@outerlayer/cli 0.33.0-next.20261022004023 → 0.33.0-next.20261022124145

package/dist/{chunk-AKHGQKNR.js → chunk-E6CO3MJE.js}

@@ -22277,6 +22277,10 @@ var ARTIFACT_MAX_GIT_BRANCH_LENGTH = 255;
 var ARTIFACT_MAX_COMMIT_SHA_LENGTH = 64;
 var ARTIFACT_MAX_SESSION_ID_LENGTH = 128;
 var Sha256Schema = external_exports.string().regex(/^[0-9a-f]{64}$/);
+var ArtifactRangeSchema = external_exports.object({
+  start: external_exports.number().finite().min(0),
+  end: external_exports.number().finite()
+}).refine((range) => range.end > range.start, { message: "end must be after start", path: ["end"] });
 var ArtifactSpoolRecordSchema = external_exports.looseObject({
   rec: external_exports.literal("artifact"),
   artifactId: external_exports.string().min(1).max(64),
@@ -22319,7 +22323,12 @@ var ArtifactSpoolRecordSchema = external_exports.looseObject({
   replacesTargets: external_exports.array(external_exports.string().regex(/^[A-Za-z0-9_.:-]{1,64}$/)).min(2).max(ARTIFACT_MAX_REPLACES_TARGETS).optional(),
   /** The tests `--test` selected from a JUnit results file, with any
    * location the caller gave. Absent when the whole file is bound. */
-  tests: TestSelectionListSchema.optional()
+  tests: TestSelectionListSchema.optional(),
+  /** The part of a video this artifact proves, in seconds from its start. */
+  range: ArtifactRangeSchema.optional(),
+  /** True when the bytes may already be stored: `sync` sends the record with
+   * no blob first and sends the blob only when the gateway asks for it. */
+  blobOptional: external_exports.boolean().optional()
 });
 var ArtifactTombstoneRecordSchema = external_exports.looseObject({
   rec: external_exports.literal("artifact-tombstone"),
@@ -22737,7 +22746,30 @@ var DemoRecordV2Schema = external_exports.strictObject({
   schemaVersion: external_exports.literal(2),
   chapters: external_exports.array(DemoRecordChapterV2Schema).min(1).max(DEMO_CHAPTERS_MAX)
 });
-external_exports.discriminatedUnion("schemaVersion", [DemoRecordV1Schema, DemoRecordV2Schema]);
+var DemoRecordChapterV3Schema = external_exports.strictObject({
+  ...chapterFields,
+  /** The `clientArtifactId` of the chapter's artifact: a range of the whole video, or its own clip. */
+  artifactId: external_exports.string().min(1).max(64),
+  /** The chapter's span in the artifact's video, in seconds from its start. In clip mode the video is the chapter's own clip. */
+  range: ArtifactRangeSchema,
+  bound: external_exports.boolean(),
+  comparable: DemoComparableSchema,
+  stills: external_exports.array(DemoStillSchema.pick({ check: true, sha256: true })).max(DEMO_CHECKS_MAX),
+  difference: external_exports.strictObject({ check: external_exports.number().int().min(0), region: DemoRegionSchema }).optional()
+}).refine((chapter) => chapter.end > chapter.start, { message: "a chapter must end after it starts", path: ["end"] }).refine((chapter) => chapter.comparable === "no" === (chapter.difference !== void 0), {
+  message: "a chapter has a difference exactly when it is not comparable",
+  path: ["difference"]
+});
+var DemoRecordVideoSchema = external_exports.union([
+  external_exports.strictObject({ artifactId: external_exports.string().min(1).max(64) }),
+  external_exports.strictObject({ omitted: external_exports.literal("size"), bytes: external_exports.number().int().nonnegative() })
+]);
+var DemoRecordV3Schema = external_exports.strictObject({
+  schemaVersion: external_exports.literal(3),
+  video: DemoRecordVideoSchema,
+  chapters: external_exports.array(DemoRecordChapterV3Schema).min(1).max(DEMO_CHAPTERS_MAX)
+});
+external_exports.discriminatedUnion("schemaVersion", [DemoRecordV1Schema, DemoRecordV2Schema, DemoRecordV3Schema]);
 /*! Bundled license information:
 
 xmlchars/xml/1.0/ed5.js:

package/dist/{chunk-DM4EGXDO.js → chunk-EWVYQLD3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-AKHGQKNR.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-E6CO3MJE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-BUBMAMIP.js → chunk-FQW7TKIU.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-XNGS6LUK.js';
-import { MIN_ENGINE_MAJOR } from './chunk-OEITN64Z.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-52C3SSNF.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-AESNEWYR.js';
+import { MIN_ENGINE_MAJOR } from './chunk-D7ECJX4J.js';
 import { runnerCredentialProblem } from './chunk-ALSE7YKX.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';

package/dist/{chunk-KUTZ6XLS.js → chunk-G63KT5I5.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { splitRawFile } from './chunk-OGCG5LOX.js';
+import { splitRawFile } from './chunk-LJG6EMLJ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';

package/dist/{chunk-Q2D4M3GC.js → chunk-GFYEMCPP.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { loadMachineSkillFiles, resolvePackRoot } from './chunk-KUTZ6XLS.js';
+import { loadMachineSkillFiles, resolvePackRoot } from './chunk-G63KT5I5.js';
 import { MAINTAINED_SKILLS, maintainedLineVersion } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-4IG6EZHU.js → chunk-HJYBWJAS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-KUTZ6XLS.js';
-import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-OGCG5LOX.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-G63KT5I5.js';
+import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-LJG6EMLJ.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';
 

package/dist/{chunk-CMTRZC23.js → chunk-HVIYKGK5.js}

@@ -1,28 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-HJEZ3D3E.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-LWODW66U.js';
+import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-LH3KULPL.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { fitImageBuildMemory } from './chunk-M5ZXOQYS.js';
 import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
 import { writePendingUpdate } from './chunk-CNRMP6EN.js';
-import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-CALFNNIY.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-XTBGPISI.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-3VGDZ23W.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, freeBytes, formatBytes, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-OEITN64Z.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-KDM77TVX.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-D7ECJX4J.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-IPJ6HR7E.js';
+import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-LCVR4UIS.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-533QGXGZ.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
+import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-S2IJQER5.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ALSE7YKX.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-IPJ6HR7E.js';
-import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-UENWEDZ3.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-UIBTEDLA.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6JNCNHSV.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-JT3YO5MH.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir, imagesDir, builderCacheDiskPath } from './chunk-ESP5VZBD.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-ESP5VZBD.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-HDSDUTX4.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-XD4ZCMA4.js';
@@ -537,6 +538,7 @@ function settleUpdate(args) {
 
 // src/runner/housekeeping/docker.ts
 var KIND_LABEL = "ai.outerlayer.kind";
+var RECIPE_KEY_LABEL = "ai.outerlayer.recipe-key";
 var NO_BUILDER = /no builder .* found/i;
 function failure(result, what) {
   return new Error(`${what}: ${result.stderr.trim() || `docker exited ${result.status}`}`);
@@ -624,6 +626,21 @@ function createHousekeepingDocker(deps) {
         labels: row.Config?.Labels ?? {}
       }));
     },
+    async listLabelledImages() {
+      const listed = await run("docker", ["image", "ls", "--all", "--no-trunc", "--quiet", "--filter", `label=${KIND_LABEL}`]);
+      if (listed.status !== 0) throw failure(listed, "docker image ls");
+      const ids = [...new Set(listed.stdout.split("\n").map((l) => l.trim()).filter(Boolean))];
+      if (ids.length === 0) return [];
+      const inspected = await run("docker", ["image", "inspect", ...ids]);
+      if (inspected.status !== 0) throw failure(inspected, "docker image inspect");
+      return JSON.parse(inspected.stdout).map((row) => ({
+        id: row.Id,
+        size: row.Size ?? 0,
+        labels: row.Config?.Labels ?? {},
+        tags: (row.RepoTags ?? []).filter((tag) => tag !== "<none>:<none>"),
+        createdMs: Date.parse(row.Created ?? "")
+      }));
+    },
     async removeImage(id) {
       const result = await run("docker", ["rmi", id]);
       if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
@@ -747,6 +764,46 @@ async function removeDanglingImages(docker, log, live) {
   }
   return freed;
 }
+var UNRECORDED_IMAGE_GRACE_MS = 60 * 60 * 1e3;
+function recordedImages(configPath) {
+  const imageIds = /* @__PURE__ */ new Set();
+  const recipeKeys = /* @__PURE__ */ new Set();
+  const root = imagesDir(configPath);
+  for (const owner of listDir(root)) {
+    for (const repo of listDir(join(root, owner))) {
+      for (const entry of listDir(join(root, owner, repo))) {
+        const file = join(root, owner, repo, entry, "image.json");
+        if (!existsSync(file)) continue;
+        let record;
+        try {
+          record = JSON.parse(readFileSync(file, "utf8"));
+        } catch {
+          return void 0;
+        }
+        if (typeof record.imageId === "string") imageIds.add(record.imageId);
+        if (typeof record.recipeKey === "string") recipeKeys.add(record.recipeKey);
+      }
+    }
+  }
+  return { imageIds, recipeKeys };
+}
+async function removeUnrecordedImages(docker, log, recorded, live, nowMs) {
+  let freed = 0;
+  for (const image of await docker.listLabelledImages()) {
+    const kind = image.labels[KIND_LABEL];
+    if (image.tags.length === 0 || live.has(image.id)) continue;
+    if (!(nowMs - image.createdMs >= UNRECORDED_IMAGE_GRACE_MS)) continue;
+    if (kind === "build" ? recorded.imageIds.has(image.id) : kind === "recipe" ? recorded.recipeKeys.has(image.labels[RECIPE_KEY_LABEL] ?? "") : true) continue;
+    try {
+      for (const tag of image.tags) await docker.removeImage(tag);
+      freed += image.size;
+      log.line(`housekeeping: removed ${kind} image ${image.tags.join(", ")} (${formatBytes(image.size)}), no image record names it`);
+    } catch (err) {
+      log.error(`housekeeping: could not remove image ${image.tags.join(", ")}: ${describeCallFailure(err)}`);
+    }
+  }
+  return freed;
+}
 async function runHousekeeping(options) {
   const { docker, log } = options;
   const nowMs = options.now().getTime();
@@ -796,6 +853,16 @@ async function runHousekeeping(options) {
     }
   }
   if (canTell && listed !== void 0) {
+    const recorded = recordedImages(options.configPath);
+    if (recorded === void 0) {
+      log.error("housekeeping: an image record does not parse, so no tagged image is removed this pass");
+    } else {
+      try {
+        freed += await removeUnrecordedImages(docker, log, recorded, liveImageIds(jobs.unfinished), nowMs);
+      } catch (err) {
+        log.error(`housekeeping: the runner's images could not be listed: ${describeCallFailure(err)}`);
+      }
+    }
     freed += await removeStaleRootDisks(root, jobs.unfinished, options);
     try {
       freed += await removeDanglingImages(docker, log, liveImageIds(jobs.unfinished));
@@ -1770,7 +1837,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-QQDUI3YX.js');
+  const { postJson: postJson2 } = await import('./work-cmd-DYM67Z3F.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2966,7 +3033,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-XGBAFJPP.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-EJKRXI2N.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-TNJXCNQ6.js → chunk-JHTJPQSL.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-4IG6EZHU.js';
+import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-HJYBWJAS.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-M5OBRUQE.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-KUTZ6XLS.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-UIUGTW5C.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-OGCG5LOX.js';
+import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-LJG6EMLJ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-RVWADVBN.js → chunk-JZ4FXSLI.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-M5OBRUQE.js';
+import { removeRetiredSkills } from './chunk-UIUGTW5C.js';
 import { defaultFetch, resolveGatewayCredentials } from './chunk-VQ2JGZSC.js';
 import { withTokenHeader } from './chunk-HDSDUTX4.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-KUTZ6XLS.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
-import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-OGCG5LOX.js';
+import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-LJG6EMLJ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';

package/dist/{chunk-HT7LVCTX.js → chunk-L3DUKDTR.js}

@@ -680,11 +680,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-UBOJHGQM.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-BX5Y3AFL.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-R4X63DYW.js');
+  const { governanceOf } = await import('./control-plane-launch-K7YD6KEN.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-KDM77TVX.js → chunk-LCVR4UIS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-UIBTEDLA.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-RVWADVBN.js';
+import { WorkCommandError, postJson } from './chunk-6JNCNHSV.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-JZ4FXSLI.js';
 import { signingFetchFor } from './chunk-VQ2JGZSC.js';
 import { signerFor } from './chunk-JT3YO5MH.js';
 import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-ESP5VZBD.js';

package/dist/{chunk-OGCG5LOX.js → chunk-LJG6EMLJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-AKHGQKNR.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-E6CO3MJE.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-HJEZ3D3E.js → chunk-LWODW66U.js}

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-RJYKTWUP.js';
-import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-Q4YVHYHT.js';
-import { installScrubContext } from './chunk-SFJD4MRY.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-ELYHDWCC.js';
 import { writeDockerClientConfig } from './chunk-XTNMIV77.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-OEITN64Z.js';
+import { zodProblem } from './chunk-I3LTIAOR.js';
+import { senderPidfile } from './chunk-QJNFO7TQ.js';
+import { installScrubContext } from './chunk-WHRR55PC.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-D7ECJX4J.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-IK6M37BI.js';
+import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-QQGZ5THT.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-HIGJTX5U.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-KDM77TVX.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-LCVR4UIS.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-S2IJQER5.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-R6QCSHKC.js';
 import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ALSE7YKX.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-IK6M37BI.js';
-import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-UENWEDZ3.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-R6QCSHKC.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-UIBTEDLA.js';
-import { planArtifactUpload } from './chunk-DM4EGXDO.js';
-import { scrubText } from './chunk-AKR32WHV.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6JNCNHSV.js';
+import { planArtifactUpload } from './chunk-EWVYQLD3.js';
+import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-JT3YO5MH.js';
 import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-ESP5VZBD.js';
 import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-HDSDUTX4.js';
-import { resolvePackRoot } from './chunk-KUTZ6XLS.js';
+import { resolvePackRoot } from './chunk-G63KT5I5.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { parsePolicy } from './chunk-OGCG5LOX.js';
-import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-AKHGQKNR.js';
+import { parsePolicy } from './chunk-LJG6EMLJ.js';
+import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-E6CO3MJE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { fdName } from './chunk-XD4ZCMA4.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';

package/dist/chunk-MBE6FEQ3.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { formatBytes, freeBytes } from './chunk-YYYRBYWG.js';
+import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-S2IJQER5.js';
+import { parseSize } from './chunk-YJLHUKYS.js';
+import { buildsDir, rootfsDir, runnerDir } from './chunk-ESP5VZBD.js';
+import { spawnSync } from 'child_process';
+import { existsSync, statSync, readdirSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+function checkDiskFit(input) {
+  const limit = parseSize(input.buildDisk);
+  if (limit === void 0) return { fits: true };
+  const { freeBytes: free, heldBytes: held, rootDiskBytes: root } = input.facts;
+  const neededBytes = input.concurrency * (limit + root);
+  const availableBytes = free + held;
+  if (neededBytes <= availableBytes) return { fits: true };
+  const oneBuild = root > 0 ? `runner.build.disk ${input.buildDisk} plus a root disk of ${formatBytes(root)}` : `runner.build.disk ${input.buildDisk}`;
+  return {
+    fits: false,
+    neededBytes,
+    availableBytes,
+    message: `the builds' disks do not fit: runner.concurrency ${input.concurrency} times the space one build can hold (${oneBuild}) needs ${formatBytes(neededBytes)}, and ${formatBytes(availableBytes)} is available (${formatBytes(free)} free plus ${formatBytes(held)} held by running builds)`
+  };
+}
+function allocatedBytes(path) {
+  try {
+    return statSync(path).blocks * 512;
+  } catch {
+    return 0;
+  }
+}
+function listDir(path) {
+  try {
+    return readdirSync(path);
+  } catch {
+    return void 0;
+  }
+}
+function microVmFacts(configPath) {
+  const builds = buildsDir(configPath);
+  const free = freeBytes(builds);
+  if (free === void 0) return void 0;
+  let held = 0;
+  if (existsSync(builds)) {
+    const entries = listDir(builds);
+    if (entries === void 0) return void 0;
+    for (const entry of entries) held += allocatedBytes(join(builds, entry, "build.ext4"));
+  }
+  let root = 0;
+  const roots = rootfsDir(runnerDir(configPath));
+  if (existsSync(roots)) {
+    const entries = listDir(roots);
+    if (entries === void 0) return void 0;
+    for (const entry of entries) {
+      if (!entry.endsWith(".ext4")) continue;
+      try {
+        root = Math.max(root, statSync(join(roots, entry)).size);
+      } catch {
+      }
+    }
+  }
+  return { freeBytes: free, heldBytes: held, rootDiskBytes: root };
+}
+var DOCKER_TIMEOUT_MS = 1e4;
+var DEFAULT_BUILD_DISK = "40g";
+var DOCKER_CACHE_MS = 6e4;
+var DEFAULT_VOLUMES_DIR = "/var/lib/docker/volumes";
+function runDocker(args, spawn = spawnSync) {
+  const result = spawn("docker", args, { encoding: "utf8", timeout: DOCKER_TIMEOUT_MS });
+  return result.status === 0 ? result.stdout : void 0;
+}
+var SIZE_UNITS = { b: 1, kb: 1e3, mb: 1e6, gb: 1e9, tb: 1e12 };
+function volumeBytes(dfOutput, names) {
+  let total = 0;
+  for (const line of dfOutput.split("\n")) {
+    const [name, , size] = line.trim().split(/\s+/);
+    if (name === void 0 || size === void 0 || !names.has(name)) continue;
+    const match = /^([\d.]+)([A-Za-z]+)$/.exec(size);
+    const unit = match === null ? void 0 : SIZE_UNITS[match[2].toLowerCase()];
+    if (match !== null && unit !== void 0) total += Number(match[1]) * unit;
+  }
+  return total;
+}
+function containerFacts(cache, configPath, docker, now) {
+  if (cache.reading === void 0 || cache.reading.configPath !== configPath || now - cache.reading.at > DOCKER_CACHE_MS) {
+    const root = docker(["info", "--format", "{{.DockerRootDir}}"])?.trim();
+    const listed = docker(["volume", "ls", "--quiet", "--filter", `label=${BUILD_LABEL}`, "--filter", `label=${RUNNER_LABEL}=${runnerLabelValue(configPath)}`]);
+    const names = new Set((listed ?? "").split("\n").map((n) => n.trim()).filter((n) => n !== ""));
+    const df = listed === void 0 || names.size === 0 ? void 0 : docker(["system", "df", "-v"]);
+    const held = listed === void 0 ? void 0 : names.size === 0 ? 0 : df === void 0 ? void 0 : volumeBytes(df, names);
+    cache.reading = {
+      at: now,
+      configPath,
+      held,
+      volumes: root === void 0 || root === "" ? DEFAULT_VOLUMES_DIR : join(root, "volumes")
+    };
+  }
+  if (cache.reading.held === void 0) return void 0;
+  const free = freeBytes(cache.reading.volumes);
+  return free === void 0 ? void 0 : { freeBytes: free, heldBytes: cache.reading.held, rootDiskBytes: 0 };
+}
+function realBuildDiskProbe(deps = {}) {
+  const cache = {};
+  const docker = deps.docker ?? ((args) => runDocker(args));
+  const now = deps.now ?? Date.now;
+  return (kind, configPath) => kind === "vm" ? microVmFacts(configPath) : containerFacts(cache, configPath, docker, now());
+}
+
+export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes };

package/dist/{chunk-RW52CUFX.js → chunk-NSPRS7WK.js}

@@ -5,7 +5,7 @@ import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfigStrict, CloudConfigError, readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-AKHGQKNR.js';
+import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-E6CO3MJE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';

package/dist/{chunk-DE7YSNDX.js → chunk-OJ63GRZ2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-6TFTRVOA.js';
-import { resolveRepoIdentity } from './chunk-AKR32WHV.js';
+import { autoConnect, detectActiveSession } from './chunk-C3XLVHN6.js';
+import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-VQ2JGZSC.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-Q4YVHYHT.js → chunk-QJNFO7TQ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-SFJD4MRY.js';
-import { CaptureDaemon } from './chunk-AKR32WHV.js';
-import { spoolDir } from './chunk-HT7LVCTX.js';
+import { LiveUploader } from './chunk-WHRR55PC.js';
+import { CaptureDaemon } from './chunk-5DNCFOXA.js';
+import { spoolDir } from './chunk-L3DUKDTR.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-NOXK3QW6.js → chunk-QSSYXK6C.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-6TFTRVOA.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-AKR32WHV.js';
+import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-C3XLVHN6.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-VQ2JGZSC.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-AKHGQKNR.js';
+import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-E6CO3MJE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, existsSync } from 'fs';
 import { join, dirname, basename } from 'path';