@outerlayer/cli 0.34.0-next.20261027023105 → 0.34.0-next.20261027162612

package/dist/{chunk-MYLOOVRJ.js → chunk-JO4SAEHH.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession, transcriptPathForSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-62URQYCB.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-OOD5NDQA.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-A6PJSNP6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-3VZTNXK5.js → chunk-JVNQNKHV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-6KFJIU73.js';
+import { EXEC_PORT } from './chunk-BS3OYFAD.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-DEJCZ43H.js → chunk-JWMJMQRF.js}

@@ -1,16 +1,64 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-BLSEHKZ4.js';
-import { parseSize } from './chunk-GR7ZVGNI.js';
-import { builderDiskPinned } from './chunk-QUOITPN7.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-LYX2RRSF.js';
+import { parseSize } from './chunk-FLHBUQ2W.js';
+import { builderDiskPinned } from './chunk-WX2HW2G2.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-SDAEXUIX.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-GMKDAF37.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';
 
 createRequire(import.meta.url);
 
+// src/runner/container/egress.ts
+var MANAGED_EGRESS = {
+  connectionsPerSecond: 20,
+  connectionBurst: 200,
+  openConnections: 256,
+  sendBytesPerSecond: 2e7,
+  flagHosts: 100
+};
+var EGRESS_SWITCHABLE_KEYS = ["connectionsPerSecond", "openConnections", "sendBytesPerSecond", "flagHosts"];
+var emptyEgressCounts = () => ({
+  connectionsOpened: 0,
+  peakConnectionsPerSecond: 0,
+  peakOpenConnections: 0,
+  bytesSent: 0,
+  refused: { connectionRate: 0, openConnections: 0 },
+  hostsFlagged: false
+});
+var systemClock = { now: () => performance.now(), sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+function resolveEgress(given, managed) {
+  if (!managed && given === void 0) return void 0;
+  const base = managed ? MANAGED_EGRESS : { connectionsPerSecond: 0, connectionBurst: MANAGED_EGRESS.connectionBurst, openConnections: 0, sendBytesPerSecond: 0, flagHosts: 0 };
+  return { ...base, ...given };
+}
+var plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+function bytesText(n) {
+  if (n < 1024) return `${n} B`;
+  const units = ["KiB", "MiB", "GiB", "TiB"];
+  let value = n / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return `${value.toFixed(1)} ${units[unit]}`;
+}
+function egressSummary(counts) {
+  const parts = [
+    `tunnel ${plural(counts.connectionsOpened ?? 0, "connection", "connections")} opened`,
+    `peak ${counts.peakConnectionsPerSecond ?? 0} in one second`,
+    `peak ${counts.peakOpenConnections ?? 0} open`,
+    `${bytesText(counts.bytesSent ?? 0)} sent`,
+    `refused ${counts.refused?.connectionRate ?? 0} by connection-rate`,
+    `refused ${counts.refused?.openConnections ?? 0} by open-connections`
+  ];
+  if (counts.hostsFlagged) parts.push("flagged for reaching many remote hosts");
+  return parts.join(" \xB7 ");
+}
+
 // src/runner/allow-hosts.ts
 var MAX_ALLOW_HOSTS = 500;
 var LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
@@ -82,7 +130,8 @@ function imageBuildOf(config) {
 function keepsHostBuilder(config, builderDiskIsPinned) {
   return !(imageBuildOf(config) === "vm" && (builderDiskIsPinned ?? builderDiskPinned()));
 }
-var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "cacheDisk", "variables", "destinations", "allowHosts", "imageBuild"];
+var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "cacheDisk", "variables", "destinations", "allowHosts", "imageBuild", "egress"];
+var EGRESS_KEYS = ["connectionsPerSecond", "connectionBurst", "openConnections", "sendBytesPerSecond", "flagHosts"];
 var HOUSEKEEPING_KEYS = ["jobsKeepDays", "buildCacheMax", "minFreeDisk"];
 var DEFAULT_JOBS_KEEP_DAYS = 30;
 var DEFAULT_BUILD_CACHE_MAX = "20g";
@@ -446,6 +495,7 @@ function resolveBuild(configPath, block) {
   if (given.imageBuild !== void 0 && given.imageBuild !== "vm" && given.imageBuild !== "host") {
     fail(configPath, "runner.build.imageBuild", "must be vm or host");
   }
+  const egress = resolveEgressBlock(configPath, given.egress);
   return {
     memory: given.memory ?? DEFAULT_BUILD.memory,
     cpus: given.cpus ?? DEFAULT_BUILD.cpus,
@@ -455,8 +505,34 @@ function resolveBuild(configPath, block) {
     variables,
     ...destinations.length === 0 ? {} : { destinations },
     ...allowHosts === void 0 ? {} : { allowHosts },
-    ...given.imageBuild === void 0 ? {} : { imageBuild: given.imageBuild }
+    ...given.imageBuild === void 0 ? {} : { imageBuild: given.imageBuild },
+    ...egress === void 0 ? {} : { egress }
   };
 }
+function resolveEgressBlock(configPath, block) {
+  if (block === void 0) return void 0;
+  if (typeof block !== "object" || block === null || Array.isArray(block)) fail(configPath, "runner.build.egress", "must be an object");
+  const given = block;
+  const out = {};
+  for (const [key, value] of Object.entries(given)) {
+    if (!EGRESS_KEYS.includes(key)) {
+      const near = nearestKey(key, EGRESS_KEYS);
+      fail(configPath, `runner.build.egress.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+    }
+    const least = key === "connectionBurst" ? 1 : 0;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < least) {
+      fail(configPath, `runner.build.egress.${key}`, least === 1 ? "must be a whole number of at least 1" : "must be a whole number of 0 or more; 0 turns the limit off");
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function optionalEgress(config) {
+  const egress = egressLimitsOf(config);
+  return egress === void 0 ? {} : { egress };
+}
+function egressLimitsOf(config) {
+  return resolveEgress(config.build?.egress, config.managed === true);
+}
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, MAX_ALLOW_HOSTS, RunnerConfigError, allowHostProblem, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, hostAllowed, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, keepsHostBuilder, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, EGRESS_SWITCHABLE_KEYS, MAX_ALLOW_HOSTS, RunnerConfigError, allowHostProblem, builtinKind, checkHooks, defaultRunnerConfigPath, egressSummary, emptyEgressCounts, hasRunnerBlock, hostAllowed, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, keepsHostBuilder, loadRunnerConfig, optionalEgress, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf, systemClock };

package/dist/{chunk-JL4GSPGD.js → chunk-KVGK2JL3.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-DX4FF5P5.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-7QF2EXAN.js';
-import { RunnerAlreadyRunningError, readPidFile } from './chunk-LQHCNXPK.js';
+import { scrubReason, stripTerminalControls } from './chunk-BCIBSJZH.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-OHTMTMFX.js';
+import { RunnerAlreadyRunningError, readPidFile } from './chunk-3FTIUB7I.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, postJson } from './chunk-QABXXQ67.js';
-import { signerFor } from './chunk-L5VHGRQE.js';
-import { pidFilePath } from './chunk-GJ4KBHBD.js';
+import { isSignatureRefusal, postJson } from './chunk-6IMQXBTZ.js';
+import { signerFor } from './chunk-RJZZFAXS.js';
+import { pidFilePath } from './chunk-3VJYDWFV.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-BLSEHKZ4.js → chunk-LYX2RRSF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-GR7ZVGNI.js';
-import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-FLHBUQ2W.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-3VJYDWFV.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-WPDL7MBC.js → chunk-MGF346ND.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-DX4FF5P5.js';
-import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SDELQEG4.js';
+import { stripTerminalControls } from './chunk-BCIBSJZH.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-CFJOONWM.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-TRGA5QRL.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-5VGCFZV2.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-SSRB5HEL.js → chunk-N33OOF3K.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-TZMDRHWB.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-QABXXQ67.js';
-import { isLinkedRepository } from './chunk-O7QPHJWN.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-6IMQXBTZ.js';
+import { isLinkedRepository } from './chunk-NO6E72RM.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-JA2ARVY6.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-T6ALNN3H.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { checkFormerSkillNames } from './chunk-LMYRR5MO.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-7QAJQDHS.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-CCHSD7RS.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-62URQYCB.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-4QQJTJUN.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-OOD5NDQA.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-A6PJSNP6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-URIZRCRY.js';
 import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-RZ7AZKTY.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-NGCQD6SN.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-NFMQCZM3.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-5NWSCHIO.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-NEO7NXJJ.js');
+    const { runnerHostChecks } = await import('./doctor-AG73VZNG.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1236,7 +1236,7 @@ async function gatherDoctorChecks() {
     const runner = (() => {
       try {
         const { concurrency, build, housekeeping, managed } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: build?.cacheDisk ?? DEFAULT_CACHE_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
+        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: build?.cacheDisk ?? DEFAULT_CACHE_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.egress === void 0 ? {} : { egress: build.egress }, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
       } catch {
         return void 0;
       }
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-IOCVYPNW.js');
+      const { inspectRunnerService } = await import('./find-unit-YGDFVHVU.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-36U7LY7C.js → chunk-NEBMTP7T.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { criteriaOf, loadCitationFinder, hostItemsOf, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, NO_CITING_TEST_REASON, NO_VERDICT_REASON, planCriteria } from './chunk-6CK2OC4Q.js';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-QABXXQ67.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-6IMQXBTZ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { defaultFetch } from './chunk-7QAJQDHS.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { defaultFetch } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { readDeliveryRecord } from './chunk-YQR6E6OV.js';
@@ -167,14 +167,14 @@ function governingDir(cwd) {
 async function testProofMode(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return "any";
-  const { testProofIn } = await import('./host-checks-JH2ILNZT.js');
+  const { testProofIn } = await import('./host-checks-6G2F2HTK.js');
   return testProofIn(dir);
 }
 async function judgeCheckName(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return {};
   if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
-  const { checksIn, isJudgeCheck } = await import('./host-checks-JH2ILNZT.js');
+  const { checksIn, isJudgeCheck } = await import('./host-checks-6G2F2HTK.js');
   const quiet = { line: () => void 0, error: () => void 0 };
   const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
   return check === void 0 ? {} : { name: check.name };
@@ -314,7 +314,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-YG6HD6SJ.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-AVKJFZOD.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-O7QPHJWN.js → chunk-NO6E72RM.js}

@@ -3,10 +3,10 @@ import { createRequire } from 'node:module';
 import { DEFAULT_DASHBOARD } from './chunk-NWHU5G6R.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-62URQYCB.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { remoteLookupFailed } from './chunk-OOD5NDQA.js';
+import { remoteLookupFailed } from './chunk-A6PJSNP6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { lstatSync } from 'fs';

package/dist/{chunk-7QF2EXAN.js → chunk-OHTMTMFX.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-DEJCZ43H.js';
-import { parseSize } from './chunk-GR7ZVGNI.js';
-import { runnerDir } from './chunk-GJ4KBHBD.js';
-import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-SDAEXUIX.js';
+import { builtinKind, keepsHostBuilder } from './chunk-JWMJMQRF.js';
+import { parseSize } from './chunk-FLHBUQ2W.js';
+import { runnerDir } from './chunk-3VJYDWFV.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-GMKDAF37.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-Q2KGDDUX.js → chunk-OP2L7OXA.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-7QF2EXAN.js';
-import { RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
-import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-SDAEXUIX.js';
+import { DEFAULT_UNIT_NAME } from './chunk-OHTMTMFX.js';
+import { RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
+import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-GMKDAF37.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-WBTPI5MP.js → chunk-QRIE4JZE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-QRJIBTNQ.js';
-import { spoolDir } from './chunk-CCHSD7RS.js';
-import { CaptureDaemon } from './chunk-OOD5NDQA.js';
+import { LiveUploader } from './chunk-7SJNVGVC.js';
+import { spoolDir } from './chunk-4QQJTJUN.js';
+import { CaptureDaemon } from './chunk-A6PJSNP6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-ZK3A4W3I.js → chunk-QWSAZGH6.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-LKTH7PUH.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-7QF2EXAN.js';
-import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-DEJCZ43H.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-BLSEHKZ4.js';
-import { builderDiskPinned } from './chunk-QUOITPN7.js';
-import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-SDAEXUIX.js';
+import { placeholderQueues, placeholderProblem } from './chunk-J3Q3QCOF.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-OHTMTMFX.js';
+import { builtinKind, EGRESS_SWITCHABLE_KEYS, imageBuildOf, keepsHostBuilder } from './chunk-JWMJMQRF.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-LYX2RRSF.js';
+import { builderDiskPinned } from './chunk-WX2HW2G2.js';
+import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-GMKDAF37.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem } from 'os';
@@ -56,6 +56,13 @@ function managedProblems(facts) {
       reason: "runner.build.allowHosts is not set, and a managed runner needs it so that a build reaches only the public hosts it lists. List the hosts your builds need; an empty list allows none"
     });
   }
+  const off = EGRESS_SWITCHABLE_KEYS.filter((key) => facts.egress?.[key] === 0);
+  if (off.length > 0) {
+    problems.push({
+      condition: "egress",
+      reason: `${off.map((key) => `runner.build.egress.${key}`).join(" and ")} ${off.length === 1 ? "is" : "are"} 0, which turns ${off.length === 1 ? "that limit" : "those limits"} off. A managed runner limits how fast a build opens connections and sends bytes, because every organization on the host shares one address. Remove ${off.length === 1 ? "the key" : "the keys"} to use the default, or set a value above 0`
+    });
+  }
   if (builtinKind(facts.provision) === "vm") {
     if (facts.imageBuild === "host") {
       problems.push({
@@ -92,6 +99,7 @@ function managedFactsOf(config, probes) {
     jailer: probes.jailer ?? "unknown",
     credentials: /* @__PURE__ */ new Set([...claudeCredentialVariablesSet(probes.env), ...credentialsInFiles(config.configPath)]),
     allowHosts: config.build?.allowHosts,
+    egress: config.build?.egress,
     imageBuild: imageBuildOf(config),
     builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
   };

package/dist/{chunk-7DK2FOZ4.js → chunk-RCAMBC3H.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { acquireSpoolLockAt } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-DINRXUQA.js';

package/dist/{chunk-L5VHGRQE.js → chunk-RJZZFAXS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-JA2ARVY6.js → chunk-T6ALNN3H.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-7QAJQDHS.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-62URQYCB.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-LASKTDCR.js';

package/dist/{chunk-HOUFCUMH.js → chunk-UZIAZXXO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-25XBOX3K.js → chunk-W246VXU4.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { CriteriaListSchema } from './chunk-DINRXUQA.js';

package/dist/{chunk-YL3RWW7X.js → chunk-WR2GRWK3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-QUOITPN7.js → chunk-WX2HW2G2.js}

@@ -127,5 +127,12 @@ var PLAYWRIGHT_FFMPEG = {
   arm64: { file: "ffmpeg-linux-arm64.zip", sha256: "457360e803a7d8d5f8f7f5ecf562b2d338f6b4f7f86339d0c31938a451e8878b" }
 };
 var MEDIA_PINS = `${VOICE_PACK_VERSION}+${FFMPEG_BUILD_TAG}+${HEADLESS_SHELL_VERSION}+${PLAYWRIGHT_FFMPEG_REVISION}`;
+var UNIVERSAL_IMAGE_REPOSITORY = "ghcr.io/outerlayerai/universal";
+var UNIVERSAL_IMAGE_SOURCE = "src-b56adab2806597e3723d8f85e2fef49208761343b1920e9ba58d1c753d1d6974";
+var UNIVERSAL_IMAGE_DIGEST = "sha256:4bee63278f05473e840fd2f56eae0ef1048e18039e65e38b642c1933d5dcd1ea";
+var UNIVERSAL_IMAGE = `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}@${UNIVERSAL_IMAGE_DIGEST}`;
+function universalImagePinned(digest = UNIVERSAL_IMAGE_DIGEST) {
+  return digest !== `sha256:${"0".repeat(64)}`;
+}
 
-export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, HEADLESS_SHELL_REVISION, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice };
+export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, HEADLESS_SHELL_REVISION, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice, universalImagePinned };

package/dist/{chunk-HDLON3RJ.js → chunk-X7M73LKT.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_DIGEST } from './chunk-WX2HW2G2.js';
 import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync } from 'fs';
 import { join, resolve, relative, dirname, sep, basename } from 'path';
 import { createRequire as createRequire$1 } from 'module';
@@ -138,6 +139,12 @@ var RecipeError = class extends Error {
     this.logPath = logPath;
   }
 };
+function universalImagePending() {
+  return new RecipeError(
+    "universal_image_pending",
+    `this CLI pins ${UNIVERSAL_IMAGE_REPOSITORY} at ${UNIVERSAL_IMAGE_DIGEST}, a digest CI has not published yet. A repository with no devcontainer file cannot be built until the pin names a published image`
+  );
+}
 var DIR_RECIPE = ".devcontainer/devcontainer.json";
 var ROOT_RECIPE = ".devcontainer.json";
 function locateRecipe(checkoutDir) {
@@ -217,7 +224,7 @@ function assertBuildable(checkoutDir, location, recipe) {
   }
 }
 function writeSanitizedRecipe(checkoutDir, location, recipe) {
-  if (location.kind === "default") throw new Error("the default image has no recipe to sanitize");
+  if (location.kind === "default") throw new Error("a build with no devcontainer file has no recipe to sanitize");
   const path = location.path === ROOT_RECIPE ? join(checkoutDir, ".outerlayer-recipe.json") : join(checkoutDir, ".devcontainer", SANITIZED_NAME);
   writeFileSync(path, `${JSON.stringify(sanitizeRecipe(recipe), null, 2)}
 `);
@@ -271,4 +278,4 @@ function devcontainerBuildInvocation(cli, req) {
   };
 }
 
-export { DOCKER_FEATURE, RecipeError, SANITIZED_NAME, assertBuildable, buildRootFromDist, classifyProperties, devcontainerBuildInvocation, locateRecipe, readRecipe, resolveDevcontainerCli, writeSanitizedRecipe };
+export { DOCKER_FEATURE, RecipeError, SANITIZED_NAME, assertBuildable, buildRootFromDist, classifyProperties, devcontainerBuildInvocation, locateRecipe, readRecipe, resolveDevcontainerCli, universalImagePending, writeSanitizedRecipe };

package/dist/{chunk-WYR4INK3.js → chunk-Z4LFCJT6.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{claude-launcher-EO3ALKBS.js → claude-launcher-LYGS66AC.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-BDSUP4DK.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-TS4DFJF4.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);