@outerlayer/cli 0.34.0-next.20261024231715 → 0.34.0-next.20261025133402

package/README.md

@@ -328,6 +328,12 @@ content:
   files and no credential for the control plane. The runner deletes the staged
   copy before the command starts. A host that cannot read the control plane
   fails the build at provision.
+- **`outerlayer runner start` on a managed runner** asks your gateway for the
+  factory's stored Anthropic API key once for each claim (`POST
+  /v1/work-items/{id}/claim/anthropic-key`, signed with the host key), before it
+  provisions the build. The runner keeps the key in memory only, gives it to
+  the build's model traffic, and forgets it when the attempt ends. It never
+  writes the key to disk or to a log.
 - **`outerlayer runner start` with `builtin:process` hooks** runs each build
   as a process under the runner's own user, with no isolation, and the
   attempt records `shared-user`. The runner clones the item's repository

package/dist/{agent-setup-HEJM3D3V.js → agent-setup-UXUWLV7O.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-5QBUX5YZ.js';
+export { keepHandWritten, runAgentSetup } from './chunk-JEOPIRUR.js';
 import './chunk-2AIOOU3A.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-4P6QGMPN.js';
 import './chunk-NKOM4JKY.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-O6DYCIVW.js';
+import './chunk-QOUR4CQ7.js';
 import './chunk-JWNH4ZTF.js';
-import './chunk-6RKD7YZ6.js';
+import './chunk-TVGLNHEB.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-SOI6K5DY.js';
-import './chunk-PA6CK6WQ.js';
-import './chunk-BALIE3BA.js';
+import './chunk-XLJLR7EK.js';
+import './chunk-N7LAEN3T.js';
+import './chunk-YOBQIXX6.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-ZQSANKS4.js';

package/dist/{bridge-NBCXFTT4.js → bridge-OWCSVCXL.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-6LBSAW6I.js';
-import './chunk-BALIE3BA.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-75KZUBHD.js';
+import './chunk-YOBQIXX6.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-LSU25G3M.js → build-4HFDZTUX.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-ZVLSYWDF.js';
-import './chunk-F5UL23I2.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-3NFZN7H6.js';
+import './chunk-ENFBYN4A.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-3Z3MPR55.js';
 import './chunk-ES4ULBAL.js';
-import './chunk-PA6CK6WQ.js';
-import './chunk-BALIE3BA.js';
+import './chunk-N7LAEN3T.js';
+import './chunk-YOBQIXX6.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-disk-LEZ6LAM3.js → build-disk-5ZQHYBO3.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-ZYKFYNES.js';
-import './chunk-43I7PXDP.js';
+export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-UC2DKBMS.js';
+import './chunk-MPDLZCXM.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-ES4ULBAL.js';
-import './chunk-6ZFY2L2T.js';
-import './chunk-SOI6K5DY.js';
-import './chunk-PA6CK6WQ.js';
-import './chunk-BALIE3BA.js';
+import './chunk-AJYZNISW.js';
+import './chunk-XLJLR7EK.js';
+import './chunk-N7LAEN3T.js';
+import './chunk-YOBQIXX6.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-24T23:18:27.314Z+1c7a05b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-25T13:35:18.143Z+b97ae23","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-I32JOQII.js → builder-54GLXGFV.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-43I7PXDP.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-MPDLZCXM.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-ES4ULBAL.js';
-import './chunk-6ZFY2L2T.js';
-import './chunk-SOI6K5DY.js';
-import './chunk-PA6CK6WQ.js';
-import './chunk-BALIE3BA.js';
+import './chunk-AJYZNISW.js';
+import './chunk-XLJLR7EK.js';
+import './chunk-N7LAEN3T.js';
+import './chunk-YOBQIXX6.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';

package/dist/{check-OOUGS65D.js → check-4TQZZOIQ.js}

@@ -1,61 +1,61 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-4Y54SQXH.js';
+import { probeCredentials } from './chunk-ZWLEUSJW.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-YIBFGAYI.js';
+import './chunk-ZV2JJPDS.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-GH246BGV.js';
-import './chunk-E4ASIOVL.js';
-import './chunk-ACRRO3MB.js';
+import './chunk-56ZHWIR2.js';
+import './chunk-Z76GVJGQ.js';
+import './chunk-RNVBSRZZ.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-57L2YAJA.js';
-import './chunk-DA3PLB5N.js';
-import './chunk-HVRQQOMH.js';
-import './chunk-6LBSAW6I.js';
+import './chunk-NW5PDZYA.js';
+import './chunk-PAK5P2ND.js';
+import './chunk-HAEDLXHA.js';
+import './chunk-75KZUBHD.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-XFFUXXI4.js';
-import './chunk-YGSY2NWU.js';
-import './chunk-QMWUPRYQ.js';
+import './chunk-KDLQGTN6.js';
+import './chunk-WIK5KUGK.js';
+import './chunk-LMICI7AY.js';
 import './chunk-ESVW4MJY.js';
-import { managedProblems, managedFactsOf } from './chunk-7WM7K2DY.js';
-import './chunk-NBZ7XBT6.js';
+import { managedProblems, managedFactsOf } from './chunk-SMMNU65K.js';
+import './chunk-DUPM5LVJ.js';
 import './chunk-TBT347UY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-YEVPRO7L.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-POGPX7LI.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-2JB4GD34.js';
-import './chunk-ZVLSYWDF.js';
-import './chunk-F5UL23I2.js';
+import './chunk-EZ7L5IZU.js';
+import './chunk-3NFZN7H6.js';
+import './chunk-ENFBYN4A.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-5THSC6BD.js';
-import './chunk-L26V6ILJ.js';
-import './chunk-62LXQM7U.js';
-import './chunk-MZBQTVFG.js';
+import './chunk-IHY457PB.js';
+import './chunk-2RBIW2PD.js';
+import './chunk-AVLLJW5D.js';
+import './chunk-36T6W5RA.js';
 import './chunk-TQMI335S.js';
-import { DEFAULT_UNIT_NAME } from './chunk-AMEM2ZLL.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-3CKMB2UK.js';
-import './chunk-ZYKFYNES.js';
-import './chunk-43I7PXDP.js';
+import { DEFAULT_UNIT_NAME } from './chunk-AABYHGVO.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-4XYC2663.js';
+import './chunk-UC2DKBMS.js';
+import './chunk-MPDLZCXM.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-ES4ULBAL.js';
-import './chunk-Z4KWHSO4.js';
+import './chunk-IW6Z337K.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-6NUPXDAA.js';
-import './chunk-EE2ZZGQV.js';
+import './chunk-3M6UYJSR.js';
+import './chunk-XA6PGME5.js';
 import './chunk-MECW77XP.js';
-import './chunk-6ZFY2L2T.js';
+import './chunk-AJYZNISW.js';
 import './chunk-NKOM4JKY.js';
 import './chunk-Y5YCX6AL.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-O6DYCIVW.js';
+import './chunk-QOUR4CQ7.js';
 import './chunk-JWNH4ZTF.js';
-import './chunk-6RKD7YZ6.js';
+import './chunk-TVGLNHEB.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-SOI6K5DY.js';
-import './chunk-PA6CK6WQ.js';
-import { claudeEnvPath } from './chunk-BALIE3BA.js';
-import './chunk-65AKMFBH.js';
+import './chunk-XLJLR7EK.js';
+import './chunk-N7LAEN3T.js';
+import { claudeEnvPath } from './chunk-YOBQIXX6.js';
+import './chunk-CXQCBAKO.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -121,7 +121,7 @@ async function runRunnerCheck(configPath, deps = {}) {
     if (unmet !== void 0) return { ok: false, check: "managed", message: `${configPath}: ${unmet.reason}` };
   }
   let credentialLine;
-  if (needsClaudeCredential(config.hooks)) {
+  if (config.managed !== true && needsClaudeCredential(config.hooks)) {
     const env = deps.env ?? process.env;
     const files = [claudeEnvPath(configPath), join(dirname(configPath), "runner.env")];
     const inShell = claudeCredentialCheck(env, { ignoreHeld: true });

package/dist/{chunk-L26V6ILJ.js → chunk-2RBIW2PD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-BALIE3BA.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-YOBQIXX6.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-MZBQTVFG.js → chunk-36T6W5RA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N7LAEN3T.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-6NUPXDAA.js → chunk-3M6UYJSR.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-EE2ZZGQV.js';
-import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
-import { resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-XA6PGME5.js';
+import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { resolveGatewayCredentials } from './chunk-TVGLNHEB.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-ZVLSYWDF.js → chunk-3NFZN7H6.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-F5UL23I2.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-ENFBYN4A.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
 import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-ES4ULBAL.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PA6CK6WQ.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BALIE3BA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-N7LAEN3T.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-YOBQIXX6.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';

package/dist/{chunk-272AKVRP.js → chunk-3RAAYBSG.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-6RKD7YZ6.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-TVGLNHEB.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-RCRE42V6.js';

package/dist/{chunk-3CKMB2UK.js → chunk-4XYC2663.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-ZYKFYNES.js';
-import { parseSize } from './chunk-43I7PXDP.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BALIE3BA.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-UC2DKBMS.js';
+import { parseSize } from './chunk-MPDLZCXM.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-YOBQIXX6.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';

package/dist/{chunk-GH246BGV.js → chunk-56ZHWIR2.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N7LAEN3T.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-6LBSAW6I.js → chunk-75KZUBHD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-BALIE3BA.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-YOBQIXX6.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-AMEM2ZLL.js → chunk-AABYHGVO.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-3CKMB2UK.js';
-import { parseSize } from './chunk-43I7PXDP.js';
-import { runnerDir } from './chunk-PA6CK6WQ.js';
-import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-BALIE3BA.js';
+import { builtinKind } from './chunk-4XYC2663.js';
+import { parseSize } from './chunk-MPDLZCXM.js';
+import { runnerDir } from './chunk-N7LAEN3T.js';
+import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-YOBQIXX6.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-HACGUL52.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';