@outerlayer/cli 0.34.0-next.20261025180645 → 0.34.0-next.20261025224117

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-25T18:08:18.697Z+424fcf9","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-25T22:42:26.292Z+d165ee3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-QULEN437.js → check-YOSEXQPQ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-VJ34F55N.js';
-import './chunk-O4Z2MNNL.js';
+import { probeCredentials } from './chunk-RLPIRL33.js';
+import './chunk-6P4YL4CO.js';
 import './chunk-TFPNPS4Q.js';
-import './chunk-RHV5SRI2.js';
-import './chunk-FD5ASWTG.js';
+import './chunk-XJXBQQR4.js';
+import './chunk-DJO6GI7B.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-FDJPDZSR.js';
 import './chunk-3JVYMD4G.js';
@@ -17,11 +17,11 @@ import './chunk-QANM5COC.js';
 import './chunk-EGVHFHY4.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-SI6WDF3U.js';
-import { managedProblems, managedFactsOf } from './chunk-DNZYXEMY.js';
+import { managedProblems, managedFactsOf } from './chunk-SMWRIAGH.js';
 import './chunk-UMYYYF7B.js';
 import './chunk-TBT347UY.js';
 import { findServiceUnit } from './chunk-SUOZYOWO.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-JQSZTQSK.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/{chunk-O4Z2MNNL.js → chunk-6P4YL4CO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-FD5ASWTG.js';
+import { scrubReason, stripTerminalControls } from './chunk-DJO6GI7B.js';
 import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-INOUUSYI.js';
 import { RunnerAlreadyRunningError, readPidFile } from './chunk-YNMVVQOQ.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';

package/dist/{chunk-FD5ASWTG.js → chunk-DJO6GI7B.js}

@@ -6,7 +6,7 @@ import { zodProblem } from './chunk-I3LTIAOR.js';
 import { senderPidfile } from './chunk-JBCOUY4M.js';
 import { installScrubContext } from './chunk-QANM5COC.js';
 import { writeDockerClientConfig } from './chunk-SI6WDF3U.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, managedClaudeKeyValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JQSZTQSK.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, managedClaudeKeyValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-ZVGSCE2Q.js';
 import { readBranchHead, fetchCommit, diffBetween } from './chunk-UO4FQAOX.js';
 import { waitForAgent, vmExecArgs } from './chunk-2ILU7UAU.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-OGPEHSNW.js';

package/dist/{chunk-LUHIN4UZ.js → chunk-GC5PVMIJ.js}

@@ -1,13 +1,67 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-OS7DJOQJ.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-UMYYYF7B.js';
+import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-OS7DJOQJ.js';
+import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-UMYYYF7B.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-PXGU3GKY.js';
-import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
+import { runnerDir, RUNNER_DIR_MODE } from './chunk-PXGU3GKY.js';
+import { lchownSync, lstatSync, realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync, readdirSync } from 'fs';
 import { dirname, sep, join } from 'path';
+import { spawnSync } from 'child_process';
+import { userInfo } from 'os';
 
 createRequire(import.meta.url);
+function idOf(flag, account) {
+  const result = spawnSync("id", [flag, account], { encoding: "utf8" });
+  const id = Number(result.stdout);
+  return result.status === 0 && result.stdout.trim() !== "" && Number.isInteger(id) ? id : void 0;
+}
+function accountIdentity(account) {
+  const self = userInfo();
+  const uid = account === self.username ? self.uid : idOf("-u", account);
+  const gid = account === self.username ? self.gid : idOf("-g", account);
+  return uid === void 0 || gid === void 0 || uid < 0 || gid < 0 ? void 0 : { uid, gid };
+}
+function realOwnership() {
+  return {
+    uid: () => process.getuid?.(),
+    ownerOf: (path) => {
+      const info = lstatSync(path, { throwIfNoEntry: false });
+      return info === void 0 ? void 0 : { uid: info.uid, gid: info.gid };
+    },
+    identity: accountIdentity,
+    lchown: (path, owner) => lchownSync(path, owner.uid, owner.gid)
+  };
+}
+function forAnother(find, deps) {
+  if (deps.uid() !== 0) return void 0;
+  const owner = find();
+  return owner !== void 0 && owner.uid !== 0 ? owner : void 0;
+}
+function accountNamed(account, deps) {
+  return forAnother(() => deps.identity(account), deps);
+}
+function accountOwning(dir, deps) {
+  return forAnother(() => deps.ownerOf(dir), deps);
+}
+function handOver(owner, paths, deps) {
+  if (owner === void 0) return void 0;
+  const give = (path, tree) => {
+    const info = lstatSync(path, { throwIfNoEntry: false });
+    if (info === void 0) return;
+    deps.lchown(path, owner);
+    if (tree && info.isDirectory()) for (const name of readdirSync(path)) give(join(path, name), true);
+  };
+  for (const entry of paths) {
+    try {
+      give(entry.path, entry.tree === true);
+    } catch (err) {
+      return `${entry.path} could not be given to user id ${owner.uid}, the account the runner runs as (${err instanceof Error ? err.message : String(err)}): run \`chown -hR ${owner.uid}:${owner.gid} ${entry.path}\` as root`;
+    }
+  }
+  return void 0;
+}
+
+// src/runner/update/install-cmd.ts
 var RunnerInstallError = class extends Error {
 };
 var RunnerDowngradeError = class extends RunnerInstallError {
@@ -42,20 +96,17 @@ function runRunnerInstall(args) {
       `this CLI is ${version}, older than ${installed}, the version the runner runs from ${currentLink(configPath)}. Installing it would move the runner back to ${version}. Run \`${launcherPath(args.home)} ${command}\` instead, which runs ${installed}. To install ${version} anyway, run \`outerlayer ${command} --allow-downgrade\``
     );
   }
-  if (!isInLayout(configPath, entry) && !sameBuildInstalled(packageRoot, packageRootIn(versionDir(configPath, version)))) {
-    const target = packageRootIn(versionDir(configPath, version));
-    mkdirSync(dirname(target), { recursive: true, mode: RUNNER_DIR_MODE });
-    rmSync(target, { recursive: true, force: true });
-    cpSync(packageRoot, target, { recursive: true });
-    carryHoistedDevcontainerCli(packageRoot, target);
-  }
-  switchCurrent(configPath, version);
+  const ownership = args.ownership ?? realOwnership();
+  const account = args.account === void 0 ? accountOwning(dirname(configPath), ownership) : accountNamed(args.account, ownership);
+  const homeAccount = accountOwning(args.home, ownership);
   let written;
   try {
-    written = writeLauncher({ home: args.home, configPath, nodePath, replace: args.replace });
-  } catch (error) {
-    if (error instanceof LauncherWriteError) throw new RunnerInstallError(error.message);
-    throw error;
+    written = placeInLayout({ configPath, nodePath, home: args.home, replace: args.replace, entry, packageRoot, version });
+  } finally {
+    const launcher = launcherPath(args.home);
+    const problem = handOver(account, [{ path: runnerDir(configPath) }, { path: dirname(versionDir(configPath, version)) }, { path: versionDir(configPath, version), tree: true }, { path: currentLink(configPath) }], ownership) ?? // A launcher file the runner did not write stays with its owner.
+    handOver(homeAccount, [{ path: join(args.home, ".local") }, { path: dirname(launcher) }, ...written === void 0 || written.state === "foreign" ? [] : [{ path: launcher }]], ownership);
+    if (problem !== void 0 && written !== void 0) throw new RunnerInstallError(problem);
   }
   return {
     version,
@@ -69,6 +120,23 @@ function runRunnerInstall(args) {
     }
   };
 }
+function placeInLayout(input) {
+  const { configPath, packageRoot, version } = input;
+  if (!isInLayout(configPath, input.entry) && !sameBuildInstalled(packageRoot, packageRootIn(versionDir(configPath, version)))) {
+    const target = packageRootIn(versionDir(configPath, version));
+    mkdirSync(dirname(target), { recursive: true, mode: RUNNER_DIR_MODE });
+    rmSync(target, { recursive: true, force: true });
+    cpSync(packageRoot, target, { recursive: true });
+    carryHoistedDevcontainerCli(packageRoot, target);
+  }
+  switchCurrent(configPath, version);
+  try {
+    return writeLauncher({ home: input.home, configPath, nodePath: input.nodePath, replace: input.replace });
+  } catch (error) {
+    if (error instanceof LauncherWriteError) throw new RunnerInstallError(error.message);
+    throw error;
+  }
+}
 function sameBuildInstalled(source, target) {
   try {
     const wanted = readFileSync(join(source, "dist", "build-info.json"), "utf8");
@@ -95,4 +163,4 @@ function restartNote(result) {
   return `current moved from ${result.previous} to ${result.version}: a runner its service started restarts on ${result.version} at once when its running builds are container builds that carry on through the restart. Otherwise it takes no new work and waits for them to finish. A runner started by hand keeps running until you restart it`;
 }
 
-export { RunnerDowngradeError, RunnerInstallError, launcherSummary, restartNote, runRunnerInstall };
+export { RunnerDowngradeError, RunnerInstallError, accountIdentity, accountNamed, handOver, launcherSummary, realOwnership, restartNote, runRunnerInstall };

package/dist/{chunk-VJ34F55N.js → chunk-RLPIRL33.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-O4Z2MNNL.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-6P4YL4CO.js';
 import { writePendingUpdate } from './chunk-TFPNPS4Q.js';
-import { renderUpdateSteps } from './chunk-RHV5SRI2.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-FD5ASWTG.js';
+import { renderUpdateSteps } from './chunk-XJXBQQR4.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-DJO6GI7B.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-FDJPDZSR.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-PAK5P2ND.js';
-import { realBlockedProbes, checkBlockedWithSlots } from './chunk-DNZYXEMY.js';
+import { realBlockedProbes, checkBlockedWithSlots } from './chunk-SMWRIAGH.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-UMYYYF7B.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JQSZTQSK.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-ZVGSCE2Q.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RFVIQLNB.js';
 import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SYVRBBLW.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
@@ -3211,7 +3211,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-QULEN437.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-YOSEXQPQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-DNZYXEMY.js → chunk-SMWRIAGH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-JQSZTQSK.js';
+import { placeholderQueues, placeholderProblem } from './chunk-ZVGSCE2Q.js';
 import { checkFit } from './chunk-INOUUSYI.js';
 import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-2D6CKNR7.js';
 import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-KM2HLQE3.js';

package/dist/{chunk-RHV5SRI2.js → chunk-XJXBQQR4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-FD5ASWTG.js';
+import { stripTerminalControls } from './chunk-DJO6GI7B.js';
 import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SYVRBBLW.js';
 import { readFileSync } from 'fs';
 

package/dist/{chunk-HHFZXOBC.js → chunk-YV7BP62T.js}

@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-LK6E3XOW.js');
+    const { runnerHostChecks } = await import('./doctor-Z4OA5JJK.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{chunk-JQSZTQSK.js → chunk-ZVGSCE2Q.js}

@@ -861,15 +861,38 @@ async function probeHelper(socketPath, options = {}) {
     return { ok: false, reason: "absent", unreachable: true, detail: message.includes(socketPath) ? message : `the helper at ${socketPath} did not answer: ${message}` };
   }
 }
-function jailedAlive(unit, cgroupRoot = "/sys/fs/cgroup") {
+var DEFAULT_BUILD_SLICE = "system.slice";
+var HELPER_CONFIG_DIR = "/etc/outerlayer";
+function sliceCgroupPath(slice) {
+  const parts = slice.replace(/\.slice$/, "").split("-");
+  return parts.map((_, i) => `${parts.slice(0, i + 1).join("-")}.slice`).join("/");
+}
+function buildSlices(socketPath, configDir = HELPER_CONFIG_DIR) {
+  const named = /^\/run\/([^/]+)\/helper\.sock$/.exec(socketPath ?? "");
+  if (named === null) return [DEFAULT_BUILD_SLICE];
+  const configPath = join(configDir, `${named[1]}.json`);
+  let slice;
   try {
-    return /^populated 1$/m.test(readFileSync(join(cgroupRoot, "system.slice", `${unit}.service`, "cgroup.events"), "utf8"));
+    slice = JSON.parse(readFileSync(configPath, "utf8")).slice;
   } catch {
-    return false;
+    return [DEFAULT_BUILD_SLICE];
+  }
+  return typeof slice === "string" && slice !== "" && slice !== DEFAULT_BUILD_SLICE ? [slice, DEFAULT_BUILD_SLICE] : [DEFAULT_BUILD_SLICE];
+}
+function jailedAlive(unit, cgroupRoot = "/sys/fs/cgroup", slices = [DEFAULT_BUILD_SLICE]) {
+  for (const slice of slices) {
+    let events;
+    try {
+      events = readFileSync(join(cgroupRoot, sliceCgroupPath(slice), `${unit}.service`, "cgroup.events"), "utf8");
+    } catch {
+      continue;
+    }
+    return /^populated 1$/m.test(events);
   }
+  return false;
 }
-function realHelperPort(env = process.env) {
-  return { probe: () => probeHelper(env[HELPER_ENV]), alive: (unit) => jailedAlive(unit) };
+function realHelperPort(env = process.env, host = {}) {
+  return { probe: () => probeHelper(env[HELPER_ENV]), alive: (unit) => jailedAlive(unit, host.cgroupRoot, buildSlices(env[HELPER_ENV], host.configDir)) };
 }
 
 // src/runner/microvm/host.ts

package/dist/{cli-G3P2B2XE.js → cli-NKT5FAP3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-HHFZXOBC.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-YV7BP62T.js';
 import './chunk-AP2K4LPI.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-4P6QGMPN.js';
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-HZUUMO45.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-FN7CSVLZ.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-HZUUMO45.js');
+    const { runInitCommand } = await import('./init-cmd-FN7CSVLZ.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -5104,7 +5104,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-QASNKYM6.js');
-    const { start, RunnerStartError } = await import('./loop-7U7MVICV.js');
+    const { start, RunnerStartError } = await import('./loop-5MVKWHNV.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-EAD2OEM7.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5123,8 +5123,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-QASNKYM6.js');
-    const { containerStart } = await import('./container-start-2DHCWV73.js');
-    const { start, RunnerStartError } = await import('./loop-7U7MVICV.js');
+    const { containerStart } = await import('./container-start-3GFLLV4Q.js');
+    const { start, RunnerStartError } = await import('./loop-5MVKWHNV.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-EAD2OEM7.js');
     try {
       const result = await containerStart({
@@ -5148,14 +5148,14 @@ function registerRunnerCommands(program2) {
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-QASNKYM6.js');
     const { runnerDir } = await import('./paths-T2DEBI62.js');
-    const { runUpdateSteps } = await import('./update-steps-JQOCCDWO.js');
+    const { runUpdateSteps } = await import('./update-steps-ROLDDTPM.js');
     const text = await runUpdateSteps({ runnerDirPath: runnerDir(opts.config ?? defaultRunnerConfigPath()) });
     process.stdout.write(`${text}
 `);
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-QASNKYM6.js');
-    const { runRunnerCheck } = await import('./check-QULEN437.js');
+    const { runRunnerCheck } = await import('./check-YOSEXQPQ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5177,7 +5177,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").option("--allow-downgrade", "install this CLI even when it is older than the version the runner runs").option("--unit-name <name>", "with --service, the unit's name, to run a second runner beside the first").option("--build-memory-max <size>", "with --service, memory all builds may use together, such as 16g").option("--build-cpus-max <n>", "with --service, CPUs all builds may use together, such as 4").action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-QASNKYM6.js');
-    const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-TWGRGEVL.js');
+    const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-5H6M2KJ7.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.service !== true) {
       const names = { print: "print", user: "user", unitName: "unit-name", buildMemoryMax: "build-memory-max", buildCpusMax: "build-cpus-max" };
@@ -5189,13 +5189,13 @@ function registerRunnerCommands(program2) {
       }
     }
     const buildCpusMax = opts.buildCpusMax === void 0 ? void 0 : Number(opts.buildCpusMax);
-    if (buildCpusMax !== void 0 && !(await import('./command-4XOXVWFW.js')).cpusAreValid(buildCpusMax)) {
+    if (buildCpusMax !== void 0 && !(await import('./command-BC2NOUA5.js')).cpusAreValid(buildCpusMax)) {
       fail(`--build-cpus-max ${opts.buildCpusMax} is not a number of CPUs from 0.01 to 1024.`);
       return;
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-4XOXVWFW.js');
+        const { installServiceCommand } = await import('./command-BC2NOUA5.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5253,7 +5253,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-QASNKYM6.js');
-    const { uninstallServiceCommand } = await import('./command-4XOXVWFW.js');
+    const { uninstallServiceCommand } = await import('./command-BC2NOUA5.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5281,10 +5281,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-QASNKYM6.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-FAIF7KOK.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-CYSUYKSX.js');
-    const { detectMachine } = await import('./machine-S3JHOX4V.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-2CEULE3F.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-3KP2CDZJ.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-WY6KFIRA.js');
+    const { detectMachine } = await import('./machine-APH6CXPC.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-43LJRRQO.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-BJPUHAKZ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5403,7 +5403,7 @@ ${C.yellow}${result.note}${C.reset}
 To isolate builds in containers instead, run ${C.yellow}${cliInvocation()} runner init --vm${C.reset}.
 `);
       }
-      const { runRunnerInstall, RunnerInstallError, RunnerDowngradeError, launcherSummary } = await import('./install-cmd-TWGRGEVL.js');
+      const { runRunnerInstall, RunnerInstallError, RunnerDowngradeError, launcherSummary } = await import('./install-cmd-5H6M2KJ7.js');
       let installedLayout = false;
       let noService = "it starts the runner from the install layout, which needs a CLI installed with npm";
       try {
@@ -5435,7 +5435,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-4XOXVWFW.js');
+        const { installServiceCommand } = await import('./command-BC2NOUA5.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5563,7 +5563,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-QASNKYM6.js');
-    const { requestStop } = await import('./loop-7U7MVICV.js');
+    const { requestStop } = await import('./loop-5MVKWHNV.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-SEMBVB5D.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5571,8 +5571,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-QASNKYM6.js');
     const { jobsDir, runnerDir } = await import('./paths-T2DEBI62.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-7U7MVICV.js');
-    const { renderStatus } = await import('./status-2AP7J2L7.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-5MVKWHNV.js');
+    const { renderStatus } = await import('./status-U3Y6HJJI.js');
     const { readHousekeepingRecord } = await import('./record-IMXQNHPB.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5631,7 +5631,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-QASNKYM6.js');
-    const { listJobFiles } = await import('./loop-7U7MVICV.js');
+    const { listJobFiles } = await import('./loop-5MVKWHNV.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-6CMB3DO6.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-4XOXVWFW.js → command-BC2NOUA5.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runRunnerInstall, launcherSummary, restartNote } from './chunk-LUHIN4UZ.js';
+import { realOwnership, accountNamed, handOver, runRunnerInstall, launcherSummary, restartNote, accountIdentity } from './chunk-GC5PVMIJ.js';
 import './chunk-OS7DJOQJ.js';
 import { currentLink, execStartCommand } from './chunk-UMYYYF7B.js';
-import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-JQSZTQSK.js';
+import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';
@@ -51,12 +51,12 @@ import './chunk-YQR6E6OV.js';
 import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
-import { runnerDir } from './chunk-PXGU3GKY.js';
-import './chunk-G4W4B33M.js';
+import { runnerDir, vmAssetsDir } from './chunk-PXGU3GKY.js';
+import { CLAUDE_ENV_FILE } from './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 import { userInfo, totalmem, tmpdir } from 'os';
-import { join, dirname } from 'path';
+import { dirname, join } from 'path';
 import { createHash } from 'crypto';
 import { rmSync, existsSync, readdirSync, mkdtempSync, writeFileSync, readFileSync, statSync, lstatSync } from 'fs';
 import { spawnSync } from 'child_process';
@@ -485,11 +485,6 @@ function readHelperRanges(dir = HELPER_CONFIG_DIR) {
   }
   return ranges;
 }
-function idOf(flag, account) {
-  const result = spawnSync("id", [flag, account], { encoding: "utf8" });
-  const id = Number(result.stdout);
-  return result.status === 0 && Number.isInteger(id) ? id : void 0;
-}
 function realHelperDeps() {
   const arch = firecrackerArch(process.arch);
   const pinnedArch = MICROVM_ARCHES.includes(arch) ? arch : void 0;
@@ -518,11 +513,7 @@ function realHelperDeps() {
         return void 0;
       }
     },
-    identity: (account) => {
-      const uid = account === userInfo().username ? userInfo().uid : idOf("-u", account);
-      const gid = account === userInfo().username ? userInfo().gid : idOf("-g", account);
-      return uid === void 0 || gid === void 0 || uid < 0 || gid < 0 ? void 0 : { uid, gid };
-    },
+    identity: accountIdentity,
     jailBase: findJailBase,
     uidRangeTaker: idRangeTaker,
     helperRanges: () => readHelperRanges(),
@@ -587,6 +578,28 @@ function sliceOf(input, usesVm, helperVersion) {
   return { limits: { memoryMaxBytes, cpus: input.buildCpusMax } };
 }
 async function installServiceCommand(input, deps = {}) {
+  if (input.print === true) return installServiceSteps(input, deps);
+  const ownership = deps.ownership ?? realOwnership();
+  const account = accountNamed(serviceAccount(input), ownership);
+  let result;
+  try {
+    result = await installServiceSteps(input, deps);
+  } finally {
+    const configDir = dirname(input.configPath);
+    const runner = runnerDir(input.configPath);
+    const problem = handOver(
+      account,
+      [{ path: join(configDir, CLAUDE_ENV_FILE) }, { path: join(configDir, "runner.env") }, { path: runner }, { path: dirname(vmAssetsDir(runner)) }, { path: vmAssetsDir(runner), tree: true }],
+      ownership
+    );
+    if (problem !== void 0 && result !== void 0) result = { ...result, ok: false, state: "refused", lines: [...result.lines, problem] };
+  }
+  return result;
+}
+function serviceAccount(input) {
+  return input.user ?? userInfo().username;
+}
+async function installServiceSteps(input, deps) {
   const nameProblem = input.unitName === void 0 ? void 0 : unitNameProblem(input.unitName);
   if (nameProblem !== void 0) return { ok: false, state: "refused", lines: [nameProblem] };
   const vm = runnerVmOf(input.configPath);
@@ -607,13 +620,15 @@ async function installServiceCommand(input, deps = {}) {
       PATH: process.env.PATH,
       replace: input.replace,
       allowDowngrade: input.allowDowngrade,
-      command: "runner install --service"
+      command: "runner install --service",
+      account: serviceAccount(input),
+      ownership: deps.ownership
     });
     launcherLines = [launcherSummary(installed.launcher)].filter((line) => line !== void 0);
     launcherNotes = installed.launcher.notes;
     restartLine = restartNote(installed);
   }
-  const account = input.user ?? userInfo().username;
+  const account = serviceAccount(input);
   const serviceDeps = (deps.service ?? realServiceDeps)();
   if (input.print !== true && account !== userInfo().username && serviceDeps.accountCan !== void 0) {
     const entry = join(currentLink(input.configPath), "node_modules", "@outerlayer", "cli", "dist", "index.js");

package/dist/{container-start-2DHCWV73.js → container-start-3GFLLV4Q.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-O4Z2MNNL.js';
-import { readOwnContainer } from './chunk-RHV5SRI2.js';
-import './chunk-FD5ASWTG.js';
+import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-6P4YL4CO.js';
+import { readOwnContainer } from './chunk-XJXBQQR4.js';
+import './chunk-DJO6GI7B.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-63IVRRIO.js';
 import './chunk-I3LTIAOR.js';
@@ -12,7 +12,7 @@ import './chunk-EGVHFHY4.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-SI6WDF3U.js';
 import './chunk-TBT347UY.js';
-import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-JQSZTQSK.js';
+import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/{doctor-LK6E3XOW.js → doctor-Z4OA5JJK.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launcherCheck } from './chunk-OS7DJOQJ.js';
-import { managedProblems } from './chunk-DNZYXEMY.js';
+import { managedProblems } from './chunk-SMWRIAGH.js';
 import './chunk-UMYYYF7B.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { needsClaudeCredential, claudeCredentialCheck, detectMachine, supportsContainerBuilds, describeMachineDocker, MIN_ENGINE_MAJOR, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned, helperFirecrackerNote, probeHelper, helperSocketPath, missingPermissionOf, missingPermissionFix } from './chunk-JQSZTQSK.js';
+import { needsClaudeCredential, claudeCredentialCheck, detectMachine, supportsContainerBuilds, describeMachineDocker, MIN_ENGINE_MAJOR, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned, helperFirecrackerNote, probeHelper, helperSocketPath, missingPermissionOf, missingPermissionFix } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-GPUL7T77.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-G3P2B2XE.js');
+var { runCli } = await import('./cli-NKT5FAP3.js');
 await runCli(process.argv);

package/dist/{init-FAIF7KOK.js → init-3KP2CDZJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-JQSZTQSK.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/{init-2CEULE3F.js → init-43LJRRQO.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-E7R2GIAW.js';
-import { RunnerInitError, readConfigObject } from './chunk-JQSZTQSK.js';
+import { RunnerInitError, readConfigObject } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/{init-cmd-HZUUMO45.js → init-cmd-FN7CSVLZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-HHFZXOBC.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-YV7BP62T.js';
 import './chunk-AP2K4LPI.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-KT4CN6OU.js';

package/dist/{install-cmd-TWGRGEVL.js → install-cmd-5H6M2KJ7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerDowngradeError, RunnerInstallError, launcherSummary, restartNote, runRunnerInstall } from './chunk-LUHIN4UZ.js';
+export { RunnerDowngradeError, RunnerInstallError, launcherSummary, restartNote, runRunnerInstall } from './chunk-GC5PVMIJ.js';
 import './chunk-OS7DJOQJ.js';
 import './chunk-UMYYYF7B.js';
 import './chunk-TQMI335S.js';

package/dist/{loop-7U7MVICV.js → loop-5MVKWHNV.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-VJ34F55N.js';
-import './chunk-O4Z2MNNL.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-RLPIRL33.js';
+import './chunk-6P4YL4CO.js';
 import './chunk-TFPNPS4Q.js';
-import './chunk-RHV5SRI2.js';
-import './chunk-FD5ASWTG.js';
+import './chunk-XJXBQQR4.js';
+import './chunk-DJO6GI7B.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-FDJPDZSR.js';
 import './chunk-3JVYMD4G.js';
@@ -17,10 +17,10 @@ import './chunk-QANM5COC.js';
 import './chunk-EGVHFHY4.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-SI6WDF3U.js';
-import './chunk-DNZYXEMY.js';
+import './chunk-SMWRIAGH.js';
 import './chunk-UMYYYF7B.js';
 import './chunk-TBT347UY.js';
-import './chunk-JQSZTQSK.js';
+import './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/{machine-S3JHOX4V.js → machine-APH6CXPC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-JQSZTQSK.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/{runner-key-CYSUYKSX.js → runner-key-WY6KFIRA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-JQSZTQSK.js';
+import { readConfigObject, RunnerInitError } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/{status-2AP7J2L7.js → status-U3Y6HJJI.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-FD5ASWTG.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-DJO6GI7B.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import './chunk-63IVRRIO.js';
 import './chunk-I3LTIAOR.js';
@@ -10,7 +10,7 @@ import './chunk-EGVHFHY4.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-SI6WDF3U.js';
 import './chunk-TBT347UY.js';
-import { LEASE_SECONDS } from './chunk-JQSZTQSK.js';
+import { LEASE_SECONDS } from './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/dist/{update-steps-JQOCCDWO.js → update-steps-ROLDDTPM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { readOwnContainer, renderUpdateSteps, runUpdateSteps } from './chunk-RHV5SRI2.js';
-import './chunk-FD5ASWTG.js';
+export { readOwnContainer, renderUpdateSteps, runUpdateSteps } from './chunk-XJXBQQR4.js';
+import './chunk-DJO6GI7B.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-63IVRRIO.js';
 import './chunk-I3LTIAOR.js';
@@ -11,7 +11,7 @@ import './chunk-EGVHFHY4.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-SI6WDF3U.js';
 import './chunk-TBT347UY.js';
-import './chunk-JQSZTQSK.js';
+import './chunk-ZVGSCE2Q.js';
 import './chunk-2PGI6RDE.js';
 import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.34.0-next.20261025180645",
+  "version": "0.34.0-next.20261025224117",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",