@outerlayer/cli 0.34.0-next.20261027023105 → 0.34.0-next.20261027121359

package/dist/{chunk-DX4FF5P5.js → chunk-SJY6A6EH.js}

@@ -2,26 +2,26 @@
 import { createRequire } from 'node:module';
 import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-6CK2OC4Q.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-P3NPTFLF.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-6SJ3DJDH.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-WBTPI5MP.js';
-import { installScrubContext } from './chunk-QRJIBTNQ.js';
-import { writeDockerClientConfig } from './chunk-CFFVCI2I.js';
+import { senderPidfile } from './chunk-YGX72FUQ.js';
+import { installScrubContext } from './chunk-B7LPFCIN.js';
+import { writeDockerClientConfig } from './chunk-XZGURZHF.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-LKTH7PUH.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-IYQPUGST.js';
-import { waitForAgent, vmExecArgs } from './chunk-3VZTNXK5.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-6KFJIU73.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-77VBS2RT.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-DEJCZ43H.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-BLSEHKZ4.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-GR7ZVGNI.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-ARPPH7VS.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-SGT7YU3X.js';
+import { waitForAgent, vmExecArgs } from './chunk-ZV6GOXYA.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-RMJSYOSV.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-66TKWWTX.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-RO2NZJHZ.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-TS2YACAQ.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-UYWGR35C.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-QUOITPN7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-QABXXQ67.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-NGZBVN6F.js';
 import { planArtifactUpload } from './chunk-IXPH4EXK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-L5VHGRQE.js';
+import { signerFor } from './chunk-KDSKFXPE.js';
 import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-OVNF4LLC.js';
 import { scrubText } from './chunk-OOD5NDQA.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
@@ -29,8 +29,8 @@ import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-XFJ7YOPD.js';
 import { CheckItemsSchema } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-GJ4KBHBD.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-SDAEXUIX.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-I2GHZ2VA.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-Z7THNFUU.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
 import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, lstatSync, realpathSync, fstatSync, readSync } from 'fs';
@@ -217,6 +217,7 @@ function builderMachineFor(config, jobDir, assets, limits) {
     limits: { ...limits, cacheDiskBytes: parseSize(config.build?.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK) },
     memory: memoryTextOf(config, jobDir, limits),
     allowHosts: withFactoryHosts(config.build?.allowHosts, managedBuildSettingsFor(jobDir)),
+    ...optionalEgress(config),
     managed: config.managed === true,
     timeLimitMinutes: config.timeLimitMinutes
   };
@@ -2297,6 +2298,7 @@ function scrubTunnelRecord(record, config) {
     refusalsMore: record.refusalsMore,
     refusals: record.refusals.map((r) => ({ ...r, host: scrubText(r.host) })),
     destinations: (record.destinations ?? []).map((name) => scrubText(name)),
+    ...record.egress === void 0 ? {} : { egress: record.egress },
     ...record.routes === void 0 ? {} : { routes: Object.fromEntries(Object.entries(record.routes).map(([name, counts]) => [scrubText(name), counts])) }
   };
 }
@@ -2909,15 +2911,19 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     );
   } else if (release.ok) {
     log.line(
-      outcome === void 0 ? `${tag} released \xB7 not attempted (provision exit 75) \xB7 ${total}` : `${tag} released \xB7 outcome ${outcome} \xB7 ${total}`
+      outcome === void 0 ? `${tag} released \xB7 not attempted (provision exit 75) \xB7 ${total}` : `${tag} released \xB7 outcome ${outcome} \xB7 ${total}${egressText(tunnelRecord)}`
     );
   } else {
     log.error(
-      `${tag} release failed after ${release.attempts} attempt(s): ${release.reason}; the lease expires at ${formatClock(leaseExpiry(job, endedAt), endedAt)}`
+      `${tag} release failed after ${release.attempts} attempt(s): ${release.reason}; the lease expires at ${formatClock(leaseExpiry(job, endedAt), endedAt)}${egressText(tunnelRecord)}`
     );
   }
   return job;
 }
+function egressText(record) {
+  if (record === void 0) return "";
+  return record.egress === void 0 ? " \xB7 tunnel counts not recorded" : ` \xB7 ${egressSummary(record.egress)}`;
+}
 function readLogState(logPath) {
   try {
     const stats = statSync(logPath);

package/dist/{chunk-7QAJQDHS.js → chunk-T375XV3H.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-L5VHGRQE.js';
+import { signRunnerRequest, signerFor } from './chunk-KDSKFXPE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-BLSEHKZ4.js → chunk-TS2YACAQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-GR7ZVGNI.js';
-import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-UYWGR35C.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-I2GHZ2VA.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-GTBY7BTI.js → chunk-UC4OSOQS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL_REVISION, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, HEADLESS_SHELL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_VERSION } from './chunk-QUOITPN7.js';
-import { PROXY_WARNING_FLAG } from './chunk-SDAEXUIX.js';
+import { PROXY_WARNING_FLAG } from './chunk-Z7THNFUU.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-SSRB5HEL.js → chunk-UDRBQI5J.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-TZMDRHWB.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-QABXXQ67.js';
-import { isLinkedRepository } from './chunk-O7QPHJWN.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-NGZBVN6F.js';
+import { isLinkedRepository } from './chunk-L7RPNSAA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-JA2ARVY6.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-QTAADTIO.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { checkFormerSkillNames } from './chunk-LMYRR5MO.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-7QAJQDHS.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-CCHSD7RS.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-T375XV3H.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-CHDWAWQA.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-RZ7AZKTY.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-NGCQD6SN.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-WMIRA4RD.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-CWYMIXTV.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-NEO7NXJJ.js');
+    const { runnerHostChecks } = await import('./doctor-5VNZ2BLY.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1236,7 +1236,7 @@ async function gatherDoctorChecks() {
     const runner = (() => {
       try {
         const { concurrency, build, housekeeping, managed } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: build?.cacheDisk ?? DEFAULT_CACHE_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
+        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: build?.cacheDisk ?? DEFAULT_CACHE_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.egress === void 0 ? {} : { egress: build.egress }, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
       } catch {
         return void 0;
       }
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-IOCVYPNW.js');
+      const { inspectRunnerService } = await import('./find-unit-R4I5GJCH.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-7QF2EXAN.js → chunk-UXGWAAGQ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-DEJCZ43H.js';
-import { parseSize } from './chunk-GR7ZVGNI.js';
-import { runnerDir } from './chunk-GJ4KBHBD.js';
-import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-SDAEXUIX.js';
+import { builtinKind, keepsHostBuilder } from './chunk-RO2NZJHZ.js';
+import { parseSize } from './chunk-UYWGR35C.js';
+import { runnerDir } from './chunk-I2GHZ2VA.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-Z7THNFUU.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-GR7ZVGNI.js → chunk-UYWGR35C.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { resolveDevcontainerCli, devcontainerBuildInvocation, RecipeError } from './chunk-HDLON3RJ.js';
 import { BUILDKIT_IMAGE } from './chunk-QUOITPN7.js';
-import { ensureHostKey } from './chunk-L5VHGRQE.js';
+import { ensureHostKey } from './chunk-KDSKFXPE.js';
 import { compareVersions } from './chunk-OOD5NDQA.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-GJ4KBHBD.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-I2GHZ2VA.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-Z7THNFUU.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { mkdirSync, createWriteStream, rmSync, existsSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';

package/dist/{chunk-LQHCNXPK.js → chunk-W5EKMK37.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-WPDL7MBC.js → chunk-W774NREK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-DX4FF5P5.js';
-import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SDELQEG4.js';
+import { stripTerminalControls } from './chunk-SJY6A6EH.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-HO4XRLAZ.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-TRGA5QRL.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-IUPWQ2RK.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-36U7LY7C.js → chunk-WS5E73JO.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { criteriaOf, loadCitationFinder, hostItemsOf, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, NO_CITING_TEST_REASON, NO_VERDICT_REASON, planCriteria } from './chunk-6CK2OC4Q.js';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-QABXXQ67.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-NGZBVN6F.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { defaultFetch } from './chunk-7QAJQDHS.js';
+import { defaultFetch } from './chunk-T375XV3H.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
@@ -167,14 +167,14 @@ function governingDir(cwd) {
 async function testProofMode(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return "any";
-  const { testProofIn } = await import('./host-checks-JH2ILNZT.js');
+  const { testProofIn } = await import('./host-checks-VKBAGGWH.js');
   return testProofIn(dir);
 }
 async function judgeCheckName(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return {};
   if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
-  const { checksIn, isJudgeCheck } = await import('./host-checks-JH2ILNZT.js');
+  const { checksIn, isJudgeCheck } = await import('./host-checks-VKBAGGWH.js');
   const quiet = { line: () => void 0, error: () => void 0 };
   const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
   return check === void 0 ? {} : { name: check.name };
@@ -314,7 +314,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-YG6HD6SJ.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-AYUWUFBE.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-ZK3A4W3I.js → chunk-XEJ5USHY.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-LKTH7PUH.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-7QF2EXAN.js';
-import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-DEJCZ43H.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-BLSEHKZ4.js';
+import { placeholderQueues, placeholderProblem } from './chunk-ARPPH7VS.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-UXGWAAGQ.js';
+import { builtinKind, EGRESS_SWITCHABLE_KEYS, imageBuildOf, keepsHostBuilder } from './chunk-RO2NZJHZ.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-TS2YACAQ.js';
 import { builderDiskPinned } from './chunk-QUOITPN7.js';
-import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-SDAEXUIX.js';
+import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-Z7THNFUU.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem } from 'os';
@@ -56,6 +56,13 @@ function managedProblems(facts) {
       reason: "runner.build.allowHosts is not set, and a managed runner needs it so that a build reaches only the public hosts it lists. List the hosts your builds need; an empty list allows none"
     });
   }
+  const off = EGRESS_SWITCHABLE_KEYS.filter((key) => facts.egress?.[key] === 0);
+  if (off.length > 0) {
+    problems.push({
+      condition: "egress",
+      reason: `${off.map((key) => `runner.build.egress.${key}`).join(" and ")} ${off.length === 1 ? "is" : "are"} 0, which turns ${off.length === 1 ? "that limit" : "those limits"} off. A managed runner limits how fast a build opens connections and sends bytes, because every organization on the host shares one address. Remove ${off.length === 1 ? "the key" : "the keys"} to use the default, or set a value above 0`
+    });
+  }
   if (builtinKind(facts.provision) === "vm") {
     if (facts.imageBuild === "host") {
       problems.push({
@@ -92,6 +99,7 @@ function managedFactsOf(config, probes) {
     jailer: probes.jailer ?? "unknown",
     credentials: /* @__PURE__ */ new Set([...claudeCredentialVariablesSet(probes.env), ...credentialsInFiles(config.configPath)]),
     allowHosts: config.build?.allowHosts,
+    egress: config.build?.egress,
     imageBuild: imageBuildOf(config),
     builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
   };

package/dist/{chunk-Q2KGDDUX.js → chunk-XSUM3E67.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-7QF2EXAN.js';
-import { RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
-import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-SDAEXUIX.js';
+import { DEFAULT_UNIT_NAME } from './chunk-UXGWAAGQ.js';
+import { RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
+import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-Z7THNFUU.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-CFFVCI2I.js → chunk-XZGURZHF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-SDAEXUIX.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-Z7THNFUU.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-WBTPI5MP.js → chunk-YGX72FUQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-QRJIBTNQ.js';
-import { spoolDir } from './chunk-CCHSD7RS.js';
+import { LiveUploader } from './chunk-B7LPFCIN.js';
+import { spoolDir } from './chunk-CHDWAWQA.js';
 import { CaptureDaemon } from './chunk-OOD5NDQA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-OKGHWCSK.js → chunk-YIBHQR3B.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-O7QPHJWN.js';
-import { resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-L7RPNSAA.js';
+import { resolveGatewayCredentials } from './chunk-T375XV3H.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';

package/dist/{chunk-SDAEXUIX.js → chunk-Z7THNFUU.js}

@@ -618,6 +618,7 @@ async function startBuildServices(input) {
     ...streamed ? { socket: false } : {},
     ...streamed ? {} : listenOnFor("tunnel.sock"),
     ...input.allowHosts === void 0 ? {} : { allowHosts: input.allowHosts },
+    ...input.egress === void 0 ? {} : { egress: input.egress },
     recordPath: join(input.jobDir, "tunnel.json")
   });
   const servers = [];

package/dist/{chunk-3VZTNXK5.js → chunk-ZV6GOXYA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-6KFJIU73.js';
+import { EXEC_PORT } from './chunk-RMJSYOSV.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{claude-launcher-EO3ALKBS.js → claude-launcher-SGZSOGKZ.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-BDSUP4DK.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-UM4IHOJQ.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);