@outerlayer/cli 0.34.0-next.20261025133402 → 0.34.0-next.20261025180645

package/dist/{chunk-ZWLEUSJW.js → chunk-VJ34F55N.js}

@@ -1,32 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-O4Z2MNNL.js';
+import { writePendingUpdate } from './chunk-TFPNPS4Q.js';
+import { renderUpdateSteps } from './chunk-RHV5SRI2.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-FD5ASWTG.js';
+import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-FDJPDZSR.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-ZV2JJPDS.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { writePendingUpdate } from './chunk-56ZHWIR2.js';
-import { renderUpdateSteps } from './chunk-Z76GVJGQ.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-RNVBSRZZ.js';
-import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-NW5PDZYA.js';
 import { RUNNER_PROTOCOL } from './chunk-PAK5P2ND.js';
-import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-SMMNU65K.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-DUPM5LVJ.js';
+import { realBlockedProbes, checkBlockedWithSlots } from './chunk-DNZYXEMY.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-UMYYYF7B.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-POGPX7LI.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-ENFBYN4A.js';
-import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-AVLLJW5D.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-36T6W5RA.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JQSZTQSK.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RFVIQLNB.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SYVRBBLW.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-4XYC2663.js';
-import { freeBytes, formatBytes, volumeBytes } from './chunk-UC2DKBMS.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-MPDLZCXM.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-IW6Z337K.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-XLJLR7EK.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-N7LAEN3T.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-YOBQIXX6.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-2D6CKNR7.js';
+import { freeBytes, formatBytes, volumeBytes } from './chunk-KM2HLQE3.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-5AFPP3GZ.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-YNMVVQOQ.js';
+import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-UN3SQTVL.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-MOI2KDLH.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { fdName } from './chunk-HACGUL52.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PXGU3GKY.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-G4W4B33M.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
@@ -614,7 +613,9 @@ function createHousekeepingDocker(deps) {
         "--filter",
         "dangling=true",
         "--filter",
-        `label=${KIND_LABEL}`
+        `label=${KIND_LABEL}`,
+        "--filter",
+        `label=${RUNNER_LABEL}=${deps.runnerId}`
       ]);
       if (listed.status !== 0) throw failure(listed, "docker image ls");
       const ids = [...new Set(listed.stdout.split("\n").map((l) => l.trim()).filter(Boolean))];
@@ -628,7 +629,7 @@ function createHousekeepingDocker(deps) {
       }));
     },
     async listLabelledImages() {
-      const listed = await run("docker", ["image", "ls", "--all", "--no-trunc", "--quiet", "--filter", `label=${KIND_LABEL}`]);
+      const listed = await run("docker", ["image", "ls", "--all", "--no-trunc", "--quiet", "--filter", `label=${KIND_LABEL}`, "--filter", `label=${RUNNER_LABEL}=${deps.runnerId}`]);
       if (listed.status !== 0) throw failure(listed, "docker image ls");
       const ids = [...new Set(listed.stdout.split("\n").map((l) => l.trim()).filter(Boolean))];
       if (ids.length === 0) return [];
@@ -668,6 +669,16 @@ function createHousekeepingDocker(deps) {
     }
   };
 }
+async function housekeepingDockerIfReachable(deps) {
+  const run = deps.run ?? spawnRun;
+  try {
+    const answered = await run("docker", ["version", "--format", "{{.Server.Version}}"]);
+    if (answered.status !== 0) return void 0;
+  } catch {
+    return void 0;
+  }
+  return createHousekeepingDocker(deps);
+}
 
 // src/runner/housekeeping/select.ts
 var DAY_MS = 864e5;
@@ -821,11 +832,13 @@ async function runHousekeeping(options) {
   const root = runnerDir(options.configPath);
   let freed = 0;
   let listed;
-  try {
-    const containers = await docker.listBuildContainers();
-    listed = { containers, volumes: await docker.listBuildVolumes() };
-  } catch (err) {
-    log.error(`housekeeping: Docker could not be asked, so nothing in Docker is removed this pass: ${describeCallFailure(err)}`);
+  if (docker !== void 0) {
+    try {
+      const containers = await docker.listBuildContainers();
+      listed = { containers, volumes: await docker.listBuildVolumes() };
+    } catch (err) {
+      log.error(`housekeeping: Docker could not be asked, so nothing in Docker is removed this pass: ${describeCallFailure(err)}`);
+    }
   }
   const jobs = readJobs(jobsDir(options.configPath));
   for (const name of jobs.unreadable) {
@@ -845,7 +858,7 @@ async function runHousekeeping(options) {
   }
   const live = liveBuildIds(jobs.unfinished);
   const finished = finishedBuildIds(jobs.finished);
-  if (canTell && listed !== void 0) {
+  if (docker !== void 0 && canTell && listed !== void 0) {
     for (const container of selectOrphans(listed.containers, live, finished)) {
       try {
         await docker.removeContainer(container.id);
@@ -863,7 +876,7 @@ async function runHousekeeping(options) {
       }
     }
   }
-  if (canTell && listed !== void 0) {
+  if (docker !== void 0 && canTell && listed !== void 0) {
     const recorded = recordedImages(options.configPath);
     if (recorded === void 0) {
       log.error("housekeeping: an image record does not parse, so no tagged image is removed this pass");
@@ -874,7 +887,7 @@ async function runHousekeeping(options) {
         log.error(`housekeeping: the runner's images could not be listed: ${describeCallFailure(err)}`);
       }
     }
-    freed += await removeStaleRootDisks(root, jobs.unfinished, options);
+    freed += await removeStaleRootDisks(root, jobs.unfinished, options, docker);
     try {
       freed += await removeDanglingImages(docker, log, liveImageIds(jobs.unfinished));
     } catch (err) {
@@ -924,7 +937,7 @@ async function runHousekeeping(options) {
   log.line(`housekeeping: pass finished, freed ${formatBytes(freed)}`);
   return { freedBytes: freed };
 }
-async function removeStaleRootDisks(root, unfinished, options) {
+async function removeStaleRootDisks(root, unfinished, options, docker) {
   const dir = rootfsDir(root);
   const inUse = new Set(unfinished.flatMap((job) => job.microvm?.rootfs === void 0 ? [] : [job.microvm.rootfs]));
   let freed = 0;
@@ -933,7 +946,7 @@ async function removeStaleRootDisks(root, unfinished, options) {
     if (imageId === void 0) continue;
     const path = join(dir, name);
     if (inUse.has(path)) continue;
-    if (await options.docker.imageState(`sha256:${imageId}`) !== "missing") continue;
+    if (await docker.imageState(`sha256:${imageId}`) !== "missing") continue;
     const size = sizeOf(path);
     try {
       rmSync(path, { force: true });
@@ -1813,13 +1826,16 @@ async function housekeepingPass(state) {
   state.housekeepingRunning = true;
   try {
     state.deps.housekeeping ??= {};
-    state.deps.housekeeping.docker ??= createHousekeepingDocker({ run: state.deps.housekeeping.run, runnerId: runnerLabelValue(state.config.configPath), builder: builderName(state.config.configPath) });
+    const hostBuilder = keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned);
+    const names = { run: state.deps.housekeeping.run, runnerId: runnerLabelValue(state.config.configPath), builder: builderName(state.config.configPath) };
+    const docker = state.deps.housekeeping.docker ?? (hostBuilder ? createHousekeepingDocker(names) : await housekeepingDockerIfReachable(names));
+    if (hostBuilder) state.deps.housekeeping.docker ??= docker;
     const result = await runHousekeeping({
       configPath: state.config.configPath,
       keepDays: config.jobsKeepDays,
       buildCacheMax: config.buildCacheMax,
-      removeHostBuilder: !keepsHostBuilder(state.config, state.deps.blocked?.builderDiskPinned),
-      docker: state.deps.housekeeping.docker,
+      removeHostBuilder: !hostBuilder,
+      docker,
       now: state.deps.now ?? (() => /* @__PURE__ */ new Date()),
       log: logOf(state)
     });
@@ -1905,7 +1921,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-KCBU3RSD.js');
+  const { postJson: postJson2 } = await import('./work-cmd-3MKUIE2C.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -3195,7 +3211,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-4TQZZOIQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-QULEN437.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -3221,7 +3237,7 @@ async function startRunner(configPath, deps, startup) {
   check = "identity";
   if (builtinKind(config.hooks.provision) === "container" || builtinKind(config.hooks.provision) === "vm") {
     await ensureRunnerIdentity(configPath, {
-      docker: deps.runnerIdentity ?? (deps.container?.host === void 0 ? void 0 : { holdsObjects: async () => false }),
+      docker: deps.runnerIdentity ?? identityDockerFor({ keepsHostBuilder: keepsHostBuilder(config, deps.blocked?.builderDiskPinned) }) ?? (deps.container?.host === void 0 ? void 0 : { holdsObjects: async () => false }),
       log: (line) => log.error(line)
     }).catch((err) => log.error(`the runner's Docker identity could not be stored: ${describeCallFailure(err)} \xB7 using the names its folder's path gives`));
   }

package/dist/{chunk-3RAAYBSG.js → chunk-YHKU2NOZ.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-TVGLNHEB.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-3N77LUQI.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-RCRE42V6.js';

package/dist/{chunk-ENFBYN4A.js → chunk-YNMVVQOQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N7LAEN3T.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{claude-launcher-JEB5BN7Q.js → claude-launcher-OQZNW7XJ.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-LHOV2FPA.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-XBGHM7DB.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);