@outerlayer/cli 0.33.0-next.20261022180022 → 0.33.0-next.20261022182214

package/README.md

@@ -223,7 +223,10 @@ content:
   build uses the host's network: the build's tunnel does not carry it, and
   `runner.build.allowHosts` does not limit it.
 - **`outerlayer runner start` with `builtin:vm` hooks** runs each build in its
-  own Firecracker microVM, which has no network device. The first microVM
+  own Firecracker microVM, which has no network card. Every TCP connection
+  of every program in it goes through the runner's tunnel, whether or not the
+  program reads the proxy variables, and `runner.build.allowHosts` narrows what
+  it reaches. No DNS query or UDP packet leaves the microVM. The first microVM
   build downloads a pinned Firecracker release from github.com. It also
   downloads a guest kernel and a guest helper from the releases of the public
   repository `outerlayerai/guest-assets` on github.com. The runner checks each

package/dist/{build-2ONBPS3M.js → build-RBLDHQTY.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-7HMF7I3D.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-MBGS33SL.js';
 import './chunk-D5ZGMXUL.js';
 import './chunk-HACGUL52.js';

package/dist/{build-disk-PCDS676T.js → build-disk-4EEKP23Z.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-JFRBPBD5.js';
+export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-3BGCXC3O.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
 import './chunk-634F6J3Q.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-22T18:03:01.584Z+80747d3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-22T18:25:50.694Z+4fc4b3d","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-AIKWGJHP.js → builder-V3KALVKL.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-LG2IQRTO.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
 import './chunk-634F6J3Q.js';

package/dist/{check-LGZOJYLS.js → check-LDDMISY6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-J5VNSW4W.js';
-import './chunk-VGIS2D3U.js';
+import { probeCredentials } from './chunk-MCIPCQP3.js';
+import './chunk-IQFX5GQH.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-QPAPHQZ7.js';
 import './chunk-3JVYMD4G.js';
@@ -9,22 +9,22 @@ import './chunk-E7R2GIAW.js';
 import './chunk-W4UFGYKQ.js';
 import './chunk-YKYCE4HY.js';
 import './chunk-5KO3TN2F.js';
-import './chunk-HAD7LYDL.js';
+import './chunk-COLOLDY3.js';
 import './chunk-TTACRX4N.js';
 import './chunk-I3LTIAOR.js';
 import './chunk-JUVUVXQZ.js';
 import './chunk-J6LFFZOY.js';
 import './chunk-EBX2DU2M.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-7SCEDWQP.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-PAFSFC6Q.js';
 import './chunk-O7MSQBTH.js';
 import './chunk-TBT347UY.js';
-import './chunk-M7IA4JOX.js';
+import './chunk-33SMNWZX.js';
 import './chunk-HDD3BKAE.js';
-import './chunk-6KVKEZTH.js';
-import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-OKTLQTWH.js';
+import './chunk-F5HZT672.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -34,11 +34,11 @@ import './chunk-JKPJQNJF.js';
 import './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME } from './chunk-A6MLCH76.js';
-import './chunk-JFRBPBD5.js';
+import './chunk-3BGCXC3O.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-ZQ7VRXYM.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';

package/dist/{chunk-M7IA4JOX.js → chunk-33SMNWZX.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-HDD3BKAE.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-6KVKEZTH.js';
-import { MIN_ENGINE_MAJOR } from './chunk-OKTLQTWH.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-F5HZT672.js';
+import { MIN_ENGINE_MAJOR } from './chunk-JDKLORO3.js';
 import { runnerCredentialProblem } from './chunk-ZQ7VRXYM.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';

package/dist/{chunk-JFRBPBD5.js → chunk-3BGCXC3O.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { formatBytes, freeBytes } from './chunk-YYYRBYWG.js';
-import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-LG2IQRTO.js';
+import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-5CZV4FZ5.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { buildsDir, rootfsDir, runnerDir } from './chunk-MBGS33SL.js';
 import { spawnSync } from 'child_process';

package/dist/{chunk-GDI6QGRH.js → chunk-4AHKR3K5.js}

@@ -1190,7 +1190,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK } = await import('./build-disk-PCDS676T.js');
+  const { DEFAULT_BUILD_DISK } = await import('./build-disk-4EEKP23Z.js');
   const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-WAIYUZUG.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
@@ -1212,7 +1212,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-C3JKNKEJ.js');
+    const { runnerHostChecks } = await import('./doctor-KT4HGALK.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{chunk-LG2IQRTO.js → chunk-5CZV4FZ5.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-3Z3MPR55.js';
-import { BUILDKIT_IMAGE } from './chunk-R6QCSHKC.js';
+import { BUILDKIT_IMAGE } from './chunk-KFA762LZ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { compareVersions } from './chunk-5DNCFOXA.js';
 import { ensureHostKey } from './chunk-634F6J3Q.js';

package/dist/{chunk-HAD7LYDL.js → chunk-COLOLDY3.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-TTACRX4N.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-TTACRX4N.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { EXEC_PORT } from './chunk-O5F376JJ.js';
 import { RELAY_PORT } from './chunk-D5ZGMXUL.js';
 import { spawn, spawnSync } from 'child_process';
-import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync } from 'fs';
+import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 
 createRequire(import.meta.url);
 var HELPER_PATH = "/opt/outerlayer/bin/outerlayer-guest";
@@ -19,9 +19,17 @@ var DOCKER_DATA_ROOT = "/build/docker";
 var BUILD_DISK = "/dev/vdb";
 var HOSTNAME = "outerlayer-build";
 var HOSTS = "127.0.0.1 localhost\n::1 localhost ip6-localhost ip6-loopback\n";
-var RESOLV_CONF = "# This microVM has no network device. Names are resolved by the runner's proxy.\n";
+var NAME_SERVER = "127.0.0.53";
+var RESOLV_CONF = `# The guest helper answers every lookup. The runner's tunnel resolves a name when a program connects to it.
+nameserver ${NAME_SERVER}
+`;
+var NSSWITCH_CONF = "hosts: files dns\n";
+var NSSWITCH_PATH = "/etc/nsswitch.conf";
+var NET_READY = "/run/outerlayer-net.ready";
+var TUN_DEVICE = "tun0";
 var BUILD_DIRECTORIES = ["/build/tmp", "/build/home", "/build/work"];
 var WORLD_WRITABLE = 1023;
+var NET_READY_TIMEOUT_MS = 3e4;
 function relayPortsFrom(cmdline) {
   const value = new RegExp(`(?:^|\\s)${KERNEL_FLAG.replace(".", "\\.")}=(\\S*)`).exec(cmdline)?.[1];
   if (value === void 0 || value === "") return [];
@@ -89,6 +97,7 @@ function runGuestInit(host, cmdline) {
 `],
     ["resolv.conf", RESOLV_CONF]
   ];
+  if (!host.exists(NSSWITCH_PATH)) files.push(["nsswitch.conf", NSSWITCH_CONF]);
   for (const [name, text] of files) {
     host.writeFile(`/run/${name}`, text);
     host.mount({ source: `/run/${name}`, target: `/etc/${name}`, bind: true });
@@ -96,15 +105,32 @@ function runGuestInit(host, cmdline) {
   host.writeFile("/proc/sys/kernel/hostname", HOSTNAME);
   host.mount({ source: "tmpfs", target: "/outerlayer/job", type: "tmpfs", options: "mode=0755" });
   const relay = host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
+  const net = host.spawnDetached([HELPER_PATH, "net", "--tun", TUN_DEVICE, "--dns", `${NAME_SERVER}:53`, "--tunnel-port", String(TUNNEL_PORT)]);
+  host.waitForFile(NET_READY);
   if (dockerRequestedBy(cmdline)) {
     startBridgeForwarder(host);
     startDocker(host);
   }
   const agent = host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
-  host.writeFile(HELPER_RECORD, [relay, agent].map((started) => `${started.pid} ${started.start}
+  host.writeFile(HELPER_RECORD, [relay, net, agent].map((started) => `${started.pid} ${started.start}
 `).join(""));
 }
-function realGuestHost() {
+var PAUSE_MS = 20;
+function realProbe() {
+  return {
+    now: () => Date.now(),
+    exists: (path) => existsSync(path),
+    sleep: (ms) => void Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+  };
+}
+function waitForPath(path, timeoutMs, probe = realProbe()) {
+  const deadline = probe.now() + timeoutMs;
+  while (!probe.exists(path)) {
+    if (probe.now() > deadline) throw new Error(`${path} did not appear within ${timeoutMs / 1e3} seconds; the guest helper's network stack did not start`);
+    probe.sleep(PAUSE_MS);
+  }
+}
+function realGuestHost(netReadyTimeoutMs = NET_READY_TIMEOUT_MS) {
   return {
     mount(args) {
       const argv = ["mount", "--target", args.target];
@@ -127,6 +153,7 @@ function realGuestHost() {
       }
     },
     symlink: (target, path) => symlinkSync(target, path),
+    waitForFile: (path) => waitForPath(path, netReadyTimeoutMs),
     warn: (text) => void process.stderr.write(`${text}
 `),
     spawnDetached(argv) {
@@ -141,4 +168,4 @@ function realGuestHost() {
   };
 }
 
-export { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD, realGuestHost, relayPortsFrom, runGuestInit };
+export { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD, realGuestHost, relayPortsFrom, runGuestInit, waitForPath };

package/dist/{chunk-6KVKEZTH.js → chunk-F5HZT672.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-OKTLQTWH.js';
+import { MIN_ENGINE_MAJOR } from './chunk-JDKLORO3.js';
 import { runnerImageVersion } from './chunk-PWB7EK4Z.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-R6QCSHKC.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-KFA762LZ.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-VGIS2D3U.js → chunk-IQFX5GQH.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HAD7LYDL.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-COLOLDY3.js';
 import { writeDockerClientConfig } from './chunk-TTACRX4N.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
 import { senderPidfile } from './chunk-JUVUVXQZ.js';
 import { installScrubContext } from './chunk-J6LFFZOY.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-OKTLQTWH.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-7HMF7I3D.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JDKLORO3.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-MWAA3A5T.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-XXVYHC6D.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-O5F376JJ.js';
 import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-JKPJQNJF.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-LG2IQRTO.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-R6QCSHKC.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-5CZV4FZ5.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-KFA762LZ.js';
 import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ZQ7VRXYM.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-KQFWTTG7.js';

package/dist/{chunk-OKTLQTWH.js → chunk-JDKLORO3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-7HMF7I3D.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-MWAA3A5T.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-XXVYHC6D.js';
@@ -9,9 +9,9 @@ import { GUEST_CID, linkVsockSockets } from './chunk-O5F376JJ.js';
 import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-JKPJQNJF.js';
 import { runnerImageVersion } from './chunk-PWB7EK4Z.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-LG2IQRTO.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-5CZV4FZ5.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-R6QCSHKC.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-KFA762LZ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDu } from './chunk-YJLHUKYS.js';
 import { WorkCommandError } from './chunk-KQFWTTG7.js';

package/dist/{chunk-R6QCSHKC.js → chunk-KFA762LZ.js}

@@ -29,13 +29,13 @@ var FIRECRACKER_SHA256 = {
 var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
-var GUEST_ASSETS_VERSION = "7";
+var GUEST_ASSETS_VERSION = "11";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
   x86_64: "8552fad4bdea1d49f3e7d2aa500ce3f8918fcd2fc66779fd83235949688a39bb"
 };
 var GUEST_HELPER_SHA256 = {
-  x86_64: "0ae934d3ad3f2a94abffcc3f044ba633b1a523dc17ff0c2bc322ed7d7fc505ea"
+  x86_64: "e373f0fdb192e9930d19dd39cf75ff1c6cf08fdf5a0f041f12c1f999919fc05a"
 };
 function guestAssetsPinned(arch) {
   const zero = "0".repeat(64);

package/dist/{chunk-J5VNSW4W.js → chunk-MCIPCQP3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-VGIS2D3U.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-IQFX5GQH.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-QPAPHQZ7.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
@@ -8,17 +8,17 @@ import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest
 import { fitImageBuildMemory } from './chunk-W4UFGYKQ.js';
 import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
 import { writePendingUpdate } from './chunk-5KO3TN2F.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-7SCEDWQP.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-PAFSFC6Q.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-O7MSQBTH.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-OKTLQTWH.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JDKLORO3.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-ZFJAQS3A.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-JKPJQNJF.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-PWB7EK4Z.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-LG2IQRTO.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-5CZV4FZ5.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ZQ7VRXYM.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
 import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KQFWTTG7.js';
@@ -3033,7 +3033,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-LGZOJYLS.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-LDDMISY6.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-7HMF7I3D.js → chunk-MWAA3A5T.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-ZFJAQS3A.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-R6QCSHKC.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-KFA762LZ.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-MBGS33SL.js';
 import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-D5ZGMXUL.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';

package/dist/{chunk-7SCEDWQP.js → chunk-PAFSFC6Q.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-M7IA4JOX.js';
+import { isPlaceholderCommand } from './chunk-33SMNWZX.js';
 import { describeCallFailure } from './chunk-JKPJQNJF.js';
 import { checkFit } from './chunk-A6MLCH76.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-JFRBPBD5.js';
-import { builderDiskPinned } from './chunk-R6QCSHKC.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-3BGCXC3O.js';
+import { builderDiskPinned } from './chunk-KFA762LZ.js';
 import { builtinKind, imageBuildOf } from './chunk-ZQ7VRXYM.js';
 import { WorkCommandError, getJson } from './chunk-KQFWTTG7.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';

package/dist/{cli-2LCCZQA6.js → cli-QUV5HTDW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-GDI6QGRH.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-4AHKR3K5.js';
 import './chunk-BJQ25STI.js';
 import './chunk-LOYLFW4I.js';
 import './chunk-KT4CN6OU.js';
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-3YBDLWPR.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-E7DMPT6E.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-3YBDLWPR.js');
+    const { runInitCommand } = await import('./init-cmd-E7DMPT6E.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4199,7 +4199,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("vm-init", { hidden: true }).description("lay out a microVM build's guest; the guest helper runs it").action(async () => {
-    const { realGuestHost, runGuestInit } = await import('./guest-init-KDK4DQFK.js');
+    const { realGuestHost, runGuestInit } = await import('./guest-init-TGECSRKO.js');
     const { readFileSync: readFileSync3 } = await import('fs');
     try {
       runGuestInit(realGuestHost(), readFileSync3("/proc/cmdline", "utf8"));
@@ -4387,7 +4387,7 @@ check. A chapter reads yes when every still matches and no when one differs; the
 the region. One run, or a chapter with no stills, reads not checked. Comparing never changes which clips bind.
 `
   ).action(async (manifest, opts) => {
-    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-AKRXCWLK.js');
+    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-Q6W74DCY.js');
     let item;
     if (opts.item !== void 0) {
       item = parseTrackerNumber(opts.item);
@@ -5038,7 +5038,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-WAIYUZUG.js');
-    const { start, RunnerStartError } = await import('./loop-3YF4S4CA.js');
+    const { start, RunnerStartError } = await import('./loop-7MFQISEV.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-ZWJLQIJV.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5057,8 +5057,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-WAIYUZUG.js');
-    const { containerStart } = await import('./container-start-RWOEQUCC.js');
-    const { start, RunnerStartError } = await import('./loop-3YF4S4CA.js');
+    const { containerStart } = await import('./container-start-SL63GFLG.js');
+    const { start, RunnerStartError } = await import('./loop-7MFQISEV.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-ZWJLQIJV.js');
     try {
       const result = await containerStart({
@@ -5078,7 +5078,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WAIYUZUG.js');
-    const { runRunnerCheck } = await import('./check-LGZOJYLS.js');
+    const { runRunnerCheck } = await import('./check-LDDMISY6.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5112,7 +5112,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-2EJ76XJH.js');
+        const { installServiceCommand } = await import('./command-LEE7TFQE.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5168,7 +5168,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-WAIYUZUG.js');
-    const { uninstallServiceCommand } = await import('./command-2EJ76XJH.js');
+    const { uninstallServiceCommand } = await import('./command-LEE7TFQE.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5196,10 +5196,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-WAIYUZUG.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-ZCZVN3AI.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-CBL5552Z.js');
-    const { detectMachine } = await import('./machine-X3EYEXEM.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-2LWFZK45.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-BMTDKZU6.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-3STHCRT5.js');
+    const { detectMachine } = await import('./machine-4QGWUII5.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-7P6JHB6Z.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-V37JMYNW.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5350,7 +5350,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-2EJ76XJH.js');
+        const { installServiceCommand } = await import('./command-LEE7TFQE.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5395,10 +5395,10 @@ Next:
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WAIYUZUG.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-2ONBPS3M.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-RBLDHQTY.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-NDEA46KV.js');
-    const { builderSpec } = await import('./builder-AIKWGJHP.js');
+    const { createDockerHost } = await import('./docker-WVTQTRSC.js');
+    const { builderSpec } = await import('./builder-V3KALVKL.js');
     const { loadRunnerConfig } = await import('./config-WAIYUZUG.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
@@ -5410,7 +5410,7 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-77KVP24W.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-X3UP5IQ4.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
@@ -5478,7 +5478,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WAIYUZUG.js');
-    const { requestStop } = await import('./loop-3YF4S4CA.js');
+    const { requestStop } = await import('./loop-7MFQISEV.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-6U7UYPIT.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5486,8 +5486,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-WAIYUZUG.js');
     const { jobsDir, runnerDir } = await import('./paths-FE7TXSTA.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-3YF4S4CA.js');
-    const { renderStatus } = await import('./status-TGQTGC7B.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-7MFQISEV.js');
+    const { renderStatus } = await import('./status-WS2REEFU.js');
     const { readHousekeepingRecord } = await import('./record-JGQ3CCKH.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5547,7 +5547,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WAIYUZUG.js');
-    const { listJobFiles } = await import('./loop-3YF4S4CA.js');
+    const { listJobFiles } = await import('./loop-7MFQISEV.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-2XVSZODP.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-2EJ76XJH.js → command-LEE7TFQE.js}

@@ -3,10 +3,10 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-DZGLRVS3.js';
 import './chunk-Y53T3QZM.js';
 import { currentLink, execStartCommand } from './chunk-O7MSQBTH.js';
-import { detectMachine } from './chunk-6KVKEZTH.js';
-import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-OKTLQTWH.js';
+import { detectMachine } from './chunk-F5HZT672.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -17,9 +17,9 @@ import './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-A6MLCH76.js';
 import './chunk-YYYRBYWG.js';
-import { readJobFile } from './chunk-LG2IQRTO.js';
+import { readJobFile } from './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-R6QCSHKC.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-KFA762LZ.js';
 import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-ZQ7VRXYM.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';

package/dist/{container-start-RWOEQUCC.js → container-start-SL63GFLG.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILD_MEMORY_VARIABLE } from './chunk-W4UFGYKQ.js';
-import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-M7IA4JOX.js';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-33SMNWZX.js';
 import { isAgentName, AGENT_COMMANDS } from './chunk-HDD3BKAE.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-6KVKEZTH.js';
-import { MIN_ENGINE_MAJOR } from './chunk-OKTLQTWH.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-F5HZT672.js';
+import { MIN_ENGINE_MAJOR } from './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -17,9 +17,9 @@ import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-PWB7EK4Z.js'
 import './chunk-TQMI335S.js';
 import './chunk-A6MLCH76.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-ZQ7VRXYM.js';
 import './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';

package/dist/{docker-NDEA46KV.js → docker-WVTQTRSC.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { childEnvironment, createDockerHost, spawnRun } from './chunk-LG2IQRTO.js';
+export { childEnvironment, createDockerHost, spawnRun } from './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
 import './chunk-634F6J3Q.js';

package/dist/{doctor-C3JKNKEJ.js → doctor-KT4HGALK.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, managedProblems, missingPermissionOf, missingPermissionFix } from './chunk-7SCEDWQP.js';
+import { needsClaudeCredential, claudeCredentialCheck, managedProblems, missingPermissionOf, missingPermissionFix } from './chunk-PAFSFC6Q.js';
 import { launcherCheck } from './chunk-Y53T3QZM.js';
 import './chunk-O7MSQBTH.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-M7IA4JOX.js';
+import './chunk-33SMNWZX.js';
 import './chunk-HDD3BKAE.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-6KVKEZTH.js';
-import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-OKTLQTWH.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-F5HZT672.js';
+import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -19,11 +19,11 @@ import './chunk-JKPJQNJF.js';
 import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import './chunk-A6MLCH76.js';
-import { realBuildDiskProbe, DEFAULT_BUILD_DISK, checkDiskFit } from './chunk-JFRBPBD5.js';
+import { realBuildDiskProbe, DEFAULT_BUILD_DISK, checkDiskFit } from './chunk-3BGCXC3O.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-LG2IQRTO.js';
+import { resolveDevcontainerCli, buildxState, spawnRun } from './chunk-5CZV4FZ5.js';
 import { locateRecipe, assertBuildable, readRecipe, RecipeError } from './chunk-3Z3MPR55.js';
-import { FIRECRACKER_VERSION, builderDiskPinned, CLAUDE_CODE_VERSION } from './chunk-R6QCSHKC.js';
+import { FIRECRACKER_VERSION, builderDiskPinned, CLAUDE_CODE_VERSION } from './chunk-KFA762LZ.js';
 import { builtinKind } from './chunk-ZQ7VRXYM.js';
 import { allowHostProblem, MAX_ALLOW_HOSTS } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';

package/dist/{emit-demo-cmd-AKRXCWLK.js → emit-demo-cmd-Q6W74DCY.js}

@@ -6,7 +6,7 @@ import './chunk-EBX2DU2M.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
 import { VoiceDownloadError, downloadPinned, sha256OfFile } from './chunk-2PGI6RDE.js';
-import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-R6QCSHKC.js';
+import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-KFA762LZ.js';
 import { detectActiveSession, autoConnect } from './chunk-RLGSBR56.js';
 import './chunk-CMNAAKFD.js';
 import './chunk-EWVYQLD3.js';

package/dist/{guest-init-KDK4DQFK.js → guest-init-TGECSRKO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-HAD7LYDL.js';
+export { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD, realGuestHost, relayPortsFrom, runGuestInit, waitForPath } from './chunk-COLOLDY3.js';
 import './chunk-TTACRX4N.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-O5F376JJ.js';

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-PXSDGAUP.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-2LCCZQA6.js');
+var { runCli } = await import('./cli-QUV5HTDW.js');
 await runCli(process.argv);

package/dist/{init-2LWFZK45.js → init-7P6JHB6Z.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-E7R2GIAW.js';
-import { RunnerInitError, readConfigObject } from './chunk-M7IA4JOX.js';
+import { RunnerInitError, readConfigObject } from './chunk-33SMNWZX.js';
 import './chunk-HDD3BKAE.js';
-import './chunk-6KVKEZTH.js';
-import './chunk-OKTLQTWH.js';
+import './chunk-F5HZT672.js';
+import './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -17,9 +17,9 @@ import './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import { checkFit, VM_SERVICE_NAME, RUNNER_RESERVE_BYTES } from './chunk-A6MLCH76.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import { runnerCredentialProblem, resolveBuild, resolveHousekeeping } from './chunk-ZQ7VRXYM.js';
 import './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';

package/dist/{init-ZCZVN3AI.js → init-BMTDKZU6.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-M7IA4JOX.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-33SMNWZX.js';
 import './chunk-HDD3BKAE.js';
-import './chunk-6KVKEZTH.js';
-import './chunk-OKTLQTWH.js';
+import './chunk-F5HZT672.js';
+import './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -16,9 +16,9 @@ import './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import './chunk-A6MLCH76.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-ZQ7VRXYM.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';

package/dist/{init-cmd-3YBDLWPR.js → init-cmd-E7DMPT6E.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-GDI6QGRH.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-4AHKR3K5.js';
 import './chunk-BJQ25STI.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-LOYLFW4I.js';

package/dist/{loop-3YF4S4CA.js → loop-7MFQISEV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-J5VNSW4W.js';
-import './chunk-VGIS2D3U.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-MCIPCQP3.js';
+import './chunk-IQFX5GQH.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-QPAPHQZ7.js';
 import './chunk-3JVYMD4G.js';
@@ -9,22 +9,22 @@ import './chunk-E7R2GIAW.js';
 import './chunk-W4UFGYKQ.js';
 import './chunk-YKYCE4HY.js';
 import './chunk-5KO3TN2F.js';
-import './chunk-HAD7LYDL.js';
+import './chunk-COLOLDY3.js';
 import './chunk-TTACRX4N.js';
 import './chunk-I3LTIAOR.js';
 import './chunk-JUVUVXQZ.js';
 import './chunk-J6LFFZOY.js';
 import './chunk-EBX2DU2M.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-7SCEDWQP.js';
+import './chunk-PAFSFC6Q.js';
 import './chunk-O7MSQBTH.js';
 import './chunk-TBT347UY.js';
-import './chunk-M7IA4JOX.js';
+import './chunk-33SMNWZX.js';
 import './chunk-HDD3BKAE.js';
-import './chunk-6KVKEZTH.js';
-import './chunk-OKTLQTWH.js';
+import './chunk-F5HZT672.js';
+import './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -34,11 +34,11 @@ import './chunk-JKPJQNJF.js';
 import './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import './chunk-A6MLCH76.js';
-import './chunk-JFRBPBD5.js';
+import './chunk-3BGCXC3O.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-ZQ7VRXYM.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';

package/dist/{machine-X3EYEXEM.js → machine-4QGWUII5.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-6KVKEZTH.js';
-import './chunk-OKTLQTWH.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-F5HZT672.js';
+import './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -13,9 +13,9 @@ import './chunk-JKPJQNJF.js';
 import './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-KQFWTTG7.js';

package/dist/{runner-identity-77KVP24W.js → runner-identity-X3UP5IQ4.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RUNNER_LABEL, builderNameFor, dockerIdentity, ensureRunnerIdentity, pathLabelValue, readRunnerIdentity } from './chunk-LG2IQRTO.js';
+export { RUNNER_LABEL, builderNameFor, dockerIdentity, ensureRunnerIdentity, pathLabelValue, readRunnerIdentity } from './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
 import './chunk-634F6J3Q.js';

package/dist/{runner-key-CBL5552Z.js → runner-key-3STHCRT5.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-M7IA4JOX.js';
+import { readConfigObject, RunnerInitError } from './chunk-33SMNWZX.js';
 import './chunk-HDD3BKAE.js';
-import './chunk-6KVKEZTH.js';
-import './chunk-OKTLQTWH.js';
+import './chunk-F5HZT672.js';
+import './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -16,9 +16,9 @@ import './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import './chunk-A6MLCH76.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import { runnerCredentialProblem } from './chunk-ZQ7VRXYM.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';

package/dist/{status-TGQTGC7B.js → status-WS2REEFU.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-VGIS2D3U.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-IQFX5GQH.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import './chunk-HAD7LYDL.js';
+import './chunk-COLOLDY3.js';
 import './chunk-TTACRX4N.js';
 import './chunk-I3LTIAOR.js';
 import './chunk-JUVUVXQZ.js';
@@ -10,9 +10,9 @@ import './chunk-J6LFFZOY.js';
 import './chunk-EBX2DU2M.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
-import { LEASE_SECONDS } from './chunk-OKTLQTWH.js';
+import { LEASE_SECONDS } from './chunk-JDKLORO3.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
+import './chunk-MWAA3A5T.js';
 import './chunk-ZFJAQS3A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -22,9 +22,9 @@ import { formatDuration, formatClock, relativeToRunner } from './chunk-JKPJQNJF.
 import { pullInstruction } from './chunk-PWB7EK4Z.js';
 import './chunk-TQMI335S.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-5CZV4FZ5.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-ZQ7VRXYM.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.33.0-next.20261022180022",
+  "version": "0.33.0-next.20261022182214",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",

package/skill-pack/maintained/outerlayer-build/references/agent-briefs.md

@@ -258,9 +258,15 @@ For each criterion, put the capture in a script under
 you captured, and regenerating it must be one command. The scripts go when the
 run's report directory goes. The emitted artifacts outlive the run.
 
-Emit each artifact with `outerlayer emit artifact ... --for <criterion id>
---pr <number>`. Always pass `--pr`. Regenerate with `--replaces` any evidence
-the tree has since invalidated. Then run `outerlayer sync`.
+Record the criteria that declare `proof: video` as one demo, as the
+outerlayer-evidence skill's "Record a demo" says. Write one Playwright test with
+`@outerlayer/playwright` and one chapter for each of those criteria, in the
+criteria's order. Run it, then run `outerlayer emit demo <manifest> --item
+"$OUTERLAYER_WORK" --pr <number>`. Emit each other artifact with `outerlayer
+emit artifact ... --for <criterion id> --pr <number>`. Always pass `--pr`.
+When the tree invalidates a video, record and emit the whole demo again: the
+newer demo replaces the older one. Regenerate any other invalidated evidence
+with `--replaces`. Then run `outerlayer sync`.
 
 Write `build-reports/evidence.md` naming every criterion with its artifact, or
 with the reason none could be produced. A criterion you could not evidence is

package/skill-pack/maintained/outerlayer-build/references/evidence.md

@@ -15,8 +15,8 @@ the issue, the pull request number, the criteria that declare a proof form, the
 instructions-file pointer and the outerlayer-evidence skill.
 
 A criterion that declares `proof: screenshot` needs a screenshot bound to its
-id. One that declares `proof: video` needs a video. A screenshot never
-satisfies `proof: video`. A criterion with no proof form is proven by its
+id. One that declares `proof: video` needs a video: its chapter of the
+item's one demo. A screenshot never satisfies `proof: video`. A criterion with no proof form is proven by its
 test, and needs no artifact.
 
 When a commit lands on the branch after the evidence agent captured, decide for
@@ -25,7 +25,8 @@ a file the capture's subject runs through: the feature's own files, the shared
 code they import, a migration or schema behind them, or a test the capture is a
 log of. A sync that brings in only files the feature never reaches leaves the
 capture valid. Spawn the evidence agent again with the stale list. It reruns
-their scripts and emits each with `--replaces`. The final report names the
+their scripts and emits each with `--replaces`. A stale video means the whole
+demo is recorded and emitted again. The final report names the
 commit and every capture with its call, kept or regenerated. A commit that
 lands after this call reopens it. Never drive the browser yourself.
 

package/skill-pack/maintained/outerlayer-evidence/SKILL.md

@@ -29,9 +29,9 @@ artifact shares one upload cap of 8 MiB, whatever its kind:
 - **screenshot** (`.png`, `.jpg`) — one focused window or region showing the
   proven state. Crop noise; keep enough chrome (URL bar, test summary line)
   to show it is real.
-- **video** (`.webm`, `.mp4`) — a short recording of the flow, start to
-  outcome. Video is the kind most likely to hit the 8 MiB cap: trim dead
-  time, prefer webm.
+- **video** (`.webm`, `.mp4`) — a recording of the flow, start to outcome.
+  Record it as a demo chapter (see "Record a demo"). Video is the kind most
+  likely to hit the 8 MiB cap: trim dead time.
 - **report** (`.html`, `.pdf`) — generated reports: coverage, benchmark,
   audit output. Emit the file the tool produced, unedited.
 - **log** (`.txt`, `.log`) — command output proving a run happened: test
@@ -80,10 +80,11 @@ the recorded list does not hold gets no row.
 
 ## Record a demo
 
-For a criterion whose behavior shows on screen, record a demo instead of a
-lone screenshot. A demo has one chapter for each criterion. Each chapter is
-that criterion's video proof, with a spoken line that says what happens and
-a list of the checks that ran.
+Record every video proof as a chapter of the item's one demo. A demo has
+one chapter for each criterion that declares a video, in the criteria's
+order. Each chapter is that criterion's video proof, with a spoken line that
+says what happens and a list of the checks that ran. Emit a video with
+`emit artifact` only when Playwright cannot drive the flow.
 
 Write a Playwright test with `@outerlayer/playwright`, one `demo.chapter`
 for each criterion: