@outerlayer/cli 0.5.1 → 0.6.0

package/dist/{chunk-T52PKE2Y.js → chunk-RZSF5B46.js}

@@ -7,23 +7,23 @@ import { createDockerHost, childEnvironment, spawnRun } from './chunk-774HEQL6.j
 import { RecipeError } from './chunk-QOZKPLVJ.js';
 import { execCapture } from './chunk-W4SQCOZU.js';
 import { GUEST_CID } from './chunk-B2G7JHHB.js';
-import { WorkCommandError, postJson } from './chunk-RMAZ2NWA.js';
+import { WorkCommandError, postJson } from './chunk-BNMCXPG7.js';
 import { parseDuKilobytes, hostAllowed } from './chunk-F6GFZXZ3.js';
 import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, AGENT_CREDENTIAL_MISSING, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT } from './chunk-AUFG23AA.js';
-import { defaultGitRunner, materializeContext } from './chunk-XDDW4FRS.js';
+import { defaultGitRunner, materializeContext } from './chunk-OIRNH6UO.js';
 import { readContextManifest, readSourceCache } from './chunk-WIOZAJ2W.js';
 import { signingFetchFor } from './chunk-BCLJSQCV.js';
 import { signerFor } from './chunk-M5POMKKW.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, runnerDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, resolve, basename } from 'path';
+import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, realpathSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { spawnSync, spawn } from 'child_process';
 import { createHash, randomBytes } from 'crypto';
-import { existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, realpathSync, renameSync, lstatSync, readFileSync, unlinkSync, readdirSync, openSync, closeSync, mkdtempSync, createWriteStream, statSync, createReadStream } from 'fs';
 import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
 import { Transform } from 'stream';
 import { pipeline, finished } from 'stream/promises';
-import { createGunzip, gunzipSync, constants } from 'zlib';
+import { createGunzip, gunzipSync, constants as constants$1 } from 'zlib';
 import { isIP, connect, createServer as createServer$1 } from 'net';
 import { lookup } from 'dns/promises';
 import { networkInterfaces } from 'os';
@@ -255,6 +255,111 @@ var BuildTokens = class {
     );
   }
 };
+var BUILD_PREFIX = "build-";
+var LEAF = "runner";
+function serviceDirectory(selfCgroup, mount) {
+  const line = selfCgroup?.split("\n").find((l) => l.startsWith("0::"));
+  if (line === void 0) return void 0;
+  const path = line.slice(3).trim();
+  if (!path.endsWith(".service")) return void 0;
+  return join(mount, path);
+}
+function prepareRunnerCgroup(setup) {
+  if (setup.invocationId === void 0 || setup.invocationId === "") return void 0;
+  const root = serviceDirectory(setup.selfCgroup, setup.mount);
+  if (root === void 0) return void 0;
+  const { fs } = setup;
+  if (!fs.exists(root) || !fs.writable(join(root, "cgroup.procs"))) return void 0;
+  if (!(fs.read(join(root, "cgroup.controllers")) ?? "").split(/\s+/).includes("memory")) return void 0;
+  for (const name of fs.list(root)) {
+    if (!name.startsWith(BUILD_PREFIX)) continue;
+    try {
+      fs.rmdir(join(root, name));
+    } catch {
+    }
+  }
+  if (!fs.exists(join(root, LEAF))) fs.mkdir(join(root, LEAF));
+  fs.write(join(root, LEAF, "cgroup.procs"), String(setup.pid));
+  fs.write(join(root, "cgroup.subtree_control"), "+memory");
+  return { root };
+}
+function createBuildCgroup(fs, root, buildId, buildMemoryBytes) {
+  const path = join(root, `${BUILD_PREFIX}${buildId}`);
+  const firecrackerOverheadBytes = 256 * 1024 ** 2;
+  fs.mkdir(path);
+  try {
+    fs.write(join(path, "memory.max"), String(buildMemoryBytes + firecrackerOverheadBytes));
+    fs.write(join(path, "memory.swap.max"), "0");
+  } catch (err) {
+    removeBuildCgroup(fs, path);
+    throw err;
+  }
+  return path;
+}
+function oomKills(fs, path) {
+  const match = /^oom_kill (\d+)$/m.exec(fs.read(join(path, "memory.events")) ?? "");
+  return match === null ? 0 : Number(match[1]);
+}
+function removeBuildCgroup(fs, path) {
+  try {
+    fs.rmdir(path);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+function realCgroupFs() {
+  return {
+    exists: (path) => existsSync(path),
+    read: (path) => {
+      try {
+        return readFileSync(path, "utf8");
+      } catch {
+        return void 0;
+      }
+    },
+    write: (path, data) => writeFileSync(path, data),
+    mkdir: (path) => mkdirSync(path),
+    rmdir: (path) => rmdirSync(path),
+    list: (path) => readdirSync(path).filter((name) => statSync(join(path, name)).isDirectory()),
+    writable: (path) => {
+      try {
+        accessSync(path, constants.W_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+var delegatedRoot;
+function setUpRunnerCgroup(over = {}) {
+  let selfCgroup;
+  try {
+    selfCgroup = readFileSync("/proc/self/cgroup", "utf8");
+  } catch {
+    selfCgroup = void 0;
+  }
+  let refusal;
+  try {
+    const prepared = prepareRunnerCgroup({ fs: realCgroupFs(), selfCgroup, pid: process.pid, invocationId: process.env.INVOCATION_ID, mount: "/sys/fs/cgroup", ...over });
+    delegatedRoot = prepared?.root;
+  } catch (err) {
+    delegatedRoot = void 0;
+    refusal = err instanceof Error ? err.message : String(err);
+  }
+  return { delegated: delegatedRoot !== void 0, ...refusal === void 0 ? {} : { refusal } };
+}
+function realCgroupPort() {
+  const fs = realCgroupFs();
+  return {
+    create: (buildId, bytes) => {
+      if (delegatedRoot === void 0) return void 0;
+      return createBuildCgroup(fs, delegatedRoot, buildId, bytes);
+    },
+    oomKills: (path) => oomKills(fs, path),
+    remove: (path) => removeBuildCgroup(fs, path)
+  };
+}
 var BranchPrepareError = class extends Error {
 };
 var OWN_PREFIX = "outerlayer/";
@@ -747,7 +852,9 @@ function machineConfig(limits2, paths) {
   };
 }
 function firecrackerCommand(input) {
-  return { command: input.binary, args: ["--no-api", "--config-file", input.configPath] };
+  const args = ["--no-api", "--config-file", input.configPath];
+  if (input.cgroup === void 0) return { command: input.binary, args };
+  return { command: "sh", args: ["-c", 'echo $$ > "$1/cgroup.procs" && shift && exec "$@"', "sh", input.cgroup, input.binary, ...args] };
 }
 var STOP_WAIT_MS = 1e4;
 var POLL_MS = 20;
@@ -804,6 +911,7 @@ function createMicroVmPorts(over = {}) {
     assets: over.assets ?? ((runnerDir2) => ensureAssets({ runnerDir: runnerDir2 })),
     rootfs: over.rootfs ?? createRootfsHost(),
     firecracker: over.firecracker ?? createFirecrackerHost(),
+    cgroup: over.cgroup ?? realCgroupPort(),
     exec: over.exec ?? execCapture
   };
 }
@@ -1093,7 +1201,7 @@ function decode(prefix, gzip) {
   if (!gzip) return prefix;
   try {
     const { compressedWindow, inflatedBytes } = limits();
-    return gunzipSync(prefix.subarray(0, compressedWindow), { finishFlush: constants.Z_SYNC_FLUSH, maxOutputLength: inflatedBytes });
+    return gunzipSync(prefix.subarray(0, compressedWindow), { finishFlush: constants$1.Z_SYNC_FLUSH, maxOutputLength: inflatedBytes });
   } catch (err) {
     const code = err.code;
     if (code === "ERR_BUFFER_TOO_LARGE") return refused(TOO_LONG);
@@ -2149,6 +2257,40 @@ function containerCommandLine(input) {
     env: { ...childEnvironment(input.runtime.hostEnv), ...env.passed }
   };
 }
+function containerSenderCommand(input) {
+  const state = input.job.container;
+  const env = buildEnvironment({
+    config: input.config,
+    item: input.job.item,
+    itemKey: input.job.itemKey,
+    branch: input.job.branch,
+    repository: state.repository,
+    hostEnv: input.runtime.hostEnv,
+    containerEnv: state.containerEnv ?? {},
+    builtIns: state.builtIns === true,
+    identity: input.job.commitIdentity
+  });
+  const args = containerExecArgs({
+    container: state.container,
+    user: state.agentUser ?? ADDED_USER,
+    workdir: CHECKOUT_DIR,
+    env,
+    argv: ["outerlayer", "session-sender"]
+  });
+  return { command: "docker", args: ["exec", ...args], env: { ...childEnvironment(input.runtime.hostEnv), ...env.passed } };
+}
+function senderSignalScript(pidfile, signal) {
+  const file = shellQuote(pidfile);
+  return `p="$(cat ${file})" && [ -n "$p" ] && grep -qa session-sender "/proc/$p/cmdline" && kill -${signal} "$p"`;
+}
+async function signalInContainer(runtime, state, pidfile, signal) {
+  await runtime.host.exec({
+    container: state.container,
+    user: state.agentUser ?? ADDED_USER,
+    env: NO_ENV,
+    argv: ["/bin/sh", "-c", senderSignalScript(pidfile, signal)]
+  });
+}
 async function stopContainer(runtime, state) {
   await runtime.host.stop(state.container);
   state.stopped = true;
@@ -2247,4 +2389,4 @@ async function cleanupContainer(runtime, state, jobDir) {
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BUILD_LABEL, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, RUNNER_LABEL, classifyRefusal, cleanupContainer, containerCommandLine, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, runnerLabelValue, shellQuote, shortClaim, stageGovernedContext, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BUILD_LABEL, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, RUNNER_LABEL, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, runnerLabelValue, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startServicesFor, stopContainer, syncInContainer };

package/dist/chunk-T6OIJQRT.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
+import { dirname } from 'path';
+
+createRequire(import.meta.url);
+function readJobFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function readJobFileChecked(path) {
+  if (!existsSync(path)) return { kind: "missing" };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { kind: "unreadable" };
+    return { kind: "ok", job: parsed };
+  } catch {
+    return { kind: "unreadable" };
+  }
+}
+function writeJobFile(path, job) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  writeFileSync(path, JSON.stringify(job, null, 2), { mode: RUNNER_FILE_MODE });
+}
+
+export { readJobFile, readJobFileChecked, writeJobFile };

package/dist/{chunk-EGABNHZG.js → chunk-UMFWVGJO.js}

@@ -1,29 +1,104 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { applyContextProvenance, installScrubContext, prepareSessionForUpload, wholeSessionCounts, sliceTurnIo } from './chunk-ZOC7JSYC.js';
-import { LaunchFilter } from './chunk-BCJNHMZT.js';
+import { LaunchFilter } from './chunk-HHJDN6AU.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-WOBNRVQT.js';
-import { tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, SOURCE_ADAPTERS, EVENT_TYPES } from './chunk-EX6M5JPR.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-3DEVYTNQ.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, scrubDeep, downconvertSession, isHumanUserTurn, turnCountBound, SOURCE_ADAPTERS, EVENT_TYPES } from './chunk-ANK2B36Y.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-DVDEBNQJ.js';
+import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { signerFor, signRunnerRequest } from './chunk-M5POMKKW.js';
-import { writeSyncStatus, spoolDir } from './chunk-UFFXNXLQ.js';
+import { writeSyncStatus, spoolDir } from './chunk-FA2BOX4O.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
+import { execFileSync } from 'child_process';
+import { hostname, userInfo } from 'os';
 import { fileURLToPath } from 'url';
 import { createRequire as createRequire$1 } from 'module';
 
 createRequire(import.meta.url);
+function detectCi(env = process.env) {
+  return env.CI === "true" || env.CI === "1" || !!env.JENKINS_URL;
+}
+function gitGlobalConfig(key) {
+  try {
+    return execFileSync("git", ["config", "--global", key], { encoding: "utf8", timeout: 2e3 }).trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function installScrubContext(home, scrub) {
+  setCustomScrubbers(scrub);
+  setLocalIdentity({
+    name: gitGlobalConfig("user.name"),
+    email: gitGlobalConfig("user.email"),
+    username: (() => {
+      try {
+        return userInfo().username;
+      } catch {
+        return void 0;
+      }
+    })(),
+    hostname: (() => {
+      try {
+        return hostname();
+      } catch {
+        return void 0;
+      }
+    })(),
+    home
+  });
+}
+function applyContextProvenance(session, record) {
+  if (!record) return;
+  if (record.repository !== void 0) session.env.contextSourceRepo = record.repository;
+  if (record.ref !== void 0) session.env.contextSourceRef = record.ref;
+  if (record.sha !== null) session.env.contextSourceSha = record.sha;
+  session.env.contextSourceVerification = record.verification;
+}
+function prepareSessionForUpload(session, tier, envVars = process.env) {
+  setRepoRoot(resolveRepoIdentity(session.env.cwd).repoRoot);
+  scrubDeep(session);
+  session.workerKind ??= detectCi(envVars) ? "ci" : "seat";
+  return downconvertSession(session, tier);
+}
+var MAX_TOOL_IO_CHARS = 64e3;
+function sliceToolIo(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  if (typeof text !== "string" || text.length <= MAX_TOOL_IO_CHARS) return value;
+  return `${text.slice(0, MAX_TOOL_IO_CHARS)}\u2026[sliced: ${text.length} chars exceeded the sync per-call cap]`;
+}
+function sliceTurnIo(turn) {
+  return {
+    ...turn,
+    toolCalls: (turn.toolCalls ?? []).map((call) => ({
+      ...call,
+      ...call.input !== void 0 ? { input: sliceToolIo(call.input) } : {},
+      ...call.output !== void 0 ? { output: sliceToolIo(call.output) } : {}
+    }))
+  };
+}
+function wholeSessionCounts(turns) {
+  const allCalls = turns.flatMap((t) => t.toolCalls ?? []);
+  return {
+    // An index BOUND (`1 + max(turn.index)`), not the shipped turn count —
+    // turn indexes are not guaranteed dense from zero, and a late artifact
+    // anchored at its real turn index must still validate against the
+    // summary row this produces (see turnCountBound).
+    turns: turnCountBound(turns),
+    toolCalls: allCalls.length,
+    errors: allCalls.filter((c) => c.status === "error").length,
+    userTurns: turns.filter(isHumanUserTurn).length
+  };
+}
 var IRRELEVANT = /* @__PURE__ */ new Set(["__tests__", "__mocks__", "node_modules"]);
 function newestSourceMs(dir) {
   let newest = 0;
@@ -481,6 +556,8 @@ function retryAfterMs(response) {
 }
 var LiveUploader = class {
   constructor(opts) {
+    /** Set by `stop()`: no more debounce or retry waits, so what is pending is sent once and given up on. */
+    this.stopping = false;
     this.cycles = /* @__PURE__ */ new Map();
     /** Sessions this sender is done with: ended, or permanently rejected. The
      * daemon keeps mirroring a transcript after its session closes, and every
@@ -491,12 +568,31 @@ var LiveUploader = class {
      * every session, so the sender stops entirely for the rest of this
      * process rather than retrying session by session. */
     this.stopped = false;
+    this.warned = /* @__PURE__ */ new Set();
     this.home = opts.home;
     this.fetchImpl = opts.fetchImpl ?? fetch;
     this.sleepImpl = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.debounceMs = opts.debounceMs ?? DEFAULT_DEBOUNCE_MS;
     this.env = opts.env ?? process.env;
     this.stderr = opts.stderr ?? ((s) => void process.stderr.write(s));
+    this.build = opts.build;
+    this.onUnauthorized = opts.onUnauthorized;
+  }
+  /**
+   * Final pass for a build sender: sends what is pending now, without waiting out the debounce and without
+   * retrying a failed send, and resolves once every cycle has finished or `timeoutMs` has passed.
+   */
+  async stop(timeoutMs) {
+    this.stopping = true;
+    let timer;
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(resolve, timeoutMs);
+    });
+    try {
+      await Promise.race([this.flush(), expired]);
+    } finally {
+      clearTimeout(timer);
+    }
   }
   /** Called for every daemon `mirrored` event. Cheap and synchronous — the
    * actual read/send work happens on the debounced cycle. */
@@ -536,7 +632,7 @@ var LiveUploader = class {
       for (; ; ) {
         for (; ; ) {
           const generationAtWaitStart = cycle.generation;
-          await this.sleepImpl(this.debounceMs);
+          if (!this.stopping) await this.sleepImpl(this.debounceMs);
           if (cycle.generation !== generationAtWaitStart) continue;
           break;
         }
@@ -562,8 +658,21 @@ var LiveUploader = class {
     const priorEntry = state.sessions[key];
     if (priorEntry?.ended || priorEntry?.failed) return true;
     const cloudConfig = readCloudConfig(this.home);
-    if (cloudConfig.autoSync === false) return false;
-    if (!cloudConfig.url || !(cloudConfig.apiKey || cloudConfig.accountToken)) return false;
+    let destination;
+    if (this.build === void 0) {
+      if (cloudConfig.autoSync === false) return false;
+      if (!cloudConfig.url || !(cloudConfig.apiKey || cloudConfig.accountToken)) return false;
+    } else {
+      const url = this.env.OUTERLAYER_URL;
+      const credential = this.env.OUTERLAYER_API_KEY;
+      const appId = this.env.OUTERLAYER_APP_ID;
+      if (!url || !credential || !appId) {
+        this.warnOnce("incomplete", `live upload is idle: this build's environment lacks ${[!url && "OUTERLAYER_URL", !credential && "OUTERLAYER_API_KEY", !appId && "OUTERLAYER_APP_ID"].filter(Boolean).join(", ")}, so nothing streams until \`outerlayer sync\` runs.
+`);
+        return false;
+      }
+      destination = { ok: true, url, credential, appId, kind: "key" };
+    }
     const info = subagentInfo(mirrorPath);
     const tail = tailTranscript(mirrorPath, void 0, {
       isSubagent: info.isSubagent,
@@ -573,17 +682,16 @@ var LiveUploader = class {
     if (!tail.session) return false;
     const session = tail.session;
     enrichSessionRepo(session);
-    const destination = resolveGatewayCredentials({ home: this.home, env: {}, cwd: session.env.cwd ?? "/" });
+    destination ??= resolveGatewayCredentials({ home: this.home, env: {}, cwd: session.env.cwd ?? "/" });
     if (!destination.ok) return false;
-    const repoFilter = new RepoFilter(cloudConfig.repos);
-    if (!repoFilter.allows(session.env.gitRepo)) return false;
+    if (this.build === void 0 && !new RepoFilter(cloudConfig.repos).allows(session.env.gitRepo)) return false;
     const launchSpool = readLaunchSpoolState(this.home);
     if (!launchStatusIsDecisive(launchSpool)) return false;
-    const launchFilter = new LaunchFilter(launchSpool.ids);
+    const launchFilter = new LaunchFilter(launchSpool.ids, launchSpool.records, this.build);
     if (!launchFilter.allows(session)) return false;
     let tier;
     try {
-      tier = resolveTier(cloudConfig.tier);
+      tier = resolveTier(this.build === void 0 ? cloudConfig.tier : this.env.OUTERLAYER_TIER ?? cloudConfig.tier);
     } catch (err) {
       if (err instanceof SyncConfigError) return false;
       throw err;
@@ -613,6 +721,7 @@ var LiveUploader = class {
       const outcome = await this.sendWithRetry(endpoint, destination.credential, destination.appId, prepared.id, payload);
       if (outcome === "unauthorized") {
         this.stopped = true;
+        this.onUnauthorized?.();
         this.stderr(
           destination.credential.startsWith("olu_") ? `live upload stopped: the login was refused (expired or revoked). No session streams from this daemon until you run \`outerlayer login\` and it restarts.
 ` : `live upload stopped: the API key was refused. No session streams from this daemon until it restarts with a valid key.
@@ -620,8 +729,9 @@ var LiveUploader = class {
         );
         return true;
       }
+      if (outcome === "unreachable") return false;
       if (outcome === "rejected") {
-        const reason = "the server refused this delta permanently";
+        const reason = `the server refused this delta permanently${this.lastRejectStatus === void 0 ? "" : ` (HTTP ${this.lastRejectStatus})`}`;
         this.mergeSessionState(key, {
           ackedTurnIndex: currentAcked,
           failed: true,
@@ -654,6 +764,7 @@ var LiveUploader = class {
    * key bound to a host key is refused on every route unless that key signed the request. A login token is
    * never signed: only the saved factory key is bound to a host key. */
   async signatureHeaders(endpoint, body, credential) {
+    if (this.build !== void 0) return {};
     if (readCloudConfig(this.home).apiKey !== credential) return {};
     let signer;
     try {
@@ -664,6 +775,12 @@ var LiveUploader = class {
     if (signer === void 0) return {};
     return { ...await signRunnerRequest({ method: "POST", url: endpoint, body: new TextEncoder().encode(body), signer }) };
   }
+  /** Writes `message` the first time `key` is seen, so a condition that holds on every fire logs once. */
+  warnOnce(key, message) {
+    if (this.warned.has(key)) return;
+    this.warned.add(key);
+    this.stderr(message);
+  }
   /** Sends one request, retrying a network error or a retryable 5xx forever
    * with exponential backoff (2s → 60s cap) — the daemon runs unattended, so
    * there is no bounded attempt count. A 401 or a permanent 4xx/rejection
@@ -673,6 +790,7 @@ var LiveUploader = class {
     let delayMs = RETRY_BASE_DELAY_MS;
     for (; ; ) {
       let response;
+      let failure = "";
       try {
         const signature = await this.signatureHeaders(endpoint, body, apiKey);
         response = await this.fetchImpl(endpoint, {
@@ -685,18 +803,30 @@ var LiveUploader = class {
           },
           body
         });
-      } catch {
+      } catch (err) {
         response = void 0;
+        failure = err instanceof Error ? err.message : String(err);
       }
       if (response) {
         if (response.status === 401) return "unauthorized";
         if (response.ok) {
           const accepted = await acceptedSessionIds(response);
-          if (accepted) return accepted.includes(sessionId) ? "accepted" : "rejected";
+          if (accepted) {
+            if (accepted.includes(sessionId)) return "accepted";
+            this.lastRejectStatus = void 0;
+            return "rejected";
+          }
         } else if (!RETRYABLE_STATUSES.has(response.status)) {
+          this.lastRejectStatus = response.status;
           return "rejected";
         }
       }
+      if (this.build !== void 0) {
+        const why = response === void 0 ? failure : `the gateway answered ${response.status}`;
+        this.stderr(`live upload of session ${sessionId} failed: ${why}${this.stopping ? "" : " \xB7 retrying"}
+`);
+      }
+      if (this.stopping) return "unreachable";
       await this.sleepImpl(Math.max(retryAfterMs(response), delayMs));
       delayMs = Math.min(delayMs * 2, RETRY_MAX_DELAY_MS);
     }
@@ -1683,4 +1813,4 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting
   }
 }
 
-export { CHUNK_PART_TARGET_BYTES, LiveUploader, RETRYABLE_STATUSES, SyncConfigError, SyncTransportError, isLoopbackUrl, resolveTier, runSync, staleBuildRefusal, staleBuildWarning };
+export { CHUNK_PART_TARGET_BYTES, LiveUploader, RETRYABLE_STATUSES, SyncConfigError, SyncTransportError, detectCi, installScrubContext, isLoopbackUrl, resolveTier, runSync, staleBuildRefusal, staleBuildWarning };