@outerlayer/cli 0.4.0 → 0.5.0

package/dist/{chunk-CBZB6XY6.js → chunk-FC7TMRNA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-L2DBRKRA.js';
-import { MIN_ENGINE_MAJOR } from './chunk-7A6RVXPZ.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RJ467PDQ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-4NMBDRBS.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-DVYHCMB2.js → chunk-JLDZTG3A.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { resolveRepoIdentity } from './chunk-G7FSV7JX.js';
+import { resolveRepoIdentity } from './chunk-EX6M5JPR.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-BOLTI6LR.js';

package/dist/{chunk-FS2VYGZT.js → chunk-L24G4PLP.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, releaseLease, isUnfinished, writeJobFile, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, readJobFile, hookLimitsFor } from './chunk-FAJSS2WN.js';
-import { RUNNER_PROTOCOL } from './chunk-FV2CCGXK.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, writeJobFile, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, readJobFile, hookLimitsFor } from './chunk-RWOTHXYE.js';
+import { RUNNER_PROTOCOL } from './chunk-QDQEUVUF.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
 import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-YYYXRJUW.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, formatClock, measureDisk, createRunnerLog, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-7A6RVXPZ.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, formatClock, measureDisk, createRunnerLog, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-4NMBDRBS.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-5DLBAXY5.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-RMAZ2NWA.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks } from './chunk-5Y3QQRUH.js';
 import { exceedsDisk } from './chunk-F6GFZXZ3.js';
 import { parseClaimIdentity, sharedUserEnvironment, JOB_MOUNT } from './chunk-AUFG23AA.js';
@@ -825,7 +825,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-UOQO2AD4.js');
+  const { postJson: postJson2 } = await import('./work-cmd-NUR4CAG6.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1525,7 +1525,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-WQP2CZDW.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-AXCXDYO2.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-7YIOOFVJ.js → chunk-OHFDWLJP.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-CBZB6XY6.js';
-import { describeCallFailure } from './chunk-7A6RVXPZ.js';
-import { WorkCommandError, getJson } from './chunk-5DLBAXY5.js';
-import { sanitizeTerminal } from './chunk-6Y63SXFO.js';
+import { isPlaceholderCommand } from './chunk-FC7TMRNA.js';
+import { describeCallFailure } from './chunk-4NMBDRBS.js';
+import { WorkCommandError, getJson } from './chunk-RMAZ2NWA.js';
+import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
 import { builtinKind } from './chunk-5Y3QQRUH.js';
 import { claudeCredential, CLAUDE_CREDENTIAL_VARIABLES } from './chunk-AUFG23AA.js';
 import { signerFor } from './chunk-M5POMKKW.js';

package/dist/{chunk-2E54Z3P5.js → chunk-OR6AEEDO.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { dashboardBase, isRepositoryLinked, workPageUrl, notLinkedText } from './chunk-3TT7RQYB.js';
-import { sanitizeTerminal } from './chunk-6Y63SXFO.js';
-import { remoteLookupFailed } from './chunk-G7FSV7JX.js';
+import { dashboardBase, isRepositoryLinked, workPageUrl, notLinkedText } from './chunk-D2KWEAN6.js';
+import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
+import { remoteLookupFailed } from './chunk-EX6M5JPR.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { findGitDirs, readRepoConnection, writeRepoConnection } from './chunk-BJ3KTMDH.js';
 import { createInterface } from 'readline/promises';

package/dist/{chunk-FV2CCGXK.js → chunk-QDQEUVUF.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 11;
+var RUNNER_PROTOCOL = 12;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-L2DBRKRA.js → chunk-RJ467PDQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-7A6RVXPZ.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-ZNA27WEV.js';
+import { MIN_ENGINE_MAJOR } from './chunk-4NMBDRBS.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-Z62HNKEJ.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-5DLBAXY5.js → chunk-RMAZ2NWA.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { sanitizeTerminal } from './chunk-6Y63SXFO.js';
-import { resolveRepoIdentity } from './chunk-G7FSV7JX.js';
+import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
+import { resolveRepoIdentity } from './chunk-EX6M5JPR.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';

package/dist/{chunk-FAJSS2WN.js → chunk-RWOTHXYE.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { DOCKERD_LOG } from './chunk-CBPPJSAR.js';
-import { installScrubContext } from './chunk-HE2D4EY5.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, ADDED_USER, createRunnerLog, createContainerRuntime, stopContainer, syncInContainer, formatDuration, cleanupContainer, retrySend, formatClock, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk } from './chunk-7A6RVXPZ.js';
-import { CLAUDE_CODE_VERSION } from './chunk-ZNA27WEV.js';
+import { installScrubContext } from './chunk-ZOC7JSYC.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, ADDED_USER, createRunnerLog, createContainerRuntime, stopContainer, syncInContainer, formatDuration, cleanupContainer, retrySend, formatClock, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk } from './chunk-4NMBDRBS.js';
+import { CLAUDE_CODE_VERSION } from './chunk-Z62HNKEJ.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
 import { childEnvironment } from './chunk-774HEQL6.js';
 import { waitForAgent, vmExecArgs } from './chunk-W4SQCOZU.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-B2G7JHHB.js';
-import { WorkCommandError, postJson, isSignatureRefusal } from './chunk-5DLBAXY5.js';
-import { planArtifactUpload } from './chunk-6Y63SXFO.js';
-import { scrubText } from './chunk-G7FSV7JX.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-RMAZ2NWA.js';
+import { planArtifactUpload } from './chunk-WOBNRVQT.js';
+import { scrubText } from './chunk-EX6M5JPR.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm } from './chunk-5Y3QQRUH.js';
 import { parseSize } from './chunk-F6GFZXZ3.js';
 import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT } from './chunk-AUFG23AA.js';
@@ -38,8 +38,8 @@ var DOCKER_LOG_LINES = 20;
 var GUEST_GH_DIR = `${JOB_MOUNT}/gh`;
 var GUEST_HOOKS_DIR = `${JOB_MOUNT}/git-hooks`;
 var GUEST_CONTEXT_DIR = `${JOB_MOUNT}/context`;
-function firstLine(text) {
-  return text.trim().split("\n")[0] ?? "";
+function firstLine(text2) {
+  return text2.trim().split("\n")[0] ?? "";
 }
 function execEnvironment(image, env) {
   const merged = { ...image, ...env.literals };
@@ -435,25 +435,25 @@ function unspecified(address) {
   const normal = new URL(`http://[${address}]/`).hostname;
   return normal === "[::]" || normal === "[::ffff:0:0]";
 }
-function parseBroker(text) {
-  const match = /^(?:\[([0-9a-fA-F:.]+)\]|([0-9.]+)):(\d{1,5})$/.exec(text);
+function parseBroker(text2) {
+  const match = /^(?:\[([0-9a-fA-F:.]+)\]|([0-9.]+)):(\d{1,5})$/.exec(text2);
   if (match === null) return void 0;
   const host = match[1] ?? match[2];
   const port = Number(match[3]);
   if (!isLiteralAddress(host) || unspecified(host) || port < 1 || port > 65535) return void 0;
-  return { host, port, text };
+  return { host, port, text: text2 };
 }
 function readReport(path) {
   const named = `provision.out names recipe ${path}`;
   if (!isAbsolute(path)) return { problem: `${named}, which is not an absolute path` };
-  let text;
+  let text2;
   try {
-    text = readFileSync(path, "utf8");
+    text2 = readFileSync(path, "utf8");
   } catch {
     return { problem: `${named}, which does not exist` };
   }
   try {
-    const parsed = JSON.parse(text);
+    const parsed = JSON.parse(text2);
     const lifecycle = parsed.apply?.lifecycle;
     if (typeof parsed.sourceCommit === "string" && typeof parsed.recipeKey === "string" && typeof parsed.imageId === "string" && typeof lifecycle === "object" && lifecycle !== null && Object.values(lifecycle).every((entries) => Array.isArray(entries) && entries.every((entry) => typeof entry === "object" && entry !== null))) {
       return { report: { ...parsed, ignored: Array.isArray(parsed.ignored) ? parsed.ignored : [] } };
@@ -635,6 +635,81 @@ async function provisionProcess(input) {
 function cleanupProcess(runtime, state) {
   return closeHostBuild(runtime, state);
 }
+
+// src/runner/verdict.ts
+var VERDICT_SETTLE_MS = 5 * 6e4;
+var VERDICT_READ_EVERY_MS = 3e4;
+var REASON_MAX = 200;
+function text(value) {
+  return typeof value === "string" ? value : "";
+}
+function fields(value) {
+  return Object(value);
+}
+function parseEvaluation(value) {
+  if (value === void 0) return void 0;
+  const raw = fields(value);
+  const verdict = raw.verdict;
+  if (verdict !== "pass" && verdict !== "flag" && verdict !== "unverifiable" && verdict !== "waiting") return null;
+  const open = [];
+  for (const row of Array.isArray(raw.open) ? raw.open : []) {
+    const r = fields(row);
+    if (r.status !== "flag" && r.status !== "pending") continue;
+    open.push({ label: text(r.label), status: r.status, sentence: text(r.sentence) });
+  }
+  return { verdict, sentence: text(raw.sentence), waitingOn: raw.waitingOn, open };
+}
+async function readItemEvaluation(config, item, fetchImpl) {
+  try {
+    const { data } = await getJson(config.url, `/v1/work-items/${item}`, config.apiKey, config.appId, fetchImpl, await signerFor(config.configPath));
+    return { ok: true, evaluation: parseEvaluation(fields(data).evaluation) };
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+}
+function rowText(row) {
+  const name = row.label !== "" && row.sentence !== "" && row.label !== row.sentence ? `${row.label}: ${row.sentence}` : row.sentence || row.label;
+  return row.status === "pending" ? `${name} (no result)` : name;
+}
+function fit(prefix, parts) {
+  let text2 = prefix + parts.join("; ");
+  for (let kept = parts.length - 1; text2.length > REASON_MAX && kept > 0; kept--) {
+    text2 = `${prefix}${parts.slice(0, kept).join("; ")}; and ${parts.length - kept} more`;
+  }
+  return text2.length > REASON_MAX ? `${text2.slice(0, REASON_MAX - 1)}\u2026` : text2;
+}
+function decideFromEvaluation(read) {
+  if (!read.ok) return { outcome: "incomplete", reason: fit("the item's status could not be read: ", [read.reason]) };
+  const evaluation = read.evaluation;
+  if (evaluation === void 0) return { outcome: "ok" };
+  if (evaluation === null) return { outcome: "incomplete", reason: "the item has no evidence evaluation yet" };
+  if (evaluation.open.length > 0) return { outcome: "incomplete", reason: fit("checks not passing: ", evaluation.open.map(rowText)) };
+  if (evaluation.verdict === "pass") return { outcome: "ok" };
+  if (evaluation.verdict === "waiting" && evaluation.waitingOn === "review") return { outcome: "ok" };
+  if (evaluation.verdict === "waiting" && evaluation.waitingOn === "links") {
+    return { outcome: "incomplete", reason: "the item's evidence was still waiting on session links to be confirmed" };
+  }
+  if (evaluation.verdict === "waiting" && evaluation.waitingOn === "claim") {
+    return { outcome: "incomplete", reason: "the item's required checks had no result when the build ended" };
+  }
+  return { outcome: "incomplete", reason: fit("the item's verdict is not passing: ", [evaluation.sentence || evaluation.verdict]) };
+}
+function waitMs(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function settleVerdict(deps) {
+  const settleMs = deps.settleMs ?? VERDICT_SETTLE_MS;
+  const everyMs = deps.everyMs ?? VERDICT_READ_EVERY_MS;
+  const startedMs = deps.now().getTime();
+  for (; ; ) {
+    const decision = decideFromEvaluation(await deps.read());
+    if (decision.outcome === "ok") return decision;
+    if (deps.now().getTime() - startedMs + everyMs > settleMs) return decision;
+    await deps.sleep(everyMs);
+  }
+}
+
+// src/runner/job.ts
 var LEASE_SECONDS = 900;
 var RENEW_INTERVAL_SECONDS = 300;
 var IDLE_CPU_USEC_PER_MINUTE_FLOOR = 2e6;
@@ -753,14 +828,14 @@ function workdirProblem(workdir) {
 function readProvisionOut(jobDirPath) {
   const path = join(jobDirPath, "provision.out");
   if (!existsSync(path)) return { ok: false };
-  let text;
+  let text2;
   try {
-    text = readFileSync(path, "utf8");
+    text2 = readFileSync(path, "utf8");
   } catch {
     return { ok: false };
   }
   const kv = {};
-  for (const line of text.split("\n")) {
+  for (const line of text2.split("\n")) {
     const eq = line.indexOf("=");
     if (eq === -1) continue;
     kv[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
@@ -792,13 +867,13 @@ function commandWithExitCodeTrailer(cmdline) {
   ].join("\n");
 }
 function readExitCode(jobDirPath) {
-  let text;
+  let text2;
   try {
-    text = readFileSync(join(jobDirPath, EXIT_CODE_FILE), "utf8");
+    text2 = readFileSync(join(jobDirPath, EXIT_CODE_FILE), "utf8");
   } catch {
     return void 0;
   }
-  const trimmed = text.trim();
+  const trimmed = text2.trim();
   return /^\d+$/.test(trimmed) ? Number(trimmed) : void 0;
 }
 function outcomeFromExitCode(jobDirPath) {
@@ -807,8 +882,8 @@ function outcomeFromExitCode(jobDirPath) {
   return { outcome: code === 0 ? "ok" : "failed", code };
 }
 var REASON_FILE = "reason";
-var REASON_MAX = 200;
-function cutReasonLine(line, max = REASON_MAX) {
+var REASON_MAX2 = 200;
+function cutReasonLine(line, max = REASON_MAX2) {
   const cut = line.slice(0, max);
   const last = cut.charCodeAt(cut.length - 1);
   return last >= 55296 && last <= 56319 ? cut.slice(0, -1) : cut;
@@ -828,8 +903,8 @@ function releaseScrub(config, home) {
   const secrets = [...headerVariables(config.build?.destinations), ...CLAUDE_CREDENTIAL_VARIABLES].map((name) => process.env[name] ?? "");
   return { literals: [...scrubList(merged?.literals), ...secrets], patterns: scrubList(merged?.patterns) };
 }
-function stripUnsendableReasonChars(text) {
-  return text.replace(/\u0000/g, "").replace(/\p{Cs}/gu, "");
+function stripUnsendableReasonChars(text2) {
+  return text2.replace(/\u0000/g, "").replace(/\p{Cs}/gu, "");
 }
 function readReasonLine(jobDirPath, config, home = homeFromEnv()) {
   let raw;
@@ -937,8 +1012,8 @@ function isIdle(logMtimeMs, nowMs, idleLimitMinutes, cpuUsecPerMinuteOverWindow)
 }
 function readCpuUsec(cgroupPath) {
   try {
-    const text = readFileSync(join(cgroupPath, "cpu.stat"), "utf8");
-    const match = /^usage_usec (\d+)$/m.exec(text);
+    const text2 = readFileSync(join(cgroupPath, "cpu.stat"), "utf8");
+    const match = /^usage_usec (\d+)$/m.exec(text2);
     return match ? Number(match[1]) : null;
   } catch {
     return null;
@@ -965,23 +1040,37 @@ async function renewLease(config, item, fetchImpl) {
 }
 var ALREADY_RELEASED = "already released";
 async function releaseLease(config, item, outcome, detail, fetchImpl) {
-  const send = async (environment) => postJson(
+  const send = async (environment2, sent2) => postJson(
     config.url,
     `/v1/work-items/${item}/claim/release`,
     config.apiKey,
     config.appId,
-    { host: config.host, outcome, stage: detail.stage, exitCode: detail.exitCode, reason: detail.reason, environment },
+    { host: config.host, outcome: sent2, stage: detail.stage, exitCode: detail.exitCode, reason: detail.reason, environment: environment2 },
     fetchImpl,
     void 0,
     await signerFor(config.configPath)
   );
+  let environment = detail.environment;
+  let sent = outcome;
   let data;
-  try {
-    ({ data } = await send(detail.environment));
-  } catch (err) {
-    if (detail.environment?.commitIdentity === void 0 || !(err instanceof WorkCommandError) || err.status !== 400 || err.code !== "invalid_request_body") throw err;
-    const { commitIdentity: _omitted, ...withoutIdentity } = detail.environment;
-    ({ data } = await send(withoutIdentity));
+  for (; ; ) {
+    try {
+      ({ data } = await send(environment, sent));
+      break;
+    } catch (err) {
+      if (!(err instanceof WorkCommandError) || err.status !== 400 || err.code !== "invalid_request_body") throw err;
+      const namesOutcome = /\boutcome\b/.test(err.message);
+      if (sent === "incomplete" && namesOutcome) {
+        sent = "ok";
+      } else if (environment?.commitIdentity !== void 0) {
+        const { commitIdentity: _omitted, ...withoutIdentity } = environment;
+        environment = withoutIdentity;
+      } else if (sent === "incomplete") {
+        sent = "ok";
+      } else {
+        throw err;
+      }
+    }
   }
   return {
     releasedAt: typeof data.releasedAt === "string" ? data.releasedAt : void 0,
@@ -1198,6 +1287,19 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     job.cleanupRan = true;
     writeJobFile(jobFilePath, job);
   }
+  let verdictReason;
+  if (outcome === "ok") {
+    const decision = await settleVerdict({
+      read: () => readItemEvaluation(config, job.item, deps.fetchImpl),
+      now,
+      sleep: deps.sleep ?? waitMs
+    });
+    if (decision.outcome === "incomplete") {
+      outcome = "incomplete";
+      verdictReason = scrubReason(decision.reason, config);
+      log.error(`${tag} the command exited 0 but the item is not done: ${verdictReason}`);
+    }
+  }
   if (config.hooks.report) {
     setStage(job, jobDirPath, "report");
     log.line(`${tag} report started \xB7 phase end`);
@@ -1236,7 +1338,9 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   }
   if (outcome !== void 0) {
     const fromHook = readReasonLine(jobDirPath, config);
-    if (ending?.reason === void 0) {
+    if (verdictReason !== void 0) {
+      job.reason = verdictReason;
+    } else if (ending?.reason === void 0) {
       job.reason = (outcome === "ok" ? void 0 : held?.reason) ?? (isolated ? fromHook ?? job.reason : fromHook);
     }
     const cliVersion = deps.cliVersion ?? resolveVersion();

package/dist/{chunk-6Y63SXFO.js → chunk-WOBNRVQT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-G7FSV7JX.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-EX6M5JPR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, existsSync, unlinkSync, readdirSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-ZNA27WEV.js → chunk-Z62HNKEJ.js}

@@ -123,12 +123,12 @@ var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "7d3924e0c8761edafbf85cb2a94c268ffad249644a40fd02d4e15cde4c206f6e"
 };
 var GUEST_ASSETS_VERSION = "1";
-var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/outerlayer/releases/download/guest-${GUEST_ASSETS_VERSION}`;
+var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
-  x86_64: "0000000000000000000000000000000000000000000000000000000000000000"
+  x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
 };
 var GUEST_HELPER_SHA256 = {
-  x86_64: "0000000000000000000000000000000000000000000000000000000000000000"
+  x86_64: "4175e89ae8cb633113b5f69ef8b6e206093954411fe53edf86357bc1b7e822f9"
 };
 function guestAssetsPinned(arch) {
   const zero = "0".repeat(64);

package/dist/{chunk-NYC54VBD.js → chunk-ZLB7GCTY.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isLinkedRepository } from './chunk-3TT7RQYB.js';
+import { isLinkedRepository } from './chunk-D2KWEAN6.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-5DLBAXY5.js';
-import { sanitizeTerminal } from './chunk-6Y63SXFO.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-G7FSV7JX.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-RMAZ2NWA.js';
+import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-EX6M5JPR.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
 import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-WIOZAJ2W.js';
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-UFVL4PZY.js');
+    const { runnerHostChecks } = await import('./doctor-J3GIMR7K.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{chunk-HE2D4EY5.js → chunk-ZOC7JSYC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, resolveRepoIdentity, scrubDeep, downconvertSession, isHumanUserTurn, turnCountBound } from './chunk-G7FSV7JX.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, resolveRepoIdentity, scrubDeep, downconvertSession, isHumanUserTurn, turnCountBound } from './chunk-EX6M5JPR.js';
 import { execFileSync } from 'child_process';
 import { hostname, userInfo } from 'os';