@outerlayer/cli 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @outerlayer/cli
 
+## 0.8.1
+
+### Patch Changes
+
+- 2bfa3a8: The `amend` skill now works in a build a runner started. It posts its closing report on the work item's general thread with `outerlayer work comment`, because a build's GitHub token cannot comment on the pull request. A local session posts the report there too, and still comments on the pull request. The SSH keep-alive advice for a dropped push now applies only to a local session pushing over SSH. Run `outerlayer context emit` to pick up the new copy.
+- d2ad3fc: A microVM build's root disk and build disk are made in containers held to `runner.build.memory`, with no swap, like the build's image builds. Docker runs those containers outside the runner's own cgroup, so nothing else limited them.
+- cf56a33: Three runner fixes:
+
+  - `outerlayer runner install` no longer moves a runner back to an older version. When the CLI you run is older than the version the runner updated itself to, the command refuses and names both versions. Run `~/.local/bin/outerlayer runner install` instead, which runs the newer version. Pass `--allow-downgrade` to install the older one on purpose. `runner install --service` and `runner init` refuse the same way.
+  - Housekeeping no longer logs an error when the runner's image builder has not started yet. It leaves the build cache for a later pass and logs that it did.
+  - A container build now sees only its own CPU cores: `runner.build.cpus`, rounded up. `nproc` inside the build reports that count, not the host's. Builds running at once get different cores while the host has enough. `runner.build.cpus` stays the limit.
+
+- 857e376: Update the bundled `structured-headers` library from 2.0.3 to 2.1.0. The runner uses it to sign its requests to the gateway; signed requests are unchanged.
+
 ## 0.8.0
 
 ### Minor Changes

package/dist/{agent-setup-C7PLRXZO.js → agent-setup-K6RD2Z4P.js}

@@ -4,17 +4,17 @@ import { addStdioMcpEntryIfAbsent } from './chunk-MQ3IPHIZ.js';
 import { installStarterPack } from './chunk-M3SQ4YGD.js';
 import { runEmit } from './chunk-EV3M3EH7.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-5FWNEQNZ.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-BQFNZOMQ.js';
 import './chunk-ZJSNLVCE.js';
 import { pinExists, readContextManifest } from './chunk-ZZXLM64C.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-VXLJORHL.js';
 import { generatedHeaderSource } from './chunk-7ZR5UPMB.js';
-import './chunk-BCLJSQCV.js';
+import './chunk-YO4PSLVB.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
-import './chunk-M5POMKKW.js';
+import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-05T12:31:55.812Z+ff35a38","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-05T15:51:32.122Z+87b226c","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-G52A6GW2.js → builder-IG6FNA54.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-5TNS3PL7.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-2BRSMBBB.js';
 import './chunk-CX22S5BA.js';
 import './chunk-GAYWY4GI.js';
 import './chunk-7RQ73DLO.js';

package/dist/{check-FOF3PUKI.js → check-GX5ND6RO.js}

@@ -1,35 +1,36 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-IJBVPLZZ.js';
+import { probeCredentials } from './chunk-5ODHQP6O.js';
 import './chunk-ABIWDUMS.js';
-import './chunk-7VNURP6M.js';
+import './chunk-I2UOAV7X.js';
+import './chunk-QB5JQH5V.js';
 import './chunk-T6OIJQRT.js';
 import './chunk-AIW6GLET.js';
 import './chunk-UGP76IZ5.js';
-import './chunk-3S4P55NE.js';
+import './chunk-4FPWKV7L.js';
 import './chunk-WVGSB3Z2.js';
-import './chunk-AIL2R4SI.js';
+import './chunk-BF4KKEFY.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-IRCBTGWF.js';
+import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-Q4432IZT.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-NALVDFIS.js';
-import './chunk-TUUMW4TC.js';
-import './chunk-CM5QTKM4.js';
+import './chunk-Z2THOHPP.js';
+import './chunk-QNRSFEGY.js';
+import './chunk-M4ERCYDB.js';
 import './chunk-JKIWMRFH.js';
 import './chunk-TTNFGMHO.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-U3GOI2B4.js';
+import './chunk-TEKZRTM3.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-5TNS3PL7.js';
+import './chunk-2BRSMBBB.js';
 import './chunk-CX22S5BA.js';
 import './chunk-ZOAEPWGL.js';
 import './chunk-R7STSBLC.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-5QLNZGAQ.js';
+import './chunk-KV47VQJZ.js';
 import './chunk-4ACZCY4I.js';
 import './chunk-BFESLKPP.js';
 import './chunk-ILEA3YHM.js';
@@ -46,19 +47,19 @@ import './chunk-HKMPVPO7.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-5FWNEQNZ.js';
+import './chunk-BQFNZOMQ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-ZZXLM64C.js';
 import './chunk-VXLJORHL.js';
 import './chunk-7ZR5UPMB.js';
-import './chunk-BCLJSQCV.js';
+import './chunk-YO4PSLVB.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
-import './chunk-M5POMKKW.js';
+import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-JPR2WHHF.js';
+import './chunk-KSLNQOOS.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{chunk-5TNS3PL7.js → chunk-2BRSMBBB.js}

@@ -27,7 +27,7 @@ function runnerLabelValue(configPath) {
   return createHash("sha256").update(resolvedRunnerDir(configPath)).digest("hex").slice(0, 12);
 }
 function hardened(input) {
-  const { memory, cpus, pids } = input.limits;
+  const { memory, cpus, pids, cpuset } = input.limits;
   return [
     "--label",
     `${BUILD_LABEL}=${input.buildId}`,
@@ -49,6 +49,7 @@ function hardened(input) {
     memory,
     "--cpus",
     String(cpus),
+    ...cpuset === void 0 ? [] : ["--cpuset-cpus", cpuset],
     "--pids-limit",
     String(pids)
   ];

package/dist/{chunk-3S4P55NE.js → chunk-4FPWKV7L.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-AIL2R4SI.js';
+import { LiveUploader } from './chunk-BF4KKEFY.js';
 import { CaptureDaemon } from './chunk-GAYWY4GI.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-JPR2WHHF.js';
+import { spoolDir } from './chunk-KSLNQOOS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-IJBVPLZZ.js → chunk-5ODHQP6O.js}

@@ -1,26 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-7VNURP6M.js';
+import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-QB5JQH5V.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
 import { RUNNER_PROTOCOL } from './chunk-AIW6GLET.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-IRCBTGWF.js';
+import { placeholderQueues, placeholderProblem } from './chunk-Q4432IZT.js';
 import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-CM5QTKM4.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-M4ERCYDB.js';
 import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-U3GOI2B4.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-5TNS3PL7.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-5QLNZGAQ.js';
+import { spawnRun } from './chunk-TEKZRTM3.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-2BRSMBBB.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KV47VQJZ.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-PWBILI5P.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-OD2VTIHN.js';
 import { parseClaimIdentity } from './chunk-HKMPVPO7.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-M5POMKKW.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-V7NIVOFD.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-ZM2IMMYN.js';
 import { HOOKS_DIR_NAME, writeCommitHooks } from './chunk-XCCLFVXM.js';
 import { randomBytes } from 'crypto';
@@ -189,133 +190,6 @@ function writeLastUpdate(configPath, update) {
 `, { mode: RUNNER_FILE_MODE });
   renameSync(temporary, path);
 }
-
-// src/runner/update/version-order.ts
-function parse(version) {
-  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(version);
-  if (match === null) return void 0;
-  return { core: [Number(match[1]), Number(match[2]), Number(match[3])], pre: match[4] };
-}
-function comparePre(a, b) {
-  const left = a.split(".");
-  const right = b.split(".");
-  for (let i = 0; i < Math.max(left.length, right.length); i++) {
-    const x = left[i];
-    const y = right[i];
-    if (x === void 0) return -1;
-    if (y === void 0) return 1;
-    const xNum = /^\d+$/.test(x);
-    const yNum = /^\d+$/.test(y);
-    if (xNum && yNum) {
-      const difference = Number(x) - Number(y);
-      if (difference !== 0) return Math.sign(difference);
-    } else if (xNum !== yNum) {
-      return xNum ? -1 : 1;
-    } else if (x < y) {
-      return -1;
-    } else if (x > y) {
-      return 1;
-    }
-  }
-  return 0;
-}
-function compareVersions(a, b) {
-  const left = parse(a);
-  const right = parse(b);
-  if (left === void 0 || right === void 0) return void 0;
-  for (let i = 0; i < 3; i++) {
-    const difference = left.core[i] - right.core[i];
-    if (difference !== 0) return Math.sign(difference);
-  }
-  if (left.pre === right.pre) return 0;
-  if (left.pre === void 0) return 1;
-  if (right.pre === void 0) return -1;
-  return comparePre(left.pre, right.pre);
-}
-function compareCores(a, b) {
-  for (let i = 0; i < 3; i++) {
-    const difference = a[i] - b[i];
-    if (difference !== 0) return Math.sign(difference);
-  }
-  return 0;
-}
-function parsePartial(text) {
-  if (text === "" || text === "*" || text === "x" || text === "X") return [];
-  const match = /^v?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?$/.exec(text);
-  if (match === null) return void 0;
-  const numbers = [];
-  for (const part of [match[1], match[2], match[3]]) {
-    if (part === void 0 || !/^\d+$/.test(part)) break;
-    numbers.push(Number(part));
-  }
-  return numbers;
-}
-function bumpLast(numbers) {
-  const core = [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
-  const last = numbers.length - 1;
-  core[last] = core[last] + 1;
-  for (let i = last + 1; i < 3; i++) core[i] = 0;
-  return core;
-}
-function fill(numbers) {
-  return [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
-}
-function meets(version, comparator) {
-  const match = /^(>=|<=|>|<|=|\^|~)?(.*)$/.exec(comparator);
-  const op = match[1] ?? "";
-  const numbers = parsePartial(match[2]);
-  if (numbers === void 0) return void 0;
-  if (numbers.length === 0) return op === "" || op === "=" || op === ">=" || op === "<=" ? true : void 0;
-  const low = fill(numbers);
-  const whole = numbers.length === 3;
-  switch (op) {
-    case ">=":
-      return compareCores(version, low) >= 0;
-    case ">":
-      return whole ? compareCores(version, low) > 0 : compareCores(version, bumpLast(numbers)) >= 0;
-    case "<":
-      return compareCores(version, low) < 0;
-    case "<=":
-      return whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0;
-    case "~":
-      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, Math.min(numbers.length, 2)))) < 0;
-    case "^": {
-      let pivot = numbers.findIndex((n) => n !== 0);
-      if (pivot === -1) pivot = numbers.length - 1;
-      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, pivot + 1))) < 0;
-    }
-    default:
-      return compareCores(version, low) >= 0 && (whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0);
-  }
-}
-function satisfiesRange(version, range) {
-  const parsed = parse(version.trim().replace(/^v/, ""));
-  if (parsed === void 0 || parsed.pre !== void 0) return void 0;
-  let anyUnreadable = false;
-  for (const alternative of range.split("||")) {
-    if (/\s-\s/.test(alternative)) {
-      anyUnreadable = true;
-      continue;
-    }
-    const comparators = alternative.trim().replace(/(>=|<=|>|<|=|\^|~)\s+/g, "$1").split(/\s+/).filter((c) => c !== "");
-    if (comparators.length === 0) comparators.push("*");
-    let all = true;
-    for (const comparator of comparators) {
-      const met = meets(parsed.core, comparator);
-      if (met === void 0) {
-        anyUnreadable = true;
-        all = false;
-        break;
-      }
-      if (!met) {
-        all = false;
-        break;
-      }
-    }
-    if (all) return true;
-  }
-  return anyUnreadable ? void 0 : false;
-}
 var RELEASE_REPOSITORY = "https://github.com/outerlayerai/outerlayer";
 var RELEASE_WORKFLOW_PATH = ".github/workflows/outerlayer-release.yml";
 var UpdateStepError = class extends Error {
@@ -588,6 +462,7 @@ function settleUpdate(args) {
 
 // src/runner/housekeeping/docker.ts
 var KIND_LABEL = "ai.outerlayer.kind";
+var NO_BUILDER = /no builder .* found/i;
 function failure(result, what) {
   return new Error(`${what}: ${result.stderr.trim() || `docker exited ${result.status}`}`);
 }
@@ -679,8 +554,12 @@ function createHousekeepingDocker(deps) {
       if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
     },
     async builderPrune(keepBytes) {
+      const inspected = await run("docker", ["buildx", "inspect", deps.builder]);
+      if (inspected.status !== 0 && NO_BUILDER.test(inspected.stderr)) return void 0;
+      const status = inspected.status === 0 ? /^Status:\s*(\S+)/m.exec(inspected.stdout)?.[1] : void 0;
+      if (status !== void 0 && status !== "running") return void 0;
       const result = await run("docker", ["buildx", "prune", "--builder", deps.builder, "--force", "--max-used-space", String(keepBytes)]);
-      if (result.status !== 0 && /no builder .* found/i.test(result.stderr)) return { freedBytes: 0 };
+      if (result.status !== 0 && (NO_BUILDER.test(result.stderr) || /driver not running/i.test(result.stderr))) return void 0;
       if (result.status !== 0) throw failure(result, "docker buildx prune");
       return { freedBytes: parsePrunedBytes(result.stdout) };
     }
@@ -851,8 +730,12 @@ async function runHousekeeping(options) {
     if (options.buildCacheMax !== "off") {
       try {
         const pruned = await docker.builderPrune(options.buildCacheMax);
-        freed += pruned.freedBytes;
-        log.line(`housekeeping: pruned the image builder's build cache down to ${formatBytes(options.buildCacheMax)}, freed ${formatBytes(pruned.freedBytes)}`);
+        if (pruned === void 0) {
+          log.line("housekeeping: the image builder is not running, so its build cache is left for a later pass");
+        } else {
+          freed += pruned.freedBytes;
+          log.line(`housekeeping: pruned the image builder's build cache down to ${formatBytes(options.buildCacheMax)}, freed ${formatBytes(pruned.freedBytes)}`);
+        }
       } catch (err) {
         log.error(`housekeeping: the build cache could not be pruned: ${describeCallFailure(err)}`);
       }
@@ -1306,7 +1189,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-B3FOXZAL.js');
+  const { postJson: postJson2 } = await import('./work-cmd-CNWPTH7W.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2030,7 +1913,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-FOF3PUKI.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-GX5ND6RO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2072,6 +1955,8 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const adopted = { job, dirPath, lastRenewAtMs: nowMs(), cmd: null, cpuSample: null, ending: false };
     state.jobs.set(dirPath, adopted);
     if (job.container !== void 0) {
+      const cores = job.container.cpuset === void 0 ? void 0 : parseCpuList(job.container.cpuset);
+      if (cores !== void 0) runtimeOf(state).cpus.hold(job.container.buildId, cores);
       const tokens = buildTokensFor(state, adopted, job.item);
       runtimeOf(state).credentials.set(dirPath, tokens);
       await ensureTunnel(runtimeOf(state), job.container, dirPath, config, job.itemKey, job.branch);

package/dist/{chunk-AIL2R4SI.js → chunk-BF4KKEFY.js}

@@ -9,12 +9,12 @@ import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo
 import { C } from './chunk-YRYMNBGQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-YNJEOGDL.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
-import { signerFor, signRunnerRequest } from './chunk-M5POMKKW.js';
-import { writeSyncStatus, spoolDir } from './chunk-JPR2WHHF.js';
+import { signerFor, signRunnerRequest } from './chunk-V7NIVOFD.js';
+import { writeSyncStatus, spoolDir } from './chunk-KSLNQOOS.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-5FWNEQNZ.js → chunk-BQFNZOMQ.js}

@@ -4,7 +4,7 @@ import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-ZZXLM64C.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
 import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-7ZR5UPMB.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-4A5E2G4E.js → chunk-HSN5QNS5.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-5QLNZGAQ.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-KV47VQJZ.js';
 import { isLinkedRepository } from './chunk-ILEA3YHM.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-GAYWY4GI.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
 import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-ZZXLM64C.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-JPR2WHHF.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-KSLNQOOS.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-WR6TRPSU.js');
+    const { runnerHostChecks } = await import('./doctor-KALLPCRB.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/chunk-I2UOAV7X.js

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/update/version-order.ts
+function parse(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(version);
+  if (match === null) return void 0;
+  return { core: [Number(match[1]), Number(match[2]), Number(match[3])], pre: match[4] };
+}
+function comparePre(a, b) {
+  const left = a.split(".");
+  const right = b.split(".");
+  for (let i = 0; i < Math.max(left.length, right.length); i++) {
+    const x = left[i];
+    const y = right[i];
+    if (x === void 0) return -1;
+    if (y === void 0) return 1;
+    const xNum = /^\d+$/.test(x);
+    const yNum = /^\d+$/.test(y);
+    if (xNum && yNum) {
+      const difference = Number(x) - Number(y);
+      if (difference !== 0) return Math.sign(difference);
+    } else if (xNum !== yNum) {
+      return xNum ? -1 : 1;
+    } else if (x < y) {
+      return -1;
+    } else if (x > y) {
+      return 1;
+    }
+  }
+  return 0;
+}
+function compareVersions(a, b) {
+  const left = parse(a);
+  const right = parse(b);
+  if (left === void 0 || right === void 0) return void 0;
+  for (let i = 0; i < 3; i++) {
+    const difference = left.core[i] - right.core[i];
+    if (difference !== 0) return Math.sign(difference);
+  }
+  if (left.pre === right.pre) return 0;
+  if (left.pre === void 0) return 1;
+  if (right.pre === void 0) return -1;
+  return comparePre(left.pre, right.pre);
+}
+function compareCores(a, b) {
+  for (let i = 0; i < 3; i++) {
+    const difference = a[i] - b[i];
+    if (difference !== 0) return Math.sign(difference);
+  }
+  return 0;
+}
+function parsePartial(text) {
+  if (text === "" || text === "*" || text === "x" || text === "X") return [];
+  const match = /^v?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?$/.exec(text);
+  if (match === null) return void 0;
+  const numbers = [];
+  for (const part of [match[1], match[2], match[3]]) {
+    if (part === void 0 || !/^\d+$/.test(part)) break;
+    numbers.push(Number(part));
+  }
+  return numbers;
+}
+function bumpLast(numbers) {
+  const core = [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
+  const last = numbers.length - 1;
+  core[last] = core[last] + 1;
+  for (let i = last + 1; i < 3; i++) core[i] = 0;
+  return core;
+}
+function fill(numbers) {
+  return [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
+}
+function meets(version, comparator) {
+  const match = /^(>=|<=|>|<|=|\^|~)?(.*)$/.exec(comparator);
+  const op = match[1] ?? "";
+  const numbers = parsePartial(match[2]);
+  if (numbers === void 0) return void 0;
+  if (numbers.length === 0) return op === "" || op === "=" || op === ">=" || op === "<=" ? true : void 0;
+  const low = fill(numbers);
+  const whole = numbers.length === 3;
+  switch (op) {
+    case ">=":
+      return compareCores(version, low) >= 0;
+    case ">":
+      return whole ? compareCores(version, low) > 0 : compareCores(version, bumpLast(numbers)) >= 0;
+    case "<":
+      return compareCores(version, low) < 0;
+    case "<=":
+      return whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0;
+    case "~":
+      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, Math.min(numbers.length, 2)))) < 0;
+    case "^": {
+      let pivot = numbers.findIndex((n) => n !== 0);
+      if (pivot === -1) pivot = numbers.length - 1;
+      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, pivot + 1))) < 0;
+    }
+    default:
+      return compareCores(version, low) >= 0 && (whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0);
+  }
+}
+function satisfiesRange(version, range) {
+  const parsed = parse(version.trim().replace(/^v/, ""));
+  if (parsed === void 0 || parsed.pre !== void 0) return void 0;
+  let anyUnreadable = false;
+  for (const alternative of range.split("||")) {
+    if (/\s-\s/.test(alternative)) {
+      anyUnreadable = true;
+      continue;
+    }
+    const comparators = alternative.trim().replace(/(>=|<=|>|<|=|\^|~)\s+/g, "$1").split(/\s+/).filter((c) => c !== "");
+    if (comparators.length === 0) comparators.push("*");
+    let all = true;
+    for (const comparator of comparators) {
+      const met = meets(parsed.core, comparator);
+      if (met === void 0) {
+        anyUnreadable = true;
+        all = false;
+        break;
+      }
+      if (!met) {
+        all = false;
+        break;
+      }
+    }
+    if (all) return true;
+  }
+  return anyUnreadable ? void 0 : false;
+}
+
+export { compareVersions, satisfiesRange };

package/dist/{chunk-OEK4JEB3.js → chunk-I7CJIRMM.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { writeLauncher, LauncherWriteError, pathNotes, launcherPath } from './chunk-PTW6W5NR.js';
-import { isInLayout, packageRootIn, versionDir, switchCurrent, currentLink, execStartLine } from './chunk-TI7B7UEO.js';
+import { compareVersions } from './chunk-I2UOAV7X.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-PTW6W5NR.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-TI7B7UEO.js';
 import { RUNNER_DIR_MODE } from './chunk-ZM2IMMYN.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
@@ -9,6 +10,8 @@ import { dirname, sep, join } from 'path';
 createRequire(import.meta.url);
 var RunnerInstallError = class extends Error {
 };
+var RunnerDowngradeError = class extends RunnerInstallError {
+};
 function runRunnerInstall(args) {
   const { configPath, nodePath } = args;
   let entry;
@@ -32,6 +35,13 @@ function runRunnerInstall(args) {
   if (manifest.name !== "@outerlayer/cli") throw new RunnerInstallError(`${packageRoot} is not the @outerlayer/cli package`);
   const version = manifest.version;
   if (typeof version !== "string" || version === "") throw new RunnerInstallError(`${packageRoot}/package.json has no version`);
+  const installed = currentVersion(configPath);
+  if (args.allowDowngrade !== true && installed !== void 0 && (compareVersions(version, installed) ?? 0) < 0) {
+    const command = args.command ?? "runner install";
+    throw new RunnerDowngradeError(
+      `this CLI is ${version}, older than ${installed}, the version the runner runs from ${currentLink(configPath)}. Installing it would move the runner back to ${version}. Run \`${launcherPath(args.home)} ${command}\` instead, which runs ${installed}. To install ${version} anyway, run \`outerlayer ${command} --allow-downgrade\``
+    );
+  }
   if (!isInLayout(configPath, entry) && !sameBuildInstalled(packageRoot, packageRootIn(versionDir(configPath, version)))) {
     const target = packageRootIn(versionDir(configPath, version));
     mkdirSync(dirname(target), { recursive: true, mode: RUNNER_DIR_MODE });
@@ -80,4 +90,4 @@ function launcherSummary(launcher) {
   return `${launcher.state === "unchanged" ? "outerlayer command already at" : "wrote the outerlayer command at"} ${launcher.path}, which runs the CLI that ${launcher.follows} names`;
 }
 
-export { RunnerInstallError, launcherSummary, runRunnerInstall };
+export { RunnerDowngradeError, RunnerInstallError, launcherSummary, runRunnerInstall };

package/dist/{chunk-JPR2WHHF.js → chunk-KSLNQOOS.js}

@@ -628,7 +628,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-QL33HDJN.js');
+          const { materializeContext: materialize } = await import('./context-materialize-4PMTDS6K.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;