@outerlayer/cli 0.33.0-next.20261022195547 → 0.33.0-next.20261023003700

package/dist/{chunk-H7A3IQH5.js → chunk-SDU2IE22.js}

@@ -1,30 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-L6JFFP3Q.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-PWH3BEZF.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UOFBHIOZ.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-6C2YWM6N.js';
-import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
-import { writePendingUpdate } from './chunk-JEKENLLA.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-DNKUSXQU.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-OWDSO3PE.js';
+import { fitImageBuildMemory } from './chunk-XHHTMFCX.js';
+import { RUNNER_PROTOCOL } from './chunk-MZYOUIY5.js';
+import { writePendingUpdate } from './chunk-GH246BGV.js';
+import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-7HHNGZS5.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-D3HRAPNF.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-DDS2ISML.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-2EGCI2VW.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RBJG5MM4.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-SK4TWCN3.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-T5REPMNL.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43PV5KDB.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-5BNWAIHN.js';
-import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-CMKY36NV.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-AA6LYZC4.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AGZNCIIJ.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BCCI32ME.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-RQJMN5TJ.js';
+import { freeBytes, formatBytes, volumeBytes } from './chunk-W2AEL4BJ.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-FR7HWWCF.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-VT4TTJPG.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
@@ -645,6 +644,16 @@ function createHousekeepingDocker(deps) {
       const result = await run("docker", ["rmi", id]);
       if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
     },
+    async removeBuilder() {
+      const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
+      if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
+      const df = await run("docker", ["system", "df", "-v"]);
+      const freedBytes = df.status === 0 ? volumeBytes(df.stdout, /* @__PURE__ */ new Set([`buildx_buildkit_${deps.builder}0_state`])) : 0;
+      const result = await run("docker", ["buildx", "rm", deps.builder]);
+      if (result.status !== 0 && NO_BUILDER.test(result.stderr)) return void 0;
+      if (result.status !== 0) throw failure(result, "docker buildx rm");
+      return { freedBytes };
+    },
     async builderPrune(keepBytes) {
       const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
       if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
@@ -869,7 +878,17 @@ async function runHousekeeping(options) {
     } catch (err) {
       log.error(`housekeeping: dangling images could not be listed: ${describeCallFailure(err)}`);
     }
-    if (options.buildCacheMax !== "off") {
+    if (options.removeHostBuilder === true) {
+      try {
+        const removed = await docker.removeBuilder();
+        if (removed !== void 0) {
+          freed += removed.freedBytes;
+          log.line(`housekeeping: removed the host image builder and its state volume, freed ${formatBytes(removed.freedBytes)}; this runner builds images in the builder microVM`);
+        }
+      } catch (err) {
+        log.error(`housekeeping: the host image builder could not be removed: ${describeCallFailure(err)}`);
+      }
+    } else if (options.buildCacheMax !== "off") {
       try {
         const pruned = await docker.builderPrune(options.buildCacheMax);
         if (pruned === void 0) {
@@ -1225,6 +1244,10 @@ function fitForImage(deps, config) {
 function describeConfig(config) {
   return `queues ${config.queues.join(",")} \xB7 concurrency ${config.concurrency} \xB7 poll ${config.pollSeconds}s`;
 }
+function slotsTotalOf(state) {
+  const slots = state.blocked === void 0 ? state.buildSlots ?? state.config.concurrency : state.config.concurrency;
+  return Math.max(slots, state.jobs.size, 1);
+}
 async function sendTickHeartbeat(state, workRequest) {
   if (state.heartbeating) {
     if (workRequest !== void 0) state.queuedWorkRequest = workRequest;
@@ -1247,7 +1270,7 @@ async function sendTickHeartbeat(state, workRequest) {
           cliVersion: state.deps.cliVersion ?? resolveVersion(),
           pollSeconds: state.pollTimerSeconds ?? state.config.pollSeconds,
           slotsUsed: state.jobs.size,
-          slotsTotal: state.config.concurrency,
+          slotsTotal: slotsTotalOf(state),
           workRequest: next,
           lastUpdate: readLastUpdate(state.config.configPath),
           lowDisk: state.lowDisk,
@@ -1660,6 +1683,7 @@ function imageBuilderState(state) {
   const kind = builtinKind(state.config.hooks.provision);
   if (kind !== "container" && kind !== "vm") return "usable";
   if (state.deps.container?.buildImage !== void 0 || state.deps.container?.imageHost !== void 0) return "usable";
+  if (!keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned)) return "usable";
   const memory = state.config.build?.memory ?? "8g";
   let probe = state.imageBuilder;
   if (probe === void 0 || probe.memory !== memory) probe = state.imageBuilder = { memory, at: 0, running: false };
@@ -1697,7 +1721,8 @@ function holdWhenBlocked(state, jailer) {
     inImage: state.deps.image !== void 0,
     ...state.deps.blocked
   };
-  const blocked = checkBlocked(state.config, probes);
+  const { blocked, slots } = checkBlockedWithSlots(state.config, probes);
+  state.buildSlots = slots;
   const log = logOf(state);
   if (blocked !== void 0) {
     if (state.blocked?.reason !== blocked.reason) log.line(`claiming nothing: ${blocked.reason}`);
@@ -1753,6 +1778,7 @@ async function housekeepingPass(state) {
       configPath: state.config.configPath,
       keepDays: config.jobsKeepDays,
       buildCacheMax: config.buildCacheMax,
+      removeHostBuilder: !keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned),
       docker: state.deps.housekeeping.docker,
       now: state.deps.now ?? (() => /* @__PURE__ */ new Date()),
       log: logOf(state)
@@ -1784,7 +1810,8 @@ async function runTick(state) {
   const repoFilter = new RepoFilter(state.config.repos);
   let filtered = 0;
   let attempts = 0;
-  while (state.jobs.size < state.config.concurrency && attempts < state.config.concurrency) {
+  const slots = Math.min(state.buildSlots ?? state.config.concurrency, state.config.concurrency);
+  while (state.jobs.size < slots && attempts < state.config.concurrency) {
     attempts++;
     let claimed = false;
     for (const queue of QUEUE_ORDER) {
@@ -1837,7 +1864,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-NCP4637R.js');
+  const { postJson: postJson2 } = await import('./work-cmd-W7WEHMQJ.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2070,6 +2097,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   log.line(`${tag} provision started`);
   const provisionStartedMs = nowOf(state).getTime();
   const processMode = isBuiltinProcess(state.config.hooks.provision);
+  const requireBuildSkill = needsBuildSkill(queue, state.config.commands[queue]);
   const cliVersion = state.deps.cliVersion ?? resolveVersion();
   let workdir;
   let cgroup;
@@ -2094,7 +2122,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
       fetchImpl: state.deps.fetchImpl,
       now: state.deps.now,
-      leaseExpiryMs: () => leaseExpiresAtMs(active.job)
+      leaseExpiryMs: () => leaseExpiresAtMs(active.job),
+      requireBuildSkill
     }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
@@ -2133,7 +2162,8 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       deadlineMs: startedAt.getTime() + state.config.timeLimitMinutes * 6e4,
       fetchImpl: state.deps.fetchImpl,
       now: state.deps.now,
-      leaseTimeLeftMs: leaseTimeLeftFor(state, active)
+      leaseTimeLeftMs: leaseTimeLeftFor(state, active),
+      requireBuildSkill
     }).catch((err) => ({ ok: false, reason: `provision failed: ${describeCallFailure(err)}`, aborted: false }));
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
@@ -2318,6 +2348,20 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   job = { ...active.job, workdir, cgroup };
   active.job = job;
   writeJobFile(jobFilePath, job);
+  const skillDecision = await decideHostBuildSkill({
+    requireBuildSkill,
+    containerMode,
+    vmMode,
+    workdir,
+    repository: primary?.repository,
+    lookup: (repository) => resolveGoverningSource({ config: state.config, repository, fetchImpl: state.deps.fetchImpl }).catch(() => void 0)
+  });
+  if (skillDecision.kind === "refuse") {
+    log.error(`${tag} ${skillDecision.reason} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason: skillDecision.reason });
+    return;
+  }
+  if (skillDecision.kind === "warn") log.line(`${tag} warning: the clone has no \`build\` skill; the control plane's context may deliver one, so the command starts`);
   if (!containerMode && !vmMode) {
     if (existsSync(join(workdir, ".git"))) {
       try {
@@ -2492,7 +2536,7 @@ async function startHostBuild(state, active, repository) {
   const runtime = runtimeOf(state);
   let failed2;
   try {
-    await startHostServices({ runtime, config: state.config, build, jobDir: active.dirPath, itemKey: active.job.itemKey, process: false });
+    await startHostServices({ runtime, config: state.config, build, jobDir: active.dirPath, itemKey: active.job.itemKey, process: false, routeLog: (line) => logOf(state).line(`#${active.job.item} ${line}`) });
   } catch (err) {
     failed2 = describeCallFailure(err);
     logOf(state).error(`#${active.job.item} the tunnel and destination servers could not start: ${failed2} \xB7 continuing`);
@@ -3037,7 +3081,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-64UX323V.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-MRYFTLOO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-AA6LYZC4.js → chunk-SOI6K5DY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-35IY5HQY.js → chunk-SVDOA4W2.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-DY7Y7UT4.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-HJYBWJAS.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-WCELNMXT.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-EUVE2EAE.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-AVTI3FL5.js';

package/dist/{chunk-RBJG5MM4.js → chunk-T5REPMNL.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-CMKY36NV.js';
-import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-WCELNMXT.js';
-import { signingFetchFor } from './chunk-WPGBDY73.js';
-import { signerFor } from './chunk-AA6LYZC4.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-AGZNCIIJ.js';
+import { WorkCommandError, postJson } from './chunk-VT4TTJPG.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-EUVE2EAE.js';
+import { signingFetchFor } from './chunk-6RKD7YZ6.js';
+import { signerFor } from './chunk-SOI6K5DY.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-PA6CK6WQ.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';

package/dist/{chunk-6KLPC4U7.js → chunk-ULBNTSAD.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-2QT4JUW3.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-WPGBDY73.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-CMKY36NV.js → chunk-VT4TTJPG.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
-import { workPageUrl } from './chunk-ZQOSIMKU.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
+import { workPageUrl } from './chunk-2WMZPJVE.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-WPGBDY73.js';
-import { signRunnerRequest } from './chunk-AA6LYZC4.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-6RKD7YZ6.js';
+import { signRunnerRequest } from './chunk-SOI6K5DY.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -441,7 +442,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-WNKICZ6E.js');
+      const { logHookError } = await import('./hook-fast-6WDMNZG5.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/chunk-W2AEL4BJ.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-FR7HWWCF.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
+import { spawnSync } from 'child_process';
+import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
+import { dirname, join } from 'path';
+
+createRequire(import.meta.url);
+function freeBytes(path, statfs = statfsSync) {
+  let at = path;
+  for (; ; ) {
+    try {
+      const stats = statfs(at);
+      return Number(stats.bavail) * Number(stats.bsize);
+    } catch (err) {
+      if (err.code !== "ENOENT") return void 0;
+      const parent = dirname(at);
+      if (parent === at) return void 0;
+      at = parent;
+    }
+  }
+}
+var UNITS = ["B", "KB", "MB", "GB", "TB"];
+function formatBytes(bytes) {
+  let value = Math.max(0, bytes);
+  let unit = 0;
+  while (value >= 1024 && unit < UNITS.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return unit === 0 ? `${Math.round(value)} B` : `${value.toFixed(1)} ${UNITS[unit]}`;
+}
+
+// src/runner/build-disk.ts
+var DEFAULT_CACHE_DISK = "40g";
+function checkDiskFit(input) {
+  const limit = parseSize(input.buildDisk);
+  if (limit === void 0) return { slots: input.concurrency, fits: true, oneBuildBytes: 0, neededBytes: 0, availableBytes: 0, reservedBytes: 0, message: "" };
+  const cacheLimit = parseSize(input.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK);
+  const { freeBytes: free, heldBytes: held, rootDiskBytes: root } = input.facts;
+  const reservedBytes = (input.facts.cacheBytes ?? []).reduce((sum, bytes) => sum + Math.max(0, cacheLimit - bytes), 0);
+  const oneBuildBytes = limit + root;
+  const neededBytes = input.concurrency * oneBuildBytes;
+  const availableBytes = Math.max(0, free + held - reservedBytes);
+  const slots = Math.min(input.concurrency, Math.floor(availableBytes / oneBuildBytes));
+  const oneBuild = root > 0 ? `runner.build.disk ${input.buildDisk} plus a root disk of ${formatBytes(root)}` : `runner.build.disk ${input.buildDisk}`;
+  const caches = reservedBytes > 0 ? `, less ${formatBytes(reservedBytes)} that the image-build caches can still grow to (runner.build.cacheDisk ${input.cacheDisk ?? DEFAULT_CACHE_DISK})` : "";
+  return {
+    slots,
+    fits: slots >= input.concurrency,
+    oneBuildBytes,
+    neededBytes,
+    availableBytes,
+    reservedBytes,
+    message: `${slots} of ${input.concurrency} ${input.concurrency === 1 ? "build" : "builds"} fit: one build can hold ${formatBytes(oneBuildBytes)} (${oneBuild}), runner.concurrency ${input.concurrency} needs ${formatBytes(neededBytes)}, and ${formatBytes(availableBytes)} is counted (${formatBytes(free)} free plus ${formatBytes(held)} held by running builds${caches})`
+  };
+}
+function allocatedBytes(path) {
+  try {
+    return statSync(path).blocks * 512;
+  } catch {
+    return 0;
+  }
+}
+function listDir(path) {
+  try {
+    return readdirSync(path);
+  } catch {
+    return void 0;
+  }
+}
+function logUnreadable(path) {
+  process.stderr.write(`outerlayer: cannot list ${path}, so the disk check does not count the image-build cache disks in it
+`);
+}
+function isBuilderDir(dir) {
+  return existsSync(join(dir, "image-builder.json"));
+}
+function cacheDiskBytes(configPath, builds, buildEntries) {
+  const cache = [];
+  const images = imagesDir(configPath);
+  if (existsSync(images)) {
+    const owners = listDir(images);
+    if (owners === void 0) {
+      logUnreadable(images);
+      return void 0;
+    }
+    for (const owner of owners) {
+      const names = listDir(join(images, owner));
+      if (names === void 0) logUnreadable(join(images, owner));
+      for (const name of names ?? []) {
+        const path = builderCacheDiskPath(configPath, owner, name);
+        if (existsSync(path)) cache.push(allocatedBytes(path));
+      }
+    }
+  }
+  for (const entry of buildEntries) {
+    if (isBuilderDir(join(builds, entry))) cache.push(allocatedBytes(join(builds, entry, "build.ext4")));
+  }
+  return cache;
+}
+function microVmFacts(configPath) {
+  const builds = buildsDir(configPath);
+  const free = freeBytes(builds);
+  if (free === void 0) return void 0;
+  let held = 0;
+  let entries = [];
+  if (existsSync(builds)) {
+    const listed = listDir(builds);
+    if (listed === void 0) return void 0;
+    entries = listed;
+    for (const entry of entries) {
+      if (!isBuilderDir(join(builds, entry))) held += allocatedBytes(join(builds, entry, "build.ext4"));
+    }
+  }
+  const cacheBytes = cacheDiskBytes(configPath, builds, entries);
+  if (cacheBytes === void 0) return void 0;
+  let root = 0;
+  const roots = rootfsDir(runnerDir(configPath));
+  if (existsSync(roots)) {
+    const rootEntries = listDir(roots);
+    if (rootEntries === void 0) return void 0;
+    for (const entry of rootEntries) {
+      if (!entry.endsWith(".ext4")) continue;
+      try {
+        root = Math.max(root, statSync(join(roots, entry)).size);
+      } catch {
+      }
+    }
+  }
+  return { freeBytes: free, heldBytes: held, rootDiskBytes: root, cacheBytes };
+}
+var DOCKER_TIMEOUT_MS = 1e4;
+var DEFAULT_BUILD_DISK = "40g";
+var DOCKER_CACHE_MS = 6e4;
+var DEFAULT_VOLUMES_DIR = "/var/lib/docker/volumes";
+function runDocker(args, spawn = spawnSync) {
+  const result = spawn("docker", args, { encoding: "utf8", timeout: DOCKER_TIMEOUT_MS });
+  return result.status === 0 ? result.stdout : void 0;
+}
+var SIZE_UNITS = { b: 1, kb: 1e3, mb: 1e6, gb: 1e9, tb: 1e12 };
+function volumeBytes(dfOutput, names) {
+  let total = 0;
+  for (const line of dfOutput.split("\n")) {
+    const [name, , size] = line.trim().split(/\s+/);
+    if (name === void 0 || size === void 0 || !names.has(name)) continue;
+    const match = /^([\d.]+)([A-Za-z]+)$/.exec(size);
+    const unit = match === null ? void 0 : SIZE_UNITS[match[2].toLowerCase()];
+    if (match !== null && unit !== void 0) total += Number(match[1]) * unit;
+  }
+  return total;
+}
+function containerFacts(cache, configPath, docker, now) {
+  if (cache.reading === void 0 || cache.reading.configPath !== configPath || now - cache.reading.at > DOCKER_CACHE_MS) {
+    const root = docker(["info", "--format", "{{.DockerRootDir}}"])?.trim();
+    const listed = docker(["volume", "ls", "--quiet", "--filter", `label=${BUILD_LABEL}`, "--filter", `label=${RUNNER_LABEL}=${runnerLabelValue(configPath)}`]);
+    const names = new Set((listed ?? "").split("\n").map((n) => n.trim()).filter((n) => n !== ""));
+    const df = listed === void 0 || names.size === 0 ? void 0 : docker(["system", "df", "-v"]);
+    const held = listed === void 0 ? void 0 : names.size === 0 ? 0 : df === void 0 ? void 0 : volumeBytes(df, names);
+    cache.reading = {
+      at: now,
+      configPath,
+      held,
+      volumes: root === void 0 || root === "" ? DEFAULT_VOLUMES_DIR : join(root, "volumes")
+    };
+  }
+  if (cache.reading.held === void 0) return void 0;
+  const free = freeBytes(cache.reading.volumes);
+  return free === void 0 ? void 0 : { freeBytes: free, heldBytes: cache.reading.held, rootDiskBytes: 0 };
+}
+function realBuildDiskProbe(deps = {}) {
+  const cache = {};
+  const docker = deps.docker ?? ((args) => runDocker(args));
+  const now = deps.now ?? Date.now;
+  return (kind, configPath) => kind === "vm" ? microVmFacts(configPath) : containerFacts(cache, configPath, docker, now());
+}
+
+export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, formatBytes, freeBytes, realBuildDiskProbe, runDocker, volumeBytes };

package/dist/{chunk-6C2YWM6N.js → chunk-XHHTMFCX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-ZRRUWNJS.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-HE4FBF4T.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-FAZDYI2D.js → chunk-XL2XWWU7.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { CriteriaListSchema } from './chunk-E6CO3MJE.js';

package/dist/{chunk-KLXWS5Z7.js → chunk-YXHKCHWG.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-DDS2ISML.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-TGHBOXKJ.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-AGZNCIIJ.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BCCI32ME.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-NE63JADS.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PA6CK6WQ.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BALIE3BA.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';

package/dist/{chunk-GWDS42JC.js → chunk-Z5IW4DHH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-OWDSO3PE.js';
+import { currentLink } from './chunk-NBZ7XBT6.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{claude-launcher-66GKNIRZ.js → claude-launcher-NTYHJUJM.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-SMHL6MWW.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-A3YCHQNQ.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);