@outerlayer/cli 0.5.1 → 0.6.0

package/dist/command-ARFK3OYF.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { runRunnerInstall } from './chunk-JWOQNNN2.js';
+import { execStartCommand } from './chunk-YYYXRJUW.js';
+import { readJobFile } from './chunk-T6OIJQRT.js';
+import { installService, uninstallService, realTaskScheduler } from './chunk-NQXFAGHU.js';
+import './chunk-FBTE2A2X.js';
+import './chunk-OUUINEYB.js';
+import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
+import { detectMachine } from './chunk-RBOMWNOG.js';
+import './chunk-RZSF5B46.js';
+import './chunk-Z62HNKEJ.js';
+import './chunk-N5FOE5PS.js';
+import './chunk-OGFGZQA3.js';
+import './chunk-774HEQL6.js';
+import './chunk-QOZKPLVJ.js';
+import './chunk-W4SQCOZU.js';
+import './chunk-B2G7JHHB.js';
+import './chunk-BNMCXPG7.js';
+import './chunk-BFESLKPP.js';
+import './chunk-3DEVYTNQ.js';
+import './chunk-ANK2B36Y.js';
+import { runnerVmOf, loadRunnerConfig } from './chunk-3DD6AOWC.js';
+import './chunk-F6GFZXZ3.js';
+import './chunk-AUFG23AA.js';
+import { realLima } from './chunk-77MM5RYD.js';
+import './chunk-WZBHBH3J.js';
+import './chunk-OIRNH6UO.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-WIOZAJ2W.js';
+import './chunk-WO2BXCTQ.js';
+import './chunk-EMY4I27X.js';
+import './chunk-BCLJSQCV.js';
+import './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-RA3O54FC.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+import { userInfo, totalmem } from 'os';
+import { rmSync, existsSync, readdirSync, readFileSync } from 'fs';
+import { spawnSync } from 'child_process';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+async function serviceInVm(lima, instance, action, options) {
+  const limactl = lima.locate();
+  if (limactl === void 0) {
+    return { ok: false, lines: ["limactl is not installed, and the runner's service lives in the Linux VM it manages. Install Lima with `brew install lima`."] };
+  }
+  const ran = await lima.shell(instance, ["outerlayer", "runner", action, "--service", ...options.extraArgs ?? []]);
+  const lines = [...ran.stdout.split("\n"), ...ran.stderr.split("\n")].map((line) => line.trim()).filter((line) => line !== "");
+  if (ran.status !== 0) return { ok: false, lines: lines.length > 0 ? lines : [`outerlayer runner ${action} --service failed in the VM ${instance} with exit status ${ran.status}`] };
+  if (action === "install") {
+    const path = writeLaunchAgent(options.home, limactl, instance);
+    lines.push(`the VM ${instance} starts at login through ${path}`);
+  } else {
+    rmSync(launchAgentPath(options.home), { force: true });
+    lines.push("removed the launch agent that started the VM at login");
+  }
+  return { ok: true, lines };
+}
+var WSL_CONF = "/etc/wsl.conf";
+function readText(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function sudoWrite(path, text) {
+  const result = spawnSync("sudo", ["tee", path], { input: text, stdio: ["pipe", "ignore", "inherit"] });
+  if (result.status !== 0) throw new Error(`sudo tee ${path} failed with exit status ${result.status}`);
+}
+function realSystemd() {
+  return {
+    running: () => existsSync("/run/systemd/system"),
+    read: readText,
+    write: sudoWrite,
+    remove: (path) => {
+      spawnSync("sudo", ["rm", "-f", path], { stdio: ["inherit", "ignore", "inherit"] });
+    },
+    systemctl: (args, options) => {
+      const result = options?.sudo === true ? spawnSync("sudo", ["systemctl", ...args], { encoding: "utf8", stdio: ["inherit", "pipe", "inherit"] }) : spawnSync("systemctl", args, { encoding: "utf8" });
+      return { status: result.status ?? -1, stdout: result.stdout ?? "" };
+    }
+  };
+}
+function realWslConf() {
+  return { read: () => readText(WSL_CONF), write: (text) => sudoWrite(WSL_CONF, text) };
+}
+function buildsRunningIn(runnerDirPath) {
+  const jobs = join(runnerDirPath, "jobs");
+  if (!existsSync(jobs)) return false;
+  try {
+    return readdirSync(jobs, { withFileTypes: true }).some((entry) => {
+      if (!entry.isDirectory()) return false;
+      const job = readJobFile(join(jobs, entry.name, "job.json"));
+      return job === null || job.outcome === void 0 && job.endedAt === void 0;
+    });
+  } catch {
+    return true;
+  }
+}
+function realServiceDeps() {
+  const platform = detectMachine().platform;
+  return {
+    platform,
+    say: (line) => process.stdout.write(`running: ${line}
+`),
+    systemd: realSystemd(),
+    ...platform === "wsl2" ? { tasks: realTaskScheduler(), wslConf: realWslConf(), distro: process.env.WSL_DISTRO_NAME } : {},
+    usableMemoryBytes: totalmem(),
+    buildsRunning: buildsRunningIn
+  };
+}
+
+// src/runner/service/command.ts
+function vmArgs(input) {
+  return [...input.print === true ? ["--print"] : [], ...input.replace === true ? ["--replace"] : [], ...input.user === void 0 ? [] : ["--user", input.user], ...input.unitName === void 0 ? [] : ["--unit-name", input.unitName]];
+}
+async function installServiceCommand(input, deps = {}) {
+  const vm = runnerVmOf(input.configPath);
+  if (vm !== void 0) {
+    const result = await serviceInVm((deps.lima ?? realLima)(), vm.instance, "install", { home: input.home, extraArgs: vmArgs(input) });
+    return { ok: result.ok, state: "vm", lines: result.lines };
+  }
+  const config = loadRunnerConfig(input.configPath);
+  if (input.print !== true && input.layoutInstalled !== true) {
+    runRunnerInstall({ configPath: input.configPath, entryPath: input.entryPath, nodePath: input.nodePath });
+  }
+  const outcome = installService(
+    {
+      configPath: input.configPath,
+      hooks: config.hooks,
+      concurrency: config.concurrency,
+      buildMemory: config.build?.memory ?? "8g",
+      timeLimitMinutes: config.timeLimitMinutes,
+      execStart: execStartCommand(input.configPath, input.nodePath),
+      user: input.user ?? userInfo().username,
+      unitName: input.unitName,
+      print: input.print,
+      replace: input.replace
+    },
+    (deps.service ?? realServiceDeps)()
+  );
+  return { ok: outcome.ok, state: outcome.state, lines: outcome.lines, unit: outcome.unit };
+}
+async function uninstallServiceCommand(input, deps = {}) {
+  const vm = runnerVmOf(input.configPath);
+  if (vm !== void 0) {
+    const result = await serviceInVm((deps.lima ?? realLima)(), vm.instance, "uninstall", { home: input.home, extraArgs: input.unitName === void 0 ? [] : ["--unit-name", input.unitName] });
+    return { ok: result.ok, state: "vm", lines: result.lines };
+  }
+  const outcome = uninstallService({ configPath: input.configPath, unitName: input.unitName }, (deps.service ?? realServiceDeps)());
+  return { ok: outcome.ok, state: outcome.state, lines: outcome.lines };
+}
+
+export { installServiceCommand, uninstallServiceCommand };

package/dist/{connect-cmd-OJBFHZWP.js → connect-cmd-PCESZLTR.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { promptOnTerminal, realConnectDeps, runConnect, runConnectCommand } from './chunk-OR6AEEDO.js';
-import './chunk-D2KWEAN6.js';
-import './chunk-WOBNRVQT.js';
-import './chunk-EX6M5JPR.js';
+export { promptOnTerminal, realConnectDeps, runConnect, runConnectCommand } from './chunk-PMAMOSTP.js';
+import './chunk-7DBI6SNT.js';
+import './chunk-3DEVYTNQ.js';
+import './chunk-ANK2B36Y.js';
 import './chunk-USO2DKBD.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';

package/dist/{context-adopt-UMA4O5NY.js → context-adopt-G5JAELE7.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { defaultGitRunner, hasSymlinkComponent } from './chunk-XDDW4FRS.js';
+import { defaultGitRunner, hasSymlinkComponent } from './chunk-OIRNH6UO.js';
+import './chunk-ZJSNLVCE.js';
 import { writeContextManifest, writePinIfChanged, touchLastCheck, clearDegraded, writeSourceCache, SOURCE_CACHE_TTL_SUCCESS_MS, writeBuildHold } from './chunk-WIOZAJ2W.js';
 import './chunk-WO2BXCTQ.js';
 import './chunk-EMY4I27X.js';
-import './chunk-ZJSNLVCE.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-EABW6AJQ.js';

package/dist/{context-materialize-G2FUFC72.js → context-materialize-3HLPZAF6.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir } from './chunk-XDDW4FRS.js';
+export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir } from './chunk-OIRNH6UO.js';
+import './chunk-ZJSNLVCE.js';
 import './chunk-WIOZAJ2W.js';
 import './chunk-WO2BXCTQ.js';
 import './chunk-EMY4I27X.js';
-import './chunk-ZJSNLVCE.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-EABW6AJQ.js';

package/dist/{dist-WDV7U7UJ.js → dist-RDLP4GGJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { CaptureDaemon, PRICE_TABLE_SOURCE, SECRET_PATTERNS, SOURCE_ADAPTERS, SUPPORTED_VERSIONS, StatuslineAggregator, WARNING_CODES, claudeCodeAdapter, codexAdapter, codexSessionIdFromPath, compareVersions, completePrefix, computeStatuslineState, costOfUsage, cursorAdapter, cursorChatIdFromPath, defaultCodexSessionsDir, defaultCursorChatsDir, defaultCursorProjectsDir, defaultProjectsDir, defaultRawDir, enrichSessionRepo, findCodexRollouts, findCursorChats, findTranscripts, isNewerThanSupported, isPriceKnown, normalizeErrorSignature, normalizeRemote, parseCodexRollout, parseCursorChat, parseTranscript, readStatuslineState, readSyncWatermarkMs, remoteLookupFailed, resolvePrice, resolveRepoIdentity, rootChildIds, scanAll, scrubDeep, scrubText, sessionIdFromPath, setCustomScrubbers, setLocalIdentity, setRepoRoot, statuslineStatePath, tailTranscript, workspacesByHash, writeStatuslineState } from './chunk-EX6M5JPR.js';
+export { CaptureDaemon, PRICE_TABLE_SOURCE, SECRET_PATTERNS, SOURCE_ADAPTERS, SUPPORTED_VERSIONS, StatuslineAggregator, WARNING_CODES, claudeCodeAdapter, codexAdapter, codexSessionIdFromPath, compareVersions, completePrefix, computeStatuslineState, costOfUsage, cursorAdapter, cursorChatIdFromPath, defaultCodexSessionsDir, defaultCursorChatsDir, defaultCursorProjectsDir, defaultProjectsDir, defaultRawDir, enrichSessionRepo, findCodexRollouts, findCursorChats, findTranscripts, isNewerThanSupported, isPriceKnown, normalizeErrorSignature, normalizeRemote, parseCodexRollout, parseCursorChat, parseTranscript, readStatuslineState, readSyncWatermarkMs, remoteLookupFailed, resolvePrice, resolveRepoIdentity, rootChildIds, scanAll, scrubDeep, scrubText, sessionIdFromPath, setCustomScrubbers, setLocalIdentity, setRepoRoot, statuslineStatePath, tailTranscript, workspacesByHash, writeStatuslineState } from './chunk-ANK2B36Y.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{doctor-MOA3RIEP.js → doctor-VOMYOHQU.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-CHLVJNTE.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-MXB5VB4Y.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-W7UTFZDH.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-RTXKYLCA.js';
-import { MIN_ENGINE_MAJOR } from './chunk-T52PKE2Y.js';
+import './chunk-4NLKY4WR.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-RBOMWNOG.js';
+import { MIN_ENGINE_MAJOR } from './chunk-RZSF5B46.js';
 import { CLAUDE_CODE_VERSION } from './chunk-Z62HNKEJ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
@@ -13,19 +13,19 @@ import { resolveDevcontainerCli } from './chunk-774HEQL6.js';
 import { locateRecipe, assertBuildable, readRecipe, RecipeError } from './chunk-QOZKPLVJ.js';
 import './chunk-W4SQCOZU.js';
 import './chunk-B2G7JHHB.js';
-import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-RMAZ2NWA.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-BNMCXPG7.js';
 import './chunk-BFESLKPP.js';
-import './chunk-WOBNRVQT.js';
-import { compareVersions } from './chunk-EX6M5JPR.js';
+import './chunk-3DEVYTNQ.js';
+import { compareVersions } from './chunk-ANK2B36Y.js';
 import { builtinKind } from './chunk-3DD6AOWC.js';
 import { parseSize } from './chunk-F6GFZXZ3.js';
 import './chunk-AUFG23AA.js';
 import './chunk-WZBHBH3J.js';
-import { defaultGitRunner } from './chunk-XDDW4FRS.js';
+import { defaultGitRunner } from './chunk-OIRNH6UO.js';
+import './chunk-ZJSNLVCE.js';
 import './chunk-WIOZAJ2W.js';
 import './chunk-WO2BXCTQ.js';
 import './chunk-EMY4I27X.js';
-import './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-EABW6AJQ.js';
@@ -46,8 +46,17 @@ createRequire(import.meta.url);
 // src/runner/microvm/doctor.ts
 var GIB = 1024 ** 3;
 var gib = (bytes) => `${Number((bytes / GIB).toFixed(1))} GiB`;
-function kvmCheck(machine) {
+function kvmCheck(machine, service) {
   const name = "KVM";
+  if (service?.hasKvmGroup !== void 0 && machine.kvm?.state !== "absent" && machine.kvm !== void 0) {
+    if (service.hasKvmGroup) return { name, status: "pass", detail: `the service ${service.unit} has the group that owns /dev/kvm, so each build runs in a microVM of its own` };
+    return {
+      name,
+      status: "fail",
+      detail: `the service ${service.unit} cannot open /dev/kvm: its main process is not in the kvm group, so every build fails at provision, even if this shell can open it`,
+      fix: `sudo usermod -aG ${machine.kvm.group ?? "kvm"} <the service's account>, then restart the service: sudo systemctl restart ${service.unit}. A service reads its groups only when it starts`
+    };
+  }
   const kvm = machine.kvm;
   if (kvm?.state === "usable") return { name, status: "pass", detail: "this user can open /dev/kvm, so each build runs in a microVM of its own" };
   if (kvm?.state === "no-permission") {
@@ -88,6 +97,16 @@ function memoryCheck(input) {
     fix: "lower runner.concurrency or runner.build.memory, or run the runner on a host with more memory"
   };
 }
+function delegationCheck(service) {
+  const name = "MicroVM memory limit";
+  if (service.delegate !== false) return { name, status: "pass", detail: `the service ${service.unit} is delegated its cgroup, so each microVM build gets a memory limit of its own` };
+  return {
+    name,
+    status: "warn",
+    detail: `the service ${service.unit} does not set Delegate=yes, so microVM builds have no limit of their own: one build that uses too much memory can take the others with it`,
+    fix: "run `outerlayer runner install --service --replace` to write the unit this CLI generates, which sets Delegate=yes"
+  };
+}
 
 // src/runner/image/doctor.ts
 var LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
@@ -419,11 +438,12 @@ async function runnerHostChecks(env) {
     },
     ...env.hooks === void 0 ? [] : [isolationCheck(env.machine ?? detectMachine(), env.hooks)],
     ...env.hooks !== void 0 && builtinKind(env.hooks.provision) === "vm" ? [
-      kvmCheck(env.machine ?? detectMachine()),
+      kvmCheck(env.machine ?? detectMachine(), env.service),
+      ...env.service === void 0 ? [] : [delegationCheck(env.service)],
       ...env.runner === void 0 ? [] : [memoryCheck({ concurrency: env.runner.concurrency, buildMemory: env.runner.buildMemory, hostMemory: env.hostMemory ?? totalmem() })]
     ] : [],
     ...env.runner?.minFreeDisk === void 0 ? [] : [freeDiskCheck(env.configPath, env.runner.minFreeDisk, env.freeBytes ?? freeBytes)],
-    ...env.hooks !== void 0 && needsClaudeCredential(env.hooks) ? [claudeCredentialCheck(env.env ?? process.env, { shell: true })] : [],
+    ...env.hooks !== void 0 && needsClaudeCredential(env.hooks) ? [claudeCredentialCheck(env.env ?? process.env, env.service === void 0 ? { shell: true } : { service: { unit: env.service.unit, variables: env.service.credentialVariables } })] : [],
     ...env.gateway === void 0 ? [] : [await hostKeyBindingCheck(env.configPath, env.gateway, env.fetchImpl ?? defaultFetch)],
     ...env.gateway === void 0 || env.hooks === void 0 || !["container", "vm"].includes(builtinKind(env.hooks.provision)) ? [] : [await controlPlaneAccessCheck({ ...env, gateway: env.gateway }, env.fetchImpl ?? defaultFetch)],
     devcontainerRunnable() ? { name: "Devcontainer CLI", status: "pass", detail: "installed beside the outerlayer CLI" } : {

package/dist/{emit-artifact-cmd-FDWYKURA.js → emit-artifact-cmd-TBF46VXZ.js}

@@ -1,16 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning } from './chunk-EGABNHZG.js';
-import { detectCi } from './chunk-ZOC7JSYC.js';
-import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-UMFWVGJO.js';
+import { launchRefusalForSession } from './chunk-HHJDN6AU.js';
 import './chunk-TBT347UY.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, appendArtifactTombstone } from './chunk-WOBNRVQT.js';
-import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, resolveRepoIdentity, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-EX6M5JPR.js';
+import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, appendArtifactTombstone } from './chunk-3DEVYTNQ.js';
+import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, resolveRepoIdentity, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-ANK2B36Y.js';
 import './chunk-YRYMNBGQ.js';
-import './chunk-DVDEBNQJ.js';
+import './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
 import './chunk-ZJSNLVCE.js';
@@ -19,7 +18,7 @@ import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR
 import './chunk-EABW6AJQ.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-UFFXNXLQ.js';
+import './chunk-FA2BOX4O.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{emit-criteria-cmd-OCXHLK34.js → emit-criteria-cmd-3427XKFW.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { launchRefusalForSession } from './chunk-HHJDN6AU.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { resolveRepoIdentity, CriteriaListSchema } from './chunk-EX6M5JPR.js';
-import { launchedItemForSession } from './chunk-DVDEBNQJ.js';
+import { resolveRepoIdentity, CriteriaListSchema } from './chunk-ANK2B36Y.js';
+import { launchedItemForSession } from './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';

package/dist/{emit-finding-cmd-POW7PKIA.js → emit-finding-cmd-GSI75K36.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { launchRefusalForSession } from './chunk-HHJDN6AU.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { FindingBatchSchema, resolveRepoIdentity } from './chunk-EX6M5JPR.js';
-import { launchedItemForSession } from './chunk-DVDEBNQJ.js';
+import { FindingBatchSchema, resolveRepoIdentity } from './chunk-ANK2B36Y.js';
+import { launchedItemForSession } from './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';

package/dist/{emit-result-cmd-ID35SH53.js → emit-result-cmd-3PRQKB55.js}

@@ -1,16 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import './chunk-EGABNHZG.js';
-import { detectCi } from './chunk-ZOC7JSYC.js';
-import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { detectCi } from './chunk-UMFWVGJO.js';
+import { launchRefusalForSession } from './chunk-HHJDN6AU.js';
 import './chunk-TBT347UY.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import './chunk-WOBNRVQT.js';
-import { EmittedNameSchema, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, resolveRepoIdentity } from './chunk-EX6M5JPR.js';
+import './chunk-3DEVYTNQ.js';
+import { EmittedNameSchema, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, resolveRepoIdentity } from './chunk-ANK2B36Y.js';
 import './chunk-YRYMNBGQ.js';
-import './chunk-DVDEBNQJ.js';
+import './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
 import './chunk-ZJSNLVCE.js';
@@ -19,7 +18,7 @@ import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR
 import './chunk-EABW6AJQ.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-UFFXNXLQ.js';
+import './chunk-FA2BOX4O.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{hook-fast-EYENPK6F.js → hook-fast-NJBBZQ5Q.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { AUTO_SYNC_DEBOUNCE_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, contextPossiblyGoverned, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, maybeAutoSync, maybeRenewWorkLease, runHookFast, spoolDir } from './chunk-UFFXNXLQ.js';
+export { AUTO_SYNC_DEBOUNCE_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, contextPossiblyGoverned, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, logHookError, maybeAutoSync, maybeRenewWorkLease, recordLinkExitFailure, runHookFast, spoolDir } from './chunk-FA2BOX4O.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/index.js

@@ -6,7 +6,7 @@ createRequire(import.meta.url);
 // src/index.ts
 var argv = process.argv.slice(2);
 if (argv[0] === "hook") {
-  const { runHookFast } = await import('./hook-fast-EYENPK6F.js');
+  const { runHookFast } = await import('./hook-fast-NJBBZQ5Q.js');
   await runHookFast(argv[1]);
   process.exit(0);
 }
@@ -21,5 +21,6 @@ if (argv[0] === "statusline") {
   await runStatuslineFast(argv.slice(1));
   process.exit(0);
 }
-var { runCli } = await import('./cli-LHSUYYMI.js');
+(await import('./hook-fast-NJBBZQ5Q.js')).recordLinkExitFailure(argv);
+var { runCli } = await import('./cli-7WCNPBYC.js');
 await runCli(process.argv);

package/dist/{init-2IPOIXJV.js → init-OHYFIKZD.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { execStartCommand } from './chunk-YYYXRJUW.js';
+import { VM_SERVICE_NAME } from './chunk-FBTE2A2X.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-OUUINEYB.js';
 import { writeLaunchAgent } from './chunk-LF6MLJCY.js';
-import { readConfigObject, RunnerInitError, isPlaceholderCommand } from './chunk-W7UTFZDH.js';
-import './chunk-RTXKYLCA.js';
-import './chunk-T52PKE2Y.js';
+import { readConfigObject, RunnerInitError } from './chunk-4NLKY4WR.js';
+import './chunk-RBOMWNOG.js';
+import './chunk-RZSF5B46.js';
 import './chunk-Z62HNKEJ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
@@ -12,19 +13,19 @@ import './chunk-774HEQL6.js';
 import './chunk-QOZKPLVJ.js';
 import './chunk-W4SQCOZU.js';
 import './chunk-B2G7JHHB.js';
-import './chunk-RMAZ2NWA.js';
+import './chunk-BNMCXPG7.js';
 import './chunk-BFESLKPP.js';
-import './chunk-WOBNRVQT.js';
-import './chunk-EX6M5JPR.js';
+import './chunk-3DEVYTNQ.js';
+import './chunk-ANK2B36Y.js';
 import { resolveBuild } from './chunk-3DD6AOWC.js';
 import { parseSize } from './chunk-F6GFZXZ3.js';
 import './chunk-AUFG23AA.js';
 import './chunk-WZBHBH3J.js';
-import './chunk-XDDW4FRS.js';
+import './chunk-OIRNH6UO.js';
+import './chunk-ZJSNLVCE.js';
 import './chunk-WIOZAJ2W.js';
 import './chunk-WO2BXCTQ.js';
 import './chunk-EMY4I27X.js';
-import './chunk-ZJSNLVCE.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-EABW6AJQ.js';
@@ -39,43 +40,22 @@ import { readFileSync, writeFileSync, existsSync, rmSync } from 'fs';
 
 createRequire(import.meta.url);
 
-// src/runner/vm/service.ts
-var VM_SERVICE_NAME = "outerlayer-runner";
-var STOP_MARGIN_MINUTES = 10;
-function runnerUnit(unit) {
-  const dir = `${unit.home}/.outerlayer`;
-  return `[Unit]
-Description=OuterLayer runner
-After=network-online.target docker.service
-Wants=network-online.target
-Requires=docker.service
-
-[Service]
-User=${unit.user}
-ExecStart=${unit.execStart}
-EnvironmentFile=-${dir}/runner.env
-Restart=on-failure
-RestartForceExitStatus=75
-RestartSec=30
-KillSignal=SIGTERM
-KillMode=mixed
-TimeoutStopSec=${unit.timeLimitMinutes + STOP_MARGIN_MINUTES}min
-
-[Install]
-WantedBy=multi-user.target
-`;
-}
-
 // src/runner/vm/sizing.ts
 var GIB = 1024 ** 3;
 var EXTRA_CPUS = 1;
-var EXTRA_MEMORY_GIB = 2;
+var GUEST_MEMORY_SHARE = 0.95;
 var EXTRA_DISK_GIB = 30;
 var gib = (size) => parseSize(size) / GIB;
+function guestUsableBytes(memoryGiB) {
+  return Math.floor(memoryGiB * GIB * GUEST_MEMORY_SHARE);
+}
+function wantedMemoryGiB(build, concurrency) {
+  return Math.ceil((gib(build.memory) * concurrency + RUNNER_RESERVE_BYTES / GIB) / GUEST_MEMORY_SHARE);
+}
 function sizeVm(build, concurrency, host) {
   return {
     cpus: Math.max(1, Math.min(Math.ceil(build.cpus * concurrency) + EXTRA_CPUS, host.cpus)),
-    memoryGiB: Math.max(1, Math.min(Math.ceil(gib(build.memory) * concurrency) + EXTRA_MEMORY_GIB, Math.floor(host.memoryBytes / GIB))),
+    memoryGiB: Math.max(1, Math.min(wantedMemoryGiB(build, concurrency), Math.floor(host.memoryBytes / GIB))),
     diskGiB: Math.ceil(gib(build.disk) * concurrency) + EXTRA_DISK_GIB
   };
 }
@@ -85,15 +65,9 @@ var VM_INSTANCE = "outerlayer-runner";
 var VmInitError = class extends Error {
 };
 var MIN_NODE_MAJOR = 22;
-var DEFAULT_TIME_LIMIT_MINUTES = 480;
 var TARBALL_IN_VM = "/tmp/outerlayer-cli.tgz";
 var NODE_VERSION = /^v(\d+)\./;
 var quote = (text) => `'${text.replace(/'/g, `'\\''`)}'`;
-function commandsAreReal(block) {
-  const commands = block?.commands ?? {};
-  const given = [commands.implement, commands.amend].filter((command) => typeof command === "string");
-  return given.length > 0 && given.every((command) => !isPlaceholderCommand(command));
-}
 async function runVmInit(configPath, deps) {
   const { lima } = deps;
   const instance = deps.instance ?? VM_INSTANCE;
@@ -130,8 +104,11 @@ async function runVmInit(configPath, deps) {
   }
   const build = resolveBuild(configPath, carried.build);
   const concurrency = typeof carried.concurrency === "number" ? carried.concurrency : 1;
-  const timeLimitMinutes = typeof carried.timeLimitMinutes === "number" ? carried.timeLimitMinutes : DEFAULT_TIME_LIMIT_MINUTES;
   const size = sizeVm(build, concurrency, { cpus: deps.hostCpus, memoryBytes: deps.hostMemoryBytes });
+  const fit = checkFit({ concurrency, buildMemory: build.memory, usableBytes: guestUsableBytes(size.memoryGiB) });
+  if (!fit.fits) {
+    throw new RunnerInitError(`${configPath}: the VM this Mac can give the runner is ${size.memoryGiB} GiB, and ${fit.message}. Lower runner.concurrency or runner.build.memory, then run this again.`);
+  }
   const leftBehind = `The VM ${instance} was left as it is; delete it with \`limactl delete --force ${instance}\` to start over.`;
   const failed = (what, result) => new VmInitError(`${what} failed: ${result.stderr.trim() || result.stdout.trim() || `exit status ${result.status}`}. ${leftBehind}`);
   const sh = async (argv, stdin) => {
@@ -172,13 +149,7 @@ async function runVmInit(configPath, deps) {
     ...block === void 0 ? {} : { runner: carried }
   };
   const innerOut = await sh(["sg", "docker", "-c", `${quote(outerlayer)} runner init --config-stdin --config ${quote(vmConfig)}`], JSON.stringify(handoff));
-  await sh(["sh", "-c", `${quote(outerlayer)} runner install --config ${quote(vmConfig)}`]);
-  const nodePath = (await sh(["sh", "-c", "command -v node"])).trim();
-  const execStart = execStartCommand(vmConfig, nodePath);
-  await sh(["sudo", "tee", `/etc/systemd/system/${VM_SERVICE_NAME}.service`], runnerUnit({ user, home, execStart, timeLimitMinutes }));
-  await sh(["sudo", "systemctl", "daemon-reload"]);
-  const enabled = commandsAreReal(block);
-  if (enabled) await sh(["sudo", "systemctl", "enable", "--now", VM_SERVICE_NAME]);
+  const installOut = await sh(["sh", "-c", `${quote(outerlayer)} runner install --service --config ${quote(vmConfig)}`]);
   let agent;
   let hadHostKey;
   try {
@@ -193,7 +164,6 @@ async function runVmInit(configPath, deps) {
   }
   return {
     instance,
-    enabled,
     lines: [
       `created the Linux VM ${instance}: ${size.cpus} CPUs, ${size.memoryGiB} GiB memory, ${size.diskGiB} GiB disk`,
       ...innerOut.split("\n").map((line) => line.trim()).filter((line) => line !== ""),
@@ -201,8 +171,9 @@ async function runVmInit(configPath, deps) {
       `moved the runner key into the VM: apiKey and runner are gone from ${configPath}`,
       ...hadHostKey ? ["deleted this Mac's old host key. If the runner key was bound to it, a member uses Clear host key on the API keys page before the VM's first claim"] : [],
       "run outerlayer login again to use capture on this Mac, with a key that is not the runner key",
-      `put CLAUDE_CODE_OAUTH_TOKEN in ${home}/.outerlayer/runner.env inside the VM${enabled ? `, then restart the runner so it reads the file: limactl shell ${instance} sudo systemctl restart ${VM_SERVICE_NAME}` : ""}`,
-      enabled ? `the runner is running in the VM: limactl shell ${instance} outerlayer runner status` : `Edit the command lines in the VM's config, then run: limactl shell ${instance} sudo systemctl enable --now ${VM_SERVICE_NAME}`
+      ...installOut.split("\n").map((line) => line.trim()).filter((line) => line !== ""),
+      `put CLAUDE_CODE_OAUTH_TOKEN in ${home}/.outerlayer/runner.env inside the VM, then restart the runner so it reads the file: limactl shell ${instance} sudo systemctl restart ${VM_SERVICE_NAME}`,
+      `the runner claims nothing while a command in the VM's config is still the placeholder or the credential is missing; its host entry says why. Check it with: limactl shell ${instance} outerlayer runner status`
     ]
   };
 }

package/dist/{init-FYDJAKTM.js → init-WVR4BZQ4.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit } from './chunk-W7UTFZDH.js';
-import './chunk-RTXKYLCA.js';
-import './chunk-T52PKE2Y.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit } from './chunk-4NLKY4WR.js';
+import './chunk-RBOMWNOG.js';
+import './chunk-RZSF5B46.js';
 import './chunk-Z62HNKEJ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
@@ -10,18 +10,18 @@ import './chunk-774HEQL6.js';
 import './chunk-QOZKPLVJ.js';
 import './chunk-W4SQCOZU.js';
 import './chunk-B2G7JHHB.js';
-import './chunk-RMAZ2NWA.js';
+import './chunk-BNMCXPG7.js';
 import './chunk-BFESLKPP.js';
-import './chunk-WOBNRVQT.js';
-import './chunk-EX6M5JPR.js';
+import './chunk-3DEVYTNQ.js';
+import './chunk-ANK2B36Y.js';
 import './chunk-F6GFZXZ3.js';
 import './chunk-AUFG23AA.js';
 import './chunk-WZBHBH3J.js';
-import './chunk-XDDW4FRS.js';
+import './chunk-OIRNH6UO.js';
+import './chunk-ZJSNLVCE.js';
 import './chunk-WIOZAJ2W.js';
 import './chunk-WO2BXCTQ.js';
 import './chunk-EMY4I27X.js';
-import './chunk-ZJSNLVCE.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-EABW6AJQ.js';