@outerlayer/cli 0.34.0-next.20261024163532 → 0.34.0-next.20261024180339

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-24T16:36:38.512Z+5a2af5b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-24T18:04:53.169Z+efc8cbd","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-K4I4EBEK.js → check-HCKDHD2R.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-DFLHVTXI.js';
+import { probeCredentials } from './chunk-43ZOV4OR.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-PBIYM2Z6.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-XLJHFZRL.js';
 import './chunk-DA3PLB5N.js';
 import './chunk-GH246BGV.js';
+import './chunk-5HLA7KPK.js';
+import './chunk-XLJHFZRL.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-57L2YAJA.js';
 import './chunk-HVRQQOMH.js';

package/dist/{chunk-DFLHVTXI.js → chunk-43ZOV4OR.js}

@@ -3,9 +3,10 @@ import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { reportFailedStart, fitImageBuildMemory } from './chunk-PBIYM2Z6.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-XLJHFZRL.js';
 import { RUNNER_PROTOCOL } from './chunk-DA3PLB5N.js';
 import { writePendingUpdate } from './chunk-GH246BGV.js';
+import { renderUpdateSteps } from './chunk-5HLA7KPK.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-XLJHFZRL.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
 import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-ZADIXMKT.js';
@@ -15,7 +16,7 @@ import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS,
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-6AQLRSYU.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3CKMB2UK.js';
 import { freeBytes, formatBytes, volumeBytes } from './chunk-ZYKFYNES.js';
@@ -1383,16 +1384,33 @@ function considerNamedImage(state, named) {
   const own = ownVersionOf(state.deps);
   if (named === void 0 || state.imageLogged === named || (compareVersions(own, named) ?? 0) >= 0) return;
   state.imageLogged = named;
-  logOf(state).line(`the factory names ${named}, newer than the ${own} this image runs \xB7 ${pullInstruction(imageTag(named))}`);
+  logOf(state).line(`the factory names ${named}, newer than the ${own} this image runs \xB7 ${imageStepFor(state, named)}`);
 }
 function upgradeStepFor(state, floor) {
   const named = state.namedVersion ?? floor;
   const target = named !== void 0 && isVersion(named) ? named : void 0;
-  if (state.deps.image !== void 0) return pullInstruction(tagToPull(target));
+  if (state.deps.image !== void 0) return imageStepFor(state, target);
   const npm = `npm install -g @outerlayer/cli@${target ?? "latest"}, then "$(npm prefix -g)/bin/outerlayer" runner install`;
   if (state.deps.update?.underService !== true) return `${npm}, then start the runner again`;
   return builtinKind(state.config.hooks.provision) === "own" ? npm : `${npm} --service`;
 }
+function imageStepFor(state, version) {
+  const read = state.ownContainer?.read;
+  return read === void 0 ? pullInstruction(tagToPull(version)) : renderUpdateSteps(read, version);
+}
+async function readOwnContainerOnce(state) {
+  const reader = state.deps.image?.readContainer;
+  if (reader === void 0) return;
+  const held = state.ownContainer;
+  const atMs = nowOf(state).getTime();
+  const retryAfterMs2 = 5 * 6e4;
+  if (held !== void 0 && (held.read.ok || atMs - held.atMs < retryAfterMs2)) return;
+  try {
+    state.ownContainer = { read: await reader(), atMs };
+  } catch (err) {
+    state.ownContainer = { read: { ok: false, reason: describeCallFailure(err) }, atMs };
+  }
+}
 function recordImageStatus(state) {
   if (state.deps.image === void 0) return;
   const named = state.imageNamed;
@@ -1813,6 +1831,7 @@ async function housekeepingPass(state) {
   }
 }
 async function runTick(state) {
+  await readOwnContainerOnce(state);
   state.restarting = false;
   state.holdingForUpdate = false;
   if (state.draining === true) return;
@@ -1939,11 +1958,10 @@ async function tryClaimAndStart(state, item, queue) {
       return { kind: "outdated" };
     }
     if (claim.code === "runner_upgrade_required") {
-      const tag = tagToPull(state.imageNamed);
       reportRepeating(
         state,
         "the runner protocol",
-        state.deps.image === void 0 ? claim.message ?? claim.reason : `${claim.message ?? claim.reason} \xB7 ${pullInstruction(tag)}`
+        state.deps.image === void 0 ? claim.message ?? claim.reason : `${claim.message ?? claim.reason} \xB7 ${imageStepFor(state, state.imageNamed)}`
       );
       state.upgradeRefused = true;
       recordImageStatus(state);
@@ -3132,7 +3150,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-K4I4EBEK.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-HCKDHD2R.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/chunk-5HLA7KPK.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { stripTerminalControls } from './chunk-XLJHFZRL.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-MZBQTVFG.js';
+import { readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+var COMPOSE_PROJECT_LABEL = "com.docker.compose.project";
+var COMPOSE_SERVICE_LABEL = "com.docker.compose.service";
+var COMPOSE_DIR_LABEL = "com.docker.compose.project.working_dir";
+function firstLine(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+function candidateIds(env, readFile) {
+  const found = [];
+  const hostname = env.HOSTNAME?.trim();
+  if (hostname !== void 0 && hostname !== "") found.push(hostname);
+  try {
+    for (const match of readFile("/proc/self/mountinfo").matchAll(/\/containers\/([0-9a-f]{64})\//g)) {
+      if (!found.includes(match[1])) found.push(match[1]);
+    }
+  } catch {
+  }
+  return found;
+}
+function bindDestination(bind) {
+  const parts = bind.split(":");
+  if (parts.length >= 3 && !parts[parts.length - 1].startsWith("/")) parts.pop();
+  return parts[parts.length - 1];
+}
+function mountsOf(row) {
+  const binds = row.HostConfig?.Binds ?? [];
+  const covered = new Set(binds.map(bindDestination));
+  const values = [...binds];
+  for (const mount of row.Mounts ?? []) {
+    if (mount.Destination === void 0 || covered.has(mount.Destination)) continue;
+    const source = mount.Type === "volume" ? mount.Name : mount.Type === "bind" ? mount.Source : void 0;
+    if (source === void 0 || source === "") continue;
+    values.push(`${source}:${mount.Destination}${mount.RW === false ? ":ro" : ""}`);
+  }
+  return values;
+}
+function restartOf(row) {
+  const policy = row.HostConfig?.RestartPolicy;
+  if (policy?.Name === void 0 || policy.Name === "" || policy.Name === "no") return void 0;
+  return policy.Name === "on-failure" && (policy.MaximumRetryCount ?? 0) > 0 ? `on-failure:${policy.MaximumRetryCount}` : policy.Name;
+}
+function networkOf(row) {
+  const mode = row.HostConfig?.NetworkMode;
+  return mode === void 0 || mode === "" || mode === "default" || mode === "bridge" ? void 0 : mode;
+}
+function envNamesOf(row, imageEnv) {
+  const own = new Set(imageEnv);
+  const names = (row.Config?.Env ?? []).filter((entry) => !own.has(entry)).map((entry) => entry.split("=")[0]);
+  return [...new Set(names)].sort();
+}
+async function readOwnContainer(deps = {}) {
+  const run = deps.run ?? (await import('./docker-DJ73SZRC.js')).spawnRun;
+  const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
+  if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
+  let problem = "";
+  let row;
+  for (const id of ids) {
+    try {
+      const result = await run("docker", ["inspect", id], { timeoutMs: 2e4 });
+      if (result.status !== 0) {
+        problem ||= firstLine(result.stderr) || `docker inspect exited with status ${result.status}`;
+        continue;
+      }
+      const parsed = JSON.parse(result.stdout)[0];
+      if (parsed?.Id !== void 0 && parsed.Id.startsWith(id)) {
+        row = parsed;
+        break;
+      }
+      problem ||= `docker inspect ${id} named another container`;
+    } catch (err) {
+      problem ||= err instanceof Error ? err.message : String(err);
+    }
+  }
+  if (row === void 0) {
+    return { ok: false, reason: `the runner could not read its container with \`docker inspect\` (is the Docker socket mounted?): ${problem}` };
+  }
+  const name = row.Name?.replace(/^\//, "");
+  const image = row.Config?.Image;
+  if (name === void 0 || name === "" || image === void 0 || image === "") {
+    return { ok: false, reason: "docker inspect gave no name or image for the container" };
+  }
+  let imageEnv = [];
+  if (row.Image !== void 0) {
+    try {
+      const result = await run("docker", ["image", "inspect", row.Image], { timeoutMs: 2e4 });
+      if (result.status === 0) imageEnv = JSON.parse(result.stdout)[0]?.Config?.Env ?? [];
+    } catch {
+    }
+  }
+  const labels = row.Config?.Labels ?? {};
+  const project = labels[COMPOSE_PROJECT_LABEL];
+  return {
+    ok: true,
+    container: {
+      name,
+      image,
+      mounts: mountsOf(row),
+      ...restartOf(row) === void 0 ? {} : { restart: restartOf(row) },
+      ...networkOf(row) === void 0 ? {} : { network: networkOf(row) },
+      envNames: envNamesOf(row, imageEnv),
+      ...project === void 0 || project === "" ? {} : { compose: { project, service: labels[COMPOSE_SERVICE_LABEL], workingDir: labels[COMPOSE_DIR_LABEL] } }
+    }
+  };
+}
+function shellWord(raw) {
+  const value = stripTerminalControls(raw);
+  return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+}
+function variablesNote(names) {
+  return names.length === 0 ? ["The container sets no variables of its own."] : [`The container sets these variables. Check that your env file sets each one: ${names.map(stripTerminalControls).join(", ")}`];
+}
+function renderUpdateSteps(read, version) {
+  const tag = version === void 0 ? tagToPull(void 0) : imageTag(version);
+  if (!read.ok) return `${pullInstruction(tag)} \xB7 the runner could not print exact commands: ${stripTerminalControls(read.reason)}`;
+  const c = read.container;
+  const lines = [];
+  if (c.compose !== void 0) {
+    const dir = c.compose.workingDir === void 0 ? "" : stripTerminalControls(c.compose.workingDir);
+    const where = dir === "" ? "" : ` in ${dir}`;
+    lines.push(
+      `Update the runner that Docker Compose started (project ${stripTerminalControls(c.compose.project)}). Run these commands${where}:`,
+      `1. Set the image of the runner service in your Compose file to ${tag}. Skip this step when it names a tag that moves, such as latest.`,
+      "2. docker compose pull",
+      "3. docker compose up -d",
+      `4. Check that the new runner is up: docker logs ${shellWord(c.name)}`,
+      `   Look for no line that says the gateway refuses work from this runner. docker exec ${shellWord(c.name)} outerlayer --version prints ${version ?? "the new version"}.`,
+      ...variablesNote(c.envNames)
+    );
+    return lines.join("\n");
+  }
+  const name = shellWord(c.name);
+  const old = shellWord(`${c.name}-old`);
+  const run = [
+    `docker run -d --name ${name}`,
+    ...c.restart === void 0 ? [] : [`--restart ${shellWord(c.restart)}`],
+    ...c.network === void 0 ? [] : [`--network ${shellWord(c.network)}`],
+    ...c.mounts.map((mount) => `-v ${shellWord(mount)}`),
+    "--env-file <the file you started it with>",
+    tag
+  ];
+  lines.push(
+    `Update the runner to ${tag}. The steps keep the old container as ${stripTerminalControls(c.name)}-old until the new one runs.`,
+    `1. docker pull ${tag}`,
+    `2. docker stop ${name}`,
+    `   docker rename ${name} ${old}`,
+    `3. ${run.join(" \\\n     ")}`,
+    `4. Check that the new runner is up: docker logs ${name}`,
+    `   Look for no line that says the gateway refuses work from this runner. docker exec ${name} outerlayer --version prints ${version ?? "the new version"}.`,
+    "5. Only after that check, remove the old container:",
+    `   docker rm ${old}`,
+    ...variablesNote(c.envNames)
+  );
+  return lines.join("\n");
+}
+async function runUpdateSteps(deps) {
+  const env = deps.env ?? process.env;
+  const named = readUpdateStatus(deps.runnerDirPath)?.named;
+  if (runnerImageVersion(env) === void 0) {
+    return `npm install -g @outerlayer/cli@${named ?? "latest"}, then "$(npm prefix -g)/bin/outerlayer" runner install, then start the runner again \xB7 this runner is not in the container image, so there is no container to read. A service runner uses \`runner install --service\` and updates itself.`;
+  }
+  return renderUpdateSteps(await readOwnContainer({ ...deps, env }), named);
+}
+
+export { readOwnContainer, renderUpdateSteps, runUpdateSteps };

package/dist/{cli-KDAKXVVE.js → cli-ADIMCYPF.js}

@@ -5109,7 +5109,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-WRHQDGVI.js');
-    const { start, RunnerStartError } = await import('./loop-E4YJ6BLL.js');
+    const { start, RunnerStartError } = await import('./loop-X3ANDLQU.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5128,8 +5128,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-WRHQDGVI.js');
-    const { containerStart } = await import('./container-start-V5WVSWAB.js');
-    const { start, RunnerStartError } = await import('./loop-E4YJ6BLL.js');
+    const { containerStart } = await import('./container-start-W4VEGRL5.js');
+    const { start, RunnerStartError } = await import('./loop-X3ANDLQU.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     try {
       const result = await containerStart({
@@ -5147,9 +5147,20 @@ function registerRunnerCommands(program2) {
       throw err;
     }
   });
+  runnerCmd.command("update-steps").description("Print the commands that update this runner, with the container's own mounts").option("--config <path>", configOption).addHelpText(
+    "after",
+    "\nIn the runner image, run it with `docker exec <container> outerlayer runner update-steps`. It reads the\ncontainer with `docker inspect` and changes nothing. The steps rename the old container and never remove it\nbefore the new one runs. They name the container's variables and never print a value.\n"
+  ).action(async (opts) => {
+    const { defaultRunnerConfigPath } = await import('./config-WRHQDGVI.js');
+    const { runnerDir } = await import('./paths-7HVTDE6J.js');
+    const { runUpdateSteps } = await import('./update-steps-4M2GIB4A.js');
+    const text = await runUpdateSteps({ runnerDirPath: runnerDir(opts.config ?? defaultRunnerConfigPath()) });
+    process.stdout.write(`${text}
+`);
+  });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WRHQDGVI.js');
-    const { runRunnerCheck } = await import('./check-K4I4EBEK.js');
+    const { runRunnerCheck } = await import('./check-HCKDHD2R.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5549,7 +5560,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WRHQDGVI.js');
-    const { requestStop } = await import('./loop-E4YJ6BLL.js');
+    const { requestStop } = await import('./loop-X3ANDLQU.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-ADSLWXBA.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5557,7 +5568,7 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-WRHQDGVI.js');
     const { jobsDir, runnerDir } = await import('./paths-7HVTDE6J.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-E4YJ6BLL.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-X3ANDLQU.js');
     const { renderStatus } = await import('./status-6ISCZDBX.js');
     const { readHousekeepingRecord } = await import('./record-PPZEXAVA.js');
     const path2 = await import('path');
@@ -5618,7 +5629,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WRHQDGVI.js');
-    const { listJobFiles } = await import('./loop-E4YJ6BLL.js');
+    const { listJobFiles } = await import('./loop-X3ANDLQU.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-HI46FO6Z.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{container-start-V5WVSWAB.js → container-start-W4VEGRL5.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-PBIYM2Z6.js';
+import { readOwnContainer } from './chunk-5HLA7KPK.js';
 import './chunk-XLJHFZRL.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-HVRQQOMH.js';
@@ -245,7 +246,7 @@ Change the variables to match the volume, or use a new volume to make a new runn
     if (err instanceof RunnerInitError) return refuse(err.message);
     throw err;
   }
-  await deps.start(configPath, { fetchImpl: deps.fetchImpl ?? fetch, image: { version, ...deps.exit === void 0 ? {} : { exit: deps.exit } } });
+  await deps.start(configPath, { fetchImpl: deps.fetchImpl ?? fetch, image: { version, readContainer: deps.readContainer ?? readOwnContainer, ...deps.exit === void 0 ? {} : { exit: deps.exit } } });
   return { ok: true };
 }
 

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-WENTLDMA.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-KDAKXVVE.js');
+var { runCli } = await import('./cli-ADIMCYPF.js');
 await runCli(process.argv);

package/dist/{loop-E4YJ6BLL.js → loop-X3ANDLQU.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-DFLHVTXI.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-43ZOV4OR.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-PBIYM2Z6.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-XLJHFZRL.js';
 import './chunk-DA3PLB5N.js';
 import './chunk-GH246BGV.js';
+import './chunk-5HLA7KPK.js';
+import './chunk-XLJHFZRL.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-57L2YAJA.js';
 import './chunk-HVRQQOMH.js';

package/dist/update-steps-4M2GIB4A.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { readOwnContainer, renderUpdateSteps, runUpdateSteps } from './chunk-5HLA7KPK.js';
+import './chunk-XLJHFZRL.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-HVRQQOMH.js';
+import './chunk-6LBSAW6I.js';
+import './chunk-I3LTIAOR.js';
+import './chunk-SMAZA7DM.js';
+import './chunk-HBVHRC3A.js';
+import './chunk-5XZ6BUPH.js';
+import './chunk-ESVW4MJY.js';
+import './chunk-TBT347UY.js';
+import './chunk-TFKROYY2.js';
+import './chunk-2PGI6RDE.js';
+import './chunk-2JB4GD34.js';
+import './chunk-ZVLSYWDF.js';
+import './chunk-F5UL23I2.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-OGFGZQA3.js';
+import './chunk-5THSC6BD.js';
+import './chunk-L26V6ILJ.js';
+import './chunk-6AQLRSYU.js';
+import './chunk-MZBQTVFG.js';
+import './chunk-TQMI335S.js';
+import './chunk-AMEM2ZLL.js';
+import './chunk-3CKMB2UK.js';
+import './chunk-ZYKFYNES.js';
+import './chunk-43I7PXDP.js';
+import './chunk-3Z3MPR55.js';
+import './chunk-ES4ULBAL.js';
+import './chunk-HIGP4WOC.js';
+import './chunk-IP7BIBXJ.js';
+import './chunk-OHJDH5GV.js';
+import './chunk-NVDPSH72.js';
+import './chunk-MECW77XP.js';
+import './chunk-6ZFY2L2T.js';
+import './chunk-TIRHZC2M.js';
+import './chunk-Y5YCX6AL.js';
+import './chunk-G2JWZDFA.js';
+import './chunk-ANPNT6PM.js';
+import './chunk-B44BFR2Q.js';
+import './chunk-UF2FU3CM.js';
+import './chunk-6RKD7YZ6.js';
+import './chunk-PJDQPF5N.js';
+import './chunk-SOI6K5DY.js';
+import './chunk-PA6CK6WQ.js';
+import './chunk-BALIE3BA.js';
+import './chunk-SHIGGHZO.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-2O5KA67H.js';
+import './chunk-BKO6JEZI.js';
+import './chunk-FGF52V4V.js';
+import './chunk-HCVLP7XA.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-ZGB4ZJ5E.js';
+import './chunk-5BHIBJDA.js';
+import './chunk-CDDED64E.js';
+import './chunk-RA3O54FC.js';
+import './chunk-T2Q7ISPE.js';
+import './chunk-WZBHBH3J.js';
+import './chunk-CRB3POP4.js';
+import './chunk-URIZRCRY.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-TUSYOL2O.js';
+import './chunk-CQRPR4WZ.js';
+import './chunk-EOTMDIYC.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-HACGUL52.js';
+import './chunk-MESOOLF4.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.34.0-next.20261024163532",
+  "version": "0.34.0-next.20261024180339",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",

package/skill-pack/maintained/outerlayer-amend/SKILL.md

@@ -27,7 +27,7 @@ branch first, unless the working tree is on it.
 ## Arguments
 
 - `--unattended`: no person is watching. Never ask a question. A need for a
-  person becomes a hand-off (step 7), never a silent stop.
+  person becomes a hand-off (step 8), never a silent stop.
 
 ## Builds and local sessions
 
@@ -85,7 +85,7 @@ repository. Commit and push in each checkout you change, to its own branch only.
      declares one.
    - **The spec is wrong.** The criterion cannot be met as written, for
      example one that names a path a repository rule forbids. Never rewrite it:
-     hand it off (step 7) with the wording change.
+     hand it off (step 8) with the wording change.
    - **Cannot tell.** Hand an ambiguous comment off with `--ready`: quote it
      and ask one question.
 5. **Fix, prove, reply.** An answer needs no commit: reply on its criterion
@@ -112,30 +112,30 @@ repository. Commit and push in each checkout you change, to its own branch only.
    - **Otherwise**, reply with a sentence naming what changed and the commit:
      `outerlayer work comment --item "$OUTERLAYER_WORK" [--criterion <criterion>] --body "<what changed>" --ready`.
      Omit `--criterion` on the general thread.
-6. **Watch CI.** Skip this step when you pushed nothing. Run
+6. **Record the proofs again** before you watch CI: the evidence check waits
+   on them. Push any recipe edit (`.outerlayer/proofs/<item key>.yaml`) first.
+   Run `outerlayer work proofs --record --comment --pr <prNumber>` in each
+   checkout you pushed.
+7. **Watch CI.** Skip this step when you pushed nothing. Run
    `gh pr checks <prNumber> --repo <repository> --watch` on each pull request
    you pushed. Leave out any check that waits on results recorded after the
    session ends. "No checks reported" is not green: query again.
    - For a failed check, read `gh run view <run-id> --log-failed`, fix it, push
-     again.
+     again, and repeat step 6.
    - If it also fails on the base branch, or outside the code, change nothing.
    - Stop after two fixes for one check.
-7. **Hand off what you cannot fix.** Reply on the thread with `--ready`: one
+8. **Hand off what you cannot fix.** Reply on the thread with `--ready`: one
    sentence of fact, then the decision a person must make. For a spec problem,
    quote the criterion and give the replacement wording. `--ready` hands the
    thread back to a person.
-8. **Check nothing is left waiting.** Reread threads. A thread still waiting
+9. **Check nothing is left waiting.** Reread threads. A thread still waiting
    on an agent has a reply that did not land or was flagged `unchanged`. Fix
    or report it. Then run `outerlayer sync` and `outerlayer work proofs`.
-9. **Record the proofs again.** Skip this step when you pushed nothing. If a
-   fix changes how a proof is made, commit the recipe edit
-   (`.outerlayer/proofs/<item key>.yaml`). Push, run
-   `outerlayer work proofs --record --comment --pr <prNumber>` per pushed checkout.
 10. **Report.** Write one line per thread: the criterion (or the general
    thread), and fixed (with the replacement) or handed off (with the reason).
    Add a line for a merge conflict (merged with the base sha, or handed off
    with the reason), a CI line when you pushed (green, or each red check and
-   why), the lines from step 9, and a line naming each proof missing or
+   why), the lines from step 6, and a line naming each proof missing or
    out of date.
    Post the lines once on the general thread:
    `outerlayer work comment --item "$OUTERLAYER_WORK" --body "<the lines>"`.

package/skill-pack/maintained/outerlayer-build/SKILL.md

@@ -338,7 +338,8 @@ Run them in order.
    the criteria itself and records the `acceptance-criteria` check, as
    release.md says. It records one check item per criterion. When the state
    file holds no criteria, no judge runs.
-   Watch CI until every check has concluded.
+   Watch CI until every check has concluded. Start the Evidence phase at the
+   same time, as release.md's "Watch CI" says: CI never reads the proofs.
 6. **Evidence.** Run `outerlayer emit step "Evidence" --item "$OUTERLAYER_WORK"`,
    then apply the team's changes for this phase. Read [references/evidence.md](references/evidence.md)
    when the pull request opens, and run it. Write and commit the proof recipe