@outerlayer/cli 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @outerlayer/cli
 
+## 0.7.0
+
+### Minor Changes
+
+- b4fdd73: The runner now runs a repository's `where: host` validators itself after a build, in a new container from the build's image, and records each result under the host's own key. A check that cannot run is recorded as a fail with a reason. `runner.checks.timeLimitMinutes` (default 10, 1 to 240) bounds the environment setup and each check command. The runner CLI is not updated for you on a host with `runner.autoUpdate` off: refresh it by hand on each host to get host checks.
+
+### Patch Changes
+
+- 35b0fed: Fixes found by running the runner service on real machines:
+
+  - A repository fetch with a claim's read token keeps the git settings the host passes in `GIT_CONFIG_*`, such as one in `runner.env`. It added the token over them.
+  - `runner install --service --user <account>` refuses when that account cannot execute the Node the install runs on, or read the runner's CLI, instead of installing a service that cannot start.
+  - A microVM the kernel kills at its memory limit while it is still starting is released with a reason saying the build ran out of memory, not that the microVM did not start.
+  - A microVM build's cgroup reclaims above `build.memory` plus 256 MiB and kills above `build.memory` plus 1 GiB. A real build was killed at plus 256 MiB, because the page cache of its disks' writes is charged to the same cgroup.
+
+- f633a70: The template build skill's `record-criteria.mjs` now records a criterion that declares `(proof: test)` with proof `test`. Test results for that criterion now count toward it.
+- 735d939: `work` and `emit` commands now connect the repository themselves when you are logged in, the repository has no saved connection, and exactly one factory fits. They print one line naming the factory and why, save the connection, and carry on. When several factories fit, they refuse and list the `--factory` value for each.
+
 ## 0.6.0
 
 ### Minor Changes

package/README.md

@@ -101,6 +101,12 @@ content:
   work — success, or the error code and message the platform returned.
   When a build's command exits 0, it reads that work item once more, for its
   evidence verdict, before releasing it: it sends nothing but the request.
+  Just before that read, the runner runs the repository's host checks. A host
+  check is a command the repository's `where: host` validators declare. The
+  runner reads the definitions with the host's own git credentials, runs each
+  command in a new container, and sends one `POST /v1/emitted-results` for
+  each: the check's name, pass or fail, and for a fail the exit status and the
+  last line of its output, scrubbed.
   Before a build's command starts, the runner also runs `git ls-remote` and
   `git fetch` in the job's workdir, with the host's own git credentials, to
   put it on the branch the claim named. Nothing about the job leaves the host
@@ -133,6 +139,10 @@ content:
   never printed. If this machine held a token from an earlier login, login
   asks the dashboard to revoke it. A key piped on stdin makes no network
   call.
+- **`outerlayer work`** and **`outerlayer emit`**, in the subcommands named below, with a login and no saved
+  connection for the repository send the same `GET /v1/me/factories?repository=<host/owner/name>`
+  request before their own, to connect the repository when exactly one factory
+  fits. They send nothing extra with a factory key, `--app-id` or `OUTERLAYER_APP_ID`. The subcommands are `work build`, `list`, `status`, `remove` and `pr`, and `emit artifact`, `result`, `criteria`, `finding` and `findings`. Other `work` subcommands never connect.
 - **`outerlayer connect`**, and the first step of `outerlayer init`, send a
   request with your login's token: `GET /v1/me/factories?repository=<host/owner/name>`,
   naming this checkout's remote. The gateway answers with the factories you can

package/dist/{agent-setup-USZ2SAXC.js → agent-setup-TXLDY5RV.js}

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { installStarterPack } from './chunk-ZMYPLFG3.js';
-import { runEmit } from './chunk-H5NCNVDA.js';
+import { installStarterPack } from './chunk-M3SQ4YGD.js';
+import { runEmit } from './chunk-EV3M3EH7.js';
 import { addStdioMcpEntryIfAbsent } from './chunk-MQ3IPHIZ.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-OIRNH6UO.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
-import { pinExists, readContextManifest } from './chunk-WIOZAJ2W.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-WO2BXCTQ.js';
-import { generatedHeaderSource } from './chunk-EMY4I27X.js';
+import { pinExists, readContextManifest } from './chunk-ZZXLM64C.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-VXLJORHL.js';
+import { generatedHeaderSource } from './chunk-7ZR5UPMB.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M5POMKKW.js';

package/dist/{build-PAEKVYVK.js → build-JF5UOWKJ.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-Z62HNKEJ.js';
+export { buildRepositoryImage } from './chunk-CEBIA5FD.js';
 import './chunk-N5FOE5PS.js';
 export { RecipeError } from './chunk-QOZKPLVJ.js';
+import './chunk-HKMPVPO7.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-04T12:35:01.048Z+a19ef31","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-05T00:52:06.865Z+90312df","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-CCVPBN7A.js → check-ASZL5BEO.js}

@@ -1,55 +1,61 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-43J3M6KB.js';
+import { probeCredentials } from './chunk-AII7CKTH.js';
 import './chunk-ABIWDUMS.js';
-import './chunk-YYYXRJUW.js';
-import './chunk-VMJ3MMBX.js';
+import './chunk-TI7B7UEO.js';
+import './chunk-AJKEHABI.js';
 import './chunk-T6OIJQRT.js';
 import './chunk-AIW6GLET.js';
 import './chunk-UGP76IZ5.js';
-import './chunk-ZILGTTY6.js';
-import './chunk-CBPPJSAR.js';
-import './chunk-UMFWVGJO.js';
+import './chunk-2VO25HHO.js';
+import './chunk-WVGSB3Z2.js';
+import './chunk-6ZZHWY2Z.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-MXB5VB4Y.js';
+import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-6IYLDODX.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
+import './chunk-6QWV3YDJ.js';
 import './chunk-OUUINEYB.js';
-import './chunk-4NLKY4WR.js';
-import './chunk-RBOMWNOG.js';
-import './chunk-RZSF5B46.js';
-import './chunk-Z62HNKEJ.js';
+import './chunk-AQ54MKSQ.js';
+import './chunk-E4PIFIC3.js';
+import './chunk-CEBIA5FD.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-774HEQL6.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-W4SQCOZU.js';
-import './chunk-B2G7JHHB.js';
+import './chunk-ZOAEPWGL.js';
+import './chunk-R7STSBLC.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-BNMCXPG7.js';
+import './chunk-DGAIVMMN.js';
+import './chunk-PUN7LMNS.js';
 import './chunk-BFESLKPP.js';
-import './chunk-3DEVYTNQ.js';
-import './chunk-ANK2B36Y.js';
+import './chunk-SSU747O6.js';
+import './chunk-ZYHKJKSU.js';
+import './chunk-D6FXM5OW.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-3DD6AOWC.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-DTXOJDEH.js';
 import './chunk-F6GFZXZ3.js';
-import './chunk-AUFG23AA.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-OIRNH6UO.js';
+import './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-WIOZAJ2W.js';
-import './chunk-WO2BXCTQ.js';
-import './chunk-EMY4I27X.js';
+import './chunk-ZZXLM64C.js';
+import './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-FA2BOX4O.js';
+import './chunk-JPR2WHHF.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{chunk-ZILGTTY6.js → chunk-2VO25HHO.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-UMFWVGJO.js';
-import { CaptureDaemon } from './chunk-ANK2B36Y.js';
+import { LiveUploader } from './chunk-6ZZHWY2Z.js';
+import { CaptureDaemon } from './chunk-D6FXM5OW.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-FA2BOX4O.js';
+import { spoolDir } from './chunk-JPR2WHHF.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-OIRNH6UO.js → chunk-5FWNEQNZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WIOZAJ2W.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-WO2BXCTQ.js';
-import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-EMY4I27X.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-ZZXLM64C.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
+import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-7ZR5UPMB.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';

package/dist/{chunk-MXB5VB4Y.js → chunk-6IYLDODX.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-4NLKY4WR.js';
-import { describeCallFailure } from './chunk-RZSF5B46.js';
-import { WorkCommandError, getJson } from './chunk-BNMCXPG7.js';
-import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
-import { builtinKind } from './chunk-3DD6AOWC.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-AUFG23AA.js';
+import { isPlaceholderCommand } from './chunk-6QWV3YDJ.js';
+import { describeCallFailure } from './chunk-E4PIFIC3.js';
+import { WorkCommandError, getJson } from './chunk-DGAIVMMN.js';
+import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
+import { builtinKind } from './chunk-DTXOJDEH.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-OD2VTIHN.js';
 import { signerFor } from './chunk-M5POMKKW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-4NLKY4WR.js → chunk-6QWV3YDJ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RBOMWNOG.js';
-import { MIN_ENGINE_MAJOR } from './chunk-RZSF5B46.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-AQ54MKSQ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E4PIFIC3.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-UMFWVGJO.js → chunk-6ZZHWY2Z.js}

@@ -4,16 +4,17 @@ import { LaunchFilter } from './chunk-HHJDN6AU.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-3DEVYTNQ.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, scrubDeep, downconvertSession, isHumanUserTurn, turnCountBound, SOURCE_ADAPTERS, EVENT_TYPES } from './chunk-ANK2B36Y.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-ZYHKJKSU.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-D6FXM5OW.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-YNJEOGDL.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { signerFor, signRunnerRequest } from './chunk-M5POMKKW.js';
-import { writeSyncStatus, spoolDir } from './chunk-FA2BOX4O.js';
+import { writeSyncStatus, spoolDir } from './chunk-JPR2WHHF.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-NQXFAGHU.js → chunk-7FTNIAHS.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { runnerUnit, UNIT_MARKER } from './chunk-FBTE2A2X.js';
 import { checkFit } from './chunk-OUUINEYB.js';
-import { builtinKind } from './chunk-3DD6AOWC.js';
+import { builtinKind } from './chunk-DTXOJDEH.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';