@outerlayer/cli 0.34.0-next.20261024174615 → 0.34.0-next.20261024225538

package/README.md

@@ -94,10 +94,10 @@ content:
   reads the runner's log for a host attempt. `outerlayer work demo` reads an
   item's newest demo record with `GET /v1/work-items/<n>/demo`.
   `outerlayer work proofs` reads the item with `GET /v1/work-items/<n>` and
-  compares each proof with the head commit. `outerlayer work proofs --init`
-  reads the same item to write the proof recipe. `outerlayer work proofs --record`
-  reads the item and its threads, and emits each proof it records, with
-  an optional comment, through your gateway. `outerlayer work stop` sends
+  compares each proof with the head commit. `outerlayer work proofs --record`
+  reads the same item, reruns the tests at HEAD that name each proof that is
+  not current, and emits each proof they write, with an optional comment,
+  through your gateway. `outerlayer work stop` sends
   `POST /v1/work-items/<n>/claim/stop` with the optional note, and the
   gateway records the request against the item's live host build. A runner
   key needs `git.read` and `work.read` to
@@ -504,7 +504,7 @@ before it gives up.
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |
 | `outerlayer work comment --item <n> [--criterion <id>] --body <text> [--artifact <id>] [--pass\|--fail\|--attach\|--ready]` | Post one comment on a work item's general thread, or on one acceptance criterion's own thread with `--criterion`. `--pass`/`--fail` need a person's own credential and apply to the whole item, so they work on the general thread only and the gateway refuses them with `--criterion`; `--attach` makes the named artifact that criterion's current proof; `--ready` hands a thread back to a person. The detected session id rides along automatically, only ever narrowing what the comment may do. |
 | `outerlayer work stop --item <n> [--note <text>]` | Ask the host that holds the item's build to end it. The host reads the request at its next heartbeat and ends the build with outcome `stopped`, so the build may run a little longer. The item is not built again until a new build request. Needs `work.update`. Exits 1 when no host build is running for the item. |
-| `outerlayer work proofs [--item <n>] [--json]` | Lists each criterion that declares a proof other than `test` as current, out of date or missing at the checkout's HEAD, or at the head of a linked pull request that is open or merged. Exits 0 when every proof is current, 1 when any is not, and 2 when it cannot tell. |
+| `outerlayer work proofs [--item <n>] [--json]` | Lists each criterion that declares a proof other than `test` as current, out of date or missing at the checkout's HEAD, or at the head of a linked pull request that is open or merged. Exits 0 when every proof is current, 1 when any is not, and 2 when it cannot tell. With `--record`, it first reruns the tests at HEAD that name each proof that is not current, through `.outerlayer-proofs.yaml`, and emits what they write. |
 | `outerlayer work demo --item <n> [--json]` | Print the item's newest demo record: its artifact id, the commit it was recorded at and the test that recorded it. `--json` prints `{ "demo": null }` for an item with no demo. |
 | `outerlayer work logs --item <n> [--attempt <claim id>]` | Print the runner's log for a host attempt on a work item: the newest attempt a runner made, or the one `--attempt` names (an `id` from `claims` in `work status --json`). The log is what the runner did around the agent, with secrets removed on the host. Exits 1 for an attempt that is still running or that an older runner released without a log. |
 | `outerlayer work threads --item <n>` | Read a work item's threads back — the general thread first, then one per criterion with proof or a comment, each with its `waitingOn`. |

package/dist/{agent-setup-FBAT5LGX.js → agent-setup-HEJM3D3V.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-74Q24R3B.js';
-import './chunk-B5MSDF5B.js';
+export { keepHandWritten, runAgentSetup } from './chunk-5QBUX5YZ.js';
+import './chunk-2AIOOU3A.js';
 import './chunk-KT4CN6OU.js';
-import './chunk-XFAJQZN2.js';
-import './chunk-TIRHZC2M.js';
+import './chunk-4P6QGMPN.js';
+import './chunk-NKOM4JKY.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-B44BFR2Q.js';
-import './chunk-UF2FU3CM.js';
+import './chunk-O6DYCIVW.js';
+import './chunk-JWNH4ZTF.js';
 import './chunk-6RKD7YZ6.js';
 import './chunk-PJDQPF5N.js';
 import './chunk-SOI6K5DY.js';
@@ -15,15 +15,15 @@ import './chunk-PA6CK6WQ.js';
 import './chunk-BALIE3BA.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-ZGB4ZJ5E.js';
+import './chunk-ZQSANKS4.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
 import './chunk-CRB3POP4.js';
-import './chunk-YPCDDQFU.js';
+import './chunk-DQ6YO7FH.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-CQRPR4WZ.js';
+import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-HACGUL52.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-24T17:47:37.980Z+5ab4e80","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-24T22:57:19.596Z+5cf285c","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-K4I4EBEK.js → check-OOUGS65D.js}

@@ -1,25 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-DFLHVTXI.js';
+import { probeCredentials } from './chunk-4Y54SQXH.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-PBIYM2Z6.js';
+import './chunk-YIBFGAYI.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-XLJHFZRL.js';
-import './chunk-DA3PLB5N.js';
 import './chunk-GH246BGV.js';
+import './chunk-E4ASIOVL.js';
+import './chunk-ACRRO3MB.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-57L2YAJA.js';
+import './chunk-DA3PLB5N.js';
 import './chunk-HVRQQOMH.js';
 import './chunk-6LBSAW6I.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-SMAZA7DM.js';
-import './chunk-HBVHRC3A.js';
-import './chunk-5XZ6BUPH.js';
+import './chunk-XFFUXXI4.js';
+import './chunk-YGSY2NWU.js';
+import './chunk-QMWUPRYQ.js';
 import './chunk-ESVW4MJY.js';
-import { managedProblems, managedFactsOf } from './chunk-ZADIXMKT.js';
+import { managedProblems, managedFactsOf } from './chunk-7WM7K2DY.js';
 import './chunk-NBZ7XBT6.js';
 import './chunk-TBT347UY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-TFKROYY2.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-YEVPRO7L.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-2JB4GD34.js';
 import './chunk-ZVLSYWDF.js';
@@ -28,7 +29,7 @@ import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-5THSC6BD.js';
 import './chunk-L26V6ILJ.js';
-import './chunk-6AQLRSYU.js';
+import './chunk-62LXQM7U.js';
 import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME } from './chunk-AMEM2ZLL.js';
@@ -37,31 +38,31 @@ import './chunk-ZYKFYNES.js';
 import './chunk-43I7PXDP.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-ES4ULBAL.js';
-import './chunk-HIGP4WOC.js';
+import './chunk-Z4KWHSO4.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-OHJDH5GV.js';
-import './chunk-NVDPSH72.js';
+import './chunk-6NUPXDAA.js';
+import './chunk-EE2ZZGQV.js';
 import './chunk-MECW77XP.js';
 import './chunk-6ZFY2L2T.js';
-import './chunk-TIRHZC2M.js';
+import './chunk-NKOM4JKY.js';
 import './chunk-Y5YCX6AL.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-B44BFR2Q.js';
-import './chunk-UF2FU3CM.js';
+import './chunk-O6DYCIVW.js';
+import './chunk-JWNH4ZTF.js';
 import './chunk-6RKD7YZ6.js';
 import './chunk-PJDQPF5N.js';
 import './chunk-SOI6K5DY.js';
 import './chunk-PA6CK6WQ.js';
 import { claudeEnvPath } from './chunk-BALIE3BA.js';
-import './chunk-SHIGGHZO.js';
+import './chunk-65AKMFBH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-ZGB4ZJ5E.js';
+import './chunk-ZQSANKS4.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -71,7 +72,7 @@ import './chunk-CRB3POP4.js';
 import './chunk-URIZRCRY.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-CQRPR4WZ.js';
+import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
 import { parseRunnerEnv } from './chunk-HACGUL52.js';

package/dist/{chunk-SVLFZLTE.js → chunk-272AKVRP.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { isAgentsMdLayout } from './chunk-TIRHZC2M.js';
+import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-6RKD7YZ6.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { machineSkillsState, staleClaudeSkills } from './chunk-HMCBX3PL.js';
-import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-ZGB4ZJ5E.js';
+import { machineSkillsState, staleClaudeSkills } from './chunk-RCRE42V6.js';
+import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-ZQSANKS4.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-YPCDDQFU.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-CQRPR4WZ.js';
+import { hasSymlinkComponent } from './chunk-DQ6YO7FH.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-FGXT5OXS.js';
 import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, realpathSync, readdirSync } from 'fs';
 import { join, dirname, posix, basename, isAbsolute, relative } from 'path';

package/dist/{chunk-B5MSDF5B.js → chunk-2AIOOU3A.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-TIRHZC2M.js';
+import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-NKOM4JKY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-UF2FU3CM.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-ZGB4ZJ5E.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-JWNH4ZTF.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-CQRPR4WZ.js';
+import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-FGXT5OXS.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-BTHH5H5H.js → chunk-3IH6K7KG.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readNewestDemo } from './chunk-ER6KQCVJ.js';
-import { runEmitArtifact } from './chunk-MHGIN2X6.js';
+import { runEmitArtifact } from './chunk-5HZGLLNW.js';
 import { VoiceDownloadError, downloadPinned, sha256OfFile } from './chunk-2PGI6RDE.js';
 import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-ES4ULBAL.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OHJDH5GV.js';
+import { autoConnect } from './chunk-6NUPXDAA.js';
 import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';

package/dist/{chunk-XFAJQZN2.js → chunk-4P6QGMPN.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-ZGB4ZJ5E.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, loadTemplateFiles, AGENTS_SKILLS_BASE, loadMaintainedFiles, rewriteSkillPaths, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MACHINE_SKILL_PATH } from './chunk-ZQSANKS4.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-YPCDDQFU.js';
+import { linkedAgentsPath } from './chunk-DQ6YO7FH.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-DFLHVTXI.js → chunk-4Y54SQXH.js}

@@ -1,26 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-PBIYM2Z6.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-YIBFGAYI.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-XLJHFZRL.js';
-import { RUNNER_PROTOCOL } from './chunk-DA3PLB5N.js';
 import { writePendingUpdate } from './chunk-GH246BGV.js';
+import { renderUpdateSteps } from './chunk-E4ASIOVL.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-ACRRO3MB.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
-import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-ZADIXMKT.js';
+import { RUNNER_PROTOCOL } from './chunk-DA3PLB5N.js';
+import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-7WM7K2DY.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-TFKROYY2.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-YEVPRO7L.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-6AQLRSYU.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-MZBQTVFG.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-62LXQM7U.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-MZBQTVFG.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3CKMB2UK.js';
 import { freeBytes, formatBytes, volumeBytes } from './chunk-ZYKFYNES.js';
 import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43I7PXDP.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-HIGP4WOC.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-Z4KWHSO4.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
@@ -1383,16 +1384,33 @@ function considerNamedImage(state, named) {
   const own = ownVersionOf(state.deps);
   if (named === void 0 || state.imageLogged === named || (compareVersions(own, named) ?? 0) >= 0) return;
   state.imageLogged = named;
-  logOf(state).line(`the factory names ${named}, newer than the ${own} this image runs \xB7 ${pullInstruction(imageTag(named))}`);
+  logOf(state).line(`the factory names ${named}, newer than the ${own} this image runs \xB7 ${imageStepFor(state, named)}`);
 }
 function upgradeStepFor(state, floor) {
   const named = state.namedVersion ?? floor;
   const target = named !== void 0 && isVersion(named) ? named : void 0;
-  if (state.deps.image !== void 0) return pullInstruction(tagToPull(target));
+  if (state.deps.image !== void 0) return imageStepFor(state, target);
   const npm = `npm install -g @outerlayer/cli@${target ?? "latest"}, then "$(npm prefix -g)/bin/outerlayer" runner install`;
   if (state.deps.update?.underService !== true) return `${npm}, then start the runner again`;
   return builtinKind(state.config.hooks.provision) === "own" ? npm : `${npm} --service`;
 }
+function imageStepFor(state, version) {
+  const read = state.ownContainer?.read;
+  return read === void 0 ? pullInstruction(tagToPull(version)) : renderUpdateSteps(read, version);
+}
+async function readOwnContainerOnce(state) {
+  const reader = state.deps.image?.readContainer;
+  if (reader === void 0) return;
+  const held = state.ownContainer;
+  const atMs = nowOf(state).getTime();
+  const retryAfterMs2 = 5 * 6e4;
+  if (held !== void 0 && (held.read.ok || atMs - held.atMs < retryAfterMs2)) return;
+  try {
+    state.ownContainer = { read: await reader(), atMs };
+  } catch (err) {
+    state.ownContainer = { read: { ok: false, reason: describeCallFailure(err) }, atMs };
+  }
+}
 function recordImageStatus(state) {
   if (state.deps.image === void 0) return;
   const named = state.imageNamed;
@@ -1813,6 +1831,7 @@ async function housekeepingPass(state) {
   }
 }
 async function runTick(state) {
+  await readOwnContainerOnce(state);
   state.restarting = false;
   state.holdingForUpdate = false;
   if (state.draining === true) return;
@@ -1886,7 +1905,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-NR53YCXJ.js');
+  const { postJson: postJson2 } = await import('./work-cmd-LTZXOPPN.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1939,11 +1958,10 @@ async function tryClaimAndStart(state, item, queue) {
       return { kind: "outdated" };
     }
     if (claim.code === "runner_upgrade_required") {
-      const tag = tagToPull(state.imageNamed);
       reportRepeating(
         state,
         "the runner protocol",
-        state.deps.image === void 0 ? claim.message ?? claim.reason : `${claim.message ?? claim.reason} \xB7 ${pullInstruction(tag)}`
+        state.deps.image === void 0 ? claim.message ?? claim.reason : `${claim.message ?? claim.reason} \xB7 ${imageStepFor(state, state.imageNamed)}`
       );
       state.upgradeRefused = true;
       recordImageStatus(state);
@@ -3132,7 +3150,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-K4I4EBEK.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-OOUGS65D.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-MHGIN2X6.js → chunk-5HZGLLNW.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-HBVHRC3A.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-YGSY2NWU.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OHJDH5GV.js';
+import { autoConnect } from './chunk-6NUPXDAA.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-MECW77XP.js';
 import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
 import { C } from './chunk-ANPNT6PM.js';

package/dist/{chunk-74Q24R3B.js → chunk-5QBUX5YZ.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-B5MSDF5B.js';
+import { runEmit } from './chunk-2AIOOU3A.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { installStarterPack } from './chunk-XFAJQZN2.js';
-import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-TIRHZC2M.js';
+import { installStarterPack } from './chunk-4P6QGMPN.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-NKOM4JKY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-B44BFR2Q.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-ZGB4ZJ5E.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-O6DYCIVW.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-YPCDDQFU.js';
+import { linkedAgentsPath } from './chunk-DQ6YO7FH.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { generatedHeaderSource } from './chunk-CQRPR4WZ.js';
+import { generatedHeaderSource } from './chunk-FGXT5OXS.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-6AQLRSYU.js → chunk-62LXQM7U.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-HIGP4WOC.js';
-import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-B44BFR2Q.js';
+import { WorkCommandError, postJson } from './chunk-Z4KWHSO4.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-O6DYCIVW.js';
 import { signingFetchFor } from './chunk-6RKD7YZ6.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-PA6CK6WQ.js';

package/dist/{chunk-SHIGGHZO.js → chunk-65AKMFBH.js}

@@ -680,11 +680,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-YGWYIFFV.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-LUBEZB3L.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-AXBWT5CC.js');
+  const { governanceOf } = await import('./control-plane-launch-QSBWTA2V.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-OHJDH5GV.js → chunk-6NUPXDAA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-NVDPSH72.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-EE2ZZGQV.js';
 import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
 import { resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';

package/dist/{chunk-ZADIXMKT.js → chunk-7WM7K2DY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-TFKROYY2.js';
+import { placeholderQueues, placeholderProblem } from './chunk-YEVPRO7L.js';
 import { checkFit } from './chunk-AMEM2ZLL.js';
 import { builtinKind, imageBuildOf } from './chunk-3CKMB2UK.js';
 import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-ZYKFYNES.js';

package/dist/{chunk-XLJHFZRL.js → chunk-ACRRO3MB.js}

@@ -4,29 +4,29 @@ import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HVRQQOMH.js';
 import { writeDockerClientConfig } from './chunk-6LBSAW6I.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-SMAZA7DM.js';
-import { installScrubContext } from './chunk-HBVHRC3A.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-TFKROYY2.js';
+import { senderPidfile } from './chunk-XFFUXXI4.js';
+import { installScrubContext } from './chunk-YGSY2NWU.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-YEVPRO7L.js';
 import { readBranchHead, fetchCommit, diffBetween } from './chunk-ZVLSYWDF.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-5THSC6BD.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-L26V6ILJ.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-6AQLRSYU.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-62LXQM7U.js';
 import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-3CKMB2UK.js';
 import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-ZYKFYNES.js';
 import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-43I7PXDP.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-ES4ULBAL.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-HIGP4WOC.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-Z4KWHSO4.js';
 import { planArtifactUpload } from './chunk-MECW77XP.js';
 import { scrubText } from './chunk-6ZFY2L2T.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-SOI6K5DY.js';
 import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PA6CK6WQ.js';
 import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BALIE3BA.js';
-import { resolvePackRoot } from './chunk-ZGB4ZJ5E.js';
+import { resolvePackRoot } from './chunk-ZQSANKS4.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { parsePolicy } from './chunk-CQRPR4WZ.js';
+import { parsePolicy } from './chunk-FGXT5OXS.js';
 import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { fdName } from './chunk-HACGUL52.js';

package/dist/{chunk-OLCIPTST.js → chunk-AP2K4LPI.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-XFAJQZN2.js';
-import { skillsBaseFor } from './chunk-TIRHZC2M.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-4P6QGMPN.js';
+import { skillsBaseFor } from './chunk-NKOM4JKY.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-ZGB4ZJ5E.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-YPCDDQFU.js';
+import { hasSymlinkComponent } from './chunk-DQ6YO7FH.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';

package/dist/{chunk-YPCDDQFU.js → chunk-DQ6YO7FH.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
 import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import { CONTEXT_PIN_FILENAME } from './chunk-CQRPR4WZ.js';
+import { CONTEXT_PIN_FILENAME } from './chunk-FGXT5OXS.js';
 import { execFileSync } from 'child_process';
 import { lstatSync, existsSync, unlinkSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';