@outerlayer/cli 0.34.0-next.20261027013606 → 0.34.0-next.20261027121359

package/dist/{chunk-QRJIBTNQ.js → chunk-B7LPFCIN.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-7DK2FOZ4.js';
+import { uploadSpooledSteps } from './chunk-QBBZGVZJ.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-IXPH4EXK.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-T375XV3H.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-L5VHGRQE.js';
-import { writeSyncStatus, spoolDir } from './chunk-CCHSD7RS.js';
+import { signerFor, signRunnerRequest } from './chunk-KDSKFXPE.js';
+import { writeSyncStatus, spoolDir } from './chunk-CHDWAWQA.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
@@ -19,7 +19,7 @@ import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { SCRUB_ENV_VARIABLE } from './chunk-SDAEXUIX.js';
+import { SCRUB_ENV_VARIABLE } from './chunk-Z7THNFUU.js';
 import { dirname, basename, join, sep } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';

package/dist/{chunk-CCHSD7RS.js → chunk-CHDWAWQA.js}

@@ -684,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-BDSUP4DK.js');
+  const { governanceOf } = await import('./control-plane-launch-UM4IHOJQ.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-HOUFCUMH.js → chunk-DUG3JXAT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-WYR4INK3.js → chunk-FRETDGET.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-YIBHQR3B.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-T375XV3H.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-SDELQEG4.js → chunk-HO4XRLAZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-GJ4KBHBD.js → chunk-I2GHZ2VA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-SDAEXUIX.js';
+import { BUILD_HOME } from './chunk-Z7THNFUU.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-YL3RWW7X.js → chunk-J2X5CTYY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-FQGC22IP.js → chunk-JKOONI3H.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-7QF2EXAN.js';
-import { inspectService, realInspectProbes } from './chunk-SDAEXUIX.js';
+import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-UXGWAAGQ.js';
+import { inspectService, realInspectProbes } from './chunk-Z7THNFUU.js';
 import { realpathSync, readFileSync, readdirSync } from 'fs';
 import { resolve, dirname, join } from 'path';
 

package/dist/{chunk-L5VHGRQE.js → chunk-KDSKFXPE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-EBVK3QBO.js → chunk-KFXPH7SJ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-QABXXQ67.js';
+import { resolveCredentials, postJson, getJson } from './chunk-NGZBVN6F.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { defaultFetch } from './chunk-7QAJQDHS.js';
+import { defaultFetch } from './chunk-T375XV3H.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-QWXBWOVV.js → chunk-L4DCIEVT.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-QRJIBTNQ.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-B7LPFCIN.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-YIBHQR3B.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-T375XV3H.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-O7QPHJWN.js → chunk-L7RPNSAA.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { DEFAULT_DASHBOARD } from './chunk-NWHU5G6R.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-T375XV3H.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { remoteLookupFailed } from './chunk-OOD5NDQA.js';

package/dist/{chunk-MN3PP45X.js → chunk-LHUZVM3L.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-YL3RWW7X.js';
+import { currentLink } from './chunk-J2X5CTYY.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-EP3WBNMC.js → chunk-LTMFHECB.js}

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-DM4EEV73.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-4IB5WUY2.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
-import { writePendingUpdate } from './chunk-HOUFCUMH.js';
-import { renderUpdateSteps } from './chunk-JM3YQ4LC.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-TS3EFB7S.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-FQOUIYBL.js';
+import { writePendingUpdate } from './chunk-DUG3JXAT.js';
+import { renderUpdateSteps } from './chunk-W774NREK.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-PBZODW5X.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-SJY6A6EH.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-VUJURIPJ.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-YL3RWW7X.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-XEJ5USHY.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-J2X5CTYY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-AHAYHJNN.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-77VBS2RT.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SDELQEG4.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-ARPPH7VS.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-66TKWWTX.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-HO4XRLAZ.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-DEJCZ43H.js';
-import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-BLSEHKZ4.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-GR7ZVGNI.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-LQHCNXPK.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-RO2NZJHZ.js';
+import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-TS2YACAQ.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-UYWGR35C.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-W5EKMK37.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-QABXXQ67.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-L5VHGRQE.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-NGZBVN6F.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-KDSKFXPE.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-SDAEXUIX.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-I2GHZ2VA.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-Z7THNFUU.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
@@ -1961,7 +1961,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-VR7PPSP6.js');
+  const { postJson: postJson2 } = await import('./work-cmd-OWZS3ZXL.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -3279,7 +3279,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-JD3GVQFP.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-FAG4QKIX.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-7PCA37ZS.js → chunk-LUYTNCMS.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readNewestDemo } from './chunk-ER6KQCVJ.js';
-import { runEmitArtifact } from './chunk-QWXBWOVV.js';
+import { runEmitArtifact } from './chunk-L4DCIEVT.js';
 import { VoiceDownloadError, downloadPinned, sha256OfFile } from './chunk-2PGI6RDE.js';
 import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-QUOITPN7.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-YIBHQR3B.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-T375XV3H.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { ARTIFACT_MAX_BYTES, ARTIFACT_MAX_CAPTION_LENGTH, DEMO_RECORD_MEDIA_TYPE, ARTIFACT_MAX_REPLACES_TARGETS, DEMO_MANIFEST_LATEST_VERSION, DemoManifestSchema, ARTIFACT_KINDS } from './chunk-DINRXUQA.js';

package/dist/{chunk-25XBOX3K.js → chunk-LXOBWRVC.js}

@@ -2,9 +2,9 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-YIBHQR3B.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-T375XV3H.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-66LH5QAV.js → chunk-M6YTST7G.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-LMYRR5MO.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-T375XV3H.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-OVNF4LLC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-XFJ7YOPD.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-SDAEXUIX.js';
+import { withTokenHeader } from './chunk-Z7THNFUU.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-72CJOYN6.js → chunk-N752ZNZ5.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-J7EJMIDR.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-LYCJQOO2.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-66LH5QAV.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-M6YTST7G.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-OVNF4LLC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-UPA5KOOX.js';

package/dist/{chunk-QABXXQ67.js → chunk-NGZBVN6F.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
-import { workPageUrl } from './chunk-O7QPHJWN.js';
+import { autoConnect } from './chunk-YIBHQR3B.js';
+import { workPageUrl } from './chunk-L7RPNSAA.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-7QAJQDHS.js';
-import { signRunnerRequest } from './chunk-L5VHGRQE.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-T375XV3H.js';
+import { signRunnerRequest } from './chunk-KDSKFXPE.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
@@ -471,7 +471,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-KXAQ22LZ.js');
+      const { logHookError } = await import('./hook-fast-XX5HZOCR.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-TS3EFB7S.js → chunk-PBZODW5X.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-RR3VDM7M.js → chunk-Q3ATWA2U.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-MN3PP45X.js';
-import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-YL3RWW7X.js';
+import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-LHUZVM3L.js';
+import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-J2X5CTYY.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { runnerDir, RUNNER_DIR_MODE } from './chunk-GJ4KBHBD.js';
+import { runnerDir, RUNNER_DIR_MODE } from './chunk-I2GHZ2VA.js';
 import { lchownSync, lstatSync, realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync, readdirSync } from 'fs';
 import { dirname, sep, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-7DK2FOZ4.js → chunk-QBBZGVZJ.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-YIBHQR3B.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { acquireSpoolLockAt } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-T375XV3H.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-JA2ARVY6.js → chunk-QTAADTIO.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-7QAJQDHS.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-T375XV3H.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-LASKTDCR.js';

package/dist/{chunk-6KFJIU73.js → chunk-RMJSYOSV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-Z7THNFUU.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-DEJCZ43H.js → chunk-RO2NZJHZ.js}

@@ -1,16 +1,64 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-BLSEHKZ4.js';
-import { parseSize } from './chunk-GR7ZVGNI.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-TS2YACAQ.js';
+import { parseSize } from './chunk-UYWGR35C.js';
 import { builderDiskPinned } from './chunk-QUOITPN7.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-SDAEXUIX.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-Z7THNFUU.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';
 
 createRequire(import.meta.url);
 
+// src/runner/container/egress.ts
+var MANAGED_EGRESS = {
+  connectionsPerSecond: 20,
+  connectionBurst: 200,
+  openConnections: 256,
+  sendBytesPerSecond: 2e7,
+  flagHosts: 100
+};
+var EGRESS_SWITCHABLE_KEYS = ["connectionsPerSecond", "openConnections", "sendBytesPerSecond", "flagHosts"];
+var emptyEgressCounts = () => ({
+  connectionsOpened: 0,
+  peakConnectionsPerSecond: 0,
+  peakOpenConnections: 0,
+  bytesSent: 0,
+  refused: { connectionRate: 0, openConnections: 0 },
+  hostsFlagged: false
+});
+var systemClock = { now: () => performance.now(), sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+function resolveEgress(given, managed) {
+  if (!managed && given === void 0) return void 0;
+  const base = managed ? MANAGED_EGRESS : { connectionsPerSecond: 0, connectionBurst: MANAGED_EGRESS.connectionBurst, openConnections: 0, sendBytesPerSecond: 0, flagHosts: 0 };
+  return { ...base, ...given };
+}
+var plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+function bytesText(n) {
+  if (n < 1024) return `${n} B`;
+  const units = ["KiB", "MiB", "GiB", "TiB"];
+  let value = n / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return `${value.toFixed(1)} ${units[unit]}`;
+}
+function egressSummary(counts) {
+  const parts = [
+    `tunnel ${plural(counts.connectionsOpened ?? 0, "connection", "connections")} opened`,
+    `peak ${counts.peakConnectionsPerSecond ?? 0} in one second`,
+    `peak ${counts.peakOpenConnections ?? 0} open`,
+    `${bytesText(counts.bytesSent ?? 0)} sent`,
+    `refused ${counts.refused?.connectionRate ?? 0} by connection-rate`,
+    `refused ${counts.refused?.openConnections ?? 0} by open-connections`
+  ];
+  if (counts.hostsFlagged) parts.push("flagged for reaching many remote hosts");
+  return parts.join(" \xB7 ");
+}
+
 // src/runner/allow-hosts.ts
 var MAX_ALLOW_HOSTS = 500;
 var LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
@@ -82,7 +130,8 @@ function imageBuildOf(config) {
 function keepsHostBuilder(config, builderDiskIsPinned) {
   return !(imageBuildOf(config) === "vm" && (builderDiskIsPinned ?? builderDiskPinned()));
 }
-var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "cacheDisk", "variables", "destinations", "allowHosts", "imageBuild"];
+var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "cacheDisk", "variables", "destinations", "allowHosts", "imageBuild", "egress"];
+var EGRESS_KEYS = ["connectionsPerSecond", "connectionBurst", "openConnections", "sendBytesPerSecond", "flagHosts"];
 var HOUSEKEEPING_KEYS = ["jobsKeepDays", "buildCacheMax", "minFreeDisk"];
 var DEFAULT_JOBS_KEEP_DAYS = 30;
 var DEFAULT_BUILD_CACHE_MAX = "20g";
@@ -446,6 +495,7 @@ function resolveBuild(configPath, block) {
   if (given.imageBuild !== void 0 && given.imageBuild !== "vm" && given.imageBuild !== "host") {
     fail(configPath, "runner.build.imageBuild", "must be vm or host");
   }
+  const egress = resolveEgressBlock(configPath, given.egress);
   return {
     memory: given.memory ?? DEFAULT_BUILD.memory,
     cpus: given.cpus ?? DEFAULT_BUILD.cpus,
@@ -455,8 +505,34 @@ function resolveBuild(configPath, block) {
     variables,
     ...destinations.length === 0 ? {} : { destinations },
     ...allowHosts === void 0 ? {} : { allowHosts },
-    ...given.imageBuild === void 0 ? {} : { imageBuild: given.imageBuild }
+    ...given.imageBuild === void 0 ? {} : { imageBuild: given.imageBuild },
+    ...egress === void 0 ? {} : { egress }
   };
 }
+function resolveEgressBlock(configPath, block) {
+  if (block === void 0) return void 0;
+  if (typeof block !== "object" || block === null || Array.isArray(block)) fail(configPath, "runner.build.egress", "must be an object");
+  const given = block;
+  const out = {};
+  for (const [key, value] of Object.entries(given)) {
+    if (!EGRESS_KEYS.includes(key)) {
+      const near = nearestKey(key, EGRESS_KEYS);
+      fail(configPath, `runner.build.egress.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+    }
+    const least = key === "connectionBurst" ? 1 : 0;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < least) {
+      fail(configPath, `runner.build.egress.${key}`, least === 1 ? "must be a whole number of at least 1" : "must be a whole number of 0 or more; 0 turns the limit off");
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function optionalEgress(config) {
+  const egress = egressLimitsOf(config);
+  return egress === void 0 ? {} : { egress };
+}
+function egressLimitsOf(config) {
+  return resolveEgress(config.build?.egress, config.managed === true);
+}
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, MAX_ALLOW_HOSTS, RunnerConfigError, allowHostProblem, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, hostAllowed, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, keepsHostBuilder, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, EGRESS_SWITCHABLE_KEYS, MAX_ALLOW_HOSTS, RunnerConfigError, allowHostProblem, builtinKind, checkHooks, defaultRunnerConfigPath, egressSummary, emptyEgressCounts, hasRunnerBlock, hostAllowed, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, keepsHostBuilder, loadRunnerConfig, optionalEgress, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf, systemClock };

package/dist/{chunk-7X2G463B.js → chunk-SGT7YU3X.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { defaultDockerfile, toolsDockerfile } from './chunk-7GY3DVIL.js';
-import { runnerLabelValue } from './chunk-GR7ZVGNI.js';
+import { defaultDockerfile, toolsDockerfile } from './chunk-UC4OSOQS.js';
+import { runnerLabelValue } from './chunk-UYWGR35C.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-HDLON3RJ.js';
 import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION } from './chunk-QUOITPN7.js';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-LQHCNXPK.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-W5EKMK37.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-GJ4KBHBD.js';
-import { withGitConfig, tokenHeader } from './chunk-SDAEXUIX.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-I2GHZ2VA.js';
+import { withGitConfig, tokenHeader } from './chunk-Z7THNFUU.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';