@outerlayer/cli 0.34.0-next.20261026214534 → 0.34.0-next.20261026230708

package/dist/{chunk-XYLHSCLR.js → chunk-KOZ6IBEI.js}

@@ -1,18 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-4UPET3R7.js';
+import { resolveDevcontainerCli, devcontainerBuildInvocation, RecipeError } from './chunk-HDLON3RJ.js';
 import { ensureHostKey } from './chunk-L5VHGRQE.js';
 import { compareVersions } from './chunk-OOD5NDQA.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-GJ4KBHBD.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
-import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync, mkdirSync, createWriteStream, rmSync, chmodSync, renameSync } from 'fs';
-import { join, resolve, relative, dirname, sep, basename } from 'path';
+import { mkdirSync, createWriteStream, rmSync, existsSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';
+import { dirname, join, resolve } from 'path';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';
-import { createRequire as createRequire$1 } from 'module';
-import { fileURLToPath } from 'url';
 
 createRequire(import.meta.url);
 
@@ -47,276 +46,6 @@ function cut(line) {
   const last = head.charCodeAt(head.length - 1);
   return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
 }
-
-// src/runner/image/properties.ts
-var LIFECYCLE = ["onCreateCommand", "updateContentCommand", "postCreateCommand", "postStartCommand"];
-var HONOURED = ["image", "build", "features", "containerEnv", "remoteUser", ...LIFECYCLE];
-var IGNORED_BUILD_KEYS = ["options"];
-var HOST_REFERENCE = /\$\{(?:localEnv|env)[:}]/;
-var DROP = /* @__PURE__ */ Symbol("drop");
-function isHonoured(property) {
-  return HONOURED.includes(property);
-}
-function isObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function featureName(id) {
-  const slash = id.lastIndexOf("/");
-  const cut2 = id.slice(slash + 1).search(/[:@]/);
-  return cut2 === -1 ? id : id.slice(0, slash + 1 + cut2);
-}
-var DOCKER_FEATURE = "ghcr.io/devcontainers/features/docker-in-docker";
-function asksForDocker(recipe, metadata) {
-  const isDocker = (id) => featureName(id) === DOCKER_FEATURE;
-  if (isObject(recipe.features) && Object.keys(recipe.features).some(isDocker)) return true;
-  return metadata.some((entry) => typeof entry.id === "string" && isDocker(entry.id));
-}
-function sameValue(a, b) {
-  return JSON.stringify(a) === JSON.stringify(b);
-}
-function isFilesOwnEntry(entry, recipe) {
-  if (typeof entry.id === "string") return false;
-  const keys = Object.keys(entry);
-  return keys.length > 0 && keys.every((key) => key in recipe && sameValue(entry[key], recipe[key]));
-}
-function withoutHostReferences(value, path, dropped) {
-  if (typeof value === "string") {
-    if (!HOST_REFERENCE.test(value)) return value;
-    dropped.push(path);
-    return DROP;
-  }
-  if (Array.isArray(value)) {
-    if (!HOST_REFERENCE.test(JSON.stringify(value))) return value;
-    dropped.push(path);
-    return DROP;
-  }
-  if (isObject(value)) {
-    const kept = {};
-    for (const [key, item] of Object.entries(value)) {
-      if (HOST_REFERENCE.test(key)) {
-        dropped.push(`${path}.${key}`);
-        continue;
-      }
-      const clean = withoutHostReferences(item, `${path}.${key}`, dropped);
-      if (clean !== DROP) kept[key] = clean;
-    }
-    return kept;
-  }
-  return value;
-}
-function honouredWithoutHostReferences(entry) {
-  const kept = {};
-  const dropped = [];
-  for (const property of HONOURED) {
-    if (!(property in entry)) continue;
-    const value = entry[property];
-    const clean = withoutHostReferences(
-      property === "build" && isObject(value) ? withoutIgnoredBuildKeys(value) : value,
-      property,
-      dropped
-    );
-    if (clean !== DROP) kept[property] = clean;
-  }
-  return { kept, dropped };
-}
-function withoutIgnoredBuildKeys(build) {
-  return Object.fromEntries(Object.entries(build).filter(([key]) => !IGNORED_BUILD_KEYS.includes(key)));
-}
-function ignoredIn(entry, source) {
-  const found = [];
-  for (const property of Object.keys(entry)) {
-    if (property === "id" || property.startsWith("$") || isHonoured(property)) continue;
-    found.push({ property, source });
-  }
-  if (isObject(entry.build)) {
-    for (const key of IGNORED_BUILD_KEYS) {
-      if (key in entry.build) found.push({ property: `build.${key}`, source });
-    }
-  }
-  for (const property of honouredWithoutHostReferences(entry).dropped) found.push({ property, source });
-  return found;
-}
-function emptyApply() {
-  return { containerEnv: {}, lifecycle: { onCreateCommand: [], updateContentCommand: [], postCreateCommand: [], postStartCommand: [] } };
-}
-function applyEntry(apply, raw, source) {
-  const entry = honouredWithoutHostReferences(raw).kept;
-  if (typeof entry.remoteUser === "string") apply.remoteUser = entry.remoteUser;
-  if (isObject(entry.containerEnv)) {
-    for (const [key, value] of Object.entries(entry.containerEnv)) {
-      if (typeof value === "string") apply.containerEnv[key] = value;
-    }
-  }
-  for (const name of LIFECYCLE) {
-    if (entry[name] !== void 0) apply.lifecycle[name].push({ source, command: entry[name] });
-  }
-}
-function classifyProperties(recipe, metadata) {
-  const ignored = ignoredIn(recipe, "file");
-  const apply = emptyApply();
-  let fileApplied = false;
-  const sanitized = sanitizeRecipe(recipe);
-  for (const entry of metadata) {
-    if (isFilesOwnEntry(entry, sanitized)) {
-      applyEntry(apply, entry, "file");
-      fileApplied = true;
-      continue;
-    }
-    const source = typeof entry.id === "string" ? `feature ${featureName(entry.id)}` : "image label";
-    ignored.push(...ignoredIn(entry, source));
-    applyEntry(apply, entry, source);
-  }
-  if (!fileApplied) applyEntry(apply, recipe, "file");
-  return { docker: asksForDocker(recipe, metadata), honoured: HONOURED.filter((property) => property in recipe), ignored, apply };
-}
-function sanitizeRecipe(recipe) {
-  return honouredWithoutHostReferences(recipe).kept;
-}
-
-// src/runner/image/recipe.ts
-var RecipeError = class extends Error {
-  constructor(code, message, logPath) {
-    super(message);
-    this.code = code;
-    this.logPath = logPath;
-  }
-};
-var DIR_RECIPE = ".devcontainer/devcontainer.json";
-var ROOT_RECIPE = ".devcontainer.json";
-function locateRecipe(checkoutDir) {
-  if (existsSync(join(checkoutDir, DIR_RECIPE))) return { kind: "file", path: DIR_RECIPE };
-  if (existsSync(join(checkoutDir, ROOT_RECIPE))) return { kind: "file", path: ROOT_RECIPE };
-  const named = namedConfigurations(checkoutDir);
-  if (named.length > 0) {
-    throw new RecipeError(
-      "recipe_ambiguous",
-      `the repository has only named devcontainer configurations (${named.join(", ")}); add ${DIR_RECIPE} so the runner knows which to build`
-    );
-  }
-  return { kind: "default" };
-}
-function namedConfigurations(checkoutDir) {
-  const dir = join(checkoutDir, ".devcontainer");
-  if (!existsSync(dir)) return [];
-  return readdirSync(dir).sort().map((entry) => `.devcontainer/${entry}/devcontainer.json`).filter((path) => existsSync(join(checkoutDir, path)));
-}
-var COMMENTS = /("(?:[^"\\]|\\.)*")|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$)/g;
-var TRAILING_COMMAS = /("(?:[^"\\]|\\.)*")|,(\s*[}\]])/g;
-function parseJsonc(text) {
-  const withoutComments = text.replace(COMMENTS, (_match, str) => str ?? "");
-  return JSON.parse(withoutComments.replace(TRAILING_COMMAS, (_match, str, close) => str ?? close ?? ""));
-}
-function readRecipe(checkoutDir, location) {
-  if (location.kind === "default") return {};
-  const parsed = parseJsonc(readFileSync(join(checkoutDir, location.path), "utf8"));
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(`${location.path} is not a JSON object`);
-  }
-  return parsed;
-}
-function within(dir, path) {
-  const rel = relative(dir, path);
-  return rel !== ".." && !rel.startsWith(`..${sep}`);
-}
-function realish(path) {
-  let existing = path;
-  let rest = "";
-  while (!existsSync(existing)) {
-    rest = join(basename(existing), rest);
-    existing = dirname(existing);
-  }
-  return join(realpathSync(existing), rest);
-}
-function assertBuildable(checkoutDir, location, recipe) {
-  if (location.kind === "default") return;
-  const devcontainerDir = join(checkoutDir, ".devcontainer");
-  if (existsSync(devcontainerDir) && lstatSync(devcontainerDir).isSymbolicLink()) {
-    throw new RecipeError(
-      "recipe_context_outside",
-      ".devcontainer is a symbolic link, so the build could read files outside the repository; commit a real directory"
-    );
-  }
-  if (recipe.dockerComposeFile !== void 0) {
-    throw new RecipeError(
-      "recipe_needs_docker",
-      "the recipe uses dockerComposeFile; its services need Docker, which a container build does not have"
-    );
-  }
-  const build = recipe.build;
-  if (typeof build !== "object" || build === null) return;
-  const { dockerfile, context } = build;
-  const base = resolve(checkoutDir, location.path, "..");
-  const allowed = join(realpathSync(checkoutDir), ".devcontainer");
-  const contextPath = resolve(base, typeof context === "string" ? context : ".");
-  const paths = [contextPath];
-  if (typeof dockerfile === "string") paths.push(resolve(base, dockerfile));
-  for (const path of paths) {
-    if (!within(devcontainerDir, path) || !within(allowed, realish(path))) {
-      throw new RecipeError(
-        "recipe_context_outside",
-        `the recipe's build reads ${relative(checkoutDir, path) || "."}, outside .devcontainer/; move the build files into .devcontainer/`
-      );
-    }
-  }
-}
-function writeSanitizedRecipe(checkoutDir, location, recipe) {
-  if (location.kind === "default") throw new Error("the default image has no recipe to sanitize");
-  const path = location.path === ROOT_RECIPE ? join(checkoutDir, ".outerlayer-recipe.json") : join(checkoutDir, ".devcontainer", SANITIZED_NAME);
-  writeFileSync(path, `${JSON.stringify(sanitizeRecipe(recipe), null, 2)}
-`);
-  return path;
-}
-var SANITIZED_NAME = "outerlayer-recipe.json";
-
-// src/runner/image/devcontainer-cli.ts
-var PACKAGE = "@devcontainers/cli";
-function buildRootFromDist(moduleDir = dirname(fileURLToPath(import.meta.url))) {
-  try {
-    const info = JSON.parse(readFileSync(join(moduleDir, "build-info.json"), "utf8"));
-    return typeof info.root === "string" ? info.root : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function resolveDevcontainerCli(opts = {}) {
-  const resolve3 = opts.resolve ?? createRequire$1(import.meta.url).resolve;
-  try {
-    const bin = join(dirname(resolve3(`${PACKAGE}/package.json`)), "devcontainer.js");
-    if (existsSync(bin)) return { command: process.execPath, args: [bin] };
-  } catch {
-  }
-  const buildRoot = opts.buildRoot ?? buildRootFromDist();
-  const fallback = buildRoot === void 0 ? void 0 : join(buildRoot, "node_modules", PACKAGE);
-  if (fallback !== void 0 && existsSync(join(fallback, "devcontainer.js"))) {
-    return { command: process.execPath, args: [join(fallback, "devcontainer.js")] };
-  }
-  throw new RecipeError(
-    "devcontainer_cli_missing",
-    `the devcontainer CLI is not installed: looked beside this package and in ${fallback ?? "the checkout this build came from (unknown)"}. Run yarn install in that checkout.`
-  );
-}
-function devcontainerBuildInvocation(cli, req) {
-  return {
-    command: cli.command,
-    args: [
-      ...cli.args,
-      "build",
-      "--workspace-folder",
-      req.workspace,
-      "--config",
-      req.config,
-      "--image-name",
-      req.imageName,
-      ...Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
-      "--log-format",
-      "text",
-      // Written as an OCI layout instead of loaded into Docker: the runner's builder cannot read Docker's image store, so the next layer starts FROM the layout.
-      ...req.layoutOut === void 0 ? [] : ["--output", `type=oci,dest=${req.layoutOut},tar=false`]
-    ]
-  };
-}
-
-// src/runner/image/docker.ts
 var CHILD_ENVIRONMENT_NAMES = [
   "PATH",
   "HOME",
@@ -354,7 +83,7 @@ function childEnvironment(base) {
   }
   return env;
 }
-var spawnRun = (command, args, opts = {}) => new Promise((resolve3) => {
+var spawnRun = (command, args, opts = {}) => new Promise((resolve2) => {
   let log;
   if (opts.logPath !== void 0) {
     mkdirSync(dirname(opts.logPath), { recursive: true });
@@ -370,11 +99,11 @@ var spawnRun = (command, args, opts = {}) => new Promise((resolve3) => {
     settled = true;
     const result = { status, stdout: stdout + stdoutDecoder.end(), stderr: stderr + stderrDecoder.end() + extra };
     if (log === void 0) {
-      resolve3(result);
+      resolve2(result);
       return;
     }
     if (extra) log.write(extra);
-    log.end(() => resolve3(result));
+    log.end(() => resolve2(result));
   };
   let timer;
   const child = spawn(command, args, {
@@ -921,7 +650,7 @@ function ensureBuilder(rawRun, spec, options = {}) {
   const result = serialized(async () => {
     const state = await buildxState(run);
     if (state !== "usable") return { ok: false, problem: state.problem };
-    const sleep = options.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
     const inspected = await run("docker", ["buildx", "inspect", spec.name]);
     let create = inspected.status !== 0;
     if (!create) {
@@ -987,4 +716,4 @@ function ensureBuilder(rawRun, spec, options = {}) {
   );
 }
 
-export { BUILD_LABEL, COMMAND_DIR, DOCKER_FEATURE, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, RecipeError, SANITIZED_NAME, assertBuildable, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, classifyProperties, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, identityDockerFor, isOutOfMemory, judgeCommand, locateRecipe, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRecipe, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile, writeSanitizedRecipe };
+export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, identityDockerFor, isOutOfMemory, judgeCommand, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRunnerIdentity, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };

package/dist/{chunk-K3ACC2CV.js → chunk-MIRCFK4X.js}

@@ -3,20 +3,18 @@ import { createRequire } from 'node:module';
 import { readNewestDemo } from './chunk-ER6KQCVJ.js';
 import { runEmitArtifact } from './chunk-QWXBWOVV.js';
 import { VoiceDownloadError, downloadPinned, sha256OfFile } from './chunk-2PGI6RDE.js';
-import { compareVersions } from './chunk-TQMI335S.js';
 import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-4UPET3R7.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { autoConnect } from './chunk-OKGHWCSK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { defaultFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
-import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { ARTIFACT_MAX_BYTES, ARTIFACT_MAX_CAPTION_LENGTH, DEMO_RECORD_MEDIA_TYPE, ARTIFACT_MAX_REPLACES_TARGETS, DEMO_MANIFEST_LATEST_VERSION, DemoManifestSchema, ARTIFACT_KINDS } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 import { createHash } from 'crypto';
-import { mkdtempSync, writeFileSync, statSync, readFileSync, rmSync, mkdirSync, existsSync, copyFileSync, realpathSync, accessSync, constants, createReadStream, createWriteStream } from 'fs';
+import { mkdtempSync, writeFileSync, statSync, readFileSync, rmSync, mkdirSync, existsSync, copyFileSync, accessSync, constants, realpathSync, createReadStream, createWriteStream } from 'fs';
 import { tmpdir } from 'os';
 import { resolve, dirname, join, relative, sep, isAbsolute, delimiter, normalize } from 'path';
 import { execFileSync, spawn } from 'child_process';
@@ -2646,33 +2644,6 @@ function recordedFrame(chapter, stored) {
   if (frame === void 0 || stored.screenshot === void 0) return {};
   return { screenshot: { artifactId: stored.screenshot.artifactId, check: frame.check, sha256: frame.sha256, fullPage: frame.fullPage, masked: frame.masked } };
 }
-var RECORDER_PACKAGE = "@outerlayer/playwright";
-function installedRecorderVersion(dir) {
-  for (let current = dir; ; current = dirname(current)) {
-    let real;
-    try {
-      real = realpathSync(join(current, "node_modules", "@outerlayer", "playwright"));
-    } catch {
-      real = void 0;
-    }
-    if (real !== void 0) {
-      if (!real.split(sep).includes("node_modules")) return void 0;
-      try {
-        const version = JSON.parse(readFileSync(join(real, "package.json"), "utf8")).version;
-        return typeof version === "string" ? version : void 0;
-      } catch {
-        return void 0;
-      }
-    }
-    if (dirname(current) === current) return void 0;
-  }
-}
-function recorderVersionNote(recorder, cli) {
-  if (recorder === void 0) return void 0;
-  const order = compareVersions(recorder, cli);
-  if (order === void 0 || order === 0) return void 0;
-  return order < 0 ? `this demo was recorded with ${RECORDER_PACKAGE} ${recorder}, and this CLI is ${cli}: install ${RECORDER_PACKAGE}@${cli}, which releases with this CLI` : `this demo was recorded with ${RECORDER_PACKAGE} ${recorder}, newer than this CLI (${cli}): update the CLI to ${recorder}`;
-}
 
 // src/demo/timeline.ts
 var JOIN_GAP = 0.25;
@@ -3064,7 +3035,7 @@ function parseManifest(path, options) {
   const version = typeof raw === "object" && raw !== null ? raw.schemaVersion : void 0;
   if (typeof version === "number" && version > DEMO_MANIFEST_LATEST_VERSION) {
     throw new EmitDemoError(
-      `the manifest "${path}" is version ${version}, and this CLI reads versions 1 to ${DEMO_MANIFEST_LATEST_VERSION}: update the CLI to the version of the recorder that wrote it`
+      `the manifest "${path}" is version ${version}, and this CLI reads versions 1 to ${DEMO_MANIFEST_LATEST_VERSION}: a newer CLI recorded it, so update this one`
     );
   }
   const parsed = DemoManifestSchema.safeParse(raw);
@@ -3092,8 +3063,6 @@ async function runEmitDemo(opts) {
   };
   const manifestPath = resolve(cwd, opts.manifest);
   const { manifest, videoPath, text: manifestText } = parseManifest(manifestPath, { needVideo: true });
-  const recorderNote = recorderVersionNote(installedRecorderVersion(dirname(manifestPath)), opts.cliVersion ?? resolvePackageVersion());
-  if (recorderNote !== void 0) say(`${C.yellow}!${C.reset} ${recorderNote}`);
   const comparisons = compareRuns({ first: { manifest, dir: dirname(manifestPath) }, firstPath: manifestPath, secondPath: opts.compare === void 0 ? void 0 : resolve(cwd, opts.compare) });
   const narrated = opts.noNarration !== true && manifest.chapters.some((chapter) => chapter.narration.trim() !== "" || (beatsOf(chapter) ?? []).some((beat) => beat.narration.trim() !== ""));
   for (const program of narrated ? ["ffmpeg", "ffprobe", "espeak-ng"] : ["ffmpeg", "ffprobe"]) {

package/dist/{chunk-5ZBVKRDK.js → chunk-PN7RMFPP.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-JKLSQOYO.js';
+import { stripTerminalControls } from './chunk-TGBST2QL.js';
 import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SDELQEG4.js';
 import { readFileSync } from 'fs';
 
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-CP656XNO.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-XWQM4F7B.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-BQQPDBSF.js → chunk-Q3L5AC75.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-3HJMY3H5.js';
-import { parseSize } from './chunk-XYLHSCLR.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-6NXBXWOP.js';
+import { parseSize } from './chunk-KOZ6IBEI.js';
 import { builderDiskPinned } from './chunk-4UPET3R7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-SDAEXUIX.js';

package/dist/{chunk-2GDKM2O4.js → chunk-T6HSNQAT.js}

@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-TGLM5XK7.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-EBT5VYPX.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-ZDVSSHO2.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-4K6OG2SZ.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-EQIAHHZD.js');
+    const { runnerHostChecks } = await import('./doctor-SF4GAWAO.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-O6WL6UIW.js');
+      const { inspectRunnerService } = await import('./find-unit-I4GWKY4T.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-KR2TIRNQ.js → chunk-T7HUNNJ2.js}

@@ -159,13 +159,22 @@ function checkoutPlaces(cwd) {
     if (dirname(dir) === dir) return void 0;
   }
 }
-async function judgeCheckName(cwd) {
+function governingDir(cwd) {
   const places = checkoutPlaces(cwd);
-  if (places === void 0) return {};
-  const delivered = readDeliveryRecord(places.common);
-  const dir = delivered?.dir ?? places.root;
+  if (places === void 0) return void 0;
+  return readDeliveryRecord(places.common)?.dir ?? places.root;
+}
+async function testProofMode(cwd) {
+  const dir = governingDir(cwd);
+  if (dir === void 0) return "any";
+  const { testProofIn } = await import('./host-checks-FKLQST3J.js');
+  return testProofIn(dir);
+}
+async function judgeCheckName(cwd) {
+  const dir = governingDir(cwd);
+  if (dir === void 0) return {};
   if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
-  const { checksIn, isJudgeCheck } = await import('./host-checks-V25YUP4Q.js');
+  const { checksIn, isJudgeCheck } = await import('./host-checks-FKLQST3J.js');
   const quiet = { line: () => void 0, error: () => void 0 };
   const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
   return check === void 0 ? {} : { name: check.name };
@@ -211,19 +220,19 @@ function otherPullRequestHeads(pullRequests, ownPr, checkoutRepository) {
   }
   return heads;
 }
-function classifyProofs(data, checkoutHead) {
+function classifyProofs(data, checkoutHead, listing = {}) {
   const heads = /* @__PURE__ */ new Set();
   if (checkoutHead !== void 0 && checkoutHead !== "") heads.add(checkoutHead.toLowerCase());
   data.pullRequests?.forEach((pr) => {
     const head = liveHead(pr);
     if (head !== void 0) heads.add(head);
   });
-  return classifyProofsAt(data, heads);
+  return classifyProofsAt(data, heads, listing);
 }
-function classifyProofsAt(data, heads) {
+function classifyProofsAt(data, heads, listing = {}) {
   const entries = [];
   for (const criterion of data.criteria?.items ?? []) {
-    if (criterion.proof === null || criterion.proof === "test") continue;
+    if (criterion.proof === null || criterion.proof === "test" && listing.tests !== true) continue;
     const newest = criterion.newestProof;
     if (newest === null || newest === void 0) {
       entries.push({ id: criterion.id, proof: criterion.proof, state: "missing", commit: null });
@@ -244,11 +253,14 @@ function renderEntry(e) {
   if (e.state === "failed") {
     return `${id}  none  failed  ${sanitizeTerminal(e.commit)}  The judge failed it: ${sanitizeTerminal(e.reason)} No test that cites it has changed since. Change a test that cites ${id}.`;
   }
-  return `${id}  ${sanitizeTerminal(e.proof)}  ${STATE_LABEL[e.state]}  ${sanitizeTerminal(e.commit ?? "no commit")}`;
+  const row = `${id}  ${sanitizeTerminal(e.proof)}  ${STATE_LABEL[e.state]}  ${sanitizeTerminal(e.commit ?? "no commit")}`;
+  if (e.proof !== "test" || e.state === "current") return row;
+  return `${row}  Run the tests with a JUnit reporter at HEAD, then run outerlayer emit artifact <file> --for ${id}`;
 }
-function render(entries, notes, json) {
+function render(entries, notes, json, tests) {
   if (json) return JSON.stringify(entries);
-  const lines = entries.length === 0 ? ["No criterion declares a proof other than test."] : entries.map(renderEntry);
+  const none = tests ? "No criterion declares a proof." : "No criterion declares a proof other than test.";
+  const lines = entries.length === 0 ? [none] : entries.map(renderEntry);
   if (notes.length > 0) lines.push(`The command could not check the judge's results: ${notes.map(sanitizeTerminal).join("; ")}.`);
   return lines.join("\n");
 }
@@ -283,11 +295,13 @@ async function runWorkProofs(opts) {
   if (!checkoutHead) {
     throw new WorkCommandError("cannot read the checkout's HEAD. Run this inside the git checkout, or pass the head explicitly.");
   }
-  const declared = classifyProofs(body, checkoutHead);
-  const unproven = await findUnproven({ item: body, cwd: opts.cwd ?? process.cwd(), head: checkoutHead });
+  const cwd = opts.cwd ?? process.cwd();
+  const tests = body.criteria?.testProofsReported === true && await testProofMode(cwd) === "any";
+  const declared = classifyProofs(body, checkoutHead, { tests });
+  const unproven = await findUnproven({ item: body, cwd, head: checkoutHead });
   const entries = [...declared, ...unproven.entries];
   const json = opts.json === true;
-  const output = render(entries, json ? [] : unproven.notes, json);
+  const output = render(entries, json ? [] : unproven.notes, json, tests);
   if (!opts.quiet) {
     process.stdout.write(output + "\n");
     if (json && unproven.notes.length > 0) process.stderr.write(`The command could not check the judge's results: ${unproven.notes.join("; ")}.
@@ -300,7 +314,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-MCSA56F5.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-SPGI47OS.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-JKLSQOYO.js → chunk-TGBST2QL.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-6CK2OC4Q.js';
+import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-P3NPTFLF.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
 import { senderPidfile } from './chunk-WBTPI5MP.js';
 import { installScrubContext } from './chunk-QRJIBTNQ.js';
 import { writeDockerClientConfig } from './chunk-CFFVCI2I.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-3PUOHONX.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-XHZBLIB2.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-DFBY6LX3.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-XDJ376OP.js';
 import { waitForAgent, vmExecArgs } from './chunk-3VZTNXK5.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-6KFJIU73.js';
 import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-77VBS2RT.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-BQQPDBSF.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-3HJMY3H5.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-XYLHSCLR.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-Q3L5AC75.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-6NXBXWOP.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-KOZ6IBEI.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-4UPET3R7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-QABXXQ67.js';
@@ -3104,6 +3104,10 @@ function asHostReads(file, base, log, tag) {
   log.line(`${tag} ${file.path} is an unedited copy an earlier release wrote, so it is read as this CLI writes it`);
   return { path: file.path, content: upgraded };
 }
+function testProofIn(root) {
+  const policyText = readInside(root, POLICY_FILE);
+  return parsePolicy(policyText === void 0 ? null : { path: POLICY_FILE, content: policyText }, []).testProof;
+}
 function checksIn(root, log, tag) {
   const base = existsSync(join(root, AGENTS_SKILLS_BASE)) ? AGENTS_SKILLS_BASE : OUTERLAYER_SKILLS_BASE;
   const policyText = readInside(root, POLICY_FILE);
@@ -3471,4 +3475,4 @@ async function runHostChecks(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MAX_CHECK_ITEMS_BYTES, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, checksIn, commandItems, commandLogOffset, deliverCommitHooks, describeHookEnd, finishJob, foldSample, hookLimitsFor, inTeardown, isContainerTracked, isGroupAlive, isIdle, isJudgeCheck, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, makeRecorder, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionMicroVm, provisionProcess, readCpuUsec, readDefinitions, readProvisionOut, recoverLostJobs, releaseLease, renewLease, restartSender, retryFailedReleases, runCommand, runHook, runHostChecks, sampleGuest, scrubReason, serveLease, setStage, startMicroVmCommand, startSender, stopOrphanedMicroVms, stripTerminalControls, timeoutAfter, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MAX_CHECK_ITEMS_BYTES, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, checksIn, commandItems, commandLogOffset, deliverCommitHooks, describeHookEnd, finishJob, foldSample, hookLimitsFor, inTeardown, isContainerTracked, isGroupAlive, isIdle, isJudgeCheck, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, makeRecorder, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionMicroVm, provisionProcess, readCpuUsec, readDefinitions, readProvisionOut, recoverLostJobs, releaseLease, renewLease, restartSender, retryFailedReleases, runCommand, runHook, runHostChecks, sampleGuest, scrubReason, serveLease, setStage, startMicroVmCommand, startSender, stopOrphanedMicroVms, stripTerminalControls, testProofIn, timeoutAfter, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-3NCWHEGM.js → chunk-TLIZ7FY4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-BQQPDBSF.js';
-import { parseSize } from './chunk-XYLHSCLR.js';
+import { builtinKind, keepsHostBuilder } from './chunk-Q3L5AC75.js';
+import { parseSize } from './chunk-KOZ6IBEI.js';
 import { runnerDir } from './chunk-GJ4KBHBD.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-SDAEXUIX.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';

package/dist/{chunk-XHZBLIB2.js → chunk-XDJ376OP.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError, locateRecipe, readRecipe, assertBuildable, runnerLabelValue, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-XYLHSCLR.js';
+import { runnerLabelValue } from './chunk-KOZ6IBEI.js';
 import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-4UPET3R7.js';
+import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-HDLON3RJ.js';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-LQHCNXPK.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-GJ4KBHBD.js';
@@ -244,6 +245,11 @@ function toolsDockerfile(parts) {
     `RUN npm install --global --prefix /out/opt/outerlayer/claude @anthropic-ai/claude-code@${version}`,
     "COPY dist /out/opt/outerlayer/cli/dist",
     "COPY package.json /out/opt/outerlayer/cli/package.json",
+    // `outerlayer demo record` runs a demo on the Playwright release this CLI depends on, found beside the CLI as an npm
+    // install puts it. Only the library, with no install scripts: the layer adds no browser to a repository's own image.
+    "RUN mkdir -p /tmp/cli-deps && cd /tmp/cli-deps && echo '{}' > package.json \\",
+    ` && npm install --no-audit --no-fund --ignore-scripts @playwright/test@${plain("the Playwright version", PLAYWRIGHT_VERSION, /^[0-9.]+$/)} \\`,
+    " && mv node_modules /out/opt/outerlayer/cli/node_modules",
     // `outerlayer claude` installs the maintained skills from this pack into the build's home folder before the agent starts.
     "COPY skill-pack /out/opt/outerlayer/cli/skill-pack",
     "RUN mkdir -p /out/opt/outerlayer/bin /out/usr/local/bin /out/etc/claude-code /out/build \\",