@outerlayer/cli 0.34.0-next.20261025133402 → 0.34.0-next.20261025180645

package/dist/{agent-setup-UXUWLV7O.js → agent-setup-FNDKCPUP.js}

@@ -1,18 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-JEOPIRUR.js';
-import './chunk-2AIOOU3A.js';
+export { keepHandWritten, runAgentSetup } from './chunk-3EJBI5JW.js';
+import './chunk-KPHRRCUY.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-4P6QGMPN.js';
-import './chunk-NKOM4JKY.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-QOUR4CQ7.js';
+import './chunk-NKOM4JKY.js';
+import './chunk-CAQCDYKF.js';
 import './chunk-JWNH4ZTF.js';
-import './chunk-TVGLNHEB.js';
+import './chunk-3N77LUQI.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import './chunk-YOBQIXX6.js';
+import './chunk-MOI2KDLH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-ZQSANKS4.js';
@@ -26,7 +24,8 @@ import './chunk-TUSYOL2O.js';
 import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{bridge-OWCSVCXL.js → bridge-YJBB4YA3.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-75KZUBHD.js';
-import './chunk-YOBQIXX6.js';
-import './chunk-HACGUL52.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-SI6WDF3U.js';
+import './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-B4OKU4MV.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-UO4FQAOX.js';
+export { RecipeError } from './chunk-5AFPP3GZ.js';
+import './chunk-4UPET3R7.js';
+import './chunk-YNMVVQOQ.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-MOI2KDLH.js';
+import './chunk-AJYZNISW.js';
+import './chunk-EOTMDIYC.js';
+import './chunk-PXGU3GKY.js';
+import './chunk-G4W4B33M.js';
+import './chunk-MESOOLF4.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{build-disk-5ZQHYBO3.js → build-disk-ZL46AEN3.js}

@@ -1,15 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-UC2DKBMS.js';
-import './chunk-MPDLZCXM.js';
-import './chunk-3Z3MPR55.js';
-import './chunk-ES4ULBAL.js';
+export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-KM2HLQE3.js';
+import './chunk-5AFPP3GZ.js';
+import './chunk-4UPET3R7.js';
+import './chunk-MOI2KDLH.js';
 import './chunk-AJYZNISW.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import './chunk-YOBQIXX6.js';
 import './chunk-EOTMDIYC.js';
-import './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-25T13:35:18.143Z+b97ae23","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-25T18:08:18.697Z+424fcf9","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-54GLXGFV.js → builder-XFPWE74N.js}

@@ -1,14 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-MPDLZCXM.js';
-import './chunk-3Z3MPR55.js';
-import './chunk-ES4ULBAL.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-5AFPP3GZ.js';
+import './chunk-4UPET3R7.js';
+import './chunk-MOI2KDLH.js';
 import './chunk-AJYZNISW.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import './chunk-YOBQIXX6.js';
 import './chunk-EOTMDIYC.js';
-import './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{check-4TQZZOIQ.js → check-QULEN437.js}

@@ -1,61 +1,58 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-ZWLEUSJW.js';
+import { probeCredentials } from './chunk-VJ34F55N.js';
+import './chunk-O4Z2MNNL.js';
+import './chunk-TFPNPS4Q.js';
+import './chunk-RHV5SRI2.js';
+import './chunk-FD5ASWTG.js';
+import './chunk-ZVB57WI6.js';
+import './chunk-FDJPDZSR.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-ZV2JJPDS.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-56ZHWIR2.js';
-import './chunk-Z76GVJGQ.js';
-import './chunk-RNVBSRZZ.js';
-import './chunk-ZVB57WI6.js';
-import './chunk-NW5PDZYA.js';
 import './chunk-PAK5P2ND.js';
-import './chunk-HAEDLXHA.js';
-import './chunk-75KZUBHD.js';
+import './chunk-63IVRRIO.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-KDLQGTN6.js';
-import './chunk-WIK5KUGK.js';
-import './chunk-LMICI7AY.js';
+import './chunk-JBCOUY4M.js';
+import './chunk-QANM5COC.js';
+import './chunk-EGVHFHY4.js';
 import './chunk-ESVW4MJY.js';
-import { managedProblems, managedFactsOf } from './chunk-SMMNU65K.js';
-import './chunk-DUPM5LVJ.js';
+import './chunk-SI6WDF3U.js';
+import { managedProblems, managedFactsOf } from './chunk-DNZYXEMY.js';
+import './chunk-UMYYYF7B.js';
 import './chunk-TBT347UY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-POGPX7LI.js';
+import { findServiceUnit } from './chunk-SUOZYOWO.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-JQSZTQSK.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-EZ7L5IZU.js';
-import './chunk-3NFZN7H6.js';
-import './chunk-ENFBYN4A.js';
-import './chunk-JBJTC3UU.js';
+import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-IHY457PB.js';
-import './chunk-2RBIW2PD.js';
-import './chunk-AVLLJW5D.js';
-import './chunk-36T6W5RA.js';
+import './chunk-2ILU7UAU.js';
+import './chunk-OGPEHSNW.js';
+import './chunk-RFVIQLNB.js';
+import './chunk-SYVRBBLW.js';
 import './chunk-TQMI335S.js';
-import { DEFAULT_UNIT_NAME } from './chunk-AABYHGVO.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-4XYC2663.js';
-import './chunk-UC2DKBMS.js';
-import './chunk-MPDLZCXM.js';
-import './chunk-3Z3MPR55.js';
-import './chunk-ES4ULBAL.js';
-import './chunk-IW6Z337K.js';
+import './chunk-OQLF3MQQ.js';
+import './chunk-INOUUSYI.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-2D6CKNR7.js';
+import './chunk-KM2HLQE3.js';
+import './chunk-5AFPP3GZ.js';
+import './chunk-4UPET3R7.js';
+import './chunk-YNMVVQOQ.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-UN3SQTVL.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-3M6UYJSR.js';
-import './chunk-XA6PGME5.js';
-import './chunk-MECW77XP.js';
-import './chunk-AJYZNISW.js';
-import './chunk-NKOM4JKY.js';
+import './chunk-AVPLEFQR.js';
+import './chunk-FVCHHSHB.js';
 import './chunk-Y5YCX6AL.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-QOUR4CQ7.js';
+import './chunk-MECW77XP.js';
+import './chunk-NKOM4JKY.js';
+import './chunk-CAQCDYKF.js';
 import './chunk-JWNH4ZTF.js';
-import './chunk-TVGLNHEB.js';
+import './chunk-3N77LUQI.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import { claudeEnvPath } from './chunk-YOBQIXX6.js';
-import './chunk-CXQCBAKO.js';
+import './chunk-MOI2KDLH.js';
+import './chunk-25GRRBTH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -63,6 +60,7 @@ import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-ZQSANKS4.js';
+import './chunk-AJYZNISW.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -75,7 +73,8 @@ import './chunk-TUSYOL2O.js';
 import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
-import { parseRunnerEnv } from './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import { claudeEnvPath, parseRunnerEnv } from './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
@@ -116,7 +115,8 @@ async function runRunnerCheck(configPath, deps = {}) {
       Object.assign(env, fromFile.env);
     }
     Object.assign(env, deps.env ?? process.env);
-    const asked = await (deps.helper ?? (() => probeHelper(env[HELPER_ENV] ?? helperSocketPath(DEFAULT_UNIT_NAME))))();
+    const socket = env[HELPER_ENV] ?? helperSocketPath(findServiceUnit(dirname(configPath), deps.units));
+    const asked = await (deps.helper ?? probeHelper)(socket);
     const unmet = managedProblems(managedFactsOf(config, { env, jailer: asked.ok ? "usable" : { problem: asked.detail } }))[0];
     if (unmet !== void 0) return { ok: false, check: "managed", message: `${configPath}: ${unmet.reason}` };
   }

package/dist/{chunk-CXQCBAKO.js → chunk-25GRRBTH.js}

@@ -684,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-LHOV2FPA.js');
+  const { governanceOf } = await import('./control-plane-launch-XBGHM7DB.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-4XYC2663.js → chunk-2D6CKNR7.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-UC2DKBMS.js';
-import { parseSize } from './chunk-MPDLZCXM.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-YOBQIXX6.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-KM2HLQE3.js';
+import { parseSize } from './chunk-5AFPP3GZ.js';
+import { builderDiskPinned } from './chunk-4UPET3R7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-G4W4B33M.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';
@@ -78,6 +79,9 @@ function imageBuildOf(config) {
   if (builtinKind(config.hooks.provision) !== "vm") return "host";
   return config.build?.imageBuild ?? "vm";
 }
+function keepsHostBuilder(config, builderDiskIsPinned) {
+  return !(imageBuildOf(config) === "vm" && (builderDiskIsPinned ?? builderDiskPinned()));
+}
 var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "cacheDisk", "variables", "destinations", "allowHosts", "imageBuild"];
 var HOUSEKEEPING_KEYS = ["jobsKeepDays", "buildCacheMax", "minFreeDisk"];
 var DEFAULT_JOBS_KEEP_DAYS = 30;
@@ -455,4 +459,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, MAX_ALLOW_HOSTS, RunnerConfigError, allowHostProblem, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, hostAllowed, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, MAX_ALLOW_HOSTS, RunnerConfigError, allowHostProblem, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, hostAllowed, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, keepsHostBuilder, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };

package/dist/{chunk-IHY457PB.js → chunk-2ILU7UAU.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-2RBIW2PD.js';
+import { EXEC_PORT } from './chunk-OGPEHSNW.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-JEOPIRUR.js → chunk-3EJBI5JW.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-2AIOOU3A.js';
+import { runEmit } from './chunk-KPHRRCUY.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
 import { installStarterPack } from './chunk-4P6QGMPN.js';
-import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-NKOM4JKY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-QOUR4CQ7.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-NKOM4JKY.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-CAQCDYKF.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-DQ6YO7FH.js';

package/dist/{chunk-TVGLNHEB.js → chunk-3N77LUQI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-XLJLR7EK.js';
+import { signRunnerRequest, signerFor } from './chunk-MOI2KDLH.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-ES4ULBAL.js → chunk-4UPET3R7.js}

@@ -44,11 +44,15 @@ function guestAssetsPinned(arch) {
 var JAILER_BINARY_SHA256 = {
   x86_64: "65ef226e96f0ceda55ba643f445801ef2cc0ea667ef67cad8ac4f406c9c8434f"
 };
-var HOST_HELPER_ASSETS_VERSION = "13";
+var HOST_HELPER_ASSETS_VERSION = "15";
 var HOST_HELPER_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${HOST_HELPER_ASSETS_VERSION}`;
 var HOST_HELPER_SHA256 = {
-  x86_64: "0d6cdbce1e5a5e084726b1d1b1cc0bc208f6662fe8d10a1d7a91e8573035505f"
+  x86_64: "710176334d514f5cf21871a96a7712646e88ed1d31dc95d835de9f0a817601c4"
 };
+var HOST_HELPER_SLICE_SINCE = 15;
+function hostHelperSupportsSlice(version = HOST_HELPER_ASSETS_VERSION) {
+  return Number(version) >= HOST_HELPER_SLICE_SINCE;
+}
 function hostHelperPinned(arch = "x86_64", hashes = HOST_HELPER_SHA256) {
   return hashes[arch] !== "0".repeat(64);
 }
@@ -105,4 +109,4 @@ var FFMPEG_STATIC = {
 var MEDIA_PINS = `${VOICE_PACK_VERSION}+${FFMPEG_BUILD_TAG}`;
 var PLAYWRIGHT_VERSION = "1.64.1";
 
-export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned };
+export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice };

package/dist/{chunk-MPDLZCXM.js → chunk-5AFPP3GZ.js}

@@ -1,15 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError } from './chunk-3Z3MPR55.js';
-import { BUILDKIT_IMAGE } from './chunk-ES4ULBAL.js';
+import { BUILDKIT_IMAGE } from './chunk-4UPET3R7.js';
+import { ensureHostKey } from './chunk-MOI2KDLH.js';
 import { compareVersions } from './chunk-AJYZNISW.js';
-import { ensureHostKey } from './chunk-XLJLR7EK.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-N7LAEN3T.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-YOBQIXX6.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PXGU3GKY.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-G4W4B33M.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
-import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';
-import { join, dirname, resolve } from 'path';
+import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync, mkdirSync, createWriteStream, rmSync, chmodSync, renameSync } from 'fs';
+import { join, resolve, relative, dirname, sep, basename } from 'path';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';
 import { createRequire as createRequire$1 } from 'module';
@@ -48,6 +47,228 @@ function cut(line) {
   const last = head.charCodeAt(head.length - 1);
   return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
 }
+
+// src/runner/image/properties.ts
+var LIFECYCLE = ["onCreateCommand", "updateContentCommand", "postCreateCommand", "postStartCommand"];
+var HONOURED = ["image", "build", "features", "containerEnv", "remoteUser", ...LIFECYCLE];
+var IGNORED_BUILD_KEYS = ["options"];
+var HOST_REFERENCE = /\$\{(?:localEnv|env)[:}]/;
+var DROP = /* @__PURE__ */ Symbol("drop");
+function isHonoured(property) {
+  return HONOURED.includes(property);
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function featureName(id) {
+  const slash = id.lastIndexOf("/");
+  const cut2 = id.slice(slash + 1).search(/[:@]/);
+  return cut2 === -1 ? id : id.slice(0, slash + 1 + cut2);
+}
+var DOCKER_FEATURE = "ghcr.io/devcontainers/features/docker-in-docker";
+function asksForDocker(recipe, metadata) {
+  const isDocker = (id) => featureName(id) === DOCKER_FEATURE;
+  if (isObject(recipe.features) && Object.keys(recipe.features).some(isDocker)) return true;
+  return metadata.some((entry) => typeof entry.id === "string" && isDocker(entry.id));
+}
+function sameValue(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function isFilesOwnEntry(entry, recipe) {
+  if (typeof entry.id === "string") return false;
+  const keys = Object.keys(entry);
+  return keys.length > 0 && keys.every((key) => key in recipe && sameValue(entry[key], recipe[key]));
+}
+function withoutHostReferences(value, path, dropped) {
+  if (typeof value === "string") {
+    if (!HOST_REFERENCE.test(value)) return value;
+    dropped.push(path);
+    return DROP;
+  }
+  if (Array.isArray(value)) {
+    if (!HOST_REFERENCE.test(JSON.stringify(value))) return value;
+    dropped.push(path);
+    return DROP;
+  }
+  if (isObject(value)) {
+    const kept = {};
+    for (const [key, item] of Object.entries(value)) {
+      if (HOST_REFERENCE.test(key)) {
+        dropped.push(`${path}.${key}`);
+        continue;
+      }
+      const clean = withoutHostReferences(item, `${path}.${key}`, dropped);
+      if (clean !== DROP) kept[key] = clean;
+    }
+    return kept;
+  }
+  return value;
+}
+function honouredWithoutHostReferences(entry) {
+  const kept = {};
+  const dropped = [];
+  for (const property of HONOURED) {
+    if (!(property in entry)) continue;
+    const value = entry[property];
+    const clean = withoutHostReferences(
+      property === "build" && isObject(value) ? withoutIgnoredBuildKeys(value) : value,
+      property,
+      dropped
+    );
+    if (clean !== DROP) kept[property] = clean;
+  }
+  return { kept, dropped };
+}
+function withoutIgnoredBuildKeys(build) {
+  return Object.fromEntries(Object.entries(build).filter(([key]) => !IGNORED_BUILD_KEYS.includes(key)));
+}
+function ignoredIn(entry, source) {
+  const found = [];
+  for (const property of Object.keys(entry)) {
+    if (property === "id" || property.startsWith("$") || isHonoured(property)) continue;
+    found.push({ property, source });
+  }
+  if (isObject(entry.build)) {
+    for (const key of IGNORED_BUILD_KEYS) {
+      if (key in entry.build) found.push({ property: `build.${key}`, source });
+    }
+  }
+  for (const property of honouredWithoutHostReferences(entry).dropped) found.push({ property, source });
+  return found;
+}
+function emptyApply() {
+  return { containerEnv: {}, lifecycle: { onCreateCommand: [], updateContentCommand: [], postCreateCommand: [], postStartCommand: [] } };
+}
+function applyEntry(apply, raw, source) {
+  const entry = honouredWithoutHostReferences(raw).kept;
+  if (typeof entry.remoteUser === "string") apply.remoteUser = entry.remoteUser;
+  if (isObject(entry.containerEnv)) {
+    for (const [key, value] of Object.entries(entry.containerEnv)) {
+      if (typeof value === "string") apply.containerEnv[key] = value;
+    }
+  }
+  for (const name of LIFECYCLE) {
+    if (entry[name] !== void 0) apply.lifecycle[name].push({ source, command: entry[name] });
+  }
+}
+function classifyProperties(recipe, metadata) {
+  const ignored = ignoredIn(recipe, "file");
+  const apply = emptyApply();
+  let fileApplied = false;
+  const sanitized = sanitizeRecipe(recipe);
+  for (const entry of metadata) {
+    if (isFilesOwnEntry(entry, sanitized)) {
+      applyEntry(apply, entry, "file");
+      fileApplied = true;
+      continue;
+    }
+    const source = typeof entry.id === "string" ? `feature ${featureName(entry.id)}` : "image label";
+    ignored.push(...ignoredIn(entry, source));
+    applyEntry(apply, entry, source);
+  }
+  if (!fileApplied) applyEntry(apply, recipe, "file");
+  return { docker: asksForDocker(recipe, metadata), honoured: HONOURED.filter((property) => property in recipe), ignored, apply };
+}
+function sanitizeRecipe(recipe) {
+  return honouredWithoutHostReferences(recipe).kept;
+}
+
+// src/runner/image/recipe.ts
+var RecipeError = class extends Error {
+  constructor(code, message, logPath) {
+    super(message);
+    this.code = code;
+    this.logPath = logPath;
+  }
+};
+var DIR_RECIPE = ".devcontainer/devcontainer.json";
+var ROOT_RECIPE = ".devcontainer.json";
+function locateRecipe(checkoutDir) {
+  if (existsSync(join(checkoutDir, DIR_RECIPE))) return { kind: "file", path: DIR_RECIPE };
+  if (existsSync(join(checkoutDir, ROOT_RECIPE))) return { kind: "file", path: ROOT_RECIPE };
+  const named = namedConfigurations(checkoutDir);
+  if (named.length > 0) {
+    throw new RecipeError(
+      "recipe_ambiguous",
+      `the repository has only named devcontainer configurations (${named.join(", ")}); add ${DIR_RECIPE} so the runner knows which to build`
+    );
+  }
+  return { kind: "default" };
+}
+function namedConfigurations(checkoutDir) {
+  const dir = join(checkoutDir, ".devcontainer");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).sort().map((entry) => `.devcontainer/${entry}/devcontainer.json`).filter((path) => existsSync(join(checkoutDir, path)));
+}
+var COMMENTS = /("(?:[^"\\]|\\.)*")|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$)/g;
+var TRAILING_COMMAS = /("(?:[^"\\]|\\.)*")|,(\s*[}\]])/g;
+function parseJsonc(text) {
+  const withoutComments = text.replace(COMMENTS, (_match, str) => str ?? "");
+  return JSON.parse(withoutComments.replace(TRAILING_COMMAS, (_match, str, close) => str ?? close ?? ""));
+}
+function readRecipe(checkoutDir, location) {
+  if (location.kind === "default") return {};
+  const parsed = parseJsonc(readFileSync(join(checkoutDir, location.path), "utf8"));
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${location.path} is not a JSON object`);
+  }
+  return parsed;
+}
+function within(dir, path) {
+  const rel = relative(dir, path);
+  return rel !== ".." && !rel.startsWith(`..${sep}`);
+}
+function realish(path) {
+  let existing = path;
+  let rest = "";
+  while (!existsSync(existing)) {
+    rest = join(basename(existing), rest);
+    existing = dirname(existing);
+  }
+  return join(realpathSync(existing), rest);
+}
+function assertBuildable(checkoutDir, location, recipe) {
+  if (location.kind === "default") return;
+  const devcontainerDir = join(checkoutDir, ".devcontainer");
+  if (existsSync(devcontainerDir) && lstatSync(devcontainerDir).isSymbolicLink()) {
+    throw new RecipeError(
+      "recipe_context_outside",
+      ".devcontainer is a symbolic link, so the build could read files outside the repository; commit a real directory"
+    );
+  }
+  if (recipe.dockerComposeFile !== void 0) {
+    throw new RecipeError(
+      "recipe_needs_docker",
+      "the recipe uses dockerComposeFile; its services need Docker, which a container build does not have"
+    );
+  }
+  const build = recipe.build;
+  if (typeof build !== "object" || build === null) return;
+  const { dockerfile, context } = build;
+  const base = resolve(checkoutDir, location.path, "..");
+  const allowed = join(realpathSync(checkoutDir), ".devcontainer");
+  const contextPath = resolve(base, typeof context === "string" ? context : ".");
+  const paths = [contextPath];
+  if (typeof dockerfile === "string") paths.push(resolve(base, dockerfile));
+  for (const path of paths) {
+    if (!within(devcontainerDir, path) || !within(allowed, realish(path))) {
+      throw new RecipeError(
+        "recipe_context_outside",
+        `the recipe's build reads ${relative(checkoutDir, path) || "."}, outside .devcontainer/; move the build files into .devcontainer/`
+      );
+    }
+  }
+}
+function writeSanitizedRecipe(checkoutDir, location, recipe) {
+  if (location.kind === "default") throw new Error("the default image has no recipe to sanitize");
+  const path = location.path === ROOT_RECIPE ? join(checkoutDir, ".outerlayer-recipe.json") : join(checkoutDir, ".devcontainer", SANITIZED_NAME);
+  writeFileSync(path, `${JSON.stringify(sanitizeRecipe(recipe), null, 2)}
+`);
+  return path;
+}
+var SANITIZED_NAME = "outerlayer-recipe.json";
+
+// src/runner/image/devcontainer-cli.ts
 var PACKAGE = "@devcontainers/cli";
 function buildRootFromDist(moduleDir = dirname(fileURLToPath(import.meta.url))) {
   try {
@@ -58,9 +279,9 @@ function buildRootFromDist(moduleDir = dirname(fileURLToPath(import.meta.url)))
   }
 }
 function resolveDevcontainerCli(opts = {}) {
-  const resolve2 = opts.resolve ?? createRequire$1(import.meta.url).resolve;
+  const resolve3 = opts.resolve ?? createRequire$1(import.meta.url).resolve;
   try {
-    const bin = join(dirname(resolve2(`${PACKAGE}/package.json`)), "devcontainer.js");
+    const bin = join(dirname(resolve3(`${PACKAGE}/package.json`)), "devcontainer.js");
     if (existsSync(bin)) return { command: process.execPath, args: [bin] };
   } catch {
   }
@@ -133,7 +354,7 @@ function childEnvironment(base) {
   }
   return env;
 }
-var spawnRun = (command, args, opts = {}) => new Promise((resolve2) => {
+var spawnRun = (command, args, opts = {}) => new Promise((resolve3) => {
   let log;
   if (opts.logPath !== void 0) {
     mkdirSync(dirname(opts.logPath), { recursive: true });
@@ -149,11 +370,11 @@ var spawnRun = (command, args, opts = {}) => new Promise((resolve2) => {
     settled = true;
     const result = { status, stdout: stdout + stdoutDecoder.end(), stderr: stderr + stderrDecoder.end() + extra };
     if (log === void 0) {
-      resolve2(result);
+      resolve3(result);
       return;
     }
     if (extra) log.write(extra);
-    log.end(() => resolve2(result));
+    log.end(() => resolve3(result));
   };
   let timer;
   const child = spawn(command, args, {
@@ -374,6 +595,9 @@ function readRunnerIdentity(configPath) {
     return void 0;
   }
 }
+function identityDockerFor(runner) {
+  return runner.keepsHostBuilder ? void 0 : { holdsObjects: async () => false };
+}
 function dockerIdentity(run = spawnRun) {
   return {
     async holdsObjects(label, builder) {
@@ -697,7 +921,7 @@ function ensureBuilder(rawRun, spec, options = {}) {
   const result = serialized(async () => {
     const state = await buildxState(run);
     if (state !== "usable") return { ok: false, problem: state.problem };
-    const sleep = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
     const inspected = await run("docker", ["buildx", "inspect", spec.name]);
     let create = inspected.status !== 0;
     if (!create) {
@@ -763,4 +987,4 @@ function ensureBuilder(rawRun, spec, options = {}) {
   );
 }
 
-export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, isOutOfMemory, judgeCommand, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };
+export { BUILD_LABEL, COMMAND_DIR, DOCKER_FEATURE, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, RecipeError, SANITIZED_NAME, assertBuildable, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, classifyProperties, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, identityDockerFor, isOutOfMemory, judgeCommand, locateRecipe, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRecipe, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile, writeSanitizedRecipe };