@outerlayer/cli 0.34.0-next.20261028132110 → 0.34.0-next.20261028152714

package/dist/{build-3IZ6XHYN.js → build-D5OIIY7B.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, baseLines, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, UNIVERSAL_SOURCE_LABEL, baseLines, buildRepositoryImage, metadataFromLabels, prepareImageBuild, universalBase, writeRecord } from './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-HA46L5FG.js';
 export { RecipeError } from './chunk-CM4J53WZ.js';
 import './chunk-D3CT6XQ4.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-28T13:23:49.030Z+1e0c364","root":"/home/runner/work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-28T15:30:06.049Z+66b6fb6","root":"/home/runner/work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-E47RDQFK.js → check-AMTV6RTN.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-YMYU56JD.js';
+import { probeCredentials } from './chunk-4L46A2RR.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-GHZLVKA3.js';
+import './chunk-3PFR2WXH.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-MH6QLXUO.js';
 import './chunk-TZXJSNN4.js';
-import './chunk-ESK6EWAQ.js';
+import './chunk-HUS6X5BJ.js';
 import './chunk-JDQBJUXQ.js';
-import './chunk-AJ3CC3HT.js';
+import './chunk-AJZWVXXA.js';
 import './chunk-UE2C4STC.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-XDCD4GD5.js';
@@ -18,15 +18,15 @@ import './chunk-FG564H3C.js';
 import './chunk-7XDF7PNF.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-BUVDDPOM.js';
-import { managedProblems, managedFactsOf } from './chunk-262MWE4Q.js';
+import { managedProblems, managedFactsOf } from './chunk-RIKXE3T5.js';
 import './chunk-E3GX4WVJ.js';
 import './chunk-TBT347UY.js';
 import { findServiceUnit } from './chunk-GHQW2BBX.js';
 import './chunk-IAVT7R6O.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-TTUI3S6B.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, HELPER_ENV, helperSocketPath, probeHelper, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{chunk-GHZLVKA3.js → chunk-3PFR2WXH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-AJ3CC3HT.js';
+import { scrubReason, stripTerminalControls } from './chunk-AJZWVXXA.js';
 import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-NYMDS542.js';
 import { RunnerAlreadyRunningError, readPidFile } from './chunk-64LLUVJR.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';

package/dist/{chunk-ECCAFFAH.js → chunk-43BV4MP5.js}

@@ -177,14 +177,14 @@ function governingDir(cwd) {
 async function testProofMode(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return "any";
-  const { testProofIn } = await import('./host-checks-DN6HLRIW.js');
+  const { testProofIn } = await import('./host-checks-BOLFMWX2.js');
   return testProofIn(dir);
 }
 async function judgeCheckName(cwd) {
   const dir = governingDir(cwd);
   if (dir === void 0) return {};
   if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
-  const { checksIn, isJudgeCheck } = await import('./host-checks-DN6HLRIW.js');
+  const { checksIn, isJudgeCheck } = await import('./host-checks-BOLFMWX2.js');
   const quiet = { line: () => void 0, error: () => void 0 };
   const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
   return check === void 0 ? {} : { name: check.name };
@@ -327,7 +327,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-SLIZUXUY.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-GICELEJQ.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;

package/dist/{chunk-S25I6OCB.js → chunk-4CNUGDNU.js}

@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-B2EZV6SJ.js');
+    const { runnerHostChecks } = await import('./doctor-UIQ22QZC.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{chunk-YMYU56JD.js → chunk-4L46A2RR.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-GHZLVKA3.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-3PFR2WXH.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
 import { writePendingUpdate } from './chunk-TZXJSNN4.js';
-import { renderUpdateSteps } from './chunk-ESK6EWAQ.js';
+import { renderUpdateSteps } from './chunk-HUS6X5BJ.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-JDQBJUXQ.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-AJ3CC3HT.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-AJZWVXXA.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf, createHousekeepingDocker, housekeepingDockerIfReachable, KIND_LABEL, RECIPE_KEY_LABEL } from './chunk-262MWE4Q.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf, createHousekeepingDocker, housekeepingDockerIfReachable, KIND_LABEL, RECIPE_KEY_LABEL } from './chunk-RIKXE3T5.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-E3GX4WVJ.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, HELPER_ENV, setUpRunnerCgroup, sweepImageBuilders, stoppedHelperReason, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ensureNetworkReady, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-TTUI3S6B.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, HELPER_ENV, setUpRunnerCgroup, sweepImageBuilders, stoppedHelperReason, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ensureNetworkReady, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-I4V2YBMA.js';
 import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-ZXQEBRCB.js';
 import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-ORENXMHA.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
@@ -3191,7 +3191,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-E47RDQFK.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-AMTV6RTN.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-AJ3CC3HT.js → chunk-AJZWVXXA.js}

@@ -8,8 +8,8 @@ import { senderPidfile } from './chunk-6MLX26T4.js';
 import { installScrubContext } from './chunk-FG564H3C.js';
 import { writeDockerClientConfig } from './chunk-BUVDDPOM.js';
 import { upgradedStarterText } from './chunk-IAVT7R6O.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepRuntimeStep, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, recordProofsInContainer, PROOFS_LOG, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, ranRuntimeStep, provisionRuntimes, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, RECORD_PROOFS_ARGV, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-TTUI3S6B.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-S44ZN3CV.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepRuntimeStep, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, recordProofsInContainer, PROOFS_LOG, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, ranRuntimeStep, provisionRuntimes, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, RECORD_PROOFS_ARGV, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-I4V2YBMA.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-KY6H5L5O.js';
 import { waitForAgent, vmExecArgs } from './chunk-NPTEYMBW.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-DKIZDYUX.js';
 import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, removeKeptContext, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-ZXQEBRCB.js';
@@ -668,7 +668,7 @@ async function provisionMicroVm(input) {
     removeStagedContext: () => removeStagedContext(buildDir2),
     keepIn: jobDir,
     ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
-    // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
+    // A build on the universal image, or on an image built from it, chooses and installs its runtimes.
     ...runtimeStepInput(report, services)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);

package/dist/{chunk-ESK6EWAQ.js → chunk-HUS6X5BJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-AJ3CC3HT.js';
+import { stripTerminalControls } from './chunk-AJZWVXXA.js';
 import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-ORENXMHA.js';
 import { readFileSync } from 'fs';
 

package/dist/{chunk-TTUI3S6B.js → chunk-I4V2YBMA.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, SHARED_OWNER, SHARED_NAME, metadataFromLabels, writeRecord } from './chunk-S44ZN3CV.js';
-import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-7XZQTJOD.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, SHARED_OWNER, SHARED_NAME, universalBase, metadataFromLabels, writeRecord } from './chunk-KY6H5L5O.js';
+import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-V64BEF6E.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-NPTEYMBW.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-DKIZDYUX.js';
@@ -13,7 +13,7 @@ import { optionalEgress, runnerCredentialProblem, builtinKind, allowHostProblem,
 import { formatBytes, allocatedBytes } from './chunk-47SFTQA5.js';
 import { NETWORK_HELPER_MEMORY, createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, networkHelperName, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, mountableHome, homeCopyRunArgs, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, NETWORK_READY_FILE, spawnRun, identityRunArgs, parseIdentity, networkHelperRunArgs } from './chunk-HA46L5FG.js';
 import { RecipeError, DOCKER_FEATURE, universalImagePending, writeSanitizedRecipe, classifyProperties } from './chunk-CM4J53WZ.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, networkHelperPinned, NETWORK_HELPER_SHA256, universalImagePinned, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-D3CT6XQ4.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, networkHelperPinned, NETWORK_HELPER_SHA256, universalImagePinned, UNIVERSAL_IMAGE, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-D3CT6XQ4.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { postJson, WorkCommandError, getJson } from './chunk-T664NDNT.js';
 import { sanitizeTerminal } from './chunk-VEVNGDTP.js';
@@ -2392,8 +2392,7 @@ async function buildInBuilder(opts, deps, prepared) {
         claudeCodeVersion: prepared.claudeCodeVersion,
         buildId: opts.cli.buildId,
         guestHelper: true,
-        fetched: true,
-        ...location.kind === "default" ? { universal: true } : {}
+        fetched: true
       })
     );
     inputs = builderInput({ checkoutDir: checkout.dir, toolsDir, toolFilesDir, recipeDir }, archive);
@@ -2415,6 +2414,7 @@ async function buildInBuilder(opts, deps, prepared) {
     const described = JSON.parse(result);
     const imageConfig = parseImageConfig(JSON.stringify(described.config));
     const labels = described.config.Labels ?? {};
+    const base = universalBase(location, labels);
     mkdirSync(recordDir, { recursive: true, mode: RUNNER_DIR_MODE });
     const fd = openSync(partial, "w", 384);
     let received = 0;
@@ -2444,7 +2444,7 @@ async function buildInBuilder(opts, deps, prepared) {
       sourceCommit: checkout.commit,
       defaultBranch: checkout.defaultBranch,
       recipe: location.kind === "default" ? "default" : location.path,
-      ...location.kind === "default" ? { base: { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST } } : {},
+      ...base === void 0 ? {} : { base },
       recipeKey: prepared.recipeKey,
       toolsKey: prepared.toolsKey,
       imageId: `${ROOT_DISK_ID_PREFIX}${rKey}-${tKey}`,
@@ -4992,7 +4992,7 @@ async function provisionContainer(input) {
     removeStagedContext: () => removeStagedContext(buildDir2),
     keepIn: jobDir,
     ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
-    // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
+    // A build on the universal image, or on an image built from it, chooses and installs its runtimes.
     ...runtimeStepInput(report, services)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);

package/dist/{chunk-S44ZN3CV.js → chunk-KY6H5L5O.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { toolsDockerfile } from './chunk-7XZQTJOD.js';
+import { toolsDockerfile } from './chunk-V64BEF6E.js';
 import { runnerLabelValue } from './chunk-HA46L5FG.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-CM4J53WZ.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE } from './chunk-D3CT6XQ4.js';
+import { UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION } from './chunk-D3CT6XQ4.js';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-64LLUVJR.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-2CW2QMSG.js';
@@ -207,9 +207,17 @@ function selectPrunable(opts) {
 
 // src/runner/image/build.ts
 function baseLines(report) {
-  return report.base === void 0 ? [] : [`  base:    ${report.base.reference}@${report.base.digest}
+  if (report.base === void 0) return [];
+  return [`  base:    ${report.base.reference}${report.base.digest === void 0 ? "" : `@${report.base.digest}`}
 `];
 }
+var UNIVERSAL_SOURCE_LABEL = "ai.outerlayer.universal-source";
+var SOURCE_TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+function universalBase(location, labels) {
+  if (location.kind === "default") return { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST };
+  const source = labels[UNIVERSAL_SOURCE_LABEL];
+  return source !== void 0 && SOURCE_TAG.test(source) ? { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${source}` } : void 0;
+}
 var KIND2 = "ai.outerlayer.kind";
 var RUNNER2 = "ai.outerlayer.runner";
 var REPOSITORY = "ai.outerlayer.repository";
@@ -422,8 +430,7 @@ async function buildRepositoryImage(opts, ports) {
           nodeImage,
           claudeCodeVersion,
           buildId: opts.cli.buildId,
-          guestHelper: opts.guestHelper !== void 0,
-          ...universal ? { universal: true } : {}
+          guestHelper: opts.guestHelper !== void 0
         });
         const labels = { [REPOSITORY]: imageRepository, [KIND2]: "build", [RUNNER2]: runnerLabel, [RECIPE_KEY2]: rKey, [TOOLS_KEY]: tKey };
         const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath, ...universal ? {} : { base: { ref: recipeTag, layout: keptLayout } } });
@@ -435,6 +442,7 @@ async function buildRepositoryImage(opts, ports) {
       if (buildImage === void 0) throw failed("finding the image after the tools build", 0);
     }
     const toolsBuilt = buildImage !== buildImageBefore;
+    const base = universalBase(location, buildImage.labels);
     let report = readReport(recordDir);
     if (report === null || report.imageId !== buildImage.id || report.docker === void 0) {
       report = {
@@ -442,7 +450,7 @@ async function buildRepositoryImage(opts, ports) {
         sourceCommit: checkout.commit,
         defaultBranch: checkout.defaultBranch,
         recipe: location.kind === "default" ? "default" : location.path,
-        ...universal ? { base: { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST } } : {},
+        ...base === void 0 ? {} : { base },
         recipeKey: rKey,
         toolsKey: tKey,
         imageId: buildImage.id,
@@ -453,6 +461,8 @@ async function buildRepositoryImage(opts, ports) {
       writeRecord(recordDir, report, now().toISOString());
     } else if (universal) {
       report = { ...report, repository, sourceCommit: checkout.commit, defaultBranch: checkout.defaultBranch };
+    } else if (base !== void 0) {
+      report = { ...report, base };
     }
     const removed = [];
     if (toolsBuilt) removed.push(...await prune(host, imageRepository, repoRecords, opts.keep ?? KEEP_BUILD_IMAGES, runnerDir(opts.configPath), runnerLabel));
@@ -493,4 +503,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath, runnerL
   return removed;
 }
 
-export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, baseLines, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, writeRecord };
+export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, UNIVERSAL_SOURCE_LABEL, baseLines, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, universalBase, writeRecord };

package/dist/{chunk-262MWE4Q.js → chunk-RIKXE3T5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-TTUI3S6B.js';
+import { placeholderQueues, placeholderProblem } from './chunk-I4V2YBMA.js';
 import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-NYMDS542.js';
 import { builtinKind, EGRESS_SWITCHABLE_KEYS, imageBuildOf, keepsHostBuilder } from './chunk-JDYBPAPP.js';
 import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK, volumeBytes } from './chunk-47SFTQA5.js';

package/dist/{chunk-7XZQTJOD.js → chunk-V64BEF6E.js}

@@ -7,9 +7,15 @@ import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 createRequire(import.meta.url);
 
 // src/runner/image/claude-wrapper.ts
-function claudeWrapperScript(opts) {
-  const path = opts.universal ? 'PATH="$PATH:/opt/outerlayer/bin"' : "PATH=/opt/outerlayer/bin:$PATH";
-  return ["#!/bin/sh", path, "export PATH", 'exec /opt/outerlayer/claude/bin/claude "$@"', ""].join("\n");
+var UNIVERSAL_VERSIONS_FILE = "/etc/outerlayer/universal-versions.json";
+function claudeWrapperScript() {
+  return [
+    "#!/bin/sh",
+    `if [ -f ${UNIVERSAL_VERSIONS_FILE} ]; then PATH="$PATH:/opt/outerlayer/bin"; else PATH=/opt/outerlayer/bin:$PATH; fi`,
+    "export PATH",
+    'exec /opt/outerlayer/claude/bin/claude "$@"',
+    ""
+  ].join("\n");
 }
 
 // src/runner/image/dockerfiles.ts
@@ -106,7 +112,7 @@ function toolsDockerfile(parts) {
     "RUN mkdir -p /out/opt/outerlayer/bin /out/usr/local/bin /out/etc/claude-code /out/build \\",
     " && cp /usr/local/bin/node /out/opt/outerlayer/bin/node \\",
     ` && printf '%s\\n' '#!/bin/sh' 'exec /opt/outerlayer/bin/node /opt/outerlayer/cli/dist/index.js "$@"' > /out/usr/local/bin/outerlayer \\`,
-    ` && printf '%s\\n' ${claudeWrapperScript({ universal: parts.universal === true }).trimEnd().split("\n").map((line) => `'${line}'`).join(" ")} > /out/usr/local/bin/claude \\`,
+    ` && printf '%s\\n' ${claudeWrapperScript().trimEnd().split("\n").map((line) => `'${line}'`).join(" ")} > /out/usr/local/bin/claude \\`,
     ` && printf '%s\\n' '${tools}' > /out/opt/outerlayer/tools.json \\`,
     ` && printf '%s\\n' '${managedSettings}' > /out/etc/claude-code/managed-settings.json \\`,
     " && chmod 0755 /out/usr/local/bin/outerlayer /out/usr/local/bin/claude \\",

package/dist/{cli-3V7AMF2V.js → cli-DQXFGH6X.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-S25I6OCB.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-4CNUGDNU.js';
 import './chunk-IAVT7R6O.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-54LIUIZL.js';
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-ELTRVJLG.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-4LYUGPB3.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-ELTRVJLG.js');
+    const { runInitCommand } = await import('./init-cmd-4LYUGPB3.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4455,7 +4455,7 @@ and the command prints the manifest's path for \`emit demo\`. Under \`work proof
 to OUTERLAYER_PROOF_OUT instead. Exit 1 means the demo's test failed; its manifest is written all the same.
 `
   ).action(async (file, opts) => {
-    const { runDemoRecord, DemoRecordError } = await import('./demo-record-cmd-KM2UPWPL.js');
+    const { runDemoRecord, DemoRecordError } = await import('./demo-record-cmd-EGBXUDYP.js');
     try {
       const result = await runDemoRecord({
         file,
@@ -4999,7 +4999,7 @@ differs from HEAD.
       fail(trackerNumberError("--pr", opts.pr));
       return;
     }
-    const { runWorkProofsCommand } = await import('./work-proofs-cmd-7C22LBBE.js');
+    const { runWorkProofsCommand } = await import('./work-proofs-cmd-CNQR7RCD.js');
     await runWorkProofsCommand({ ...opts, ...pr === void 0 ? {} : { pr } });
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
@@ -5146,7 +5146,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-2EADRNJB.js');
-    const { start, RunnerStartError } = await import('./loop-LILQBIHK.js');
+    const { start, RunnerStartError } = await import('./loop-GRDMQM2J.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-AVJFRZZT.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5165,8 +5165,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-2EADRNJB.js');
-    const { containerStart } = await import('./container-start-RS3S6WYE.js');
-    const { start, RunnerStartError } = await import('./loop-LILQBIHK.js');
+    const { containerStart } = await import('./container-start-L5FDIAD7.js');
+    const { start, RunnerStartError } = await import('./loop-GRDMQM2J.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-AVJFRZZT.js');
     try {
       const result = await containerStart({
@@ -5190,14 +5190,14 @@ function registerRunnerCommands(program2) {
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-2EADRNJB.js');
     const { runnerDir } = await import('./paths-VQ3ALYZ3.js');
-    const { runUpdateSteps } = await import('./update-steps-6JOHOMGM.js');
+    const { runUpdateSteps } = await import('./update-steps-7HZZPWZE.js');
     const text = await runUpdateSteps({ runnerDirPath: runnerDir(opts.config ?? defaultRunnerConfigPath()) });
     process.stdout.write(`${text}
 `);
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-2EADRNJB.js');
-    const { runRunnerCheck } = await import('./check-E47RDQFK.js');
+    const { runRunnerCheck } = await import('./check-AMTV6RTN.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5231,13 +5231,13 @@ function registerRunnerCommands(program2) {
       }
     }
     const buildCpusMax = opts.buildCpusMax === void 0 ? void 0 : Number(opts.buildCpusMax);
-    if (buildCpusMax !== void 0 && !(await import('./command-57COSNSG.js')).cpusAreValid(buildCpusMax)) {
+    if (buildCpusMax !== void 0 && !(await import('./command-JLHJ2TOH.js')).cpusAreValid(buildCpusMax)) {
       fail(`--build-cpus-max ${opts.buildCpusMax} is not a number of CPUs from 0.01 to 1024.`);
       return;
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-57COSNSG.js');
+        const { installServiceCommand } = await import('./command-JLHJ2TOH.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5295,7 +5295,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-2EADRNJB.js');
-    const { uninstallServiceCommand } = await import('./command-57COSNSG.js');
+    const { uninstallServiceCommand } = await import('./command-JLHJ2TOH.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5323,10 +5323,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-2EADRNJB.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-SCUDJ6QI.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-4OIOA3CD.js');
-    const { detectMachine } = await import('./machine-UVPCJGJU.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-6D3RKRRB.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-7G3UO6J3.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-DIGTV3G5.js');
+    const { detectMachine } = await import('./machine-QSGONNDX.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-N6UZ5WCL.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-K4DOSDUV.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5477,7 +5477,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-57COSNSG.js');
+        const { installServiceCommand } = await import('./command-JLHJ2TOH.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5522,7 +5522,7 @@ Next:
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\nA repository with no devcontainer file builds on the universal image the CLI pins by digest.\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-2EADRNJB.js');
-    const { baseLines, buildRepositoryImage, RecipeError } = await import('./build-3IZ6XHYN.js');
+    const { baseLines, buildRepositoryImage, RecipeError } = await import('./build-D5OIIY7B.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
     const { createDockerHost } = await import('./docker-UP7EFFLL.js');
     const { builderSpec } = await import('./builder-S42B4STV.js');
@@ -5606,7 +5606,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-2EADRNJB.js');
-    const { requestStop } = await import('./loop-LILQBIHK.js');
+    const { requestStop } = await import('./loop-GRDMQM2J.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-3KPTSRB4.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5614,8 +5614,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-2EADRNJB.js');
     const { jobsDir, runnerDir } = await import('./paths-VQ3ALYZ3.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-LILQBIHK.js');
-    const { renderStatus } = await import('./status-5RSSYZBU.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-GRDMQM2J.js');
+    const { renderStatus } = await import('./status-NA5DLUXD.js');
     const { readHousekeepingRecord } = await import('./record-XE7Z3QGF.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5674,7 +5674,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-2EADRNJB.js');
-    const { listJobFiles } = await import('./loop-LILQBIHK.js');
+    const { listJobFiles } = await import('./loop-GRDMQM2J.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-HUENB7U4.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-57COSNSG.js → command-JLHJ2TOH.js}

@@ -3,10 +3,10 @@ import { createRequire } from 'node:module';
 import { realOwnership, accountNamed, handOver, runRunnerInstall, launcherSummary, restartNote, accountIdentity } from './chunk-265SXBQ5.js';
 import './chunk-QGTJ5IJN.js';
 import { currentLink, execStartCommand } from './chunk-E3GX4WVJ.js';
-import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-TTUI3S6B.js';
+import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{container-start-RS3S6WYE.js → container-start-L5FDIAD7.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-GHZLVKA3.js';
-import { readOwnContainer } from './chunk-ESK6EWAQ.js';
-import './chunk-AJ3CC3HT.js';
+import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-3PFR2WXH.js';
+import { readOwnContainer } from './chunk-HUS6X5BJ.js';
+import './chunk-AJZWVXXA.js';
 import './chunk-UE2C4STC.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-XDCD4GD5.js';
@@ -14,10 +14,10 @@ import './chunk-ESVW4MJY.js';
 import './chunk-BUVDDPOM.js';
 import './chunk-TBT347UY.js';
 import './chunk-IAVT7R6O.js';
-import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-TTUI3S6B.js';
+import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{demo-record-cmd-KM2UPWPL.js → demo-record-cmd-EGBXUDYP.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { IMAGE_BROWSER } from './chunk-7XZQTJOD.js';
+import { IMAGE_BROWSER } from './chunk-V64BEF6E.js';
 import { buildRootFromDist } from './chunk-CM4J53WZ.js';
 import './chunk-D3CT6XQ4.js';
 import { C } from './chunk-ANPNT6PM.js';

package/dist/{doctor-B2EZV6SJ.js → doctor-UIQ22QZC.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { KIND_LABEL, managedProblems } from './chunk-262MWE4Q.js';
+import { KIND_LABEL, managedProblems } from './chunk-RIKXE3T5.js';
 import { launcherCheck } from './chunk-QGTJ5IJN.js';
 import './chunk-E3GX4WVJ.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { needsClaudeCredential, claudeCredentialCheck, detectMachine, supportsContainerBuilds, describeMachineDocker, MIN_ENGINE_MAJOR, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned, helperFirecrackerNote, probeHelper, helperSocketPath, firstLine, missingPermissionOf, missingPermissionFix } from './chunk-TTUI3S6B.js';
+import { needsClaudeCredential, claudeCredentialCheck, detectMachine, supportsContainerBuilds, describeMachineDocker, MIN_ENGINE_MAJOR, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned, helperFirecrackerNote, probeHelper, helperSocketPath, firstLine, missingPermissionOf, missingPermissionFix } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{host-checks-DN6HLRIW.js → host-checks-BOLFMWX2.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MAX_CHECK_ITEMS_BYTES, checksIn, commandItems, isJudgeCheck, makeRecorder, readDefinitions, runHostChecks, testProofIn, timeoutAfter } from './chunk-AJ3CC3HT.js';
+export { MAX_CHECK_ITEMS_BYTES, checksIn, commandItems, isJudgeCheck, makeRecorder, readDefinitions, runHostChecks, testProofIn, timeoutAfter } from './chunk-AJZWVXXA.js';
 import './chunk-UE2C4STC.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-XDCD4GD5.js';
@@ -12,10 +12,10 @@ import './chunk-ESVW4MJY.js';
 import './chunk-BUVDDPOM.js';
 import './chunk-TBT347UY.js';
 import './chunk-IAVT7R6O.js';
-import './chunk-TTUI3S6B.js';
+import './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-DPC75LFQ.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-3V7AMF2V.js');
+var { runCli } = await import('./cli-DQXFGH6X.js');
 await runCli(process.argv);

package/dist/{init-SCUDJ6QI.js → init-7G3UO6J3.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-TTUI3S6B.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{init-6D3RKRRB.js → init-N6UZ5WCL.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-E7R2GIAW.js';
-import { RunnerInitError, readConfigObject } from './chunk-TTUI3S6B.js';
+import { RunnerInitError, readConfigObject } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{init-cmd-ELTRVJLG.js → init-cmd-4LYUGPB3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-S25I6OCB.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-4CNUGDNU.js';
 import './chunk-IAVT7R6O.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-KT4CN6OU.js';

package/dist/{loop-LILQBIHK.js → loop-GRDMQM2J.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-YMYU56JD.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-4L46A2RR.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-GHZLVKA3.js';
+import './chunk-3PFR2WXH.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-MH6QLXUO.js';
 import './chunk-TZXJSNN4.js';
-import './chunk-ESK6EWAQ.js';
+import './chunk-HUS6X5BJ.js';
 import './chunk-JDQBJUXQ.js';
-import './chunk-AJ3CC3HT.js';
+import './chunk-AJZWVXXA.js';
 import './chunk-UE2C4STC.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-XDCD4GD5.js';
@@ -18,14 +18,14 @@ import './chunk-FG564H3C.js';
 import './chunk-7XDF7PNF.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-BUVDDPOM.js';
-import './chunk-262MWE4Q.js';
+import './chunk-RIKXE3T5.js';
 import './chunk-E3GX4WVJ.js';
 import './chunk-TBT347UY.js';
 import './chunk-IAVT7R6O.js';
-import './chunk-TTUI3S6B.js';
+import './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{machine-UVPCJGJU.js → machine-QSGONNDX.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-TTUI3S6B.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{runner-key-4OIOA3CD.js → runner-key-DIGTV3G5.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-TTUI3S6B.js';
+import { readConfigObject, RunnerInitError } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{status-5RSSYZBU.js → status-NA5DLUXD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-AJ3CC3HT.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-AJZWVXXA.js';
 import './chunk-UE2C4STC.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import './chunk-XDCD4GD5.js';
@@ -12,10 +12,10 @@ import './chunk-ESVW4MJY.js';
 import './chunk-BUVDDPOM.js';
 import './chunk-TBT347UY.js';
 import './chunk-IAVT7R6O.js';
-import { LEASE_SECONDS } from './chunk-TTUI3S6B.js';
+import { LEASE_SECONDS } from './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{update-steps-6JOHOMGM.js → update-steps-7HZZPWZE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { readOwnContainer, renderUpdateSteps, runUpdateSteps } from './chunk-ESK6EWAQ.js';
-import './chunk-AJ3CC3HT.js';
+export { readOwnContainer, renderUpdateSteps, runUpdateSteps } from './chunk-HUS6X5BJ.js';
+import './chunk-AJZWVXXA.js';
 import './chunk-UE2C4STC.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-XDCD4GD5.js';
@@ -13,10 +13,10 @@ import './chunk-ESVW4MJY.js';
 import './chunk-BUVDDPOM.js';
 import './chunk-TBT347UY.js';
 import './chunk-IAVT7R6O.js';
-import './chunk-TTUI3S6B.js';
+import './chunk-I4V2YBMA.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-S44ZN3CV.js';
-import './chunk-7XZQTJOD.js';
+import './chunk-KY6H5L5O.js';
+import './chunk-V64BEF6E.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-NPTEYMBW.js';
 import './chunk-DKIZDYUX.js';

package/dist/{work-proofs-cmd-7C22LBBE.js → work-proofs-cmd-CNQR7RCD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { classifyProofs, classifyProofsAt, otherPullRequestHeads, resolveProofsItem, runWorkProofs, runWorkProofsCommand } from './chunk-ECCAFFAH.js';
+export { classifyProofs, classifyProofsAt, otherPullRequestHeads, resolveProofsItem, runWorkProofs, runWorkProofsCommand } from './chunk-43BV4MP5.js';
 import './chunk-UE2C4STC.js';
 import './chunk-T664NDNT.js';
 import './chunk-IP7BIBXJ.js';

package/dist/{work-proofs-record-SLIZUXUY.js → work-proofs-record-GICELEJQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveProofsItem, ownPullRequest, otherPullRequestHeads, classifyProofsAt, runWorkProofs, proofsCommentId, kindProblem, proofsCommentBody } from './chunk-ECCAFFAH.js';
+import { resolveProofsItem, ownPullRequest, otherPullRequestHeads, classifyProofsAt, runWorkProofs, proofsCommentId, kindProblem, proofsCommentBody } from './chunk-43BV4MP5.js';
 import { runWorkComment } from './chunk-6G3BG2GI.js';
 import { runnerMatcher } from './chunk-UE2C4STC.js';
 import { runEmitDemo } from './chunk-TVDKDXW6.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.34.0-next.20261028132110",
+  "version": "0.34.0-next.20261028152714",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, demo, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",