@outerlayer/cli 0.33.0-next.20261022161023 → 0.33.0-next.20261022180022

package/dist/{chunk-WHRR55PC.js → chunk-J6LFFZOY.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-THTBXIK5.js';
+import { uploadSpooledSteps } from './chunk-EBX2DU2M.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-EWVYQLD3.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-VQ2JGZSC.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FLFK42YF.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-JT3YO5MH.js';
-import { writeSyncStatus, spoolDir } from './chunk-L3DUKDTR.js';
+import { signerFor, signRunnerRequest } from './chunk-634F6J3Q.js';
+import { writeSyncStatus, spoolDir } from './chunk-ZANK3WWF.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';

package/dist/{chunk-MBE6FEQ3.js → chunk-JFRBPBD5.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { formatBytes, freeBytes } from './chunk-YYYRBYWG.js';
-import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-S2IJQER5.js';
+import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-LG2IQRTO.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { buildsDir, rootfsDir, runnerDir } from './chunk-ESP5VZBD.js';
+import { buildsDir, rootfsDir, runnerDir } from './chunk-MBGS33SL.js';
 import { spawnSync } from 'child_process';
 import { existsSync, statSync, readdirSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-LCVR4UIS.js → chunk-JKPJQNJF.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-6JNCNHSV.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-JZ4FXSLI.js';
-import { signingFetchFor } from './chunk-VQ2JGZSC.js';
-import { signerFor } from './chunk-JT3YO5MH.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-ESP5VZBD.js';
+import { WorkCommandError, postJson } from './chunk-KQFWTTG7.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-YMGSMPPW.js';
+import { signingFetchFor } from './chunk-FLFK42YF.js';
+import { signerFor } from './chunk-634F6J3Q.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-MBGS33SL.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';

package/dist/{chunk-QJNFO7TQ.js → chunk-JUVUVXQZ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-WHRR55PC.js';
+import { LiveUploader } from './chunk-J6LFFZOY.js';
 import { CaptureDaemon } from './chunk-5DNCFOXA.js';
-import { spoolDir } from './chunk-L3DUKDTR.js';
+import { spoolDir } from './chunk-ZANK3WWF.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-6JNCNHSV.js → chunk-KQFWTTG7.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-C3XLVHN6.js';
-import { workPageUrl } from './chunk-B3EE7OKK.js';
+import { detectActiveSession, autoConnect } from './chunk-RLGSBR56.js';
+import { workPageUrl } from './chunk-CMNAAKFD.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-VQ2JGZSC.js';
-import { signRunnerRequest } from './chunk-JT3YO5MH.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-FLFK42YF.js';
+import { signRunnerRequest } from './chunk-634F6J3Q.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -441,7 +441,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-FJ2PMBML.js');
+      const { logHookError } = await import('./hook-fast-PXSDGAUP.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-S2IJQER5.js → chunk-LG2IQRTO.js}

@@ -4,9 +4,9 @@ import { RecipeError } from './chunk-3Z3MPR55.js';
 import { BUILDKIT_IMAGE } from './chunk-R6QCSHKC.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { compareVersions } from './chunk-5DNCFOXA.js';
-import { ensureHostKey } from './chunk-JT3YO5MH.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-ESP5VZBD.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-HDSDUTX4.js';
+import { ensureHostKey } from './chunk-634F6J3Q.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-MBGS33SL.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-D5ZGMXUL.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';

package/dist/{chunk-72BIONOT.js → chunk-LOYLFW4I.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { isAgentsMdLayout } from './chunk-HJYBWJAS.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-VQ2JGZSC.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-FLFK42YF.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-GFYEMCPP.js';

package/dist/{chunk-FQW7TKIU.js → chunk-M7IA4JOX.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-52C3SSNF.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-AESNEWYR.js';
-import { MIN_ENGINE_MAJOR } from './chunk-D7ECJX4J.js';
-import { runnerCredentialProblem } from './chunk-ALSE7YKX.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-HDD3BKAE.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-6KVKEZTH.js';
+import { MIN_ENGINE_MAJOR } from './chunk-OKTLQTWH.js';
+import { runnerCredentialProblem } from './chunk-ZQ7VRXYM.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-ESP5VZBD.js → chunk-MBGS33SL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-HDSDUTX4.js';
+import { BUILD_HOME } from './chunk-D5ZGMXUL.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -86,5 +86,14 @@ function deliveryDir(repository, sha) {
   }
   return `${BUILD_HOME}/.outerlayer/context/${repository}/${sha}`;
 }
+function jobConsolePath(jobDirPath) {
+  return join(jobDirPath, "vm-console.log");
+}
+function builderConsolePath(buildDirPath) {
+  return join(buildDirPath, "console.log");
+}
+function imageBuildLogsDir(configPath, owner, name) {
+  return join(imagesDir(configPath), owner, name, "builds");
+}
 
-export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, builderCacheDiskPath, buildsDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, keptContextDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };
+export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, builderCacheDiskPath, builderConsolePath, buildsDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imageBuildLogsDir, imagesDir, jobConsolePath, jobDir, jobsDir, keptContextDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };

package/dist/{chunk-HIGJTX5U.js → chunk-O5F376JJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-HDSDUTX4.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-D5ZGMXUL.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-3VGDZ23W.js → chunk-O7MSQBTH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-D7ECJX4J.js → chunk-OKTLQTWH.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-IK6M37BI.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-7HMF7I3D.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { runExec, execCapture, waitForAgent } from './chunk-QQGZ5THT.js';
-import { GUEST_CID, linkVsockSockets } from './chunk-HIGJTX5U.js';
-import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-LCVR4UIS.js';
-import { runnerImageVersion } from './chunk-533QGXGZ.js';
+import { runExec, execCapture, waitForAgent } from './chunk-XXVYHC6D.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-O5F376JJ.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-JKPJQNJF.js';
+import { runnerImageVersion } from './chunk-PWB7EK4Z.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-S2IJQER5.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-LG2IQRTO.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
 import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-R6QCSHKC.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { WorkCommandError } from './chunk-6JNCNHSV.js';
+import { WorkCommandError } from './chunk-KQFWTTG7.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-5DNCFOXA.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath } from './chunk-ESP5VZBD.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-HDSDUTX4.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-MBGS33SL.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-D5ZGMXUL.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-LJG6EMLJ.js';
 import { downconvertSession } from './chunk-E6CO3MJE.js';
-import { realFdStorePort } from './chunk-XD4ZCMA4.js';
+import { realFdStorePort } from './chunk-HACGUL52.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, statSync, readdirSync, mkdtempSync, writeFileSync, lstatSync, copyFileSync, accessSync, constants, rmdirSync, renameSync, unlinkSync, linkSync, openSync, closeSync, cpSync, writeSync, appendFileSync, createWriteStream, createReadStream } from 'fs';
 import { join, dirname, relative, resolve, basename } from 'path';
@@ -709,10 +709,18 @@ var LOG_TAIL_LINES = 30;
 var MAX_PENDING_BYTES = 64 * 1024;
 var MAX_LOG_BYTES = 64 * 1024 * 1024;
 var RESULT_PREFIX = "OL-RESULT ";
+var ENGINE_PANIC_PREFIX = "OL-ENGINE-PANIC ";
+var ENGINE_STOPPED_LINE = "the Docker engine in the builder is stopped";
 var REFUSALS_NAMED = 5;
 var GUEST_OUTPUT = "/out/rootfs.ext4";
 var DOCKER_WAIT_SECONDS = 90;
 var BUILD_CACHE_KEEP = "2GB";
+function unpackCommand(target) {
+  return ["sh", "-c", 'tar -x --no-same-owner -C "$1"; s=$?; cat >/dev/null; exit $s', "unpack", target];
+}
+function engineLogExcerpt(log) {
+  return `grep -m1 'panic:' ${log} | sed 's/^/${ENGINE_PANIC_PREFIX}/' || true; tail -n 20 ${log}`;
+}
 function builderMachineConfig(limits2, paths) {
   return machineConfig(limits2, { ...paths, guestInit: BUILDER_INIT });
 }
@@ -743,13 +751,25 @@ function builderGuestScript(parts) {
     "export NODE_USE_ENV_PROXY=1",
     "export DOCKER_CONFIG=/run/builder/docker DOCKER_BUILDKIT=1",
     "mkdir -p /run/builder/docker /cache/docker",
+    "dockerd_pid=",
     // Whatever way the script ends, the cache keeps the recipe image and a bounded build cache, so a repository's cache disk cannot fill with the images of old recipes.
     "trim() {",
     `  docker image ls --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -vxF -e '<none>:<none>' -e ${recipeTag} | xargs -r docker rmi > /dev/null 2>&1 || true`,
     "  docker image prune --force > /dev/null 2>&1 || true",
     `  docker builder prune --force --keep-storage ${BUILD_CACHE_KEEP} > /dev/null 2>&1 || true`,
     "}",
-    "trap trim EXIT",
+    // The engine stops and the disks sync before the microVM does: the runner stops a builder without a shutdown, and an engine still running leaves BuildKit's database half-written on the cache disk.
+    "settle() {",
+    "  trim",
+    '  if [ -n "$dockerd_pid" ]; then',
+    '    kill "$dockerd_pid" 2>/dev/null || true',
+    "    waited_stop=0",
+    '    while kill -0 "$dockerd_pid" 2>/dev/null && [ "$waited_stop" -lt 60 ]; do waited_stop=$((waited_stop + 1)); sleep 1; done',
+    `    if ! kill -0 "$dockerd_pid" 2>/dev/null; then echo "${ENGINE_STOPPED_LINE}"; fi`,
+    "  fi",
+    "  sync",
+    "}",
+    "trap settle EXIT",
     "cat > /run/builder/daemon.json <<'OL_DAEMON_JSON'",
     JSON.stringify(daemonConfig(), null, 2),
     "OL_DAEMON_JSON",
@@ -764,10 +784,11 @@ function builderGuestScript(parts) {
     "mount -t cgroup2 cgroup2 /sys/fs/cgroup 2>/dev/null || true",
     `node /work/tools/dist/index.js vm-forward --listen ${BRIDGE_ADDRESS}:${TUNNEL_PORT} --to 127.0.0.1:${TUNNEL_PORT} > /run/builder/forward.log 2>&1 &`,
     "dockerd --config-file /run/builder/daemon.json > /run/builder/dockerd.log 2>&1 &",
+    "dockerd_pid=$!",
     "waited=0",
     "until docker info > /dev/null 2>&1; do",
     "  waited=$((waited + 1))",
-    `  if [ "$waited" -gt ${DOCKER_WAIT_SECONDS} ]; then echo "the Docker engine in the builder did not start:"; tail -n 20 /run/builder/dockerd.log; exit 1; fi`,
+    `  if [ "$waited" -gt ${DOCKER_WAIT_SECONDS} ]; then echo "the Docker engine in the builder did not start:"; ${engineLogExcerpt("/run/builder/dockerd.log")}; exit 1; fi`,
     "  sleep 1",
     "done",
     build,
@@ -896,6 +917,7 @@ async function buildInBuilder(opts, deps, prepared) {
   }, Math.max(0, opts.deadlineMs - Date.now()));
   const tail = [];
   let result;
+  let enginePanic;
   let pending = "";
   let logged = 0;
   let hostFailure;
@@ -925,6 +947,8 @@ async function buildInBuilder(opts, deps, prepared) {
     }
     for (const line of lines) {
       if (line.startsWith(RESULT_PREFIX)) result = line.slice(RESULT_PREFIX.length);
+      else if (line.startsWith(ENGINE_PANIC_PREFIX)) enginePanic ??= line.slice(ENGINE_PANIC_PREFIX.length);
+      else if (line === ENGINE_STOPPED_LINE) continue;
       else {
         tail.push(line);
         if (tail.length > LOG_TAIL_LINES) tail.shift();
@@ -983,12 +1007,12 @@ async function buildInBuilder(opts, deps, prepared) {
     } else {
       state.cgroup = ports.cgroup.create(id, opts.limits.memoryBytes);
       if (state.cgroup !== void 0) record.cgroup = state.cgroup;
-      state.firecracker = await ports.firecracker.spawn({ binary: opts.firecracker, configPath, consolePath: join(dir, "console.log"), cgroup: state.cgroup });
+      state.firecracker = await ports.firecracker.spawn({ binary: opts.firecracker, configPath, consolePath: builderConsolePath(dir), cgroup: state.cgroup });
       record.firecracker = state.firecracker;
       writeBuilderRecord(dir, record);
     }
     if (!await waitForAgent(state.vsockPath, { attempts: BOOT_ATTEMPTS, delayMs: BOOT_POLL_MS, sleep, onFailure: () => void 0 })) {
-      throw new StepFailed(`the builder microVM did not start: its exec agent did not answer${state.jailed === void 0 ? ` (console in ${join(dir, "console.log")})` : `; its console output is in the journal of the unit ${state.jailed.unit}`}`);
+      throw new StepFailed(`the builder microVM did not start: its exec agent did not answer${state.jailed === void 0 ? ` (console in ${builderConsolePath(dir)})` : `; its console output is in the journal of the unit ${state.jailed.unit}`}`);
     }
     const space = await cacheSpace();
     check(0, "checking the builder's cache disk");
@@ -1020,7 +1044,7 @@ async function buildInBuilder(opts, deps, prepared) {
     for (const { target, stream } of inputs) {
       let status;
       try {
-        status = (await ports.exec(state.vsockPath, exec(["tar", "-x", "--no-same-owner", "-C", target]), { stdin: stream, signal: controller.signal })).status;
+        status = (await ports.exec(state.vsockPath, exec(unpackCommand(target)), { stdin: stream, signal: controller.signal })).status;
       } catch (err) {
         if (hostFailure !== void 0 || controller.signal.aborted) throw err;
         throw new StepFailed(`unpacking ${target} in the builder failed: ${err instanceof Error ? err.message : String(err)}${await spaceNote()}`);
@@ -1115,7 +1139,8 @@ async function buildInBuilder(opts, deps, prepared) {
     if (err instanceof StepFailed && refusals.length > 0) return new RecipeError("image_builder_failed", refusalReason(refusals, logPath), logPath);
     const last = tail.filter((line) => line.trim() !== "").at(-1);
     const why = err instanceof StepFailed ? err.message : `the builder microVM failed: ${describeCallFailure(err)}`;
-    return new RecipeError("image_builder_failed", `${why}${last === void 0 ? "" : `; the last line was: ${last}`}. The build log is at ${logPath}`, logPath);
+    const panicNote = enginePanic === void 0 ? "" : `; the first panic in the Docker engine's log was: ${enginePanic}`;
+    return new RecipeError("image_builder_failed", `${why}${panicNote}${last === void 0 ? "" : `; the last line was: ${last}`}. The build log is at ${logPath}`, logPath);
   }
   async function stopBuilder() {
     let ok = true;

package/dist/{chunk-533QGXGZ.js → chunk-PWB7EK4Z.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-LH3KULPL.js → chunk-QPAPHQZ7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-C3XLVHN6.js → chunk-RLGSBR56.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-B3EE7OKK.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-CMNAAKFD.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
-import { resolveGatewayCredentials } from './chunk-VQ2JGZSC.js';
+import { resolveGatewayCredentials } from './chunk-FLFK42YF.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-XTNMIV77.js → chunk-TTACRX4N.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-HDSDUTX4.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-D5ZGMXUL.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-LWODW66U.js → chunk-VGIS2D3U.js}

@@ -1,35 +1,35 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-ELYHDWCC.js';
-import { writeDockerClientConfig } from './chunk-XTNMIV77.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HAD7LYDL.js';
+import { writeDockerClientConfig } from './chunk-TTACRX4N.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-QJNFO7TQ.js';
-import { installScrubContext } from './chunk-WHRR55PC.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-D7ECJX4J.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-IK6M37BI.js';
+import { senderPidfile } from './chunk-JUVUVXQZ.js';
+import { installScrubContext } from './chunk-J6LFFZOY.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-OKTLQTWH.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-7HMF7I3D.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { waitForAgent, vmExecArgs } from './chunk-QQGZ5THT.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-HIGJTX5U.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-LCVR4UIS.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-S2IJQER5.js';
+import { waitForAgent, vmExecArgs } from './chunk-XXVYHC6D.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-O5F376JJ.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-JKPJQNJF.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-LG2IQRTO.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-R6QCSHKC.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ALSE7YKX.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ZQ7VRXYM.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6JNCNHSV.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-KQFWTTG7.js';
 import { planArtifactUpload } from './chunk-EWVYQLD3.js';
 import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-JT3YO5MH.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath } from './chunk-ESP5VZBD.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-HDSDUTX4.js';
+import { signerFor } from './chunk-634F6J3Q.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-MBGS33SL.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-D5ZGMXUL.js';
 import { resolvePackRoot } from './chunk-G63KT5I5.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-LJG6EMLJ.js';
 import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-E6CO3MJE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { fdName } from './chunk-XD4ZCMA4.js';
+import { fdName } from './chunk-HACGUL52.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, accessSync, constants, openSync, readFileSync, closeSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';
@@ -280,7 +280,7 @@ async function keepSockets(runtime, buildId, listeners, leaseServer, line, error
     }
   } catch (err) {
     error(`this build ends with its runner: its sockets could not be kept for the next one: ${describeCallFailure(err)}`);
-    for (const name of stored) await store.remove(name).catch(() => void 0);
+    for (const name of stored) await store.remove(name).catch((removeErr) => error(`the descriptor ${name} could not be taken out of the store: ${describeCallFailure(removeErr)}`));
     return [];
   }
   return stored;
@@ -476,7 +476,7 @@ async function provisionMicroVm(input) {
     }
     if (state.cgroup !== void 0) input.save(state, environment);
   }
-  const consolePath = join(jobDir, "vm-console.log");
+  const consolePath = jobConsolePath(jobDir);
   if (helper !== void 0) {
     try {
       await startJailedInto(
@@ -872,7 +872,7 @@ async function startCheckMicroVm(input) {
   };
   const checksDir = join(jobDir, "checks");
   mkdirSync(checksDir, { recursive: true });
-  const consolePath = join(checksDir, "vm-console.log");
+  const consolePath = jobConsolePath(checksDir);
   input.save(state);
   const fail = async (reason) => {
     try {
@@ -1024,7 +1024,7 @@ async function stopBuildMicroVm(runtime, state, jobDir) {
   await runtime.vm.firecracker.stop(state.firecracker);
   if (runtime.vm.firecracker.alive(state.firecracker)) throw new Error(`the microVM (pid ${state.firecracker.pid}) is still running after it was stopped`);
 }
-async function cleanupMicroVm(runtime, state, jobDir) {
+async function cleanupMicroVm(runtime, state, jobDir, warn) {
   const failures = [];
   if (jobDir !== void 0) await copyHookErrors(runtime, state, jobDir);
   if (state.jailed !== void 0) {
@@ -1056,7 +1056,9 @@ async function cleanupMicroVm(runtime, state, jobDir) {
     runtime.tunnels.delete(state.buildId);
     await tunnel.close();
   }
-  for (const name of state.fdStore ?? []) await runtime.vm.fdStore.remove(name).catch(() => void 0);
+  for (const name of state.fdStore ?? []) {
+    await runtime.vm.fdStore.remove(name).catch((err) => warn?.(`the descriptor ${name} could not be taken out of the store: ${describeCallFailure(err)}`));
+  }
   rmSync(state.buildDir, { recursive: true, force: true });
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
@@ -3205,7 +3207,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       let cleanedUp = true;
       tunnelRecord = vmBuild.runtime.tunnels.get(vmBuild.state.buildId)?.record();
       try {
-        await cleanupMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath);
+        await cleanupMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath, (text2) => log.error(`${tag} ${text2}`));
       } catch (err) {
         cleanedUp = false;
         log.error(`${tag} cleanup failed: ${describeCallFailure(err)} \xB7 continuing`);

package/dist/{chunk-2GHI2J26.js → chunk-VHRKGCBY.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-DY7Y7UT4.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-HJYBWJAS.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-JZ4FXSLI.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-YMGSMPPW.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-AVTI3FL5.js';

package/dist/{chunk-M5ZXOQYS.js → chunk-W4UFGYKQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-HBBCQ5NE.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-A6MLCH76.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-OJ63GRZ2.js → chunk-XCUXPSHL.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-C3XLVHN6.js';
+import { autoConnect, detectActiveSession } from './chunk-RLGSBR56.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-VQ2JGZSC.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-FLFK42YF.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-QQGZ5THT.js → chunk-XXVYHC6D.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-HIGJTX5U.js';
+import { EXEC_PORT } from './chunk-O5F376JJ.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-A3H27SYX.js → chunk-Y53T3QZM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-3VGDZ23W.js';
+import { currentLink } from './chunk-O7MSQBTH.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-JZ4FXSLI.js → chunk-YMGSMPPW.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-UIUGTW5C.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-VQ2JGZSC.js';
-import { withTokenHeader } from './chunk-HDSDUTX4.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-FLFK42YF.js';
+import { withTokenHeader } from './chunk-D5ZGMXUL.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-L3DUKDTR.js → chunk-ZANK3WWF.js}

@@ -684,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-K7YD6KEN.js');
+  const { governanceOf } = await import('./control-plane-launch-O3TXH3LI.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-IPJ6HR7E.js → chunk-ZFJAQS3A.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ESP5VZBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-ALSE7YKX.js → chunk-ZQ7VRXYM.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-HDSDUTX4.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-D5ZGMXUL.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';

package/dist/{chunk-J42MMS4R.js → chunk-ZQSCE7M4.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-C3XLVHN6.js';
+import { detectActiveSession, autoConnect } from './chunk-RLGSBR56.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-VQ2JGZSC.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FLFK42YF.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { CriteriaListSchema } from './chunk-E6CO3MJE.js';

package/dist/{chunk-V2EUC2MJ.js → chunk-ZZAA73E5.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-WHRR55PC.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-J6LFFZOY.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-C3XLVHN6.js';
+import { detectActiveSession, autoConnect } from './chunk-RLGSBR56.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-VQ2JGZSC.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FLFK42YF.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-E6CO3MJE.js';