@outerlayer/cli 0.33.0-next.20261022182340 → 0.33.0-next.20261022195547

package/dist/{chunk-EYW2ZRDL.js → chunk-WCELNMXT.js}

@@ -79,10 +79,12 @@ var defaultGitRunner = (args, opts) => {
     return { ok: true, stdout: Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout), stderr: "" };
   } catch (err) {
     const e = err;
+    const stderr = e.stderr ? Buffer.from(e.stderr).toString("utf8") : "";
     return {
       ok: false,
       stdout: e.stdout ? Buffer.from(e.stdout) : Buffer.alloc(0),
-      stderr: e.stderr ? Buffer.from(e.stderr).toString("utf8") : e.message ?? String(err)
+      stderr: stderr === "" ? e.message ?? String(err) : stderr,
+      ...e.code === "ETIMEDOUT" ? { timedOut: true } : {}
     };
   }
 };
@@ -90,6 +92,36 @@ function gitText(git, cwd, args, timeoutMs) {
   const result = git(args, { cwd, timeoutMs });
   return result.ok ? result.stdout.toString("utf8").trim() : void 0;
 }
+function fetchFailureDetail(result, timeoutMs) {
+  if (result.timedOut === true) return `git fetch did not finish within ${timeoutMs / 1e3} seconds`;
+  const lines = result.stderr.split("\n").map((line2) => line2.trim()).filter((line2) => line2 !== "");
+  const line = lines.find((candidate) => /^(fatal|error):/.test(candidate)) ?? lines.at(-1) ?? "git fetch failed";
+  return line.replace(/(\w+:\/\/)[^/@\s]+@/g, "$1").slice(0, 300);
+}
+async function fetchControlPlaneCommit(input) {
+  const { git, home, repository, sha, remoteUrl, policy } = input;
+  const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
+  const cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
+  const localRef = `refs/outerlayer/sha-${sanitizeRefName(sha)}`;
+  if (policy.reuseCached && gitText(git, cacheRepoDir, ["rev-parse", "--verify", "--quiet", localRef], 2e3) === sha) {
+    return { ok: true, cacheRepoDir, localRef, fetched: false };
+  }
+  const token = await input.token();
+  const attempts = Math.max(1, policy.attempts);
+  for (let attempt = 1; ; attempt++) {
+    const result = git(["fetch", "--depth", "1", remoteUrl, `+${sha}:${localRef}`], {
+      cwd: cacheRepoDir,
+      timeoutMs: policy.timeoutMs,
+      ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+    });
+    if (result.ok) return { ok: true, cacheRepoDir, localRef, fetched: true };
+    const kind = result.timedOut === true ? "unreachable" : classifyGitFailure(result.stderr);
+    if (kind === "no-access" || attempt >= attempts) {
+      const detail = fetchFailureDetail(result, policy.timeoutMs);
+      return { ok: false, kind, detail: attempt > 1 ? `${detail} (${attempt} attempts)` : detail };
+    }
+  }
+}
 var GATEWAY_TOO_OLD_MESSAGE = "the OuterLayer this machine talks to is too old to name the control plane \u2014 ask whoever runs it to upgrade; context written earlier is kept";
 var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
 function designationAuthRejectedMessage(credential) {
@@ -97,9 +129,6 @@ function designationAuthRejectedMessage(credential) {
 }
 var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written";
 var OVERLAY_FAILED_MESSAGE = "control-plane content was written but the maintained skills could not be refreshed";
-function isStagingWriteFault(message) {
-  return message === PARTIAL_WRITE_MESSAGE || message === OVERLAY_FAILED_MESSAGE;
-}
 function hasSymlinkComponent(root, relPath) {
   let current = root;
   for (const segment of relPath.split("/")) {
@@ -121,7 +150,7 @@ function noAccessMessage() {
   return "you do not have access to the control plane \u2014 check your git credentials (SSH key or token) and org/SSO access, then retry";
 }
 function classifyGitFailure(stderr) {
-  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied/i.test(stderr)) {
+  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied|could not read (username|password)|repository .*not found/i.test(stderr)) {
     return "no-access";
   }
   return "unreachable";
@@ -216,25 +245,28 @@ async function materializeContext(deps) {
     }
   };
   const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
-  const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
-  const cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
-  const localRef = `refs/outerlayer/sha-${sanitizeRefName(storedSha)}`;
-  const wanted = `+${storedSha}:${localRef}`;
-  const access = await deps.controlPlaneAccess?.([{ repository, ref }]);
-  const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
-  const fetchResult = git(["fetch", "--depth", "1", remoteUrl, wanted], {
-    cwd: cacheRepoDir,
-    timeoutMs: 1e4,
-    ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+  const fetched = await fetchControlPlaneCommit({
+    git,
+    home,
+    repository,
+    sha: storedSha,
+    remoteUrl,
+    // A runner reads the control plane with a token for it, not the host's git login.
+    token: async () => {
+      const access = await deps.controlPlaneAccess?.([{ repository, ref }]);
+      return access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
+    },
+    policy: deps.controlPlaneFetch ?? { timeoutMs: 1e4, attempts: 1, reuseCached: false }
   });
   const commitNote = (message) => `could not fetch commit \`${storedSha.slice(0, 7)}\` of ${repository}; ${message}`;
-  if (!fetchResult.ok) {
-    const kind = classifyGitFailure(fetchResult.stderr);
-    const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage() : unreachableMessage());
+  if (!fetched.ok) {
+    const { kind } = fetched;
+    const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage() : `${unreachableMessage()}: ${fetched.detail}`);
     writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref });
     record(null, "none", repository, ref);
     return { status: kind, message: doctorMessage, sha: null, verification: "none" };
   }
+  const { cacheRepoDir, localRef } = fetched;
   const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
   if (fetchedSha !== storedSha) {
     const doctorMessage = commitNote(unreachableMessage());
@@ -498,4 +530,4 @@ function writeFilesVerbatim(git, cacheRepoDir, files, workpieceRoot) {
   return { writtenPaths, ok: !anySkipped };
 }
 
-export { defaultGitRunner, isStagingWriteFault, lookupGoverningSource, materializeContext, parseOwnerRepo, resolveGitCommonDir };
+export { defaultGitRunner, fetchControlPlaneCommit, lookupGoverningSource, materializeContext, parseOwnerRepo, resolveGitCommonDir };

package/dist/{chunk-ODHEQ4TA.js → chunk-ZXBQ6E72.js}

@@ -2,14 +2,14 @@
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-BJQ25STI.js';
 import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-6IKSUAIA.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-TDVG6MCO.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-CMKY36NV.js';
 import { isLinkedRepository } from './chunk-ZQOSIMKU.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { checkFormerSkillNames } from './chunk-UIUGTW5C.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-WPGBDY73.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-WB7LPDXR.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-DJWKUQLO.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1190,7 +1190,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK } = await import('./build-disk-6T4WR3XI.js');
+  const { DEFAULT_BUILD_DISK } = await import('./build-disk-6QAXMA2J.js');
   const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-DUY2PT7K.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
@@ -1212,7 +1212,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-D5JNQ6U7.js');
+    const { runnerHostChecks } = await import('./doctor-N3CDJ66I.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{claude-launcher-B4L7ELIF.js → claude-launcher-66GKNIRZ.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-PSFYCKYH.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-SMHL6MWW.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);

package/dist/{cli-IO5VOFBP.js → cli-WICFAKFW.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-ODHEQ4TA.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-ZXBQ6E72.js';
 import './chunk-BJQ25STI.js';
 import './chunk-6IKSUAIA.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-DY7Y7UT4.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-TDVG6MCO.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-CMKY36NV.js';
 import './chunk-2QT4JUW3.js';
 import './chunk-ZQOSIMKU.js';
 import './chunk-EWVYQLD3.js';
@@ -20,7 +20,7 @@ import './chunk-PJDQPF5N.js';
 import './chunk-AA6LYZC4.js';
 import './chunk-AGZNCIIJ.js';
 import './chunk-BCCI32ME.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-WB7LPDXR.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-DJWKUQLO.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-I7RZHMXW.js';
 import './chunk-BKO6JEZI.js';
@@ -3874,7 +3874,7 @@ build, ../outerlayer-build/SKILL.md becomes ~/.agents/skills/outerlayer-build/SK
 what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocation() + " doctor` reports the same\nstates under Starter files.\n"
   ).action(async (opts) => {
     if (opts.update || opts.dryRun) {
-      const { runInitUpdateWithFleet, formatInitUpdate, updateFlagProblem } = await import('./init-update-DWZMXIBG.js');
+      const { runInitUpdateWithFleet, formatInitUpdate, updateFlagProblem } = await import('./init-update-NCM4GA3S.js');
       const { fleetReadiness } = await import('./fleet-readiness-EZAGL32M.js');
       const problem = updateFlagProblem(opts);
       if (problem !== void 0) {
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-4HAGUCMD.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-2CAMWMRP.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-4HAGUCMD.js');
+    const { runInitCommand } = await import('./init-cmd-2CAMWMRP.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -3944,7 +3944,7 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-32F2JJIL.js');
+          const { runAgentSetup } = await import('./agent-setup-RJOVRRHK.js');
           return runAgentSetup({ cwd: process.cwd(), skillsLink: opts.skillsLink !== false });
         },
         runDoctorChecks: gatherDoctorChecks,
@@ -4070,7 +4070,7 @@ code is 1: revoke the token on /profile/security.
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-XCGNHOGU.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-BSUZ65CU.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4101,7 +4101,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-6O6LTIBM.js');
+    const { runWatch } = await import('./watch-UF6XCGSI.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4191,7 +4191,7 @@ code is 1: revoke the token on /profile/security.
     process.exitCode = await runBuildCommand({ dir: opts.dir, argv: command });
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-CMDAHNLE.js');
+    const { runSessionSender } = await import('./session-sender-MSHKJSBG.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4287,7 +4287,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-TSUOZSYJ.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-N52IABK6.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4338,7 +4338,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-DX6RNKGK.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-73OWUBH6.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4387,7 +4387,7 @@ check. A chapter reads yes when every still matches and no when one differs; the
 the region. One run, or a chapter with no stills, reads not checked. Comparing never changes which clips bind.
 `
   ).action(async (manifest, opts) => {
-    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-KMADDLIA.js');
+    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-4AV74GMZ.js');
     let item;
     if (opts.item !== void 0) {
       item = parseTrackerNumber(opts.item);
@@ -4625,9 +4625,9 @@ function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
   const run = async (action) => {
-    const { WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
-      await action(await import('./spec-cmd-WFS64ZCI.js'));
+      await action(await import('./spec-cmd-AWIMO32E.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4731,7 +4731,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4754,7 +4754,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4778,8 +4778,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-QW745J2A.js');
-    const { WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-YNQYVHYS.js');
+    const { WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4800,8 +4800,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-QW745J2A.js');
-    const { WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-YNQYVHYS.js');
+    const { WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4825,8 +4825,8 @@ still running, or that an older runner released, has no log and the
 command exits 1.
 `
   ).action(async (opts) => {
-    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-GMPGBFLO.js');
-    const { WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-HHWVYQBG.js');
+    const { WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkLogs(opts);
     } catch (err) {
@@ -4849,8 +4849,8 @@ item is not built again until a new build request. Exits 1 when no host
 build is running for the item.
 `
   ).action(async (opts) => {
-    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-C65WG6NY.js');
-    const { WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-DBWNHZJO.js');
+    const { WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkStop(opts);
     } catch (err) {
@@ -4871,7 +4871,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4883,7 +4883,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4895,7 +4895,7 @@ live addition remains on it.
     }
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4916,7 +4916,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-ABYB5RGL.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-4FXVAZWF.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4936,7 +4936,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-ABYB5RGL.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-4FXVAZWF.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4968,7 +4968,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-ABYB5RGL.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-4FXVAZWF.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -5020,8 +5020,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-75XO4DL2.js');
-    const { WorkCommandError } = await import('./work-cmd-H7LLCT2W.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-ALVD7KLY.js');
+    const { WorkCommandError } = await import('./work-cmd-NCP4637R.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -5038,7 +5038,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-DUY2PT7K.js');
-    const { start, RunnerStartError } = await import('./loop-S5OE3B3O.js');
+    const { start, RunnerStartError } = await import('./loop-PXALY3VY.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BSY63HIC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5057,8 +5057,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-DUY2PT7K.js');
-    const { containerStart } = await import('./container-start-C33T3KS6.js');
-    const { start, RunnerStartError } = await import('./loop-S5OE3B3O.js');
+    const { containerStart } = await import('./container-start-QX53HKXW.js');
+    const { start, RunnerStartError } = await import('./loop-PXALY3VY.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BSY63HIC.js');
     try {
       const result = await containerStart({
@@ -5078,7 +5078,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-DUY2PT7K.js');
-    const { runRunnerCheck } = await import('./check-DUVKQSXY.js');
+    const { runRunnerCheck } = await import('./check-64UX323V.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5112,7 +5112,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-VWYDP7QC.js');
+        const { installServiceCommand } = await import('./command-VGR24IPI.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5168,7 +5168,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-DUY2PT7K.js');
-    const { uninstallServiceCommand } = await import('./command-VWYDP7QC.js');
+    const { uninstallServiceCommand } = await import('./command-VGR24IPI.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5196,10 +5196,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-DUY2PT7K.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-F5ZCQU4C.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-SFSXLQ72.js');
-    const { detectMachine } = await import('./machine-2HTTC2EF.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-UE4IDADW.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-VCWDBOT4.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-6BIULOR4.js');
+    const { detectMachine } = await import('./machine-AZRL432D.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-XG4NRZX4.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-26NLQI35.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5350,7 +5350,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-VWYDP7QC.js');
+        const { installServiceCommand } = await import('./command-VGR24IPI.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5395,10 +5395,10 @@ Next:
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-DUY2PT7K.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-BOVQZXKB.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-GKCVFHF4.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-JQTUFP6V.js');
-    const { builderSpec } = await import('./builder-E4F5355C.js');
+    const { createDockerHost } = await import('./docker-GGRJHHBP.js');
+    const { builderSpec } = await import('./builder-DPNHJXG3.js');
     const { loadRunnerConfig } = await import('./config-DUY2PT7K.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
@@ -5410,11 +5410,11 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-5SOFX53W.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-WGH73DTV.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
-      const { imageTargetFor } = await import('./governing-source-G2I3ZT6M.js');
+      const { imageTargetFor } = await import('./governing-source-M7ZRJCGY.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5478,7 +5478,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-DUY2PT7K.js');
-    const { requestStop } = await import('./loop-S5OE3B3O.js');
+    const { requestStop } = await import('./loop-PXALY3VY.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-MORUQ4LF.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5486,8 +5486,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-DUY2PT7K.js');
     const { jobsDir, runnerDir } = await import('./paths-KHDFSBEI.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-S5OE3B3O.js');
-    const { renderStatus } = await import('./status-56B2RX4M.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-PXALY3VY.js');
+    const { renderStatus } = await import('./status-BILERIXB.js');
     const { readHousekeepingRecord } = await import('./record-7CNTGRLD.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5547,7 +5547,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-DUY2PT7K.js');
-    const { listJobFiles } = await import('./loop-S5OE3B3O.js');
+    const { listJobFiles } = await import('./loop-PXALY3VY.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-QSKJ4G6M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-VWYDP7QC.js → command-VGR24IPI.js}

@@ -3,29 +3,29 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-GN2R5Z7G.js';
 import './chunk-GWDS42JC.js';
 import { currentLink, execStartCommand } from './chunk-OWDSO3PE.js';
-import { detectMachine } from './chunk-X2LZ2IHE.js';
-import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-5CZVJVTP.js';
+import { detectMachine } from './chunk-I5LGKZ4M.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-D3HRAPNF.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-BMCPLX2W.js';
+import './chunk-KLXWS5Z7.js';
 import './chunk-DDS2ISML.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-6NWS455T.js';
 import './chunk-LWTBE5J6.js';
-import './chunk-RAHE2AYU.js';
+import './chunk-RBJG5MM4.js';
 import './chunk-SK4TWCN3.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-ZRRUWNJS.js';
 import './chunk-YYYRBYWG.js';
-import { readJobFile } from './chunk-HGZXTPRO.js';
+import { readJobFile } from './chunk-43PV5KDB.js';
 import './chunk-3Z3MPR55.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-KFA762LZ.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-TGHBOXKJ.js';
 import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-5BNWAIHN.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';
 import { realLima } from './chunk-77MM5RYD.js';
 import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
-import './chunk-TDVG6MCO.js';
+import './chunk-CMKY36NV.js';
 import './chunk-2QT4JUW3.js';
 import './chunk-ZQOSIMKU.js';
 import './chunk-EWVYQLD3.js';
@@ -34,7 +34,7 @@ import './chunk-HJYBWJAS.js';
 import './chunk-NSPRS7WK.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EYW2ZRDL.js';
+import './chunk-WCELNMXT.js';
 import './chunk-UIUGTW5C.js';
 import './chunk-WPGBDY73.js';
 import './chunk-PJDQPF5N.js';

package/dist/{container-start-C33T3KS6.js → container-start-QX53HKXW.js}

@@ -1,29 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILD_MEMORY_VARIABLE } from './chunk-6C2YWM6N.js';
-import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-FVY5OU3N.js';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-WBZJWVT2.js';
 import { isAgentName, AGENT_COMMANDS } from './chunk-CUBIZBMF.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-X2LZ2IHE.js';
-import { MIN_ENGINE_MAJOR } from './chunk-5CZVJVTP.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-I5LGKZ4M.js';
+import { MIN_ENGINE_MAJOR } from './chunk-D3HRAPNF.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-BMCPLX2W.js';
+import './chunk-KLXWS5Z7.js';
 import './chunk-DDS2ISML.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-6NWS455T.js';
 import './chunk-LWTBE5J6.js';
-import './chunk-RAHE2AYU.js';
+import './chunk-RBJG5MM4.js';
 import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-SK4TWCN3.js';
 import './chunk-TQMI335S.js';
 import './chunk-ZRRUWNJS.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-HGZXTPRO.js';
+import './chunk-43PV5KDB.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-KFA762LZ.js';
+import './chunk-TGHBOXKJ.js';
 import './chunk-5BNWAIHN.js';
 import './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import './chunk-TDVG6MCO.js';
+import './chunk-CMKY36NV.js';
 import './chunk-2QT4JUW3.js';
 import './chunk-ZQOSIMKU.js';
 import './chunk-EWVYQLD3.js';
@@ -32,7 +32,7 @@ import './chunk-HJYBWJAS.js';
 import './chunk-NSPRS7WK.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EYW2ZRDL.js';
+import './chunk-WCELNMXT.js';
 import './chunk-UIUGTW5C.js';
 import './chunk-WPGBDY73.js';
 import './chunk-PJDQPF5N.js';