@outerlayer/cli 0.33.0-next.20261021171625 → 0.33.0-next.20261021223634

package/dist/{chunk-JUXATN46.js → chunk-OGCG5LOX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-3WW2TL7V.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-AKHGQKNR.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-XRQ7DABQ.js → chunk-Q2D4M3GC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { loadMachineSkillFiles, resolvePackRoot } from './chunk-YW4PEGLN.js';
+import { loadMachineSkillFiles, resolvePackRoot } from './chunk-KUTZ6XLS.js';
 import { MAINTAINED_SKILLS, maintainedLineVersion } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-3RS3RNGH.js → chunk-Q4YVHYHT.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-XFS2TMOB.js';
-import { CaptureDaemon } from './chunk-XT5SOJRC.js';
-import { spoolDir } from './chunk-NHXJU7CM.js';
+import { LiveUploader } from './chunk-SFJD4MRY.js';
+import { CaptureDaemon } from './chunk-AKR32WHV.js';
+import { spoolDir } from './chunk-HT7LVCTX.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-INCKTGMM.js → chunk-RQKQTRXM.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-X2Y3B4JH.js';
-import { acquireSpoolLockAt } from './chunk-3H7NZPYG.js';
-import { resolveRepoIdentity } from './chunk-XT5SOJRC.js';
+import { autoConnect, detectActiveSession } from './chunk-6TFTRVOA.js';
+import { acquireSpoolLockAt } from './chunk-DM4EGXDO.js';
+import { resolveRepoIdentity } from './chunk-AKR32WHV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F3EF56LQ.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-VQ2JGZSC.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { StepNameSchema, StepBodySchema } from './chunk-3WW2TL7V.js';
+import { StepNameSchema, StepBodySchema } from './chunk-AKHGQKNR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';
 import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, appendFileSync } from 'fs';

package/dist/{chunk-D73OLAYE.js → chunk-RVWADVBN.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-FE3RTGJN.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-F3EF56LQ.js';
+import { removeRetiredSkills } from './chunk-M5OBRUQE.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-VQ2JGZSC.js';
 import { withTokenHeader } from './chunk-HDSDUTX4.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-YW4PEGLN.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-KUTZ6XLS.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
-import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-JUXATN46.js';
+import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-OGCG5LOX.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';

package/dist/{chunk-6C3ZVE62.js → chunk-RW52CUFX.js}

@@ -5,7 +5,7 @@ import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfigStrict, CloudConfigError, readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-3WW2TL7V.js';
+import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-AKHGQKNR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';

package/dist/{chunk-XFS2TMOB.js → chunk-SFJD4MRY.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-INCKTGMM.js';
+import { uploadSpooledSteps } from './chunk-RQKQTRXM.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-3H7NZPYG.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-XT5SOJRC.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-DM4EGXDO.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-AKR32WHV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-F3EF56LQ.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-VQ2JGZSC.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-APSYTJ6I.js';
-import { writeSyncStatus, spoolDir } from './chunk-NHXJU7CM.js';
+import { signerFor, signRunnerRequest } from './chunk-JT3YO5MH.js';
+import { writeSyncStatus, spoolDir } from './chunk-HT7LVCTX.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
@@ -17,7 +17,7 @@ import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-3WW2TL7V.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-AKHGQKNR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { dirname, basename, join, sep } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';

package/dist/{chunk-77F7NGAZ.js → chunk-TA6TFYAN.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-ZBN4JGTJ.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-ZZSQYOY5.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-A3H27SYX.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-3VGDZ23W.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-KP6R7CV3.js';
+import { RUNNER_DIR_MODE } from './chunk-ESP5VZBD.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-GI6LOIHS.js → chunk-TNJXCNQ6.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-ZAJKEHIE.js';
+import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-4IG6EZHU.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-FE3RTGJN.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-YW4PEGLN.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-M5OBRUQE.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-KUTZ6XLS.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-JUXATN46.js';
+import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-OGCG5LOX.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-BSHUTMXV.js → chunk-TPGHCH2H.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-T5TBGOT6.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-IPJ6HR7E.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256 } from './chunk-LK2S5XZH.js';
-import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';
-import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-HDSDUTX4.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS } from './chunk-LHYO4RDP.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-ESP5VZBD.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-HDSDUTX4.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
-import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
+import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';
 import { execFile } from 'child_process';
@@ -147,6 +147,11 @@ async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
 }
 
 // src/runner/image/dockerfiles.ts
+var FETCHED_DIR = "fetched";
+var FETCHED_VOICE_DIR = "voice";
+var FETCHED_FFMPEG = "ffmpeg.tar.xz";
+var FETCHED_GH = "gh.tgz";
+var FETCHED_TINI = "tini";
 function plain(name, value, allowed) {
   if (!allowed.test(value)) throw new Error(`${name} holds a character a Dockerfile line cannot carry safely: ${JSON.stringify(value)}`);
   return value;
@@ -185,26 +190,31 @@ function toolsDockerfile(parts) {
   const stream = `NODE_USE_ENV_PROXY=1 node ${PROXY_WARNING_FLAG} -e 'const{pipeline}=require("stream/promises"),{Readable}=require("stream"),fs=require("fs");fetch(process.argv[1]).then((r)=>{if(!r.ok)throw new Error(process.argv[1]+" "+r.status);return pipeline(Readable.fromWeb(r.body),fs.createWriteStream(process.argv[2]))})'`;
   const voiceDir = `/out/opt/outerlayer/voice/${VOICE_PACK_VERSION}`;
   const checks = VOICE_PACK_FILES.map((file) => `echo "${file.sha256}  ${voiceDir}/${file.name}" | sha256sum -c -`);
-  return [
+  const fetched = parts.fetched === true;
+  const voice = fetched ? [`FROM ${nodeImage} AS voice`, `COPY ${FETCHED_DIR}/${FETCHED_VOICE_DIR}/ ${voiceDir}/`, `RUN ${checks.join(" \\\n && ")} \\`, " && chmod -R a+rX /out"] : [
     // The voice pack streams to disk, one pinned file at a time, because a 300 MB model must not sit in a build's memory. Its own stage keeps it cached when the CLI changes.
     `FROM ${nodeImage} AS voice`,
     `RUN mkdir -p ${voiceDir} \\`,
     ...VOICE_PACK_FILES.map((file) => ` && ${stream} ${file.url} ${voiceDir}/${file.name} \\`),
     ...checks.map((check) => ` && ${check} \\`),
-    " && chmod -R a+rX /out",
+    " && chmod -R a+rX /out"
+  ];
+  return [
+    ...voice,
     // ffmpeg and ffprobe are static LGPL builds. espeak-ng comes from the stage image's own package, with the libraries and loader it needs, and runs as a separate program.
     `FROM ${nodeImage} AS media`,
     "ARG TARGETARCH",
     "RUN apt-get update \\",
     " && apt-get install -y --no-install-recommends ca-certificates espeak-ng xz-utils \\",
     " && rm -rf /var/lib/apt/lists/*",
+    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_FFMPEG} /tmp/ffmpeg.tar.xz`] : [],
     "RUN set -eu \\",
     ` && case "$TARGETARCH" in \\`,
     `      amd64) ffmpeg_file=${FFMPEG_STATIC.amd64.file}; ffmpeg_sha=${FFMPEG_STATIC.amd64.sha256} ;; \\`,
     `      arm64) ffmpeg_file=${FFMPEG_STATIC.arm64.file}; ffmpeg_sha=${FFMPEG_STATIC.arm64.sha256} ;; \\`,
     `      *) echo "no pinned ffmpeg for $TARGETARCH" >&2; exit 1 ;; \\`,
     "    esac \\",
-    ` && ${download} https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/$ffmpeg_file /tmp/ffmpeg.tar.xz \\`,
+    ...fetched ? [] : [` && ${download} https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/$ffmpeg_file /tmp/ffmpeg.tar.xz \\`],
     ' && echo "$ffmpeg_sha  /tmp/ffmpeg.tar.xz" | sha256sum -c - \\',
     " && tar -xJf /tmp/ffmpeg.tar.xz -C /tmp \\",
     " && mkdir -p /out/usr/local/bin /out/opt/outerlayer/media/lib \\",
@@ -239,16 +249,17 @@ function toolsDockerfile(parts) {
       "RUN chmod 0755 /out/opt/outerlayer/bin/outerlayer-guest \\",
       " && mkdir -p /out/outerlayer/job /out/outerlayer/judge /out/run /out/proc /out/sys /out/dev"
     ] : [],
+    ...fetched ? [`COPY ${FETCHED_DIR}/${FETCHED_TINI} /tmp/tini`, `COPY ${FETCHED_DIR}/${FETCHED_GH} /tmp/gh.tgz`] : [],
     `RUN set -eu \\`,
     ` && case "$TARGETARCH" in \\`,
     `      amd64) gh_sha=${GH_SHA256.amd64}; tini_sha=${TINI_SHA256.amd64} ;; \\`,
     `      arm64) gh_sha=${GH_SHA256.arm64}; tini_sha=${TINI_SHA256.arm64} ;; \\`,
     `      *) echo "no pinned gh and tini for $TARGETARCH" >&2; exit 1 ;; \\`,
     "    esac \\",
-    ` && ${download} https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-$TARGETARCH /tmp/tini \\`,
+    ...fetched ? [] : [` && ${download} https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-$TARGETARCH /tmp/tini \\`],
     ' && echo "$tini_sha  /tmp/tini" | sha256sum -c - \\',
     " && install -m 0755 /tmp/tini /out/opt/outerlayer/bin/tini \\",
-    ` && ${download} https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_$TARGETARCH.tar.gz /tmp/gh.tgz \\`,
+    ...fetched ? [] : [` && ${download} https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_$TARGETARCH.tar.gz /tmp/gh.tgz \\`],
     ' && echo "$gh_sha  /tmp/gh.tgz" | sha256sum -c - \\',
     " && tar -xzf /tmp/gh.tgz -C /tmp \\",
     ` && install -m 0755 /tmp/gh_${GH_VERSION}_linux_$TARGETARCH/bin/gh /out/usr/local/bin/gh`,
@@ -362,15 +373,18 @@ async function fetchPinnedCommit(opts) {
   if (!fetched.ok) throw new RecipeError("repository_unreadable", `cannot read ${opts.repository}: ${fetched.reason}`);
   return { dir: opts.dir, defaultBranch: opts.ref, commit: opts.commit };
 }
-function metadataOf(image) {
+function metadataFromLabels(labels) {
   try {
-    const parsed = JSON.parse(image.labels["devcontainer.metadata"] ?? "[]");
+    const parsed = JSON.parse(labels["devcontainer.metadata"] ?? "[]");
     const entries = Array.isArray(parsed) ? parsed : [parsed];
     return entries.filter((e) => typeof e === "object" && e !== null && !Array.isArray(e));
   } catch {
     return [];
   }
 }
+function metadataOf(image) {
+  return metadataFromLabels(image.labels);
+}
 function readReport(recordDir) {
   try {
     return JSON.parse(readFileSync(join(recordDir, "recipe.json"), "utf8"));
@@ -386,8 +400,7 @@ function writeRecord(recordDir, report, builtAt) {
   writeFileSync(join(recordDir, "recipe.json"), `${JSON.stringify(report, null, 2)}
 `, { mode: RUNNER_FILE_MODE });
 }
-async function buildRepositoryImage(opts, ports) {
-  const { host } = ports;
+async function prepareImageBuild(opts) {
   const { full: repository, owner, name } = splitRepository(opts.repository);
   if (!existsSync(join(opts.cli.distDir, "index.js"))) {
     throw new Error(`${opts.cli.distDir} holds no index.js: the tools layer copies the built CLI, so run this from a build (yarn workspace @outerlayer/cli build)`);
@@ -396,7 +409,6 @@ async function buildRepositoryImage(opts, ports) {
   const claudeCodeVersion = opts.claudeCodeVersion ?? CLAUDE_CODE_VERSION;
   const nodeImage = opts.nodeImage ?? NODE_IMAGE;
   const baseImage = opts.defaultBaseImage ?? DEFAULT_BASE_IMAGE;
-  const scratchRoot = opts.tmpDir ?? tmpdir();
   const cacheDir = repoCacheDir(opts.configPath, owner, name);
   const repoRecords = join(imagesDir(opts.configPath), owner, name);
   const logPath = join(repoRecords, "builds", `${attemptStamp(now())}.log`);
@@ -411,6 +423,7 @@ async function buildRepositoryImage(opts, ports) {
     }
     throw err;
   }
+  const release = () => releasePidFile(lockPath, self);
   try {
     const remote = opts.remote ?? `https://github.com/${owner}/${name}.git`;
     const checkout = opts.pinned === void 0 ? await fetchDefaultBranch({ remote, dir: cacheDir, token: opts.readToken, repository }) : await fetchPinnedCommit({ remote, dir: cacheDir, token: opts.readToken, repository, ...opts.pinned });
@@ -421,8 +434,21 @@ async function buildRepositoryImage(opts, ports) {
     const rKey = recipeKey(checkout.dir, location, defaultText);
     const tKey = toolsKey({ buildId: opts.cli.buildId, claudeCodeVersion, nodeImage, ghVersion: GH_VERSION, tiniVersion: TINI_VERSION, guestHelperSha256: opts.guestHelper?.sha256, mediaPins: MEDIA_PINS });
     const recordDir = join(repoRecords, `${rKey.slice(0, KEY_PREFIX)}-${tKey.slice(0, KEY_PREFIX)}`);
-    const buildTag = `${TAG_HOST}/build/${repository}:${rKey.slice(0, KEY_PREFIX)}-${tKey.slice(0, KEY_PREFIX)}`;
-    const recipeTag = `${TAG_HOST}/recipe/${repository}:${rKey.slice(0, KEY_PREFIX)}`;
+    return { repository, owner, name, repoRecords, recordDir, checkout, location, recipe, recipeKey: rKey, toolsKey: tKey, defaultText, claudeCodeVersion, nodeImage, logPath, release };
+  } catch (err) {
+    release();
+    throw err;
+  }
+}
+async function buildRepositoryImage(opts, ports) {
+  const { host } = ports;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const scratchRoot = opts.tmpDir ?? tmpdir();
+  const prepared = await prepareImageBuild(opts);
+  const { repository, repoRecords, checkout, location, recipe, recipeKey: rKey, toolsKey: tKey, defaultText, claudeCodeVersion, nodeImage, recordDir, logPath } = prepared;
+  const buildTag = `${TAG_HOST}/build/${repository}:${rKey.slice(0, KEY_PREFIX)}-${tKey.slice(0, KEY_PREFIX)}`;
+  const recipeTag = `${TAG_HOST}/recipe/${repository}:${rKey.slice(0, KEY_PREFIX)}`;
+  try {
     const existing = await host.list(repository);
     const labelled = existing.find((i) => i.labels[KIND2] === "recipe" && i.labels[RECIPE_KEY2] === rKey);
     const recipeImageBefore = labelled !== void 0 && (await host.inspect(recipeTag))?.id === labelled.id ? labelled : void 0;
@@ -538,7 +564,7 @@ async function buildRepositoryImage(opts, ports) {
       removed
     };
   } finally {
-    releasePidFile(lockPath, self);
+    prepared.release();
   }
 }
 async function prune(host, repository, repoRecords, keep, runnerDirPath) {
@@ -564,4 +590,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath) {
   return removed;
 }
 
-export { buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, readBranchHead, readDefaultBranchHead };
+export { FETCHED_DIR, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR, KEY_PREFIX, TAG_HOST, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, toolsDockerfile, writeRecord };

package/dist/{chunk-X7ML37UF.js → chunk-UIBTEDLA.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-X2Y3B4JH.js';
-import { workPageUrl } from './chunk-LESWVXRE.js';
-import { sanitizeTerminal } from './chunk-3H7NZPYG.js';
-import { resolveRepoIdentity } from './chunk-XT5SOJRC.js';
+import { detectActiveSession, autoConnect } from './chunk-6TFTRVOA.js';
+import { workPageUrl } from './chunk-5RUH3PCG.js';
+import { sanitizeTerminal } from './chunk-DM4EGXDO.js';
+import { resolveRepoIdentity } from './chunk-AKR32WHV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-F3EF56LQ.js';
-import { signRunnerRequest } from './chunk-APSYTJ6I.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-VQ2JGZSC.js';
+import { signRunnerRequest } from './chunk-JT3YO5MH.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -441,7 +441,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-WQQYEXO5.js');
+      const { logHookError } = await import('./hook-fast-NVBMSE3N.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-QCDVKCHA.js → chunk-UWEJ6HGB.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-YW4PEGLN.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-KUTZ6XLS.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-WXEPMPHK.js';
+import { linkedAgentsPath } from './chunk-LN4WDONI.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-F3EF56LQ.js → chunk-VQ2JGZSC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-APSYTJ6I.js';
+import { signRunnerRequest, signerFor } from './chunk-JT3YO5MH.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';