@outerlayer/cli 0.34.0-next.20261027121359 → 0.34.0-next.20261027174501

package/dist/{chunk-TS2YACAQ.js → chunk-LYX2RRSF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-UYWGR35C.js';
-import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-I2GHZ2VA.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-FLHBUQ2W.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-3VJYDWFV.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-WS5E73JO.js → chunk-MXAYUZJF.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { criteriaOf, loadCitationFinder, hostItemsOf, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, NO_CITING_TEST_REASON, NO_VERDICT_REASON, planCriteria } from './chunk-6CK2OC4Q.js';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-NGZBVN6F.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-6IMQXBTZ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { defaultFetch } from './chunk-T375XV3H.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { defaultFetch } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { readDeliveryRecord } from './chunk-YQR6E6OV.js';
@@ -167,14 +167,14 @@ function governingDir(cwd) {
 async function testProofMode(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return "any";
-  const { testProofIn } = await import('./host-checks-VKBAGGWH.js');
+  const { testProofIn } = await import('./host-checks-33ZTDTSH.js');
   return testProofIn(dir);
 }
 async function judgeCheckName(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return {};
   if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
-  const { checksIn, isJudgeCheck } = await import('./host-checks-VKBAGGWH.js');
+  const { checksIn, isJudgeCheck } = await import('./host-checks-33ZTDTSH.js');
   const quiet = { line: () => void 0, error: () => void 0 };
   const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
   return check === void 0 ? {} : { name: check.name };
@@ -314,7 +314,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-AYUWUFBE.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-USD4JWFP.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-L7RPNSAA.js → chunk-NO6E72RM.js}

@@ -3,10 +3,10 @@ import { createRequire } from 'node:module';
 import { DEFAULT_DASHBOARD } from './chunk-NWHU5G6R.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-T375XV3H.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-62URQYCB.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { remoteLookupFailed } from './chunk-OOD5NDQA.js';
+import { remoteLookupFailed } from './chunk-A6PJSNP6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { lstatSync } from 'fs';

package/dist/{chunk-UXGWAAGQ.js → chunk-OHTMTMFX.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-RO2NZJHZ.js';
-import { parseSize } from './chunk-UYWGR35C.js';
-import { runnerDir } from './chunk-I2GHZ2VA.js';
-import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-Z7THNFUU.js';
+import { builtinKind, keepsHostBuilder } from './chunk-JWMJMQRF.js';
+import { parseSize } from './chunk-FLHBUQ2W.js';
+import { runnerDir } from './chunk-3VJYDWFV.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-GMKDAF37.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-XSUM3E67.js → chunk-OP2L7OXA.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-UXGWAAGQ.js';
-import { RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
-import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-Z7THNFUU.js';
+import { DEFAULT_UNIT_NAME } from './chunk-OHTMTMFX.js';
+import { RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
+import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-GMKDAF37.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-UDRBQI5J.js → chunk-PMIW6OGQ.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-TZMDRHWB.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-NGZBVN6F.js';
-import { isLinkedRepository } from './chunk-L7RPNSAA.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-6IMQXBTZ.js';
+import { isLinkedRepository } from './chunk-NO6E72RM.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-QTAADTIO.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-T6ALNN3H.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { checkFormerSkillNames } from './chunk-LMYRR5MO.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-T375XV3H.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-CHDWAWQA.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-62URQYCB.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-4QQJTJUN.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-OOD5NDQA.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-A6PJSNP6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-URIZRCRY.js';
 import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-WMIRA4RD.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-CWYMIXTV.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-NFMQCZM3.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-5NWSCHIO.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-5VNZ2BLY.js');
+    const { runnerHostChecks } = await import('./doctor-N4I6IEKP.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-R4I5GJCH.js');
+      const { inspectRunnerService } = await import('./find-unit-YGDFVHVU.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-YGX72FUQ.js → chunk-QRIE4JZE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-B7LPFCIN.js';
-import { spoolDir } from './chunk-CHDWAWQA.js';
-import { CaptureDaemon } from './chunk-OOD5NDQA.js';
+import { LiveUploader } from './chunk-7SJNVGVC.js';
+import { spoolDir } from './chunk-4QQJTJUN.js';
+import { CaptureDaemon } from './chunk-A6PJSNP6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-QBBZGVZJ.js → chunk-RCAMBC3H.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-YIBHQR3B.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { acquireSpoolLockAt } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-T375XV3H.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-DINRXUQA.js';

package/dist/{chunk-KDSKFXPE.js → chunk-RJZZFAXS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-LTMFHECB.js → chunk-S5U6RKQX.js}

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-4IB5WUY2.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-Y4WJ4BLX.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
-import { writePendingUpdate } from './chunk-DUG3JXAT.js';
-import { renderUpdateSteps } from './chunk-W774NREK.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-PBZODW5X.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-SJY6A6EH.js';
+import { writePendingUpdate } from './chunk-UZIAZXXO.js';
+import { renderUpdateSteps } from './chunk-SKAML7GB.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-BS4CZMT6.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-Y7MF32DM.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-XEJ5USHY.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-J2X5CTYY.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-4HA4S3U2.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-WR2GRWK3.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-ARPPH7VS.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-66TKWWTX.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-HO4XRLAZ.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-LSFP57LI.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-7Q7GQELE.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-CFJOONWM.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-RO2NZJHZ.js';
-import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-TS2YACAQ.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-UYWGR35C.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-W5EKMK37.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWMJMQRF.js';
+import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-LYX2RRSF.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-FLHBUQ2W.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-3FTIUB7I.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-NGZBVN6F.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-KDSKFXPE.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6IMQXBTZ.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-RJZZFAXS.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-I2GHZ2VA.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-Z7THNFUU.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-3VJYDWFV.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-GMKDAF37.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
@@ -1961,7 +1961,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-OWZS3ZXL.js');
+  const { postJson: postJson2 } = await import('./work-cmd-LUKJHAMH.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -3279,7 +3279,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-FAG4QKIX.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-IFHLERRX.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-W774NREK.js → chunk-SKAML7GB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-SJY6A6EH.js';
-import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-HO4XRLAZ.js';
+import { stripTerminalControls } from './chunk-Y7MF32DM.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-CFJOONWM.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-IUPWQ2RK.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-5VGCFZV2.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-QTAADTIO.js → chunk-T6ALNN3H.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-T375XV3H.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-62URQYCB.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-LASKTDCR.js';

package/dist/{chunk-DUG3JXAT.js → chunk-UZIAZXXO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-LXOBWRVC.js → chunk-W246VXU4.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-YIBHQR3B.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-T375XV3H.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { CriteriaListSchema } from './chunk-DINRXUQA.js';

package/dist/{chunk-J2X5CTYY.js → chunk-WR2GRWK3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-I2GHZ2VA.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-QUOITPN7.js → chunk-WX2HW2G2.js}

@@ -127,5 +127,12 @@ var PLAYWRIGHT_FFMPEG = {
   arm64: { file: "ffmpeg-linux-arm64.zip", sha256: "457360e803a7d8d5f8f7f5ecf562b2d338f6b4f7f86339d0c31938a451e8878b" }
 };
 var MEDIA_PINS = `${VOICE_PACK_VERSION}+${FFMPEG_BUILD_TAG}+${HEADLESS_SHELL_VERSION}+${PLAYWRIGHT_FFMPEG_REVISION}`;
+var UNIVERSAL_IMAGE_REPOSITORY = "ghcr.io/outerlayerai/universal";
+var UNIVERSAL_IMAGE_SOURCE = "src-b56adab2806597e3723d8f85e2fef49208761343b1920e9ba58d1c753d1d6974";
+var UNIVERSAL_IMAGE_DIGEST = "sha256:4bee63278f05473e840fd2f56eae0ef1048e18039e65e38b642c1933d5dcd1ea";
+var UNIVERSAL_IMAGE = `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}@${UNIVERSAL_IMAGE_DIGEST}`;
+function universalImagePinned(digest = UNIVERSAL_IMAGE_DIGEST) {
+  return digest !== `sha256:${"0".repeat(64)}`;
+}
 
-export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, HEADLESS_SHELL_REVISION, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice };
+export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, HEADLESS_SHELL_REVISION, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice, universalImagePinned };

package/dist/{chunk-HDLON3RJ.js → chunk-X7M73LKT.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_DIGEST } from './chunk-WX2HW2G2.js';
 import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync } from 'fs';
 import { join, resolve, relative, dirname, sep, basename } from 'path';
 import { createRequire as createRequire$1 } from 'module';
@@ -138,6 +139,12 @@ var RecipeError = class extends Error {
     this.logPath = logPath;
   }
 };
+function universalImagePending() {
+  return new RecipeError(
+    "universal_image_pending",
+    `this CLI pins ${UNIVERSAL_IMAGE_REPOSITORY} at ${UNIVERSAL_IMAGE_DIGEST}, a digest CI has not published yet. A repository with no devcontainer file cannot be built until the pin names a published image`
+  );
+}
 var DIR_RECIPE = ".devcontainer/devcontainer.json";
 var ROOT_RECIPE = ".devcontainer.json";
 function locateRecipe(checkoutDir) {
@@ -217,7 +224,7 @@ function assertBuildable(checkoutDir, location, recipe) {
   }
 }
 function writeSanitizedRecipe(checkoutDir, location, recipe) {
-  if (location.kind === "default") throw new Error("the default image has no recipe to sanitize");
+  if (location.kind === "default") throw new Error("a build with no devcontainer file has no recipe to sanitize");
   const path = location.path === ROOT_RECIPE ? join(checkoutDir, ".outerlayer-recipe.json") : join(checkoutDir, ".devcontainer", SANITIZED_NAME);
   writeFileSync(path, `${JSON.stringify(sanitizeRecipe(recipe), null, 2)}
 `);
@@ -271,4 +278,4 @@ function devcontainerBuildInvocation(cli, req) {
   };
 }
 
-export { DOCKER_FEATURE, RecipeError, SANITIZED_NAME, assertBuildable, buildRootFromDist, classifyProperties, devcontainerBuildInvocation, locateRecipe, readRecipe, resolveDevcontainerCli, writeSanitizedRecipe };
+export { DOCKER_FEATURE, RecipeError, SANITIZED_NAME, assertBuildable, buildRootFromDist, classifyProperties, devcontainerBuildInvocation, locateRecipe, readRecipe, resolveDevcontainerCli, universalImagePending, writeSanitizedRecipe };

package/dist/{chunk-4IB5WUY2.js → chunk-Y4WJ4BLX.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-SJY6A6EH.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-UXGWAAGQ.js';
-import { RunnerAlreadyRunningError, readPidFile } from './chunk-W5EKMK37.js';
+import { scrubReason, stripTerminalControls } from './chunk-Y7MF32DM.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-OHTMTMFX.js';
+import { RunnerAlreadyRunningError, readPidFile } from './chunk-3FTIUB7I.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, postJson } from './chunk-NGZBVN6F.js';
-import { signerFor } from './chunk-KDSKFXPE.js';
-import { pidFilePath } from './chunk-I2GHZ2VA.js';
+import { isSignatureRefusal, postJson } from './chunk-6IMQXBTZ.js';
+import { signerFor } from './chunk-RJZZFAXS.js';
+import { pidFilePath } from './chunk-3VJYDWFV.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-SJY6A6EH.js → chunk-Y7MF32DM.js}

@@ -2,35 +2,35 @@
 import { createRequire } from 'node:module';
 import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-6CK2OC4Q.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-6SJ3DJDH.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-5ARXP3BP.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-YGX72FUQ.js';
-import { installScrubContext } from './chunk-B7LPFCIN.js';
-import { writeDockerClientConfig } from './chunk-XZGURZHF.js';
+import { senderPidfile } from './chunk-QRIE4JZE.js';
+import { installScrubContext } from './chunk-7SJNVGVC.js';
+import { writeDockerClientConfig } from './chunk-GPO7F757.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-ARPPH7VS.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-SGT7YU3X.js';
-import { waitForAgent, vmExecArgs } from './chunk-ZV6GOXYA.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-RMJSYOSV.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-66TKWWTX.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-RO2NZJHZ.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-TS2YACAQ.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-UYWGR35C.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-QUOITPN7.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepUnpinnedRuntimes, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-LSFP57LI.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-5FHBVV25.js';
+import { waitForAgent, vmExecArgs } from './chunk-JVNQNKHV.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-BS3OYFAD.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-7Q7GQELE.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-JWMJMQRF.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-LYX2RRSF.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-FLHBUQ2W.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-WX2HW2G2.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-NGZBVN6F.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6IMQXBTZ.js';
 import { planArtifactUpload } from './chunk-IXPH4EXK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-KDSKFXPE.js';
+import { signerFor } from './chunk-RJZZFAXS.js';
 import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-OVNF4LLC.js';
-import { scrubText } from './chunk-OOD5NDQA.js';
+import { scrubText } from './chunk-A6PJSNP6.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-XFJ7YOPD.js';
 import { CheckItemsSchema } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-I2GHZ2VA.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-Z7THNFUU.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-3VJYDWFV.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-GMKDAF37.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
 import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, lstatSync, realpathSync, fstatSync, readSync } from 'fs';
@@ -610,9 +610,10 @@ async function provisionMicroVm(input) {
   } catch (err) {
     return bail(`the build's Maven settings could not be delivered: ${describeCallFailure(err)}`);
   }
-  const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  let execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
   for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
-  const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, execEnv) });
+  const plainEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv, proxyWarning: false });
+  const request = (argv, workdir, plain = false) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, plain ? plainEnv : execEnv) });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
@@ -621,7 +622,7 @@ async function provisionMicroVm(input) {
     agentVersion,
     lifecycle: report.apply.lifecycle,
     exec: async (argv, workdir, opts) => {
-      const ran = await vm.exec(state.vsockPath, request(argv, workdir));
+      const ran = await vm.exec(state.vsockPath, request(argv, workdir, opts?.withoutProxyWarning === true));
       if (opts?.quiet !== true) appendFileSync(logPath, ran.stdout + ran.stderr);
       return ran;
     },
@@ -651,10 +652,17 @@ async function provisionMicroVm(input) {
     },
     removeStagedContext: () => removeStagedContext(buildDir2),
     keepIn: jobDir,
-    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {}
+    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
+    // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
+    ...runtimeStepInput(report, services),
+    dropProxyWarning: () => {
+      state.proxyWarningDropped = true;
+      execEnv = plainEnv;
+    }
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
+  keepUnpinnedRuntimes(state, steps);
   if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
@@ -699,9 +707,11 @@ function vmExecFor(input, argv) {
     repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
+    unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
     imageEnv: state.imageEnv,
+    proxyWarning: state.proxyWarningDropped !== true,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
   });
   const options = {
@@ -729,9 +739,11 @@ async function startMicroVmCommand(input) {
     repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
+    unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
     imageEnv: state.imageEnv,
+    proxyWarning: state.proxyWarningDropped !== true,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
   });
   const started = await input.runtime.vm.exec(state.vsockPath, {
@@ -772,9 +784,11 @@ async function syncInMicroVm(input) {
       repositories: job.repositories,
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
+      unpinnedRuntimes: state.unpinnedRuntimes,
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,
       imageEnv: state.imageEnv,
+      proxyWarning: state.proxyWarningDropped !== true,
       factoryVariables: factoryVariablesOf(input.config, input.jobDir)
     });
     const result = await runtime.vm.exec(state.vsockPath, {

package/dist/{chunk-FRETDGET.js → chunk-Z4LFCJT6.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-YIBHQR3B.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-T375XV3H.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{claude-launcher-SGZSOGKZ.js → claude-launcher-LYGS66AC.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-UM4IHOJQ.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-TS4DFJF4.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);