@outerlayer/cli 0.34.0-next.20261025210240 → 0.34.0-next.20261026145838

package/dist/{build-B4OKU4MV.js → build-ZJK6CPNH.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-UO4FQAOX.js';
-export { RecipeError } from './chunk-5AFPP3GZ.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-VVOSUGEF.js';
+export { RecipeError } from './chunk-M3ME6TLQ.js';
 import './chunk-4UPET3R7.js';
 import './chunk-YNMVVQOQ.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-MOI2KDLH.js';
-import './chunk-AJYZNISW.js';
+import './chunk-GSSVJNP2.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-PXGU3GKY.js';
 import './chunk-G4W4B33M.js';

package/dist/{build-disk-ZL46AEN3.js → build-disk-7HS4UF7O.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-KM2HLQE3.js';
-import './chunk-5AFPP3GZ.js';
+export { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK, DOCKER_CACHE_MS, allocatedBytes, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-UONH72CJ.js';
+import './chunk-M3ME6TLQ.js';
 import './chunk-4UPET3R7.js';
 import './chunk-MOI2KDLH.js';
-import './chunk-AJYZNISW.js';
+import './chunk-GSSVJNP2.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-PXGU3GKY.js';
 import './chunk-G4W4B33M.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-25T21:03:51.173Z+0cb29f4","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-26T15:00:03.094Z+e6e9c6f","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-XFPWE74N.js → builder-MHZKDI4H.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-5AFPP3GZ.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-M3ME6TLQ.js';
 import './chunk-4UPET3R7.js';
 import './chunk-MOI2KDLH.js';
-import './chunk-AJYZNISW.js';
+import './chunk-GSSVJNP2.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-PXGU3GKY.js';
 import './chunk-G4W4B33M.js';

package/dist/{check-QULEN437.js → check-4W4QUBMP.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-VJ34F55N.js';
-import './chunk-O4Z2MNNL.js';
+import { probeCredentials } from './chunk-PWSUNS6Y.js';
+import './chunk-CY5TCVBS.js';
 import './chunk-TFPNPS4Q.js';
-import './chunk-RHV5SRI2.js';
-import './chunk-FD5ASWTG.js';
+import './chunk-KRTD2F3I.js';
+import './chunk-AE3OTPUU.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-FDJPDZSR.js';
 import './chunk-3JVYMD4G.js';
@@ -12,36 +12,39 @@ import './chunk-E7R2GIAW.js';
 import './chunk-PAK5P2ND.js';
 import './chunk-63IVRRIO.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-JBCOUY4M.js';
-import './chunk-QANM5COC.js';
-import './chunk-EGVHFHY4.js';
+import './chunk-SKVA4KWD.js';
+import './chunk-XTYYF6P7.js';
+import './chunk-VGRCZE6U.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-SI6WDF3U.js';
-import { managedProblems, managedFactsOf } from './chunk-DNZYXEMY.js';
+import { managedProblems, managedFactsOf } from './chunk-ZP7GKJSM.js';
 import './chunk-UMYYYF7B.js';
 import './chunk-TBT347UY.js';
-import { findServiceUnit } from './chunk-SUOZYOWO.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-JQSZTQSK.js';
+import { findServiceUnit } from './chunk-3RLKILPT.js';
+import './chunk-XKJOIQ2Q.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-7P3H4RY2.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-UO4FQAOX.js';
+import './chunk-VVOSUGEF.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-2ILU7UAU.js';
 import './chunk-OGPEHSNW.js';
-import './chunk-RFVIQLNB.js';
+import './chunk-PP6OX4OT.js';
 import './chunk-SYVRBBLW.js';
 import './chunk-TQMI335S.js';
-import './chunk-OQLF3MQQ.js';
-import './chunk-INOUUSYI.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-2D6CKNR7.js';
-import './chunk-KM2HLQE3.js';
-import './chunk-5AFPP3GZ.js';
+import './chunk-7JE2WFNK.js';
+import './chunk-EMH2LNIE.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-3EHDZTRT.js';
+import './chunk-UONH72CJ.js';
+import './chunk-M3ME6TLQ.js';
 import './chunk-4UPET3R7.js';
 import './chunk-YNMVVQOQ.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-UN3SQTVL.js';
+import './chunk-KT4CN6OU.js';
+import './chunk-4P6QGMPN.js';
+import './chunk-6JZXIWX7.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-AVPLEFQR.js';
-import './chunk-FVCHHSHB.js';
+import './chunk-7DXVL7TN.js';
+import './chunk-35JMYSUD.js';
 import './chunk-Y5YCX6AL.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
@@ -60,7 +63,7 @@ import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-ZQSANKS4.js';
-import './chunk-AJYZNISW.js';
+import './chunk-GSSVJNP2.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -68,6 +71,7 @@ import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-CRB3POP4.js';
 import './chunk-URIZRCRY.js';
+import './chunk-DQ6YO7FH.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
 import './chunk-FGXT5OXS.js';

package/dist/{chunk-FVCHHSHB.js → chunk-35JMYSUD.js}

@@ -6,7 +6,7 @@ import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
 import { cliFetch, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { remoteLookupFailed } from './chunk-AJYZNISW.js';
+import { remoteLookupFailed } from './chunk-GSSVJNP2.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { lstatSync } from 'fs';

package/dist/{chunk-2D6CKNR7.js → chunk-3EHDZTRT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-KM2HLQE3.js';
-import { parseSize } from './chunk-5AFPP3GZ.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-UONH72CJ.js';
+import { parseSize } from './chunk-M3ME6TLQ.js';
 import { builderDiskPinned } from './chunk-4UPET3R7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-G4W4B33M.js';

package/dist/{chunk-SUOZYOWO.js → chunk-3RLKILPT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-INOUUSYI.js';
+import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-EMH2LNIE.js';
 import { inspectService, realInspectProbes } from './chunk-G4W4B33M.js';
 import { realpathSync, readFileSync, readdirSync } from 'fs';
 import { resolve, dirname, join } from 'path';

package/dist/{chunk-NW26E4YU.js → chunk-4YFMNF5Y.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession, transcriptPathForSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-AVPLEFQR.js';
+import { autoConnect } from './chunk-7DXVL7TN.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-3N77LUQI.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-GSSVJNP2.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-UN3SQTVL.js → chunk-6JZXIWX7.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-AVPLEFQR.js';
-import { workPageUrl } from './chunk-FVCHHSHB.js';
+import { autoConnect } from './chunk-7DXVL7TN.js';
+import { workPageUrl } from './chunk-35JMYSUD.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-3N77LUQI.js';
 import { signRunnerRequest } from './chunk-MOI2KDLH.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-AVPLEFQR.js → chunk-7DXVL7TN.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-FVCHHSHB.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-35JMYSUD.js';
 import { resolveGatewayCredentials } from './chunk-3N77LUQI.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-OQLF3MQQ.js → chunk-7JE2WFNK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-INOUUSYI.js';
+import { DEFAULT_UNIT_NAME } from './chunk-EMH2LNIE.js';
 import { RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
 import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-G4W4B33M.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';

package/dist/{chunk-JQSZTQSK.js → chunk-7P3H4RY2.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-UO4FQAOX.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-VVOSUGEF.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-2ILU7UAU.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-OGPEHSNW.js';
-import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-RFVIQLNB.js';
+import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-PP6OX4OT.js';
 import { runnerImageVersion } from './chunk-SYVRBBLW.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-OQLF3MQQ.js';
-import { runnerCredentialProblem, builtinKind, hostAllowed } from './chunk-2D6CKNR7.js';
-import { formatBytes, allocatedBytes } from './chunk-KM2HLQE3.js';
-import { createDockerHost, builderSpec, RecipeError, DOCKER_FEATURE, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun, writeSanitizedRecipe, classifyProperties } from './chunk-5AFPP3GZ.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-7JE2WFNK.js';
+import { runnerCredentialProblem, builtinKind, hostAllowed } from './chunk-3EHDZTRT.js';
+import { formatBytes, allocatedBytes } from './chunk-UONH72CJ.js';
+import { createDockerHost, builderSpec, RecipeError, DOCKER_FEATURE, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun, writeSanitizedRecipe, classifyProperties } from './chunk-M3ME6TLQ.js';
 import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-4UPET3R7.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { postJson, WorkCommandError, getJson } from './chunk-UN3SQTVL.js';
+import { postJson, WorkCommandError, getJson } from './chunk-6JZXIWX7.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { signerFor } from './chunk-MOI2KDLH.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-AJYZNISW.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-GSSVJNP2.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-FGXT5OXS.js';
 import { downconvertSession } from './chunk-EOTMDIYC.js';
 import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-PXGU3GKY.js';
@@ -861,15 +861,38 @@ async function probeHelper(socketPath, options = {}) {
     return { ok: false, reason: "absent", unreachable: true, detail: message.includes(socketPath) ? message : `the helper at ${socketPath} did not answer: ${message}` };
   }
 }
-function jailedAlive(unit, cgroupRoot = "/sys/fs/cgroup") {
+var DEFAULT_BUILD_SLICE = "system.slice";
+var HELPER_CONFIG_DIR = "/etc/outerlayer";
+function sliceCgroupPath(slice) {
+  const parts = slice.replace(/\.slice$/, "").split("-");
+  return parts.map((_, i) => `${parts.slice(0, i + 1).join("-")}.slice`).join("/");
+}
+function buildSlices(socketPath, configDir = HELPER_CONFIG_DIR) {
+  const named = /^\/run\/([^/]+)\/helper\.sock$/.exec(socketPath ?? "");
+  if (named === null) return [DEFAULT_BUILD_SLICE];
+  const configPath = join(configDir, `${named[1]}.json`);
+  let slice;
   try {
-    return /^populated 1$/m.test(readFileSync(join(cgroupRoot, "system.slice", `${unit}.service`, "cgroup.events"), "utf8"));
+    slice = JSON.parse(readFileSync(configPath, "utf8")).slice;
   } catch {
-    return false;
+    return [DEFAULT_BUILD_SLICE];
   }
+  return typeof slice === "string" && slice !== "" && slice !== DEFAULT_BUILD_SLICE ? [slice, DEFAULT_BUILD_SLICE] : [DEFAULT_BUILD_SLICE];
+}
+function jailedAlive(unit, cgroupRoot = "/sys/fs/cgroup", slices = [DEFAULT_BUILD_SLICE]) {
+  for (const slice of slices) {
+    let events;
+    try {
+      events = readFileSync(join(cgroupRoot, sliceCgroupPath(slice), `${unit}.service`, "cgroup.events"), "utf8");
+    } catch {
+      continue;
+    }
+    return /^populated 1$/m.test(events);
+  }
+  return false;
 }
-function realHelperPort(env = process.env) {
-  return { probe: () => probeHelper(env[HELPER_ENV]), alive: (unit) => jailedAlive(unit) };
+function realHelperPort(env = process.env, host = {}) {
+  return { probe: () => probeHelper(env[HELPER_ENV]), alive: (unit) => jailedAlive(unit, host.cgroupRoot, buildSlices(env[HELPER_ENV], host.configDir)) };
 }
 
 // src/runner/microvm/host.ts

package/dist/{chunk-FD5ASWTG.js → chunk-AE3OTPUU.js}

@@ -3,25 +3,26 @@ import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-63IVRRIO.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JBCOUY4M.js';
-import { installScrubContext } from './chunk-QANM5COC.js';
+import { senderPidfile } from './chunk-SKVA4KWD.js';
+import { installScrubContext } from './chunk-XTYYF6P7.js';
 import { writeDockerClientConfig } from './chunk-SI6WDF3U.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, managedClaudeKeyValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JQSZTQSK.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-UO4FQAOX.js';
+import { upgradedStarterText } from './chunk-XKJOIQ2Q.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, managedClaudeKeyValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-7P3H4RY2.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-VVOSUGEF.js';
 import { waitForAgent, vmExecArgs } from './chunk-2ILU7UAU.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-OGPEHSNW.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RFVIQLNB.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-2D6CKNR7.js';
-import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-KM2HLQE3.js';
-import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-5AFPP3GZ.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-PP6OX4OT.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-3EHDZTRT.js';
+import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-UONH72CJ.js';
+import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-M3ME6TLQ.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-4UPET3R7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-UN3SQTVL.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6JZXIWX7.js';
 import { planArtifactUpload } from './chunk-MECW77XP.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-MOI2KDLH.js';
-import { resolvePackRoot } from './chunk-ZQSANKS4.js';
-import { scrubText } from './chunk-AJYZNISW.js';
+import { resolvePackRoot, AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-ZQSANKS4.js';
+import { scrubText } from './chunk-GSSVJNP2.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-FGXT5OXS.js';
@@ -1653,9 +1654,18 @@ function validatorFilesIn(root) {
   }
   return files;
 }
+var CRITERIA_CHECK = "acceptance-criteria";
+function asHostReads(file, base, log, tag) {
+  const upgraded = upgradedStarterText(file.path, file.content, { base });
+  if (upgraded === void 0) return file;
+  log.line(`${tag} ${file.path} is an unedited copy an earlier release wrote, so it is read as this CLI writes it`);
+  return { path: file.path, content: upgraded };
+}
 function checksIn(root, log, tag) {
-  const policy = readInside(root, POLICY_FILE);
-  const loaded = parsePolicy(policy === void 0 ? null : { path: POLICY_FILE, content: policy }, validatorFilesIn(root));
+  const base = existsSync(join(root, AGENTS_SKILLS_BASE)) ? AGENTS_SKILLS_BASE : OUTERLAYER_SKILLS_BASE;
+  const policyText = readInside(root, POLICY_FILE);
+  const policy = policyText === void 0 ? null : asHostReads({ path: POLICY_FILE, content: policyText }, base, log, tag);
+  const loaded = parsePolicy(policy, validatorFilesIn(root).map((file) => asHostReads(file, base, log, tag)));
   for (const problem of loaded.problems) log.error(`${tag} ${problem.file}: ${problem.problem}`);
   const hostChecks = loaded.customs.filter((def) => def.runWhere === "host" && def.level !== "off" && def.declaresEmit !== null);
   const checks = [];
@@ -1663,7 +1673,8 @@ function checksIn(root, log, tag) {
     if (def.judge !== void 0) checks.push({ name: def.declaresEmit, judge: { brief: def.judge.brief, text: readBrief(root, def.judge.brief), subjects: def.judge.subjects } });
     else if (def.command !== void 0) checks.push({ name: def.declaresEmit, command: def.command });
   }
-  return checks;
+  const unrecorded = loaded.customs.filter((def) => def.level !== "off" && def.declaresEmit === CRITERIA_CHECK && !checks.some((check) => check.name === CRITERIA_CHECK)).map((def) => def.id);
+  return { checks, unrecorded };
 }
 async function readDefinitions(input, repository, scratch, token, tokens) {
   const { config, job, deps } = input;
@@ -1672,7 +1683,7 @@ async function readDefinitions(input, repository, scratch, token, tokens) {
   const controlPlaneUrl = (controlPlane) => deps.runtime.remoteFor?.(controlPlane) ?? `${deps.runtime.github.gitUrl}/${controlPlane}.git`;
   const governing = (job.container ?? job.microvm)?.governing;
   const kept = keptContextTree(input.jobDir, governing);
-  if (kept !== void 0) return { ok: true, checks: checksIn(kept, deps.log, tag) };
+  if (kept !== void 0) return { ok: true, ...checksIn(kept, deps.log, tag) };
   const staged = await stage({
     config,
     repository,
@@ -1688,18 +1699,20 @@ async function readDefinitions(input, repository, scratch, token, tokens) {
   if (staged.kind === "refused") return { ok: false, reason: staged.reason };
   if (staged.kind === "staged") {
     try {
-      return { ok: true, checks: checksIn(join(staged.dir, "tree"), deps.log, tag) };
+      return { ok: true, ...checksIn(join(staged.dir, "tree"), deps.log, tag) };
     } finally {
       rmSync(staged.dir, { recursive: true, force: true });
     }
   }
   const repo = join(scratch, "repo");
   const remote = deps.runtime.remoteFor?.(repository) ?? `${deps.runtime.github.gitUrl}/${repository}.git`;
-  const commit = job.environment?.recipe?.sourceCommit ?? await deps.runtime.readHead(remote, scratch);
+  const started = (job.container ?? job.microvm)?.startCommit;
+  const commit = started !== void 0 && started !== "" ? started : job.environment?.recipe?.sourceCommit ?? await deps.runtime.readHead(remote, scratch);
   if (commit === void 0) return { ok: false, reason: "the repository's default branch could not be read" };
   const fetched = await (deps.fetchCommit ?? fetchCommit)({ remote, dir: repo, commit, token });
   if (!fetched.ok) return { ok: false, reason: fetched.reason };
-  return { ok: true, checks: checksIn(repo, deps.log, tag) };
+  deps.log.line(`${tag} check definitions read at ${commit.slice(0, 12)}`);
+  return { ok: true, ...checksIn(repo, deps.log, tag) };
 }
 function timeoutAfter(ms, sleep) {
   if (sleep !== void 0) return { done: sleep(ms).then(() => "timeout"), cancel: () => void 0 };
@@ -2205,6 +2218,9 @@ async function runJudge(input) {
     for (const name of passed.value) await record2(name, "fail", `the definitions could not be read: ${definitions.reason}`, { idTag: "judge-unread" });
     return;
   }
+  for (const id of definitions.unrecorded) {
+    log.line(`${tag} judge not run for ${id}: the check is not run.where: host with a judge or a command, so this host records no result for it`);
+  }
   const checks = definitions.checks.filter(isJudgeCheck);
   if (checks.length === 0) {
     rmSync(scratch, { recursive: true, force: true });

package/dist/{chunk-O4Z2MNNL.js → chunk-CY5TCVBS.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-FD5ASWTG.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-INOUUSYI.js';
+import { scrubReason, stripTerminalControls } from './chunk-AE3OTPUU.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-EMH2LNIE.js';
 import { RunnerAlreadyRunningError, readPidFile } from './chunk-YNMVVQOQ.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, postJson } from './chunk-UN3SQTVL.js';
+import { isSignatureRefusal, postJson } from './chunk-6JZXIWX7.js';
 import { signerFor } from './chunk-MOI2KDLH.js';
 import { pidFilePath } from './chunk-PXGU3GKY.js';
 import { readFileSync } from 'fs';

package/dist/{chunk-INOUUSYI.js → chunk-EMH2LNIE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-2D6CKNR7.js';
-import { parseSize } from './chunk-5AFPP3GZ.js';
+import { builtinKind, keepsHostBuilder } from './chunk-3EHDZTRT.js';
+import { parseSize } from './chunk-M3ME6TLQ.js';
 import { runnerDir } from './chunk-PXGU3GKY.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-G4W4B33M.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';

package/dist/{chunk-BHSSGVOY.js → chunk-GEQT3RPN.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-UN3SQTVL.js';
+import { resolveCredentials, postJson, getJson } from './chunk-6JZXIWX7.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { defaultFetch } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';

package/dist/{chunk-AJYZNISW.js → chunk-GSSVJNP2.js}

@@ -22021,14 +22021,14 @@ var ModelRegistryImpl = class {
 };
 var models_default = {
   version: "1.0.0",
-  generatedAt: "2026-10-25T03:54:26.839Z",
+  generatedAt: "2026-10-26T03:58:22.664Z",
   sources: {
     litellm: {
-      fetchedAt: "2026-10-25T03:54:26.839Z",
+      fetchedAt: "2026-10-26T03:58:22.664Z",
       modelCount: 2006
     },
     openrouter: {
-      fetchedAt: "2026-10-25T03:54:26.839Z",
+      fetchedAt: "2026-10-26T03:58:22.664Z",
       modelCount: 198
     }
   },
@@ -67647,8 +67647,8 @@ var models_default = {
         "top_p"
       ],
       pricing: {
-        inputCostPerToken: 15e-8,
-        outputCostPerToken: 6e-7
+        inputCostPerToken: 3e-7,
+        outputCostPerToken: 12e-7
       },
       context: {
         maxInputTokens: 1048576,

package/dist/{chunk-K2UAQWYO.js → chunk-IM6IL3F4.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-AVPLEFQR.js';
+import { autoConnect } from './chunk-7DXVL7TN.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-HHFZXOBC.js → chunk-KAVZAB3E.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned } from './chunk-AP2K4LPI.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-UN3SQTVL.js';
-import { isLinkedRepository } from './chunk-FVCHHSHB.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-XKJOIQ2Q.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-6JZXIWX7.js';
+import { isLinkedRepository } from './chunk-35JMYSUD.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-YHKU2NOZ.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
@@ -12,7 +12,7 @@ import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_ST
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-GSSVJNP2.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-URIZRCRY.js';
 import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-ZL46AEN3.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-QASNKYM6.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-7HS4UF7O.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-W2XWNR4C.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-LK6E3XOW.js');
+    const { runnerHostChecks } = await import('./doctor-GVWQBHBC.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-4UR647S4.js');
+      const { inspectRunnerService } = await import('./find-unit-GGBRYOSO.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-RHV5SRI2.js → chunk-KRTD2F3I.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-FD5ASWTG.js';
+import { stripTerminalControls } from './chunk-AE3OTPUU.js';
 import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SYVRBBLW.js';
 import { readFileSync } from 'fs';
 
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-TAC6G4VU.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-GA63DVME.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-5AFPP3GZ.js → chunk-M3ME6TLQ.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-4UPET3R7.js';
 import { ensureHostKey } from './chunk-MOI2KDLH.js';
-import { compareVersions } from './chunk-AJYZNISW.js';
+import { compareVersions } from './chunk-GSSVJNP2.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PXGU3GKY.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-G4W4B33M.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';

package/dist/{chunk-RFVIQLNB.js → chunk-PP6OX4OT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-UN3SQTVL.js';
+import { WorkCommandError, postJson } from './chunk-6JZXIWX7.js';
 import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-CAQCDYKF.js';
 import { signingFetchFor } from './chunk-3N77LUQI.js';
 import { signerFor } from './chunk-MOI2KDLH.js';