@outerlayer/cli 0.5.1 → 0.6.0

package/dist/{chunk-UFFXNXLQ.js → chunk-FA2BOX4O.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, statSync, appendFileSync, openSync, opendirSync, unlinkSync } from 'fs';
+import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, statSync, appendFileSync, opendirSync, unlinkSync } from 'fs';
 import { spawn, execFileSync } from 'child_process';
 import { createHash } from 'crypto';
 import { join, dirname, resolve } from 'path';
@@ -347,18 +347,11 @@ var readStdin = () => {
   }
 };
 var AUTO_SYNC_DEBOUNCE_MS = 5 * 60 * 1e3;
-function appendFd(path) {
-  if (path === void 0) return "ignore";
-  try {
-    return openSync(path, "a");
-  } catch {
-    return "ignore";
-  }
-}
-var spawnDetached = (command, args, stderrPath, cwd) => {
+var LOG_FAILURES_FLAG = "--log-failures";
+var spawnDetached = (command, args, cwd) => {
   const child = spawn(command, args, {
     detached: true,
-    stdio: ["ignore", "ignore", appendFd(stderrPath)],
+    stdio: ["ignore", "ignore", "ignore"],
     ...cwd !== void 0 ? { cwd } : {}
   });
   child.on("error", () => {
@@ -382,7 +375,7 @@ function maybeAutoSync(event, home = homeFromEnv(), spawnImpl = spawnDetached, n
       if (!config.appId) return;
     } else if (!config.accountToken || readRepoConnection(cwd) === void 0) return;
     writeFileSync(marker, String(now));
-    spawnImpl(process.execPath, [process.argv[1], "sync", "--quiet"], void 0, cwd);
+    spawnImpl(process.execPath, [process.argv[1], "sync", "--quiet"], cwd);
   } catch {
   }
 }
@@ -395,13 +388,13 @@ function hookErrorsContext(home, writtenBytes, seenBytes) {
 }
 async function handleWorkLaunch(sessionId, home, env, spawnImpl = spawnDetached, cwd = process.cwd()) {
   if (!sessionId || env.OUTERLAYER_WORK === void 0) return void 0;
-  const { parseWorkItemEnv, appendLaunchRecord } = await import('./work-launch-YI4CJDAP.js');
+  const { parseWorkItemEnv, appendLaunchRecord } = await import('./work-launch-R5HTAP6X.js');
   const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
   if ("reason" in parsed) {
     logHookError(home, new Error(`OUTERLAYER_WORK ignored: ${parsed.reason}`));
     return `OuterLayer ignored this session's OUTERLAYER_WORK value: ${sanitizeForContext(parsed.reason)}. The session is not attached to a work item and will not upload. Hook failures are logged to ${join(spoolDir(home), "hook-errors.log")}.`;
   }
-  appendLaunchRecord({ sessionId, item: parsed.number }, home);
+  appendLaunchRecord({ sessionId, item: parsed.number, ...env.OUTERLAYER_JOB_DIR === void 0 ? {} : { job: env.OUTERLAYER_JOB_DIR } }, home);
   const args = [
     process.argv[1],
     "work",
@@ -417,17 +410,16 @@ async function handleWorkLaunch(sessionId, home, env, spawnImpl = spawnDetached,
     // hook has already returned) and cannot double-link, because the
     // link is keyed by the session id passed above.
     "--retry",
-    String(WORK_LINK_RETRIES)
+    String(WORK_LINK_RETRIES),
+    LOG_FAILURES_FLAG
   ];
   if (env.OUTERLAYER_JOB_DIR !== void 0) args.push("--no-lease");
   spawnImpl(
     process.execPath,
     args,
-    // The link runs after this hook has exited, so its own failure
-    // (offline, revoked key, unknown item number) has nowhere else to be
-    // seen: without this the session uploads later with no Work link and
-    // no trace of why.
-    join(spoolDir(home), "hook-errors.log"),
+    // The link appends its own failure line to hook-errors.log (see
+    // `--log-failures`), so a Node warning on a link that worked never
+    // reaches the log.
     cwd
   );
   return void 0;
@@ -456,30 +448,28 @@ async function maybeRenewWorkLease(event, sessionId, home = homeFromEnv(), env =
       if (now - statSync(marker).mtimeMs < WORK_LEASE_RENEW_DEBOUNCE_MS) return;
     } catch {
     }
-    const { parseWorkItemEnv } = await import('./work-launch-YI4CJDAP.js');
+    const { parseWorkItemEnv } = await import('./work-launch-R5HTAP6X.js');
     const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
     if ("reason" in parsed) return;
     writeFileSync(marker, String(now));
     spawnImpl(
       process.execPath,
-      [process.argv[1], "work", "link-session", String(parsed.number), "--session-id", sessionId],
-      join(spoolDir(home), "hook-errors.log"),
+      [process.argv[1], "work", "link-session", String(parsed.number), "--session-id", sessionId, LOG_FAILURES_FLAG],
       cwd
     );
   } catch {
   }
 }
-async function handleWorkSessionEnd(event, sessionId, home = homeFromEnv(), env = process.env, spawnImpl = spawnDetached, cwd = process.cwd()) {
+async function handleWorkSessionEnd(event, sessionId, _home = homeFromEnv(), env = process.env, spawnImpl = spawnDetached, cwd = process.cwd()) {
   try {
     if (event !== "SessionEnd") return;
     if (!sessionId || env.OUTERLAYER_WORK === void 0) return;
-    const { parseWorkItemEnv } = await import('./work-launch-YI4CJDAP.js');
+    const { parseWorkItemEnv } = await import('./work-launch-R5HTAP6X.js');
     const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
     if ("reason" in parsed) return;
     spawnImpl(
       process.execPath,
-      [process.argv[1], "work", "link-session", String(parsed.number), "--session-id", sessionId, "--ended"],
-      join(spoolDir(home), "hook-errors.log"),
+      [process.argv[1], "work", "link-session", String(parsed.number), "--session-id", sessionId, "--ended", LOG_FAILURES_FLAG],
       cwd
     );
   } catch {
@@ -638,7 +628,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-G2FUFC72.js');
+          const { materializeContext: materialize } = await import('./context-materialize-3HLPZAF6.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;
@@ -677,7 +667,9 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
     logHookError(home, err);
   }
 }
+var hookErrorsLogged = 0;
 function logHookError(home, err) {
+  hookErrorsLogged++;
   try {
     const dir = spoolDir(home);
     mkdirSync(dir, { recursive: true });
@@ -690,5 +682,15 @@ function logHookError(home, err) {
   } catch {
   }
 }
+function recordLinkExitFailure(argv, home = homeFromEnv(), target = process) {
+  const at = argv.indexOf("link-session");
+  if (at < 0 || !argv.includes(LOG_FAILURES_FLAG)) return;
+  const number = argv[at + 1] ?? "?";
+  target.once("exit", (code) => {
+    if (code !== 0 && hookErrorsLogged === 0) {
+      logHookError(home, new Error(`work link-session #${number} exited with code ${code} before it reported a failure`));
+    }
+  });
+}
 
-export { AUTO_SYNC_DEBOUNCE_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };
+export { AUTO_SYNC_DEBOUNCE_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, logHookError, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, recordLinkExitFailure, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };

package/dist/chunk-FBTE2A2X.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/vm/service.ts
+var VM_SERVICE_NAME = "outerlayer-runner";
+var UNIT_MARKER = "# Written by outerlayer runner install --service; edit the runner config, not this file.";
+var STOP_MARGIN_MINUTES = 10;
+function escapeUnitPath(path) {
+  return path.replace(/%/g, "%%").replace(/ /g, "\\x20");
+}
+function runnerUnit(unit) {
+  return `${UNIT_MARKER}
+[Unit]
+Description=OuterLayer runner
+After=network-online.target${unit.docker ? " docker.service" : ""}
+Wants=network-online.target
+${unit.docker ? "Requires=docker.service\n" : ""}
+[Service]
+User=${unit.user}
+ExecStart=${unit.execStart}
+EnvironmentFile=-${escapeUnitPath(`${unit.configDir}/runner.env`)}
+Restart=on-failure
+RestartForceExitStatus=75
+RestartSec=30
+KillSignal=SIGTERM
+KillMode=mixed
+TimeoutStopSec=${unit.timeLimitMinutes + STOP_MARGIN_MINUTES}min
+OOMPolicy=continue
+Delegate=yes
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+export { UNIT_MARKER, VM_SERVICE_NAME, runnerUnit };

package/dist/{chunk-DVDEBNQJ.js → chunk-GQD22KKN.js}

@@ -27,7 +27,12 @@ function launchesPath(home) {
 }
 function appendLaunchRecord(input, home) {
   mkdirSync(join(home, ".outerlayer", "spool"), { recursive: true });
-  const record = { sessionId: input.sessionId, item: input.item, t: input.t ?? (/* @__PURE__ */ new Date()).toISOString() };
+  const record = {
+    sessionId: input.sessionId,
+    item: input.item,
+    ...input.job === void 0 ? {} : { job: input.job },
+    t: input.t ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
   appendFileSync(launchesPath(home), `${JSON.stringify(record)}
 `);
 }
@@ -75,22 +80,28 @@ function launchedItemsBySession(home, readImpl = readLaunchSpool) {
 }
 function readLaunchSpoolState(home, readImpl = readLaunchSpool) {
   const ids = /* @__PURE__ */ new Set();
+  const records = /* @__PURE__ */ new Map();
   const read = readImpl(launchesPath(home));
-  if (read.kind === "unreadable") return { ids, unreadable: read.reason };
-  if (read.kind === "absent") return { ids };
+  if (read.kind === "unreadable") return { ids, records, unreadable: read.reason };
+  if (read.kind === "absent") return { ids, records };
   let malformedLines = 0;
   for (const line of read.text.split("\n")) {
     const text = line.trim();
     if (!text) continue;
     try {
       const record = JSON.parse(text);
-      if (typeof record.sessionId === "string" && record.sessionId !== "") ids.add(record.sessionId);
-      else malformedLines += 1;
+      if (typeof record.sessionId === "string" && record.sessionId !== "") {
+        ids.add(record.sessionId);
+        records.set(record.sessionId, {
+          ...typeof record.item === "number" ? { item: record.item } : {},
+          ...typeof record.job === "string" ? { job: record.job } : {}
+        });
+      } else malformedLines += 1;
     } catch {
       malformedLines += 1;
     }
   }
-  return { ids, ...malformedLines > 0 ? { malformedLines } : {} };
+  return { ids, records, ...malformedLines > 0 ? { malformedLines } : {} };
 }
 
 export { appendLaunchRecord, launchStatusIsDecisive, launchedItemForSession, launchedItemsBySession, launchesPath, parseWorkItemEnv, readLaunchSpoolState };

package/dist/{chunk-BCJNHMZT.js → chunk-HHJDN6AU.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readLaunchSpoolState, launchesPath } from './chunk-DVDEBNQJ.js';
+import { readLaunchSpoolState, launchesPath } from './chunk-GQD22KKN.js';
 
 createRequire(import.meta.url);
 
@@ -17,18 +17,33 @@ function launchRefusalForSession(sessionId, home) {
   return `this session was not launched with OUTERLAYER_WORK naming a work item, so nothing it produces may leave the machine. Start the session with OUTERLAYER_WORK set (for example OUTERLAYER_WORK=42), or run this from CI.`;
 }
 var LaunchFilter = class {
-  constructor(launchedSessionIds) {
+  /**
+   * `records`, when given, scopes a live sender:
+   * - a build sender (`build`) admits only a session launched for its item in its own job; a record with no job
+   *   is one an older hook wrote, which is admitted on the item alone;
+   * - any other live sender skips a session launched inside a runner job, which only that job's sender sends.
+   * `sync` passes no records and decides by the launch record's existence alone.
+   */
+  constructor(launchedSessionIds, records, build) {
     this.launchedSessionIds = launchedSessionIds;
+    this.records = records;
+    this.build = build;
     /** Sessions dropped for carrying no launch record — for the sync summary. */
     this.skippedTotal = 0;
   }
   /** True when the session should sync. Records skips for reporting. */
   allows(session) {
     const key = session.subagent?.parentSessionId ?? session.id;
-    const allowed = typeof key === "string" && this.launchedSessionIds.has(key);
+    const allowed = typeof key === "string" && this.launchedSessionIds.has(key) && this.inScope(this.records?.get(key));
     if (!allowed) this.skippedTotal += 1;
     return allowed;
   }
+  inScope(facts) {
+    if (this.build !== void 0) {
+      return facts !== void 0 && facts.item === this.build.item && (facts.job === void 0 || facts.job === this.build.jobDir);
+    }
+    return facts?.job === void 0;
+  }
 };
 
 export { LaunchFilter, launchRefusalForSession };

package/dist/{chunk-JLDZTG3A.js → chunk-IASWYRVG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { resolveRepoIdentity } from './chunk-EX6M5JPR.js';
+import { resolveRepoIdentity } from './chunk-ANK2B36Y.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-BOLTI6LR.js';

package/dist/{install-cmd-7WXOIFDO.js → chunk-JWOQNNN2.js}

@@ -2,7 +2,6 @@
 import { createRequire } from 'node:module';
 import { isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-YYYXRJUW.js';
 import { RUNNER_DIR_MODE } from './chunk-ZM2IMMYN.js';
-import './chunk-Z5GEFMRW.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-H4CK2YK4.js → chunk-MIGEDH5P.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isLinkedRepository } from './chunk-D2KWEAN6.js';
+import { isLinkedRepository } from './chunk-7DBI6SNT.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-RMAZ2NWA.js';
-import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-EX6M5JPR.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-BNMCXPG7.js';
+import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-ANK2B36Y.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
 import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-WIOZAJ2W.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-UFFXNXLQ.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-FA2BOX4O.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1012,11 +1012,11 @@ async function gatherDoctorChecks() {
   if (credential[0]?.status === "pass") checks.push(...await githubAppChecks());
   const runnerVm = runnerVmOf(configPath);
   if (runnerVm !== void 0) {
-    const { realLima } = await import('./lima-XN65D7GN.js');
+    const { realLima } = await import('./lima-7NPCNGWT.js');
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-MOA3RIEP.js');
+    const { runnerHostChecks } = await import('./doctor-VOMYOHQU.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1047,7 +1047,15 @@ async function gatherDoctorChecks() {
         return void 0;
       }
     })();
-    checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner }));
+    const service = await (async () => {
+      const { existsSync: existsSync2 } = await import('fs');
+      if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
+      const { inspectService, realInspectProbes } = await import('./inspect-XAUSB7L3.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-DSUZE2TJ.js');
+      const { dirname: dirname2 } = await import('path');
+      return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
+    })();
+    checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));
   }
   return checks;
 }

package/dist/{chunk-CHLVJNTE.js → chunk-MXB5VB4Y.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-W7UTFZDH.js';
-import { describeCallFailure } from './chunk-T52PKE2Y.js';
-import { WorkCommandError, getJson } from './chunk-RMAZ2NWA.js';
-import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
+import { isPlaceholderCommand } from './chunk-4NLKY4WR.js';
+import { describeCallFailure } from './chunk-RZSF5B46.js';
+import { WorkCommandError, getJson } from './chunk-BNMCXPG7.js';
+import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
 import { builtinKind } from './chunk-3DD6AOWC.js';
-import { claudeCredential, CLAUDE_CREDENTIAL_VARIABLES } from './chunk-AUFG23AA.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-AUFG23AA.js';
 import { signerFor } from './chunk-M5POMKKW.js';
 
 createRequire(import.meta.url);
@@ -27,6 +27,18 @@ function needsClaudeCredential(hooks) {
 var CREDENTIAL_FIX = "Run `claude setup-token`, then start the runner with CLAUDE_CODE_OAUTH_TOKEN set to the token it prints (or ANTHROPIC_API_KEY set to an API key), for example with EnvironmentFile= in the runner's systemd unit";
 function claudeCredentialCheck(env, options = {}) {
   const name = "Claude credential";
+  if (options.service !== void 0) {
+    const { unit, variables } = options.service;
+    if (variables.length === 0) {
+      return {
+        name,
+        status: "fail",
+        detail: `the service ${unit} has no Claude credential: neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set in its runner.env, so every build fails at provision as agent_credential_missing`,
+        fix: `${CREDENTIAL_FIX}, then restart the service: sudo systemctl restart ${unit}.`
+      };
+    }
+    return { name, status: "pass", detail: `${variables[0]} is set in the runner.env of the service ${unit}` };
+  }
   const held = claudeCredential(env);
   if (held === void 0) {
     return {

package/dist/chunk-NQXFAGHU.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { runnerUnit, UNIT_MARKER } from './chunk-FBTE2A2X.js';
+import { checkFit } from './chunk-OUUINEYB.js';
+import { builtinKind } from './chunk-3DD6AOWC.js';
+import { runnerDir } from './chunk-ZM2IMMYN.js';
+import { dirname } from 'path';
+import { spawnSync } from 'child_process';
+
+createRequire(import.meta.url);
+function withSystemd(conf) {
+  const lines = (conf ?? "").split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  const boot = lines.findIndex((line) => line.trim() === "[boot]");
+  if (boot === -1) {
+    return { text: `${lines.length === 0 ? "" : `${lines.join("\n")}
+
+`}[boot]
+systemd=true
+`, changed: true };
+  }
+  let end = lines.findIndex((line, at) => at > boot && /^\s*\[/.test(line));
+  if (end === -1) end = lines.length;
+  const key = lines.findIndex((line, at) => at > boot && at < end && /^\s*systemd\s*=/.test(line));
+  if (key !== -1) {
+    if (/^\s*systemd\s*=\s*true\s*$/i.test(lines[key])) return { text: `${lines.join("\n")}
+`, changed: false };
+    lines[key] = "systemd=true";
+  } else {
+    lines.splice(boot + 1, 0, "systemd=true");
+  }
+  return { text: `${lines.join("\n")}
+`, changed: true };
+}
+function taskNameFor(unitName) {
+  return unitName;
+}
+function taskCommand(distro) {
+  return `wsl.exe -d ${distro} --exec sleep infinity`;
+}
+function realTaskScheduler(run = defaultRun) {
+  const message = (result) => (result.stderr.trim() || result.stdout.trim()).slice(0, 300);
+  return {
+    available: () => run(["/?"]).status === 0,
+    create: (name, command) => {
+      const result = run(["/Create", "/F", "/TN", name, "/SC", "ONLOGON", "/TR", command]);
+      return result.status === 0 ? { ok: true } : { ok: false, message: message(result) };
+    },
+    exists: (name) => run(["/Query", "/TN", name]).status === 0,
+    remove: (name) => {
+      const result = run(["/Delete", "/F", "/TN", name]);
+      return result.status === 0 ? { ok: true } : { ok: false, message: message(result) };
+    }
+  };
+}
+function defaultRun(args) {
+  const result = spawnSync("schtasks.exe", args, { encoding: "utf8", timeout: 3e4 });
+  return { status: result.error === void 0 ? result.status : null, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+}
+
+// src/runner/service/install.ts
+var DEFAULT_UNIT_NAME = "outerlayer-runner";
+function unitPathFor(unitName = DEFAULT_UNIT_NAME) {
+  return `/etc/systemd/system/${unitName}.service`;
+}
+var outcome = (ok, state, lines, unit) => ({ ok, state, lines, ...unit === void 0 ? {} : { unit } });
+function asRoot(deps, lines, say, argv) {
+  say(`sudo systemctl ${argv.join(" ")}`);
+  const result = deps.systemd.systemctl(argv, { sudo: true });
+  if (result.status !== 0) lines.push(`sudo systemctl ${argv.join(" ")} failed with exit status ${result.status}`);
+  return result.status === 0;
+}
+function attempt(lines, step) {
+  try {
+    step();
+    return true;
+  } catch (err) {
+    lines.push(err instanceof Error ? err.message : String(err));
+    return false;
+  }
+}
+var OWN_HOOKS = "the hooks are the host's own executables, so the runner does not write a service for them: run `outerlayer runner install --service --print` to print the unit, and edit it for your hooks";
+function installService(request, deps) {
+  const unitName = request.unitName ?? DEFAULT_UNIT_NAME;
+  const unitPath = unitPathFor(unitName);
+  const lines = [];
+  const say = deps.say ?? ((line) => void lines.push(line));
+  const kind = builtinKind(request.hooks.provision);
+  const own = kind === "own" || builtinKind(request.hooks.cleanup) === "own";
+  const unit = runnerUnit({
+    user: request.user,
+    configDir: dirname(request.configPath),
+    execStart: request.execStart,
+    timeLimitMinutes: request.timeLimitMinutes,
+    docker: kind === "container" || kind === "vm" || builtinKind(request.hooks.cleanup) === "container" || builtinKind(request.hooks.cleanup) === "vm"
+  });
+  if (request.print === true) return outcome(true, "printed", [], unit);
+  if (own) return outcome(false, "refused", [OWN_HOOKS]);
+  if (deps.platform === "darwin" || deps.platform === "windows") {
+    return outcome(false, "refused", [
+      deps.platform === "darwin" ? "the runner on a Mac lives in a Linux VM, and its service is set up there: run `outerlayer runner init --vm`" : "the runner on Windows lives in WSL2: run this from a WSL2 shell"
+    ]);
+  }
+  if (!deps.systemd.running()) {
+    if (deps.platform === "wsl2" && deps.wslConf !== void 0) {
+      const merged = withSystemd(deps.wslConf.read());
+      if (merged.changed) {
+        say("sudo tee /etc/wsl.conf");
+        const wslConf = deps.wslConf;
+        if (!attempt(lines, () => wslConf.write(merged.text))) return outcome(false, "refused", lines);
+      }
+      lines.push(
+        "systemd is not running in this WSL2 distribution. `systemd=true` is " + (merged.changed ? "now" : "already") + " in /etc/wsl.conf; run `wsl --shutdown` once from Windows, then run this again. No service or scheduled task is set up until then"
+      );
+      return outcome(true, "needs-wsl-shutdown", lines);
+    }
+    return outcome(false, "refused", ["systemd was not found (/run/systemd/system is missing), so no service is set up. `--print` prints the unit for another service manager"]);
+  }
+  if (kind === "container" || kind === "vm") {
+    const fit = checkFit({ concurrency: request.concurrency, buildMemory: request.buildMemory, usableBytes: deps.usableMemoryBytes });
+    if (!fit.fits) return outcome(false, "refused", [`${fit.message}. Nothing is set up: lower runner.concurrency or runner.build.memory, then run this again`]);
+  }
+  const existing = deps.systemd.read(unitPath);
+  const write = () => {
+    say(`sudo tee ${unitPath}`);
+    return attempt(lines, () => deps.systemd.write(unitPath, unit));
+  };
+  const running = () => deps.systemd.systemctl(["is-enabled", unitName]).status === 0 && deps.systemd.systemctl(["is-active", unitName]).status === 0;
+  const ensureTask = () => {
+    if (deps.platform === "wsl2") lines.push(...ensureLoginTask(deps, unitName));
+  };
+  if (existing === unit) {
+    if (!running() && !asRoot(deps, lines, say, ["enable", "--now", unitName])) return outcome(false, "refused", lines);
+    lines.push(`the service ${unitName} is current: the unit already matches the config, so nothing was changed`);
+    ensureTask();
+    return outcome(true, "current", lines);
+  }
+  if (existing === void 0) {
+    if (!write()) return outcome(false, "refused", lines);
+    if (!asRoot(deps, lines, say, ["daemon-reload"]) || !asRoot(deps, lines, say, ["enable", "--now", unitName])) {
+      say(`sudo rm ${unitPath}`);
+      if (attempt(lines, () => deps.systemd.remove(unitPath))) deps.systemd.systemctl(["daemon-reload"], { sudo: true });
+      return outcome(false, "refused", lines);
+    }
+    lines.push(`installed and started the service ${unitName}: the runner starts at boot and after a crash`);
+    ensureTask();
+    return outcome(true, "installed", lines);
+  }
+  if (!existing.startsWith(UNIT_MARKER) && request.replace !== true) {
+    lines.push(`${unitPath} differs from what this command writes, and it was not written by it, so it was left alone. Pass --replace to replace it, or \`--print\` to compare`);
+    return outcome(false, "differs", lines);
+  }
+  if (!write()) return outcome(false, "refused", lines);
+  if (!asRoot(deps, lines, say, ["daemon-reload"])) return outcome(false, "refused", lines);
+  if ((!existing.startsWith(UNIT_MARKER) || !running()) && !asRoot(deps, lines, say, ["enable", "--now", unitName])) return outcome(false, "refused", lines);
+  ensureTask();
+  if (deps.buildsRunning(runnerDir(request.configPath))) {
+    lines.push(`rewrote ${unitPath}; a build is running, so the service was not restarted and the new unit applies at the next restart`);
+    return outcome(true, "pending-restart", lines);
+  }
+  if (!asRoot(deps, lines, say, ["restart", unitName])) return outcome(false, "refused", lines);
+  lines.push(`rewrote ${unitPath} and restarted the service ${unitName}`);
+  return outcome(true, "updated", lines);
+}
+function ensureLoginTask(deps, unitName) {
+  const tasks = deps.tasks;
+  const name = taskNameFor(unitName);
+  const command = taskCommand(deps.distro ?? "Ubuntu");
+  const manual = `from Windows, run: schtasks /Create /F /TN ${name} /SC ONLOGON /TR "${command}"`;
+  if (tasks === void 0 || !tasks.available()) {
+    return [`Windows interop is off, so the scheduled task that starts WSL2 at login was not made: ${manual}`];
+  }
+  if (tasks.exists(name)) return [`the scheduled task ${name} already starts WSL2 at login`];
+  const created = tasks.create(name, command);
+  return created.ok ? [`made the scheduled task ${name}: it starts WSL2 at login and keeps it running, so the service runs from login`] : [`the scheduled task ${name} was not made (${created.message ?? "schtasks.exe failed"}): ${manual}`];
+}
+function uninstallService(request, deps) {
+  const unitName = request.unitName ?? DEFAULT_UNIT_NAME;
+  const unitPath = unitPathFor(unitName);
+  const lines = [];
+  const say = deps.say ?? ((line) => void lines.push(line));
+  const taskName = taskNameFor(unitName);
+  const removeTask = () => {
+    if (deps.platform !== "wsl2" || deps.tasks === void 0 || !deps.tasks.available() || !deps.tasks.exists(taskName)) return;
+    const removed = deps.tasks.remove(taskName);
+    lines.push(removed.ok ? `removed the scheduled task ${taskName}` : `the scheduled task ${taskName} was not removed (${removed.message ?? "schtasks.exe failed"}): from Windows, run: schtasks /Delete /F /TN ${taskName}`);
+  };
+  const existing = deps.systemd.running() ? deps.systemd.read(unitPath) : void 0;
+  if (existing === void 0) {
+    removeTask();
+    lines.push(`no service ${unitName} is installed, so there is nothing to remove`);
+    return outcome(true, "absent", lines);
+  }
+  if (!existing.startsWith(UNIT_MARKER)) {
+    lines.push(`${unitPath} was not written by \`runner install --service\`, so it was left alone`);
+    return outcome(false, "differs", lines);
+  }
+  if (!asRoot(deps, lines, say, ["disable", "--now", unitName])) return outcome(false, "refused", lines);
+  say(`sudo rm ${unitPath}`);
+  if (!attempt(lines, () => deps.systemd.remove(unitPath))) return outcome(false, "refused", lines);
+  if (deps.systemd.read(unitPath) !== void 0) {
+    lines.push(`${unitPath} is still there after the remove, so the service ${unitName} was not removed`);
+    return outcome(false, "refused", lines);
+  }
+  if (!asRoot(deps, lines, say, ["daemon-reload"])) return outcome(false, "refused", lines);
+  removeTask();
+  lines.push(`removed the service ${unitName}`);
+  return outcome(true, "removed", lines);
+}
+
+export { DEFAULT_UNIT_NAME, installService, realTaskScheduler, uninstallService, unitPathFor };

package/dist/chunk-OUUINEYB.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { parseSize } from './chunk-F6GFZXZ3.js';
+
+createRequire(import.meta.url);
+
+// src/runner/service/fit.ts
+var GIB = 1024 ** 3;
+var RUNNER_RESERVE_BYTES = 2 * GIB;
+function gib(bytes) {
+  return `${Number((bytes / GIB).toFixed(1))} GiB`;
+}
+function checkFit(input) {
+  const perBuild = parseSize(input.buildMemory);
+  if (perBuild === void 0) return { fits: true };
+  const neededBytes = input.concurrency * perBuild;
+  const availableBytes = Math.max(0, input.usableBytes - RUNNER_RESERVE_BYTES);
+  if (neededBytes <= availableBytes) return { fits: true };
+  return {
+    fits: false,
+    neededBytes,
+    availableBytes,
+    message: `runner.concurrency ${input.concurrency} times runner.build.memory ${input.buildMemory} needs ${gib(neededBytes)}, and ${gib(availableBytes)} is available (${gib(input.usableBytes)} of memory less ${gib(RUNNER_RESERVE_BYTES)} for the runner and the system)`
+  };
+}
+
+export { RUNNER_RESERVE_BYTES, checkFit };

package/dist/{chunk-OR6AEEDO.js → chunk-PMAMOSTP.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { dashboardBase, isRepositoryLinked, workPageUrl, notLinkedText } from './chunk-D2KWEAN6.js';
-import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
-import { remoteLookupFailed } from './chunk-EX6M5JPR.js';
+import { dashboardBase, isRepositoryLinked, workPageUrl, notLinkedText } from './chunk-7DBI6SNT.js';
+import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
+import { remoteLookupFailed } from './chunk-ANK2B36Y.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { findGitDirs, readRepoConnection, writeRepoConnection } from './chunk-BJ3KTMDH.js';
 import { createInterface } from 'readline/promises';

package/dist/{chunk-RTXKYLCA.js → chunk-RBOMWNOG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-T52PKE2Y.js';
+import { MIN_ENGINE_MAJOR } from './chunk-RZSF5B46.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-Z62HNKEJ.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';