@outerlayer/cli 0.33.0-next.20261023120437 → 0.33.0-next.20261023122246

package/README.md

@@ -168,9 +168,19 @@ content:
   fetches the package's dependencies, and both npm runs use this user's npm
   configuration, including any registry token in `~/.npmrc`. Set
   `runner.autoUpdate` to `false` to stop them.
+  When `outerlayer runner start` fails a start-up check before its first
+  heartbeat, it sends one report with `POST /v1/hosts/startup-report`. The
+  report holds the host name, the CLI version, the name of the failed check
+  and the error text, with terminal control codes removed, scrubbed of the
+  keys the runner holds and cut to 200 characters. It sends none when another
+  runner already runs on the same config, or when the gateway refused the
+  runner key or its host key's signature. The call waits at most 5 seconds,
+  and a gateway with no such route ignores it.
   `outerlayer runner container-start`, the runner image's entrypoint, writes
-  the config from its environment variables with no network call. It then
-  runs `outerlayer runner start`, which makes the calls above. In the image
+  the config from its environment variables. When the container reaches no
+  Docker it can use, it sends that report, with the check `docker`, and
+  stops. Otherwise it runs `outerlayer runner start`, which makes the calls
+  above. In the image
   the runner never calls the npm registry. It logs the image tag to pull.
   `runner check` makes a list call and a host-key lookup to confirm the key
   works and sends nothing else; `runner status` and `runner logs` make no network call at all.

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-23T12:05:53.102Z+82d4e55","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-23T12:24:08.386Z+0c94177","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-4QNLMDP7.js → check-YCFZ3H35.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-YSM4EEUK.js';
-import './chunk-FZUFUVLK.js';
+import { probeCredentials } from './chunk-Y6KIGWFO.js';
 import './chunk-GH246BGV.js';
-import './chunk-ZVB57WI6.js';
 import './chunk-57L2YAJA.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-YGZLRX5U.js';
-import './chunk-MZYOUIY5.js';
+import './chunk-ZUVERBFB.js';
+import './chunk-RAMTJ2XP.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-TRP3KPGK.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';
 import './chunk-I3LTIAOR.js';

package/dist/{chunk-FZUFUVLK.js → chunk-RAMTJ2XP.js}

@@ -22,7 +22,7 @@ import { scrubText } from './chunk-NIY2UBT6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PA6CK6WQ.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
 import { resolvePackRoot } from './chunk-44V5SD4G.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -3547,4 +3547,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, finishJob, foldSample, hookLimitsFor, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, restartSender, retryFailedReleases, runCommand, runHook, sampleGuest, serveLease, setStage, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, finishJob, foldSample, hookLimitsFor, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, restartSender, retryFailedReleases, runCommand, runHook, sampleGuest, scrubReason, serveLease, setStage, startMicroVmCommand, startSender, stopOrphanedMicroVms, stripTerminalControls, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-MZYOUIY5.js → chunk-TRP3KPGK.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 28;
+var RUNNER_PROTOCOL = 29;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-YSM4EEUK.js → chunk-Y6KIGWFO.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-FZUFUVLK.js';
 import { writePendingUpdate } from './chunk-GH246BGV.js';
-import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-YGZLRX5U.js';
-import { RUNNER_PROTOCOL } from './chunk-MZYOUIY5.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-ZUVERBFB.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-RAMTJ2XP.js';
+import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
+import { RUNNER_PROTOCOL } from './chunk-TRP3KPGK.js';
 import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-SQQD5MST.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
@@ -2813,21 +2813,26 @@ async function probeCredentials(config, fetchImpl = fetch) {
     return { ok: true };
   } catch (err) {
     const status = err instanceof WorkCommandError ? err.status : void 0;
+    const code = err instanceof WorkCommandError ? err.code : void 0;
     if (err instanceof WorkCommandError && isSignatureRefusal(err.code)) {
       return {
         ok: false,
         fatal: err.code === "runner_key_signature_invalid",
-        reason: `${config.configPath}: ${err.message}`
+        reason: `${config.configPath}: ${err.message}`,
+        status,
+        code
       };
     }
     if (status === 401 || status === 403) {
       return {
         ok: false,
         fatal: true,
-        reason: `${config.configPath}: the API key was refused (${status}). A runner key needs git.read and work.read to list and read work items, and work.claim to claim, renew and release.`
+        reason: `${config.configPath}: the API key was refused (${status}). A runner key needs git.read and work.read to list and read work items, and work.claim to claim, renew and release.`,
+        status,
+        code
       };
     }
-    return { ok: false, fatal: false, reason: describeCallFailure(err) };
+    return { ok: false, fatal: false, reason: describeCallFailure(err), status, code };
   }
 }
 async function rejoinContainerBuild(state, adopted) {
@@ -3071,6 +3076,15 @@ function hooksOf(configPath) {
   }
 }
 async function start(configPath, deps = { fetchImpl: fetch }) {
+  const startup = {};
+  try {
+    return await startRunner(configPath, deps, startup);
+  } catch (err) {
+    await startup.report?.(err);
+    throw err;
+  }
+}
+async function startRunner(configPath, deps, startup) {
   const log = deps.log ??= createRunnerLog(deps.now ?? (() => /* @__PURE__ */ new Date()));
   takeClaudeCredential(process.env, hooksOf(configPath));
   const update = deps.update;
@@ -3081,7 +3095,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-4QNLMDP7.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-YCFZ3H35.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -3092,22 +3106,37 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     }
   }
   const loaded = loadRunnerConfig(configPath);
+  let check = "hooks";
+  let probeRefusal;
+  startup.report = (err) => reportFailedStart(
+    { config: loaded, cliVersion: deps.cliVersion ?? resolveVersion(), check, error: err, refusal: probeRefusal },
+    deps.fetchImpl
+  );
   const hookProblem = checkHooks(loaded);
   if (hookProblem) throw new RunnerStartError(hookProblem);
+  check = "image";
   const { config, note: fitNote } = fitForImage(deps, loaded);
+  check = "host-key";
   await ensureHostKey(configPath);
+  check = "identity";
   if (builtinKind(config.hooks.provision) === "container" || builtinKind(config.hooks.provision) === "vm") {
     await ensureRunnerIdentity(configPath, {
       docker: deps.runnerIdentity ?? (deps.container?.host === void 0 ? void 0 : { holdsObjects: async () => false }),
       log: (line) => log.error(line)
     }).catch((err) => log.error(`the runner's Docker identity could not be stored: ${describeCallFailure(err)} \xB7 using the names its folder's path gives`));
   }
+  check = "credentials";
   const probe = await probeCredentials(config, deps.fetchImpl);
-  if (!probe.ok && probe.fatal) throw new RunnerStartError(probe.reason);
+  if (!probe.ok && probe.fatal) {
+    probeRefusal = { status: probe.status, code: probe.code };
+    throw new RunnerStartError(probe.reason);
+  }
   if (!probe.ok) log.error(`the gateway did not answer at start: ${probe.reason} \xB7 starting anyway`);
+  check = "pid-file";
   mkdirSync(jobsDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
   const self = { pid: process.pid, start: startTimeOf(process.pid) ?? "" };
   claimPidFile(pidFilePath(configPath), self);
+  check = "cgroup";
   const { delegated, refusal } = setUpRunnerCgroup();
   if (refusal !== void 0) log.error(`the kernel refused a cgroup step for the runner's service: ${refusal}`);
   if (isBuiltinVm(config.hooks.provision) && !delegated) {
@@ -3122,6 +3151,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
   const state = { config, jobs: /* @__PURE__ */ new Map(), deps, configMtimeMs };
   log.line(`runner ${config.host} started \xB7 config ${configPath} \xB7 ${describeConfig(config)}`);
   if (fitNote !== void 0) log.line(fitNote);
+  check = "recovery";
   const leavesBuilds = await canLeaveBuilds(state);
   let sigusr2Target;
   let sigusr2Early = false;
@@ -3189,6 +3219,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       `recovered job ${recovered.queue} #${recovered.item} (claim ${shortClaim(recovered.claimId)}) as ${recovered.outcome ?? "interrupted"}: ${why}`
     );
   }
+  startup.report = void 0;
   let intakeClosed = false;
   let closed = false;
   let stopping = false;

package/dist/chunk-ZUVERBFB.js

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { scrubReason, stripTerminalControls } from './chunk-RAMTJ2XP.js';
+import { RunnerAlreadyRunningError, readPidFile } from './chunk-F5UL23I2.js';
+import { isSameProcess } from './chunk-JBJTC3UU.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-EHOFFTVX.js';
+import { isSignatureRefusal, postJson } from './chunk-YXMGHGHR.js';
+import { signerFor } from './chunk-SOI6K5DY.js';
+import { pidFilePath } from './chunk-PA6CK6WQ.js';
+import { readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+var GIB = 1024 ** 3;
+var DEFAULT_GIB = 8;
+var MINIMUM_GIB = 4;
+var BUILD_MEMORY_VARIABLE = "OUTERLAYER_BUILD_MEMORY";
+function memoryIsSet(configPath) {
+  try {
+    const raw = JSON.parse(readFileSync(configPath, "utf8"));
+    return raw.runner.build.memory !== void 0;
+  } catch {
+    return false;
+  }
+}
+function gib(bytes) {
+  return `${Number((bytes / GIB).toFixed(1))} GiB`;
+}
+function fitImageBuildMemory(config, totalMemoryBytes) {
+  if (memoryIsSet(config.configPath)) return { config };
+  const current = config.build?.memory ?? `${DEFAULT_GIB}g`;
+  if (checkFit({ concurrency: config.concurrency, buildMemory: current, usableBytes: totalMemoryBytes }).fits) return { config };
+  const available = Math.max(0, totalMemoryBytes - RUNNER_RESERVE_BYTES);
+  const perBuild = Math.floor(available / config.concurrency / GIB);
+  if (perBuild < MINIMUM_GIB) return { config };
+  const memory = `${perBuild}g`;
+  return {
+    config: { ...config, build: { ...config.build, memory } },
+    note: `builds get ${memory} of memory to fit this machine's ${gib(totalMemoryBytes)}; set ${BUILD_MEMORY_VARIABLE} to choose another value`
+  };
+}
+
+// src/runner/startup-report.ts
+var REPORT_TIMEOUT_MS = 5e3;
+var EMPTY_MESSAGE = "the check failed with no message";
+async function reportFailedStart(failed, fetchImpl, deps = {}) {
+  try {
+    if (failed.error instanceof RunnerAlreadyRunningError || refusesReport(failed.refusal)) return;
+    if (otherRunnerLive(failed.config.configPath, deps.isSameProcess ?? isSameProcess)) return;
+    await sendStartupReport(failed, fetchImpl, deps);
+  } catch {
+  }
+}
+function refusesReport(refusal) {
+  return refusal !== void 0 && (refusal.status === 401 || isSignatureRefusal(refusal.code));
+}
+function otherRunnerLive(configPath, isSame) {
+  const entry = readPidFile(pidFilePath(configPath));
+  return entry !== null && entry.pid !== process.pid && isSame(entry.pid, entry.start);
+}
+async function sendStartupReport(failed, fetchImpl, deps) {
+  const now = deps.now ?? (() => performance.now());
+  const startedAt = now();
+  const { config } = failed;
+  const text = failed.error instanceof Error ? failed.error.message : String(failed.error);
+  const message = (deps.scrub ?? scrubReason)(stripTerminalControls(text), config) ?? EMPTY_MESSAGE;
+  const signer = await signerFor(config.configPath).catch(() => void 0);
+  const left = REPORT_TIMEOUT_MS - (now() - startedAt);
+  if (left <= 0) return;
+  await postJson(
+    config.url,
+    "/v1/hosts/startup-report",
+    config.apiKey,
+    config.appId,
+    { host: config.host, cliVersion: failed.cliVersion, check: failed.check, message },
+    fetchImpl,
+    left,
+    signer
+  );
+}
+
+export { BUILD_MEMORY_VARIABLE, fitImageBuildMemory, reportFailedStart };

package/dist/{cli-BC7JWQUQ.js → cli-WFLOFK42.js}

@@ -4963,7 +4963,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-CIVWB7EJ.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-GBU2ACRF.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4983,7 +4983,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-CIVWB7EJ.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-GBU2ACRF.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -5015,7 +5015,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-CIVWB7EJ.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-GBU2ACRF.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -5085,7 +5085,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-MVA7YTFW.js');
-    const { start, RunnerStartError } = await import('./loop-YJF27PUS.js');
+    const { start, RunnerStartError } = await import('./loop-KRGNTFZ2.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5104,8 +5104,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-MVA7YTFW.js');
-    const { containerStart } = await import('./container-start-AQJ64LCF.js');
-    const { start, RunnerStartError } = await import('./loop-YJF27PUS.js');
+    const { containerStart } = await import('./container-start-C4XCYPUA.js');
+    const { start, RunnerStartError } = await import('./loop-KRGNTFZ2.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     try {
       const result = await containerStart({
@@ -5125,7 +5125,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-MVA7YTFW.js');
-    const { runRunnerCheck } = await import('./check-4QNLMDP7.js');
+    const { runRunnerCheck } = await import('./check-YCFZ3H35.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5525,7 +5525,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-MVA7YTFW.js');
-    const { requestStop } = await import('./loop-YJF27PUS.js');
+    const { requestStop } = await import('./loop-KRGNTFZ2.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-ADSLWXBA.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5533,8 +5533,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-MVA7YTFW.js');
     const { jobsDir, runnerDir } = await import('./paths-7HVTDE6J.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-YJF27PUS.js');
-    const { renderStatus } = await import('./status-AYHBGIAP.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-KRGNTFZ2.js');
+    const { renderStatus } = await import('./status-YVJQWWDP.js');
     const { readHousekeepingRecord } = await import('./record-PPZEXAVA.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5594,7 +5594,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-MVA7YTFW.js');
-    const { listJobFiles } = await import('./loop-YJF27PUS.js');
+    const { listJobFiles } = await import('./loop-KRGNTFZ2.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-HI46FO6Z.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{container-start-AQJ64LCF.js → container-start-C4XCYPUA.js}

@@ -1,6 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_MEMORY_VARIABLE } from './chunk-YGZLRX5U.js';
+import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-ZUVERBFB.js';
+import './chunk-RAMTJ2XP.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-HVRQQOMH.js';
+import './chunk-6LBSAW6I.js';
+import './chunk-I3LTIAOR.js';
+import './chunk-7IFYI7XF.js';
+import './chunk-D3EDZPJR.js';
+import './chunk-7UPMYRPS.js';
+import './chunk-ESVW4MJY.js';
+import './chunk-TBT347UY.js';
 import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-IUPY54BZ.js';
 import './chunk-2PGI6RDE.js';
 import { isAgentName, AGENT_COMMANDS } from './chunk-EXZACZ2P.js';
@@ -36,17 +46,23 @@ import './chunk-PJDQPF5N.js';
 import './chunk-SOI6K5DY.js';
 import './chunk-PA6CK6WQ.js';
 import { readClaudeCredential, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES } from './chunk-BALIE3BA.js';
+import './chunk-UK4RGH46.js';
 import './chunk-ZJSNLVCE.js';
+import './chunk-2O5KA67H.js';
+import './chunk-BKO6JEZI.js';
 import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-44V5SD4G.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
-import './chunk-RA3O54FC.js';
+import { resolveVersion } from './chunk-RA3O54FC.js';
+import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
+import './chunk-URIZRCRY.js';
 import './chunk-YQR6E6OV.js';
+import './chunk-TUSYOL2O.js';
 import './chunk-6CXNWKWD.js';
 import './chunk-F2D5BSXS.js';
 import './chunk-VNVZDWO3.js';
@@ -170,22 +186,29 @@ async function containerStart(deps) {
   }
   const settings = settingsOf(env);
   if (typeof settings === "string") return refuse(settings);
+  const url = set(env, "OUTERLAYER_URL");
+  const appId = set(env, "OUTERLAYER_APP_ID");
+  const apiKey = set(env, "OUTERLAYER_API_KEY");
+  const host = named.name;
+  const refuseDocker = async (message) => {
+    await reportFailedStart(
+      { config: { configPath, url, apiKey, appId, host }, cliVersion: resolveVersion(), check: "docker", error: message },
+      deps.fetchImpl ?? fetch
+    );
+    return refuse(message);
+  };
   const socketPresent = deps.socketPresent ?? existsSync;
   if (!socketPresent(DOCKER_SOCKET)) {
-    return refuse(
+    return refuseDocker(
       `${DOCKER_SOCKET} is not in the container. The runner starts each build as a container on the host's Docker, so start this container with -v ${DOCKER_SOCKET}:${DOCKER_SOCKET}.`
     );
   }
   const machine = { ...(deps.machine ?? (() => detectMachine()))(), inImage: true };
   if (!supportsContainerBuilds(machine)) {
-    return refuse(
+    return refuseDocker(
       `The container reaches ${describeMachineDocker(machine)} through ${DOCKER_SOCKET}, and builds need Docker Engine in a version that isolates a build (${MIN_ENGINE_MAJOR} or later), on Docker Engine or Docker Desktop. Check that the socket is the host's Docker and that it is running.`
     );
   }
-  const url = set(env, "OUTERLAYER_URL");
-  const appId = set(env, "OUTERLAYER_APP_ID");
-  const apiKey = set(env, "OUTERLAYER_API_KEY");
-  const host = named.name;
   if (existsSync(configPath)) {
     const stored = readConfig(configPath);
     if (stored instanceof RunnerInitError) return refuse(stored.message);

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-3IYSWDL4.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-BC7JWQUQ.js');
+var { runCli } = await import('./cli-WFLOFK42.js');
 await runCli(process.argv);

package/dist/{loop-YJF27PUS.js → loop-KRGNTFZ2.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-YSM4EEUK.js';
-import './chunk-FZUFUVLK.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-Y6KIGWFO.js';
 import './chunk-GH246BGV.js';
-import './chunk-ZVB57WI6.js';
 import './chunk-57L2YAJA.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-YGZLRX5U.js';
-import './chunk-MZYOUIY5.js';
+import './chunk-ZUVERBFB.js';
+import './chunk-RAMTJ2XP.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-TRP3KPGK.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';
 import './chunk-I3LTIAOR.js';

package/dist/{status-AYHBGIAP.js → status-YVJQWWDP.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-FZUFUVLK.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-RAMTJ2XP.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';

package/dist/{work-claim-cmd-CIVWB7EJ.js → work-claim-cmd-GBU2ACRF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_PROTOCOL } from './chunk-MZYOUIY5.js';
+import { RUNNER_PROTOCOL } from './chunk-TRP3KPGK.js';
 import { defaultRunnerConfigPath } from './chunk-VWQCYOBS.js';
 import './chunk-X4JEBMYN.js';
 import './chunk-OGMXVPCS.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.33.0-next.20261023120437",
+  "version": "0.33.0-next.20261023122246",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",

package/dist/chunk-YGZLRX5U.js

@@ -1,36 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-EHOFFTVX.js';
-import { readFileSync } from 'fs';
-
-createRequire(import.meta.url);
-var GIB = 1024 ** 3;
-var DEFAULT_GIB = 8;
-var MINIMUM_GIB = 4;
-var BUILD_MEMORY_VARIABLE = "OUTERLAYER_BUILD_MEMORY";
-function memoryIsSet(configPath) {
-  try {
-    const raw = JSON.parse(readFileSync(configPath, "utf8"));
-    return raw.runner.build.memory !== void 0;
-  } catch {
-    return false;
-  }
-}
-function gib(bytes) {
-  return `${Number((bytes / GIB).toFixed(1))} GiB`;
-}
-function fitImageBuildMemory(config, totalMemoryBytes) {
-  if (memoryIsSet(config.configPath)) return { config };
-  const current = config.build?.memory ?? `${DEFAULT_GIB}g`;
-  if (checkFit({ concurrency: config.concurrency, buildMemory: current, usableBytes: totalMemoryBytes }).fits) return { config };
-  const available = Math.max(0, totalMemoryBytes - RUNNER_RESERVE_BYTES);
-  const perBuild = Math.floor(available / config.concurrency / GIB);
-  if (perBuild < MINIMUM_GIB) return { config };
-  const memory = `${perBuild}g`;
-  return {
-    config: { ...config, build: { ...config.build, memory } },
-    note: `builds get ${memory} of memory to fit this machine's ${gib(totalMemoryBytes)}; set ${BUILD_MEMORY_VARIABLE} to choose another value`
-  };
-}
-
-export { BUILD_MEMORY_VARIABLE, fitImageBuildMemory };