@outerlayer/cli 0.34.0-next.20261027013606 → 0.34.0-next.20261027121359

package/dist/{chunk-FQOUIYBL.js → chunk-SJY6A6EH.js}

@@ -2,26 +2,26 @@
 import { createRequire } from 'node:module';
 import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-6CK2OC4Q.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-P3NPTFLF.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-6SJ3DJDH.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-WBTPI5MP.js';
-import { installScrubContext } from './chunk-QRJIBTNQ.js';
-import { writeDockerClientConfig } from './chunk-CFFVCI2I.js';
+import { senderPidfile } from './chunk-YGX72FUQ.js';
+import { installScrubContext } from './chunk-B7LPFCIN.js';
+import { writeDockerClientConfig } from './chunk-XZGURZHF.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-AHAYHJNN.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-7X2G463B.js';
-import { waitForAgent, vmExecArgs } from './chunk-3VZTNXK5.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-6KFJIU73.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-77VBS2RT.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-DEJCZ43H.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-BLSEHKZ4.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-GR7ZVGNI.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-ARPPH7VS.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-SGT7YU3X.js';
+import { waitForAgent, vmExecArgs } from './chunk-ZV6GOXYA.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-RMJSYOSV.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-66TKWWTX.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-RO2NZJHZ.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-TS2YACAQ.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-UYWGR35C.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-QUOITPN7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-QABXXQ67.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-NGZBVN6F.js';
 import { planArtifactUpload } from './chunk-IXPH4EXK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-L5VHGRQE.js';
+import { signerFor } from './chunk-KDSKFXPE.js';
 import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-OVNF4LLC.js';
 import { scrubText } from './chunk-OOD5NDQA.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
@@ -29,8 +29,8 @@ import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-XFJ7YOPD.js';
 import { CheckItemsSchema } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-GJ4KBHBD.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-SDAEXUIX.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-I2GHZ2VA.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-Z7THNFUU.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
 import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, lstatSync, realpathSync, fstatSync, readSync } from 'fs';
@@ -217,6 +217,7 @@ function builderMachineFor(config, jobDir, assets, limits) {
     limits: { ...limits, cacheDiskBytes: parseSize(config.build?.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK) },
     memory: memoryTextOf(config, jobDir, limits),
     allowHosts: withFactoryHosts(config.build?.allowHosts, managedBuildSettingsFor(jobDir)),
+    ...optionalEgress(config),
     managed: config.managed === true,
     timeLimitMinutes: config.timeLimitMinutes
   };
@@ -2297,6 +2298,7 @@ function scrubTunnelRecord(record, config) {
     refusalsMore: record.refusalsMore,
     refusals: record.refusals.map((r) => ({ ...r, host: scrubText(r.host) })),
     destinations: (record.destinations ?? []).map((name) => scrubText(name)),
+    ...record.egress === void 0 ? {} : { egress: record.egress },
     ...record.routes === void 0 ? {} : { routes: Object.fromEntries(Object.entries(record.routes).map(([name, counts]) => [scrubText(name), counts])) }
   };
 }
@@ -2909,15 +2911,19 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     );
   } else if (release.ok) {
     log.line(
-      outcome === void 0 ? `${tag} released \xB7 not attempted (provision exit 75) \xB7 ${total}` : `${tag} released \xB7 outcome ${outcome} \xB7 ${total}`
+      outcome === void 0 ? `${tag} released \xB7 not attempted (provision exit 75) \xB7 ${total}` : `${tag} released \xB7 outcome ${outcome} \xB7 ${total}${egressText(tunnelRecord)}`
     );
   } else {
     log.error(
-      `${tag} release failed after ${release.attempts} attempt(s): ${release.reason}; the lease expires at ${formatClock(leaseExpiry(job, endedAt), endedAt)}`
+      `${tag} release failed after ${release.attempts} attempt(s): ${release.reason}; the lease expires at ${formatClock(leaseExpiry(job, endedAt), endedAt)}${egressText(tunnelRecord)}`
     );
   }
   return job;
 }
+function egressText(record) {
+  if (record === void 0) return "";
+  return record.egress === void 0 ? " \xB7 tunnel counts not recorded" : ` \xB7 ${egressSummary(record.egress)}`;
+}
 function readLogState(logPath) {
   try {
     const stats = statSync(logPath);

package/dist/{chunk-7QAJQDHS.js → chunk-T375XV3H.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-L5VHGRQE.js';
+import { signRunnerRequest, signerFor } from './chunk-KDSKFXPE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-BLSEHKZ4.js → chunk-TS2YACAQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-GR7ZVGNI.js';
-import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-UYWGR35C.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-I2GHZ2VA.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-7GY3DVIL.js → chunk-UC4OSOQS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL_REVISION, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, HEADLESS_SHELL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_VERSION } from './chunk-QUOITPN7.js';
-import { PROXY_WARNING_FLAG } from './chunk-SDAEXUIX.js';
+import { PROXY_WARNING_FLAG } from './chunk-Z7THNFUU.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 
 createRequire(import.meta.url);
@@ -19,6 +19,13 @@ var IMAGE_BROWSER = {
   playwright: "/opt/outerlayer/browser/playwright",
   fontConfig: "/opt/outerlayer/browser/fonts.conf"
 };
+var FALLBACK_BIN = "/opt/outerlayer/fallback/bin";
+var IMAGE_GIT = "/opt/outerlayer/git";
+var CA_BUNDLE = "/opt/outerlayer/certs/ca-certificates.crt";
+function findCaBundle() {
+  const bundles = ["/etc/ssl/certs/ca-certificates.crt", "/etc/pki/tls/certs/ca-bundle.crt", "/etc/ssl/ca-bundle.pem", "/etc/ssl/cert.pem", CA_BUNDLE];
+  return `for ca in ${bundles.join(" ")}; do [ -f "$ca" ] && break; done`;
+}
 function plain(name, value, allowed) {
   if (!allowed.test(value)) throw new Error(`${name} holds a character a Dockerfile line cannot carry safely: ${JSON.stringify(value)}`);
   return value;
@@ -106,6 +113,7 @@ function toolsDockerfile(parts) {
     " && chmod 0755 /out/usr/local/bin/espeak-ng \\",
     " && chmod -R a+rX /out",
     ...browserStage({ nodeImage, fetched, download, stream }),
+    ...gitStage(nodeImage),
     `FROM ${recipeImage} AS recipe`,
     `FROM ${nodeImage} AS stage`,
     "ARG TARGETARCH",
@@ -148,7 +156,10 @@ function toolsDockerfile(parts) {
     ...fetched ? [] : [` && ${download} https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_$TARGETARCH.tar.gz /tmp/gh.tgz \\`],
     ' && echo "$gh_sha  /tmp/gh.tgz" | sha256sum -c - \\',
     " && tar -xzf /tmp/gh.tgz -C /tmp \\",
-    ` && install -m 0755 /tmp/gh_${GH_VERSION}_linux_$TARGETARCH/bin/gh /out/usr/local/bin/gh`,
+    ` && install -D -m 0755 /tmp/gh_${GH_VERSION}_linux_$TARGETARCH/bin/gh /out/opt/outerlayer/gh/gh \\`,
+    // gh checks GitHub's certificate against the system's CA certificates, which a slim recipe image does not have.
+    ` && printf '%s\\n' '#!/bin/sh' '${findCaBundle()}' 'SSL_CERT_FILE="\${SSL_CERT_FILE:-$ca}"' 'export SSL_CERT_FILE' 'exec /opt/outerlayer/gh/gh "$@"' > /out/usr/local/bin/gh \\`,
+    " && chmod 0755 /out/usr/local/bin/gh",
     "COPY --from=recipe /etc/passwd /tmp/recipe-passwd",
     "COPY --from=recipe /etc/group /tmp/recipe-group",
     `RUN uid=$(awk -F: 'BEGIN{m=1499} $3>=1500 && $3<60000 && $3>m{m=$3} END{print m+1}' /tmp/recipe-passwd) \\`,
@@ -169,17 +180,52 @@ function toolsDockerfile(parts) {
     "COPY --from=voice /out/ /",
     "COPY --from=media /out/ /",
     "COPY --from=browser /out/ /",
+    "COPY --from=git /out/ /",
     "ENV DISABLE_AUTOUPDATER=1",
+    // Last, so a recipe's own git comes first. A recipe image that sets no PATH gets the one Docker gives a container.
+    `ENV PATH=\${PATH:-/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}:${FALLBACK_BIN}`,
     // espeak-ng's audio library makes a private pulse-* folder for the user who runs it, in the temp folder unless XDG_RUNTIME_DIR names another.
     // Made here, as root, it would ship in the image where the build user cannot read it, and the runner's disk check fails on it.
     "RUN check=$(mktemp -d /tmp/ol-check.XXXXXX) \\",
     " && outerlayer --version && claude --version && gh --version && ffmpeg -version && ffprobe -version \\",
     ' && XDG_RUNTIME_DIR="$check" espeak-ng --version \\',
+    ` && git --version && ${FALLBACK_BIN}/git --version \\`,
     ` && ${IMAGE_BROWSER.playwright}/chromium_headless_shell-${HEADLESS_SHELL_REVISION}/chrome-headless-shell-linux*/chrome-headless-shell --version \\`,
     ' && rm -rf "$check"',
     ""
   ].join("\n");
 }
+function gitStage(nodeImage) {
+  const lib = `${IMAGE_GIT}/lib`;
+  const wrapper = [
+    "#!/bin/sh",
+    findCaBundle(),
+    'GIT_SSL_CAINFO="${GIT_SSL_CAINFO:-$ca}"',
+    `GIT_EXEC_PATH=${IMAGE_GIT}/git-core`,
+    `GIT_TEMPLATE_DIR="\${GIT_TEMPLATE_DIR:-${IMAGE_GIT}/templates}"`,
+    "export GIT_SSL_CAINFO GIT_EXEC_PATH GIT_TEMPLATE_DIR",
+    `exec ${IMAGE_GIT}/git-core/git "$@"`
+  ];
+  return [
+    `FROM ${nodeImage} AS git`,
+    "RUN apt-get update \\",
+    " && apt-get install -y --no-install-recommends git ca-certificates patchelf \\",
+    " && rm -rf /var/lib/apt/lists/*",
+    "RUN set -eu \\",
+    ` && mkdir -p /out${lib} /out/opt/outerlayer/certs /out${FALLBACK_BIN} \\`,
+    ` && cp -a /usr/lib/git-core /out${IMAGE_GIT}/git-core \\`,
+    ` && cp -a /usr/share/git-core/templates /out${IMAGE_GIT}/templates \\`,
+    ` && programs=$(find /out${IMAGE_GIT}/git-core -type f -exec sh -c 'head -c 4 "$1" | grep -q ELF' _ {} \\; -print) \\`,
+    ` && if ldd $programs | grep 'not found'; then echo "git needs a library this stage does not install" >&2; exit 1; fi \\`,
+    ` && cp -L $(for file in $programs; do ldd "$file" | awk '$3 ~ /^\\// {print $3}'; done | sort -u) /out${lib}/ \\`,
+    ` && cp -L $(ldd /usr/lib/git-core/git | awk '$1 ~ /ld-linux/ {print $1}') /out${lib}/ld.so \\`,
+    ` && for file in $programs; do patchelf --set-interpreter ${lib}/ld.so --force-rpath --set-rpath ${lib} "$file"; done \\`,
+    ` && cp -L /etc/ssl/certs/ca-certificates.crt /out${CA_BUNDLE} \\`,
+    ` && printf '%s\\n' ${wrapper.map((line) => `'${line}'`).join(" ")} > /out${FALLBACK_BIN}/git \\`,
+    ` && chmod 0755 /out${FALLBACK_BIN}/git \\`,
+    " && chmod -R a+rX /out"
+  ];
+}
 function browserStage(parts) {
   const { fetched } = parts;
   const libraries = [

package/dist/{chunk-MPNASRYB.js → chunk-UDRBQI5J.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-TZMDRHWB.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-QABXXQ67.js';
-import { isLinkedRepository } from './chunk-O7QPHJWN.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-NGZBVN6F.js';
+import { isLinkedRepository } from './chunk-L7RPNSAA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-JA2ARVY6.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-QTAADTIO.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { checkFormerSkillNames } from './chunk-LMYRR5MO.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-7QAJQDHS.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-CCHSD7RS.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-T375XV3H.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-CHDWAWQA.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-RZ7AZKTY.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-NGCQD6SN.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-WMIRA4RD.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-CWYMIXTV.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-QENPDYBD.js');
+    const { runnerHostChecks } = await import('./doctor-5VNZ2BLY.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1236,7 +1236,7 @@ async function gatherDoctorChecks() {
     const runner = (() => {
       try {
         const { concurrency, build, housekeeping, managed } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: build?.cacheDisk ?? DEFAULT_CACHE_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
+        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: build?.cacheDisk ?? DEFAULT_CACHE_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.egress === void 0 ? {} : { egress: build.egress }, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
       } catch {
         return void 0;
       }
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-IOCVYPNW.js');
+      const { inspectRunnerService } = await import('./find-unit-R4I5GJCH.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-7QF2EXAN.js → chunk-UXGWAAGQ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-DEJCZ43H.js';
-import { parseSize } from './chunk-GR7ZVGNI.js';
-import { runnerDir } from './chunk-GJ4KBHBD.js';
-import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-SDAEXUIX.js';
+import { builtinKind, keepsHostBuilder } from './chunk-RO2NZJHZ.js';
+import { parseSize } from './chunk-UYWGR35C.js';
+import { runnerDir } from './chunk-I2GHZ2VA.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-Z7THNFUU.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-GR7ZVGNI.js → chunk-UYWGR35C.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { resolveDevcontainerCli, devcontainerBuildInvocation, RecipeError } from './chunk-HDLON3RJ.js';
 import { BUILDKIT_IMAGE } from './chunk-QUOITPN7.js';
-import { ensureHostKey } from './chunk-L5VHGRQE.js';
+import { ensureHostKey } from './chunk-KDSKFXPE.js';
 import { compareVersions } from './chunk-OOD5NDQA.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-GJ4KBHBD.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-I2GHZ2VA.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-Z7THNFUU.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { mkdirSync, createWriteStream, rmSync, existsSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';

package/dist/{chunk-LQHCNXPK.js → chunk-W5EKMK37.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-JM3YQ4LC.js → chunk-W774NREK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-FQOUIYBL.js';
-import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SDELQEG4.js';
+import { stripTerminalControls } from './chunk-SJY6A6EH.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-HO4XRLAZ.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-TRGA5QRL.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-IUPWQ2RK.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-GK6OYFMU.js → chunk-WS5E73JO.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { criteriaOf, loadCitationFinder, hostItemsOf, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, NO_CITING_TEST_REASON, NO_VERDICT_REASON, planCriteria } from './chunk-6CK2OC4Q.js';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-QABXXQ67.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-NGZBVN6F.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { defaultFetch } from './chunk-7QAJQDHS.js';
+import { defaultFetch } from './chunk-T375XV3H.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
@@ -167,14 +167,14 @@ function governingDir(cwd) {
 async function testProofMode(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return "any";
-  const { testProofIn } = await import('./host-checks-UNEQTQ6L.js');
+  const { testProofIn } = await import('./host-checks-VKBAGGWH.js');
   return testProofIn(dir);
 }
 async function judgeCheckName(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return {};
   if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
-  const { checksIn, isJudgeCheck } = await import('./host-checks-UNEQTQ6L.js');
+  const { checksIn, isJudgeCheck } = await import('./host-checks-VKBAGGWH.js');
   const quiet = { line: () => void 0, error: () => void 0 };
   const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
   return check === void 0 ? {} : { name: check.name };
@@ -314,7 +314,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-XG544MGV.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-AYUWUFBE.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-VUJURIPJ.js → chunk-XEJ5USHY.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-AHAYHJNN.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-7QF2EXAN.js';
-import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-DEJCZ43H.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-BLSEHKZ4.js';
+import { placeholderQueues, placeholderProblem } from './chunk-ARPPH7VS.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-UXGWAAGQ.js';
+import { builtinKind, EGRESS_SWITCHABLE_KEYS, imageBuildOf, keepsHostBuilder } from './chunk-RO2NZJHZ.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-TS2YACAQ.js';
 import { builderDiskPinned } from './chunk-QUOITPN7.js';
-import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-SDAEXUIX.js';
+import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-Z7THNFUU.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem } from 'os';
@@ -56,6 +56,13 @@ function managedProblems(facts) {
       reason: "runner.build.allowHosts is not set, and a managed runner needs it so that a build reaches only the public hosts it lists. List the hosts your builds need; an empty list allows none"
     });
   }
+  const off = EGRESS_SWITCHABLE_KEYS.filter((key) => facts.egress?.[key] === 0);
+  if (off.length > 0) {
+    problems.push({
+      condition: "egress",
+      reason: `${off.map((key) => `runner.build.egress.${key}`).join(" and ")} ${off.length === 1 ? "is" : "are"} 0, which turns ${off.length === 1 ? "that limit" : "those limits"} off. A managed runner limits how fast a build opens connections and sends bytes, because every organization on the host shares one address. Remove ${off.length === 1 ? "the key" : "the keys"} to use the default, or set a value above 0`
+    });
+  }
   if (builtinKind(facts.provision) === "vm") {
     if (facts.imageBuild === "host") {
       problems.push({
@@ -92,6 +99,7 @@ function managedFactsOf(config, probes) {
     jailer: probes.jailer ?? "unknown",
     credentials: /* @__PURE__ */ new Set([...claudeCredentialVariablesSet(probes.env), ...credentialsInFiles(config.configPath)]),
     allowHosts: config.build?.allowHosts,
+    egress: config.build?.egress,
     imageBuild: imageBuildOf(config),
     builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
   };

package/dist/{chunk-Q2KGDDUX.js → chunk-XSUM3E67.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-7QF2EXAN.js';
-import { RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
-import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-SDAEXUIX.js';
+import { DEFAULT_UNIT_NAME } from './chunk-UXGWAAGQ.js';
+import { RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
+import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-Z7THNFUU.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-CFFVCI2I.js → chunk-XZGURZHF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-SDAEXUIX.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-Z7THNFUU.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-WBTPI5MP.js → chunk-YGX72FUQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-QRJIBTNQ.js';
-import { spoolDir } from './chunk-CCHSD7RS.js';
+import { LiveUploader } from './chunk-B7LPFCIN.js';
+import { spoolDir } from './chunk-CHDWAWQA.js';
 import { CaptureDaemon } from './chunk-OOD5NDQA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-OKGHWCSK.js → chunk-YIBHQR3B.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-O7QPHJWN.js';
-import { resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-L7RPNSAA.js';
+import { resolveGatewayCredentials } from './chunk-T375XV3H.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';

package/dist/{chunk-SDAEXUIX.js → chunk-Z7THNFUU.js}

@@ -618,6 +618,7 @@ async function startBuildServices(input) {
     ...streamed ? { socket: false } : {},
     ...streamed ? {} : listenOnFor("tunnel.sock"),
     ...input.allowHosts === void 0 ? {} : { allowHosts: input.allowHosts },
+    ...input.egress === void 0 ? {} : { egress: input.egress },
     recordPath: join(input.jobDir, "tunnel.json")
   });
   const servers = [];

package/dist/{chunk-3VZTNXK5.js → chunk-ZV6GOXYA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-6KFJIU73.js';
+import { EXEC_PORT } from './chunk-RMJSYOSV.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{claude-launcher-EO3ALKBS.js → claude-launcher-SGZSOGKZ.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-BDSUP4DK.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-UM4IHOJQ.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);