@outerlayer/cli 0.34.0-next.20261024174615 → 0.34.0-next.20261024225538

package/dist/chunk-E4ASIOVL.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { stripTerminalControls } from './chunk-ACRRO3MB.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-MZBQTVFG.js';
+import { readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+var COMPOSE_PROJECT_LABEL = "com.docker.compose.project";
+var COMPOSE_SERVICE_LABEL = "com.docker.compose.service";
+var COMPOSE_DIR_LABEL = "com.docker.compose.project.working_dir";
+function firstLine(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+function candidateIds(env, readFile) {
+  const found = [];
+  const hostname = env.HOSTNAME?.trim();
+  if (hostname !== void 0 && hostname !== "") found.push(hostname);
+  try {
+    for (const match of readFile("/proc/self/mountinfo").matchAll(/\/containers\/([0-9a-f]{64})\//g)) {
+      if (!found.includes(match[1])) found.push(match[1]);
+    }
+  } catch {
+  }
+  return found;
+}
+function bindDestination(bind) {
+  const parts = bind.split(":");
+  if (parts.length >= 3 && !parts[parts.length - 1].startsWith("/")) parts.pop();
+  return parts[parts.length - 1];
+}
+function mountsOf(row) {
+  const binds = row.HostConfig?.Binds ?? [];
+  const covered = new Set(binds.map(bindDestination));
+  const values = [...binds];
+  for (const mount of row.Mounts ?? []) {
+    if (mount.Destination === void 0 || covered.has(mount.Destination)) continue;
+    const source = mount.Type === "volume" ? mount.Name : mount.Type === "bind" ? mount.Source : void 0;
+    if (source === void 0 || source === "") continue;
+    values.push(`${source}:${mount.Destination}${mount.RW === false ? ":ro" : ""}`);
+  }
+  return values;
+}
+function restartOf(row) {
+  const policy = row.HostConfig?.RestartPolicy;
+  if (policy?.Name === void 0 || policy.Name === "" || policy.Name === "no") return void 0;
+  return policy.Name === "on-failure" && (policy.MaximumRetryCount ?? 0) > 0 ? `on-failure:${policy.MaximumRetryCount}` : policy.Name;
+}
+function networkOf(row) {
+  const mode = row.HostConfig?.NetworkMode;
+  return mode === void 0 || mode === "" || mode === "default" || mode === "bridge" ? void 0 : mode;
+}
+function envNamesOf(row, imageEnv) {
+  const own = new Set(imageEnv);
+  const names = (row.Config?.Env ?? []).filter((entry) => !own.has(entry)).map((entry) => entry.split("=")[0]);
+  return [...new Set(names)].sort();
+}
+async function readOwnContainer(deps = {}) {
+  const run = deps.run ?? (await import('./docker-DJ73SZRC.js')).spawnRun;
+  const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
+  if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
+  let problem = "";
+  let row;
+  for (const id of ids) {
+    try {
+      const result = await run("docker", ["inspect", id], { timeoutMs: 2e4 });
+      if (result.status !== 0) {
+        problem ||= firstLine(result.stderr) || `docker inspect exited with status ${result.status}`;
+        continue;
+      }
+      const parsed = JSON.parse(result.stdout)[0];
+      if (parsed?.Id !== void 0 && parsed.Id.startsWith(id)) {
+        row = parsed;
+        break;
+      }
+      problem ||= `docker inspect ${id} named another container`;
+    } catch (err) {
+      problem ||= err instanceof Error ? err.message : String(err);
+    }
+  }
+  if (row === void 0) {
+    return { ok: false, reason: `the runner could not read its container with \`docker inspect\` (is the Docker socket mounted?): ${problem}` };
+  }
+  const name = row.Name?.replace(/^\//, "");
+  const image = row.Config?.Image;
+  if (name === void 0 || name === "" || image === void 0 || image === "") {
+    return { ok: false, reason: "docker inspect gave no name or image for the container" };
+  }
+  let imageEnv = [];
+  if (row.Image !== void 0) {
+    try {
+      const result = await run("docker", ["image", "inspect", row.Image], { timeoutMs: 2e4 });
+      if (result.status === 0) imageEnv = JSON.parse(result.stdout)[0]?.Config?.Env ?? [];
+    } catch {
+    }
+  }
+  const labels = row.Config?.Labels ?? {};
+  const project = labels[COMPOSE_PROJECT_LABEL];
+  return {
+    ok: true,
+    container: {
+      name,
+      image,
+      mounts: mountsOf(row),
+      ...restartOf(row) === void 0 ? {} : { restart: restartOf(row) },
+      ...networkOf(row) === void 0 ? {} : { network: networkOf(row) },
+      envNames: envNamesOf(row, imageEnv),
+      ...project === void 0 || project === "" ? {} : { compose: { project, service: labels[COMPOSE_SERVICE_LABEL], workingDir: labels[COMPOSE_DIR_LABEL] } }
+    }
+  };
+}
+function shellWord(raw) {
+  const value = stripTerminalControls(raw);
+  return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+}
+function variablesNote(names) {
+  return names.length === 0 ? ["The container sets no variables of its own."] : [`The container sets these variables. Check that your env file sets each one: ${names.map(stripTerminalControls).join(", ")}`];
+}
+function renderUpdateSteps(read, version) {
+  const tag = version === void 0 ? tagToPull(void 0) : imageTag(version);
+  if (!read.ok) return `${pullInstruction(tag)} \xB7 the runner could not print exact commands: ${stripTerminalControls(read.reason)}`;
+  const c = read.container;
+  const lines = [];
+  if (c.compose !== void 0) {
+    const dir = c.compose.workingDir === void 0 ? "" : stripTerminalControls(c.compose.workingDir);
+    const where = dir === "" ? "" : ` in ${dir}`;
+    lines.push(
+      `Update the runner that Docker Compose started (project ${stripTerminalControls(c.compose.project)}). Run these commands${where}:`,
+      `1. Set the image of the runner service in your Compose file to ${tag}. Skip this step when it names a tag that moves, such as latest.`,
+      "2. docker compose pull",
+      "3. docker compose up -d",
+      `4. Check that the new runner is up: docker logs ${shellWord(c.name)}`,
+      `   Look for no line that says the gateway refuses work from this runner. docker exec ${shellWord(c.name)} outerlayer --version prints ${version ?? "the new version"}.`,
+      ...variablesNote(c.envNames)
+    );
+    return lines.join("\n");
+  }
+  const name = shellWord(c.name);
+  const old = shellWord(`${c.name}-old`);
+  const run = [
+    `docker run -d --name ${name}`,
+    ...c.restart === void 0 ? [] : [`--restart ${shellWord(c.restart)}`],
+    ...c.network === void 0 ? [] : [`--network ${shellWord(c.network)}`],
+    ...c.mounts.map((mount) => `-v ${shellWord(mount)}`),
+    "--env-file <the file you started it with>",
+    tag
+  ];
+  lines.push(
+    `Update the runner to ${tag}. The steps keep the old container as ${stripTerminalControls(c.name)}-old until the new one runs.`,
+    `1. docker pull ${tag}`,
+    `2. docker stop ${name}`,
+    `   docker rename ${name} ${old}`,
+    `3. ${run.join(" \\\n     ")}`,
+    `4. Check that the new runner is up: docker logs ${name}`,
+    `   Look for no line that says the gateway refuses work from this runner. docker exec ${name} outerlayer --version prints ${version ?? "the new version"}.`,
+    "5. Only after that check, remove the old container:",
+    `   docker rm ${old}`,
+    ...variablesNote(c.envNames)
+  );
+  return lines.join("\n");
+}
+async function runUpdateSteps(deps) {
+  const env = deps.env ?? process.env;
+  const named = readUpdateStatus(deps.runnerDirPath)?.named;
+  if (runnerImageVersion(env) === void 0) {
+    return `npm install -g @outerlayer/cli@${named ?? "latest"}, then "$(npm prefix -g)/bin/outerlayer" runner install, then start the runner again \xB7 this runner is not in the container image, so there is no container to read. A service runner uses \`runner install --service\` and updates itself.`;
+  }
+  return renderUpdateSteps(await readOwnContainer({ ...deps, env }), named);
+}
+
+export { readOwnContainer, renderUpdateSteps, runUpdateSteps };

package/dist/{chunk-NVDPSH72.js → chunk-EE2ZZGQV.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { remoteLookupFailed } from './chunk-6ZFY2L2T.js';
-import { isAgentsMdLayout } from './chunk-TIRHZC2M.js';
+import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
 import { DEFAULT_DASHBOARD } from './chunk-Y5YCX6AL.js';
 import { cliFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';

package/dist/{chunk-GWF3ZRUX.js → chunk-EN3YWO7Q.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-HIGP4WOC.js';
+import { resolveCredentials, postJson, getJson } from './chunk-Z4KWHSO4.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';

package/dist/{chunk-CQRPR4WZ.js → chunk-FGXT5OXS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ArtifactCriterionIdSchema, ARTIFACT_KINDS } from './chunk-EOTMDIYC.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-EOTMDIYC.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);
@@ -1460,7 +1460,7 @@ var require_stringify = __commonJS({
         props.push(doc.directives.tagString(tag));
       return props.join(" ");
     }
-    function stringify2(item, ctx, onComment, onChompKeep) {
+    function stringify(item, ctx, onComment, onChompKeep) {
       if (identity.isPair(item))
         return item.toString(ctx, onComment, onChompKeep);
       if (identity.isAlias(item)) {
@@ -1489,7 +1489,7 @@ var require_stringify = __commonJS({
 ${ctx.indent}${str}`;
     }
     exports$1.createStringifyContext = createStringifyContext;
-    exports$1.stringify = stringify2;
+    exports$1.stringify = stringify;
   }
 });
 
@@ -1498,7 +1498,7 @@ var require_stringifyPair = __commonJS({
   "../../node_modules/yaml/dist/stringify/stringifyPair.js"(exports$1) {
     var identity = require_identity();
     var Scalar = require_Scalar();
-    var stringify2 = require_stringify();
+    var stringify = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
       const { allNullValues, doc, indent, indentStep, options: { commentString, indentSeq, simpleKeys } } = ctx;
@@ -1520,7 +1520,7 @@ var require_stringifyPair = __commonJS({
       });
       let keyCommentDone = false;
       let chompKeep = false;
-      let str = stringify2.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+      let str = stringify.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
       if (!explicitKey && !ctx.inFlow && str.length > 1024) {
         if (simpleKeys)
           throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
@@ -1572,7 +1572,7 @@ ${indent}:`;
         ctx.indent = ctx.indent.substring(2);
       }
       let valueCommentDone = false;
-      const valueStr = stringify2.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
+      const valueStr = stringify.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
       let ws = " ";
       if (keyComment || vsb || vcb) {
         ws = vsb ? "\n" : "";
@@ -1710,7 +1710,7 @@ var require_addPairToJSMap = __commonJS({
   "../../node_modules/yaml/dist/nodes/addPairToJSMap.js"(exports$1) {
     var log = require_log();
     var merge = require_merge();
-    var stringify2 = require_stringify();
+    var stringify = require_stringify();
     var identity = require_identity();
     var toJS = require_toJS();
     function addPairToJSMap(ctx, map, { key, value }) {
@@ -1746,7 +1746,7 @@ var require_addPairToJSMap = __commonJS({
       if (typeof jsKey !== "object")
         return String(jsKey);
       if (identity.isNode(key) && ctx?.doc) {
-        const strCtx = stringify2.createStringifyContext(ctx.doc, {});
+        const strCtx = stringify.createStringifyContext(ctx.doc, {});
         strCtx.anchors = /* @__PURE__ */ new Set();
         for (const node of ctx.anchors.keys())
           strCtx.anchors.add(node.anchor);
@@ -1811,12 +1811,12 @@ var require_Pair = __commonJS({
 var require_stringifyCollection = __commonJS({
   "../../node_modules/yaml/dist/stringify/stringifyCollection.js"(exports$1) {
     var identity = require_identity();
-    var stringify2 = require_stringify();
+    var stringify = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyCollection(collection, ctx, options) {
       const flow = ctx.inFlow ?? collection.flow;
-      const stringify3 = flow ? stringifyFlowCollection : stringifyBlockCollection;
-      return stringify3(collection, ctx, options);
+      const stringify2 = flow ? stringifyFlowCollection : stringifyBlockCollection;
+      return stringify2(collection, ctx, options);
     }
     function stringifyBlockCollection({ comment, items }, ctx, { blockItemPrefix, flowChars, itemIndent, onChompKeep, onComment }) {
       const { indent, options: { commentString } } = ctx;
@@ -1841,7 +1841,7 @@ var require_stringifyCollection = __commonJS({
           }
         }
         chompKeep = false;
-        let str2 = stringify2.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
+        let str2 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
         if (comment2)
           str2 += stringifyComment.lineComment(str2, itemIndent, commentString(comment2));
         if (chompKeep && comment2)
@@ -1908,7 +1908,7 @@ ${indent}${line}` : "\n";
         }
         if (comment)
           reqNewline = true;
-        let str = stringify2.stringify(item, itemCtx, () => comment = null);
+        let str = stringify.stringify(item, itemCtx, () => comment = null);
         reqNewline || (reqNewline = lines.length > linesAtValue || str.includes("\n"));
         if (i < items.length - 1) {
           str += ",";
@@ -3245,7 +3245,7 @@ var require_Schema = __commonJS({
 var require_stringifyDocument = __commonJS({
   "../../node_modules/yaml/dist/stringify/stringifyDocument.js"(exports$1) {
     var identity = require_identity();
-    var stringify2 = require_stringify();
+    var stringify = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyDocument(doc, options) {
       const lines = [];
@@ -3260,7 +3260,7 @@ var require_stringifyDocument = __commonJS({
       }
       if (hasDirectives)
         lines.push("---");
-      const ctx = stringify2.createStringifyContext(doc, options);
+      const ctx = stringify.createStringifyContext(doc, options);
       const { commentString } = ctx.options;
       if (doc.commentBefore) {
         if (lines.length !== 1)
@@ -3282,7 +3282,7 @@ var require_stringifyDocument = __commonJS({
           contentComment = doc.contents.comment;
         }
         const onChompKeep = contentComment ? void 0 : () => chompKeep = true;
-        let body = stringify2.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
+        let body = stringify.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
         if (contentComment)
           body += stringifyComment.lineComment(body, "", commentString(contentComment));
         if ((body[0] === "|" || body[0] === ">") && lines[lines.length - 1] === "---") {
@@ -3290,7 +3290,7 @@ var require_stringifyDocument = __commonJS({
         } else
           lines.push(body);
       } else {
-        lines.push(stringify2.stringify(doc.contents, ctx));
+        lines.push(stringify.stringify(doc.contents, ctx));
       }
       if (doc.directives?.docEnd) {
         if (doc.comment) {
@@ -5406,7 +5406,7 @@ var require_cst_scalar = __commonJS({
 // ../../node_modules/yaml/dist/parse/cst-stringify.js
 var require_cst_stringify = __commonJS({
   "../../node_modules/yaml/dist/parse/cst-stringify.js"(exports$1) {
-    var stringify2 = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
+    var stringify = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
     function stringifyToken(token) {
       switch (token.type) {
         case "block-scalar": {
@@ -5459,7 +5459,7 @@ var require_cst_stringify = __commonJS({
         res += stringifyToken(value);
       return res;
     }
-    exports$1.stringify = stringify2;
+    exports$1.stringify = stringify;
   }
 });
 
@@ -7183,7 +7183,7 @@ var require_public_api = __commonJS({
       }
       return doc.toJS(Object.assign({ reviver: _reviver }, options));
     }
-    function stringify2(value, replacer, options) {
+    function stringify(value, replacer, options) {
       let _replacer = null;
       if (typeof replacer === "function" || Array.isArray(replacer)) {
         _replacer = replacer;
@@ -7208,7 +7208,7 @@ var require_public_api = __commonJS({
     exports$1.parse = parse2;
     exports$1.parseAllDocuments = parseAllDocuments;
     exports$1.parseDocument = parseDocument2;
-    exports$1.stringify = stringify2;
+    exports$1.stringify = stringify;
   }
 });
 
@@ -8707,126 +8707,56 @@ function sessionsToTimeline(sessions) {
   });
   return out;
 }
-var DEMO = "demo";
+var FILES_PLACEHOLDER = "{files}";
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function load(text) {
-  let raw;
-  try {
-    raw = (0, import_yaml.parse)(text);
-  } catch (err) {
-    return { ok: false, problems: [`the file is not valid YAML: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`] };
-  }
-  if (raw === null || raw === void 0) return { ok: true, value: {} };
-  if (!isRecord2(raw)) return { ok: false, problems: ["the file must be a mapping"] };
-  return { ok: true, value: raw };
-}
 function unknownKeys(record, known, where, problems) {
   for (const key of Object.keys(record)) {
     if (!known.includes(key)) problems.push(`${where}: unknown key "${key}"`);
   }
 }
-function criterionId(value, where, problems) {
-  if (typeof value !== "string" || !ArtifactCriterionIdSchema.safeParse(value).success) {
-    problems.push(`${where}: "${String(value)}" is not a criterion id (1-64 characters of letters, digits, "_", ".", ":" or "-")`);
-    return void 0;
-  }
-  return value;
-}
-function parseProofRecipe(text) {
-  var _a, _b;
-  const loaded = load(text);
-  if (!loaded.ok) return loaded;
-  const root = loaded.value;
-  const problems = [];
-  unknownKeys(root, ["run", "manual"], "recipe", problems);
-  const run = [];
-  const manual = [];
-  const named = /* @__PURE__ */ new Map();
-  const name = (id, where) => {
-    const earlier = named.get(id);
-    if (earlier !== void 0) problems.push(`${where}: criterion ${id} is already named in ${earlier}. Name each criterion in one place`);
-    else named.set(id, where);
-  };
-  const runRaw = (_a = root.run) != null ? _a : [];
-  if (!Array.isArray(runRaw)) problems.push("run: must be a list");
-  else {
-    let demos = 0;
-    runRaw.forEach((entry, index) => {
-      const where = `run[${index}]`;
-      if (!isRecord2(entry)) {
-        problems.push(`${where}: must be a mapping with command, emit and for`);
-        return;
-      }
-      unknownKeys(entry, ["command", "emit", "for"], where, problems);
-      const { command, emit } = entry;
-      if (typeof command !== "string") problems.push(`${where}: command must be a string`);
-      if (typeof emit !== "string") problems.push(`${where}: emit must be "${DEMO}" or a path in the repository`);
-      if (typeof command !== "string" || typeof emit !== "string") return;
-      if (emit === DEMO) {
-        demos += 1;
-        if (demos > 1) problems.push(`${where}: a recipe has one demo entry`);
-        if (entry.for !== void 0) problems.push(`${where}: a demo entry takes no "for". Its chapters name their criteria`);
-        run.push({ command, emit });
-        return;
-      }
-      if (entry.for === void 0) {
-        problems.push(`${where}: a command entry needs "for", the criterion its file proves`);
-        return;
-      }
-      const id = criterionId(entry.for, `${where}.for`, problems);
-      if (id === void 0) return;
-      name(id, where);
-      run.push({ command, emit, for: id });
-    });
-  }
-  const manualRaw = (_b = root.manual) != null ? _b : [];
-  if (!Array.isArray(manualRaw)) problems.push("manual: must be a list");
-  else {
-    manualRaw.forEach((entry, index) => {
-      const where = `manual[${index}]`;
-      if (!isRecord2(entry)) {
-        problems.push(`${where}: must be a mapping with criterion and reason`);
-        return;
-      }
-      unknownKeys(entry, ["criterion", "reason"], where, problems);
-      const id = criterionId(entry.criterion, `${where}.criterion`, problems);
-      if (typeof entry.reason !== "string" || entry.reason.trim() === "") {
-        problems.push(`${where}: reason must say why a person records this proof`);
-        return;
-      }
-      if (id === void 0) return;
-      name(id, where);
-      manual.push({ criterion: id, reason: entry.reason });
-    });
+function parseProofsConfig(text) {
+  let raw;
+  try {
+    raw = (0, import_yaml.parse)(text);
+  } catch (err) {
+    return { ok: false, problems: [`the file is not valid YAML: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`] };
   }
-  return problems.length > 0 ? { ok: false, problems } : { ok: true, value: { run, manual } };
-}
-function parseProofSetup(text) {
-  const loaded = load(text);
-  if (!loaded.ok) return loaded;
-  const root = loaded.value;
+  const root = raw === null || raw === void 0 ? {} : raw;
+  if (!isRecord2(root)) return { ok: false, problems: ["the file must be a mapping"] };
   const problems = [];
-  unknownKeys(root, ["setup", "teardown"], "setup file", problems);
-  const commands = (key, value) => {
+  unknownKeys(root, ["setup", "teardown", "runners"], "proofs file", problems);
+  const commands = (key) => {
+    const value = root[key];
+    if (value === void 0) return [];
     if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && entry.trim() !== "")) {
       problems.push(`${key}: must be a list of commands`);
       return [];
     }
     return value;
   };
-  if (!("setup" in root)) problems.push("setup: the file needs a setup list. Use an empty list for no setup");
-  const setup = "setup" in root ? commands("setup", root.setup) : [];
-  const teardown = root.teardown === void 0 ? void 0 : commands("teardown", root.teardown);
-  if (problems.length > 0) return { ok: false, problems };
-  return { ok: true, value: { setup, ...teardown === void 0 ? {} : { teardown } } };
-}
-function renderProofRecipe(recipe) {
-  return (0, import_yaml.stringify)({ run: recipe.run, manual: recipe.manual }, { lineWidth: 0 });
-}
-function renderProofSetup(setup) {
-  return (0, import_yaml.stringify)({ setup: setup.setup, ...setup.teardown === void 0 ? {} : { teardown: setup.teardown } }, { lineWidth: 0 });
+  const setup = commands("setup");
+  const teardown = commands("teardown");
+  const runners = [];
+  if (!Array.isArray(root.runners)) {
+    problems.push("runners: the file needs a runners list. Use an empty list for no runner");
+  } else {
+    root.runners.forEach((entry, index) => {
+      const where = `runners[${index}]`;
+      if (!isRecord2(entry)) {
+        problems.push(`${where}: must be a mapping with files and command`);
+        return;
+      }
+      unknownKeys(entry, ["files", "command"], where, problems);
+      const { files, command } = entry;
+      if (typeof files !== "string" || files.trim() === "") problems.push(`${where}: files must be a glob string`);
+      if (typeof command !== "string" || command.trim() === "") problems.push(`${where}: command must be a string`);
+      else if (!command.includes(FILES_PLACEHOLDER)) problems.push(`${where}: command must contain ${FILES_PLACEHOLDER}, where the matched test files go`);
+      if (typeof files === "string" && files.trim() !== "" && typeof command === "string" && command.includes(FILES_PLACEHOLDER)) runners.push({ files, command });
+    });
+  }
+  return problems.length > 0 ? { ok: false, problems } : { ok: true, value: { setup, teardown, runners } };
 }
 
-export { ALL_TARGET_IDS, CONTEXT_PIN_FILENAME, classifyTree, emitTree, extractFacts, generatedHeaderSource, normalizePath, normalizeRepoName, orderSessions, parseOuterlayerConfig, parsePolicy, parseProofRecipe, parseProofSetup, renderProofRecipe, renderProofSetup, sessionsToTimeline, splitRawFile };
+export { ALL_TARGET_IDS, CONTEXT_PIN_FILENAME, classifyTree, emitTree, extractFacts, generatedHeaderSource, normalizePath, normalizeRepoName, orderSessions, parseOuterlayerConfig, parsePolicy, parseProofsConfig, sessionsToTimeline, splitRawFile };

package/dist/{chunk-3KT2IWV3.js → chunk-FVKH3PMV.js}

@@ -1,20 +1,66 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-HIGP4WOC.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-Z4KWHSO4.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch } from './chunk-6RKD7YZ6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import { inferArtifactKind, mediaTypeForArtifactPath, WORK_ITEM_COMMENT_MAX_BODY_LENGTH } from './chunk-EOTMDIYC.js';
+import { createHash } from 'crypto';
 
 createRequire(import.meta.url);
+function kindProblem(declared, file) {
+  if (declared === "test") return "a test proof is recorded by CI, not by --record";
+  const kind = inferArtifactKind(mediaTypeForArtifactPath(file));
+  return kind === declared ? void 0 : `the kinds differ: the file is a ${kind}, but the criterion declares a ${declared} proof`;
+}
+function proofsCommentBody(head, lines) {
+  const header = `These proofs are not current at ${head.slice(0, 7)}:`;
+  const rows = lines.map((line) => `- ${line.id} (${line.proof}): ${line.reason}`);
+  const fits = (count2) => {
+    const left = rows.length - count2;
+    return [header, ...rows.slice(0, count2), ...left > 0 ? [`and ${left} more.`] : []].join("\n");
+  };
+  let count = rows.length;
+  while (count > 0 && fits(count).length > WORK_ITEM_COMMENT_MAX_BODY_LENGTH) count -= 1;
+  return fits(count);
+}
+function proofsCommentId(item, head, lines) {
+  const list = [...lines].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((line) => [line.id, line.proof, line.reason]);
+  const digest = createHash("sha256").update(JSON.stringify([item, head.toLowerCase(), list])).digest("hex");
+  return `proofs-${digest.slice(0, 32)}`;
+}
+function repositoryName(repository) {
+  return repository.replace(/\.git$/, "").split("/").filter((part) => part !== "").slice(-2).join("/").toLowerCase();
+}
+function ownPullRequest(pullRequests, requested, checkoutRepository) {
+  if (requested !== void 0) return { pr: requested };
+  const here = checkoutRepository === void 0 ? void 0 : repositoryName(checkoutRepository);
+  const open = pullRequests.filter(
+    (pr) => pr.state === "open" && typeof pr.prNumber === "number" && (here === void 0 || repositoryName(pr.repository ?? "") === here)
+  );
+  if (open.length > 1) return { ambiguous: open.map((pr) => pr.prNumber) };
+  return { pr: open[0]?.prNumber };
+}
 
 // src/work-proofs-cmd.ts
 function liveHead(pr) {
   if (pr.state !== "open" && pr.state !== "merged" || typeof pr.headSha !== "string" || pr.headSha === "") return void 0;
   return pr.headSha.toLowerCase();
 }
+function otherPullRequestHeads(pullRequests, ownPr, checkoutRepository) {
+  const here = checkoutRepository === void 0 ? void 0 : repositoryName(checkoutRepository);
+  const heads = /* @__PURE__ */ new Set();
+  for (const pr of pullRequests) {
+    const head = liveHead(pr);
+    if (head === void 0) continue;
+    const isOwn = ownPr !== void 0 && pr.prNumber === ownPr && (here === void 0 || repositoryName(pr.repository ?? "") === here);
+    if (!isOwn) heads.add(head);
+  }
+  return heads;
+}
 function classifyProofs(data, checkoutHead) {
   const heads = /* @__PURE__ */ new Set();
   if (checkoutHead !== void 0 && checkoutHead !== "") heads.add(checkoutHead.toLowerCase());
@@ -83,14 +129,8 @@ async function runWorkProofs(opts) {
 }
 async function runWorkProofsCommand(opts) {
   try {
-    if (opts.init) {
-      const { runWorkProofsInit } = await import('./work-proofs-init-GNGI7PZU.js');
-      await runWorkProofsInit(opts);
-      process.exitCode = 0;
-      return;
-    }
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-HTWSMEDG.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-XPAU7N57.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;
@@ -108,4 +148,4 @@ async function runWorkProofsCommand(opts) {
   }
 }
 
-export { classifyProofs, classifyProofsAt, liveHead, resolveProofsItem, runWorkProofs, runWorkProofsCommand };
+export { classifyProofs, classifyProofsAt, kindProblem, otherPullRequestHeads, ownPullRequest, proofsCommentBody, proofsCommentId, resolveProofsItem, runWorkProofs, runWorkProofsCommand };

package/dist/{chunk-UF2FU3CM.js → chunk-JWNH4ZTF.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-ZGB4ZJ5E.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-CQRPR4WZ.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-FGXT5OXS.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-2G7PJAJZ.js → chunk-K5Q6T7SE.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OHJDH5GV.js';
+import { autoConnect } from './chunk-6NUPXDAA.js';
 import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';

package/dist/{chunk-TIRHZC2M.js → chunk-NKOM4JKY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-ZGB4ZJ5E.js';
-import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-CQRPR4WZ.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-ZQSANKS4.js';
+import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-FGXT5OXS.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';