@outerlayer/cli 0.33.0-next.20261022194605 → 0.33.0-next.20261022195547

package/dist/{agent-setup-32F2JJIL.js → agent-setup-RJOVRRHK.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-4XQ6F3HD.js';
+export { keepHandWritten, runAgentSetup } from './chunk-35IY5HQY.js';
 import './chunk-JHTJPQSL.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-DY7Y7UT4.js';
 import './chunk-HJYBWJAS.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EYW2ZRDL.js';
+import './chunk-WCELNMXT.js';
 import './chunk-UIUGTW5C.js';
 import './chunk-WPGBDY73.js';
 import './chunk-PJDQPF5N.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-22T19:47:58.976Z+3d54e29","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-22T19:57:46.463Z+671ceda","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-KD5PLAVL.js → check-64UX323V.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-RXUZD7DC.js';
-import './chunk-IYH4R4EZ.js';
+import { probeCredentials } from './chunk-H7A3IQH5.js';
+import './chunk-L6JFFP3Q.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-UOFBHIOZ.js';
 import './chunk-3JVYMD4G.js';
@@ -12,17 +12,17 @@ import './chunk-JEKENLLA.js';
 import './chunk-W5DOK7BL.js';
 import './chunk-QL3LPZ67.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-JR4TZLG6.js';
-import './chunk-A33USDCE.js';
+import './chunk-QDMMW5PC.js';
+import './chunk-3MXPS7ED.js';
 import './chunk-DETKDTNL.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-V3MMJT4T.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-DNKUSXQU.js';
 import './chunk-OWDSO3PE.js';
 import './chunk-TBT347UY.js';
-import './chunk-JMZZLICN.js';
+import './chunk-WBZJWVT2.js';
 import './chunk-CUBIZBMF.js';
-import './chunk-FMH6LSUE.js';
-import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-SVXFSQRD.js';
+import './chunk-I5LGKZ4M.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-D3HRAPNF.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-KLXWS5Z7.js';
 import './chunk-DDS2ISML.js';
@@ -30,7 +30,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-6NWS455T.js';
 import './chunk-LWTBE5J6.js';
-import './chunk-RAHE2AYU.js';
+import './chunk-RBJG5MM4.js';
 import './chunk-SK4TWCN3.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME } from './chunk-ZRRUWNJS.js';
@@ -42,7 +42,7 @@ import './chunk-TGHBOXKJ.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-5BNWAIHN.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';
-import './chunk-TDVG6MCO.js';
+import './chunk-CMKY36NV.js';
 import './chunk-2QT4JUW3.js';
 import './chunk-ZQOSIMKU.js';
 import './chunk-EWVYQLD3.js';
@@ -51,14 +51,14 @@ import './chunk-HJYBWJAS.js';
 import './chunk-NSPRS7WK.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EYW2ZRDL.js';
+import './chunk-WCELNMXT.js';
 import './chunk-UIUGTW5C.js';
 import './chunk-WPGBDY73.js';
 import './chunk-PJDQPF5N.js';
 import './chunk-AA6LYZC4.js';
 import './chunk-AGZNCIIJ.js';
 import { claudeEnvPath } from './chunk-BCCI32ME.js';
-import './chunk-WB7LPDXR.js';
+import './chunk-DJWKUQLO.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';

package/dist/{chunk-4XQ6F3HD.js → chunk-35IY5HQY.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-DY7Y7UT4.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-HJYBWJAS.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-EYW2ZRDL.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-WCELNMXT.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-AVTI3FL5.js';

package/dist/{chunk-A33USDCE.js → chunk-3MXPS7ED.js}

@@ -9,7 +9,7 @@ import { C } from './chunk-ANPNT6PM.js';
 import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor, signRunnerRequest } from './chunk-AA6LYZC4.js';
-import { writeSyncStatus, spoolDir } from './chunk-WB7LPDXR.js';
+import { writeSyncStatus, spoolDir } from './chunk-DJWKUQLO.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';

package/dist/{chunk-6YHUMNUB.js → chunk-77B36F5K.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-A33USDCE.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-3MXPS7ED.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-EWVYQLD3.js';

package/dist/{chunk-TDVG6MCO.js → chunk-CMKY36NV.js}

@@ -441,7 +441,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-6GE5LEJI.js');
+      const { logHookError } = await import('./hook-fast-WNKICZ6E.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-SVXFSQRD.js → chunk-D3HRAPNF.js}

@@ -6,7 +6,7 @@ import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-6NWS455T.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-LWTBE5J6.js';
-import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-RAHE2AYU.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-RBJG5MM4.js';
 import { runnerImageVersion } from './chunk-SK4TWCN3.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
 import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-43PV5KDB.js';
@@ -14,7 +14,7 @@ import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties }
 import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-TGHBOXKJ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { WorkCommandError } from './chunk-TDVG6MCO.js';
+import { WorkCommandError } from './chunk-CMKY36NV.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-5DNCFOXA.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-AGZNCIIJ.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, writeBuildMavenSettings, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BCCI32ME.js';
@@ -3581,6 +3581,19 @@ async function provisionContainer(input) {
   const governing = await resolveGoverningSource({ config, repository, fetchImpl: input.fetchImpl });
   if (!governing.ok) return fail(governing.reason);
   const governingSource = governing.source;
+  const controlPlaneUrl = (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`;
+  if (governingSource.kind === "governed") {
+    const unfetched = await prefetchGovernedContext({
+      configPath: config.configPath,
+      repository,
+      source: governingSource,
+      controlPlaneUrl,
+      controlPlaneToken: () => tokens.controlPlane(),
+      log,
+      tag
+    });
+    if (unfetched !== void 0) return fail(unfetched);
+  }
   const imageRepository = governingSource.kind === "governed" ? governingSource.repository : repository;
   const obtained = await obtainImage({
     config,
@@ -3771,7 +3784,7 @@ async function provisionContainer(input) {
       buildId,
       buildDir: buildDir2,
       fetchImpl: input.fetchImpl,
-      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`,
+      controlPlaneUrl,
       controlPlaneToken: () => tokens.controlPlane(),
       log,
       tag

package/dist/{chunk-WB7LPDXR.js → chunk-DJWKUQLO.js}

@@ -684,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-PSFYCKYH.js');
+  const { governanceOf } = await import('./control-plane-launch-SMHL6MWW.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-V3MMJT4T.js → chunk-DNKUSXQU.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-JMZZLICN.js';
-import { describeCallFailure } from './chunk-RAHE2AYU.js';
+import { isPlaceholderCommand } from './chunk-WBZJWVT2.js';
+import { describeCallFailure } from './chunk-RBJG5MM4.js';
 import { checkFit } from './chunk-ZRRUWNJS.js';
 import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-P5FC7VUO.js';
 import { builderDiskPinned } from './chunk-TGHBOXKJ.js';
 import { builtinKind, imageBuildOf } from './chunk-5BNWAIHN.js';
-import { WorkCommandError, getJson } from './chunk-TDVG6MCO.js';
+import { WorkCommandError, getJson } from './chunk-CMKY36NV.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { signerFor } from './chunk-AA6LYZC4.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-BCCI32ME.js';

package/dist/{chunk-RXUZD7DC.js → chunk-H7A3IQH5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-IYH4R4EZ.js';
+import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-L6JFFP3Q.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UOFBHIOZ.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
@@ -8,20 +8,20 @@ import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest
 import { fitImageBuildMemory } from './chunk-6C2YWM6N.js';
 import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
 import { writePendingUpdate } from './chunk-JEKENLLA.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-V3MMJT4T.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-DNKUSXQU.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-OWDSO3PE.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-SVXFSQRD.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-D3HRAPNF.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-DDS2ISML.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RAHE2AYU.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RBJG5MM4.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-SK4TWCN3.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43PV5KDB.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-5BNWAIHN.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-TDVG6MCO.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-CMKY36NV.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-AA6LYZC4.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AGZNCIIJ.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BCCI32ME.js';
@@ -1837,7 +1837,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-H7LLCT2W.js');
+  const { postJson: postJson2 } = await import('./work-cmd-NCP4637R.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -3037,7 +3037,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-KD5PLAVL.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-64UX323V.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-FMH6LSUE.js → chunk-I5LGKZ4M.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-SVXFSQRD.js';
+import { MIN_ENGINE_MAJOR } from './chunk-D3HRAPNF.js';
 import { runnerImageVersion } from './chunk-SK4TWCN3.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-TGHBOXKJ.js';
 import { spawnSync } from 'child_process';

package/dist/{chunk-IYH4R4EZ.js → chunk-L6JFFP3Q.js}

@@ -4,19 +4,19 @@ import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-W5DOK7BL.js';
 import { writeDockerClientConfig } from './chunk-QL3LPZ67.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JR4TZLG6.js';
-import { installScrubContext } from './chunk-A33USDCE.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-SVXFSQRD.js';
+import { senderPidfile } from './chunk-QDMMW5PC.js';
+import { installScrubContext } from './chunk-3MXPS7ED.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-D3HRAPNF.js';
 import { readBranchHead, fetchCommit, diffBetween } from './chunk-KLXWS5Z7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-6NWS455T.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-LWTBE5J6.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RAHE2AYU.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RBJG5MM4.js';
 import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-43PV5KDB.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TGHBOXKJ.js';
 import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-5BNWAIHN.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-TDVG6MCO.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-CMKY36NV.js';
 import { planArtifactUpload } from './chunk-EWVYQLD3.js';
 import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
@@ -314,6 +314,19 @@ async function provisionMicroVm(input) {
   const governing = await resolveGoverningSource({ config, repository, fetchImpl: input.fetchImpl });
   if (!governing.ok) return fail(governing.reason);
   const governingSource = governing.source;
+  const controlPlaneUrl = (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`;
+  if (governingSource.kind === "governed") {
+    const unfetched = await prefetchGovernedContext({
+      configPath: config.configPath,
+      repository,
+      source: governingSource,
+      controlPlaneUrl,
+      controlPlaneToken: () => tokens.controlPlane(),
+      log,
+      tag
+    });
+    if (unfetched !== void 0) return fail(unfetched);
+  }
   const limits = {
     cpus: config.build?.cpus ?? DEFAULT_CPUS,
     memoryBytes: buildMemoryBytes(config),
@@ -599,7 +612,7 @@ async function provisionMicroVm(input) {
       buildId,
       buildDir: buildDir2,
       fetchImpl: input.fetchImpl,
-      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`,
+      controlPlaneUrl,
       controlPlaneToken: () => tokens.controlPlane(),
       log,
       tag

package/dist/{chunk-JR4TZLG6.js → chunk-QDMMW5PC.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-A33USDCE.js';
+import { LiveUploader } from './chunk-3MXPS7ED.js';
 import { CaptureDaemon } from './chunk-5DNCFOXA.js';
-import { spoolDir } from './chunk-WB7LPDXR.js';
+import { spoolDir } from './chunk-DJWKUQLO.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-RAHE2AYU.js → chunk-RBJG5MM4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-TDVG6MCO.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-EYW2ZRDL.js';
+import { WorkCommandError, postJson } from './chunk-CMKY36NV.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-WCELNMXT.js';
 import { signingFetchFor } from './chunk-WPGBDY73.js';
 import { signerFor } from './chunk-AA6LYZC4.js';
 import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-AGZNCIIJ.js';
@@ -328,7 +328,19 @@ var NoControlPlane = class extends Error {
 var GatewayConflict = class extends Error {
 };
 var unavailable = (why) => ({ kind: "refused", reason: `context_unavailable: ${why}` });
+function tokenRefusedReason(err, repository) {
+  return err.detail === void 0 ? `context_unavailable: the gateway refused a token for the control plane named for ${repository} (${err.code})` : `context_unavailable: the token request for the control plane named for ${repository} failed: ${err.detail}`;
+}
 var DESIGNATION_LOOKUP = { timeoutMs: 1e4, attempts: 2 };
+function buildFetch(reuseCached) {
+  return { timeoutMs: 3e4, attempts: 2, reuseCached };
+}
+function credentialName(tokenRepository) {
+  return tokenRepository === void 0 ? "the host's git login" : "the token the gateway issued";
+}
+function fetchFailureReason(failure, credential, plane, sha, repository) {
+  return failure.kind === "no-access" ? `context_unavailable: ${credential} cannot read ${plane}, the control plane named for ${repository}` : `context_unavailable: commit ${sha.slice(0, 7)} of ${plane}, the control plane named for ${repository}, could not be fetched: ${failure.detail}`;
+}
 function lookupFailureReason(failure, repository) {
   switch (failure?.kind) {
     case "timeout":
@@ -382,6 +394,7 @@ async function stageGovernedContext(input) {
       cloud: { url, apiKey, appId },
       fetchImpl: signingFetchFor(input.fetchImpl, configPath, apiKey),
       designationLookup: DESIGNATION_LOOKUP,
+      controlPlaneFetch: buildFetch(true),
       ...input.source === void 0 ? {} : { pinnedSource: input.source },
       git,
       now: input.now,
@@ -417,28 +430,19 @@ async function stageGovernedContext(input) {
         }
         if (result.message !== void 0) return finish(unavailable(result.message));
         return finish(unavailable(lookupFailureReason(result.lookupFailure, input.repository)));
-      case "unreachable":
       case "no-access": {
-        const plane = isStagingWriteFault(result.message) ? void 0 : readDegraded(join(tree, ".git"))?.repository;
-        if (plane !== void 0) {
-          const credential = tokenRepository !== void 0 && tokenRepository.toLowerCase() === plane.toLowerCase() ? "the token the gateway issued" : "the host's git login";
-          return finish(unavailable(`${credential} cannot read ${plane}, the control plane named for ${input.repository}`));
-        }
+        const plane = readDegraded(join(tree, ".git"))?.repository;
+        if (plane !== void 0) return finish(unavailable(`${credentialName(tokenRepository)} cannot read ${plane}, the control plane named for ${input.repository}`));
         return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
       }
+      // An unreachable result is a timeout, a network failure, or a failure to write the fetched files. Its message says which.
       default:
         return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
     }
   } catch (err) {
     if (err instanceof NoControlPlane) return finish({ kind: "none" });
     if (err instanceof GatewayConflict) return finish({ kind: "refused", reason: `context_conflict: ${err.message}` });
-    if (err instanceof TokenRefused) {
-      return finish(
-        unavailable(
-          err.detail === void 0 ? `the gateway refused a token for the control plane named for ${input.repository} (${err.code})` : `the token request for the control plane named for ${input.repository} failed: ${err.detail}`
-        )
-      );
-    }
+    if (err instanceof TokenRefused) return finish({ kind: "refused", reason: tokenRefusedReason(err, input.repository) });
     return finish(unavailable(`the context of ${input.repository} could not be staged: ${err instanceof Error ? err.message : String(err)}`));
   }
 }
@@ -462,6 +466,32 @@ async function controlPlaneAccess(ask, candidates, repository, log, tag) {
   }
   return answer;
 }
+async function prefetchGovernedContext(input) {
+  const { repository, source } = input;
+  let tokenRepository;
+  try {
+    const fetched = await fetchControlPlaneCommit({
+      git: input.git ?? defaultGitRunner,
+      home: contextHomeDir(input.configPath),
+      repository: source.repository,
+      sha: source.sha,
+      remoteUrl: input.controlPlaneUrl(source.repository),
+      token: async () => {
+        if (input.controlPlaneToken === void 0) return void 0;
+        const access = await controlPlaneAccess(input.controlPlaneToken, [{ repository: source.repository }], repository, input.log, input.tag);
+        tokenRepository = access?.repository;
+        return access?.token;
+      },
+      policy: buildFetch(false)
+    });
+    if (fetched.ok) return void 0;
+    return fetchFailureReason(fetched, credentialName(tokenRepository), source.repository, source.sha, repository);
+  } catch (err) {
+    if (err instanceof NoControlPlane || err instanceof GatewayConflict) return void 0;
+    if (err instanceof TokenRefused) return tokenRefusedReason(err, repository);
+    return `context_unavailable: the control plane named for ${repository} could not be fetched: ${err instanceof Error ? err.message : String(err)}`;
+  }
+}
 function removeStagedContext(buildDir) {
   rmSync(stagedContextDir(buildDir), { recursive: true, force: true });
 }
@@ -516,4 +546,4 @@ async function imageTargetFor(input) {
   return { ok: true, repository: resolved.source.repository, pinned: { commit: resolved.source.sha, ref: resolved.source.ref } };
 }
 
-export { BuildTokens, WORKFLOW_PERMISSION_REASON, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };
+export { BuildTokens, WORKFLOW_PERMISSION_REASON, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, prefetchGovernedContext, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };

package/dist/{chunk-JMZZLICN.js → chunk-WBZJWVT2.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-CUBIZBMF.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-FMH6LSUE.js';
-import { MIN_ENGINE_MAJOR } from './chunk-SVXFSQRD.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-I5LGKZ4M.js';
+import { MIN_ENGINE_MAJOR } from './chunk-D3HRAPNF.js';
 import { runnerCredentialProblem } from './chunk-5BNWAIHN.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';

package/dist/{chunk-EYW2ZRDL.js → chunk-WCELNMXT.js}

@@ -79,10 +79,12 @@ var defaultGitRunner = (args, opts) => {
     return { ok: true, stdout: Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout), stderr: "" };
   } catch (err) {
     const e = err;
+    const stderr = e.stderr ? Buffer.from(e.stderr).toString("utf8") : "";
     return {
       ok: false,
       stdout: e.stdout ? Buffer.from(e.stdout) : Buffer.alloc(0),
-      stderr: e.stderr ? Buffer.from(e.stderr).toString("utf8") : e.message ?? String(err)
+      stderr: stderr === "" ? e.message ?? String(err) : stderr,
+      ...e.code === "ETIMEDOUT" ? { timedOut: true } : {}
     };
   }
 };
@@ -90,6 +92,36 @@ function gitText(git, cwd, args, timeoutMs) {
   const result = git(args, { cwd, timeoutMs });
   return result.ok ? result.stdout.toString("utf8").trim() : void 0;
 }
+function fetchFailureDetail(result, timeoutMs) {
+  if (result.timedOut === true) return `git fetch did not finish within ${timeoutMs / 1e3} seconds`;
+  const lines = result.stderr.split("\n").map((line2) => line2.trim()).filter((line2) => line2 !== "");
+  const line = lines.find((candidate) => /^(fatal|error):/.test(candidate)) ?? lines.at(-1) ?? "git fetch failed";
+  return line.replace(/(\w+:\/\/)[^/@\s]+@/g, "$1").slice(0, 300);
+}
+async function fetchControlPlaneCommit(input) {
+  const { git, home, repository, sha, remoteUrl, policy } = input;
+  const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
+  const cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
+  const localRef = `refs/outerlayer/sha-${sanitizeRefName(sha)}`;
+  if (policy.reuseCached && gitText(git, cacheRepoDir, ["rev-parse", "--verify", "--quiet", localRef], 2e3) === sha) {
+    return { ok: true, cacheRepoDir, localRef, fetched: false };
+  }
+  const token = await input.token();
+  const attempts = Math.max(1, policy.attempts);
+  for (let attempt = 1; ; attempt++) {
+    const result = git(["fetch", "--depth", "1", remoteUrl, `+${sha}:${localRef}`], {
+      cwd: cacheRepoDir,
+      timeoutMs: policy.timeoutMs,
+      ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+    });
+    if (result.ok) return { ok: true, cacheRepoDir, localRef, fetched: true };
+    const kind = result.timedOut === true ? "unreachable" : classifyGitFailure(result.stderr);
+    if (kind === "no-access" || attempt >= attempts) {
+      const detail = fetchFailureDetail(result, policy.timeoutMs);
+      return { ok: false, kind, detail: attempt > 1 ? `${detail} (${attempt} attempts)` : detail };
+    }
+  }
+}
 var GATEWAY_TOO_OLD_MESSAGE = "the OuterLayer this machine talks to is too old to name the control plane \u2014 ask whoever runs it to upgrade; context written earlier is kept";
 var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
 function designationAuthRejectedMessage(credential) {
@@ -97,9 +129,6 @@ function designationAuthRejectedMessage(credential) {
 }
 var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written";
 var OVERLAY_FAILED_MESSAGE = "control-plane content was written but the maintained skills could not be refreshed";
-function isStagingWriteFault(message) {
-  return message === PARTIAL_WRITE_MESSAGE || message === OVERLAY_FAILED_MESSAGE;
-}
 function hasSymlinkComponent(root, relPath) {
   let current = root;
   for (const segment of relPath.split("/")) {
@@ -121,7 +150,7 @@ function noAccessMessage() {
   return "you do not have access to the control plane \u2014 check your git credentials (SSH key or token) and org/SSO access, then retry";
 }
 function classifyGitFailure(stderr) {
-  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied/i.test(stderr)) {
+  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied|could not read (username|password)|repository .*not found/i.test(stderr)) {
     return "no-access";
   }
   return "unreachable";
@@ -216,25 +245,28 @@ async function materializeContext(deps) {
     }
   };
   const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
-  const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
-  const cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
-  const localRef = `refs/outerlayer/sha-${sanitizeRefName(storedSha)}`;
-  const wanted = `+${storedSha}:${localRef}`;
-  const access = await deps.controlPlaneAccess?.([{ repository, ref }]);
-  const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
-  const fetchResult = git(["fetch", "--depth", "1", remoteUrl, wanted], {
-    cwd: cacheRepoDir,
-    timeoutMs: 1e4,
-    ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+  const fetched = await fetchControlPlaneCommit({
+    git,
+    home,
+    repository,
+    sha: storedSha,
+    remoteUrl,
+    // A runner reads the control plane with a token for it, not the host's git login.
+    token: async () => {
+      const access = await deps.controlPlaneAccess?.([{ repository, ref }]);
+      return access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
+    },
+    policy: deps.controlPlaneFetch ?? { timeoutMs: 1e4, attempts: 1, reuseCached: false }
   });
   const commitNote = (message) => `could not fetch commit \`${storedSha.slice(0, 7)}\` of ${repository}; ${message}`;
-  if (!fetchResult.ok) {
-    const kind = classifyGitFailure(fetchResult.stderr);
-    const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage() : unreachableMessage());
+  if (!fetched.ok) {
+    const { kind } = fetched;
+    const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage() : `${unreachableMessage()}: ${fetched.detail}`);
     writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref });
     record(null, "none", repository, ref);
     return { status: kind, message: doctorMessage, sha: null, verification: "none" };
   }
+  const { cacheRepoDir, localRef } = fetched;
   const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
   if (fetchedSha !== storedSha) {
     const doctorMessage = commitNote(unreachableMessage());
@@ -498,4 +530,4 @@ function writeFilesVerbatim(git, cacheRepoDir, files, workpieceRoot) {
   return { writtenPaths, ok: !anySkipped };
 }
 
-export { defaultGitRunner, isStagingWriteFault, lookupGoverningSource, materializeContext, parseOwnerRepo, resolveGitCommonDir };
+export { defaultGitRunner, fetchControlPlaneCommit, lookupGoverningSource, materializeContext, parseOwnerRepo, resolveGitCommonDir };

package/dist/{chunk-ESEUG62R.js → chunk-ZXBQ6E72.js}

@@ -2,14 +2,14 @@
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-BJQ25STI.js';
 import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-6IKSUAIA.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-TDVG6MCO.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-CMKY36NV.js';
 import { isLinkedRepository } from './chunk-ZQOSIMKU.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { checkFormerSkillNames } from './chunk-UIUGTW5C.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-WPGBDY73.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-WB7LPDXR.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-DJWKUQLO.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1212,7 +1212,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-N36BHNH3.js');
+    const { runnerHostChecks } = await import('./doctor-N3CDJ66I.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{claude-launcher-B4L7ELIF.js → claude-launcher-66GKNIRZ.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-PSFYCKYH.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-SMHL6MWW.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);