@outerlayer/cli 0.33.0 → 0.34.0-next.20261023233807

package/dist/{work-proofs-cmd-XBESDEPM.js → chunk-NYHQF6BT.js}

@@ -1,46 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-VSLJ6PPG.js';
-import './chunk-IP7BIBXJ.js';
-import './chunk-HLZMAJJD.js';
-import './chunk-S5CNYXUA.js';
-import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
-import { resolveRepoIdentity } from './chunk-NIY2UBT6.js';
-import './chunk-LYGI3T66.js';
-import './chunk-7V5GUEDU.js';
-import './chunk-G2JWZDFA.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-J32AF6D2.js';
+import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { resolveRepoIdentity } from './chunk-BO42KT3D.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch } from './chunk-6RKD7YZ6.js';
-import './chunk-PJDQPF5N.js';
-import './chunk-SOI6K5DY.js';
-import './chunk-PA6CK6WQ.js';
-import './chunk-BALIE3BA.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-44V5SD4G.js';
-import './chunk-5BHIBJDA.js';
-import './chunk-CDDED64E.js';
-import './chunk-RA3O54FC.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import './chunk-CRB3POP4.js';
-import './chunk-6CXNWKWD.js';
-import './chunk-F2D5BSXS.js';
-import './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
-import './chunk-MESOOLF4.js';
-import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);
 
 // src/work-proofs-cmd.ts
+function liveHead(pr) {
+  if (pr.state !== "open" && pr.state !== "merged" || typeof pr.headSha !== "string" || pr.headSha === "") return void 0;
+  return pr.headSha.toLowerCase();
+}
 function classifyProofs(data, checkoutHead) {
   const heads = /* @__PURE__ */ new Set();
   if (checkoutHead !== void 0 && checkoutHead !== "") heads.add(checkoutHead.toLowerCase());
   data.pullRequests?.forEach((pr) => {
-    if ((pr.state === "open" || pr.state === "merged") && typeof pr.headSha === "string" && pr.headSha !== "") {
-      heads.add(pr.headSha.toLowerCase());
-    }
+    const head = liveHead(pr);
+    if (head !== void 0) heads.add(head);
   });
+  return classifyProofsAt(data, heads);
+}
+function classifyProofsAt(data, heads) {
   const entries = [];
   for (const criterion of data.criteria?.items ?? []) {
     if (criterion.proof === null || criterion.proof === "test") continue;
@@ -61,7 +45,7 @@ function render(entries, json) {
   if (entries.length === 0) return "No criterion declares a proof other than test.";
   return entries.map((e) => `${sanitizeTerminal(e.id)}  ${sanitizeTerminal(e.proof)}  ${STATE_LABEL[e.state]}  ${sanitizeTerminal(e.commit ?? "no commit")}`).join("\n");
 }
-async function runWorkProofs(opts) {
+function resolveProofsItem(opts) {
   const env = opts.env ?? process.env;
   let item;
   if (opts.item !== void 0) {
@@ -75,6 +59,10 @@ async function runWorkProofs(opts) {
   if (item === void 0) {
     throw new WorkCommandError("no work item. Pass --item <number>, or set OUTERLAYER_WORK to the item's number.");
   }
+  return item;
+}
+async function runWorkProofs(opts) {
+  const item = resolveProofsItem(opts);
   const creds = resolveCredentials(opts);
   const { data } = await getJson(creds.url, `/v1/work-items/${item}`, creds.apiKey, creds.appId, opts.fetchImpl ?? defaultFetch);
   const body = data;
@@ -95,6 +83,18 @@ async function runWorkProofs(opts) {
 }
 async function runWorkProofsCommand(opts) {
   try {
+    if (opts.init) {
+      const { runWorkProofsInit } = await import('./work-proofs-init-QB2UL3BC.js');
+      await runWorkProofsInit(opts);
+      process.exitCode = 0;
+      return;
+    }
+    if (opts.record) {
+      const { runWorkProofsRecord } = await import('./work-proofs-record-APK4VWRB.js');
+      const result2 = await runWorkProofsRecord(opts);
+      process.exitCode = result2.exitCode;
+      return;
+    }
     const result = await runWorkProofs(opts);
     process.exitCode = result.exitCode;
   } catch (err) {
@@ -108,4 +108,4 @@ async function runWorkProofsCommand(opts) {
   }
 }
 
-export { classifyProofs, runWorkProofs, runWorkProofsCommand };
+export { classifyProofs, classifyProofsAt, liveHead, resolveProofsItem, runWorkProofs, runWorkProofsCommand };

package/dist/{chunk-DKFUXYGD.js → chunk-OLCIPTST.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-KUE4V2SK.js';
-import { skillsBaseFor } from './chunk-LYGI3T66.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-XFAJQZN2.js';
+import { skillsBaseFor } from './chunk-TIRHZC2M.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-44V5SD4G.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-ZGB4ZJ5E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-ZF24JN7R.js';
+import { hasSymlinkComponent } from './chunk-YPCDDQFU.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';

package/dist/{chunk-S5CNYXUA.js → chunk-OVRNGOD2.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
-import { remoteLookupFailed } from './chunk-NIY2UBT6.js';
-import { isAgentsMdLayout } from './chunk-LYGI3T66.js';
-import { DEFAULT_DASHBOARD } from './chunk-7V5GUEDU.js';
+import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { remoteLookupFailed } from './chunk-BO42KT3D.js';
+import { isAgentsMdLayout } from './chunk-TIRHZC2M.js';
+import { DEFAULT_DASHBOARD } from './chunk-Y5YCX6AL.js';
 import { cliFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';

package/dist/{chunk-UK4RGH46.js → chunk-SHIGGHZO.js}

@@ -680,11 +680,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-A2FGVVPH.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-YGWYIFFV.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-7SOH6IMA.js');
+  const { governanceOf } = await import('./control-plane-launch-AXBWT5CC.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-EJL6CWSP.js → chunk-SVLFZLTE.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
-import { isAgentsMdLayout } from './chunk-LYGI3T66.js';
+import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { isAgentsMdLayout } from './chunk-TIRHZC2M.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-6RKD7YZ6.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { machineSkillsState, staleClaudeSkills } from './chunk-JEVKOZBB.js';
-import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-44V5SD4G.js';
+import { machineSkillsState, staleClaudeSkills } from './chunk-HMCBX3PL.js';
+import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-ZGB4ZJ5E.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-ZF24JN7R.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-6CXNWKWD.js';
+import { hasSymlinkComponent } from './chunk-YPCDDQFU.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-CQRPR4WZ.js';
 import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, realpathSync, readdirSync } from 'fs';
 import { join, dirname, posix, basename, isAbsolute, relative } from 'path';

package/dist/{chunk-5M2J7B5N.js → chunk-TCGVYHII.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-HLZMAJJD.js';
-import { resolveRepoIdentity } from './chunk-NIY2UBT6.js';
+import { autoConnect } from './chunk-2HCXEIJD.js';
+import { resolveRepoIdentity } from './chunk-BO42KT3D.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-LYGI3T66.js → chunk-TIRHZC2M.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-44V5SD4G.js';
-import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-6CXNWKWD.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-ZGB4ZJ5E.js';
+import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-CQRPR4WZ.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';
 

package/dist/{chunk-OGMXVPCS.js → chunk-TYBK2UCW.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-3Z3MPR55.js';
-import { BUILDKIT_IMAGE } from './chunk-NE63JADS.js';
-import { compareVersions } from './chunk-NIY2UBT6.js';
+import { BUILDKIT_IMAGE } from './chunk-ES4ULBAL.js';
+import { compareVersions } from './chunk-BO42KT3D.js';
 import { ensureHostKey } from './chunk-SOI6K5DY.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PA6CK6WQ.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BALIE3BA.js';

package/dist/{chunk-FT7MUQGO.js → chunk-UF2FU3CM.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-44V5SD4G.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-ZGB4ZJ5E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-6CXNWKWD.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-CQRPR4WZ.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{work-comment-cmd-QEZHRXC5.js → chunk-VY2FE5VT.js}

@@ -1,33 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-VSLJ6PPG.js';
+import { resolveCredentials, postJson, getJson } from './chunk-J32AF6D2.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import './chunk-HLZMAJJD.js';
-import './chunk-S5CNYXUA.js';
-import { sanitizeTerminal } from './chunk-MPC2UAW2.js';
-import { resolveRepoIdentity } from './chunk-NIY2UBT6.js';
-import './chunk-LYGI3T66.js';
-import './chunk-7V5GUEDU.js';
-import './chunk-G2JWZDFA.js';
+import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { resolveRepoIdentity } from './chunk-BO42KT3D.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch } from './chunk-6RKD7YZ6.js';
-import './chunk-PJDQPF5N.js';
-import './chunk-SOI6K5DY.js';
-import './chunk-PA6CK6WQ.js';
-import './chunk-BALIE3BA.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-44V5SD4G.js';
-import './chunk-5BHIBJDA.js';
-import './chunk-CDDED64E.js';
-import './chunk-RA3O54FC.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import './chunk-CRB3POP4.js';
-import './chunk-6CXNWKWD.js';
-import './chunk-F2D5BSXS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
-import './chunk-MESOOLF4.js';
-import './chunk-Z5GEFMRW.js';
 import { randomUUID } from 'crypto';
 
 createRequire(import.meta.url);
@@ -65,7 +45,7 @@ async function runWorkComment(opts) {
   });
   const creds = resolveCredentials({ ...opts, cwd, home, env });
   const comment = {
-    clientCommentId: randomUUID(),
+    clientCommentId: opts.clientCommentId ?? randomUUID(),
     body: opts.body ?? "",
     ...opts.criterion !== void 0 ? { criterion: opts.criterion } : {},
     ...action !== void 0 ? { action } : {},

package/dist/{chunk-GO2DUPQS.js → chunk-WEUCD3J3.js}

@@ -2,13 +2,13 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-HLZMAJJD.js';
-import { resolveRepoIdentity } from './chunk-NIY2UBT6.js';
+import { autoConnect } from './chunk-2HCXEIJD.js';
+import { resolveRepoIdentity } from './chunk-BO42KT3D.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { CriteriaListSchema } from './chunk-F2D5BSXS.js';
+import { CriteriaListSchema } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync } from 'fs';
 

package/dist/{chunk-KUE4V2SK.js → chunk-XFAJQZN2.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-44V5SD4G.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-ZGB4ZJ5E.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-ZF24JN7R.js';
+import { linkedAgentsPath } from './chunk-YPCDDQFU.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-2LFWCIIE.js → chunk-XXTXM47K.js}

@@ -4,30 +4,30 @@ import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HVRQQOMH.js';
 import { writeDockerClientConfig } from './chunk-6LBSAW6I.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-7IFYI7XF.js';
-import { installScrubContext } from './chunk-D3EDZPJR.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-4YLL2E7Y.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-YXHKCHWG.js';
+import { senderPidfile } from './chunk-YQ5BEACL.js';
+import { installScrubContext } from './chunk-KLGYSJ3A.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-KSZXJE3R.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-ZVLSYWDF.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-5THSC6BD.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-L26V6ILJ.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-Z57X4KNC.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-VWQCYOBS.js';
-import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-X4JEBMYN.js';
-import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-OGMXVPCS.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-NE63JADS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-VSLJ6PPG.js';
-import { planArtifactUpload } from './chunk-MPC2UAW2.js';
-import { scrubText } from './chunk-NIY2UBT6.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-3CUGPUCP.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-2UF4H4PG.js';
+import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-BBGVXGSO.js';
+import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-TYBK2UCW.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-ES4ULBAL.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-J32AF6D2.js';
+import { planArtifactUpload } from './chunk-MECW77XP.js';
+import { scrubText } from './chunk-BO42KT3D.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PA6CK6WQ.js';
 import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
-import { resolvePackRoot } from './chunk-44V5SD4G.js';
+import { resolvePackRoot } from './chunk-ZGB4ZJ5E.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { parsePolicy } from './chunk-6CXNWKWD.js';
-import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-F2D5BSXS.js';
+import { parsePolicy } from './chunk-CQRPR4WZ.js';
+import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';

package/dist/{chunk-7V5GUEDU.js → chunk-Y5YCX6AL.js}

@@ -5,7 +5,7 @@ import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfigStrict, CloudConfigError, readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-F2D5BSXS.js';
+import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';

package/dist/chunk-YNJUN6BB.js

@@ -0,0 +1,148 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { liveHead, resolveProofsItem, classifyProofsAt } from './chunk-NYHQF6BT.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-J32AF6D2.js';
+import { resolveRepoIdentity } from './chunk-BO42KT3D.js';
+import { defaultFetch } from './chunk-6RKD7YZ6.js';
+import { renderProofRecipe, renderProofSetup } from './chunk-CQRPR4WZ.js';
+import { inferArtifactKind, mediaTypeForArtifactPath, WORK_ITEM_COMMENT_MAX_BODY_LENGTH } from './chunk-EOTMDIYC.js';
+import { realpathSync, existsSync, mkdirSync, writeFileSync } from 'fs';
+import { join, isAbsolute, resolve, relative } from 'path';
+import { createHash } from 'crypto';
+
+createRequire(import.meta.url);
+var DEMO_PROOFS = /* @__PURE__ */ new Set(["screenshot", "video"]);
+var KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function recipeKeyFor(trackerKey) {
+  const hash = trackerKey.lastIndexOf("#");
+  const key = hash === -1 ? trackerKey : trackerKey.slice(hash + 1);
+  return KEY_PATTERN.test(key) ? key : void 0;
+}
+function buildRecipe(entries) {
+  const run = [];
+  if (entries.some((entry) => DEMO_PROOFS.has(entry.proof))) run.push({ command: "", emit: "demo" });
+  for (const entry of entries) {
+    if (!DEMO_PROOFS.has(entry.proof)) run.push({ command: "", emit: "", for: entry.id });
+  }
+  return { run, manual: [] };
+}
+function planEntries(recipe, states) {
+  const stateOf = new Map(states.map((state) => [state.id, state.state]));
+  const named = /* @__PURE__ */ new Set([...recipe.run.flatMap((entry) => entry.for === void 0 ? [] : [entry.for]), ...recipe.manual.map((entry) => entry.criterion)]);
+  return recipe.run.map((entry) => {
+    const criteria = entry.emit === "demo" ? states.filter((state) => DEMO_PROOFS.has(state.proof) && !named.has(state.id)).map((state) => state.id) : [entry.for];
+    if (criteria.length === 0) return { entry, criteria, skip: "empty" };
+    const current = criteria.every((id) => stateOf.get(id) === "current");
+    return { entry, criteria, skip: current ? "current" : null };
+  });
+}
+function checkEmitPath(root, emit) {
+  if (emit === "") return { ok: false, reason: "the entry has no emit path" };
+  if (isAbsolute(emit)) return { ok: false, reason: `the emit path "${emit}" is outside the repository: it is absolute` };
+  const path = resolve(root, emit);
+  const from = relative(root, path);
+  if (from === "" || from === ".." || from.startsWith("../") || isAbsolute(from)) {
+    return { ok: false, reason: `the emit path "${emit}" is outside the repository` };
+  }
+  return { ok: true, path };
+}
+function insideRoot(root, path) {
+  try {
+    const from = relative(realpathSync(root), realpathSync(path));
+    return from !== "" && from !== ".." && !from.startsWith("../") && !isAbsolute(from);
+  } catch {
+    return false;
+  }
+}
+function kindProblem(declared, file) {
+  if (declared === null) return void 0;
+  if (declared === "test") return "a test proof is recorded by CI, not by a recipe";
+  const kind = inferArtifactKind(mediaTypeForArtifactPath(file));
+  return kind === declared ? void 0 : `the file is a ${kind}, but the criterion declares a ${declared} proof`;
+}
+function proofsCommentBody(head, lines) {
+  const header = `These proofs are not current at ${head.slice(0, 7)}:`;
+  const rows = lines.map((line) => `- ${line.id} (${line.proof}): ${line.reason}`);
+  const fits = (count2) => {
+    const left = rows.length - count2;
+    return [header, ...rows.slice(0, count2), ...left > 0 ? [`and ${left} more.`] : []].join("\n");
+  };
+  let count = rows.length;
+  while (count > 0 && fits(count).length > WORK_ITEM_COMMENT_MAX_BODY_LENGTH) count -= 1;
+  return fits(count);
+}
+function proofsCommentId(item, head, lines) {
+  const list = [...lines].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((line) => [line.id, line.proof, line.reason]);
+  const digest = createHash("sha256").update(JSON.stringify([item, head.toLowerCase(), list])).digest("hex");
+  return `proofs-${digest.slice(0, 32)}`;
+}
+function repositoryName(repository) {
+  return repository.replace(/\.git$/, "").split("/").filter((part) => part !== "").slice(-2).join("/").toLowerCase();
+}
+function ownPullRequest(pullRequests, requested, checkoutRepository) {
+  if (requested !== void 0) return { pr: requested };
+  const here = checkoutRepository === void 0 ? void 0 : repositoryName(checkoutRepository);
+  const open = pullRequests.filter(
+    (pr) => pr.state === "open" && typeof pr.prNumber === "number" && (here === void 0 || repositoryName(pr.repository ?? "") === here)
+  );
+  if (open.length > 1) return { ambiguous: open.map((pr) => pr.prNumber) };
+  return { pr: open[0]?.prNumber };
+}
+
+// src/work-proofs-init.ts
+var PROOFS_DIR = join(".outerlayer", "proofs");
+var SETUP_FILE = "setup.yaml";
+function repositoryName2(repository) {
+  return repository.replace(/\.git$/, "").split("/").filter((part) => part !== "").slice(-2).join("/").toLowerCase();
+}
+function otherPullRequestHeads(pullRequests, ownPr, checkoutRepository) {
+  const here = checkoutRepository === void 0 ? void 0 : repositoryName2(checkoutRepository);
+  const heads = /* @__PURE__ */ new Set();
+  for (const pr of pullRequests) {
+    const head = liveHead(pr);
+    if (head === void 0) continue;
+    const isOwn = ownPr !== void 0 && pr.prNumber === ownPr && (here === void 0 || repositoryName2(pr.repository ?? "") === here);
+    if (!isOwn) heads.add(head);
+  }
+  return heads;
+}
+function writeOnce(path, text) {
+  if (existsSync(path)) return false;
+  mkdirSync(join(path, ".."), { recursive: true });
+  writeFileSync(path, text, { flag: "wx" });
+  return true;
+}
+async function runWorkProofsInit(opts) {
+  const item = resolveProofsItem(opts);
+  const cwd = opts.cwd ?? process.cwd();
+  const identity = resolveRepoIdentity(cwd);
+  if (identity.repoRoot === void 0) throw new WorkCommandError("this is not a git checkout. Run this inside the repository.");
+  const root = identity.repoRoot;
+  const creds = resolveCredentials(opts);
+  const { data } = await getJson(creds.url, `/v1/work-items/${item}`, creds.apiKey, creds.appId, opts.fetchImpl ?? defaultFetch);
+  const body = data;
+  const key = recipeKeyFor(body.trackerKey ?? "");
+  if (key === void 0) {
+    throw new WorkCommandError(`the item's tracker key "${body.trackerKey ?? ""}" cannot name a recipe file. Name the file by hand in ${PROOFS_DIR}.`);
+  }
+  const pullRequests = body.pullRequests ?? [];
+  const own = ownPullRequest(pullRequests, opts.pr, identity.gitRepo);
+  if ("ambiguous" in own) {
+    throw new WorkCommandError(`the item links several open pull requests (${own.ambiguous.map((n) => `#${n}`).join(", ")}). Pass --pr <number> to name this checkout's.`);
+  }
+  const otherHeads = otherPullRequestHeads(pullRequests, own.pr, identity.gitRepo);
+  const todo = classifyProofsAt(body, otherHeads).filter((entry) => entry.state !== "current");
+  const recipePath = join(root, PROOFS_DIR, `${key}.yaml`);
+  const shown = relative(root, recipePath);
+  const recipeWritten = writeOnce(recipePath, renderProofRecipe(buildRecipe(todo)));
+  const setupWritten = writeOnce(join(root, PROOFS_DIR, SETUP_FILE), renderProofSetup({ setup: [] }));
+  const lines = [
+    recipeWritten ? `Wrote ${shown} with ${todo.length} proof${todo.length === 1 ? "" : "s"} to record. Fill in each command and emit path, then commit it.` : `Kept ${shown}: it exists, so it is unchanged.`,
+    setupWritten ? `Wrote ${join(PROOFS_DIR, SETUP_FILE)} with an empty setup. Add the commands that start the app, then commit it.` : `Kept ${join(PROOFS_DIR, SETUP_FILE)}: it exists.`
+  ];
+  const output = lines.join("\n");
+  if (!opts.quiet) process.stdout.write(output + "\n");
+  return { output, recipePath, recipe: recipeWritten ? "written" : "kept", setup: setupWritten ? "written" : "kept" };
+}
+
+export { PROOFS_DIR, SETUP_FILE, checkEmitPath, insideRoot, kindProblem, otherPullRequestHeads, ownPullRequest, planEntries, proofsCommentBody, proofsCommentId, recipeKeyFor, runWorkProofsInit };

package/dist/{chunk-ZF24JN7R.js → chunk-YPCDDQFU.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
 import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import { CONTEXT_PIN_FILENAME } from './chunk-6CXNWKWD.js';
+import { CONTEXT_PIN_FILENAME } from './chunk-CQRPR4WZ.js';
 import { execFileSync } from 'child_process';
 import { lstatSync, existsSync, unlinkSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';

package/dist/{chunk-7IFYI7XF.js → chunk-YQ5BEACL.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-D3EDZPJR.js';
-import { CaptureDaemon } from './chunk-NIY2UBT6.js';
-import { spoolDir } from './chunk-UK4RGH46.js';
+import { LiveUploader } from './chunk-KLGYSJ3A.js';
+import { CaptureDaemon } from './chunk-BO42KT3D.js';
+import { spoolDir } from './chunk-SHIGGHZO.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-44V5SD4G.js → chunk-ZGB4ZJ5E.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { splitRawFile } from './chunk-6CXNWKWD.js';
+import { splitRawFile } from './chunk-CQRPR4WZ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';

package/dist/{chunk-YXHKCHWG.js → chunk-ZVLSYWDF.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-NE63JADS.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-ES4ULBAL.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PA6CK6WQ.js';
 import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BALIE3BA.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';

package/dist/{claude-launcher-YRPW4SWA.js → claude-launcher-YXRS4EZE.js}

@@ -4,12 +4,12 @@ import { sharedSkillNames } from './chunk-FGF52V4V.js';
 import { GOVERNANCE_VARIABLE, versionAtLeast, MINIMUM_CLAUDE_VERSION, SHIM_SCRIPT, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 export { MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setupMachineSkills } from './chunk-JEVKOZBB.js';
-import './chunk-44V5SD4G.js';
+import { setupMachineSkills } from './chunk-HMCBX3PL.js';
+import './chunk-ZGB4ZJ5E.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
-import './chunk-6CXNWKWD.js';
-import './chunk-F2D5BSXS.js';
+import './chunk-CQRPR4WZ.js';
+import './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { spawnSync, execFileSync, spawn } from 'child_process';
@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-7SOH6IMA.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-AXBWT5CC.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);