@outerlayer/cli 0.34.0-next.20261027193835 → 0.34.0-next.20261028002917

package/dist/{chunk-FLHBUQ2W.js → chunk-AHWMY3MS.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveDevcontainerCli, devcontainerBuildInvocation, universalImagePending, RecipeError } from './chunk-X7M73LKT.js';
-import { universalImagePinned, UNIVERSAL_IMAGE, BUILDKIT_IMAGE } from './chunk-WX2HW2G2.js';
-import { ensureHostKey } from './chunk-RJZZFAXS.js';
+import { resolveDevcontainerCli, devcontainerBuildInvocation, universalImagePending, RecipeError } from './chunk-CM4J53WZ.js';
+import { universalImagePinned, UNIVERSAL_IMAGE, BUILDKIT_IMAGE } from './chunk-D3CT6XQ4.js';
+import { ensureHostKey } from './chunk-VKYU4HHW.js';
 import { compareVersions } from './chunk-A6PJSNP6.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-3VJYDWFV.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-GMKDAF37.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-AJTGTSNA.js';
+import { CLAUDE_PORT, BUILD_HOME, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-L2OARQKP.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { mkdirSync, createWriteStream, rmSync, existsSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';
-import { dirname, join, resolve } from 'path';
+import { dirname, join, posix, resolve } from 'path';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';
 
@@ -454,6 +454,65 @@ var HASH_ARGV = ["/opt/outerlayer/bin/node", "-e", HASH_SCRIPT, JUDGE_PROGRAM];
 function parseProgramHash(stdout) {
   return /^([0-9a-f]{64}) /.exec(stdout.trim())?.[1];
 }
+function within(path, folder) {
+  return path === folder || path.startsWith(`${folder}/`);
+}
+function mountableHome(home) {
+  const kept = ["/opt/outerlayer", "/usr/local/bin", "/outerlayer", "/etc", "/usr", "/bin", "/sbin", "/lib", "/var/run"];
+  const kernel = ["/proc", "/sys", "/dev", "/run"];
+  const writable = ["/build", "/tmp"];
+  if (home === void 0 || !home.startsWith("/") || /[",\n]/.test(home)) return void 0;
+  const path = posix.normalize(home).replace(/(.)\/+$/, "$1");
+  if (path === "/" || path === "/nonexistent") return void 0;
+  if (writable.some((folder) => within(path, folder)) || kernel.some((folder) => within(path, folder))) return void 0;
+  if (kept.some((folder) => within(folder, path) || within(path, folder))) return void 0;
+  return path;
+}
+function identityScript() {
+  return [
+    "const [want, file] = process.argv.slice(1);",
+    'const rows = require("fs").readFileSync(file, "utf8").split("\\n").map((line) => line.split(":")).filter((f) => f.length >= 7);',
+    "const row = rows.find((f) => f[0] === want) ?? (/^\\d+$/.test(want) ? rows.find((f) => f[2] === want) : undefined);",
+    "process.stdout.write(JSON.stringify(row === undefined ? null : { uid: Number(row[2]), home: row[5] }));"
+  ].join("\n");
+}
+function identityArgs(user) {
+  return [user, "/etc/passwd"];
+}
+function parseIdentity(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+  if (parsed === null) return null;
+  const { uid, home } = parsed;
+  return Number.isInteger(uid) && typeof home === "string" ? { uid, home } : void 0;
+}
+function homeCopyScript() {
+  return [
+    'const fs = require("fs");',
+    "const [from, to] = process.argv.slice(1);",
+    "if (!fs.existsSync(from)) process.exit(0);",
+    "let skipped = 0;",
+    "const readable = (path) => {",
+    "  try {",
+    "    const stat = fs.lstatSync(path);",
+    "    if (!stat.isFile() && !stat.isDirectory() && !stat.isSymbolicLink()) return false;",
+    "    if (!stat.isSymbolicLink()) fs.accessSync(path, stat.isDirectory() ? fs.constants.R_OK | fs.constants.X_OK : fs.constants.R_OK);",
+    "    return true;",
+    "  } catch {",
+    "    return false;",
+    "  }",
+    "};",
+    "fs.cpSync(from, to, { recursive: true, force: false, errorOnExist: false, preserveTimestamps: true, verbatimSymlinks: true, filter: (path) => readable(path) || (skipped++, false) });",
+    "if (skipped > 0) process.stderr.write(`left out ${skipped} entries the build user cannot read\\n`);"
+  ].join("\n");
+}
+function homeCopyArgs(home) {
+  return [home, BUILD_HOME];
+}
 
 // src/runner/container/run-args.ts
 var COMMAND_DIR = "/build/.command";
@@ -461,7 +520,7 @@ var BUILD_LABEL = "ai.outerlayer.build";
 function runnerLabelValue(configPath) {
   return readRunnerIdentity(configPath)?.label ?? pathLabelValue(configPath);
 }
-function hardened(input) {
+function hardened(input, network) {
   const { memory, cpus, pids, cpuset } = input.limits;
   return [
     "--label",
@@ -469,7 +528,7 @@ function hardened(input) {
     "--label",
     `${RUNNER_LABEL}=${input.runnerId}`,
     "--network",
-    "none",
+    network === void 0 ? "none" : `container:${network}`,
     "--cap-drop",
     "ALL",
     "--security-opt",
@@ -505,7 +564,7 @@ function containerRunArgs(input) {
     "--detach",
     "--name",
     input.container,
-    ...hardened(exec ? { ...input, user: RELAY_USER } : input),
+    ...hardened(exec ? { ...input, user: RELAY_USER } : input, input.network),
     // Only the relay's user can open the folder the joining socket is in.
     ...exec ? ["--tmpfs", `${JOIN_DIR}:mode=0700,uid=${RELAY_ID},gid=${RELAY_ID}`] : [],
     "--mount",
@@ -513,6 +572,8 @@ function containerRunArgs(input) {
     // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
     "--mount",
     `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
+    // A program that takes its home from `/etc/passwd`, as Java does, writes in the build's home too.
+    ...input.home === void 0 ? [] : ["--mount", `type=volume,src=${input.volume},dst=${mountPath(input.home)},volume-subpath=home`],
     ...copied ? [
       // Owned by the relay's user, who writes the files in; the agent can read them and cannot change them. `exec` so the commit hooks can run.
       "--tmpfs",
@@ -547,6 +608,67 @@ function containerRunArgs(input) {
     ] : []
   ];
 }
+var NETWORK_HELPER_PROGRAM = "/opt/outerlayer/bin/outerlayer-guest";
+var NETWORK_READY_FILE = "/run/outerlayer-net.ready";
+var NAME_SERVER = "127.0.0.53";
+var NETWORK_HELPER_MEMORY = "512m";
+var NETWORK_HELPER_PIDS = 256;
+function networkHelperName(container) {
+  return `${container}-net`;
+}
+function networkHelperRunArgs(input) {
+  return [
+    "--detach",
+    "--name",
+    input.name,
+    "--label",
+    `${BUILD_LABEL}=${input.buildId}`,
+    "--label",
+    `${RUNNER_LABEL}=${input.runnerId}`,
+    "--network",
+    "none",
+    "--cap-drop",
+    "ALL",
+    "--cap-add",
+    "NET_ADMIN",
+    "--device",
+    "/dev/net/tun",
+    "--security-opt",
+    "no-new-privileges",
+    "--read-only",
+    "--tmpfs",
+    "/run:mode=0755",
+    "--user",
+    "0:0",
+    "--dns",
+    NAME_SERVER,
+    ...input.ipv6 ? ["--sysctl", "net.ipv6.conf.all.disable_ipv6=1", "--sysctl", "net.ipv6.conf.default.disable_ipv6=1"] : [],
+    "--sysctl",
+    "net.ipv4.conf.all.rp_filter=0",
+    "--sysctl",
+    "net.ipv4.conf.default.rp_filter=0",
+    "--sysctl",
+    "net.ipv4.ip_unprivileged_port_start=0",
+    "--memory",
+    NETWORK_HELPER_MEMORY,
+    "--memory-swap",
+    NETWORK_HELPER_MEMORY,
+    ...input.limits.cpuset === void 0 ? [] : ["--cpuset-cpus", input.limits.cpuset],
+    "--pids-limit",
+    String(NETWORK_HELPER_PIDS),
+    "--entrypoint",
+    NETWORK_HELPER_PROGRAM,
+    input.image,
+    "net",
+    "--relay",
+    `127.0.0.1:${RELAY_PORT}`,
+    "--dns",
+    `${NAME_SERVER}:53`,
+    "--ready",
+    NETWORK_READY_FILE,
+    "--drop-privileges"
+  ];
+}
 function prepareRunArgs(input) {
   return [
     "--rm",
@@ -565,6 +687,29 @@ function prepareRunArgs(input) {
     COMMAND_DIR
   ];
 }
+function scriptRunArgs(input, script, args) {
+  return [
+    "--rm",
+    ...hardened(input),
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    // The image's own NODE_OPTIONS can require a module or name a flag this Node rejects, and the script needs none.
+    "--env",
+    "NODE_OPTIONS=",
+    "--entrypoint",
+    "/opt/outerlayer/bin/node",
+    input.image,
+    "-e",
+    script,
+    ...args
+  ];
+}
+function identityRunArgs(input, user) {
+  return scriptRunArgs(input, identityScript(), identityArgs(user));
+}
+function homeCopyRunArgs(input, home) {
+  return scriptRunArgs(input, homeCopyScript(), homeCopyArgs(home));
+}
 function containerExecArgs(input) {
   const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
   const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
@@ -717,4 +862,4 @@ function ensureBuilder(rawRun, spec, options = {}) {
   );
 }
 
-export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, identityDockerFor, isOutOfMemory, judgeCommand, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRunnerIdentity, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };
+export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, NETWORK_HELPER_MEMORY, NETWORK_READY_FILE, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, homeCopyArgs, homeCopyRunArgs, homeCopyScript, identityArgs, identityDockerFor, identityRunArgs, identityScript, isOutOfMemory, judgeCommand, mountableHome, networkHelperName, networkHelperRunArgs, parseIdentity, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRunnerIdentity, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };

package/dist/{chunk-3VJYDWFV.js → chunk-AJTGTSNA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-GMKDAF37.js';
+import { BUILD_HOME } from './chunk-L2OARQKP.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-5FHBVV25.js → chunk-BQ4C47K2.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { toolsDockerfile } from './chunk-CMMEJJTL.js';
-import { runnerLabelValue } from './chunk-FLHBUQ2W.js';
-import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-X7M73LKT.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE } from './chunk-WX2HW2G2.js';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-3FTIUB7I.js';
+import { toolsDockerfile } from './chunk-KTVZ7TZY.js';
+import { runnerLabelValue } from './chunk-AHWMY3MS.js';
+import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-CM4J53WZ.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE } from './chunk-D3CT6XQ4.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-3X6OSXSB.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-3VJYDWFV.js';
-import { withGitConfig, tokenHeader } from './chunk-GMKDAF37.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-AJTGTSNA.js';
+import { withGitConfig, tokenHeader } from './chunk-L2OARQKP.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';

package/dist/{chunk-EYJRVHBN.js → chunk-BTDBDTUY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-NO6E72RM.js';
-import { resolveGatewayCredentials } from './chunk-62URQYCB.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-4J5GRWAY.js';
+import { resolveGatewayCredentials } from './chunk-PAGB3DCI.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';

package/dist/{chunk-X7M73LKT.js → chunk-CM4J53WZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_DIGEST } from './chunk-WX2HW2G2.js';
+import { UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_DIGEST } from './chunk-D3CT6XQ4.js';
 import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync } from 'fs';
 import { join, resolve, relative, dirname, sep, basename } from 'path';
 import { createRequire as createRequire$1 } from 'module';

package/dist/{chunk-WX2HW2G2.js → chunk-D3CT6XQ4.js}

@@ -29,18 +29,25 @@ var FIRECRACKER_SHA256 = {
 var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
-var GUEST_ASSETS_VERSION = "14";
+var GUEST_ASSETS_VERSION = "16";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
   x86_64: "8552fad4bdea1d49f3e7d2aa500ce3f8918fcd2fc66779fd83235949688a39bb"
 };
 var GUEST_HELPER_SHA256 = {
-  x86_64: "8080d4a8e8361cc8bf1cc34629bf49b6742e339c20cbf42d84a59b0d7fa33524"
+  x86_64: "c3c7f30a7238d274ea220632bb43a0e46589ee4194e9d7351774c17a2541cc12"
 };
 function guestAssetsPinned(arch) {
   const zero = "0".repeat(64);
   return GUEST_KERNEL_SHA256[arch] !== zero && GUEST_HELPER_SHA256[arch] !== zero;
 }
+var NETWORK_HELPER_SHA256 = {
+  x86_64: "c3c7f30a7238d274ea220632bb43a0e46589ee4194e9d7351774c17a2541cc12",
+  aarch64: "02c10b2c2b7b233375e8f127ef3dd9fe43f9426a18f0d2cbb81b103911c62703"
+};
+function networkHelperPinned(arch, hashes = NETWORK_HELPER_SHA256) {
+  return Object.hasOwn(hashes, arch) && hashes[arch] !== "0".repeat(64);
+}
 var JAILER_BINARY_SHA256 = {
   x86_64: "65ef226e96f0ceda55ba643f445801ef2cc0ea667ef67cad8ac4f406c9c8434f"
 };
@@ -135,4 +142,4 @@ function universalImagePinned(digest = UNIVERSAL_IMAGE_DIGEST) {
   return digest !== `sha256:${"0".repeat(64)}`;
 }
 
-export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, HEADLESS_SHELL_REVISION, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NODE_IMAGE, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice, universalImagePinned };
+export { BUILDER_DISK_BASE_URL, BUILDER_DISK_SHA256, BUILDER_DISK_VERSION, BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FFMPEG_BUILD_TAG, FFMPEG_STATIC, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, HEADLESS_SHELL_REVISION, HOST_HELPER_ASSETS_VERSION, HOST_HELPER_BASE_URL, HOST_HELPER_SHA256, HOST_HELPER_SLICE_SINCE, JAILER_BINARY_SHA256, MEDIA_PINS, MICROVM_ARCHES, NETWORK_HELPER_SHA256, NODE_IMAGE, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, PLAYWRIGHT_VERSION, TINI_SHA256, TINI_VERSION, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, VOICE_PACK_FILES, VOICE_PACK_VERSION, builderDiskPinned, firecrackerArch, guestAssetsPinned, hostHelperPinned, hostHelperSupportsSlice, networkHelperPinned, universalImagePinned };

package/dist/{chunk-HJCNWEQK.js → chunk-D6SH7DWA.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-6IMQXBTZ.js';
+import { resolveCredentials, postJson, getJson } from './chunk-GJYGOFF3.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { defaultFetch } from './chunk-62URQYCB.js';
+import { defaultFetch } from './chunk-PAGB3DCI.js';
 import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-LYX2RRSF.js → chunk-EGJY6MBC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-FLHBUQ2W.js';
-import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-3VJYDWFV.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-AHWMY3MS.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-AJTGTSNA.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-T6ALNN3H.js → chunk-F3BGTGQC.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-62URQYCB.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-PAGB3DCI.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-LASKTDCR.js';

package/dist/{chunk-BS3OYFAD.js → chunk-G4SOMWXL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-GMKDAF37.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-L2OARQKP.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-BS4CZMT6.js → chunk-GET5HKLM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-6IMQXBTZ.js → chunk-GJYGOFF3.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-EYJRVHBN.js';
-import { workPageUrl } from './chunk-NO6E72RM.js';
+import { autoConnect } from './chunk-BTDBDTUY.js';
+import { workPageUrl } from './chunk-4J5GRWAY.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-62URQYCB.js';
-import { signRunnerRequest } from './chunk-RJZZFAXS.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-PAGB3DCI.js';
+import { signRunnerRequest } from './chunk-VKYU4HHW.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
@@ -471,7 +471,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-5WOGLR7V.js');
+      const { logHookError } = await import('./hook-fast-WM6YZVBJ.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-Y4WJ4BLX.js → chunk-GMEXR6PY.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-Y7MF32DM.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-OHTMTMFX.js';
-import { RunnerAlreadyRunningError, readPidFile } from './chunk-3FTIUB7I.js';
+import { scrubReason, stripTerminalControls } from './chunk-PBI4CM4M.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-NBETYM32.js';
+import { RunnerAlreadyRunningError, readPidFile } from './chunk-3X6OSXSB.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, postJson } from './chunk-6IMQXBTZ.js';
-import { signerFor } from './chunk-RJZZFAXS.js';
-import { pidFilePath } from './chunk-3VJYDWFV.js';
+import { isSignatureRefusal, postJson } from './chunk-GJYGOFF3.js';
+import { signerFor } from './chunk-VKYU4HHW.js';
+import { pidFilePath } from './chunk-AJTGTSNA.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-JWMJMQRF.js → chunk-GXMMILQ4.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-LYX2RRSF.js';
-import { parseSize } from './chunk-FLHBUQ2W.js';
-import { builderDiskPinned } from './chunk-WX2HW2G2.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-EGJY6MBC.js';
+import { parseSize } from './chunk-AHWMY3MS.js';
+import { builderDiskPinned } from './chunk-D3CT6XQ4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-GMKDAF37.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-L2OARQKP.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';

package/dist/{chunk-WR2GRWK3.js → chunk-I4YOWQH7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';