@outerlayer/cli 0.34.0-next.20261028105453 → 0.34.0-next.20261028132110

package/dist/{chunk-5VKSPEST.js → chunk-BTA5QOKD.js}

@@ -2,13 +2,13 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-GJHOU5V3.js';
+import { autoConnect } from './chunk-BRBZKIZG.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
-import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity } from './chunk-GH2HEEOH.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { CriteriaListSchema } from './chunk-DINRXUQA.js';
+import { CriteriaListSchema } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync } from 'fs';
 

package/dist/{chunk-NWHU5G6R.js → chunk-CKDSPW35.js}

@@ -5,7 +5,7 @@ import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfigStrict, CloudConfigError, readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-DINRXUQA.js';
+import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';

package/dist/{chunk-6YIWAOHM.js → chunk-ECCAFFAH.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { criteriaOf, loadCitationFinder, hostItemsOf, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, NO_CITING_TEST_REASON, NO_VERDICT_REASON, planCriteria } from './chunk-6CK2OC4Q.js';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-72N7GOLM.js';
+import { criteriaOf, loadCitationFinder, hostItemsOf, testFileMatcher, criterionInputs, NO_CITING_TEST_REASON, NO_VERDICT_REASON, planCriteria, NO_TEST_FILES_REASON, MAX_TEST_FILE_BYTES, MAX_TEST_FILES } from './chunk-UE2C4STC.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-T664NDNT.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
+import { sanitizeTerminal } from './chunk-VEVNGDTP.js';
 import { defaultFetch } from './chunk-IZKUPAXF.js';
-import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity } from './chunk-GH2HEEOH.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { readDeliveryRecord } from './chunk-YQR6E6OV.js';
-import { inferArtifactKind, mediaTypeForArtifactPath, WORK_ITEM_COMMENT_MAX_BODY_LENGTH } from './chunk-DINRXUQA.js';
+import { inferArtifactKind, mediaTypeForArtifactPath, WORK_ITEM_COMMENT_MAX_BODY_LENGTH } from './chunk-IXRUVR25.js';
 import { createHash } from 'crypto';
 import { spawnSync } from 'child_process';
 import { existsSync, statSync, readFileSync } from 'fs';
@@ -87,13 +87,13 @@ function unprovenCriteria(input) {
     commits.set(item.id, commit);
     previous.set(item.id, { ...item, inputs: criterionInputs({ brief: NO_BRIEF, criterion, citations: judgedCitations, testFiles: judged }) });
   }
-  const plan = planCriteria({ criteria, citations, inputs, previous: [...previous.values()] });
+  const plan = planCriteria({ criteria, citations, inputs, previous: [...previous.values()], noTestFiles: input.headFiles.length === 0 });
   const settled = new Map(plan.settled.map((item) => [item.id, item]));
   const entries = [];
   for (const criterion of criteria) {
     const item = settled.get(criterion.id);
     if (item === void 0 || item.result !== "fail") continue;
-    if (item.refs === void 0) entries.push({ id: criterion.id, proof: null, state: "uncited" });
+    if (item.refs === void 0) entries.push({ id: criterion.id, proof: null, state: "uncited", ...item.reason === NO_TEST_FILES_REASON ? { noTestFiles: true } : {} });
     else entries.push({ id: criterion.id, proof: null, state: "failed", commit: commits.get(criterion.id) ?? "", reason: item.reason ?? "no reason recorded" });
   }
   return { entries, notes };
@@ -129,7 +129,7 @@ function testFilesAt(cwd, head, isTest) {
     const picked = /* @__PURE__ */ new Map();
     for (const entry of listing.toString("utf8").split("\0")) {
       const match = /^(\d+) blob ([0-9a-f]+)\s+(\d+)\t(.*)$/s.exec(entry);
-      if (match === null || !match[1].startsWith("100") || Number(match[3]) > MAX_TEST_FILE_BYTES || !isTest.test(match[4])) continue;
+      if (match === null || !match[1].startsWith("100") || Number(match[3]) > MAX_TEST_FILE_BYTES || !isTest(match[4])) continue;
       if (picked.size >= MAX_TEST_FILES) break;
       picked.set(match[4], match[2]);
     }
@@ -140,6 +140,16 @@ function testFilesAt(cwd, head, isTest) {
     return void 0;
   }
 }
+function proofsFileAt(cwd, commit) {
+  try {
+    return git(cwd, ["show", `${commit}:.outerlayer-proofs.yaml`]).toString("utf8");
+  } catch {
+    return void 0;
+  }
+}
+function testFilesOf(cwd, commit, finder) {
+  return testFilesAt(cwd, commit, testFileMatcher(finder, proofsFileAt(cwd, commit)));
+}
 function checkoutPlaces(cwd) {
   for (let dir = resolve(cwd); ; dir = dirname(dir)) {
     const dotGit = resolve(dir, ".git");
@@ -167,14 +177,14 @@ function governingDir(cwd) {
 async function testProofMode(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return "any";
-  const { testProofIn } = await import('./host-checks-77FAAR2A.js');
+  const { testProofIn } = await import('./host-checks-DN6HLRIW.js');
   return testProofIn(dir);
 }
 async function judgeCheckName(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return {};
   if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
-  const { checksIn, isJudgeCheck } = await import('./host-checks-77FAAR2A.js');
+  const { checksIn, isJudgeCheck } = await import('./host-checks-DN6HLRIW.js');
   const quiet = { line: () => void 0, error: () => void 0 };
   const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
   return check === void 0 ? {} : { name: check.name };
@@ -186,7 +196,7 @@ async function findUnproven(input) {
     const criteria = criteriaOf(input.item);
     if (criteria === void 0) return { entries: [], notes: [] };
     const finder = await loadCitationFinder();
-    const headFiles = testFilesAt(input.cwd, input.head, finder.TEST_FILE);
+    const headFiles = testFilesOf(input.cwd, input.head, finder);
     if (headFiles === void 0) return { entries: [], notes: [`the test files at ${input.head.slice(0, 7)} cannot be read`] };
     const items = hostItemsOf(input.item, found.name);
     const result = unprovenCriteria({
@@ -194,7 +204,7 @@ async function findUnproven(input) {
       finder,
       headFiles,
       items,
-      testFilesAt: (commit) => testFilesAt(input.cwd, commit, finder.TEST_FILE)
+      testFilesAt: (commit) => testFilesOf(input.cwd, commit, finder)
     });
     const check = Object(input.item).checks?.find((c) => Object(c).name === found.name);
     if (check?.source === "host" && check.result === "fail" && items.length === 0) result.notes.unshift("the gateway returned no check items for the judge's result");
@@ -248,6 +258,9 @@ var STATE_LABEL = { current: "current", "out-of-date": "out of date", missing: "
 function renderEntry(e) {
   const id = sanitizeTerminal(e.id);
   if (e.state === "uncited") {
+    if (e.noTestFiles === true) {
+      return `${id}  none  uncited  No file at this commit is recognized as a test. Name the repository's test files with a runner glob in \`.outerlayer-proofs.yaml\`.`;
+    }
     return `${id}  none  uncited  No test at HEAD cites it. Put ${id} in a test's title or in a comment above the test, as in // proves ${id}`;
   }
   if (e.state === "failed") {
@@ -314,7 +327,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-BCY52YK3.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-SLIZUXUY.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-6WU2D2CY.js → chunk-ESK6EWAQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-ITS67SH7.js';
+import { stripTerminalControls } from './chunk-AJ3CC3HT.js';
 import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-ORENXMHA.js';
 import { readFileSync } from 'fs';
 
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-OQP6NU7P.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-UP7EFFLL.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-C2E4PWEN.js → chunk-FG564H3C.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-ZIXLG6EQ.js';
+import { uploadSpooledSteps } from './chunk-7XDF7PNF.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-IXPH4EXK.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-VEVNGDTP.js';
 import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor, signRunnerRequest } from './chunk-VJQQVTCS.js';
-import { writeSyncStatus, spoolDir } from './chunk-D7MWJM2G.js';
+import { writeSyncStatus, spoolDir } from './chunk-WHONZ53R.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-A2KLVZBU.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-GH2HEEOH.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-DINRXUQA.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { SCRUB_ENV_VARIABLE } from './chunk-4N7BQBO4.js';
 import { dirname, basename, join, sep } from 'path';

package/dist/{chunk-A2KLVZBU.js → chunk-GH2HEEOH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-DINRXUQA.js';
+import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-IXRUVR25.js';
 import { createHash } from 'crypto';
 import { readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, renameSync, unlinkSync, writeFileSync, stat as stat$1, unwatchFile, watchFile, watch as watch$1 } from 'fs';
 import { type, homedir } from 'os';

package/dist/{chunk-AVI3MGQO.js → chunk-GHQW2BBX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-N4KQMGEZ.js';
+import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-NYMDS542.js';
 import { inspectService, realInspectProbes } from './chunk-4N7BQBO4.js';
 import { realpathSync, readFileSync, readdirSync } from 'fs';
 import { resolve, dirname, join } from 'path';

package/dist/{chunk-6UHU7DHT.js → chunk-GHZLVKA3.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-ITS67SH7.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-N4KQMGEZ.js';
+import { scrubReason, stripTerminalControls } from './chunk-AJ3CC3HT.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-NYMDS542.js';
 import { RunnerAlreadyRunningError, readPidFile } from './chunk-64LLUVJR.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, postJson } from './chunk-72N7GOLM.js';
+import { isSignatureRefusal, postJson } from './chunk-T664NDNT.js';
 import { signerFor } from './chunk-VJQQVTCS.js';
 import { pidFilePath } from './chunk-2CW2QMSG.js';
 import { readFileSync } from 'fs';

package/dist/{chunk-2LCNMAWP.js → chunk-HA46L5FG.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { resolveDevcontainerCli, devcontainerBuildInvocation, universalImagePending, RecipeError } from './chunk-CM4J53WZ.js';
 import { universalImagePinned, UNIVERSAL_IMAGE, BUILDKIT_IMAGE } from './chunk-D3CT6XQ4.js';
 import { ensureHostKey } from './chunk-VJQQVTCS.js';
-import { compareVersions } from './chunk-A2KLVZBU.js';
+import { compareVersions } from './chunk-GH2HEEOH.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-2CW2QMSG.js';
 import { CLAUDE_PORT, BUILD_HOME, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4N7BQBO4.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';

package/dist/{chunk-OVNF4LLC.js → chunk-HH3BQG65.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { splitRawFile } from './chunk-XFJ7YOPD.js';
+import { splitRawFile } from './chunk-2EEW6FJN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';

package/dist/{chunk-TZMDRHWB.js → chunk-IAVT7R6O.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH, POLICY_CONTENT } from './chunk-J7EJMIDR.js';
-import { skillsBaseFor } from './chunk-LYCJQOO2.js';
+import { VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH, POLICY_CONTENT } from './chunk-54LIUIZL.js';
+import { skillsBaseFor } from './chunk-ARL6X6Y4.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolvePackRoot, AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, restoreSkillPaths, rewriteSkillPaths, skillDir, loadTemplateFiles, TEMPLATE_SKILLS } from './chunk-OVNF4LLC.js';
+import { resolvePackRoot, AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, restoreSkillPaths, rewriteSkillPaths, skillDir, loadTemplateFiles, TEMPLATE_SKILLS } from './chunk-HH3BQG65.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-UPA5KOOX.js';
+import { hasSymlinkComponent } from './chunk-RQ3GCCHH.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';

package/dist/{chunk-QXAPVAPR.js → chunk-JDYBPAPP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-7LKOOGSN.js';
-import { parseSize } from './chunk-2LCNMAWP.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-47SFTQA5.js';
+import { parseSize } from './chunk-HA46L5FG.js';
 import { builderDiskPinned } from './chunk-D3CT6XQ4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-4N7BQBO4.js';

package/dist/{chunk-LEJWPGO7.js → chunk-LBEYOL5K.js}

@@ -2,15 +2,15 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession, transcriptPathForSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-GJHOU5V3.js';
+import { autoConnect } from './chunk-BRBZKIZG.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-GH2HEEOH.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-DINRXUQA.js';
+import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, existsSync } from 'fs';
 import { join, dirname, basename } from 'path';

package/dist/{chunk-N4KQMGEZ.js → chunk-NYMDS542.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-QXAPVAPR.js';
-import { parseSize } from './chunk-2LCNMAWP.js';
+import { builtinKind, keepsHostBuilder } from './chunk-JDYBPAPP.js';
+import { parseSize } from './chunk-HA46L5FG.js';
 import { runnerDir } from './chunk-2CW2QMSG.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-4N7BQBO4.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';

package/dist/{chunk-TWFBOZQ5.js → chunk-OKJXZXYH.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-LYCJQOO2.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-LMYRR5MO.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-OVNF4LLC.js';
+import { isAgentsMdLayout, discoverOuterlayerPaths, isForeignTree, toRepoRelative } from './chunk-ARL6X6Y4.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-RPST2GNG.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-HH3BQG65.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-XFJ7YOPD.js';
+import { emitTree, generatedHeaderSource, parseOuterlayerConfig, classifyTree } from './chunk-2EEW6FJN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-EXKOPZQV.js → chunk-QELQ6Y4I.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
+import { sanitizeTerminal } from './chunk-VEVNGDTP.js';
+import { isAgentsMdLayout } from './chunk-ARL6X6Y4.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-IZKUPAXF.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { machineSkillsState, staleClaudeSkills } from './chunk-LASKTDCR.js';
-import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-OVNF4LLC.js';
+import { machineSkillsState, staleClaudeSkills } from './chunk-ZEFNJCN3.js';
+import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-HH3BQG65.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-UPA5KOOX.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-XFJ7YOPD.js';
+import { hasSymlinkComponent } from './chunk-RQ3GCCHH.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-2EEW6FJN.js';
 import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, realpathSync, readdirSync } from 'fs';
 import { join, dirname, posix, basename, isAbsolute, relative } from 'path';

package/dist/{chunk-LMYRR5MO.js → chunk-RPST2GNG.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-OVNF4LLC.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-HH3BQG65.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-XFJ7YOPD.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-2EEW6FJN.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-UPA5KOOX.js → chunk-RQ3GCCHH.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
 import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import { CONTEXT_PIN_FILENAME } from './chunk-XFJ7YOPD.js';
+import { CONTEXT_PIN_FILENAME } from './chunk-2EEW6FJN.js';
 import { execFileSync } from 'child_process';
 import { lstatSync, existsSync, unlinkSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';

package/dist/{chunk-7DHESPSV.js → chunk-S25I6OCB.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned } from './chunk-TZMDRHWB.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-72N7GOLM.js';
-import { isLinkedRepository } from './chunk-N6V4ZHI7.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-IAVT7R6O.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-T664NDNT.js';
+import { isLinkedRepository } from './chunk-26WUFKYZ.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-EXKOPZQV.js';
-import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { checkFormerSkillNames } from './chunk-LMYRR5MO.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-QELQ6Y4I.js';
+import { sanitizeTerminal } from './chunk-VEVNGDTP.js';
+import { checkFormerSkillNames } from './chunk-RPST2GNG.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-IZKUPAXF.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-D7MWJM2G.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-WHONZ53R.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-GH2HEEOH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-URIZRCRY.js';
 import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-QV4TO7HZ.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-AB5Y73BU.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-TEITBQKE.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-2EADRNJB.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-OXMOYIKK.js');
+    const { runnerHostChecks } = await import('./doctor-B2EZV6SJ.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-2C6EK5YY.js');
+      const { inspectRunnerService } = await import('./find-unit-H5DKNRBG.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-AGNFPJSP.js → chunk-S44ZN3CV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { toolsDockerfile } from './chunk-7XZQTJOD.js';
-import { runnerLabelValue } from './chunk-2LCNMAWP.js';
+import { runnerLabelValue } from './chunk-HA46L5FG.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-CM4J53WZ.js';
 import { CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE } from './chunk-D3CT6XQ4.js';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-64LLUVJR.js';

package/dist/{chunk-5B6DLEVM.js → chunk-SH5JFBPO.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-TWFBOZQ5.js';
+import { runEmit } from './chunk-OKJXZXYH.js';
 import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { installStarterPack } from './chunk-J7EJMIDR.js';
+import { installStarterPack } from './chunk-54LIUIZL.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-LYCJQOO2.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-QTL7VZVF.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-OVNF4LLC.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-ARL6X6Y4.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-X2ZJL7GA.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-HH3BQG65.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { linkedAgentsPath } from './chunk-UPA5KOOX.js';
+import { linkedAgentsPath } from './chunk-RQ3GCCHH.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { generatedHeaderSource } from './chunk-XFJ7YOPD.js';
+import { generatedHeaderSource } from './chunk-2EEW6FJN.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-72N7GOLM.js → chunk-T664NDNT.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-GJHOU5V3.js';
-import { workPageUrl } from './chunk-N6V4ZHI7.js';
+import { autoConnect } from './chunk-BRBZKIZG.js';
+import { workPageUrl } from './chunk-26WUFKYZ.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
+import { sanitizeTerminal } from './chunk-VEVNGDTP.js';
 import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-IZKUPAXF.js';
 import { signRunnerRequest } from './chunk-VJQQVTCS.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity } from './chunk-GH2HEEOH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
@@ -44,7 +44,7 @@ var TRACKERS = {
     connect: {
       kind: "form",
       summary: "Read the projects you pick on a site, and file specs as issues, with a service account. One webhook is created in Jira by an admin.",
-      intro: "Uses a service account's OAuth client credential. Create one under Atlassian administration, then paste it here. Give it read:jira-work, and write:jira-work to file specs. A credential's scopes are fixed when it is created.",
+      intro: "Uses a service account's OAuth client credential. Create one under Atlassian administration, then paste it here. Give it read:jira-work, and write:jira-work to file specs and to move issues to In progress. The service account also needs the Browse projects and Transition issues project permissions. A credential's scopes are fixed when it is created.",
       notice: "After connecting, you get a webhook URL and secret to put on one webhook in Jira. That is the only manual step, and the only time the secret is shown.",
       fields: [
         { name: "siteUrl", label: "Site URL", placeholder: "https://your-team.atlassian.net" },
@@ -471,7 +471,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-5C4MQ5ZS.js');
+      const { logHookError } = await import('./hook-fast-DPC75LFQ.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-7JBG43BX.js → chunk-TTUI3S6B.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, SHARED_OWNER, SHARED_NAME, metadataFromLabels, writeRecord } from './chunk-AGNFPJSP.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, SHARED_OWNER, SHARED_NAME, metadataFromLabels, writeRecord } from './chunk-S44ZN3CV.js';
 import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-7XZQTJOD.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-NPTEYMBW.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-DKIZDYUX.js';
-import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-SODV2YMW.js';
+import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-ZXQEBRCB.js';
 import { runnerImageVersion } from './chunk-ORENXMHA.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-S37IAT3A.js';
-import { optionalEgress, runnerCredentialProblem, builtinKind, allowHostProblem, systemClock, emptyEgressCounts, hostAllowed } from './chunk-QXAPVAPR.js';
-import { formatBytes, allocatedBytes } from './chunk-7LKOOGSN.js';
-import { NETWORK_HELPER_MEMORY, createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, networkHelperName, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, mountableHome, homeCopyRunArgs, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, NETWORK_READY_FILE, spawnRun, identityRunArgs, parseIdentity, networkHelperRunArgs } from './chunk-2LCNMAWP.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-UAINHP2C.js';
+import { optionalEgress, runnerCredentialProblem, builtinKind, allowHostProblem, systemClock, emptyEgressCounts, hostAllowed } from './chunk-JDYBPAPP.js';
+import { formatBytes, allocatedBytes } from './chunk-47SFTQA5.js';
+import { NETWORK_HELPER_MEMORY, createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, networkHelperName, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, mountableHome, homeCopyRunArgs, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, NETWORK_READY_FILE, spawnRun, identityRunArgs, parseIdentity, networkHelperRunArgs } from './chunk-HA46L5FG.js';
 import { RecipeError, DOCKER_FEATURE, universalImagePending, writeSanitizedRecipe, classifyProperties } from './chunk-CM4J53WZ.js';
 import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, networkHelperPinned, NETWORK_HELPER_SHA256, universalImagePinned, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-D3CT6XQ4.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { postJson, WorkCommandError, getJson } from './chunk-72N7GOLM.js';
-import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
+import { postJson, WorkCommandError, getJson } from './chunk-T664NDNT.js';
+import { sanitizeTerminal } from './chunk-VEVNGDTP.js';
 import { signerFor } from './chunk-VJQQVTCS.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-A2KLVZBU.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-XFJ7YOPD.js';
-import { downconvertSession } from './chunk-DINRXUQA.js';
+import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-GH2HEEOH.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-2EEW6FJN.js';
+import { downconvertSession } from './chunk-IXRUVR25.js';
 import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-2CW2QMSG.js';
 import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, checkoutPath, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, checkEnvironment, withMiseVariables, AGENT_CREDENTIAL_MISSING, isMiseVariableAllowed, JOB_MOUNT, realFdStorePort } from './chunk-4N7BQBO4.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
@@ -3527,6 +3527,10 @@ function copyJudgeTree(from, to, limits2 = { files: MAX_TREE_FILES, bytes: MAX_T
   walk(from, to, true);
 }
 
+// src/runner/record-proofs.ts
+var RECORD_PROOFS_ARGV = ["outerlayer", "work", "proofs", "--record", "--comment"];
+var PROOFS_LOG = "proofs.log";
+
 // src/runner/container/agent-user.ts
 var ADDED_USER = "ol-agent";
 var RELAY_REFUSAL = `the agent's user cannot be \`${RELAY_USER}\``;
@@ -5186,6 +5190,12 @@ async function deliverContainerHooks(runtime, state, jobDir) {
   return deliverJobFiles(runtime, state, ["git-hooks"], secretsOf(runtime, jobDir));
 }
 async function syncInContainer(input) {
+  return runCliInContainer(input, ["outerlayer", "sync"], "sync.log");
+}
+async function recordProofsInContainer(input) {
+  return runCliInContainer(input, [...RECORD_PROOFS_ARGV], PROOFS_LOG);
+}
+async function runCliInContainer(input, argv, logName) {
   const { runtime, job } = input;
   const state = job.container;
   try {
@@ -5215,8 +5225,8 @@ async function syncInContainer(input) {
       identity: job.commitIdentity
     });
     const result = await runtime.host.exec(
-      { container: state.container, user: state.agentUser ?? ADDED_USER, workdir: job.workdir ?? CHECKOUT_DIR, env, argv: ["outerlayer", "sync"] },
-      { logPath: join(input.jobDir, "sync.log") }
+      { container: state.container, user: state.agentUser ?? ADDED_USER, workdir: job.workdir ?? CHECKOUT_DIR, env, argv },
+      { logPath: join(input.jobDir, logName) }
     );
     return result.status === 0 ? { ok: true } : { ok: false, reason: `exit ${result.status}` };
   } catch (err) {
@@ -5595,4 +5605,4 @@ function describeMachineDocker(machine) {
   return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
 }
 
-export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureNetworkReady, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, firstLine4 as firstLine, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, keepRuntimeStep, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, provisionRuntimes, ranRuntimeStep, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, runtimeStepInput, said, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, stoppedHelperReason, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };
+export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, PROOFS_LOG, RECORD_PROOFS_ARGV, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureNetworkReady, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, firstLine4 as firstLine, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, keepRuntimeStep, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, provisionRuntimes, ranRuntimeStep, reachDockerStep, readConfigObject, recordProofsInContainer, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, runtimeStepInput, said, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, stoppedHelperReason, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };