@outerlayer/cli 0.34.0-next.20261028010245 → 0.34.0-next.20261028122415

package/dist/{chunk-PBI4CM4M.js → chunk-YGU43DH4.js}

@@ -1,36 +1,36 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-6CK2OC4Q.js';
+import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, testFileMatcher, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-BEGMZKMG.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { HELPER_PATH, DOCKERD_LOG, HELPER_RECORD } from './chunk-UEDRRWZ3.js';
+import { HELPER_PATH, DOCKERD_LOG, HELPER_RECORD } from './chunk-XDCD4GD5.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JXY66VYX.js';
-import { installScrubContext } from './chunk-32FAPJFD.js';
-import { writeDockerClientConfig } from './chunk-QJ2SNBHL.js';
+import { senderPidfile } from './chunk-AKQX462F.js';
+import { installScrubContext } from './chunk-C2E4PWEN.js';
+import { writeDockerClientConfig } from './chunk-BUVDDPOM.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepUnpinnedRuntimes, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-VB4QD4WN.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-BQ4C47K2.js';
-import { waitForAgent, vmExecArgs } from './chunk-PHIQHIRJ.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-G4SOMWXL.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-PPQTTJSW.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-GXMMILQ4.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-EGJY6MBC.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-AHWMY3MS.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepRuntimeStep, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, ranRuntimeStep, provisionRuntimes, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-7JBG43BX.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-AGNFPJSP.js';
+import { waitForAgent, vmExecArgs } from './chunk-NPTEYMBW.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-DKIZDYUX.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-SODV2YMW.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-QXAPVAPR.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-7LKOOGSN.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-2LCNMAWP.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-D3CT6XQ4.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-GJYGOFF3.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-72N7GOLM.js';
 import { planArtifactUpload } from './chunk-IXPH4EXK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-VKYU4HHW.js';
+import { signerFor } from './chunk-VJQQVTCS.js';
 import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-OVNF4LLC.js';
-import { scrubText } from './chunk-A6PJSNP6.js';
+import { scrubText } from './chunk-A2KLVZBU.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-XFJ7YOPD.js';
 import { CheckItemsSchema } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-AJTGTSNA.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, BUILD_HOME, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, EVAL_INPUT_DIR } from './chunk-L2OARQKP.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-2CW2QMSG.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, withMiseVariables, fdName, BUILD_HOME, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4N7BQBO4.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
 import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, lstatSync, realpathSync, fstatSync, readSync } from 'fs';
@@ -623,7 +623,12 @@ async function provisionMicroVm(input) {
     const failure = await waitForDocker(runtime, state, agentUser, input.now ?? (() => /* @__PURE__ */ new Date()));
     if (failure !== void 0) return bail(failure);
   }
-  const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
+  const request = (argv, workdir, variables) => ({
+    argv,
+    user: agentUser,
+    cwd: workdir,
+    env: execEnvironment(state.imageEnv, withMiseVariables(env, variables))
+  });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
@@ -632,7 +637,7 @@ async function provisionMicroVm(input) {
     agentVersion,
     lifecycle: report.apply.lifecycle,
     exec: async (argv, workdir, opts) => {
-      const ran = await vm.exec(state.vsockPath, request(argv, workdir));
+      const ran = await vm.exec(state.vsockPath, request(argv, workdir, opts?.variables));
       if (opts?.quiet !== true) appendFileSync(logPath, ran.stdout + ran.stderr);
       return ran;
     },
@@ -668,7 +673,7 @@ async function provisionMicroVm(input) {
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
-  keepUnpinnedRuntimes(state, steps);
+  keepRuntimeStep(state, steps);
   if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
@@ -714,6 +719,7 @@ function vmExecFor(input, argv) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     unpinnedRuntimes: state.unpinnedRuntimes,
+    miseVariables: state.miseVariables,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
@@ -744,6 +750,7 @@ async function startMicroVmCommand(input) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     unpinnedRuntimes: state.unpinnedRuntimes,
+    miseVariables: state.miseVariables,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
@@ -787,6 +794,7 @@ async function syncInMicroVm(input) {
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
       unpinnedRuntimes: state.unpinnedRuntimes,
+      miseVariables: state.miseVariables,
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,
       factoryVariables: factoryVariablesOf(input.config, input.jobDir)
@@ -1073,7 +1081,7 @@ async function startCheckMicroVm(input) {
       state,
       evalInput: { dir: evalInput.dir, deliver: deliverEvalInput },
       exec: async (argv, workdir, opts) => {
-        const ran = await vm.exec(state.vsockPath, { argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
+        const ran = await vm.exec(state.vsockPath, { argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, withMiseVariables(env, opts?.variables)) });
         if (opts?.logPath !== void 0) appendFileSync(opts.logPath, ran.stdout + ran.stderr);
         return ran;
       },
@@ -1774,12 +1782,21 @@ function testFilesIn(root, isTest, limits = { files: MAX_TEST_FILES, bytes: MAX_
       const rel = prefix === "" ? name : `${prefix}/${name}`;
       const stat = lstatSync(path);
       if (stat.isDirectory()) walk(path, rel);
-      else if (stat.isFile() && isTest.test(rel) && stat.size <= limits.bytes) files.push({ path: rel, contents: readFileSync(path, "utf8") });
+      else if (stat.isFile() && isTest(rel) && stat.size <= limits.bytes) files.push({ path: rel, contents: readFileSync(path, "utf8") });
     }
   };
   walk(root, "");
   return files;
 }
+function proofsFileIn(root) {
+  const path = join(root, ".outerlayer-proofs.yaml");
+  try {
+    const stat = lstatSync(path);
+    return stat.isFile() && stat.size <= MAX_TEST_FILE_BYTES ? readFileSync(path, "utf8") : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function hostPassedNames(config, item, fetchImpl) {
   const workItemId = Object(await readWorkItem(config, item, fetchImpl)).workItemId;
   if (typeof workItemId !== "string") throw new WorkCommandError("the work item read named no id");
@@ -1914,11 +1931,11 @@ async function runJudge(input) {
     if (!fetched.ok) return await fail(check, `the build's tests could not be fetched: ${fetched.reason}`);
     const finder = await loadCitationFinder();
     const list = criteria ?? [];
-    const testFiles = testFilesIn(branchDir, finder.TEST_FILE);
+    const testFiles = testFilesIn(branchDir, testFileMatcher(finder, proofsFileIn(branchDir)));
     const citations = finder.buildCitations({ ids: list.map((criterion) => criterion.id), files: testFiles, repository: repo, sha: head });
     const testFileText = new Map(testFiles.map((file) => [file.path, file.contents]));
     const inputs = new Map(list.map((criterion) => [criterion.id, criterionInputs({ brief, criterion, citations, testFiles: testFileText })]));
-    const plan = planCriteria({ criteria: list, citations, inputs, previous });
+    const plan = planCriteria({ criteria: list, citations, inputs, previous, noTestFiles: testFiles.length === 0 });
     if (plan.toJudge.length < list.length) {
       log.line(`${tag} judge: ${plan.toJudge.length} of ${list.length} criteria to judge, ${list.length - plan.toJudge.length} settled without the judge`);
     }
@@ -3329,6 +3346,7 @@ async function runHostChecks(input) {
       }
     }
     let abandoned = false;
+    let variables;
     const setup = async () => {
       const started = job.microvm !== void 0 ? await startCheckMicroVm({
         config,
@@ -3357,6 +3375,7 @@ async function runHostChecks(input) {
       });
       if (!started.ok) return `the check environment could not be made: ${started.reason}`;
       const made = "container" in started ? started.container : started.environment;
+      const checkBuildId = made.state.buildId;
       const steps = [
         {
           argv: ["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"],
@@ -3386,10 +3405,21 @@ async function runHostChecks(input) {
         const ran = await made.exec(step.argv, step.workdir, { logPath: environmentLog });
         if (ran.status !== 0) return `the check environment could not be prepared: ${step.failed(ran.status)}`;
       }
+      if (ranRuntimeStep(job.container ?? job.microvm)) {
+        const chosen = await provisionRuntimes({
+          repositories: repositoriesToCheckOut,
+          exec: (argv, workdir, opts) => made.exec(argv, workdir, opts?.quiet === true ? {} : { logPath: environmentLog }),
+          log,
+          tag: `${tag} checks`,
+          refusals: () => runtime.tunnels.get(checkBuildId)?.record().refusals ?? []
+        });
+        if (!chosen.ok) return `the check environment could not be prepared: ${chosen.reason}`;
+        variables = chosen.variables;
+      }
       const lifecycleDir = lifecycleWorkdir(repositoriesToCheckOut, (job.container ?? job.microvm)?.governing?.repository);
       for (const step of lifecycleSteps((job.container ?? job.microvm)?.lifecycle ?? {})) {
         log.line(`${tag} checks lifecycle ${step.name} (${step.source})`);
-        const ran = await made.exec(step.argv, lifecycleDir, { logPath: environmentLog });
+        const ran = await made.exec(step.argv, lifecycleDir, { logPath: environmentLog, variables });
         if (ran.status !== 0) return `the check environment could not be prepared: ${lifecycleFailureReason(step, ran.status)}`;
       }
       return made;
@@ -3442,7 +3472,7 @@ async function runHostChecks(input) {
       const checkStartedMs = now().getTime();
       const logPath = join(jobDir, "checks", `${check.name}.log`);
       await ready.exec(["rm", "-f", CHECK_ITEMS_FILE], CHECKOUT_DIR, { logPath });
-      const running = ready.exec(["/bin/sh", "-c", check.command], CHECKOUT_DIR, { logPath });
+      const running = ready.exec(["/bin/sh", "-c", check.command], CHECKOUT_DIR, { logPath, variables });
       running.catch(() => void 0);
       const timer = timeoutAfter(limitMinutes * 6e4, deps.sleep);
       let outcome;

package/dist/{chunk-NOEJGR4X.js → chunk-ZIXLG6EQ.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-BTDBDTUY.js';
+import { autoConnect } from './chunk-GJHOU5V3.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { acquireSpoolLockAt } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-PAGB3DCI.js';
-import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
+import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-DINRXUQA.js';

package/dist/{claude-launcher-GGZEWVYJ.js → claude-launcher-XX2MLBDW.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-55CJGYBK.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-RJSAIFEP.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);