@outerlayer/cli 0.33.0-next.20261023030517 → 0.33.0-next.20261023122246

package/dist/{chunk-GFTWZSOW.js → chunk-IUPY54BZ.js}

@@ -1,29 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-UHFU3CBN.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-EXZACZ2P.js';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-YXHKCHWG.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-5THSC6BD.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-L26V6ILJ.js';
-import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-Z4GLZTDF.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-XCRET2GZ.js';
 import { runnerImageVersion } from './chunk-MZBQTVFG.js';
-import { runnerCredentialProblem, builtinKind, hostAllowed } from './chunk-ONUACB5C.js';
-import { formatBytes, allocatedBytes } from './chunk-LHKWWEQZ.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-QKEOAQ2W.js';
+import { runnerCredentialProblem, builtinKind, hostAllowed } from './chunk-VWQCYOBS.js';
+import { formatBytes, allocatedBytes } from './chunk-X4JEBMYN.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-OGMXVPCS.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
 import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-NE63JADS.js';
-import { WorkCommandError, getJson } from './chunk-5FSVA3CO.js';
-import { sanitizeTerminal } from './chunk-E4F7YE7P.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QQXNS4G2.js';
+import { WorkCommandError, getJson } from './chunk-YXMGHGHR.js';
+import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-NIY2UBT6.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-PA6CK6WQ.js';
 import { parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, claudeCredential, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, JOB_MOUNT } from './chunk-BALIE3BA.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-PNIFQX73.js';
-import { downconvertSession } from './chunk-V7Q5OKN7.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-6CXNWKWD.js';
+import { downconvertSession } from './chunk-F2D5BSXS.js';
 import { realFdStorePort } from './chunk-HACGUL52.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { spawn, spawnSync } from 'child_process';

package/dist/{chunk-T4TT76GG.js → chunk-JEVKOZBB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { loadMachineSkillFiles, resolvePackRoot } from './chunk-M24H6JQW.js';
+import { loadMachineSkillFiles, resolvePackRoot } from './chunk-44V5SD4G.js';
 import { MAINTAINED_SKILLS, maintainedLineVersion } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-XMPE5TT4.js → chunk-KUE4V2SK.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-M24H6JQW.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-44V5SD4G.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-6ZLI652Y.js';
+import { linkedAgentsPath } from './chunk-ZF24JN7R.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-DHUHQPRQ.js → chunk-L6MDOEHN.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-PILHDNHX.js';
+import { runEmit } from './chunk-V673DFOL.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { installStarterPack } from './chunk-XMPE5TT4.js';
-import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-PJI5D2XT.js';
+import { installStarterPack } from './chunk-KUE4V2SK.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-LYGI3T66.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-2WZ66FXA.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-M24H6JQW.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-AKZRGFGT.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-44V5SD4G.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-6ZLI652Y.js';
+import { linkedAgentsPath } from './chunk-ZF24JN7R.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { generatedHeaderSource } from './chunk-PNIFQX73.js';
+import { generatedHeaderSource } from './chunk-6CXNWKWD.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-PJI5D2XT.js → chunk-LYGI3T66.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-M24H6JQW.js';
-import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-PNIFQX73.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-44V5SD4G.js';
+import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-6CXNWKWD.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';
 

package/dist/{chunk-E4F7YE7P.js → chunk-MPC2UAW2.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-V7Q5OKN7.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-F2D5BSXS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-QQXNS4G2.js → chunk-NIY2UBT6.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-V7Q5OKN7.js';
+import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-F2D5BSXS.js';
 import { createHash } from 'crypto';
 import { readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, renameSync, unlinkSync, writeFileSync, stat as stat$1, unwatchFile, watchFile, watch as watch$1 } from 'fs';
 import { type, homedir } from 'os';

package/dist/{chunk-QKEOAQ2W.js → chunk-OGMXVPCS.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-3Z3MPR55.js';
 import { BUILDKIT_IMAGE } from './chunk-NE63JADS.js';
-import { compareVersions } from './chunk-QQXNS4G2.js';
+import { compareVersions } from './chunk-NIY2UBT6.js';
 import { ensureHostKey } from './chunk-SOI6K5DY.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PA6CK6WQ.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BALIE3BA.js';

package/dist/{chunk-A5FFANL7.js → chunk-QKNFU5GA.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-T4S2DVOA.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-D3EDZPJR.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-CCOU4NXE.js';
-import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-E4F7YE7P.js';
-import { resolveRepoIdentity } from './chunk-QQXNS4G2.js';
+import { autoConnect } from './chunk-HLZMAJJD.js';
+import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-MPC2UAW2.js';
+import { resolveRepoIdentity } from './chunk-NIY2UBT6.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-V7Q5OKN7.js';
+import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-F2D5BSXS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { createHash, randomUUID } from 'crypto';
 import { statSync, readFileSync, mkdirSync, existsSync, writeFileSync, renameSync, unlinkSync } from 'fs';

package/dist/{chunk-AXIK6F52.js → chunk-RAMTJ2XP.js}

@@ -4,30 +4,30 @@ import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HVRQQOMH.js';
 import { writeDockerClientConfig } from './chunk-6LBSAW6I.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-4NKHOCTF.js';
-import { installScrubContext } from './chunk-T4S2DVOA.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-GFTWZSOW.js';
+import { senderPidfile } from './chunk-7IFYI7XF.js';
+import { installScrubContext } from './chunk-D3EDZPJR.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-IUPY54BZ.js';
 import { readBranchHead, fetchCommit, diffBetween } from './chunk-YXHKCHWG.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-5THSC6BD.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-L26V6ILJ.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-Z4GLZTDF.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ONUACB5C.js';
-import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-LHKWWEQZ.js';
-import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-QKEOAQ2W.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-XCRET2GZ.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-VWQCYOBS.js';
+import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-X4JEBMYN.js';
+import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-OGMXVPCS.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-NE63JADS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-5FSVA3CO.js';
-import { planArtifactUpload } from './chunk-E4F7YE7P.js';
-import { scrubText } from './chunk-QQXNS4G2.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-YXMGHGHR.js';
+import { planArtifactUpload } from './chunk-MPC2UAW2.js';
+import { scrubText } from './chunk-NIY2UBT6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PA6CK6WQ.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
-import { resolvePackRoot } from './chunk-M24H6JQW.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
+import { resolvePackRoot } from './chunk-44V5SD4G.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { parsePolicy } from './chunk-PNIFQX73.js';
-import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-V7Q5OKN7.js';
+import { parsePolicy } from './chunk-6CXNWKWD.js';
+import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-F2D5BSXS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
@@ -3547,4 +3547,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, finishJob, foldSample, hookLimitsFor, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, restartSender, retryFailedReleases, runCommand, runHook, sampleGuest, serveLease, setStage, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, finishJob, foldSample, hookLimitsFor, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, restartSender, retryFailedReleases, runCommand, runHook, sampleGuest, scrubReason, serveLease, setStage, startMicroVmCommand, startSender, stopOrphanedMicroVms, stripTerminalControls, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-VJGQEASF.js → chunk-S5CNYXUA.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-E4F7YE7P.js';
-import { remoteLookupFailed } from './chunk-QQXNS4G2.js';
-import { isAgentsMdLayout } from './chunk-PJI5D2XT.js';
-import { DEFAULT_DASHBOARD } from './chunk-X37GC7DM.js';
+import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
+import { remoteLookupFailed } from './chunk-NIY2UBT6.js';
+import { isAgentsMdLayout } from './chunk-LYGI3T66.js';
+import { DEFAULT_DASHBOARD } from './chunk-7V5GUEDU.js';
 import { cliFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';

package/dist/{chunk-B6WW6AKO.js → chunk-SQQD5MST.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-GFTWZSOW.js';
-import { checkFit } from './chunk-7HZH5D7H.js';
-import { builtinKind, imageBuildOf } from './chunk-ONUACB5C.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-LHKWWEQZ.js';
+import { placeholderQueues, placeholderProblem } from './chunk-IUPY54BZ.js';
+import { checkFit } from './chunk-EHOFFTVX.js';
+import { builtinKind, imageBuildOf } from './chunk-VWQCYOBS.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-X4JEBMYN.js';
 import { builderDiskPinned } from './chunk-NE63JADS.js';
 import { claudeCredentialVariablesSet, claudeCredential } from './chunk-BALIE3BA.js';
 import { closeSync, openSync, constants } from 'fs';

package/dist/{chunk-MZYOUIY5.js → chunk-TRP3KPGK.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 28;
+var RUNNER_PROTOCOL = 29;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-JB4R5IFJ.js → chunk-UK4RGH46.js}

@@ -680,11 +680,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-EKTPKJJT.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-A2FGVVPH.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-NOKM6CBH.js');
+  const { governanceOf } = await import('./control-plane-launch-7SOH6IMA.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-PILHDNHX.js → chunk-V673DFOL.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-PJI5D2XT.js';
+import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-LYGI3T66.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-C7WGCI77.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-M24H6JQW.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-FT7MUQGO.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-44V5SD4G.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-PNIFQX73.js';
+import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-6CXNWKWD.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-ONUACB5C.js → chunk-VWQCYOBS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-LHKWWEQZ.js';
-import { parseSize } from './chunk-QKEOAQ2W.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-X4JEBMYN.js';
+import { parseSize } from './chunk-OGMXVPCS.js';
 import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BALIE3BA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';

package/dist/{chunk-LHKWWEQZ.js → chunk-X4JEBMYN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-QKEOAQ2W.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-OGMXVPCS.js';
 import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';

package/dist/{chunk-Z4GLZTDF.js → chunk-XCRET2GZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-5FSVA3CO.js';
-import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-2WZ66FXA.js';
+import { WorkCommandError, postJson } from './chunk-YXMGHGHR.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-AKZRGFGT.js';
 import { signingFetchFor } from './chunk-6RKD7YZ6.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-PA6CK6WQ.js';

package/dist/{chunk-67KCGRKA.js → chunk-Y6KIGWFO.js}

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-AXIK6F52.js';
 import { writePendingUpdate } from './chunk-GH246BGV.js';
-import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-RLAKWXDK.js';
-import { RUNNER_PROTOCOL } from './chunk-MZYOUIY5.js';
-import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-B6WW6AKO.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-ZUVERBFB.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-RAMTJ2XP.js';
+import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
+import { RUNNER_PROTOCOL } from './chunk-TRP3KPGK.js';
+import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-SQQD5MST.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-GFTWZSOW.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-IUPY54BZ.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-Z4GLZTDF.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-XCRET2GZ.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ONUACB5C.js';
-import { freeBytes, formatBytes, volumeBytes } from './chunk-LHKWWEQZ.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-QKEOAQ2W.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-5FSVA3CO.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-VWQCYOBS.js';
+import { freeBytes, formatBytes, volumeBytes } from './chunk-X4JEBMYN.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-OGMXVPCS.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-YXMGHGHR.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
@@ -1864,7 +1864,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-PQZ5RYDB.js');
+  const { postJson: postJson2 } = await import('./work-cmd-OO6K6ELP.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2813,21 +2813,26 @@ async function probeCredentials(config, fetchImpl = fetch) {
     return { ok: true };
   } catch (err) {
     const status = err instanceof WorkCommandError ? err.status : void 0;
+    const code = err instanceof WorkCommandError ? err.code : void 0;
     if (err instanceof WorkCommandError && isSignatureRefusal(err.code)) {
       return {
         ok: false,
         fatal: err.code === "runner_key_signature_invalid",
-        reason: `${config.configPath}: ${err.message}`
+        reason: `${config.configPath}: ${err.message}`,
+        status,
+        code
       };
     }
     if (status === 401 || status === 403) {
       return {
         ok: false,
         fatal: true,
-        reason: `${config.configPath}: the API key was refused (${status}). A runner key needs git.read and work.read to list and read work items, and work.claim to claim, renew and release.`
+        reason: `${config.configPath}: the API key was refused (${status}). A runner key needs git.read and work.read to list and read work items, and work.claim to claim, renew and release.`,
+        status,
+        code
       };
     }
-    return { ok: false, fatal: false, reason: describeCallFailure(err) };
+    return { ok: false, fatal: false, reason: describeCallFailure(err), status, code };
   }
 }
 async function rejoinContainerBuild(state, adopted) {
@@ -3071,6 +3076,15 @@ function hooksOf(configPath) {
   }
 }
 async function start(configPath, deps = { fetchImpl: fetch }) {
+  const startup = {};
+  try {
+    return await startRunner(configPath, deps, startup);
+  } catch (err) {
+    await startup.report?.(err);
+    throw err;
+  }
+}
+async function startRunner(configPath, deps, startup) {
   const log = deps.log ??= createRunnerLog(deps.now ?? (() => /* @__PURE__ */ new Date()));
   takeClaudeCredential(process.env, hooksOf(configPath));
   const update = deps.update;
@@ -3081,7 +3095,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-AEMFDR55.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-YCFZ3H35.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -3092,22 +3106,37 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     }
   }
   const loaded = loadRunnerConfig(configPath);
+  let check = "hooks";
+  let probeRefusal;
+  startup.report = (err) => reportFailedStart(
+    { config: loaded, cliVersion: deps.cliVersion ?? resolveVersion(), check, error: err, refusal: probeRefusal },
+    deps.fetchImpl
+  );
   const hookProblem = checkHooks(loaded);
   if (hookProblem) throw new RunnerStartError(hookProblem);
+  check = "image";
   const { config, note: fitNote } = fitForImage(deps, loaded);
+  check = "host-key";
   await ensureHostKey(configPath);
+  check = "identity";
   if (builtinKind(config.hooks.provision) === "container" || builtinKind(config.hooks.provision) === "vm") {
     await ensureRunnerIdentity(configPath, {
       docker: deps.runnerIdentity ?? (deps.container?.host === void 0 ? void 0 : { holdsObjects: async () => false }),
       log: (line) => log.error(line)
     }).catch((err) => log.error(`the runner's Docker identity could not be stored: ${describeCallFailure(err)} \xB7 using the names its folder's path gives`));
   }
+  check = "credentials";
   const probe = await probeCredentials(config, deps.fetchImpl);
-  if (!probe.ok && probe.fatal) throw new RunnerStartError(probe.reason);
+  if (!probe.ok && probe.fatal) {
+    probeRefusal = { status: probe.status, code: probe.code };
+    throw new RunnerStartError(probe.reason);
+  }
   if (!probe.ok) log.error(`the gateway did not answer at start: ${probe.reason} \xB7 starting anyway`);
+  check = "pid-file";
   mkdirSync(jobsDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
   const self = { pid: process.pid, start: startTimeOf(process.pid) ?? "" };
   claimPidFile(pidFilePath(configPath), self);
+  check = "cgroup";
   const { delegated, refusal } = setUpRunnerCgroup();
   if (refusal !== void 0) log.error(`the kernel refused a cgroup step for the runner's service: ${refusal}`);
   if (isBuiltinVm(config.hooks.provision) && !delegated) {
@@ -3122,6 +3151,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const state = { config, jobs: /* @__PURE__ */ new Map(), deps, configMtimeMs };
   log.line(`runner ${config.host} started \xB7 config ${configPath} \xB7 ${describeConfig(config)}`);
   if (fitNote !== void 0) log.line(fitNote);
+  check = "recovery";
   const leavesBuilds = await canLeaveBuilds(state);
   let sigusr2Target;
   let sigusr2Early = false;
@@ -3189,6 +3219,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       `recovered job ${recovered.queue} #${recovered.item} (claim ${shortClaim(recovered.claimId)}) as ${recovered.outcome ?? "interrupted"}: ${why}`
     );
   }
+  startup.report = void 0;
   let intakeClosed = false;
   let closed = false;
   let stopping = false;

package/dist/{chunk-5FSVA3CO.js → chunk-YXMGHGHR.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-CCOU4NXE.js';
-import { workPageUrl } from './chunk-VJGQEASF.js';
-import { sanitizeTerminal } from './chunk-E4F7YE7P.js';
-import { resolveRepoIdentity } from './chunk-QQXNS4G2.js';
+import { autoConnect } from './chunk-HLZMAJJD.js';
+import { workPageUrl } from './chunk-S5CNYXUA.js';
+import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
+import { resolveRepoIdentity } from './chunk-NIY2UBT6.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-6RKD7YZ6.js';
 import { signRunnerRequest } from './chunk-SOI6K5DY.js';
@@ -442,7 +442,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-4RYMBFPO.js');
+      const { logHookError } = await import('./hook-fast-3IYSWDL4.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-6ZLI652Y.js → chunk-ZF24JN7R.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
 import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import { CONTEXT_PIN_FILENAME } from './chunk-PNIFQX73.js';
+import { CONTEXT_PIN_FILENAME } from './chunk-6CXNWKWD.js';
 import { execFileSync } from 'child_process';
 import { lstatSync, existsSync, unlinkSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';

package/dist/chunk-ZUVERBFB.js

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { scrubReason, stripTerminalControls } from './chunk-RAMTJ2XP.js';
+import { RunnerAlreadyRunningError, readPidFile } from './chunk-F5UL23I2.js';
+import { isSameProcess } from './chunk-JBJTC3UU.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-EHOFFTVX.js';
+import { isSignatureRefusal, postJson } from './chunk-YXMGHGHR.js';
+import { signerFor } from './chunk-SOI6K5DY.js';
+import { pidFilePath } from './chunk-PA6CK6WQ.js';
+import { readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+var GIB = 1024 ** 3;
+var DEFAULT_GIB = 8;
+var MINIMUM_GIB = 4;
+var BUILD_MEMORY_VARIABLE = "OUTERLAYER_BUILD_MEMORY";
+function memoryIsSet(configPath) {
+  try {
+    const raw = JSON.parse(readFileSync(configPath, "utf8"));
+    return raw.runner.build.memory !== void 0;
+  } catch {
+    return false;
+  }
+}
+function gib(bytes) {
+  return `${Number((bytes / GIB).toFixed(1))} GiB`;
+}
+function fitImageBuildMemory(config, totalMemoryBytes) {
+  if (memoryIsSet(config.configPath)) return { config };
+  const current = config.build?.memory ?? `${DEFAULT_GIB}g`;
+  if (checkFit({ concurrency: config.concurrency, buildMemory: current, usableBytes: totalMemoryBytes }).fits) return { config };
+  const available = Math.max(0, totalMemoryBytes - RUNNER_RESERVE_BYTES);
+  const perBuild = Math.floor(available / config.concurrency / GIB);
+  if (perBuild < MINIMUM_GIB) return { config };
+  const memory = `${perBuild}g`;
+  return {
+    config: { ...config, build: { ...config.build, memory } },
+    note: `builds get ${memory} of memory to fit this machine's ${gib(totalMemoryBytes)}; set ${BUILD_MEMORY_VARIABLE} to choose another value`
+  };
+}
+
+// src/runner/startup-report.ts
+var REPORT_TIMEOUT_MS = 5e3;
+var EMPTY_MESSAGE = "the check failed with no message";
+async function reportFailedStart(failed, fetchImpl, deps = {}) {
+  try {
+    if (failed.error instanceof RunnerAlreadyRunningError || refusesReport(failed.refusal)) return;
+    if (otherRunnerLive(failed.config.configPath, deps.isSameProcess ?? isSameProcess)) return;
+    await sendStartupReport(failed, fetchImpl, deps);
+  } catch {
+  }
+}
+function refusesReport(refusal) {
+  return refusal !== void 0 && (refusal.status === 401 || isSignatureRefusal(refusal.code));
+}
+function otherRunnerLive(configPath, isSame) {
+  const entry = readPidFile(pidFilePath(configPath));
+  return entry !== null && entry.pid !== process.pid && isSame(entry.pid, entry.start);
+}
+async function sendStartupReport(failed, fetchImpl, deps) {
+  const now = deps.now ?? (() => performance.now());
+  const startedAt = now();
+  const { config } = failed;
+  const text = failed.error instanceof Error ? failed.error.message : String(failed.error);
+  const message = (deps.scrub ?? scrubReason)(stripTerminalControls(text), config) ?? EMPTY_MESSAGE;
+  const signer = await signerFor(config.configPath).catch(() => void 0);
+  const left = REPORT_TIMEOUT_MS - (now() - startedAt);
+  if (left <= 0) return;
+  await postJson(
+    config.url,
+    "/v1/hosts/startup-report",
+    config.apiKey,
+    config.appId,
+    { host: config.host, cliVersion: failed.cliVersion, check: failed.check, message },
+    fetchImpl,
+    left,
+    signer
+  );
+}
+
+export { BUILD_MEMORY_VARIABLE, fitImageBuildMemory, reportFailedStart };