@outerlayer/cli 0.7.0 → 0.8.1

package/dist/{chunk-AII7CKTH.js → chunk-5ODHQP6O.js}

@@ -1,25 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
-import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-TI7B7UEO.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-AJKEHABI.js';
+import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-QB5JQH5V.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
 import { RUNNER_PROTOCOL } from './chunk-AIW6GLET.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-6IYLDODX.js';
+import { placeholderQueues, placeholderProblem } from './chunk-Q4432IZT.js';
+import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { checkFit } from './chunk-OUUINEYB.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock, runnerLabelValue, BUILD_LABEL, RUNNER_LABEL } from './chunk-E4PIFIC3.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-M4ERCYDB.js';
+import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-774HEQL6.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-DGAIVMMN.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-DTXOJDEH.js';
-import { exceedsDisk } from './chunk-F6GFZXZ3.js';
+import { spawnRun } from './chunk-TEKZRTM3.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-2BRSMBBB.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KV47VQJZ.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-PWBILI5P.js';
+import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-OD2VTIHN.js';
 import { parseClaimIdentity } from './chunk-HKMPVPO7.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-M5POMKKW.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-V7NIVOFD.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-ZM2IMMYN.js';
 import { HOOKS_DIR_NAME, writeCommitHooks } from './chunk-XCCLFVXM.js';
 import { randomBytes } from 'crypto';
@@ -37,7 +39,7 @@ function openKvm() {
   }
 }
 function realBlockedProbes() {
-  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem };
+  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown" };
 }
 var DEFAULT_BUILD_MEMORY = "8g";
 function checkBlocked(config, probes) {
@@ -61,6 +63,13 @@ function checkBlocked(config, probes) {
       reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
     };
   }
+  if (kind === "container" || kind === "vm") {
+    const builder = probes.imageBuilder;
+    if (builder === "unknown") {
+      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
+    }
+    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
+  }
   if (kind !== "own" && claudeCredential(probes.env) === void 0) {
     return {
       reason: "there is no Claude credential in the runner's environment. Put CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY in the runner.env beside the config, then restart the service"
@@ -181,133 +190,6 @@ function writeLastUpdate(configPath, update) {
 `, { mode: RUNNER_FILE_MODE });
   renameSync(temporary, path);
 }
-
-// src/runner/update/version-order.ts
-function parse(version) {
-  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(version);
-  if (match === null) return void 0;
-  return { core: [Number(match[1]), Number(match[2]), Number(match[3])], pre: match[4] };
-}
-function comparePre(a, b) {
-  const left = a.split(".");
-  const right = b.split(".");
-  for (let i = 0; i < Math.max(left.length, right.length); i++) {
-    const x = left[i];
-    const y = right[i];
-    if (x === void 0) return -1;
-    if (y === void 0) return 1;
-    const xNum = /^\d+$/.test(x);
-    const yNum = /^\d+$/.test(y);
-    if (xNum && yNum) {
-      const difference = Number(x) - Number(y);
-      if (difference !== 0) return Math.sign(difference);
-    } else if (xNum !== yNum) {
-      return xNum ? -1 : 1;
-    } else if (x < y) {
-      return -1;
-    } else if (x > y) {
-      return 1;
-    }
-  }
-  return 0;
-}
-function compareVersions(a, b) {
-  const left = parse(a);
-  const right = parse(b);
-  if (left === void 0 || right === void 0) return void 0;
-  for (let i = 0; i < 3; i++) {
-    const difference = left.core[i] - right.core[i];
-    if (difference !== 0) return Math.sign(difference);
-  }
-  if (left.pre === right.pre) return 0;
-  if (left.pre === void 0) return 1;
-  if (right.pre === void 0) return -1;
-  return comparePre(left.pre, right.pre);
-}
-function compareCores(a, b) {
-  for (let i = 0; i < 3; i++) {
-    const difference = a[i] - b[i];
-    if (difference !== 0) return Math.sign(difference);
-  }
-  return 0;
-}
-function parsePartial(text) {
-  if (text === "" || text === "*" || text === "x" || text === "X") return [];
-  const match = /^v?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?$/.exec(text);
-  if (match === null) return void 0;
-  const numbers = [];
-  for (const part of [match[1], match[2], match[3]]) {
-    if (part === void 0 || !/^\d+$/.test(part)) break;
-    numbers.push(Number(part));
-  }
-  return numbers;
-}
-function bumpLast(numbers) {
-  const core = [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
-  const last = numbers.length - 1;
-  core[last] = core[last] + 1;
-  for (let i = last + 1; i < 3; i++) core[i] = 0;
-  return core;
-}
-function fill(numbers) {
-  return [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
-}
-function meets(version, comparator) {
-  const match = /^(>=|<=|>|<|=|\^|~)?(.*)$/.exec(comparator);
-  const op = match[1] ?? "";
-  const numbers = parsePartial(match[2]);
-  if (numbers === void 0) return void 0;
-  if (numbers.length === 0) return op === "" || op === "=" || op === ">=" || op === "<=" ? true : void 0;
-  const low = fill(numbers);
-  const whole = numbers.length === 3;
-  switch (op) {
-    case ">=":
-      return compareCores(version, low) >= 0;
-    case ">":
-      return whole ? compareCores(version, low) > 0 : compareCores(version, bumpLast(numbers)) >= 0;
-    case "<":
-      return compareCores(version, low) < 0;
-    case "<=":
-      return whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0;
-    case "~":
-      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, Math.min(numbers.length, 2)))) < 0;
-    case "^": {
-      let pivot = numbers.findIndex((n) => n !== 0);
-      if (pivot === -1) pivot = numbers.length - 1;
-      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, pivot + 1))) < 0;
-    }
-    default:
-      return compareCores(version, low) >= 0 && (whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0);
-  }
-}
-function satisfiesRange(version, range) {
-  const parsed = parse(version.trim().replace(/^v/, ""));
-  if (parsed === void 0 || parsed.pre !== void 0) return void 0;
-  let anyUnreadable = false;
-  for (const alternative of range.split("||")) {
-    if (/\s-\s/.test(alternative)) {
-      anyUnreadable = true;
-      continue;
-    }
-    const comparators = alternative.trim().replace(/(>=|<=|>|<|=|\^|~)\s+/g, "$1").split(/\s+/).filter((c) => c !== "");
-    if (comparators.length === 0) comparators.push("*");
-    let all = true;
-    for (const comparator of comparators) {
-      const met = meets(parsed.core, comparator);
-      if (met === void 0) {
-        anyUnreadable = true;
-        all = false;
-        break;
-      }
-      if (!met) {
-        all = false;
-        break;
-      }
-    }
-    if (all) return true;
-  }
-  return anyUnreadable ? void 0 : false;
-}
 var RELEASE_REPOSITORY = "https://github.com/outerlayerai/outerlayer";
 var RELEASE_WORKFLOW_PATH = ".github/workflows/outerlayer-release.yml";
 var UpdateStepError = class extends Error {
@@ -580,6 +462,7 @@ function settleUpdate(args) {
 
 // src/runner/housekeeping/docker.ts
 var KIND_LABEL = "ai.outerlayer.kind";
+var NO_BUILDER = /no builder .* found/i;
 function failure(result, what) {
   return new Error(`${what}: ${result.stderr.trim() || `docker exited ${result.status}`}`);
 }
@@ -671,8 +554,13 @@ function createHousekeepingDocker(deps) {
       if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
     },
     async builderPrune(keepBytes) {
-      const result = await run("docker", ["builder", "prune", "--force", "--keep-storage", String(keepBytes)]);
-      if (result.status !== 0) throw failure(result, "docker builder prune");
+      const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
+      if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
+      const status = inspected.status === 0 ? /^Status:\s*(\S+)/m.exec(inspected.stdout)?.[1] : void 0;
+      if (status !== void 0 && status !== "running") return void 0;
+      const result = await run("docker", ["buildx", "prune", "--builder", deps.builder, "--force", "--max-used-space", String(keepBytes)]);
+      if (result.status !== 0 && (NO_BUILDER.test(result.stderr) || /driver not running/i.test(result.stderr))) return void 0;
+      if (result.status !== 0) throw failure(result, "docker buildx prune");
       return { freedBytes: parsePrunedBytes(result.stdout) };
     }
   };
@@ -842,8 +730,12 @@ async function runHousekeeping(options) {
     if (options.buildCacheMax !== "off") {
       try {
         const pruned = await docker.builderPrune(options.buildCacheMax);
-        freed += pruned.freedBytes;
-        log.line(`housekeeping: pruned the build cache down to ${formatBytes(options.buildCacheMax)}, freed ${formatBytes(pruned.freedBytes)}`);
+        if (pruned === void 0) {
+          log.line("housekeeping: the image builder is not running, so its build cache is left for a later pass");
+        } else {
+          freed += pruned.freedBytes;
+          log.line(`housekeeping: pruned the image builder's build cache down to ${formatBytes(options.buildCacheMax)}, freed ${formatBytes(pruned.freedBytes)}`);
+        }
       } catch (err) {
         log.error(`housekeeping: the build cache could not be pruned: ${describeCallFailure(err)}`);
       }
@@ -1137,10 +1029,39 @@ async function tick(state) {
   }
   await sendTickHeartbeat(state, state.lastWorkRequest);
 }
+function imageBuilderState(state) {
+  const kind = builtinKind(state.config.hooks.provision);
+  if (kind !== "container" && kind !== "vm") return "usable";
+  if (state.deps.container?.buildImage !== void 0 || state.deps.container?.imageHost !== void 0) return "usable";
+  const memory = state.config.build?.memory ?? "8g";
+  let probe = state.imageBuilder;
+  if (probe === void 0 || probe.memory !== memory) probe = state.imageBuilder = { memory, at: 0, running: false };
+  if (probe.result?.ok === true && !probe.running && probe.failures !== void 0 && ensureFailureCount() !== probe.failures) probe.result = void 0;
+  const nowMs = nowOf(state).getTime();
+  const recheckMs = 10 * 6e4;
+  const due = !probe.running && (probe.result === void 0 || !probe.result.ok || nowMs - probe.at >= recheckMs);
+  if (due) {
+    const checking = probe;
+    checking.running = true;
+    const spec = builderSpec(state.config.configPath, memory, state.deps.container?.hostEnv ?? process.env);
+    const check = state.deps.builderProbe ?? ((s) => ensureBuilder(spawnRun, s, { bootstrap: true }));
+    void check(spec).catch((err) => ({ ok: false, problem: `the image builder could not be checked: ${describeCallFailure(err)}` })).then((result2) => {
+      checking.result = result2;
+      checking.failures = ensureFailureCount();
+      checking.at = nowOf(state).getTime();
+      checking.running = false;
+      if (result2.ok && state.blocked !== void 0 && state.pollTimerSeconds !== void 0) void tick(state);
+    });
+  }
+  const result = probe.result;
+  if (result === void 0) return "unknown";
+  return result.ok ? "usable" : { problem: result.problem };
+}
 function holdWhenBlocked(state) {
   const probes = {
     ...realBlockedProbes(),
     ...state.deps.container?.hostEnv === void 0 ? {} : { env: state.deps.container.hostEnv },
+    ...state.deps.blocked?.imageBuilder === void 0 ? { imageBuilder: imageBuilderState(state) } : {},
     ...state.deps.blocked
   };
   const blocked = checkBlocked(state.config, probes);
@@ -1194,7 +1115,7 @@ async function housekeepingPass(state) {
   state.housekeepingRunning = true;
   try {
     state.deps.housekeeping ??= {};
-    state.deps.housekeeping.docker ??= createHousekeepingDocker({ runnerId: runnerLabelValue(state.config.configPath) });
+    state.deps.housekeeping.docker ??= createHousekeepingDocker({ runnerId: runnerLabelValue(state.config.configPath), builder: builderName(state.config.configPath) });
     const result = await runHousekeeping({
       configPath: state.config.configPath,
       keepDays: config.jobsKeepDays,
@@ -1268,7 +1189,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-6UMCFTAW.js');
+  const { postJson: postJson2 } = await import('./work-cmd-CNWPTH7W.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1992,7 +1913,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-ASZL5BEO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-GX5ND6RO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2034,6 +1955,8 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const adopted = { job, dirPath, lastRenewAtMs: nowMs(), cmd: null, cpuSample: null, ending: false };
     state.jobs.set(dirPath, adopted);
     if (job.container !== void 0) {
+      const cores = job.container.cpuset === void 0 ? void 0 : parseCpuList(job.container.cpuset);
+      if (cores !== void 0) runtimeOf(state).cpus.hold(job.container.buildId, cores);
       const tokens = buildTokensFor(state, adopted, job.item);
       runtimeOf(state).credentials.set(dirPath, tokens);
       await ensureTunnel(runtimeOf(state), job.container, dirPath, config, job.itemKey, job.branch);

package/dist/chunk-7RQ73DLO.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/container/disk.ts
+var UNITS = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 };
+function parseSize(text) {
+  const match = /^(\d+(?:\.\d+)?)([kKmMgG]?)$/.exec(text);
+  if (match === null) return void 0;
+  const bytes = Number(match[1]) * UNITS[match[2].toLowerCase()];
+  return bytes > 0 ? bytes : void 0;
+}
+function parseDuKilobytes(output) {
+  const match = /^(\d+)\s/.exec(output);
+  return match === null ? void 0 : Number(match[1]);
+}
+function exceedsDisk(usedKilobytes, limit) {
+  const bytes = parseSize(limit);
+  return usedKilobytes * 1024 > (bytes ?? Number.POSITIVE_INFINITY);
+}
+
+export { exceedsDisk, parseDuKilobytes, parseSize };

package/dist/{chunk-7FTNIAHS.js → chunk-AX23QKHS.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { runnerUnit, UNIT_MARKER } from './chunk-FBTE2A2X.js';
-import { checkFit } from './chunk-OUUINEYB.js';
-import { builtinKind } from './chunk-DTXOJDEH.js';
+import { checkFit } from './chunk-JKIWMRFH.js';
+import { builtinKind } from './chunk-PWBILI5P.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';
@@ -165,7 +165,11 @@ function installService(request, deps) {
 function ensureLoginTask(deps, unitName) {
   const tasks = deps.tasks;
   const name = taskNameFor(unitName);
-  const command = taskCommand(deps.distro ?? "Ubuntu");
+  if (deps.distro === void 0 || deps.distro === "") {
+    const manual2 = `from Windows, run: schtasks /Create /F /TN ${name} /SC ONLOGON /TR "${taskCommand("<distribution>")}", with the name \`wsl -l\` shows`;
+    return [`WSL_DISTRO_NAME is not set, as under sudo, so the scheduled task that starts WSL2 at login was not made: ${manual2}`];
+  }
+  const command = taskCommand(deps.distro);
   const manual = `from Windows, run: schtasks /Create /F /TN ${name} /SC ONLOGON /TR "${command}"`;
   if (tasks === void 0 || !tasks.available()) {
     return [`Windows interop is off, so the scheduled task that starts WSL2 at login was not made: ${manual}`];

package/dist/{chunk-6ZZHWY2Z.js → chunk-BF4KKEFY.js}

@@ -5,16 +5,16 @@ import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-ZYHKJKSU.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-D6FXM5OW.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-GAYWY4GI.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-YNJEOGDL.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
-import { signerFor, signRunnerRequest } from './chunk-M5POMKKW.js';
-import { writeSyncStatus, spoolDir } from './chunk-JPR2WHHF.js';
+import { signerFor, signRunnerRequest } from './chunk-V7NIVOFD.js';
+import { writeSyncStatus, spoolDir } from './chunk-KSLNQOOS.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-5FWNEQNZ.js → chunk-BQFNZOMQ.js}

@@ -4,7 +4,7 @@ import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-ZZXLM64C.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
 import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-7ZR5UPMB.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/chunk-CX22S5BA.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/image/pins.ts
+var CLAUDE_CODE_VERSION = "2.1.284";
+var DEFAULT_BASE_IMAGE = "ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3";
+var NODE_IMAGE = "node:22-bookworm-slim@sha256:43ac6c60b8f89723f746e8a92ce91abd5017e627ce1ddfe4238355d3a30b772c";
+var BUILDKIT_IMAGE = "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea";
+var GH_VERSION = "2.101.0";
+var GH_SHA256 = {
+  amd64: "9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8",
+  arm64: "b57e8063f18862647c9d22727c32e9da1b963f8bf9db648fe123a6975695640f"
+};
+var TINI_VERSION = "0.19.0";
+var TINI_SHA256 = {
+  amd64: "c5b0666b4cb676901f90dfcb37106783c5fe2077b04590973b885950611b30ee",
+  arm64: "eae1d3aa50c48fb23b8cbdf4e369d0910dfc538566bfd09df89a774aa84a48b9"
+};
+var MICROVM_ARCHES = ["x86_64"];
+function firecrackerArch(nodeArch) {
+  return nodeArch === "x64" ? "x86_64" : nodeArch === "arm64" ? "aarch64" : nodeArch;
+}
+var FIRECRACKER_VERSION = "1.13.1";
+var FIRECRACKER_SHA256 = {
+  x86_64: "59450b9171ff2ebdf2f9a25be3a248a7ba79fb6371aec51a9d6d8eefca7b4faf"
+};
+var FIRECRACKER_BINARY_SHA256 = {
+  x86_64: "7d3924e0c8761edafbf85cb2a94c268ffad249644a40fd02d4e15cde4c206f6e"
+};
+var GUEST_ASSETS_VERSION = "1";
+var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
+var GUEST_KERNEL_SHA256 = {
+  x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
+};
+var GUEST_HELPER_SHA256 = {
+  x86_64: "4175e89ae8cb633113b5f69ef8b6e206093954411fe53edf86357bc1b7e822f9"
+};
+function guestAssetsPinned(arch) {
+  const zero = "0".repeat(64);
+  return GUEST_KERNEL_SHA256[arch] !== zero && GUEST_HELPER_SHA256[arch] !== zero;
+}
+
+export { BUILDKIT_IMAGE, CLAUDE_CODE_VERSION, DEFAULT_BASE_IMAGE, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GH_SHA256, GH_VERSION, GUEST_ASSETS_BASE_URL, GUEST_ASSETS_VERSION, GUEST_HELPER_SHA256, GUEST_KERNEL_SHA256, MICROVM_ARCHES, NODE_IMAGE, TINI_SHA256, TINI_VERSION, firecrackerArch, guestAssetsPinned };

package/dist/{chunk-D6FXM5OW.js → chunk-GAYWY4GI.js}

@@ -21970,14 +21970,14 @@ var ModelRegistryImpl = class {
 };
 var models_default = {
   version: "1.0.0",
-  generatedAt: "2026-10-04T05:04:28.506Z",
+  generatedAt: "2026-10-05T04:49:52.578Z",
   sources: {
     litellm: {
-      fetchedAt: "2026-10-04T05:04:28.506Z",
+      fetchedAt: "2026-10-05T04:49:52.578Z",
       modelCount: 1887
     },
     openrouter: {
-      fetchedAt: "2026-10-04T05:04:28.506Z",
+      fetchedAt: "2026-10-05T04:49:52.578Z",
       modelCount: 198
     }
   },
@@ -43490,12 +43490,12 @@ var models_default = {
         "top_p"
       ],
       pricing: {
-        inputCostPerToken: 25e-8,
-        outputCostPerToken: 1e-6
+        inputCostPerToken: 29e-8,
+        outputCostPerToken: 114e-8
       },
       context: {
         maxInputTokens: 163840,
-        maxOutputTokens: 147456
+        maxOutputTokens: 115200
       },
       capabilities: {
         functionCalling: true,
@@ -52756,8 +52756,8 @@ var models_default = {
         "max_tokens"
       ],
       pricing: {
-        inputCostPerToken: 4e-6,
-        outputCostPerToken: 2e-5
+        inputCostPerToken: 2e-6,
+        outputCostPerToken: 1e-5
       },
       context: {
         maxInputTokens: 105e4,

package/dist/{chunk-MQPRB5K7.js → chunk-HSN5QNS5.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-DGAIVMMN.js';
-import { isLinkedRepository } from './chunk-SSU747O6.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-KV47VQJZ.js';
+import { isLinkedRepository } from './chunk-ILEA3YHM.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-D6FXM5OW.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-GAYWY4GI.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
 import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-ZZXLM64C.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-JPR2WHHF.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-KSLNQOOS.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1004,7 +1004,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-I3TVFYLH.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-Z3USDBLU.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-FVDT3KJZ.js');
+    const { runnerHostChecks } = await import('./doctor-KALLPCRB.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1051,7 +1051,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync2 } = await import('fs');
       if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-XAUSB7L3.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-NMAPLLBQ.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-FHTVJZS6.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();