@outerlayer/cli 0.34.0-next.20261026230708 → 0.34.0-next.20261027013606

package/dist/{chunk-DFBY6LX3.js → chunk-AHAYHJNN.js}

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-XDJ376OP.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, metadataFromLabels, writeRecord } from './chunk-7X2G463B.js';
+import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-7GY3DVIL.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-3VZTNXK5.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-6KFJIU73.js';
 import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-77VBS2RT.js';
 import { runnerImageVersion } from './chunk-SDELQEG4.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-63A6NUEZ.js';
-import { runnerCredentialProblem, builtinKind, allowHostProblem, hostAllowed } from './chunk-Q3L5AC75.js';
-import { formatBytes, allocatedBytes } from './chunk-6NXBXWOP.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-KOZ6IBEI.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-4UPET3R7.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-Q2KGDDUX.js';
+import { runnerCredentialProblem, builtinKind, allowHostProblem, hostAllowed } from './chunk-DEJCZ43H.js';
+import { formatBytes, allocatedBytes } from './chunk-BLSEHKZ4.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-GR7ZVGNI.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-HDLON3RJ.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-QUOITPN7.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { postJson, WorkCommandError, getJson } from './chunk-QABXXQ67.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
@@ -539,7 +540,9 @@ function toolFilePins(arch) {
     ...VOICE_PACK_FILES.map((file) => ({ path: `${FETCHED_VOICE_DIR}/${file.name}`, url: file.url, sha256: file.sha256 })),
     { path: FETCHED_FFMPEG, url: `https://github.com/BtbN/FFmpeg-Builds/releases/download/${FFMPEG_BUILD_TAG}/${FFMPEG_STATIC[arch].file}`, sha256: FFMPEG_STATIC[arch].sha256 },
     { path: FETCHED_GH, url: `https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${arch}.tar.gz`, sha256: GH_SHA256[arch] },
-    { path: FETCHED_TINI, url: `https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-${arch}`, sha256: TINI_SHA256[arch] }
+    { path: FETCHED_TINI, url: `https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static-${arch}`, sha256: TINI_SHA256[arch] },
+    { path: FETCHED_HEADLESS_SHELL, url: `${HEADLESS_SHELL_BASE_URL}/${HEADLESS_SHELL[arch].file}`, sha256: HEADLESS_SHELL[arch].sha256 },
+    { path: FETCHED_PLAYWRIGHT_FFMPEG, url: `${PLAYWRIGHT_FFMPEG_BASE_URL}/${PLAYWRIGHT_FFMPEG[arch].file}`, sha256: PLAYWRIGHT_FFMPEG[arch].sha256 }
   ];
 }
 function pinsDir(runnerDir2, pins) {

package/dist/{chunk-6NXBXWOP.js → chunk-BLSEHKZ4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-KOZ6IBEI.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-GR7ZVGNI.js';
 import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';

package/dist/{chunk-Q3L5AC75.js → chunk-DEJCZ43H.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-6NXBXWOP.js';
-import { parseSize } from './chunk-KOZ6IBEI.js';
-import { builderDiskPinned } from './chunk-4UPET3R7.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-BLSEHKZ4.js';
+import { parseSize } from './chunk-GR7ZVGNI.js';
+import { builderDiskPinned } from './chunk-QUOITPN7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-SDAEXUIX.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';

package/dist/{chunk-F5H3LVHR.js → chunk-DM4EEV73.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-TGBST2QL.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-TLIZ7FY4.js';
+import { scrubReason, stripTerminalControls } from './chunk-FQOUIYBL.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-7QF2EXAN.js';
 import { RunnerAlreadyRunningError, readPidFile } from './chunk-LQHCNXPK.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
 import { isSignatureRefusal, postJson } from './chunk-QABXXQ67.js';

package/dist/{chunk-IZVDQXTC.js → chunk-EP3WBNMC.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-F5H3LVHR.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-DM4EEV73.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
 import { writePendingUpdate } from './chunk-HOUFCUMH.js';
-import { renderUpdateSteps } from './chunk-PN7RMFPP.js';
+import { renderUpdateSteps } from './chunk-JM3YQ4LC.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-TS3EFB7S.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-TGBST2QL.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-FQOUIYBL.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-XLJXO4QC.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-VUJURIPJ.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-YL3RWW7X.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-DFBY6LX3.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-AHAYHJNN.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-77VBS2RT.js';
 import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SDELQEG4.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-Q3L5AC75.js';
-import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-6NXBXWOP.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-KOZ6IBEI.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-DEJCZ43H.js';
+import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-BLSEHKZ4.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-GR7ZVGNI.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-LQHCNXPK.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-QABXXQ67.js';
@@ -3279,7 +3279,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-V66LZDNK.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-JD3GVQFP.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-JZLMFYFM.js → chunk-FQGC22IP.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-TLIZ7FY4.js';
+import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-7QF2EXAN.js';
 import { inspectService, realInspectProbes } from './chunk-SDAEXUIX.js';
 import { realpathSync, readFileSync, readdirSync } from 'fs';
 import { resolve, dirname, join } from 'path';

package/dist/{chunk-TGBST2QL.js → chunk-FQOUIYBL.js}

@@ -8,15 +8,15 @@ import { senderPidfile } from './chunk-WBTPI5MP.js';
 import { installScrubContext } from './chunk-QRJIBTNQ.js';
 import { writeDockerClientConfig } from './chunk-CFFVCI2I.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-DFBY6LX3.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-XDJ376OP.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-AHAYHJNN.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-7X2G463B.js';
 import { waitForAgent, vmExecArgs } from './chunk-3VZTNXK5.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-6KFJIU73.js';
 import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-77VBS2RT.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-Q3L5AC75.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-6NXBXWOP.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-KOZ6IBEI.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-4UPET3R7.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-DEJCZ43H.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-BLSEHKZ4.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-GR7ZVGNI.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-QUOITPN7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-QABXXQ67.js';
 import { planArtifactUpload } from './chunk-IXPH4EXK.js';

package/dist/{chunk-T7HUNNJ2.js → chunk-GK6OYFMU.js}

@@ -167,14 +167,14 @@ function governingDir(cwd) {
 async function testProofMode(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return "any";
-  const { testProofIn } = await import('./host-checks-FKLQST3J.js');
+  const { testProofIn } = await import('./host-checks-UNEQTQ6L.js');
   return testProofIn(dir);
 }
 async function judgeCheckName(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return {};
   if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
-  const { checksIn, isJudgeCheck } = await import('./host-checks-FKLQST3J.js');
+  const { checksIn, isJudgeCheck } = await import('./host-checks-UNEQTQ6L.js');
   const quiet = { line: () => void 0, error: () => void 0 };
   const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
   return check === void 0 ? {} : { name: check.name };
@@ -314,7 +314,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-SPGI47OS.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-XG544MGV.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-KOZ6IBEI.js → chunk-GR7ZVGNI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILDKIT_IMAGE } from './chunk-4UPET3R7.js';
 import { resolveDevcontainerCli, devcontainerBuildInvocation, RecipeError } from './chunk-HDLON3RJ.js';
+import { BUILDKIT_IMAGE } from './chunk-QUOITPN7.js';
 import { ensureHostKey } from './chunk-L5VHGRQE.js';
 import { compareVersions } from './chunk-OOD5NDQA.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-GJ4KBHBD.js';

package/dist/{chunk-PN7RMFPP.js → chunk-JM3YQ4LC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-TGBST2QL.js';
+import { stripTerminalControls } from './chunk-FQOUIYBL.js';
 import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SDELQEG4.js';
 import { readFileSync } from 'fs';
 
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-XWQM4F7B.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-TRGA5QRL.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-T6HSNQAT.js → chunk-MPNASRYB.js}

@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-ZDVSSHO2.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-4K6OG2SZ.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-RZ7AZKTY.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-NGCQD6SN.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-SF4GAWAO.js');
+    const { runnerHostChecks } = await import('./doctor-QENPDYBD.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-I4GWKY4T.js');
+      const { inspectRunnerService } = await import('./find-unit-IOCVYPNW.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-63A6NUEZ.js → chunk-Q2KGDDUX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-TLIZ7FY4.js';
+import { DEFAULT_UNIT_NAME } from './chunk-7QF2EXAN.js';
 import { RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-SDAEXUIX.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';

package/dist/{chunk-4UPET3R7.js → chunk-QUOITPN7.js}

@@ -106,7 +106,26 @@ var FFMPEG_STATIC = {
     sha256: "8463881ca7a25015ca6e00f5c91dd2f1637eb73d33c8230413cb74db760a86b3"
   }
 };
-var MEDIA_PINS = `${VOICE_PACK_VERSION}+${FFMPEG_BUILD_TAG}`;
 var PLAYWRIGHT_VERSION = "1.64.1";
+var HEADLESS_SHELL_VERSION = "156.0.8078.4";
+var HEADLESS_SHELL_REVISION = "1248";
+var HEADLESS_SHELL_BASE_URL = `https://cdn.playwright.dev/builds/cft/${HEADLESS_SHELL_VERSION}`;
+var HEADLESS_SHELL = {
+  amd64: {
+    file: "linux64/chrome-headless-shell-linux64.zip",
+    sha256: "c3e50596aef52c58f8fda3c6b3411c33d34c88b177b3ed1c2243359fd3b8ba20"
+  },
+  arm64: {
+    file: "linux-arm64/chrome-headless-shell-linux-arm64.zip",
+    sha256: "81ab9d4d3c301dc5fdfb6c541b9e6632b16fc819a6a854460f40a76fe2b2c476"
+  }
+};
+var PLAYWRIGHT_FFMPEG_REVISION = "1013";
+var PLAYWRIGHT_FFMPEG_BASE_URL = `https://cdn.playwright.dev/dbazure/download/playwright/builds/ffmpeg/${PLAYWRIGHT_FFMPEG_REVISION}`;
+var PLAYWRIGHT_FFMPEG = {
+  amd64: { file: "ffmpeg-linux.zip", sha256: "ee986434d158f74fb5d9c5ff1092026ceedb63f324fe90b5be89460926b7b679" },
+  arm64: { file: "ffmpeg-linux-arm64.zip", sha256: "457360e803a7d8d5f8f7f5ecf562b2d338f6b4f7f86339d0c31938a451e8878b" }
+};
+var MEDIA_PINS = `${VOICE_PACK_VERSION}+${FFMPEG_BUILD_TAG}+${HEADLESS_SHELL_VERSION}+${PLAYWRIGHT_FFMPEG_REVISION}`;
 
-export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice };
+export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, HEADLESS_SHELL_REVISION, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice };

package/dist/{chunk-XLJXO4QC.js → chunk-VUJURIPJ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-DFBY6LX3.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-TLIZ7FY4.js';
-import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-Q3L5AC75.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-6NXBXWOP.js';
-import { builderDiskPinned } from './chunk-4UPET3R7.js';
+import { placeholderQueues, placeholderProblem } from './chunk-AHAYHJNN.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-7QF2EXAN.js';
+import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-DEJCZ43H.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-BLSEHKZ4.js';
+import { builderDiskPinned } from './chunk-QUOITPN7.js';
 import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-SDAEXUIX.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{cli-HQWQEHXJ.js → cli-3BAUWQCS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-T6HSNQAT.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-MPNASRYB.js';
 import './chunk-TZMDRHWB.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-J7EJMIDR.js';
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-MQ5R35O2.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-34YWWGQZ.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-MQ5R35O2.js');
+    const { runInitCommand } = await import('./init-cmd-34YWWGQZ.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4394,7 +4394,7 @@ its criterion, and the new record retires the old record. The id must be the ite
 as \`work demo --item <n> --json\` prints it.
 `
   ).action(async (manifest, opts) => {
-    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-6VTA5BSJ.js');
+    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-QMRDQGB6.js');
     let item;
     if (opts.item !== void 0) {
       item = parseTrackerNumber(opts.item);
@@ -4437,7 +4437,7 @@ as \`work demo --item <n> --json\` prints it.
     }
   });
   program2.command("demo-voice", { hidden: true }).description("Speak demo lines for a recorder: JSON lines in on stdin, out on stdout").action(async () => {
-    const { runDemoVoice } = await import('./demo-voice-cmd-MBK3BGHZ.js');
+    const { runDemoVoice } = await import('./demo-voice-cmd-RWTRJUAX.js');
     await runDemoVoice();
   });
   const demoCmd = program2.command("demo").description("Record demos with the recorder this CLI carries");
@@ -4455,7 +4455,7 @@ and the command prints the manifest's path for \`emit demo\`. Under \`work proof
 to OUTERLAYER_PROOF_OUT instead. Exit 1 means the demo's test failed; its manifest is written all the same.
 `
   ).action(async (file, opts) => {
-    const { runDemoRecord, DemoRecordError } = await import('./demo-record-cmd-7HJ5C7KM.js');
+    const { runDemoRecord, DemoRecordError } = await import('./demo-record-cmd-C2C4P2EQ.js');
     try {
       const result = await runDemoRecord({
         file,
@@ -4999,7 +4999,7 @@ differs from HEAD.
       fail(trackerNumberError("--pr", opts.pr));
       return;
     }
-    const { runWorkProofsCommand } = await import('./work-proofs-cmd-56EY7O45.js');
+    const { runWorkProofsCommand } = await import('./work-proofs-cmd-DTFQ3FSB.js');
     await runWorkProofsCommand({ ...opts, ...pr === void 0 ? {} : { pr } });
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
@@ -5024,7 +5024,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-QPYCZUMI.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-JF5GGDFZ.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -5044,7 +5044,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-QPYCZUMI.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-JF5GGDFZ.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -5076,7 +5076,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-QPYCZUMI.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-JF5GGDFZ.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -5145,8 +5145,8 @@ function registerRunnerCommands(program2) {
   const runnerCmd = program2.command("runner").description("Take work from the implement and amend queues on this machine");
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-4K6OG2SZ.js');
-    const { start, RunnerStartError } = await import('./loop-NNNDBFAS.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-NGCQD6SN.js');
+    const { start, RunnerStartError } = await import('./loop-WHK6EVUE.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-PCG2H5T4.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5164,9 +5164,9 @@ function registerRunnerCommands(program2) {
     "after",
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-4K6OG2SZ.js');
-    const { containerStart } = await import('./container-start-R74IO7CI.js');
-    const { start, RunnerStartError } = await import('./loop-NNNDBFAS.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-NGCQD6SN.js');
+    const { containerStart } = await import('./container-start-YBENDAOQ.js');
+    const { start, RunnerStartError } = await import('./loop-WHK6EVUE.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-PCG2H5T4.js');
     try {
       const result = await containerStart({
@@ -5188,16 +5188,16 @@ function registerRunnerCommands(program2) {
     "after",
     "\nIn the runner image, run it with `docker exec <container> outerlayer runner update-steps`. It reads the\ncontainer with `docker inspect` and changes nothing. The steps rename the old container and never remove it\nbefore the new one runs. They name the container's variables and never print a value.\n"
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-4K6OG2SZ.js');
+    const { defaultRunnerConfigPath } = await import('./config-NGCQD6SN.js');
     const { runnerDir } = await import('./paths-AQ47ZRHK.js');
-    const { runUpdateSteps } = await import('./update-steps-ZTNIK7LA.js');
+    const { runUpdateSteps } = await import('./update-steps-J54P3SBL.js');
     const text = await runUpdateSteps({ runnerDirPath: runnerDir(opts.config ?? defaultRunnerConfigPath()) });
     process.stdout.write(`${text}
 `);
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-4K6OG2SZ.js');
-    const { runRunnerCheck } = await import('./check-V66LZDNK.js');
+    const { defaultRunnerConfigPath } = await import('./config-NGCQD6SN.js');
+    const { runRunnerCheck } = await import('./check-JD3GVQFP.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5218,7 +5218,7 @@ function registerRunnerCommands(program2) {
 `);
   });
   runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").option("--allow-downgrade", "install this CLI even when it is older than the version the runner runs").option("--unit-name <name>", "with --service, the unit's name, to run a second runner beside the first").option("--build-memory-max <size>", "with --service, memory all builds may use together, such as 16g").option("--build-cpus-max <n>", "with --service, CPUs all builds may use together, such as 4").action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-4K6OG2SZ.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-NGCQD6SN.js');
     const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-RGO7NWKP.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.service !== true) {
@@ -5231,13 +5231,13 @@ function registerRunnerCommands(program2) {
       }
     }
     const buildCpusMax = opts.buildCpusMax === void 0 ? void 0 : Number(opts.buildCpusMax);
-    if (buildCpusMax !== void 0 && !(await import('./command-TONUMZ2A.js')).cpusAreValid(buildCpusMax)) {
+    if (buildCpusMax !== void 0 && !(await import('./command-UVGNJILP.js')).cpusAreValid(buildCpusMax)) {
       fail(`--build-cpus-max ${opts.buildCpusMax} is not a number of CPUs from 0.01 to 1024.`);
       return;
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-TONUMZ2A.js');
+        const { installServiceCommand } = await import('./command-UVGNJILP.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5294,8 +5294,8 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       fail(`pass --service: \`${cliInvocation()} runner uninstall --service\` removes the runner's service.`);
       return;
     }
-    const { defaultRunnerConfigPath } = await import('./config-4K6OG2SZ.js');
-    const { uninstallServiceCommand } = await import('./command-TONUMZ2A.js');
+    const { defaultRunnerConfigPath } = await import('./config-NGCQD6SN.js');
+    const { uninstallServiceCommand } = await import('./command-UVGNJILP.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5322,12 +5322,12 @@ already in claude.env is used.
   printf '%s' "$CLAUDE_CODE_OAUTH_TOKEN" | ${cliInvocation()} runner init --agent claude --factory <org>/<factory>
 `
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-4K6OG2SZ.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-3MO5WCU3.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-ASPZ7TQH.js');
-    const { detectMachine } = await import('./machine-GCW2GGI2.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-TDLUTI6F.js');
-    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-LVVLUHY2.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-NGCQD6SN.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-JR62PVKC.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-4ASVLQGM.js');
+    const { detectMachine } = await import('./machine-ZZOQ7LLV.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-6UEOOD2J.js');
+    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-DH7YA4BU.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
       fail(`--agent ${opts.agent}: runner init writes commands for ${Object.keys(AGENT_COMMANDS).join(", ")}. For another agent, leave --agent out and edit runner.commands.`);
@@ -5477,7 +5477,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-TONUMZ2A.js');
+        const { installServiceCommand } = await import('./command-UVGNJILP.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5521,12 +5521,12 @@ Next:
     "after",
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-4K6OG2SZ.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-M4UYZAFH.js');
+    const { defaultRunnerConfigPath } = await import('./config-NGCQD6SN.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-YSOVDTAN.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-XWQM4F7B.js');
-    const { builderSpec } = await import('./builder-IORYS76D.js');
-    const { loadRunnerConfig } = await import('./config-4K6OG2SZ.js');
+    const { createDockerHost } = await import('./docker-TRGA5QRL.js');
+    const { builderSpec } = await import('./builder-MQIL24HI.js');
+    const { loadRunnerConfig } = await import('./config-NGCQD6SN.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
       try {
@@ -5537,7 +5537,7 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-73F2IWBT.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-GLL56XY7.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
@@ -5604,17 +5604,17 @@ Next:
     }
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-4K6OG2SZ.js');
-    const { requestStop } = await import('./loop-NNNDBFAS.js');
+    const { defaultRunnerConfigPath } = await import('./config-NGCQD6SN.js');
+    const { requestStop } = await import('./loop-WHK6EVUE.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-BTXKIH73.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
-    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-4K6OG2SZ.js');
+    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-NGCQD6SN.js');
     const { jobsDir, runnerDir } = await import('./paths-AQ47ZRHK.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-NNNDBFAS.js');
-    const { renderStatus } = await import('./status-35Z3TW42.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-WHK6EVUE.js');
+    const { renderStatus } = await import('./status-7YP2C2QK.js');
     const { readHousekeepingRecord } = await import('./record-SVCNFCGQ.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5635,7 +5635,7 @@ Next:
     const processState = runnerProcessState(configPath);
     const service = await (async () => {
       if (process.platform !== "linux" || !existsSync("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-I4GWKY4T.js');
+      const { inspectRunnerService } = await import('./find-unit-IOCVYPNW.js');
       const facts = inspectRunnerService(configPath);
       return facts === void 0 ? void 0 : { unit: facts.unit, running: facts.mainPid !== void 0, delegated: facts.delegate };
     })();
@@ -5672,8 +5672,8 @@ Next:
     );
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-4K6OG2SZ.js');
-    const { listJobFiles } = await import('./loop-NNNDBFAS.js');
+    const { defaultRunnerConfigPath } = await import('./config-NGCQD6SN.js');
+    const { listJobFiles } = await import('./loop-WHK6EVUE.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-LEVH6VAI.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-TONUMZ2A.js → command-UVGNJILP.js}

@@ -3,22 +3,23 @@ import { createRequire } from 'node:module';
 import { realOwnership, accountNamed, handOver, runRunnerInstall, launcherSummary, restartNote, accountIdentity } from './chunk-RR3VDM7M.js';
 import './chunk-MN3PP45X.js';
 import { currentLink, execStartCommand } from './chunk-YL3RWW7X.js';
-import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-DFBY6LX3.js';
+import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-AHAYHJNN.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-XDJ376OP.js';
+import './chunk-7X2G463B.js';
+import './chunk-7GY3DVIL.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-3VZTNXK5.js';
 import './chunk-6KFJIU73.js';
 import './chunk-77VBS2RT.js';
 import './chunk-SDELQEG4.js';
 import './chunk-TQMI335S.js';
-import './chunk-63A6NUEZ.js';
-import { unitNameProblem, DEFAULT_UNIT_NAME, checkFit, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-TLIZ7FY4.js';
-import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-Q3L5AC75.js';
-import './chunk-6NXBXWOP.js';
-import { parseSize, readJobFile } from './chunk-KOZ6IBEI.js';
-import { HOST_HELPER_ASSETS_VERSION, builderDiskPinned, hostHelperSupportsSlice, HOST_HELPER_SLICE_SINCE, firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, hostHelperPinned } from './chunk-4UPET3R7.js';
+import './chunk-Q2KGDDUX.js';
+import { unitNameProblem, DEFAULT_UNIT_NAME, checkFit, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-7QF2EXAN.js';
+import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-DEJCZ43H.js';
+import './chunk-BLSEHKZ4.js';
+import { parseSize, readJobFile } from './chunk-GR7ZVGNI.js';
 import './chunk-HDLON3RJ.js';
+import { HOST_HELPER_ASSETS_VERSION, builderDiskPinned, hostHelperSupportsSlice, HOST_HELPER_SLICE_SINCE, firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, hostHelperPinned } from './chunk-QUOITPN7.js';
 import { realLima } from './chunk-77MM5RYD.js';
 import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
 import './chunk-LQHCNXPK.js';