@outerlayer/cli 0.33.0-next.20261023002325 → 0.33.0-next.20261023030517

package/README.md

@@ -91,7 +91,10 @@ content:
   work item's general thread or a criterion thread — the detected session id
   rides along the same way it does for `emit`, only ever narrowing what the
   comment may do; `outerlayer work threads` reads them back. `outerlayer work logs`
-  reads the runner's log for a host attempt. `outerlayer work stop` sends
+  reads the runner's log for a host attempt. `outerlayer work demo` reads an
+  item's newest demo record with `GET /v1/work-items/<n>/demo`.
+  `outerlayer work proofs` reads the item with `GET /v1/work-items/<n>` and
+  compares each proof with the head commit. `outerlayer work stop` sends
   `POST /v1/work-items/<n>/claim/stop` with the optional note, and the
   gateway records the request against the item's live host build. A runner
   key needs `git.read` and `work.read` to
@@ -375,7 +378,8 @@ content:
   or to the git checkout.
 - **`outerlayer emit demo <manifest>`** first reads the item's recorded
   criteria (`GET /v1/work-items/{number}`) to check the chapters' criterion
-  ids. It cuts a recorded video once, from the first chapter's start to the
+  ids. With `--replaces <record id>`, it also reads the item's newest demo record
+  (`GET /v1/work-items/{number}/demo`) before it uploads anything. It cuts a recorded video once, from the first chapter's start to the
   last chapter's end, and emits it as one video artifact. It then emits a video
   artifact for each chapter with the same bytes and a time range in that video,
   followed by the manifest as the demo record. A recording over 8 MiB falls
@@ -482,10 +486,12 @@ before it gives up.
 | `outerlayer context emit [--check]` | Compile `.outerlayer/` into each configured target tool's native files (targets come from `.outerlayer/config.json`). `--check` computes outputs and diffs against disk without writing (CI mode). Bare `outerlayer emit` with no name still compiles, with a deprecation warning. |
 | `outerlayer hooks wrap` / `outerlayer hooks unwrap` | Auto-wrap (or undo wrapping) `PreToolUse`/`PostToolUse` hooks for execution evidence — one spawn per firing. |
 | `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. A JUnit XML file bound with `--for` proves a criterion that declares `test` proof; `--test <name[=path:line]>` binds only the named tests. |
-| `outerlayer emit demo <manifest> [--compare <manifest>] [--no-narration] [--item <n>] [--pr <n>]` | Turn a recorded video and its manifest (written by `@outerlayer/playwright`) into a narrated demo: one WebM clip for each chapter, emitted as a video artifact. A chapter whose checks all passed is bound to its criterion. The manifest is emitted as the demo record. With `--compare`, a second run's stills are compared with the first run's, and each chapter reads `yes`, `no` or `not checked`. Needs `ffmpeg` and `ffprobe`, and `espeak-ng` unless `--no-narration`. Exit 1 means a chapter had a failed check. |
+| `outerlayer emit demo <manifest> [--compare <manifest>] [--no-narration] [--item <n>] [--pr <n>] [--replaces <record id>]` | Turn a recorded video and its manifest (written by `@outerlayer/playwright`) into a narrated demo: one WebM clip for each chapter, emitted as a video artifact. A chapter whose checks all passed is bound to its criterion. The manifest is emitted as the demo record, with the test file a version 3 manifest names. With `--replaces <record id>`, the new demo retires the item's old demo. With `--compare`, a second run's stills are compared with the first run's, and each chapter reads `yes`, `no` or `not checked`. Needs `ffmpeg` and `ffprobe`, and `espeak-ng` unless `--no-narration`. Exit 1 means a chapter had a failed check. |
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |
 | `outerlayer work comment --item <n> [--criterion <id>] --body <text> [--artifact <id>] [--pass\|--fail\|--attach\|--ready]` | Post one comment on a work item's general thread, or on one acceptance criterion's own thread with `--criterion`. `--pass`/`--fail` need a person's own credential and apply to the whole item, so they work on the general thread only and the gateway refuses them with `--criterion`; `--attach` makes the named artifact that criterion's current proof; `--ready` hands a thread back to a person. The detected session id rides along automatically, only ever narrowing what the comment may do. |
 | `outerlayer work stop --item <n> [--note <text>]` | Ask the host that holds the item's build to end it. The host reads the request at its next heartbeat and ends the build with outcome `stopped`, so the build may run a little longer. The item is not built again until a new build request. Needs `work.update`. Exits 1 when no host build is running for the item. |
+| `outerlayer work proofs [--item <n>] [--json]` | Lists each criterion that declares a proof other than `test` as current, out of date or missing at the checkout's HEAD, or at the head of a linked pull request that is open or merged. Exits 0 when every proof is current, 1 when any is not, and 2 when it cannot tell. |
+| `outerlayer work demo --item <n> [--json]` | Print the item's newest demo record: its artifact id, the commit it was recorded at and the test that recorded it. `--json` prints `{ "demo": null }` for an item with no demo. |
 | `outerlayer work logs --item <n> [--attempt <claim id>]` | Print the runner's log for a host attempt on a work item: the newest attempt a runner made, or the one `--attempt` names (an `id` from `claims` in `work status --json`). The log is what the runner did around the agent, with secrets removed on the host. Exits 1 for an attempt that is still running or that an older runner released without a log. |
 | `outerlayer work threads --item <n>` | Read a work item's threads back — the general thread first, then one per criterion with proof or a comment, each with its `waitingOn`. |
 | `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] [--cause <text>] [--detail <text>] [--suggestion <text>] [--command <text>] [--error <text>] [--test <name>] [--symbol <name>] [--started-at <event> --ended-at <event>] [--problem <id> … --link-reason <text> \| --new] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. `--cause`, `--detail`, `--suggestion`, `--command`, `--error` (the first error line), `--test` and `--symbol` carry what a fix needs. Every finding joins a factory-level problem: when a key of the finding matches a known problem it joins that problem; otherwise nothing is stored, the closest problems are printed, and the command exits with code 3. Run it again with `--problem <id> --link-reason <text>` (repeat `--problem` for each problem the finding reports) or with `--new`. Without `--started-at`, it prints the session's recent events with ids and times; name the event where you hit the problem and the one where you got past it with `--started-at` and `--ended-at`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding and keeps its problems. |

package/dist/{agent-setup-55ZDEXCS.js → agent-setup-APFM4MZ4.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-SVDOA4W2.js';
-import './chunk-JHTJPQSL.js';
+export { keepHandWritten, runAgentSetup } from './chunk-DHUHQPRQ.js';
+import './chunk-PILHDNHX.js';
 import './chunk-KT4CN6OU.js';
-import './chunk-DY7Y7UT4.js';
-import './chunk-HJYBWJAS.js';
+import './chunk-XMPE5TT4.js';
+import './chunk-PJI5D2XT.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EUVE2EAE.js';
-import './chunk-UIUGTW5C.js';
+import './chunk-2WZ66FXA.js';
+import './chunk-C7WGCI77.js';
 import './chunk-6RKD7YZ6.js';
 import './chunk-PJDQPF5N.js';
 import './chunk-SOI6K5DY.js';
@@ -15,16 +15,16 @@ import './chunk-PA6CK6WQ.js';
 import './chunk-BALIE3BA.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-G63KT5I5.js';
+import './chunk-M24H6JQW.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
 import './chunk-CRB3POP4.js';
-import './chunk-AVTI3FL5.js';
+import './chunk-6ZLI652Y.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-LJG6EMLJ.js';
-import './chunk-E6CO3MJE.js';
+import './chunk-PNIFQX73.js';
+import './chunk-V7Q5OKN7.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';

package/dist/{artifact-link-cmd-6FF2Y6QI.js → artifact-link-cmd-IHHMU4EA.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-EWVYQLD3.js';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-E4F7YE7P.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import './chunk-E6CO3MJE.js';
+import './chunk-V7Q5OKN7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{build-G4GUF6LT.js → build-SEAQVLD5.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-JPG43G6Y.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-YXHKCHWG.js';
 import './chunk-F5UL23I2.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-3Z3MPR55.js';
-import './chunk-TGHBOXKJ.js';
+import './chunk-NE63JADS.js';
 import './chunk-PA6CK6WQ.js';
 import './chunk-BALIE3BA.js';
 import './chunk-HACGUL52.js';

package/dist/build-disk-55M4ZMDX.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-LHKWWEQZ.js';
+import './chunk-QKEOAQ2W.js';
+import './chunk-3Z3MPR55.js';
+import './chunk-NE63JADS.js';
+import './chunk-QQXNS4G2.js';
+import './chunk-SOI6K5DY.js';
+import './chunk-PA6CK6WQ.js';
+import './chunk-BALIE3BA.js';
+import './chunk-V7Q5OKN7.js';
+import './chunk-HACGUL52.js';
+import './chunk-MESOOLF4.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-23T00:24:49.363Z+beeb073","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-23T03:06:35.440Z+4c51ec6","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-3CUKTVSY.js → builder-DQZCPB7J.js}

@@ -1,14 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-GFVDC5S3.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-QKEOAQ2W.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-TGHBOXKJ.js';
-import './chunk-YJLHUKYS.js';
-import './chunk-5DNCFOXA.js';
+import './chunk-NE63JADS.js';
+import './chunk-QQXNS4G2.js';
 import './chunk-SOI6K5DY.js';
 import './chunk-PA6CK6WQ.js';
 import './chunk-BALIE3BA.js';
-import './chunk-E6CO3MJE.js';
+import './chunk-V7Q5OKN7.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-64FD5G3X.js → check-AEMFDR55.js}

@@ -1,69 +1,67 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-CANYZTD5.js';
-import './chunk-DGI66PGY.js';
+import { probeCredentials } from './chunk-67KCGRKA.js';
+import './chunk-AXIK6F52.js';
+import './chunk-GH246BGV.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-57L2YAJA.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-OOCAF3ID.js';
+import './chunk-RLAKWXDK.js';
 import './chunk-MZYOUIY5.js';
-import './chunk-GH246BGV.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-Q2CMEQV7.js';
-import './chunk-2N67C6IV.js';
-import './chunk-AU346ENF.js';
+import './chunk-4NKHOCTF.js';
+import './chunk-T4S2DVOA.js';
+import './chunk-HUBRTT2C.js';
 import './chunk-ESVW4MJY.js';
-import { managedProblems, managedFactsOf } from './chunk-QFQC5K4J.js';
+import { managedProblems, managedFactsOf } from './chunk-B6WW6AKO.js';
 import './chunk-NBZ7XBT6.js';
 import './chunk-TBT347UY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-JRZCRIEO.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-GFTWZSOW.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-YERR22SY.js';
-import './chunk-JPG43G6Y.js';
+import './chunk-UHFU3CBN.js';
+import './chunk-YXHKCHWG.js';
 import './chunk-F5UL23I2.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-T5REPMNL.js';
+import './chunk-Z4GLZTDF.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
-import { DEFAULT_UNIT_NAME } from './chunk-LYE3KB6L.js';
-import './chunk-XWFSAOC7.js';
-import './chunk-YYYRBYWG.js';
-import './chunk-GFVDC5S3.js';
+import { DEFAULT_UNIT_NAME } from './chunk-7HZH5D7H.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-ONUACB5C.js';
+import './chunk-LHKWWEQZ.js';
+import './chunk-QKEOAQ2W.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-TGHBOXKJ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-3DCB3GOV.js';
-import './chunk-YJLHUKYS.js';
-import './chunk-VT4TTJPG.js';
+import './chunk-NE63JADS.js';
+import './chunk-5FSVA3CO.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-B2JURP6A.js';
-import './chunk-2WMZPJVE.js';
-import './chunk-EWVYQLD3.js';
-import './chunk-5DNCFOXA.js';
-import './chunk-HJYBWJAS.js';
-import './chunk-NSPRS7WK.js';
+import './chunk-CCOU4NXE.js';
+import './chunk-VJGQEASF.js';
+import './chunk-E4F7YE7P.js';
+import './chunk-QQXNS4G2.js';
+import './chunk-PJI5D2XT.js';
+import './chunk-X37GC7DM.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EUVE2EAE.js';
-import './chunk-UIUGTW5C.js';
+import './chunk-2WZ66FXA.js';
+import './chunk-C7WGCI77.js';
 import './chunk-6RKD7YZ6.js';
 import './chunk-PJDQPF5N.js';
 import './chunk-SOI6K5DY.js';
 import './chunk-PA6CK6WQ.js';
 import { claudeEnvPath } from './chunk-BALIE3BA.js';
-import './chunk-QPWFVE3X.js';
+import './chunk-JB4R5IFJ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-G63KT5I5.js';
+import './chunk-M24H6JQW.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -73,8 +71,8 @@ import './chunk-CRB3POP4.js';
 import './chunk-URIZRCRY.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-LJG6EMLJ.js';
-import './chunk-E6CO3MJE.js';
+import './chunk-PNIFQX73.js';
+import './chunk-V7Q5OKN7.js';
 import './chunk-VNVZDWO3.js';
 import { parseRunnerEnv } from './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';

package/dist/{chunk-EUVE2EAE.js → chunk-2WZ66FXA.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { removeRetiredSkills } from './chunk-UIUGTW5C.js';
+import { removeRetiredSkills } from './chunk-C7WGCI77.js';
 import { defaultFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { withTokenHeader } from './chunk-BALIE3BA.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-G63KT5I5.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-M24H6JQW.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
-import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-LJG6EMLJ.js';
+import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-PNIFQX73.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';

package/dist/{chunk-BJQ25STI.js → chunk-35DSTT37.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-DY7Y7UT4.js';
-import { skillsBaseFor } from './chunk-HJYBWJAS.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-XMPE5TT4.js';
+import { skillsBaseFor } from './chunk-PJI5D2XT.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-G63KT5I5.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-M24H6JQW.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-AVTI3FL5.js';
+import { hasSymlinkComponent } from './chunk-6ZLI652Y.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';

package/dist/{chunk-Q2CMEQV7.js → chunk-4NKHOCTF.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-2N67C6IV.js';
-import { CaptureDaemon } from './chunk-5DNCFOXA.js';
-import { spoolDir } from './chunk-QPWFVE3X.js';
+import { LiveUploader } from './chunk-T4S2DVOA.js';
+import { CaptureDaemon } from './chunk-QQXNS4G2.js';
+import { spoolDir } from './chunk-JB4R5IFJ.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-VT4TTJPG.js → chunk-5FSVA3CO.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-B2JURP6A.js';
-import { workPageUrl } from './chunk-2WMZPJVE.js';
-import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
-import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
+import { autoConnect } from './chunk-CCOU4NXE.js';
+import { workPageUrl } from './chunk-VJGQEASF.js';
+import { sanitizeTerminal } from './chunk-E4F7YE7P.js';
+import { resolveRepoIdentity } from './chunk-QQXNS4G2.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-6RKD7YZ6.js';
 import { signRunnerRequest } from './chunk-SOI6K5DY.js';
@@ -442,7 +442,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-6WDMNZG5.js');
+      const { logHookError } = await import('./hook-fast-4RYMBFPO.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-CANYZTD5.js → chunk-67KCGRKA.js}

@@ -1,27 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-DGI66PGY.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-AXIK6F52.js';
+import { writePendingUpdate } from './chunk-GH246BGV.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-OOCAF3ID.js';
+import { fitImageBuildMemory } from './chunk-RLAKWXDK.js';
 import { RUNNER_PROTOCOL } from './chunk-MZYOUIY5.js';
-import { writePendingUpdate } from './chunk-GH246BGV.js';
-import { realBlockedProbes, checkBlocked } from './chunk-QFQC5K4J.js';
+import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-B6WW6AKO.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JRZCRIEO.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-GFTWZSOW.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-T5REPMNL.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-Z4GLZTDF.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-GFVDC5S3.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3DCB3GOV.js';
-import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-VT4TTJPG.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ONUACB5C.js';
+import { freeBytes, formatBytes, volumeBytes } from './chunk-LHKWWEQZ.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-QKEOAQ2W.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-5FSVA3CO.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
@@ -645,6 +644,16 @@ function createHousekeepingDocker(deps) {
       const result = await run("docker", ["rmi", id]);
       if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
     },
+    async removeBuilder() {
+      const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
+      if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
+      const df = await run("docker", ["system", "df", "-v"]);
+      const freedBytes = df.status === 0 ? volumeBytes(df.stdout, /* @__PURE__ */ new Set([`buildx_buildkit_${deps.builder}0_state`])) : 0;
+      const result = await run("docker", ["buildx", "rm", deps.builder]);
+      if (result.status !== 0 && NO_BUILDER.test(result.stderr)) return void 0;
+      if (result.status !== 0) throw failure(result, "docker buildx rm");
+      return { freedBytes };
+    },
     async builderPrune(keepBytes) {
       const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
       if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
@@ -869,7 +878,17 @@ async function runHousekeeping(options) {
     } catch (err) {
       log.error(`housekeeping: dangling images could not be listed: ${describeCallFailure(err)}`);
     }
-    if (options.buildCacheMax !== "off") {
+    if (options.removeHostBuilder === true) {
+      try {
+        const removed = await docker.removeBuilder();
+        if (removed !== void 0) {
+          freed += removed.freedBytes;
+          log.line(`housekeeping: removed the host image builder and its state volume, freed ${formatBytes(removed.freedBytes)}; this runner builds images in the builder microVM`);
+        }
+      } catch (err) {
+        log.error(`housekeeping: the host image builder could not be removed: ${describeCallFailure(err)}`);
+      }
+    } else if (options.buildCacheMax !== "off") {
       try {
         const pruned = await docker.builderPrune(options.buildCacheMax);
         if (pruned === void 0) {
@@ -1225,6 +1244,10 @@ function fitForImage(deps, config) {
 function describeConfig(config) {
   return `queues ${config.queues.join(",")} \xB7 concurrency ${config.concurrency} \xB7 poll ${config.pollSeconds}s`;
 }
+function slotsTotalOf(state) {
+  const slots = state.blocked === void 0 ? state.buildSlots ?? state.config.concurrency : state.config.concurrency;
+  return Math.max(slots, state.jobs.size, 1);
+}
 async function sendTickHeartbeat(state, workRequest) {
   if (state.heartbeating) {
     if (workRequest !== void 0) state.queuedWorkRequest = workRequest;
@@ -1247,7 +1270,7 @@ async function sendTickHeartbeat(state, workRequest) {
           cliVersion: state.deps.cliVersion ?? resolveVersion(),
           pollSeconds: state.pollTimerSeconds ?? state.config.pollSeconds,
           slotsUsed: state.jobs.size,
-          slotsTotal: state.config.concurrency,
+          slotsTotal: slotsTotalOf(state),
           workRequest: next,
           lastUpdate: readLastUpdate(state.config.configPath),
           lowDisk: state.lowDisk,
@@ -1660,6 +1683,7 @@ function imageBuilderState(state) {
   const kind = builtinKind(state.config.hooks.provision);
   if (kind !== "container" && kind !== "vm") return "usable";
   if (state.deps.container?.buildImage !== void 0 || state.deps.container?.imageHost !== void 0) return "usable";
+  if (!keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned)) return "usable";
   const memory = state.config.build?.memory ?? "8g";
   let probe = state.imageBuilder;
   if (probe === void 0 || probe.memory !== memory) probe = state.imageBuilder = { memory, at: 0, running: false };
@@ -1697,7 +1721,8 @@ function holdWhenBlocked(state, jailer) {
     inImage: state.deps.image !== void 0,
     ...state.deps.blocked
   };
-  const blocked = checkBlocked(state.config, probes);
+  const { blocked, slots } = checkBlockedWithSlots(state.config, probes);
+  state.buildSlots = slots;
   const log = logOf(state);
   if (blocked !== void 0) {
     if (state.blocked?.reason !== blocked.reason) log.line(`claiming nothing: ${blocked.reason}`);
@@ -1753,6 +1778,7 @@ async function housekeepingPass(state) {
       configPath: state.config.configPath,
       keepDays: config.jobsKeepDays,
       buildCacheMax: config.buildCacheMax,
+      removeHostBuilder: !keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned),
       docker: state.deps.housekeeping.docker,
       now: state.deps.now ?? (() => /* @__PURE__ */ new Date()),
       log: logOf(state)
@@ -1784,7 +1810,8 @@ async function runTick(state) {
   const repoFilter = new RepoFilter(state.config.repos);
   let filtered = 0;
   let attempts = 0;
-  while (state.jobs.size < state.config.concurrency && attempts < state.config.concurrency) {
+  const slots = Math.min(state.buildSlots ?? state.config.concurrency, state.config.concurrency);
+  while (state.jobs.size < slots && attempts < state.config.concurrency) {
     attempts++;
     let claimed = false;
     for (const queue of QUEUE_ORDER) {
@@ -1837,7 +1864,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-W7WEHMQJ.js');
+  const { postJson: postJson2 } = await import('./work-cmd-PQZ5RYDB.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -3054,7 +3081,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-64FD5G3X.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-AEMFDR55.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-HXA5GIHK.js → chunk-6ANIBEQ6.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
-import { isAgentsMdLayout } from './chunk-HJYBWJAS.js';
+import { sanitizeTerminal } from './chunk-E4F7YE7P.js';
+import { isAgentsMdLayout } from './chunk-PJI5D2XT.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-6RKD7YZ6.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { machineSkillsState, staleClaudeSkills } from './chunk-GFYEMCPP.js';
-import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-G63KT5I5.js';
+import { machineSkillsState, staleClaudeSkills } from './chunk-T4TT76GG.js';
+import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-M24H6JQW.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-AVTI3FL5.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-LJG6EMLJ.js';
+import { hasSymlinkComponent } from './chunk-6ZLI652Y.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-PNIFQX73.js';
 import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, realpathSync, readdirSync } from 'fs';
 import { join, dirname, posix, basename, isAbsolute, relative } from 'path';

package/dist/{chunk-AVTI3FL5.js → chunk-6ZLI652Y.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
 import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import { CONTEXT_PIN_FILENAME } from './chunk-LJG6EMLJ.js';
+import { CONTEXT_PIN_FILENAME } from './chunk-PNIFQX73.js';
 import { execFileSync } from 'child_process';
 import { lstatSync, existsSync, unlinkSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';

package/dist/{chunk-LYE3KB6L.js → chunk-7HZH5D7H.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-3DCB3GOV.js';
-import { parseSize } from './chunk-YJLHUKYS.js';
+import { builtinKind } from './chunk-ONUACB5C.js';
+import { parseSize } from './chunk-QKEOAQ2W.js';
 import { runnerDir } from './chunk-PA6CK6WQ.js';
 import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-BALIE3BA.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-HACGUL52.js';

package/dist/{chunk-6Z4SZHV2.js → chunk-A5FFANL7.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-2N67C6IV.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-T4S2DVOA.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-B2JURP6A.js';
-import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-EWVYQLD3.js';
-import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
+import { autoConnect } from './chunk-CCOU4NXE.js';
+import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-E4F7YE7P.js';
+import { resolveRepoIdentity } from './chunk-QQXNS4G2.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-E6CO3MJE.js';
+import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-V7Q5OKN7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { createHash, randomUUID } from 'crypto';
 import { statSync, readFileSync, mkdirSync, existsSync, writeFileSync, renameSync, unlinkSync } from 'fs';