@outerlayer/cli 0.33.0-next.20261022195547 → 0.33.0-next.20261023002325

package/dist/{chunk-H7A3IQH5.js → chunk-CANYZTD5.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-L6JFFP3Q.js';
+import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-DGI66PGY.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UOFBHIOZ.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-6C2YWM6N.js';
-import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
-import { writePendingUpdate } from './chunk-JEKENLLA.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-DNKUSXQU.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-OWDSO3PE.js';
+import { fitImageBuildMemory } from './chunk-OOCAF3ID.js';
+import { RUNNER_PROTOCOL } from './chunk-MZYOUIY5.js';
+import { writePendingUpdate } from './chunk-GH246BGV.js';
+import { realBlockedProbes, checkBlocked } from './chunk-QFQC5K4J.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-D3HRAPNF.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-DDS2ISML.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JRZCRIEO.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RBJG5MM4.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-SK4TWCN3.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-T5REPMNL.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43PV5KDB.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-5BNWAIHN.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-GFVDC5S3.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3DCB3GOV.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-CMKY36NV.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-AA6LYZC4.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AGZNCIIJ.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BCCI32ME.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-VT4TTJPG.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
@@ -1837,7 +1837,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-NCP4637R.js');
+  const { postJson: postJson2 } = await import('./work-cmd-W7WEHMQJ.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2070,6 +2070,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   log.line(`${tag} provision started`);
   const provisionStartedMs = nowOf(state).getTime();
   const processMode = isBuiltinProcess(state.config.hooks.provision);
+  const requireBuildSkill = needsBuildSkill(queue, state.config.commands[queue]);
   const cliVersion = state.deps.cliVersion ?? resolveVersion();
   let workdir;
   let cgroup;
@@ -2094,7 +2095,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
       fetchImpl: state.deps.fetchImpl,
       now: state.deps.now,
-      leaseExpiryMs: () => leaseExpiresAtMs(active.job)
+      leaseExpiryMs: () => leaseExpiresAtMs(active.job),
+      requireBuildSkill
     }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
@@ -2133,7 +2135,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
       fetchImpl: state.deps.fetchImpl,
       now: state.deps.now,
-      leaseTimeLeftMs: leaseTimeLeftFor(state, active)
+      leaseTimeLeftMs: leaseTimeLeftFor(state, active),
+      requireBuildSkill
     }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
@@ -2318,6 +2321,20 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   job = { ...active.job, workdir, cgroup };
   active.job = job;
   writeJobFile(jobFilePath, job);
+  const skillDecision = await decideHostBuildSkill({
+    requireBuildSkill,
+    containerMode,
+    vmMode,
+    workdir,
+    repository: primary?.repository,
+    lookup: (repository) => resolveGoverningSource({ config: state.config, repository, fetchImpl: state.deps.fetchImpl }).catch(() => void 0)
+  });
+  if (skillDecision.kind === "refuse") {
+    log.error(`${tag} ${skillDecision.reason} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason: skillDecision.reason });
+    return;
+  }
+  if (skillDecision.kind === "warn") log.line(`${tag} warning: the clone has no \`build\` skill; the control plane's context may deliver one, so the command starts`);
   if (!containerMode && !vmMode) {
     if (existsSync(join(workdir, ".git"))) {
       try {
@@ -2492,7 +2509,7 @@ async function startHostBuild(state, active, repository) {
   const runtime = runtimeOf(state);
   let failed2;
   try {
-    await startHostServices({ runtime, config: state.config, build, jobDir: active.dirPath, itemKey: active.job.itemKey, process: false });
+    await startHostServices({ runtime, config: state.config, build, jobDir: active.dirPath, itemKey: active.job.itemKey, process: false, routeLog: (line) => logOf(state).line(`#${active.job.item} ${line}`) });
   } catch (err) {
     failed2 = describeCallFailure(err);
     logOf(state).error(`#${active.job.item} the tunnel and destination servers could not start: ${failed2} \xB7 continuing`);
@@ -3037,7 +3054,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-64UX323V.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-64FD5G3X.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-L6JFFP3Q.js → chunk-DGI66PGY.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-W5DOK7BL.js';
-import { writeDockerClientConfig } from './chunk-QL3LPZ67.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HVRQQOMH.js';
+import { writeDockerClientConfig } from './chunk-6LBSAW6I.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-QDMMW5PC.js';
-import { installScrubContext } from './chunk-3MXPS7ED.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-D3HRAPNF.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-KLXWS5Z7.js';
+import { senderPidfile } from './chunk-Q2CMEQV7.js';
+import { installScrubContext } from './chunk-2N67C6IV.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JRZCRIEO.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-JPG43G6Y.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { waitForAgent, vmExecArgs } from './chunk-6NWS455T.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-LWTBE5J6.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RBJG5MM4.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-43PV5KDB.js';
+import { waitForAgent, vmExecArgs } from './chunk-5THSC6BD.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-L26V6ILJ.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-T5REPMNL.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-GFVDC5S3.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TGHBOXKJ.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-5BNWAIHN.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-3DCB3GOV.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-CMKY36NV.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-VT4TTJPG.js';
 import { planArtifactUpload } from './chunk-EWVYQLD3.js';
 import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-AA6LYZC4.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-AGZNCIIJ.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BCCI32ME.js';
+import { signerFor } from './chunk-SOI6K5DY.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PA6CK6WQ.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
 import { resolvePackRoot } from './chunk-G63KT5I5.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -442,7 +442,7 @@ async function provisionMicroVm(input) {
   let services;
   try {
     const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
-    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote);
+    services = await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote, "socket", void 0, void 0, (line) => log.line(`${tag} ${line}`));
     runtime.tunnels.set(buildId, services);
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
@@ -627,7 +627,8 @@ async function provisionMicroVm(input) {
       }
     },
     removeStagedContext: () => removeStagedContext(buildDir2),
-    keepIn: jobDir
+    keepIn: jobDir,
+    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {}
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
@@ -1446,7 +1447,8 @@ async function startHostServices(input) {
       builtIns: Object.fromEntries((build.destinations ?? []).filter((d) => BUILT_IN_NAMES.includes(d.name)).map((d) => [d.name, d.port]))
     },
     hostEnv: runtime.hostEnv,
-    destinationOptions: runtime.destinationOptions
+    destinationOptions: runtime.destinationOptions,
+    ...input.routeLog === void 0 ? {} : { log: input.routeLog }
   });
   build.proxyPort = services.proxyPort;
   build.destinations = [
@@ -1564,6 +1566,7 @@ function isTailedStage(stage) {
   const tailed = ["provision", "sync", "cleanup", "report"];
   return tailed.includes(stage);
 }
+var PROVISION_PROBLEM = /\b(warn(ing)?|error|fail(ed|ure)?|refused)\b/i;
 var READ_LIMIT_BYTES = 1048576;
 var ITEM_LINE = /^#(\d+)\b/;
 var AttemptLogBook = class {
@@ -1668,6 +1671,11 @@ function buildReleaseLog(jobDirPath, endStage, scrub) {
     const tail = stage === void 0 ? [] : lastLines(stage);
     if (tail.length > 0) parts.push(`--- the last ${tail.length} lines of ${file} ---`, ...tail);
   }
+  if (endStage !== "provision") {
+    const provision = readEnd(join(jobDirPath, "provision.log"), READ_LIMIT_BYTES);
+    const problems = provision === void 0 ? [] : provision.split("\n").filter((line) => PROVISION_PROBLEM.test(line)).slice(-50);
+    if (problems.length > 0) parts.push(`--- provision problems (${problems.length} lines of provision.log) ---`, ...problems);
+  }
   if (parts.length === 0) return void 0;
   return capRunnerLog(scrub(parts.join("\n")) + "\n");
 }
@@ -1696,7 +1704,7 @@ async function provisionProcess(input) {
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
   try {
-    await startHostServices({ runtime, config, build: state, jobDir, itemKey: input.itemKey, process: true });
+    await startHostServices({ runtime, config, build: state, jobDir, itemKey: input.itemKey, process: true, routeLog: (line) => input.log.line(`#${item.number} ${line}`) });
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
@@ -2919,7 +2927,8 @@ function scrubTunnelRecord(record, config) {
     hostsMore: record.hostsMore,
     refusalsMore: record.refusalsMore,
     refusals: record.refusals.map((r) => ({ ...r, host: scrubText(r.host) })),
-    destinations: (record.destinations ?? []).map((name) => scrubText(name))
+    destinations: (record.destinations ?? []).map((name) => scrubText(name)),
+    ...record.routes === void 0 ? {} : { routes: Object.fromEntries(Object.entries(record.routes).map(([name, counts]) => [scrubText(name), counts])) }
   };
 }
 function runCommand(cmdline, env, cwd, logPath, spawnFn = spawn) {
@@ -3054,6 +3063,9 @@ async function releaseLease(config, item, outcome, detail, fetchImpl) {
         sent = "ok";
       } else if (log !== void 0 && /\blog\b/.test(err.message)) {
         log = void 0;
+      } else if (environment?.routes !== void 0) {
+        const { routes: _omittedRoutes, ...withoutRoutes } = environment;
+        environment = withoutRoutes;
       } else if (environment?.guestUsage !== void 0) {
         const { guestUsage: _omittedUsage, ...withoutUsage } = environment;
         environment = withoutUsage;

package/dist/{chunk-GN2R5Z7G.js → chunk-DXJTBU7A.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-GWDS42JC.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-OWDSO3PE.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-Z5IW4DHH.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-NBZ7XBT6.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE } from './chunk-PA6CK6WQ.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-WCELNMXT.js → chunk-EUVE2EAE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-UIUGTW5C.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-WPGBDY73.js';
-import { withTokenHeader } from './chunk-BCCI32ME.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
+import { withTokenHeader } from './chunk-BALIE3BA.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-DDS2ISML.js → chunk-F5UL23I2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-43PV5KDB.js → chunk-GFVDC5S3.js}

@@ -4,9 +4,9 @@ import { RecipeError } from './chunk-3Z3MPR55.js';
 import { BUILDKIT_IMAGE } from './chunk-TGHBOXKJ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { compareVersions } from './chunk-5DNCFOXA.js';
-import { ensureHostKey } from './chunk-AA6LYZC4.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-AGZNCIIJ.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BCCI32ME.js';
+import { ensureHostKey } from './chunk-SOI6K5DY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PA6CK6WQ.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BALIE3BA.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';

package/dist/{chunk-JEKENLLA.js → chunk-GH246BGV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-W5DOK7BL.js → chunk-HVRQQOMH.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-QL3LPZ67.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-6LBSAW6I.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { EXEC_PORT } from './chunk-LWTBE5J6.js';
-import { RELAY_PORT } from './chunk-BCCI32ME.js';
+import { EXEC_PORT } from './chunk-L26V6ILJ.js';
+import { RELAY_PORT } from './chunk-BALIE3BA.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-6IKSUAIA.js → chunk-HXA5GIHK.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { isAgentsMdLayout } from './chunk-HJYBWJAS.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-6RKD7YZ6.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-GFYEMCPP.js';
@@ -11,8 +11,9 @@ import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { hasSymlinkComponent } from './chunk-AVTI3FL5.js';
 import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-LJG6EMLJ.js';
+import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, realpathSync, readdirSync } from 'fs';
-import { join, dirname, posix } from 'path';
+import { join, dirname, posix, basename, isAbsolute, relative } from 'path';
 
 createRequire(import.meta.url);
 var PROSE_FILE = /\.mdc?$/;
@@ -220,6 +221,63 @@ function checkMachineSkills(opts) {
     }
   ];
 }
+var SKILL_BASES2 = [".agents/skills", ".claude/skills"];
+function ignoreRuleFor(repoRoot, path) {
+  let out;
+  try {
+    out = execFileSync("git", ["-C", repoRoot, "check-ignore", "-v", "--", path], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 });
+  } catch {
+    return void 0;
+  }
+  const match = /^(.*?):(\d+):([^\t]*)\t/.exec(out);
+  if (match === null || match[3].startsWith("!")) return void 0;
+  return { source: match[1], line: match[2], pattern: match[3] };
+}
+function ignoredSkillFolders(repoRoot) {
+  const found = [];
+  let any = false;
+  const ruleFor = (path) => ignoreRuleFor(repoRoot, path);
+  for (const base of SKILL_BASES2) {
+    let names;
+    try {
+      names = readdirSync(join(repoRoot, base), { withFileTypes: true }).filter((entry) => entry.isDirectory() || entry.isSymbolicLink()).map((entry) => entry.name).sort();
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      const folder = `${base}/${name}`;
+      any = true;
+      const file = existsSync(join(repoRoot, folder, "SKILL.md")) ? `${folder}/SKILL.md` : folder;
+      if (ruleFor(file) === void 0) continue;
+      const parts = file.split("/");
+      const ignored = parts.map((_, i) => parts.slice(0, i + 1).join("/")).find((path) => ruleFor(path) !== void 0);
+      found.push({ folder, ignored, ...ruleFor(ignored) });
+    }
+  }
+  return { found, any };
+}
+function ignoredSkillFix({ folder, ignored, source, line }) {
+  if (folder.startsWith(`${ignored}/`)) {
+    return `${ignored}/ is ignored as a whole, and git cannot bring back a folder inside an ignored one: change line ${line} of ${source} so it no longer matches ${ignored}/, or run \`git add -f ${folder}\`, then commit.`;
+  }
+  const target = ignored === folder ? `${folder}/` : ignored;
+  if (basename(source) !== ".gitignore" || isAbsolute(source)) return `Add the line \`!${target}\` to .gitignore, then commit the folder.`;
+  const path = relative(dirname(source), target) + (target.endsWith("/") ? "/" : "");
+  const anchored = path.slice(0, -1).includes("/") ? path : `/${path}`;
+  return `Add the line \`!${anchored}\` to ${source} below line ${line}, then commit the folder.`;
+}
+function checkIgnoredSkillFolders(repoRoot) {
+  const { found, any } = ignoredSkillFolders(repoRoot);
+  if (found.length === 0) {
+    return !any ? [] : [{ name: "Skills", status: "pass", detail: `no folder under ${SKILL_BASES2.join(" or ")} is ignored by git` }];
+  }
+  return found.map((ignored) => ({
+    name: "Skills",
+    status: "warn",
+    detail: `${ignored.folder} is ignored by ${ignored.source} line ${ignored.line} (\`${ignored.pattern}\`), so git never commits it and a build's clone has no ${ignored.folder.split("/").at(-1)} skill`,
+    fix: ignoredSkillFix(ignored)
+  }));
+}
 
 // src/fleet-readiness.ts
 var FIRST_VERSION_WITH_MACHINE_SKILLS = "0.27.0";
@@ -297,4 +355,4 @@ async function fleetCheck(opts = {}) {
   return [{ name: CHECK_NAME, status: "pass", detail }];
 }
 
-export { applyReferenceRewrites, checkBuildSkill, checkCommittedMaintainedSkills, checkMachineSkills, checkMaintainedReferences, committedMaintainedFolders, describeFleet, fleetCheck, fleetReadiness, maintainedReferenceRewrites, skillsFolders };
+export { applyReferenceRewrites, checkBuildSkill, checkCommittedMaintainedSkills, checkIgnoredSkillFolders, checkMachineSkills, checkMaintainedReferences, committedMaintainedFolders, describeFleet, fleetCheck, fleetReadiness, maintainedReferenceRewrites, skillsFolders };

package/dist/{chunk-2QT4JUW3.js → chunk-IP7BIBXJ.js}

@@ -1,11 +1,5 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-ZQOSIMKU.js';
-import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
-import { resolveGatewayCredentials } from './chunk-WPGBDY73.js';
-import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { cliInvocation } from './chunk-CRB3POP4.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';
 import { join } from 'path';
 
@@ -82,32 +76,4 @@ function transcriptPathForSession(sessionId, home, readTailImpl = readTail) {
   return found;
 }
 
-// src/auto-connect.ts
-async function autoConnect(opts) {
-  const env = opts.env ?? process.env;
-  const home = opts.home ?? homeFromEnv(env);
-  const cwd = opts.cwd ?? process.cwd();
-  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, home, env, cwd });
-  if (resolved.ok || resolved.kind !== "login" || !resolved.credential || !resolved.url) return void 0;
-  const dirs = findGitDirs(cwd);
-  const repository = opts.repository ?? resolveRepoIdentity(cwd).gitRepo;
-  if (dirs === void 0 || repository === void 0) return void 0;
-  const listed = await fetchFactories(opts.fetchImpl ?? fetch, resolved.url, resolved.credential, repository);
-  if (!listed.ok || listed.factories.length === 0) return void 0;
-  const chosen = selectFactory(listed.factories, readRepoConnection(cwd), repository);
-  if (chosen.factory === void 0) {
-    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`${cliInvocation()} connect --factory <org>/<factory>\` with one of:
-${chosen.text}
-Or pass --app-id / set OUTERLAYER_APP_ID.`;
-  }
-  try {
-    saveFactoryConnection(dirs.gitCommonDir, void 0, chosen.factory, /* @__PURE__ */ new Date());
-  } catch {
-    return void 0;
-  }
-  process.stderr.write(`${autoConnectedLine(repository, chosen.factory, chosen.reason)}
-`);
-  return void 0;
-}
-
-export { autoConnect, detectActiveSession, transcriptPathForSession };
+export { detectActiveSession, transcriptPathForSession };

package/dist/{chunk-KLXWS5Z7.js → chunk-JPG43G6Y.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-DDS2ISML.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
 import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-TGHBOXKJ.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-AGZNCIIJ.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BCCI32ME.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PA6CK6WQ.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BALIE3BA.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';