@outerlayer/cli 0.33.0-next.20261023122246 → 0.33.0-next.20261023151440

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-23T12:24:08.386Z+0c94177","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-23T15:16:37.060Z+5648b3a","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-YCFZ3H35.js → check-XPMN4GHD.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-Y6KIGWFO.js';
+import { probeCredentials } from './chunk-YY3OQJ4X.js';
 import './chunk-GH246BGV.js';
 import './chunk-57L2YAJA.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-ZUVERBFB.js';
-import './chunk-RAMTJ2XP.js';
+import './chunk-RZOO7X4G.js';
+import './chunk-2LFWCIIE.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-TRP3KPGK.js';
+import './chunk-DA3PLB5N.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';
 import './chunk-I3LTIAOR.js';
@@ -16,10 +16,10 @@ import './chunk-7IFYI7XF.js';
 import './chunk-D3EDZPJR.js';
 import './chunk-7UPMYRPS.js';
 import './chunk-ESVW4MJY.js';
-import { managedProblems, managedFactsOf } from './chunk-SQQD5MST.js';
+import { managedProblems, managedFactsOf } from './chunk-VMIOUVJF.js';
 import './chunk-NBZ7XBT6.js';
 import './chunk-TBT347UY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-IUPY54BZ.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -28,7 +28,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME } from './chunk-EHOFFTVX.js';
@@ -37,7 +37,7 @@ import './chunk-X4JEBMYN.js';
 import './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{chunk-RAMTJ2XP.js → chunk-2LFWCIIE.js}

@@ -6,17 +6,17 @@ import { writeDockerClientConfig } from './chunk-6LBSAW6I.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
 import { senderPidfile } from './chunk-7IFYI7XF.js';
 import { installScrubContext } from './chunk-D3EDZPJR.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-IUPY54BZ.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-4YLL2E7Y.js';
 import { readBranchHead, fetchCommit, diffBetween } from './chunk-YXHKCHWG.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-5THSC6BD.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-L26V6ILJ.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-XCRET2GZ.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-Z57X4KNC.js';
 import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-VWQCYOBS.js';
 import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-X4JEBMYN.js';
 import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-OGMXVPCS.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-NE63JADS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-YXMGHGHR.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-VSLJ6PPG.js';
 import { planArtifactUpload } from './chunk-MPC2UAW2.js';
 import { scrubText } from './chunk-NIY2UBT6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';

package/dist/{chunk-IUPY54BZ.js → chunk-4YLL2E7Y.js}

@@ -7,14 +7,14 @@ import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-5THSC6BD.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-L26V6ILJ.js';
-import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-XCRET2GZ.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-Z57X4KNC.js';
 import { runnerImageVersion } from './chunk-MZBQTVFG.js';
 import { runnerCredentialProblem, builtinKind, hostAllowed } from './chunk-VWQCYOBS.js';
 import { formatBytes, allocatedBytes } from './chunk-X4JEBMYN.js';
 import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-OGMXVPCS.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
 import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-NE63JADS.js';
-import { WorkCommandError, getJson } from './chunk-YXMGHGHR.js';
+import { WorkCommandError, getJson } from './chunk-VSLJ6PPG.js';
 import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-NIY2UBT6.js';
 import { signerFor } from './chunk-SOI6K5DY.js';

package/dist/{chunk-2JLM4GUF.js → chunk-BLHUFOOB.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-DKFUXYGD.js';
 import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-EJL6CWSP.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-YXMGHGHR.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-VSLJ6PPG.js';
 import { isLinkedRepository } from './chunk-S5CNYXUA.js';
 import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-NIY2UBT6.js';
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-4YZOP343.js');
+    const { runnerHostChecks } = await import('./doctor-MFLM7DMY.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{chunk-TRP3KPGK.js → chunk-DA3PLB5N.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 29;
+var RUNNER_PROTOCOL = 31;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-ZUVERBFB.js → chunk-RZOO7X4G.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-RAMTJ2XP.js';
+import { scrubReason, stripTerminalControls } from './chunk-2LFWCIIE.js';
 import { RunnerAlreadyRunningError, readPidFile } from './chunk-F5UL23I2.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
 import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-EHOFFTVX.js';
-import { isSignatureRefusal, postJson } from './chunk-YXMGHGHR.js';
+import { isSignatureRefusal, postJson } from './chunk-VSLJ6PPG.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { pidFilePath } from './chunk-PA6CK6WQ.js';
 import { readFileSync } from 'fs';

package/dist/{chunk-SQQD5MST.js → chunk-VMIOUVJF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-IUPY54BZ.js';
+import { placeholderQueues, placeholderProblem } from './chunk-4YLL2E7Y.js';
 import { checkFit } from './chunk-EHOFFTVX.js';
 import { builtinKind, imageBuildOf } from './chunk-VWQCYOBS.js';
 import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-X4JEBMYN.js';

package/dist/{chunk-YXMGHGHR.js → chunk-VSLJ6PPG.js}

@@ -115,13 +115,14 @@ var WorkCommandError = class extends Error {
    * reached a response. A caller that has to tell one refusal from another —
    * a claim lost to another host from a key that no longer works — reads it
    * rather than matching on the message. */
-  constructor(message, retryable = false, status, code, reason, billingUrl) {
+  constructor(message, retryable = false, status, code, reason, billingUrl, lowestVersion) {
     super(message);
     this.retryable = retryable;
     this.status = status;
     this.code = code;
     this.reason = reason;
     this.billingUrl = billingUrl;
+    this.lowestVersion = lowestVersion;
   }
 };
 var WORK_LINK_RETRY_DELAYS_MS = [1e3, 5e3, 15e3, 6e4];
@@ -247,7 +248,10 @@ async function sendJsonBefore(method, url, path, apiKey, appId, body, fetchImpl,
       json.error?.message ?? `request failed (${response.status})`,
       response.status >= 500 || response.status === 429,
       response.status,
-      json.error?.code
+      json.error?.code,
+      void 0,
+      void 0,
+      typeof json.error?.lowestVersion === "string" ? json.error.lowestVersion : void 0
     );
   }
   return { status: response.status, data: json.data ?? json };

package/dist/{chunk-Y6KIGWFO.js → chunk-YY3OQJ4X.js}

@@ -4,23 +4,23 @@ import { writePendingUpdate } from './chunk-GH246BGV.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-ZUVERBFB.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-RAMTJ2XP.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-RZOO7X4G.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-2LFWCIIE.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { RUNNER_PROTOCOL } from './chunk-TRP3KPGK.js';
-import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-SQQD5MST.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
+import { RUNNER_PROTOCOL } from './chunk-DA3PLB5N.js';
+import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-VMIOUVJF.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-IUPY54BZ.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-4YLL2E7Y.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-XCRET2GZ.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-Z57X4KNC.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-VWQCYOBS.js';
 import { freeBytes, formatBytes, volumeBytes } from './chunk-X4JEBMYN.js';
 import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-OGMXVPCS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-YXMGHGHR.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-VSLJ6PPG.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
@@ -121,7 +121,8 @@ async function sendHeartbeat(args, fetchImpl) {
     blocked: args.blocked === void 0 ? void 0 : { reason: cutForGateway(args.blocked.reason, BLOCKED_REASON_MAX) },
     state: args.state,
     waitingItems: args.waitingItems === void 0 ? void 0 : args.waitingItems.slice(0, WAITING_ITEMS_MAX),
-    takes: args.takes === void 0 ? void 0 : takesBody(args.takes)
+    takes: args.takes === void 0 ? void 0 : takesBody(args.takes),
+    selfUpdate: args.selfUpdate
   };
   try {
     const response = await postJson(
@@ -1284,10 +1285,12 @@ async function sendTickHeartbeat(state, workRequest) {
           }),
           // Left out unless a draining runner has builds to wait on, so the gateway stores null.
           waitingItems: waitingItems.length > 0 ? waitingItems : void 0,
-          takes: { queues: state.config.queues, repos: { include: state.config.repos?.include, exclude: state.config.repos?.exclude } }
+          takes: { queues: state.config.queues, repos: { include: state.config.repos?.include, exclude: state.config.repos?.exclude } },
+          selfUpdate: selfUpdateReport(state)
         },
         state.deps.fetchImpl
       );
+      if (result.ok) state.heartbeatSent = true;
       reportRepeating(state, "the heartbeat", result.ok ? void 0 : `heartbeat failed: ${result.reason}`);
       if (result.ok) {
         considerNamedVersion(state, result.runnerVersion);
@@ -1335,7 +1338,18 @@ function selfUpdateBlocker(configPath, entryPath, own) {
   if (current !== own) return `\`current\` names ${current ?? "nothing"}, not the running ${own} \xB7 restart the runner`;
   return void 0;
 }
+function selfUpdateReport(state) {
+  if (state.deps.image !== void 0) return { enabled: false, reason: "runner-image" };
+  const update = state.deps.update;
+  const configPath = state.config.configPath;
+  if (update === void 0 || !isInLayout(configPath, update.entryPath) || !startedThroughCurrent(configPath, update.entryPath)) {
+    return { enabled: false, reason: "outside-install-layout" };
+  }
+  if (!state.config.autoUpdate) return { enabled: false, reason: "auto-update-off" };
+  return { enabled: true };
+}
 function considerNamedVersion(state, named) {
+  if (named !== void 0 && isVersion(named)) state.namedVersion = named;
   if (state.deps.image !== void 0) {
     considerNamedImage(state, named);
     return;
@@ -1371,6 +1385,14 @@ function considerNamedImage(state, named) {
   state.imageLogged = named;
   logOf(state).line(`the factory names ${named}, newer than the ${own} this image runs \xB7 ${pullInstruction(imageTag(named))}`);
 }
+function upgradeStepFor(state, floor) {
+  const named = state.namedVersion ?? floor;
+  const target = named !== void 0 && isVersion(named) ? named : void 0;
+  if (state.deps.image !== void 0) return pullInstruction(tagToPull(target));
+  const npm = `npm install -g @outerlayer/cli@${target ?? "latest"}, then "$(npm prefix -g)/bin/outerlayer" runner install`;
+  if (state.deps.update?.underService !== true) return `${npm}, then start the runner again`;
+  return builtinKind(state.config.hooks.provision) === "own" ? npm : `${npm} --service`;
+}
 function recordImageStatus(state) {
   if (state.deps.image === void 0) return;
   const named = state.imageNamed;
@@ -1864,7 +1886,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-OO6K6ELP.js');
+  const { postJson: postJson2 } = await import('./work-cmd-J2LJ3V4A.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1878,6 +1900,7 @@ async function tryClaimAndStart(state, item, queue) {
         kind: queue,
         seconds: LEASE_SECONDS,
         runnerProtocol: RUNNER_PROTOCOL,
+        cliVersion: state.deps.cliVersion ?? resolveVersion(),
         ...hostKey === void 0 ? {} : { hostKey: hostKey.hostKey }
       },
       state.deps.fetchImpl,
@@ -1904,6 +1927,17 @@ async function tryClaimAndStart(state, item, queue) {
       reportRepeating(state, "the organization's billing", claim.message ?? claim.reason);
       return { kind: "read_only" };
     }
+    if (claim.code === "runner_version_unsupported") {
+      if (state.heartbeatSent !== true) return { kind: "outdated" };
+      const floor = claim.lowestVersion ?? "the minimum version";
+      if (state.versionRefusalLogged !== floor) {
+        state.versionRefusalLogged = floor;
+        logOf(state).error(`the gateway refuses work from this runner: it runs ${ownVersionOf(state.deps)}, below ${floor} \xB7 ${upgradeStepFor(state, claim.lowestVersion)}`);
+      }
+      state.upgradeRefused = true;
+      recordImageStatus(state);
+      return { kind: "outdated" };
+    }
     if (claim.code === "runner_upgrade_required") {
       const tag = tagToPull(state.imageNamed);
       reportRepeating(
@@ -1920,6 +1954,7 @@ async function tryClaimAndStart(state, item, queue) {
   reportRepeating(state, "the organization's billing", void 0);
   reportRepeating(state, "the runner protocol", void 0);
   state.upgradeRefused = false;
+  state.versionRefusalLogged = void 0;
   recordImageStatus(state);
   reportRepeating(state, "the request signature", void 0);
   const { data } = claim.value;
@@ -3095,7 +3130,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-YCFZ3H35.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-XPMN4GHD.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-XCRET2GZ.js → chunk-Z57X4KNC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-YXMGHGHR.js';
+import { WorkCommandError, postJson } from './chunk-VSLJ6PPG.js';
 import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-AKZRGFGT.js';
 import { signingFetchFor } from './chunk-6RKD7YZ6.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
@@ -92,9 +92,10 @@ async function retrySend(send, deps = {}) {
       const code = err instanceof WorkCommandError ? err.code : void 0;
       const status = err instanceof WorkCommandError ? err.status : void 0;
       const message = err instanceof WorkCommandError ? err.message : void 0;
-      if (!isRetryable(err)) return { ok: false, attempts, reason, retryable: false, code, status, message };
+      const lowestVersion = err instanceof WorkCommandError ? err.lowestVersion : void 0;
+      if (!isRetryable(err)) return { ok: false, attempts, reason, retryable: false, code, status, message, lowestVersion };
       const elapsedMs = now().getTime() - startedMs;
-      if (elapsedMs + backoffMs >= windowMs) return { ok: false, attempts, reason, retryable: true, code, status, message };
+      if (elapsedMs + backoffMs >= windowMs) return { ok: false, attempts, reason, retryable: true, code, status, message, lowestVersion };
       await sleep(backoffMs);
       backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
     }

package/dist/{cli-WFLOFK42.js → cli-65ZQJ622.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-2JLM4GUF.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-BLHUFOOB.js';
 import './chunk-DKFUXYGD.js';
 import './chunk-EJL6CWSP.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-KUE4V2SK.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-YXMGHGHR.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';
@@ -3927,13 +3927,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-7CGCDLBZ.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-3VWJUWXA.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-7CGCDLBZ.js');
+    const { runInitCommand } = await import('./init-cmd-3VWJUWXA.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4634,9 +4634,9 @@ function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
   const run = async (action) => {
-    const { WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
-      await action(await import('./spec-cmd-E6SINBX6.js'));
+      await action(await import('./spec-cmd-7W4ERDL7.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4740,7 +4740,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4763,7 +4763,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4787,8 +4787,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-SY7NY2CR.js');
-    const { WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-QEZHRXC5.js');
+    const { WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4809,8 +4809,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-SY7NY2CR.js');
-    const { WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-QEZHRXC5.js');
+    const { WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4834,8 +4834,8 @@ still running, or that an older runner released, has no log and the
 command exits 1.
 `
   ).action(async (opts) => {
-    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-PWOFLTGD.js');
-    const { WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-UA5PAXRP.js');
+    const { WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkLogs(opts);
     } catch (err) {
@@ -4858,8 +4858,8 @@ item is not built again until a new build request. Exits 1 when no host
 build is running for the item.
 `
   ).action(async (opts) => {
-    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-WZHBEKE4.js');
-    const { WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-ZDIW3MVX.js');
+    const { WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkStop(opts);
     } catch (err) {
@@ -4880,8 +4880,8 @@ Prints the item's newest live demo record: its artifact id, the commit it was re
 test file that recorded it. With --json, prints { "demo": null } for an item with no demo.
 `
   ).action(async (opts) => {
-    const { runWorkDemo, WorkDemoCommandError } = await import('./work-demo-cmd-Y7EU335L.js');
-    const { WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkDemo, WorkDemoCommandError } = await import('./work-demo-cmd-A7XE4NKA.js');
+    const { WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkDemo(opts);
     } catch (err) {
@@ -4902,7 +4902,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4914,7 +4914,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4938,11 +4938,11 @@ Exits 0 when every listed proof is current, 1 when any is out of date or missing
 and 2 when it cannot tell.
 `
   ).action(async (opts) => {
-    const { runWorkProofsCommand } = await import('./work-proofs-cmd-6W6DDAP6.js');
+    const { runWorkProofsCommand } = await import('./work-proofs-cmd-XBESDEPM.js');
     await runWorkProofsCommand(opts);
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4963,7 +4963,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-GBU2ACRF.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-G3DC5LJK.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4983,7 +4983,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-GBU2ACRF.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-G3DC5LJK.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -5015,7 +5015,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-GBU2ACRF.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-G3DC5LJK.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -5067,8 +5067,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-AJUTKYWN.js');
-    const { WorkCommandError } = await import('./work-cmd-OO6K6ELP.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-ZYKNAJJM.js');
+    const { WorkCommandError } = await import('./work-cmd-J2LJ3V4A.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -5085,7 +5085,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-MVA7YTFW.js');
-    const { start, RunnerStartError } = await import('./loop-KRGNTFZ2.js');
+    const { start, RunnerStartError } = await import('./loop-5QV4VZOF.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5104,8 +5104,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-MVA7YTFW.js');
-    const { containerStart } = await import('./container-start-C4XCYPUA.js');
-    const { start, RunnerStartError } = await import('./loop-KRGNTFZ2.js');
+    const { containerStart } = await import('./container-start-RVH5743X.js');
+    const { start, RunnerStartError } = await import('./loop-5QV4VZOF.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     try {
       const result = await containerStart({
@@ -5125,7 +5125,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-MVA7YTFW.js');
-    const { runRunnerCheck } = await import('./check-YCFZ3H35.js');
+    const { runRunnerCheck } = await import('./check-XPMN4GHD.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5159,7 +5159,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-SQ4466SL.js');
+        const { installServiceCommand } = await import('./command-QENZQGZL.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5215,7 +5215,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-MVA7YTFW.js');
-    const { uninstallServiceCommand } = await import('./command-SQ4466SL.js');
+    const { uninstallServiceCommand } = await import('./command-QENZQGZL.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5243,10 +5243,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-MVA7YTFW.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-T64C4MID.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-5SGBLTDJ.js');
-    const { detectMachine } = await import('./machine-VBITNWTR.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-63X6ECKF.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-WIHSXL74.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-N4IIFMUX.js');
+    const { detectMachine } = await import('./machine-XTSUAX3K.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-VWJIINBC.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-ILP6BAC2.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5397,7 +5397,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-SQ4466SL.js');
+        const { installServiceCommand } = await import('./command-QENZQGZL.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5461,7 +5461,7 @@ Next:
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
-      const { imageTargetFor } = await import('./governing-source-IRRP7G5G.js');
+      const { imageTargetFor } = await import('./governing-source-INEXO2CK.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5525,7 +5525,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-MVA7YTFW.js');
-    const { requestStop } = await import('./loop-KRGNTFZ2.js');
+    const { requestStop } = await import('./loop-5QV4VZOF.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-ADSLWXBA.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5533,8 +5533,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-MVA7YTFW.js');
     const { jobsDir, runnerDir } = await import('./paths-7HVTDE6J.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-KRGNTFZ2.js');
-    const { renderStatus } = await import('./status-YVJQWWDP.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-5QV4VZOF.js');
+    const { renderStatus } = await import('./status-VBUCLDN5.js');
     const { readHousekeepingRecord } = await import('./record-PPZEXAVA.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5594,7 +5594,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-MVA7YTFW.js');
-    const { listJobFiles } = await import('./loop-KRGNTFZ2.js');
+    const { listJobFiles } = await import('./loop-5QV4VZOF.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-HI46FO6Z.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-SQ4466SL.js → command-QENZQGZL.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-DXJTBU7A.js';
 import './chunk-Z5IW4DHH.js';
 import { currentLink, execStartCommand } from './chunk-NBZ7XBT6.js';
-import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-IUPY54BZ.js';
+import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -12,7 +12,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-EHOFFTVX.js';
@@ -23,7 +23,7 @@ import './chunk-3Z3MPR55.js';
 import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-NE63JADS.js';
 import { realLima } from './chunk-77MM5RYD.js';
 import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{container-start-C4XCYPUA.js → container-start-RVH5743X.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-ZUVERBFB.js';
-import './chunk-RAMTJ2XP.js';
+import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-RZOO7X4G.js';
+import './chunk-2LFWCIIE.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';
@@ -11,7 +11,7 @@ import './chunk-D3EDZPJR.js';
 import './chunk-7UPMYRPS.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
-import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-IUPY54BZ.js';
+import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import { isAgentName, AGENT_COMMANDS } from './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -20,7 +20,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import './chunk-EHOFFTVX.js';
@@ -29,7 +29,7 @@ import './chunk-X4JEBMYN.js';
 import { parseSize } from './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{doctor-4YZOP343.js → doctor-MFLM7DMY.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launcherCheck } from './chunk-Z5IW4DHH.js';
-import { keepsHostBuilder, managedProblems } from './chunk-SQQD5MST.js';
+import { keepsHostBuilder, managedProblems } from './chunk-VMIOUVJF.js';
 import './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { needsClaudeCredential, claudeCredentialCheck, detectMachine, supportsContainerBuilds, describeMachineDocker, MIN_ENGINE_MAJOR, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned, helperFirecrackerNote, probeHelper, helperSocketPath, missingPermissionOf, missingPermissionFix } from './chunk-IUPY54BZ.js';
+import { needsClaudeCredential, claudeCredentialCheck, detectMachine, supportsContainerBuilds, describeMachineDocker, MIN_ENGINE_MAJOR, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned, helperFirecrackerNote, probeHelper, helperSocketPath, missingPermissionOf, missingPermissionFix } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -13,7 +13,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import './chunk-EHOFFTVX.js';
@@ -22,7 +22,7 @@ import { realBuildDiskProbe, DEFAULT_BUILD_DISK, freeBytes, checkDiskFit, format
 import { resolveDevcontainerCli, buildxState, spawnRun, parseSize } from './chunk-OGMXVPCS.js';
 import { locateRecipe, assertBuildable, readRecipe, RecipeError } from './chunk-3Z3MPR55.js';
 import { FIRECRACKER_VERSION, builderDiskPinned, CLAUDE_CODE_VERSION } from './chunk-NE63JADS.js';
-import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-YXMGHGHR.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{governing-source-IRRP7G5G.js → governing-source-INEXO2CK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { imageTargetFor, pinnedSourceOf, resolveGoverningSource } from './chunk-XCRET2GZ.js';
-import './chunk-YXMGHGHR.js';
+export { imageTargetFor, pinnedSourceOf, resolveGoverningSource } from './chunk-Z57X4KNC.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-3IYSWDL4.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-WFLOFK42.js');
+var { runCli } = await import('./cli-65ZQJ622.js');
 await runCli(process.argv);

package/dist/{init-63X6ECKF.js → init-VWJIINBC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-E7R2GIAW.js';
-import { RunnerInitError, readConfigObject } from './chunk-IUPY54BZ.js';
+import { RunnerInitError, readConfigObject } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -10,7 +10,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import { checkFit, VM_SERVICE_NAME, RUNNER_RESERVE_BYTES } from './chunk-EHOFFTVX.js';
@@ -20,7 +20,7 @@ import { parseSize } from './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
 import { writeLaunchAgent } from './chunk-LF6MLJCY.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{init-T64C4MID.js → init-WIHSXL74.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-IUPY54BZ.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -9,7 +9,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import './chunk-EHOFFTVX.js';
@@ -18,7 +18,7 @@ import './chunk-X4JEBMYN.js';
 import './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{init-cmd-7CGCDLBZ.js → init-cmd-3VWJUWXA.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-2JLM4GUF.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-BLHUFOOB.js';
 import './chunk-DKFUXYGD.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-EJL6CWSP.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-KUE4V2SK.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import { runConnect, hasUncommittedPolicy, commitCommandsFor } from './chunk-S5CNYXUA.js';

package/dist/{loop-KRGNTFZ2.js → loop-5QV4VZOF.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-Y6KIGWFO.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-YY3OQJ4X.js';
 import './chunk-GH246BGV.js';
 import './chunk-57L2YAJA.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-ZUVERBFB.js';
-import './chunk-RAMTJ2XP.js';
+import './chunk-RZOO7X4G.js';
+import './chunk-2LFWCIIE.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-TRP3KPGK.js';
+import './chunk-DA3PLB5N.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';
 import './chunk-I3LTIAOR.js';
@@ -16,10 +16,10 @@ import './chunk-7IFYI7XF.js';
 import './chunk-D3EDZPJR.js';
 import './chunk-7UPMYRPS.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-SQQD5MST.js';
+import './chunk-VMIOUVJF.js';
 import './chunk-NBZ7XBT6.js';
 import './chunk-TBT347UY.js';
-import './chunk-IUPY54BZ.js';
+import './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -28,7 +28,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import './chunk-EHOFFTVX.js';
@@ -37,7 +37,7 @@ import './chunk-X4JEBMYN.js';
 import './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{machine-VBITNWTR.js → machine-XTSUAX3K.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-IUPY54BZ.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -9,7 +9,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import './chunk-EHOFFTVX.js';
@@ -18,7 +18,7 @@ import './chunk-X4JEBMYN.js';
 import './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{runner-key-5SGBLTDJ.js → runner-key-N4IIFMUX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-IUPY54BZ.js';
+import { readConfigObject, RunnerInitError } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -9,7 +9,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-XCRET2GZ.js';
+import './chunk-Z57X4KNC.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import './chunk-EHOFFTVX.js';
@@ -18,7 +18,7 @@ import './chunk-X4JEBMYN.js';
 import './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
-import { getJson } from './chunk-YXMGHGHR.js';
+import { getJson } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import { fetchFactories, slug, dashboardBase, listText } from './chunk-S5CNYXUA.js';

package/dist/{spec-cmd-E6SINBX6.js → spec-cmd-7W4ERDL7.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { criteriaFromAcceptanceFile, runEmitCriteria } from './chunk-GO2DUPQS.js';
 import './chunk-ESVW4MJY.js';
-import { getJson, postJson, patchJson, WorkCommandError, resolveCredentials } from './chunk-YXMGHGHR.js';
+import { getJson, postJson, patchJson, WorkCommandError, resolveCredentials } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import { autoConnect } from './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{status-YVJQWWDP.js → status-VBUCLDN5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-RAMTJ2XP.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-2LFWCIIE.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';
@@ -10,7 +10,7 @@ import './chunk-D3EDZPJR.js';
 import './chunk-7UPMYRPS.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-TBT347UY.js';
-import { LEASE_SECONDS } from './chunk-IUPY54BZ.js';
+import { LEASE_SECONDS } from './chunk-4YLL2E7Y.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-EXZACZ2P.js';
 import './chunk-YXHKCHWG.js';
@@ -19,7 +19,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import { formatDuration, formatClock, relativeToRunner } from './chunk-XCRET2GZ.js';
+import { formatDuration, formatClock, relativeToRunner } from './chunk-Z57X4KNC.js';
 import { pullInstruction } from './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import './chunk-EHOFFTVX.js';
@@ -28,7 +28,7 @@ import { formatBytes } from './chunk-X4JEBMYN.js';
 import './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
-import './chunk-YXMGHGHR.js';
+import './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{work-claim-cmd-GBU2ACRF.js → work-claim-cmd-G3DC5LJK.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_PROTOCOL } from './chunk-TRP3KPGK.js';
+import { RUNNER_PROTOCOL } from './chunk-DA3PLB5N.js';
 import { defaultRunnerConfigPath } from './chunk-VWQCYOBS.js';
 import './chunk-X4JEBMYN.js';
 import './chunk-OGMXVPCS.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-NE63JADS.js';
-import { resolveCredentials, WorkCommandError, parsePositiveInt, postJson, environmentFacts, findLiveItemForIssue } from './chunk-YXMGHGHR.js';
-export { WorkCommandError } from './chunk-YXMGHGHR.js';
+import { resolveCredentials, WorkCommandError, parsePositiveInt, postJson, environmentFacts, findLiveItemForIssue } from './chunk-VSLJ6PPG.js';
+export { WorkCommandError } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';
@@ -26,7 +26,7 @@ import './chunk-BJ3KTMDH.js';
 import './chunk-44V5SD4G.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
-import './chunk-RA3O54FC.js';
+import { resolveVersion } from './chunk-RA3O54FC.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
 import './chunk-6CXNWKWD.js';
@@ -71,7 +71,9 @@ async function runWorkClaim(opts) {
     `/v1/work-items/${itemId}/claim`,
     creds.apiKey,
     creds.appId,
-    { host, kind: opts.kind, seconds, runnerProtocol: RUNNER_PROTOCOL, hostKey: hostKey.hostKey },
+    // The CLI's own version, so the gateway judges this claim on it and not on a runner that once
+    // heartbeated under the same host name.
+    { host, kind: opts.kind, seconds, runnerProtocol: RUNNER_PROTOCOL, cliVersion: resolveVersion(), hostKey: hostKey.hostKey },
     fetchImpl,
     void 0,
     hostKey.signer

package/dist/{work-cmd-OO6K6ELP.js → work-cmd-J2LJ3V4A.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { WorkCommandError, environmentFacts, findLiveItemForIssue, getJson, parsePositiveInt, patchJson, postJson, resolveCredentials, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus } from './chunk-YXMGHGHR.js';
+export { WorkCommandError, environmentFacts, findLiveItemForIssue, getJson, parsePositiveInt, patchJson, postJson, resolveCredentials, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{work-comment-cmd-SY7NY2CR.js → work-comment-cmd-QEZHRXC5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-YXMGHGHR.js';
+import { resolveCredentials, postJson, getJson } from './chunk-VSLJ6PPG.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{work-demo-cmd-Y7EU335L.js → work-demo-cmd-A7XE4NKA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readNewestDemo } from './chunk-ER6KQCVJ.js';
-import { resolveCredentials, WorkCommandError } from './chunk-YXMGHGHR.js';
+import { resolveCredentials, WorkCommandError } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{work-logs-cmd-PWOFLTGD.js → work-logs-cmd-UA5PAXRP.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, getJson } from './chunk-YXMGHGHR.js';
+import { resolveCredentials, getJson } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{work-open-pr-cmd-AJUTKYWN.js → work-open-pr-cmd-ZYKNAJJM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { itemLabel, runWorkPr, WorkPrCommandError } from './chunk-5M2J7B5N.js';
-import { resolveCredentials } from './chunk-YXMGHGHR.js';
+import { resolveCredentials } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{work-proofs-cmd-6W6DDAP6.js → work-proofs-cmd-XBESDEPM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-YXMGHGHR.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/dist/{work-stop-cmd-WZHBEKE4.js → work-stop-cmd-ZDIW3MVX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, WorkCommandError } from './chunk-YXMGHGHR.js';
+import { resolveCredentials, postJson, WorkCommandError } from './chunk-VSLJ6PPG.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-HLZMAJJD.js';
 import './chunk-S5CNYXUA.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.33.0-next.20261023122246",
+  "version": "0.33.0-next.20261023151440",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",