema = external_exports.strictObject({
+  x: external_exports.number().int().min(0),
+  y: external_exports.number().int().min(0),
+  width: external_exports.number().int().positive(),
+  height: external_exports.number().int().positive()
+});
+var DemoRecordChapterV2Schema = external_exports.strictObject({
+  ...chapterFields,
+  clipArtifactId: external_exports.string().min(1).max(64),
+  bound: external_exports.boolean(),
+  comparable: DemoComparableSchema,
+  /** The first run's stills: the check each follows and the SHA-256 of its file. */
+  stills: external_exports.array(DemoStillSchema.pick({ check: true, sha256: true })).max(DEMO_CHECKS_MAX),
+  /** The first still that differs between the runs. Present exactly when `comparable` is `no`. */
+  difference: external_exports.strictObject({ check: external_exports.number().int().min(0), region: DemoRegionSchema }).optional()
+}).refine((chapter) => chapter.end > chapter.start, { message: "a chapter must end after it starts", path: ["end"] }).refine((chapter) => chapter.comparable === "no" === (chapter.difference !== void 0), {
+  message: "a chapter has a difference exactly when it is not comparable",
+  path: ["difference"]
+});
+var DemoRecordV1Schema = external_exports.strictObject({
   schemaVersion: external_exports.literal(1),
   chapters: external_exports.array(DemoRecordChapterSchema).min(1).max(DEMO_CHAPTERS_MAX)
 });
+var DemoRecordV2Schema = external_exports.strictObject({
+  schemaVersion: external_exports.literal(2),
+  chapters: external_exports.array(DemoRecordChapterV2Schema).min(1).max(DEMO_CHAPTERS_MAX)
+});
+external_exports.discriminatedUnion("schemaVersion", [DemoRecordV1Schema, DemoRecordV2Schema]);
 /*! Bundled license information:
 
 xmlchars/xml/1.0/ed5.js:

package/dist/{chunk-XT5SOJRC.js → chunk-AKR32WHV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-3WW2TL7V.js';
+import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-AKHGQKNR.js';
 import { createHash } from 'crypto';
 import { readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, renameSync, unlinkSync, writeFileSync, stat as stat$1, unwatchFile, watchFile, watch as watch$1 } from 'fs';
 import { type, homedir } from 'os';

package/dist/{chunk-P7BEZAEU.js → chunk-ALSE7YKX.js}

@@ -35,7 +35,11 @@ var DEFAULT_CHECK_TIME_LIMIT_MINUTES = 10;
 var CHECKS_KEYS = ["timeLimitMinutes"];
 var MAX_CHECK_TIME_LIMIT_MINUTES = 240;
 var DEFAULT_BUILD = { memory: "8g", cpus: 4, pids: 4096, disk: "40g", variables: [] };
-var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts"];
+function imageBuildOf(config) {
+  if (builtinKind(config.hooks.provision) !== "vm") return "host";
+  return config.build?.imageBuild ?? "vm";
+}
+var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts", "imageBuild"];
 var HOUSEKEEPING_KEYS = ["jobsKeepDays", "buildCacheMax", "minFreeDisk"];
 var DEFAULT_JOBS_KEEP_DAYS = 30;
 var DEFAULT_BUILD_CACHE_MAX = "20g";
@@ -396,6 +400,9 @@ function resolveBuild(configPath, block) {
       if (!allowHosts.includes(host)) allowHosts.push(host);
     }
   }
+  if (given.imageBuild !== void 0 && given.imageBuild !== "vm" && given.imageBuild !== "host") {
+    fail(configPath, "runner.build.imageBuild", "must be vm or host");
+  }
   return {
     memory: given.memory ?? DEFAULT_BUILD.memory,
     cpus: given.cpus ?? DEFAULT_BUILD.cpus,
@@ -403,8 +410,9 @@ function resolveBuild(configPath, block) {
     disk: given.disk ?? DEFAULT_BUILD.disk,
     variables,
     ...destinations.length === 0 ? {} : { destinations },
-    ...allowHosts === void 0 ? {} : { allowHosts }
+    ...allowHosts === void 0 ? {} : { allowHosts },
+    ...given.imageBuild === void 0 ? {} : { imageBuild: given.imageBuild }
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };

package/dist/{chunk-5T2VOSIL.js → chunk-CHXYLCMA.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { RecipeError } from './chunk-3Z3MPR55.js';
-import { BUILDKIT_IMAGE } from './chunk-LK2S5XZH.js';
-import { compareVersions } from './chunk-XT5SOJRC.js';
-import { ensureHostKey } from './chunk-APSYTJ6I.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-KP6R7CV3.js';
+import { BUILDKIT_IMAGE } from './chunk-LHYO4RDP.js';
+import { compareVersions } from './chunk-AKR32WHV.js';
+import { ensureHostKey } from './chunk-JT3YO5MH.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-ESP5VZBD.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-HDSDUTX4.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { StringDecoder } from 'string_decoder';

package/dist/{chunk-GXKWPOK6.js → chunk-CMU6QJHE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-MV52FCSG.js';
-import { runnerImageVersion } from './chunk-IWYS4ERC.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-LK2S5XZH.js';
+import { MIN_ENGINE_MAJOR } from './chunk-X5LFLYSD.js';
+import { runnerImageVersion } from './chunk-533QGXGZ.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-LHYO4RDP.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-TZQIEUDE.js → chunk-CNRMP6EN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-UJIG5BU7.js → chunk-CV2S5L4J.js}

@@ -1,29 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-YGXKXL4Q.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-X7UUIHGH.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-72YES3RL.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-LH3KULPL.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-WHSYPR3U.js';
+import { fitImageBuildMemory } from './chunk-M5ZXOQYS.js';
 import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
-import { writePendingUpdate } from './chunk-TZQIEUDE.js';
+import { writePendingUpdate } from './chunk-CNRMP6EN.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-RHBFNZ7J.js';
-import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-ZZSQYOY5.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-LBPK2TPR.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-3VGDZ23W.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-MV52FCSG.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-QNVIGO5X.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-IWYS4ERC.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, freeBytes, formatBytes, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-X5LFLYSD.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-KDM77TVX.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-533QGXGZ.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-P7BEZAEU.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-T5TBGOT6.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ALSE7YKX.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-IPJ6HR7E.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-5T2VOSIL.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-CHXYLCMA.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-X7ML37UF.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-APSYTJ6I.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-KP6R7CV3.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-UIBTEDLA.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-JT3YO5MH.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir, imagesDir, builderCacheDiskPath } from './chunk-ESP5VZBD.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-HDSDUTX4.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-XD4ZCMA4.js';
@@ -817,6 +816,7 @@ async function runHousekeeping(options) {
       }
     }
   }
+  freed += removeStaleBuilderCaches(options, nowMs);
   const spoolPath = spoolDir(root);
   const spoolFiles = listDir(spoolPath).flatMap((name) => {
     const mtimeMs = mtimeOf(join(spoolPath, name));
@@ -857,6 +857,25 @@ async function removeStaleRootDisks(root, unfinished, options) {
   }
   return freed;
 }
+function removeStaleBuilderCaches(options, nowMs) {
+  let freed = 0;
+  for (const owner of listDir(imagesDir(options.configPath))) {
+    for (const name of listDir(join(imagesDir(options.configPath), owner))) {
+      const path = builderCacheDiskPath(options.configPath, owner, name);
+      const mtimeMs = mtimeOf(path);
+      if (mtimeMs === void 0 || nowMs - mtimeMs < options.keepDays * 864e5) continue;
+      const size = sizeOf(path);
+      try {
+        rmSync(path, { force: true });
+        freed += size;
+        options.log.line(`housekeeping: removed the builder cache disk of ${owner}/${name} (${formatBytes(size)}), last used ${formatDuration(nowMs - mtimeMs)} ago`);
+      } catch (err) {
+        options.log.error(`housekeeping: could not remove the builder cache disk of ${owner}/${name}: ${describeCallFailure(err)}`);
+      }
+    }
+  }
+  return freed;
+}
 var HOOKS_DIR_NAME = "git-hooks";
 var CO_AUTHOR_FILE = "co-author";
 var HOOKS = [
@@ -1751,7 +1770,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-UTD4Y7W3.js');
+  const { postJson: postJson2 } = await import('./work-cmd-QQDUI3YX.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2947,7 +2966,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-4BL6XRWJ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-AXDPZJU4.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -3015,6 +3034,11 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     return [];
   });
   for (const buildId of runningMicroVms) log.line(`stopped microVM build ${buildId}, left running by an earlier runner`);
+  const sweptBuilders = await sweepImageBuilders(configPath, runtimeOf(state).vm, (line) => log.error(line)).catch((err) => {
+    log.error(`a builder microVM an earlier runner left could not be removed: ${describeCallFailure(err)}`);
+    return [];
+  });
+  for (const buildId of sweptBuilders) log.line(`removed builder microVM ${buildId}, left by an earlier runner`);
   const attemptLogs = attemptLogsOf(state);
   for (const { job, format } of listUnreadableJobs(jobsDir(configPath))) {
     log.error(`leaving job ${job.queue} #${job.item} alone: its job-state format ${format} is not one this version reads`);

package/dist/{chunk-OF4TFWKR.js → chunk-DE7YSNDX.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-X2Y3B4JH.js';
-import { resolveRepoIdentity } from './chunk-XT5SOJRC.js';
+import { autoConnect, detectActiveSession } from './chunk-6TFTRVOA.js';
+import { resolveRepoIdentity } from './chunk-AKR32WHV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-VQ2JGZSC.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-3H7NZPYG.js → chunk-DM4EGXDO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-3WW2TL7V.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-AKHGQKNR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-H6Y5D6J7.js → chunk-EG7KPSSP.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-3H7NZPYG.js';
-import { isAgentsMdLayout } from './chunk-ZAJKEHIE.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-F3EF56LQ.js';
+import { sanitizeTerminal } from './chunk-DM4EGXDO.js';
+import { isAgentsMdLayout } from './chunk-4IG6EZHU.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-VQ2JGZSC.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { machineSkillsState, staleClaudeSkills } from './chunk-XRQ7DABQ.js';
-import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-YW4PEGLN.js';
+import { machineSkillsState, staleClaudeSkills } from './chunk-Q2D4M3GC.js';
+import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-KUTZ6XLS.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-WXEPMPHK.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-JUXATN46.js';
+import { hasSymlinkComponent } from './chunk-LN4WDONI.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-OGCG5LOX.js';
 import { existsSync, readFileSync, writeFileSync, realpathSync, readdirSync } from 'fs';
 import { join, dirname, posix } from 'path';
 

package/dist/{chunk-KP6R7CV3.js → chunk-ESP5VZBD.js}

@@ -31,6 +31,9 @@ function imagesDir(configPath) {
 function repoCacheDir(configPath, owner, name) {
   return join(runnerDir(configPath), "repos", owner, name);
 }
+function builderCacheDiskPath(configPath, owner, name) {
+  return join(imagesDir(configPath), owner, name, "builder-cache.ext4");
+}
 function buildsDir(configPath) {
   return join(runnerDir(configPath), "builds");
 }
@@ -84,4 +87,4 @@ function deliveryDir(repository, sha) {
   return `${BUILD_HOME}/.outerlayer/context/${repository}/${sha}`;
 }
 
-export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, buildsDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, keptContextDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };
+export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, builderCacheDiskPath, buildsDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, keptContextDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };

package/dist/{chunk-RQGHHEM7.js → chunk-HBBCQ5NE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-P7BEZAEU.js';
+import { builtinKind } from './chunk-ALSE7YKX.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { runnerDir } from './chunk-KP6R7CV3.js';
+import { runnerDir } from './chunk-ESP5VZBD.js';
 import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-HDSDUTX4.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';

package/dist/{chunk-NHXJU7CM.js → chunk-HT7LVCTX.js}

@@ -680,11 +680,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-VSDT77BZ.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-UBOJHGQM.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-DHMD5WBU.js');
+  const { governanceOf } = await import('./control-plane-launch-R4X63DYW.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-T5TBGOT6.js → chunk-IPJ6HR7E.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-APSYTJ6I.js → chunk-JT3YO5MH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-QNVIGO5X.js → chunk-KDM77TVX.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-X7ML37UF.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-D73OLAYE.js';
-import { signingFetchFor } from './chunk-F3EF56LQ.js';
-import { signerFor } from './chunk-APSYTJ6I.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-KP6R7CV3.js';
+import { WorkCommandError, postJson } from './chunk-UIBTEDLA.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-RVWADVBN.js';
+import { signingFetchFor } from './chunk-VQ2JGZSC.js';
+import { signerFor } from './chunk-JT3YO5MH.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-ESP5VZBD.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';

package/dist/{chunk-YW4PEGLN.js → chunk-KUTZ6XLS.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { splitRawFile } from './chunk-JUXATN46.js';
+import { splitRawFile } from './chunk-OGCG5LOX.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';

package/dist/{chunk-RHBFNZ7J.js → chunk-LBPK2TPR.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-2FPEB36J.js';
-import { describeCallFailure } from './chunk-QNVIGO5X.js';
-import { checkFit } from './chunk-RQGHHEM7.js';
-import { builtinKind } from './chunk-P7BEZAEU.js';
-import { WorkCommandError, getJson } from './chunk-X7ML37UF.js';
-import { sanitizeTerminal } from './chunk-3H7NZPYG.js';
-import { signerFor } from './chunk-APSYTJ6I.js';
+import { isPlaceholderCommand } from './chunk-O6NG67Y7.js';
+import { describeCallFailure } from './chunk-KDM77TVX.js';
+import { checkFit } from './chunk-HBBCQ5NE.js';
+import { builtinKind, imageBuildOf } from './chunk-ALSE7YKX.js';
+import { builderDiskPinned } from './chunk-LHYO4RDP.js';
+import { WorkCommandError, getJson } from './chunk-UIBTEDLA.js';
+import { sanitizeTerminal } from './chunk-DM4EGXDO.js';
+import { signerFor } from './chunk-JT3YO5MH.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-HDSDUTX4.js';
 import { closeSync, openSync, constants } from 'fs';
 import { totalmem } from 'os';
@@ -158,6 +159,19 @@ function managedProblems(facts) {
       reason: "runner.build.allowHosts is not set, and a managed runner needs it so that a build reaches only the public hosts it lists. List the hosts your builds need; an empty list allows none"
     });
   }
+  if (builtinKind(facts.provision) === "vm") {
+    if (facts.imageBuild === "host") {
+      problems.push({
+        condition: "imageBuild",
+        reason: "runner.build.imageBuild is host, and a managed runner builds its images in a builder microVM, because a recipe step on the host could reach the host's own services and network. Remove runner.build.imageBuild or set it to vm"
+      });
+    } else if (!facts.builderDiskPinned) {
+      problems.push({
+        condition: "imageBuild",
+        reason: "this release of the CLI pins no builder root disk, so it cannot build images in a builder microVM, which a managed runner needs for runner.build.imageBuild. Update the CLI to a release that pins one"
+      });
+    }
+  }
   return problems;
 }
 function managedFactsOf(config, probes) {
@@ -165,7 +179,9 @@ function managedFactsOf(config, probes) {
     provision: config.hooks.provision,
     jailer: probes.jailer ?? "unknown",
     credentials: claudeCredentialVariablesSet(probes.env),
-    allowHosts: config.build?.allowHosts
+    allowHosts: config.build?.allowHosts,
+    imageBuild: imageBuildOf(config),
+    builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
   };
 }
 function checkBlocked(config, probes) {

package/dist/{chunk-X7UUIHGH.js → chunk-LH3KULPL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-LK2S5XZH.js → chunk-LHYO4RDP.js}

@@ -52,6 +52,14 @@ var HOST_HELPER_SHA256 = {
 function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
   return hashes[arch] !== "0".repeat(64);
 }
+var BUILDER_DISK_VERSION = "1";
+var BUILDER_DISK_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/builder-${BUILDER_DISK_VERSION}`;
+var BUILDER_DISK_SHA256 = {
+  x86_64: "fb581f3cc5a7329b2f65b5d62e42be8a53cf845596a76d7ad938ba4c2598dc37"
+};
+function builderDiskPinned(arch = "x86_64", hashes = BUILDER_DISK_SHA256) {
+  return hashes[arch] !== "0".repeat(64);
+}
 var VOICE_PACK_VERSION = "kokoro-82m-v1.0-ort-1.21.0";
 var KOKORO_REVISION = "1939ad2a8e416c0acfeecc08a694d14ef25f2231";
 var KOKORO_BASE_URL = `https://huggingface.co/onnx-community/Kokoro-82M-v1.0-ONNX/resolve/${KOKORO_REVISION}`;
@@ -96,4 +104,4 @@ var FFMPEG_STATIC = {
 };
 var MEDIA_PINS = `${VOICE_PACK_VERSION}+${FFMPEG_BUILD_TAG}`;
 
-export { BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, firecrackerArch, guestAssetsPinned, hostHelperPinned };
+export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned };

package/dist/{chunk-WXEPMPHK.js → chunk-LN4WDONI.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
 import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import { CONTEXT_PIN_FILENAME } from './chunk-JUXATN46.js';
+import { CONTEXT_PIN_FILENAME } from './chunk-OGCG5LOX.js';
 import { execFileSync } from 'child_process';
 import { lstatSync, existsSync, unlinkSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';

package/dist/{chunk-FE3RTGJN.js → chunk-M5OBRUQE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-YW4PEGLN.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-KUTZ6XLS.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-JUXATN46.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-OGCG5LOX.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-WHSYPR3U.js → chunk-M5ZXOQYS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-RQGHHEM7.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-HBBCQ5NE.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-OX7CHZTJ.js → chunk-N3KK5BKF.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-GI6LOIHS.js';
+import { runEmit } from './chunk-TNJXCNQ6.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { installStarterPack } from './chunk-QCDVKCHA.js';
-import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-ZAJKEHIE.js';
+import { installStarterPack } from './chunk-UWEJ6HGB.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-4IG6EZHU.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-D73OLAYE.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-YW4PEGLN.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-RVWADVBN.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-KUTZ6XLS.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-WXEPMPHK.js';
+import { linkedAgentsPath } from './chunk-LN4WDONI.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { generatedHeaderSource } from './chunk-JUXATN46.js';
+import { generatedHeaderSource } from './chunk-OGCG5LOX.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-4LU7MFJO.js → chunk-NOXK3QW6.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-X2Y3B4JH.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-XT5SOJRC.js';
+import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-6TFTRVOA.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-AKR32WHV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F3EF56LQ.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-VQ2JGZSC.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-3WW2TL7V.js';
+import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-AKHGQKNR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, existsSync } from 'fs';
 import { join, dirname, basename } from 'path';

package/dist/{chunk-2FPEB36J.js → chunk-O6NG67Y7.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-GXKWPOK6.js';
-import { MIN_ENGINE_MAJOR } from './chunk-MV52FCSG.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-NJS7JJYN.js';
-import { runnerCredentialProblem } from './chunk-P7BEZAEU.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-CMU6QJHE.js';
+import { MIN_ENGINE_MAJOR } from './chunk-X5LFLYSD.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-52C3SSNF.js';
+import { runnerCredentialProblem } from './chunk-ALSE7YKX.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';