@outerlayer/cli 0.5.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @outerlayer/cli
 
+## 0.7.0
+
+### Minor Changes
+
+- b4fdd73: The runner now runs a repository's `where: host` validators itself after a build, in a new container from the build's image, and records each result under the host's own key. A check that cannot run is recorded as a fail with a reason. `runner.checks.timeLimitMinutes` (default 10, 1 to 240) bounds the environment setup and each check command. The runner CLI is not updated for you on a host with `runner.autoUpdate` off: refresh it by hand on each host to get host checks.
+
+### Patch Changes
+
+- 35b0fed: Fixes found by running the runner service on real machines:
+
+  - A repository fetch with a claim's read token keeps the git settings the host passes in `GIT_CONFIG_*`, such as one in `runner.env`. It added the token over them.
+  - `runner install --service --user <account>` refuses when that account cannot execute the Node the install runs on, or read the runner's CLI, instead of installing a service that cannot start.
+  - A microVM the kernel kills at its memory limit while it is still starting is released with a reason saying the build ran out of memory, not that the microVM did not start.
+  - A microVM build's cgroup reclaims above `build.memory` plus 256 MiB and kills above `build.memory` plus 1 GiB. A real build was killed at plus 256 MiB, because the page cache of its disks' writes is charged to the same cgroup.
+
+- f633a70: The template build skill's `record-criteria.mjs` now records a criterion that declares `(proof: test)` with proof `test`. Test results for that criterion now count toward it.
+- 735d939: `work` and `emit` commands now connect the repository themselves when you are logged in, the repository has no saved connection, and exactly one factory fits. They print one line naming the factory and why, save the connection, and carry on. When several factories fit, they refuse and list the `--factory` value for each.
+
+## 0.6.0
+
+### Minor Changes
+
+- cb41102: A runner build's agent session now appears on its work item, with its running cost, while the build runs. The runner starts a hidden `session-sender` command beside each build's command, in a microVM, a container, a host `exec` hook or on the host. The end-of-attempt sync stays the complete upload. The capture daemon gains a watch-only mode that reports changed transcripts without copying them.
+- 21b7405: `outerlayer runner init` now sets the runner up to keep running on Linux, macOS and Windows (WSL2), with the same commands on each: `runner install --service` (with `--print`, `--user` and `--replace`) writes, enables and starts one systemd unit, and `runner uninstall --service` removes it. Each microVM build runs in a cgroup of its own with a memory limit of `build.memory` plus 256 MiB, and a build the kernel kills for want of memory ends `failed` with a reason that says so, without stopping the runner or the other builds. Setup refuses builds that cannot fit in memory together. The runner claims nothing, and says why in its heartbeat as `blocked`, when it cannot open `/dev/kvm`, has no Claude credential, still has the placeholder command, or has builds that do not fit in memory. `outerlayer doctor` now reports the running service's groups and credential instead of your shell's. The runner now reports protocol 14 to its gateway.
+
+### Patch Changes
+
+- 573abaa: A session link that worked no longer leaves a Node warning in `~/.outerlayer/spool/hook-errors.log`. Only links that fail are logged, with one line naming the item.
+
 ## 0.5.1
 
 ### Patch Changes

package/README.md

@@ -56,6 +56,15 @@ send, so turning it off takes effect without restarting the daemon.
 authoritative upload — the daemon exists so a session's page can follow
 along before that sync ever runs.
 
+**`outerlayer session-sender` is started only by a runner, inside each build,
+and streams that build's sessions to its work item while the build runs.** It
+sends under the build's own item key to the build's own gateway, both taken
+from the job's environment and never from your config file, and only sessions
+the build itself launched. It sends no session that belongs to anyone else on
+the machine, and your own `outerlayer daemon` skips sessions launched inside a
+runner build. The runner stops it before the build's final `outerlayer sync`,
+which remains the complete upload.
+
 These commands also talk to your workspace. None of them sends session
 content:
 
@@ -92,6 +101,12 @@ content:
   work — success, or the error code and message the platform returned.
   When a build's command exits 0, it reads that work item once more, for its
   evidence verdict, before releasing it: it sends nothing but the request.
+  Just before that read, the runner runs the repository's host checks. A host
+  check is a command the repository's `where: host` validators declare. The
+  runner reads the definitions with the host's own git credentials, runs each
+  command in a new container, and sends one `POST /v1/emitted-results` for
+  each: the check's name, pass or fail, and for a fail the exit status and the
+  last line of its output, scrubbed.
   Before a build's command starts, the runner also runs `git ls-remote` and
   `git fetch` in the job's workdir, with the host's own git credentials, to
   put it on the branch the claim named. Nothing about the job leaves the host
@@ -124,6 +139,10 @@ content:
   never printed. If this machine held a token from an earlier login, login
   asks the dashboard to revoke it. A key piped on stdin makes no network
   call.
+- **`outerlayer work`** and **`outerlayer emit`**, in the subcommands named below, with a login and no saved
+  connection for the repository send the same `GET /v1/me/factories?repository=<host/owner/name>`
+  request before their own, to connect the repository when exactly one factory
+  fits. They send nothing extra with a factory key, `--app-id` or `OUTERLAYER_APP_ID`. The subcommands are `work build`, `list`, `status`, `remove` and `pr`, and `emit artifact`, `result`, `criteria`, `finding` and `findings`. Other `work` subcommands never connect.
 - **`outerlayer connect`**, and the first step of `outerlayer init`, send a
   request with your login's token: `GET /v1/me/factories?repository=<host/owner/name>`,
   naming this checkout's remote. The gateway answers with the factories you can

package/dist/{agent-setup-IFH3FB5X.js → agent-setup-TXLDY5RV.js}

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { installStarterPack } from './chunk-ZMYPLFG3.js';
-import { runEmit } from './chunk-H5NCNVDA.js';
+import { installStarterPack } from './chunk-M3SQ4YGD.js';
+import { runEmit } from './chunk-EV3M3EH7.js';
 import { addStdioMcpEntryIfAbsent } from './chunk-MQ3IPHIZ.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-XDDW4FRS.js';
-import { pinExists, readContextManifest } from './chunk-WIOZAJ2W.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-WO2BXCTQ.js';
-import { generatedHeaderSource } from './chunk-EMY4I27X.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
+import { pinExists, readContextManifest } from './chunk-ZZXLM64C.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-VXLJORHL.js';
+import { generatedHeaderSource } from './chunk-7ZR5UPMB.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M5POMKKW.js';

package/dist/{build-PAEKVYVK.js → build-JF5UOWKJ.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-Z62HNKEJ.js';
+export { buildRepositoryImage } from './chunk-CEBIA5FD.js';
 import './chunk-N5FOE5PS.js';
 export { RecipeError } from './chunk-QOZKPLVJ.js';
+import './chunk-HKMPVPO7.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-04T00:10:45.902Z+d37533c","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-05T00:52:06.865Z+90312df","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-4Q33B5ZE.js → check-ASZL5BEO.js}

@@ -1,45 +1,61 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-F4NU4H3V.js';
-import './chunk-UWH5DSUP.js';
-import './chunk-ZXBITXTS.js';
-import './chunk-UGP76IZ5.js';
+import { probeCredentials } from './chunk-AII7CKTH.js';
 import './chunk-ABIWDUMS.js';
-import './chunk-YYYXRJUW.js';
-import './chunk-CBPPJSAR.js';
-import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-CHLVJNTE.js';
+import './chunk-TI7B7UEO.js';
+import './chunk-AJKEHABI.js';
+import './chunk-T6OIJQRT.js';
+import './chunk-AIW6GLET.js';
+import './chunk-UGP76IZ5.js';
+import './chunk-2VO25HHO.js';
+import './chunk-WVGSB3Z2.js';
+import './chunk-6ZZHWY2Z.js';
+import './chunk-HHJDN6AU.js';
+import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-6IYLDODX.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-ZOC7JSYC.js';
 import './chunk-TBT347UY.js';
-import './chunk-W7UTFZDH.js';
-import './chunk-RTXKYLCA.js';
-import './chunk-T52PKE2Y.js';
-import './chunk-Z62HNKEJ.js';
+import './chunk-6QWV3YDJ.js';
+import './chunk-OUUINEYB.js';
+import './chunk-AQ54MKSQ.js';
+import './chunk-E4PIFIC3.js';
+import './chunk-CEBIA5FD.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-774HEQL6.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-W4SQCOZU.js';
-import './chunk-B2G7JHHB.js';
-import './chunk-RMAZ2NWA.js';
+import './chunk-ZOAEPWGL.js';
+import './chunk-R7STSBLC.js';
+import './chunk-F7CU5ABH.js';
+import './chunk-BKO6JEZI.js';
+import './chunk-DGAIVMMN.js';
+import './chunk-PUN7LMNS.js';
 import './chunk-BFESLKPP.js';
-import './chunk-WOBNRVQT.js';
-import './chunk-EX6M5JPR.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-3DD6AOWC.js';
+import './chunk-SSU747O6.js';
+import './chunk-ZYHKJKSU.js';
+import './chunk-D6FXM5OW.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
+import './chunk-YRYMNBGQ.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-DTXOJDEH.js';
 import './chunk-F6GFZXZ3.js';
-import './chunk-AUFG23AA.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
+import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
-import './chunk-XDDW4FRS.js';
-import './chunk-WIOZAJ2W.js';
-import './chunk-WO2BXCTQ.js';
-import './chunk-EMY4I27X.js';
+import './chunk-5QRP3MVS.js';
+import './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
+import './chunk-ZZXLM64C.js';
+import './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
+import './chunk-JPR2WHHF.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/chunk-2VO25HHO.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { LiveUploader } from './chunk-6ZZHWY2Z.js';
+import { CaptureDaemon } from './chunk-D6FXM5OW.js';
+import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
+import { spoolDir } from './chunk-JPR2WHHF.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { mkdirSync, writeFileSync, rmSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var SENDER_STOP_WAIT_MS = 25e3;
+var RESCAN_MS = 3e4;
+function senderPidfile(home, item) {
+  return join(spoolDir(home), `session-sender-${item}.pid`);
+}
+async function startSessionSender(opts = {}) {
+  const env = opts.env ?? process.env;
+  const stderr = opts.stderr ?? ((s) => void process.stderr.write(s));
+  const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
+  const jobDir = env.OUTERLAYER_JOB_DIR;
+  if ("reason" in parsed || !jobDir) {
+    throw new Error("a session sender runs inside a runner job: OUTERLAYER_WORK must name the item and OUTERLAYER_JOB_DIR the job");
+  }
+  const home = opts.home ?? homeFromEnv(env);
+  const uploader = new LiveUploader({
+    home,
+    env,
+    fetchImpl: opts.fetchImpl,
+    sleepImpl: opts.sleepImpl,
+    debounceMs: opts.debounceMs,
+    stderr,
+    build: { item: parsed.number, jobDir },
+    onUnauthorized: opts.onFatal
+  });
+  const onLog = (event) => {
+    if (event.type === "changed" && event.file !== void 0) uploader.notify(event.file);
+    if (event.type === "error") stderr(`error ${event.file}: ${event.detail}
+`);
+  };
+  const daemon = new CaptureDaemon({ ...opts.root === void 0 ? {} : { root: opts.root }, watchOnly: true, rescanMs: RESCAN_MS, onLog });
+  const pidfile = senderPidfile(home, parsed.number);
+  try {
+    mkdirSync(spoolDir(home), { recursive: true });
+    writeFileSync(pidfile, String(process.pid));
+  } catch {
+  }
+  await daemon.start();
+  let stopped;
+  return {
+    stop: () => stopped ??= (async () => {
+      daemon.rescanNow();
+      await uploader.stop(opts.stopWaitMs ?? SENDER_STOP_WAIT_MS);
+      await daemon.stop();
+      rmSync(pidfile, { force: true });
+    })()
+  };
+}
+async function runSessionSender() {
+  let sender;
+  const exit = async (code) => {
+    await sender?.stop().catch(() => void 0);
+    process.exit(code);
+  };
+  sender = await startSessionSender({ onFatal: () => void exit(1) });
+  process.on("SIGTERM", () => void exit(0));
+  process.on("SIGINT", () => void exit(0));
+  process.on("unhandledRejection", (reason) => {
+    process.stderr.write(`session-sender: unhandled error, continuing: ${String(reason)}
+`);
+  });
+  await new Promise(() => void 0);
+}
+
+export { runSessionSender, senderPidfile, startSessionSender };

package/dist/{chunk-XDDW4FRS.js → chunk-5FWNEQNZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WIOZAJ2W.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-WO2BXCTQ.js';
-import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-EMY4I27X.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-ZZXLM64C.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
+import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-7ZR5UPMB.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';

package/dist/{chunk-CHLVJNTE.js → chunk-6IYLDODX.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-W7UTFZDH.js';
-import { describeCallFailure } from './chunk-T52PKE2Y.js';
-import { WorkCommandError, getJson } from './chunk-RMAZ2NWA.js';
-import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
-import { builtinKind } from './chunk-3DD6AOWC.js';
-import { claudeCredential, CLAUDE_CREDENTIAL_VARIABLES } from './chunk-AUFG23AA.js';
+import { isPlaceholderCommand } from './chunk-6QWV3YDJ.js';
+import { describeCallFailure } from './chunk-E4PIFIC3.js';
+import { WorkCommandError, getJson } from './chunk-DGAIVMMN.js';
+import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
+import { builtinKind } from './chunk-DTXOJDEH.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-OD2VTIHN.js';
 import { signerFor } from './chunk-M5POMKKW.js';
 
 createRequire(import.meta.url);
@@ -27,6 +27,18 @@ function needsClaudeCredential(hooks) {
 var CREDENTIAL_FIX = "Run `claude setup-token`, then start the runner with CLAUDE_CODE_OAUTH_TOKEN set to the token it prints (or ANTHROPIC_API_KEY set to an API key), for example with EnvironmentFile= in the runner's systemd unit";
 function claudeCredentialCheck(env, options = {}) {
   const name = "Claude credential";
+  if (options.service !== void 0) {
+    const { unit, variables } = options.service;
+    if (variables.length === 0) {
+      return {
+        name,
+        status: "fail",
+        detail: `the service ${unit} has no Claude credential: neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set in its runner.env, so every build fails at provision as agent_credential_missing`,
+        fix: `${CREDENTIAL_FIX}, then restart the service: sudo systemctl restart ${unit}.`
+      };
+    }
+    return { name, status: "pass", detail: `${variables[0]} is set in the runner.env of the service ${unit}` };
+  }
   const held = claudeCredential(env);
   if (held === void 0) {
     return {

package/dist/{chunk-W7UTFZDH.js → chunk-6QWV3YDJ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RTXKYLCA.js';
-import { MIN_ENGINE_MAJOR } from './chunk-T52PKE2Y.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-AQ54MKSQ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E4PIFIC3.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-EGABNHZG.js → chunk-6ZZHWY2Z.js}

@@ -1,29 +1,105 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { applyContextProvenance, installScrubContext, prepareSessionForUpload, wholeSessionCounts, sliceTurnIo } from './chunk-ZOC7JSYC.js';
-import { LaunchFilter } from './chunk-BCJNHMZT.js';
+import { LaunchFilter } from './chunk-HHJDN6AU.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-WOBNRVQT.js';
-import { tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, SOURCE_ADAPTERS, EVENT_TYPES } from './chunk-EX6M5JPR.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-ZYHKJKSU.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-D6FXM5OW.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-DVDEBNQJ.js';
+import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-YNJEOGDL.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { signerFor, signRunnerRequest } from './chunk-M5POMKKW.js';
-import { writeSyncStatus, spoolDir } from './chunk-UFFXNXLQ.js';
+import { writeSyncStatus, spoolDir } from './chunk-JPR2WHHF.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
+import { execFileSync } from 'child_process';
+import { hostname, userInfo } from 'os';
 import { fileURLToPath } from 'url';
 import { createRequire as createRequire$1 } from 'module';
 
 createRequire(import.meta.url);
+function detectCi(env = process.env) {
+  return env.CI === "true" || env.CI === "1" || !!env.JENKINS_URL;
+}
+function gitGlobalConfig(key) {
+  try {
+    return execFileSync("git", ["config", "--global", key], { encoding: "utf8", timeout: 2e3 }).trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function installScrubContext(home, scrub) {
+  setCustomScrubbers(scrub);
+  setLocalIdentity({
+    name: gitGlobalConfig("user.name"),
+    email: gitGlobalConfig("user.email"),
+    username: (() => {
+      try {
+        return userInfo().username;
+      } catch {
+        return void 0;
+      }
+    })(),
+    hostname: (() => {
+      try {
+        return hostname();
+      } catch {
+        return void 0;
+      }
+    })(),
+    home
+  });
+}
+function applyContextProvenance(session, record) {
+  if (!record) return;
+  if (record.repository !== void 0) session.env.contextSourceRepo = record.repository;
+  if (record.ref !== void 0) session.env.contextSourceRef = record.ref;
+  if (record.sha !== null) session.env.contextSourceSha = record.sha;
+  session.env.contextSourceVerification = record.verification;
+}
+function prepareSessionForUpload(session, tier, envVars = process.env) {
+  setRepoRoot(resolveRepoIdentity(session.env.cwd).repoRoot);
+  scrubDeep(session);
+  session.workerKind ??= detectCi(envVars) ? "ci" : "seat";
+  return downconvertSession(session, tier);
+}
+var MAX_TOOL_IO_CHARS = 64e3;
+function sliceToolIo(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  if (typeof text !== "string" || text.length <= MAX_TOOL_IO_CHARS) return value;
+  return `${text.slice(0, MAX_TOOL_IO_CHARS)}\u2026[sliced: ${text.length} chars exceeded the sync per-call cap]`;
+}
+function sliceTurnIo(turn) {
+  return {
+    ...turn,
+    toolCalls: (turn.toolCalls ?? []).map((call) => ({
+      ...call,
+      ...call.input !== void 0 ? { input: sliceToolIo(call.input) } : {},
+      ...call.output !== void 0 ? { output: sliceToolIo(call.output) } : {}
+    }))
+  };
+}
+function wholeSessionCounts(turns) {
+  const allCalls = turns.flatMap((t) => t.toolCalls ?? []);
+  return {
+    // An index BOUND (`1 + max(turn.index)`), not the shipped turn count —
+    // turn indexes are not guaranteed dense from zero, and a late artifact
+    // anchored at its real turn index must still validate against the
+    // summary row this produces (see turnCountBound).
+    turns: turnCountBound(turns),
+    toolCalls: allCalls.length,
+    errors: allCalls.filter((c) => c.status === "error").length,
+    userTurns: turns.filter(isHumanUserTurn).length
+  };
+}
 var IRRELEVANT = /* @__PURE__ */ new Set(["__tests__", "__mocks__", "node_modules"]);
 function newestSourceMs(dir) {
   let newest = 0;
@@ -481,6 +557,8 @@ function retryAfterMs(response) {
 }
 var LiveUploader = class {
   constructor(opts) {
+    /** Set by `stop()`: no more debounce or retry waits, so what is pending is sent once and given up on. */
+    this.stopping = false;
     this.cycles = /* @__PURE__ */ new Map();
     /** Sessions this sender is done with: ended, or permanently rejected. The
      * daemon keeps mirroring a transcript after its session closes, and every
@@ -491,12 +569,31 @@ var LiveUploader = class {
      * every session, so the sender stops entirely for the rest of this
      * process rather than retrying session by session. */
     this.stopped = false;
+    this.warned = /* @__PURE__ */ new Set();
     this.home = opts.home;
     this.fetchImpl = opts.fetchImpl ?? fetch;
     this.sleepImpl = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.debounceMs = opts.debounceMs ?? DEFAULT_DEBOUNCE_MS;
     this.env = opts.env ?? process.env;
     this.stderr = opts.stderr ?? ((s) => void process.stderr.write(s));
+    this.build = opts.build;
+    this.onUnauthorized = opts.onUnauthorized;
+  }
+  /**
+   * Final pass for a build sender: sends what is pending now, without waiting out the debounce and without
+   * retrying a failed send, and resolves once every cycle has finished or `timeoutMs` has passed.
+   */
+  async stop(timeoutMs) {
+    this.stopping = true;
+    let timer;
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(resolve, timeoutMs);
+    });
+    try {
+      await Promise.race([this.flush(), expired]);
+    } finally {
+      clearTimeout(timer);
+    }
   }
   /** Called for every daemon `mirrored` event. Cheap and synchronous — the
    * actual read/send work happens on the debounced cycle. */
@@ -536,7 +633,7 @@ var LiveUploader = class {
       for (; ; ) {
         for (; ; ) {
           const generationAtWaitStart = cycle.generation;
-          await this.sleepImpl(this.debounceMs);
+          if (!this.stopping) await this.sleepImpl(this.debounceMs);
           if (cycle.generation !== generationAtWaitStart) continue;
           break;
         }
@@ -562,8 +659,21 @@ var LiveUploader = class {
     const priorEntry = state.sessions[key];
     if (priorEntry?.ended || priorEntry?.failed) return true;
     const cloudConfig = readCloudConfig(this.home);
-    if (cloudConfig.autoSync === false) return false;
-    if (!cloudConfig.url || !(cloudConfig.apiKey || cloudConfig.accountToken)) return false;
+    let destination;
+    if (this.build === void 0) {
+      if (cloudConfig.autoSync === false) return false;
+      if (!cloudConfig.url || !(cloudConfig.apiKey || cloudConfig.accountToken)) return false;
+    } else {
+      const url = this.env.OUTERLAYER_URL;
+      const credential = this.env.OUTERLAYER_API_KEY;
+      const appId = this.env.OUTERLAYER_APP_ID;
+      if (!url || !credential || !appId) {
+        this.warnOnce("incomplete", `live upload is idle: this build's environment lacks ${[!url && "OUTERLAYER_URL", !credential && "OUTERLAYER_API_KEY", !appId && "OUTERLAYER_APP_ID"].filter(Boolean).join(", ")}, so nothing streams until \`outerlayer sync\` runs.
+`);
+        return false;
+      }
+      destination = { ok: true, url, credential, appId, kind: "key" };
+    }
     const info = subagentInfo(mirrorPath);
     const tail = tailTranscript(mirrorPath, void 0, {
       isSubagent: info.isSubagent,
@@ -573,17 +683,16 @@ var LiveUploader = class {
     if (!tail.session) return false;
     const session = tail.session;
     enrichSessionRepo(session);
-    const destination = resolveGatewayCredentials({ home: this.home, env: {}, cwd: session.env.cwd ?? "/" });
+    destination ??= resolveGatewayCredentials({ home: this.home, env: {}, cwd: session.env.cwd ?? "/" });
     if (!destination.ok) return false;
-    const repoFilter = new RepoFilter(cloudConfig.repos);
-    if (!repoFilter.allows(session.env.gitRepo)) return false;
+    if (this.build === void 0 && !new RepoFilter(cloudConfig.repos).allows(session.env.gitRepo)) return false;
     const launchSpool = readLaunchSpoolState(this.home);
     if (!launchStatusIsDecisive(launchSpool)) return false;
-    const launchFilter = new LaunchFilter(launchSpool.ids);
+    const launchFilter = new LaunchFilter(launchSpool.ids, launchSpool.records, this.build);
     if (!launchFilter.allows(session)) return false;
     let tier;
     try {
-      tier = resolveTier(cloudConfig.tier);
+      tier = resolveTier(this.build === void 0 ? cloudConfig.tier : this.env.OUTERLAYER_TIER ?? cloudConfig.tier);
     } catch (err) {
       if (err instanceof SyncConfigError) return false;
       throw err;
@@ -613,6 +722,7 @@ var LiveUploader = class {
       const outcome = await this.sendWithRetry(endpoint, destination.credential, destination.appId, prepared.id, payload);
       if (outcome === "unauthorized") {
         this.stopped = true;
+        this.onUnauthorized?.();
         this.stderr(
           destination.credential.startsWith("olu_") ? `live upload stopped: the login was refused (expired or revoked). No session streams from this daemon until you run \`outerlayer login\` and it restarts.
 ` : `live upload stopped: the API key was refused. No session streams from this daemon until it restarts with a valid key.
@@ -620,8 +730,9 @@ var LiveUploader = class {
         );
         return true;
       }
+      if (outcome === "unreachable") return false;
       if (outcome === "rejected") {
-        const reason = "the server refused this delta permanently";
+        const reason = `the server refused this delta permanently${this.lastRejectStatus === void 0 ? "" : ` (HTTP ${this.lastRejectStatus})`}`;
         this.mergeSessionState(key, {
           ackedTurnIndex: currentAcked,
           failed: true,
@@ -654,6 +765,7 @@ var LiveUploader = class {
    * key bound to a host key is refused on every route unless that key signed the request. A login token is
    * never signed: only the saved factory key is bound to a host key. */
   async signatureHeaders(endpoint, body, credential) {
+    if (this.build !== void 0) return {};
     if (readCloudConfig(this.home).apiKey !== credential) return {};
     let signer;
     try {
@@ -664,6 +776,12 @@ var LiveUploader = class {
     if (signer === void 0) return {};
     return { ...await signRunnerRequest({ method: "POST", url: endpoint, body: new TextEncoder().encode(body), signer }) };
   }
+  /** Writes `message` the first time `key` is seen, so a condition that holds on every fire logs once. */
+  warnOnce(key, message) {
+    if (this.warned.has(key)) return;
+    this.warned.add(key);
+    this.stderr(message);
+  }
   /** Sends one request, retrying a network error or a retryable 5xx forever
    * with exponential backoff (2s → 60s cap) — the daemon runs unattended, so
    * there is no bounded attempt count. A 401 or a permanent 4xx/rejection
@@ -673,6 +791,7 @@ var LiveUploader = class {
     let delayMs = RETRY_BASE_DELAY_MS;
     for (; ; ) {
       let response;
+      let failure = "";
       try {
         const signature = await this.signatureHeaders(endpoint, body, apiKey);
         response = await this.fetchImpl(endpoint, {
@@ -685,18 +804,30 @@ var LiveUploader = class {
           },
           body
         });
-      } catch {
+      } catch (err) {
         response = void 0;
+        failure = err instanceof Error ? err.message : String(err);
       }
       if (response) {
         if (response.status === 401) return "unauthorized";
         if (response.ok) {
           const accepted = await acceptedSessionIds(response);
-          if (accepted) return accepted.includes(sessionId) ? "accepted" : "rejected";
+          if (accepted) {
+            if (accepted.includes(sessionId)) return "accepted";
+            this.lastRejectStatus = void 0;
+            return "rejected";
+          }
         } else if (!RETRYABLE_STATUSES.has(response.status)) {
+          this.lastRejectStatus = response.status;
           return "rejected";
         }
       }
+      if (this.build !== void 0) {
+        const why = response === void 0 ? failure : `the gateway answered ${response.status}`;
+        this.stderr(`live upload of session ${sessionId} failed: ${why}${this.stopping ? "" : " \xB7 retrying"}
+`);
+      }
+      if (this.stopping) return "unreachable";
       await this.sleepImpl(Math.max(retryAfterMs(response), delayMs));
       delayMs = Math.min(delayMs * 2, RETRY_MAX_DELAY_MS);
     }
@@ -1683,4 +1814,4 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting
   }
 }
 
-export { CHUNK_PART_TARGET_BYTES, LiveUploader, RETRYABLE_STATUSES, SyncConfigError, SyncTransportError, isLoopbackUrl, resolveTier, runSync, staleBuildRefusal, staleBuildWarning };
+export { CHUNK_PART_TARGET_BYTES, LiveUploader, RETRYABLE_STATUSES, SyncConfigError, SyncTransportError, detectCi, installScrubContext, isLoopbackUrl, resolveTier, runSync, staleBuildRefusal, staleBuildWarning };

package/dist/{lima-XN65D7GN.js → chunk-77MM5RYD.js}

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import './chunk-Z5GEFMRW.js';
 import { spawnSync, spawn } from 'child_process';
 import { statSync, accessSync, constants } from 'fs';
 import { delimiter, resolve } from 'path';