@outerlayer/cli 0.33.0-next.20261022194605 → 0.33.0-next.20261023002325

package/dist/{chunk-RXUZD7DC.js → chunk-CANYZTD5.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-IYH4R4EZ.js';
+import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-DGI66PGY.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UOFBHIOZ.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-6C2YWM6N.js';
-import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
-import { writePendingUpdate } from './chunk-JEKENLLA.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-V3MMJT4T.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-OWDSO3PE.js';
+import { fitImageBuildMemory } from './chunk-OOCAF3ID.js';
+import { RUNNER_PROTOCOL } from './chunk-MZYOUIY5.js';
+import { writePendingUpdate } from './chunk-GH246BGV.js';
+import { realBlockedProbes, checkBlocked } from './chunk-QFQC5K4J.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-SVXFSQRD.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-DDS2ISML.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JRZCRIEO.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RAHE2AYU.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-SK4TWCN3.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-T5REPMNL.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43PV5KDB.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-5BNWAIHN.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-GFVDC5S3.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3DCB3GOV.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-TDVG6MCO.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-AA6LYZC4.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AGZNCIIJ.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BCCI32ME.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-VT4TTJPG.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
@@ -1837,7 +1837,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-H7LLCT2W.js');
+  const { postJson: postJson2 } = await import('./work-cmd-W7WEHMQJ.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2070,6 +2070,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   log.line(`${tag} provision started`);
   const provisionStartedMs = nowOf(state).getTime();
   const processMode = isBuiltinProcess(state.config.hooks.provision);
+  const requireBuildSkill = needsBuildSkill(queue, state.config.commands[queue]);
   const cliVersion = state.deps.cliVersion ?? resolveVersion();
   let workdir;
   let cgroup;
@@ -2094,7 +2095,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
       fetchImpl: state.deps.fetchImpl,
       now: state.deps.now,
-      leaseExpiryMs: () => leaseExpiresAtMs(active.job)
+      leaseExpiryMs: () => leaseExpiresAtMs(active.job),
+      requireBuildSkill
     }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
@@ -2133,7 +2135,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
       fetchImpl: state.deps.fetchImpl,
       now: state.deps.now,
-      leaseTimeLeftMs: leaseTimeLeftFor(state, active)
+      leaseTimeLeftMs: leaseTimeLeftFor(state, active),
+      requireBuildSkill
     }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
@@ -2318,6 +2321,20 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   job = { ...active.job, workdir, cgroup };
   active.job = job;
   writeJobFile(jobFilePath, job);
+  const skillDecision = await decideHostBuildSkill({
+    requireBuildSkill,
+    containerMode,
+    vmMode,
+    workdir,
+    repository: primary?.repository,
+    lookup: (repository) => resolveGoverningSource({ config: state.config, repository, fetchImpl: state.deps.fetchImpl }).catch(() => void 0)
+  });
+  if (skillDecision.kind === "refuse") {
+    log.error(`${tag} ${skillDecision.reason} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason: skillDecision.reason });
+    return;
+  }
+  if (skillDecision.kind === "warn") log.line(`${tag} warning: the clone has no \`build\` skill; the control plane's context may deliver one, so the command starts`);
   if (!containerMode && !vmMode) {
     if (existsSync(join(workdir, ".git"))) {
       try {
@@ -2492,7 +2509,7 @@ async function startHostBuild(state, active, repository) {
   const runtime = runtimeOf(state);
   let failed2;
   try {
-    await startHostServices({ runtime, config: state.config, build, jobDir: active.dirPath, itemKey: active.job.itemKey, process: false });
+    await startHostServices({ runtime, config: state.config, build, jobDir: active.dirPath, itemKey: active.job.itemKey, process: false, routeLog: (line) => logOf(state).line(`#${active.job.item} ${line}`) });
   } catch (err) {
     failed2 = describeCallFailure(err);
     logOf(state).error(`#${active.job.item} the tunnel and destination servers could not start: ${failed2} \xB7 continuing`);
@@ -3037,7 +3054,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-KD5PLAVL.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-64FD5G3X.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-IYH4R4EZ.js → chunk-DGI66PGY.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-W5DOK7BL.js';
-import { writeDockerClientConfig } from './chunk-QL3LPZ67.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HVRQQOMH.js';
+import { writeDockerClientConfig } from './chunk-6LBSAW6I.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JR4TZLG6.js';
-import { installScrubContext } from './chunk-A33USDCE.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-SVXFSQRD.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-KLXWS5Z7.js';
+import { senderPidfile } from './chunk-Q2CMEQV7.js';
+import { installScrubContext } from './chunk-2N67C6IV.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JRZCRIEO.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-JPG43G6Y.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { waitForAgent, vmExecArgs } from './chunk-6NWS455T.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-LWTBE5J6.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RAHE2AYU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-43PV5KDB.js';
+import { waitForAgent, vmExecArgs } from './chunk-5THSC6BD.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-L26V6ILJ.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-T5REPMNL.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-GFVDC5S3.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TGHBOXKJ.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-5BNWAIHN.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-3DCB3GOV.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-TDVG6MCO.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-VT4TTJPG.js';
 import { planArtifactUpload } from './chunk-EWVYQLD3.js';
 import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-AA6LYZC4.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-AGZNCIIJ.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BCCI32ME.js';
+import { signerFor } from './chunk-SOI6K5DY.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PA6CK6WQ.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
 import { resolvePackRoot } from './chunk-G63KT5I5.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -314,6 +314,19 @@ async function provisionMicroVm(input) {
   const governing = await resolveGoverningSource({ config, repository, fetchImpl: input.fetchImpl });
   if (!governing.ok) return fail(governing.reason);
   const governingSource = governing.source;
+  const controlPlaneUrl = (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`;
+  if (governingSource.kind === "governed") {
+    const unfetched = await prefetchGovernedContext({
+      configPath: config.configPath,
+      repository,
+      source: governingSource,
+      controlPlaneUrl,
+      controlPlaneToken: () => tokens.controlPlane(),
+      log,
+      tag
+    });
+    if (unfetched !== void 0) return fail(unfetched);
+  }
   const limits = {
     cpus: config.build?.cpus ?? DEFAULT_CPUS,
     memoryBytes: buildMemoryBytes(config),
@@ -429,7 +442,7 @@ async function provisionMicroVm(input) {
   let services;
   try {
     const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
-    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote);
+    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "socket", void 0, void 0, (line) => log.line(`${tag} ${line}`));
     runtime.tunnels.set(buildId, services);
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
@@ -599,7 +612,7 @@ async function provisionMicroVm(input) {
       buildId,
       buildDir: buildDir2,
       fetchImpl: input.fetchImpl,
-      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`,
+      controlPlaneUrl,
       controlPlaneToken: () => tokens.controlPlane(),
       log,
       tag
@@ -614,7 +627,8 @@ async function provisionMicroVm(input) {
       }
     },
     removeStagedContext: () => removeStagedContext(buildDir2),
-    keepIn: jobDir
+    keepIn: jobDir,
+    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {}
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
@@ -1433,7 +1447,8 @@ async function startHostServices(input) {
       builtIns: Object.fromEntries((build.destinations ?? []).filter((d) => BUILT_IN_NAMES.includes(d.name)).map((d) => [d.name, d.port]))
     },
     hostEnv: runtime.hostEnv,
-    destinationOptions: runtime.destinationOptions
+    destinationOptions: runtime.destinationOptions,
+    ...input.routeLog === void 0 ? {} : { log: input.routeLog }
   });
   build.proxyPort = services.proxyPort;
   build.destinations = [
@@ -1551,6 +1566,7 @@ function isTailedStage(stage) {
   const tailed = ["provision", "sync", "cleanup", "report"];
   return tailed.includes(stage);
 }
+var PROVISION_PROBLEM = /\b(warn(ing)?|error|fail(ed|ure)?|refused)\b/i;
 var READ_LIMIT_BYTES = 1048576;
 var ITEM_LINE = /^#(\d+)\b/;
 var AttemptLogBook = class {
@@ -1655,6 +1671,11 @@ function buildReleaseLog(jobDirPath, endStage, scrub) {
     const tail = stage === void 0 ? [] : lastLines(stage);
     if (tail.length > 0) parts.push(`--- the last ${tail.length} lines of ${file} ---`, ...tail);
   }
+  if (endStage !== "provision") {
+    const provision = readEnd(join(jobDirPath, "provision.log"), READ_LIMIT_BYTES);
+    const problems = provision === void 0 ? [] : provision.split("\n").filter((line) => PROVISION_PROBLEM.test(line)).slice(-50);
+    if (problems.length > 0) parts.push(`--- provision problems (${problems.length} lines of provision.log) ---`, ...problems);
+  }
   if (parts.length === 0) return void 0;
   return capRunnerLog(scrub(parts.join("\n")) + "\n");
 }
@@ -1683,7 +1704,7 @@ async function provisionProcess(input) {
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
   try {
-    await startHostServices({ runtime, config, build: state, jobDir, itemKey: input.itemKey, process: true });
+    await startHostServices({ runtime, config, build: state, jobDir, itemKey: input.itemKey, process: true, routeLog: (line) => input.log.line(`#${item.number} ${line}`) });
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
@@ -2906,7 +2927,8 @@ function scrubTunnelRecord(record, config) {
     hostsMore: record.hostsMore,
     refusalsMore: record.refusalsMore,
     refusals: record.refusals.map((r) => ({ ...r, host: scrubText(r.host) })),
-    destinations: (record.destinations ?? []).map((name) => scrubText(name))
+    destinations: (record.destinations ?? []).map((name) => scrubText(name)),
+    ...record.routes === void 0 ? {} : { routes: Object.fromEntries(Object.entries(record.routes).map(([name, counts]) => [scrubText(name), counts])) }
   };
 }
 function runCommand(cmdline, env, cwd, logPath, spawnFn = spawn) {
@@ -3041,6 +3063,9 @@ async function releaseLease(config, item, outcome, detail, fetchImpl) {
         sent = "ok";
       } else if (log !== void 0 && /\blog\b/.test(err.message)) {
         log = void 0;
+      } else if (environment?.routes !== void 0) {
+        const { routes: _omittedRoutes, ...withoutRoutes } = environment;
+        environment = withoutRoutes;
       } else if (environment?.guestUsage !== void 0) {
         const { guestUsage: _omittedUsage, ...withoutUsage } = environment;
         environment = withoutUsage;

package/dist/{chunk-GN2R5Z7G.js → chunk-DXJTBU7A.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-GWDS42JC.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-OWDSO3PE.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-Z5IW4DHH.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-NBZ7XBT6.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE } from './chunk-PA6CK6WQ.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-EYW2ZRDL.js → chunk-EUVE2EAE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-UIUGTW5C.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-WPGBDY73.js';
-import { withTokenHeader } from './chunk-BCCI32ME.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
+import { withTokenHeader } from './chunk-BALIE3BA.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
@@ -79,10 +79,12 @@ var defaultGitRunner = (args, opts) => {
     return { ok: true, stdout: Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout), stderr: "" };
   } catch (err) {
     const e = err;
+    const stderr = e.stderr ? Buffer.from(e.stderr).toString("utf8") : "";
     return {
       ok: false,
       stdout: e.stdout ? Buffer.from(e.stdout) : Buffer.alloc(0),
-      stderr: e.stderr ? Buffer.from(e.stderr).toString("utf8") : e.message ?? String(err)
+      stderr: stderr === "" ? e.message ?? String(err) : stderr,
+      ...e.code === "ETIMEDOUT" ? { timedOut: true } : {}
     };
   }
 };
@@ -90,6 +92,36 @@ function gitText(git, cwd, args, timeoutMs) {
   const result = git(args, { cwd, timeoutMs });
   return result.ok ? result.stdout.toString("utf8").trim() : void 0;
 }
+function fetchFailureDetail(result, timeoutMs) {
+  if (result.timedOut === true) return `git fetch did not finish within ${timeoutMs / 1e3} seconds`;
+  const lines = result.stderr.split("\n").map((line2) => line2.trim()).filter((line2) => line2 !== "");
+  const line = lines.find((candidate) => /^(fatal|error):/.test(candidate)) ?? lines.at(-1) ?? "git fetch failed";
+  return line.replace(/(\w+:\/\/)[^/@\s]+@/g, "$1").slice(0, 300);
+}
+async function fetchControlPlaneCommit(input) {
+  const { git, home, repository, sha, remoteUrl, policy } = input;
+  const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
+  const cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
+  const localRef = `refs/outerlayer/sha-${sanitizeRefName(sha)}`;
+  if (policy.reuseCached && gitText(git, cacheRepoDir, ["rev-parse", "--verify", "--quiet", localRef], 2e3) === sha) {
+    return { ok: true, cacheRepoDir, localRef, fetched: false };
+  }
+  const token = await input.token();
+  const attempts = Math.max(1, policy.attempts);
+  for (let attempt = 1; ; attempt++) {
+    const result = git(["fetch", "--depth", "1", remoteUrl, `+${sha}:${localRef}`], {
+      cwd: cacheRepoDir,
+      timeoutMs: policy.timeoutMs,
+      ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+    });
+    if (result.ok) return { ok: true, cacheRepoDir, localRef, fetched: true };
+    const kind = result.timedOut === true ? "unreachable" : classifyGitFailure(result.stderr);
+    if (kind === "no-access" || attempt >= attempts) {
+      const detail = fetchFailureDetail(result, policy.timeoutMs);
+      return { ok: false, kind, detail: attempt > 1 ? `${detail} (${attempt} attempts)` : detail };
+    }
+  }
+}
 var GATEWAY_TOO_OLD_MESSAGE = "the OuterLayer this machine talks to is too old to name the control plane \u2014 ask whoever runs it to upgrade; context written earlier is kept";
 var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
 function designationAuthRejectedMessage(credential) {
@@ -97,9 +129,6 @@ function designationAuthRejectedMessage(credential) {
 }
 var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written";
 var OVERLAY_FAILED_MESSAGE = "control-plane content was written but the maintained skills could not be refreshed";
-function isStagingWriteFault(message) {
-  return message === PARTIAL_WRITE_MESSAGE || message === OVERLAY_FAILED_MESSAGE;
-}
 function hasSymlinkComponent(root, relPath) {
   let current = root;
   for (const segment of relPath.split("/")) {
@@ -121,7 +150,7 @@ function noAccessMessage() {
   return "you do not have access to the control plane \u2014 check your git credentials (SSH key or token) and org/SSO access, then retry";
 }
 function classifyGitFailure(stderr) {
-  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied/i.test(stderr)) {
+  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied|could not read (username|password)|repository .*not found/i.test(stderr)) {
     return "no-access";
   }
   return "unreachable";
@@ -216,25 +245,28 @@ async function materializeContext(deps) {
     }
   };
   const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
-  const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
-  const cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
-  const localRef = `refs/outerlayer/sha-${sanitizeRefName(storedSha)}`;
-  const wanted = `+${storedSha}:${localRef}`;
-  const access = await deps.controlPlaneAccess?.([{ repository, ref }]);
-  const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
-  const fetchResult = git(["fetch", "--depth", "1", remoteUrl, wanted], {
-    cwd: cacheRepoDir,
-    timeoutMs: 1e4,
-    ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+  const fetched = await fetchControlPlaneCommit({
+    git,
+    home,
+    repository,
+    sha: storedSha,
+    remoteUrl,
+    // A runner reads the control plane with a token for it, not the host's git login.
+    token: async () => {
+      const access = await deps.controlPlaneAccess?.([{ repository, ref }]);
+      return access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
+    },
+    policy: deps.controlPlaneFetch ?? { timeoutMs: 1e4, attempts: 1, reuseCached: false }
   });
   const commitNote = (message) => `could not fetch commit \`${storedSha.slice(0, 7)}\` of ${repository}; ${message}`;
-  if (!fetchResult.ok) {
-    const kind = classifyGitFailure(fetchResult.stderr);
-    const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage() : unreachableMessage());
+  if (!fetched.ok) {
+    const { kind } = fetched;
+    const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage() : `${unreachableMessage()}: ${fetched.detail}`);
     writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref });
     record(null, "none", repository, ref);
     return { status: kind, message: doctorMessage, sha: null, verification: "none" };
   }
+  const { cacheRepoDir, localRef } = fetched;
   const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
   if (fetchedSha !== storedSha) {
     const doctorMessage = commitNote(unreachableMessage());
@@ -498,4 +530,4 @@ function writeFilesVerbatim(git, cacheRepoDir, files, workpieceRoot) {
   return { writtenPaths, ok: !anySkipped };
 }
 
-export { defaultGitRunner, isStagingWriteFault, lookupGoverningSource, materializeContext, parseOwnerRepo, resolveGitCommonDir };
+export { defaultGitRunner, fetchControlPlaneCommit, lookupGoverningSource, materializeContext, parseOwnerRepo, resolveGitCommonDir };

package/dist/{chunk-DDS2ISML.js → chunk-F5UL23I2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-43PV5KDB.js → chunk-GFVDC5S3.js}

@@ -4,9 +4,9 @@ import { RecipeError } from './chunk-3Z3MPR55.js';
 import { BUILDKIT_IMAGE } from './chunk-TGHBOXKJ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { compareVersions } from './chunk-5DNCFOXA.js';
-import { ensureHostKey } from './chunk-AA6LYZC4.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-AGZNCIIJ.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BCCI32ME.js';
+import { ensureHostKey } from './chunk-SOI6K5DY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PA6CK6WQ.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BALIE3BA.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';

package/dist/{chunk-JEKENLLA.js → chunk-GH246BGV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-W5DOK7BL.js → chunk-HVRQQOMH.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-QL3LPZ67.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-6LBSAW6I.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { EXEC_PORT } from './chunk-LWTBE5J6.js';
-import { RELAY_PORT } from './chunk-BCCI32ME.js';
+import { EXEC_PORT } from './chunk-L26V6ILJ.js';
+import { RELAY_PORT } from './chunk-BALIE3BA.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-6IKSUAIA.js → chunk-HXA5GIHK.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { isAgentsMdLayout } from './chunk-HJYBWJAS.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-6RKD7YZ6.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-GFYEMCPP.js';
@@ -11,8 +11,9 @@ import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { hasSymlinkComponent } from './chunk-AVTI3FL5.js';
 import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-LJG6EMLJ.js';
+import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, realpathSync, readdirSync } from 'fs';
-import { join, dirname, posix } from 'path';
+import { join, dirname, posix, basename, isAbsolute, relative } from 'path';
 
 createRequire(import.meta.url);
 var PROSE_FILE = /\.mdc?$/;
@@ -220,6 +221,63 @@ function checkMachineSkills(opts) {
     }
   ];
 }
+var SKILL_BASES2 = [".agents/skills", ".claude/skills"];
+function ignoreRuleFor(repoRoot, path) {
+  let out;
+  try {
+    out = execFileSync("git", ["-C", repoRoot, "check-ignore", "-v", "--", path], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 });
+  } catch {
+    return void 0;
+  }
+  const match = /^(.*?):(\d+):([^\t]*)\t/.exec(out);
+  if (match === null || match[3].startsWith("!")) return void 0;
+  return { source: match[1], line: match[2], pattern: match[3] };
+}
+function ignoredSkillFolders(repoRoot) {
+  const found = [];
+  let any = false;
+  const ruleFor = (path) => ignoreRuleFor(repoRoot, path);
+  for (const base of SKILL_BASES2) {
+    let names;
+    try {
+      names = readdirSync(join(repoRoot, base), { withFileTypes: true }).filter((entry) => entry.isDirectory() || entry.isSymbolicLink()).map((entry) => entry.name).sort();
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      const folder = `${base}/${name}`;
+      any = true;
+      const file = existsSync(join(repoRoot, folder, "SKILL.md")) ? `${folder}/SKILL.md` : folder;
+      if (ruleFor(file) === void 0) continue;
+      const parts = file.split("/");
+      const ignored = parts.map((_, i) => parts.slice(0, i + 1).join("/")).find((path) => ruleFor(path) !== void 0);
+      found.push({ folder, ignored, ...ruleFor(ignored) });
+    }
+  }
+  return { found, any };
+}
+function ignoredSkillFix({ folder, ignored, source, line }) {
+  if (folder.startsWith(`${ignored}/`)) {
+    return `${ignored}/ is ignored as a whole, and git cannot bring back a folder inside an ignored one: change line ${line} of ${source} so it no longer matches ${ignored}/, or run \`git add -f ${folder}\`, then commit.`;
+  }
+  const target = ignored === folder ? `${folder}/` : ignored;
+  if (basename(source) !== ".gitignore" || isAbsolute(source)) return `Add the line \`!${target}\` to .gitignore, then commit the folder.`;
+  const path = relative(dirname(source), target) + (target.endsWith("/") ? "/" : "");
+  const anchored = path.slice(0, -1).includes("/") ? path : `/${path}`;
+  return `Add the line \`!${anchored}\` to ${source} below line ${line}, then commit the folder.`;
+}
+function checkIgnoredSkillFolders(repoRoot) {
+  const { found, any } = ignoredSkillFolders(repoRoot);
+  if (found.length === 0) {
+    return !any ? [] : [{ name: "Skills", status: "pass", detail: `no folder under ${SKILL_BASES2.join(" or ")} is ignored by git` }];
+  }
+  return found.map((ignored) => ({
+    name: "Skills",
+    status: "warn",
+    detail: `${ignored.folder} is ignored by ${ignored.source} line ${ignored.line} (\`${ignored.pattern}\`), so git never commits it and a build's clone has no ${ignored.folder.split("/").at(-1)} skill`,
+    fix: ignoredSkillFix(ignored)
+  }));
+}
 
 // src/fleet-readiness.ts
 var FIRST_VERSION_WITH_MACHINE_SKILLS = "0.27.0";
@@ -297,4 +355,4 @@ async function fleetCheck(opts = {}) {
   return [{ name: CHECK_NAME, status: "pass", detail }];
 }
 
-export { applyReferenceRewrites, checkBuildSkill, checkCommittedMaintainedSkills, checkMachineSkills, checkMaintainedReferences, committedMaintainedFolders, describeFleet, fleetCheck, fleetReadiness, maintainedReferenceRewrites, skillsFolders };
+export { applyReferenceRewrites, checkBuildSkill, checkCommittedMaintainedSkills, checkIgnoredSkillFolders, checkMachineSkills, checkMaintainedReferences, committedMaintainedFolders, describeFleet, fleetCheck, fleetReadiness, maintainedReferenceRewrites, skillsFolders };

package/dist/{chunk-2QT4JUW3.js → chunk-IP7BIBXJ.js}

@@ -1,11 +1,5 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-ZQOSIMKU.js';
-import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
-import { resolveGatewayCredentials } from './chunk-WPGBDY73.js';
-import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { cliInvocation } from './chunk-CRB3POP4.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';
 import { join } from 'path';
 
@@ -82,32 +76,4 @@ function transcriptPathForSession(sessionId, home, readTailImpl = readTail) {
   return found;
 }
 
-// src/auto-connect.ts
-async function autoConnect(opts) {
-  const env = opts.env ?? process.env;
-  const home = opts.home ?? homeFromEnv(env);
-  const cwd = opts.cwd ?? process.cwd();
-  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, home, env, cwd });
-  if (resolved.ok || resolved.kind !== "login" || !resolved.credential || !resolved.url) return void 0;
-  const dirs = findGitDirs(cwd);
-  const repository = opts.repository ?? resolveRepoIdentity(cwd).gitRepo;
-  if (dirs === void 0 || repository === void 0) return void 0;
-  const listed = await fetchFactories(opts.fetchImpl ?? fetch, resolved.url, resolved.credential, repository);
-  if (!listed.ok || listed.factories.length === 0) return void 0;
-  const chosen = selectFactory(listed.factories, readRepoConnection(cwd), repository);
-  if (chosen.factory === void 0) {
-    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`${cliInvocation()} connect --factory <org>/<factory>\` with one of:
-${chosen.text}
-Or pass --app-id / set OUTERLAYER_APP_ID.`;
-  }
-  try {
-    saveFactoryConnection(dirs.gitCommonDir, void 0, chosen.factory, /* @__PURE__ */ new Date());
-  } catch {
-    return void 0;
-  }
-  process.stderr.write(`${autoConnectedLine(repository, chosen.factory, chosen.reason)}
-`);
-  return void 0;
-}
-
-export { autoConnect, detectActiveSession, transcriptPathForSession };
+export { detectActiveSession, transcriptPathForSession };

package/dist/{chunk-KLXWS5Z7.js → chunk-JPG43G6Y.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-DDS2ISML.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
 import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-TGHBOXKJ.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-AGZNCIIJ.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BCCI32ME.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PA6CK6WQ.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BALIE3BA.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';