@outerlayer/cli 0.33.0-next.20261023002325 → 0.33.0-next.20261023003700

package/dist/{chunk-CANYZTD5.js → chunk-SDU2IE22.js}

@@ -1,26 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-DGI66PGY.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-PWH3BEZF.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-OOCAF3ID.js';
+import { fitImageBuildMemory } from './chunk-XHHTMFCX.js';
 import { RUNNER_PROTOCOL } from './chunk-MZYOUIY5.js';
 import { writePendingUpdate } from './chunk-GH246BGV.js';
-import { realBlockedProbes, checkBlocked } from './chunk-QFQC5K4J.js';
+import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-7HHNGZS5.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JRZCRIEO.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-2EGCI2VW.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-T5REPMNL.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-GFVDC5S3.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3DCB3GOV.js';
-import { exceedsDisk } from './chunk-YJLHUKYS.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-RQJMN5TJ.js';
+import { freeBytes, formatBytes, volumeBytes } from './chunk-W2AEL4BJ.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-FR7HWWCF.js';
 import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-VT4TTJPG.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
@@ -645,6 +644,16 @@ function createHousekeepingDocker(deps) {
       const result = await run("docker", ["rmi", id]);
       if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
     },
+    async removeBuilder() {
+      const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
+      if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
+      const df = await run("docker", ["system", "df", "-v"]);
+      const freedBytes = df.status === 0 ? volumeBytes(df.stdout, /* @__PURE__ */ new Set([`buildx_buildkit_${deps.builder}0_state`])) : 0;
+      const result = await run("docker", ["buildx", "rm", deps.builder]);
+      if (result.status !== 0 && NO_BUILDER.test(result.stderr)) return void 0;
+      if (result.status !== 0) throw failure(result, "docker buildx rm");
+      return { freedBytes };
+    },
     async builderPrune(keepBytes) {
       const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
       if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
@@ -869,7 +878,17 @@ async function runHousekeeping(options) {
     } catch (err) {
       log.error(`housekeeping: dangling images could not be listed: ${describeCallFailure(err)}`);
     }
-    if (options.buildCacheMax !== "off") {
+    if (options.removeHostBuilder === true) {
+      try {
+        const removed = await docker.removeBuilder();
+        if (removed !== void 0) {
+          freed += removed.freedBytes;
+          log.line(`housekeeping: removed the host image builder and its state volume, freed ${formatBytes(removed.freedBytes)}; this runner builds images in the builder microVM`);
+        }
+      } catch (err) {
+        log.error(`housekeeping: the host image builder could not be removed: ${describeCallFailure(err)}`);
+      }
+    } else if (options.buildCacheMax !== "off") {
       try {
         const pruned = await docker.builderPrune(options.buildCacheMax);
         if (pruned === void 0) {
@@ -1225,6 +1244,10 @@ function fitForImage(deps, config) {
 function describeConfig(config) {
   return `queues ${config.queues.join(",")} \xB7 concurrency ${config.concurrency} \xB7 poll ${config.pollSeconds}s`;
 }
+function slotsTotalOf(state) {
+  const slots = state.blocked === void 0 ? state.buildSlots ?? state.config.concurrency : state.config.concurrency;
+  return Math.max(slots, state.jobs.size, 1);
+}
 async function sendTickHeartbeat(state, workRequest) {
   if (state.heartbeating) {
     if (workRequest !== void 0) state.queuedWorkRequest = workRequest;
@@ -1247,7 +1270,7 @@ async function sendTickHeartbeat(state, workRequest) {
           cliVersion: state.deps.cliVersion ?? resolveVersion(),
           pollSeconds: state.pollTimerSeconds ?? state.config.pollSeconds,
           slotsUsed: state.jobs.size,
-          slotsTotal: state.config.concurrency,
+          slotsTotal: slotsTotalOf(state),
           workRequest: next,
           lastUpdate: readLastUpdate(state.config.configPath),
           lowDisk: state.lowDisk,
@@ -1660,6 +1683,7 @@ function imageBuilderState(state) {
   const kind = builtinKind(state.config.hooks.provision);
   if (kind !== "container" && kind !== "vm") return "usable";
   if (state.deps.container?.buildImage !== void 0 || state.deps.container?.imageHost !== void 0) return "usable";
+  if (!keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned)) return "usable";
   const memory = state.config.build?.memory ?? "8g";
   let probe = state.imageBuilder;
   if (probe === void 0 || probe.memory !== memory) probe = state.imageBuilder = { memory, at: 0, running: false };
@@ -1697,7 +1721,8 @@ function holdWhenBlocked(state, jailer) {
     inImage: state.deps.image !== void 0,
     ...state.deps.blocked
   };
-  const blocked = checkBlocked(state.config, probes);
+  const { blocked, slots } = checkBlockedWithSlots(state.config, probes);
+  state.buildSlots = slots;
   const log = logOf(state);
   if (blocked !== void 0) {
     if (state.blocked?.reason !== blocked.reason) log.line(`claiming nothing: ${blocked.reason}`);
@@ -1753,6 +1778,7 @@ async function housekeepingPass(state) {
       configPath: state.config.configPath,
       keepDays: config.jobsKeepDays,
       buildCacheMax: config.buildCacheMax,
+      removeHostBuilder: !keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned),
       docker: state.deps.housekeeping.docker,
       now: state.deps.now ?? (() => /* @__PURE__ */ new Date()),
       log: logOf(state)
@@ -1784,7 +1810,8 @@ async function runTick(state) {
   const repoFilter = new RepoFilter(state.config.repos);
   let filtered = 0;
   let attempts = 0;
-  while (state.jobs.size < state.config.concurrency && attempts < state.config.concurrency) {
+  const slots = Math.min(state.buildSlots ?? state.config.concurrency, state.config.concurrency);
+  while (state.jobs.size < slots && attempts < state.config.concurrency) {
     attempts++;
     let claimed = false;
     for (const queue of QUEUE_ORDER) {
@@ -3054,7 +3081,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-64FD5G3X.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-MRYFTLOO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/chunk-W2AEL4BJ.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-FR7HWWCF.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
+import { spawnSync } from 'child_process';
+import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
+import { dirname, join } from 'path';
+
+createRequire(import.meta.url);
+function freeBytes(path, statfs = statfsSync) {
+  let at = path;
+  for (; ; ) {
+    try {
+      const stats = statfs(at);
+      return Number(stats.bavail) * Number(stats.bsize);
+    } catch (err) {
+      if (err.code !== "ENOENT") return void 0;
+      const parent = dirname(at);
+      if (parent === at) return void 0;
+      at = parent;
+    }
+  }
+}
+var UNITS = ["B", "KB", "MB", "GB", "TB"];
+function formatBytes(bytes) {
+  let value = Math.max(0, bytes);
+  let unit = 0;
+  while (value >= 1024 && unit < UNITS.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return unit === 0 ? `${Math.round(value)} B` : `${value.toFixed(1)} ${UNITS[unit]}`;
+}
+
+// src/runner/build-disk.ts
+var DEFAULT_CACHE_DISK = "40g";
+function checkDiskFit(input) {
+  const limit = parseSize(input.buildDisk);
+  if (limit === void 0) return { slots: input.concurrency, fits: true, oneBuildBytes: 0, neededBytes: 0, availableBytes: 0, reservedBytes: 0, message: "" };
+  const cacheLimit = parseSize(input.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK);
+  const { freeBytes: free, heldBytes: held, rootDiskBytes: root } = input.facts;
+  const reservedBytes = (input.facts.cacheBytes ?? []).reduce((sum, bytes) => sum + Math.max(0, cacheLimit - bytes), 0);
+  const oneBuildBytes = limit + root;
+  const neededBytes = input.concurrency * oneBuildBytes;
+  const availableBytes = Math.max(0, free + held - reservedBytes);
+  const slots = Math.min(input.concurrency, Math.floor(availableBytes / oneBuildBytes));
+  const oneBuild = root > 0 ? `runner.build.disk ${input.buildDisk} plus a root disk of ${formatBytes(root)}` : `runner.build.disk ${input.buildDisk}`;
+  const caches = reservedBytes > 0 ? `, less ${formatBytes(reservedBytes)} that the image-build caches can still grow to (runner.build.cacheDisk ${input.cacheDisk ?? DEFAULT_CACHE_DISK})` : "";
+  return {
+    slots,
+    fits: slots >= input.concurrency,
+    oneBuildBytes,
+    neededBytes,
+    availableBytes,
+    reservedBytes,
+    message: `${slots} of ${input.concurrency} ${input.concurrency === 1 ? "build" : "builds"} fit: one build can hold ${formatBytes(oneBuildBytes)} (${oneBuild}), runner.concurrency ${input.concurrency} needs ${formatBytes(neededBytes)}, and ${formatBytes(availableBytes)} is counted (${formatBytes(free)} free plus ${formatBytes(held)} held by running builds${caches})`
+  };
+}
+function allocatedBytes(path) {
+  try {
+    return statSync(path).blocks * 512;
+  } catch {
+    return 0;
+  }
+}
+function listDir(path) {
+  try {
+    return readdirSync(path);
+  } catch {
+    return void 0;
+  }
+}
+function logUnreadable(path) {
+  process.stderr.write(`outerlayer: cannot list ${path}, so the disk check does not count the image-build cache disks in it
+`);
+}
+function isBuilderDir(dir) {
+  return existsSync(join(dir, "image-builder.json"));
+}
+function cacheDiskBytes(configPath, builds, buildEntries) {
+  const cache = [];
+  const images = imagesDir(configPath);
+  if (existsSync(images)) {
+    const owners = listDir(images);
+    if (owners === void 0) {
+      logUnreadable(images);
+      return void 0;
+    }
+    for (const owner of owners) {
+      const names = listDir(join(images, owner));
+      if (names === void 0) logUnreadable(join(images, owner));
+      for (const name of names ?? []) {
+        const path = builderCacheDiskPath(configPath, owner, name);
+        if (existsSync(path)) cache.push(allocatedBytes(path));
+      }
+    }
+  }
+  for (const entry of buildEntries) {
+    if (isBuilderDir(join(builds, entry))) cache.push(allocatedBytes(join(builds, entry, "build.ext4")));
+  }
+  return cache;
+}
+function microVmFacts(configPath) {
+  const builds = buildsDir(configPath);
+  const free = freeBytes(builds);
+  if (free === void 0) return void 0;
+  let held = 0;
+  let entries = [];
+  if (existsSync(builds)) {
+    const listed = listDir(builds);
+    if (listed === void 0) return void 0;
+    entries = listed;
+    for (const entry of entries) {
+      if (!isBuilderDir(join(builds, entry))) held += allocatedBytes(join(builds, entry, "build.ext4"));
+    }
+  }
+  const cacheBytes = cacheDiskBytes(configPath, builds, entries);
+  if (cacheBytes === void 0) return void 0;
+  let root = 0;
+  const roots = rootfsDir(runnerDir(configPath));
+  if (existsSync(roots)) {
+    const rootEntries = listDir(roots);
+    if (rootEntries === void 0) return void 0;
+    for (const entry of rootEntries) {
+      if (!entry.endsWith(".ext4")) continue;
+      try {
+        root = Math.max(root, statSync(join(roots, entry)).size);
+      } catch {
+      }
+    }
+  }
+  return { freeBytes: free, heldBytes: held, rootDiskBytes: root, cacheBytes };
+}
+var DOCKER_TIMEOUT_MS = 1e4;
+var DEFAULT_BUILD_DISK = "40g";
+var DOCKER_CACHE_MS = 6e4;
+var DEFAULT_VOLUMES_DIR = "/var/lib/docker/volumes";
+function runDocker(args, spawn = spawnSync) {
+  const result = spawn("docker", args, { encoding: "utf8", timeout: DOCKER_TIMEOUT_MS });
+  return result.status === 0 ? result.stdout : void 0;
+}
+var SIZE_UNITS = { b: 1, kb: 1e3, mb: 1e6, gb: 1e9, tb: 1e12 };
+function volumeBytes(dfOutput, names) {
+  let total = 0;
+  for (const line of dfOutput.split("\n")) {
+    const [name, , size] = line.trim().split(/\s+/);
+    if (name === void 0 || size === void 0 || !names.has(name)) continue;
+    const match = /^([\d.]+)([A-Za-z]+)$/.exec(size);
+    const unit = match === null ? void 0 : SIZE_UNITS[match[2].toLowerCase()];
+    if (match !== null && unit !== void 0) total += Number(match[1]) * unit;
+  }
+  return total;
+}
+function containerFacts(cache, configPath, docker, now) {
+  if (cache.reading === void 0 || cache.reading.configPath !== configPath || now - cache.reading.at > DOCKER_CACHE_MS) {
+    const root = docker(["info", "--format", "{{.DockerRootDir}}"])?.trim();
+    const listed = docker(["volume", "ls", "--quiet", "--filter", `label=${BUILD_LABEL}`, "--filter", `label=${RUNNER_LABEL}=${runnerLabelValue(configPath)}`]);
+    const names = new Set((listed ?? "").split("\n").map((n) => n.trim()).filter((n) => n !== ""));
+    const df = listed === void 0 || names.size === 0 ? void 0 : docker(["system", "df", "-v"]);
+    const held = listed === void 0 ? void 0 : names.size === 0 ? 0 : df === void 0 ? void 0 : volumeBytes(df, names);
+    cache.reading = {
+      at: now,
+      configPath,
+      held,
+      volumes: root === void 0 || root === "" ? DEFAULT_VOLUMES_DIR : join(root, "volumes")
+    };
+  }
+  if (cache.reading.held === void 0) return void 0;
+  const free = freeBytes(cache.reading.volumes);
+  return free === void 0 ? void 0 : { freeBytes: free, heldBytes: cache.reading.held, rootDiskBytes: 0 };
+}
+function realBuildDiskProbe(deps = {}) {
+  const cache = {};
+  const docker = deps.docker ?? ((args) => runDocker(args));
+  const now = deps.now ?? Date.now;
+  return (kind, configPath) => kind === "vm" ? microVmFacts(configPath) : containerFacts(cache, configPath, docker, now());
+}
+
+export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, formatBytes, freeBytes, realBuildDiskProbe, runDocker, volumeBytes };

package/dist/{chunk-OOCAF3ID.js → chunk-XHHTMFCX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-LYE3KB6L.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-HE4FBF4T.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-JPG43G6Y.js → chunk-YXHKCHWG.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-TGHBOXKJ.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-NE63JADS.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PA6CK6WQ.js';
 import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BALIE3BA.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';

package/dist/{cli-WKRURGHC.js → cli-K6XGL4EZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-LJUIG5K4.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-3RIFVLPO.js';
 import './chunk-BJQ25STI.js';
 import './chunk-HXA5GIHK.js';
 import './chunk-KT4CN6OU.js';
@@ -3927,13 +3927,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-PFW4XTG7.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-YMGW2WXJ.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-PFW4XTG7.js');
+    const { runInitCommand } = await import('./init-cmd-YMGW2WXJ.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4388,7 +4388,7 @@ check. A chapter reads yes when every still matches and no when one differs; the
 the region. One run, or a chapter with no stills, reads not checked. Comparing never changes which clips bind.
 `
   ).action(async (manifest, opts) => {
-    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-JSVI56WY.js');
+    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-6DF2QIAS.js');
     let item;
     if (opts.item !== void 0) {
       item = parseTrackerNumber(opts.item);
@@ -4917,7 +4917,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-MFND6Z4S.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-NJNOQFQE.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4937,7 +4937,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-MFND6Z4S.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-NJNOQFQE.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4969,7 +4969,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-MFND6Z4S.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-NJNOQFQE.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -5038,8 +5038,8 @@ function registerRunnerCommands(program2) {
   const runnerCmd = program2.command("runner").description("Take work from the implement and amend queues on this machine");
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-LZSFW2O3.js');
-    const { start, RunnerStartError } = await import('./loop-2SITCQ6H.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-QXMUWJAQ.js');
+    const { start, RunnerStartError } = await import('./loop-UJL2UCUM.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5057,9 +5057,9 @@ function registerRunnerCommands(program2) {
     "after",
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-LZSFW2O3.js');
-    const { containerStart } = await import('./container-start-DQKFQ3CL.js');
-    const { start, RunnerStartError } = await import('./loop-2SITCQ6H.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-QXMUWJAQ.js');
+    const { containerStart } = await import('./container-start-CVP3NTDG.js');
+    const { start, RunnerStartError } = await import('./loop-UJL2UCUM.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     try {
       const result = await containerStart({
@@ -5078,8 +5078,8 @@ function registerRunnerCommands(program2) {
     }
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-LZSFW2O3.js');
-    const { runRunnerCheck } = await import('./check-64FD5G3X.js');
+    const { defaultRunnerConfigPath } = await import('./config-QXMUWJAQ.js');
+    const { runRunnerCheck } = await import('./check-MRYFTLOO.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5100,7 +5100,7 @@ function registerRunnerCommands(program2) {
 `);
   });
   runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").option("--allow-downgrade", "install this CLI even when it is older than the version the runner runs").option("--unit-name <name>", "with --service, the unit's name, to run a second runner beside the first").action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-LZSFW2O3.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-QXMUWJAQ.js');
     const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-FV7IZ7XF.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.service !== true) {
@@ -5113,7 +5113,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-WG54AUHK.js');
+        const { installServiceCommand } = await import('./command-7FAIIQGF.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5168,8 +5168,8 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       fail(`pass --service: \`${cliInvocation()} runner uninstall --service\` removes the runner's service.`);
       return;
     }
-    const { defaultRunnerConfigPath } = await import('./config-LZSFW2O3.js');
-    const { uninstallServiceCommand } = await import('./command-WG54AUHK.js');
+    const { defaultRunnerConfigPath } = await import('./config-QXMUWJAQ.js');
+    const { uninstallServiceCommand } = await import('./command-7FAIIQGF.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5196,12 +5196,12 @@ already in claude.env is used.
   printf '%s' "$CLAUDE_CODE_OAUTH_TOKEN" | ${cliInvocation()} runner init --agent claude --factory <org>/<factory>
 `
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-LZSFW2O3.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-WNO4NAO7.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-YUKU2MWK.js');
-    const { detectMachine } = await import('./machine-YHBCNRUO.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-OKJAI77M.js');
-    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-QYE7KZFP.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-QXMUWJAQ.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-XDOKWBL2.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-FUJD66R6.js');
+    const { detectMachine } = await import('./machine-2YPAFFCH.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-ZQ5B3TJZ.js');
+    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-HOUXKWIJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
       fail(`--agent ${opts.agent}: runner init writes commands for ${Object.keys(AGENT_COMMANDS).join(", ")}. For another agent, leave --agent out and edit runner.commands.`);
@@ -5351,7 +5351,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-WG54AUHK.js');
+        const { installServiceCommand } = await import('./command-7FAIIQGF.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5395,12 +5395,12 @@ Next:
     "after",
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-LZSFW2O3.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-G4GUF6LT.js');
+    const { defaultRunnerConfigPath } = await import('./config-QXMUWJAQ.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-SEAQVLD5.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-4ERXWTRW.js');
-    const { builderSpec } = await import('./builder-3CUKTVSY.js');
-    const { loadRunnerConfig } = await import('./config-LZSFW2O3.js');
+    const { createDockerHost } = await import('./docker-ANW76BNW.js');
+    const { builderSpec } = await import('./builder-Y4P7QARW.js');
+    const { loadRunnerConfig } = await import('./config-QXMUWJAQ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
       try {
@@ -5411,7 +5411,7 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-FIHOECSH.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-KPUVTRLS.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
@@ -5478,17 +5478,17 @@ Next:
     }
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-LZSFW2O3.js');
-    const { requestStop } = await import('./loop-2SITCQ6H.js');
+    const { defaultRunnerConfigPath } = await import('./config-QXMUWJAQ.js');
+    const { requestStop } = await import('./loop-UJL2UCUM.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-ADSLWXBA.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
-    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-LZSFW2O3.js');
+    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-QXMUWJAQ.js');
     const { jobsDir, runnerDir } = await import('./paths-7HVTDE6J.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-2SITCQ6H.js');
-    const { renderStatus } = await import('./status-VBQJMFEX.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-UJL2UCUM.js');
+    const { renderStatus } = await import('./status-2KNTILGQ.js');
     const { readHousekeepingRecord } = await import('./record-PPZEXAVA.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5510,7 +5510,7 @@ Next:
     const service = await (async () => {
       if (process.platform !== "linux" || !existsSync("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-DNLXTXLA.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-GQUCHIGE.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-QPA7DQHO.js');
       const facts = inspectService(DEFAULT_UNIT_NAME, path2.dirname(configPath), realInspectProbes());
       return facts === void 0 ? void 0 : { unit: facts.unit, running: facts.mainPid !== void 0, delegated: facts.delegate };
     })();
@@ -5547,8 +5547,8 @@ Next:
     );
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-LZSFW2O3.js');
-    const { listJobFiles } = await import('./loop-2SITCQ6H.js');
+    const { defaultRunnerConfigPath } = await import('./config-QXMUWJAQ.js');
+    const { listJobFiles } = await import('./loop-UJL2UCUM.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-HI46FO6Z.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-WG54AUHK.js → command-7FAIIQGF.js}

@@ -3,10 +3,10 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-DXJTBU7A.js';
 import './chunk-Z5IW4DHH.js';
 import { currentLink, execStartCommand } from './chunk-NBZ7XBT6.js';
-import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-JRZCRIEO.js';
+import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-2EGCI2VW.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-YERR22SY.js';
-import './chunk-JPG43G6Y.js';
+import './chunk-DISTLL2Q.js';
+import './chunk-YXHKCHWG.js';
 import './chunk-F5UL23I2.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
@@ -15,13 +15,12 @@ import './chunk-L26V6ILJ.js';
 import './chunk-T5REPMNL.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
-import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-LYE3KB6L.js';
-import './chunk-YYYRBYWG.js';
-import { readJobFile } from './chunk-GFVDC5S3.js';
+import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-HE4FBF4T.js';
+import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-RQJMN5TJ.js';
+import './chunk-W2AEL4BJ.js';
+import { readJobFile } from './chunk-FR7HWWCF.js';
 import './chunk-3Z3MPR55.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-TGHBOXKJ.js';
-import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-3DCB3GOV.js';
-import './chunk-YJLHUKYS.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-NE63JADS.js';
 import { realLima } from './chunk-77MM5RYD.js';
 import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
 import './chunk-VT4TTJPG.js';

package/dist/{config-LZSFW2O3.js → config-QXMUWJAQ.js}

@@ -1,8 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf } from './chunk-3DCB3GOV.js';
-import './chunk-YJLHUKYS.js';
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf } from './chunk-RQJMN5TJ.js';
+import './chunk-W2AEL4BJ.js';
+import './chunk-FR7HWWCF.js';
+import './chunk-3Z3MPR55.js';
+import './chunk-NE63JADS.js';
+import './chunk-5DNCFOXA.js';
+import './chunk-SOI6K5DY.js';
+import './chunk-PA6CK6WQ.js';
 import './chunk-BALIE3BA.js';
+import './chunk-E6CO3MJE.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';