@outerlayer/cli 0.8.0 → 0.8.1

package/dist/{cli-AOJPAVFX.js → cli-X5ONGYNY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-4A5E2G4E.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-HSN5QNS5.js';
 import './chunk-F47JBIAW.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-5QLNZGAQ.js';
+import './chunk-KV47VQJZ.js';
 import './chunk-4ACZCY4I.js';
 import './chunk-BFESLKPP.js';
 import './chunk-ILEA3YHM.js';
@@ -16,14 +16,14 @@ import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-5QRP3MVS.js';
 import { pinExists } from './chunk-ZZXLM64C.js';
 import './chunk-7ZR5UPMB.js';
-import './chunk-BCLJSQCV.js';
+import './chunk-YO4PSLVB.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import './chunk-M5POMKKW.js';
+import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-JPR2WHHF.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-KSLNQOOS.js';
 import { managedHookScripts, removeJournalHooks, installPreCommitGuardHook, removePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -3855,7 +3855,7 @@ function buildProgram(argv = process.argv) {
       else process.stdout.write(outcome.text);
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-BYZYAJ5P.js');
+    const { runInitCommand } = await import('./init-cmd-P4MVCBCZ.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory },
       {
@@ -3867,7 +3867,7 @@ function buildProgram(argv = process.argv) {
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-C7PLRXZO.js');
+          const { runAgentSetup } = await import('./agent-setup-K6RD2Z4P.js');
           return runAgentSetup({ cwd: process.cwd() });
         },
         runDoctorChecks: gatherDoctorChecks
@@ -3927,7 +3927,7 @@ function buildProgram(argv = process.argv) {
     "\nIncremental: only sessions newer than the last checkpoint ship. The tier\nis applied on this machine before anything leaves it; `--dry-run` prints\nexactly what would. The hook-triggered background sync runs `--quiet`.\nExit 2 means the server rejected at least one session.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-CAEPJR7B.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-RJR77V4O.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -3956,7 +3956,7 @@ function buildProgram(argv = process.argv) {
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated("`outerlayer watch` is now `outerlayer daemon`; the old name will be removed in a future release.");
     }
-    const { runWatch } = await import('./watch-LAAZFBHH.js');
+    const { runWatch } = await import('./watch-YNZTFLEY.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4010,7 +4010,7 @@ function buildProgram(argv = process.argv) {
     }
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-Q5HAMOL2.js');
+    const { runSessionSender } = await import('./session-sender-V46VPWQ5.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4068,7 +4068,7 @@ function registerEmitCommands(program2) {
       return;
     }
     warnIfApiKeyFlag(opts);
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-2DMN6O6U.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-KXHHP6HX.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4119,7 +4119,7 @@ locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-AVM4YXMQ.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-D5GMVWNC.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4154,7 +4154,7 @@ locally so it never uploads. One correction can retire several duplicates.
     '\n  outerlayer emit finding --id gate-skip --category tooling \\\n    --title "The pre-push gate prints green when a step was skipped" \\\n    --file scripts/git/pre-push-checks.mjs --where "build session"\n\nRecords one problem you hit in the factory: an instruction that is wrong or\nmissing (context), a flaky test, a misbehaving script (tooling), a local\nsetup trap (environment), a bug outside your own change (defect), or\nanything else. A problem in your own change is fixed, not recorded.\nA context finding needs --rule-path and --rule-relation, and --rule-quote\nunless the relation is missing.\n--item names the work item; without it, inside a recorded session, the\nitem that session was launched for is used automatically.\n'
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-6R5WBPCH.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-46PTPN3A.js');
     try {
       refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
@@ -4193,7 +4193,7 @@ locally so it never uploads. One correction can retire several duplicates.
     "\n  outerlayer emit findings review.json --item 412\n\nRecords a whole batch at once \u2014 a FindingBatch JSON file (schemaVersion,\noptional headSha / contextSourceSha, and 1-500 findings), validated against\nthe same contract `emit finding` uses before anything is sent. Re-emitting\nan id already on the item replaces that row rather than adding a second one.\n--item names the work item; without it, inside a recorded session, the item\nthat session was launched for is used automatically.\n"
   ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-6R5WBPCH.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-46PTPN3A.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4217,7 +4217,7 @@ locally so it never uploads. One correction can retire several duplicates.
     '\n  outerlayer emit criteria criteria.json --item 412\n\nRecords the item\'s acceptance criteria as one list. The file is JSON:\n  { "criteria": [ { "id": "AC-1", "text": "Given ...", "proof": null },\n                  { "id": "login.redirect", "text": "...", "proof": "screenshot" } ] }\nAn id is 1-64 characters of A-Z a-z 0-9 . _ : - and is the id evidence is bound to with\n`emit artifact --for`. proof is video, screenshot, report, log, test, file or null (any bound\nartifact proves it). The list holds 1 to 200 criteria, each text at most 2,000\ncharacters, and no id twice. The list is validated before anything is sent.\nOnce an item has a list, only a person can replace it: run the command outside an\nagent session, with your own login. A key bound to no member cannot replace it either.\n--item names the work item; without it, inside a recorded session, the item that\nsession was launched for is used automatically.\n'
   ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-LDBE4YDS.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-IE7VIM64.js');
     try {
       const result = await runEmitCriteria({
         file,
@@ -4244,7 +4244,7 @@ function registerWorkCommands(program2) {
     "\n  outerlayer work build --issue 42                       # a host builds it\n  outerlayer work build --item 7                         # retry an item already on Work\n  outerlayer work build --issue 42 --local               # you build it\n  outerlayer work build --issue ENG-123 --tracker linear # a Linear issue\n\nWithout --local, records a build request: a host takes the item when it\nhas a free slot. It never links the calling session and never takes a\nlease, even run from inside one.\n\nWith --local, puts the item on Work with no build request, so no host\ntakes it, and prints the line that starts your session on it. That\nsession links itself and holds the item's lease while it works.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-B3FOXZAL.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-CNWPTH7W.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4260,7 +4260,7 @@ function registerWorkCommands(program2) {
     "\n  outerlayer work link-session 42\n\nNames an item that already exists on the calling session \u2014 it never\ncreates one. Create one with `outerlayer work build --local`. Linking\nthe same session to the same item twice is a no-op. Also takes or\nrenews that session's own 20-minute lease, unless --no-lease or\n--ended is given, or another worker already holds a live one.\n"
   ).action(async (number, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-B3FOXZAL.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-CNWPTH7W.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4285,8 +4285,8 @@ most one action flag may be given.
 `
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-O5WGRI6K.js');
-    const { WorkCommandError } = await import('./work-cmd-B3FOXZAL.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-HH45S6UE.js');
+    const { WorkCommandError } = await import('./work-cmd-CNWPTH7W.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4302,8 +4302,8 @@ most one action flag may be given.
     "\n  outerlayer work threads --item 7\n\nPrints the item's general thread, then one thread per acceptance\ncriterion that carries proof or a comment, each with who is waiting\non whom next.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-O5WGRI6K.js');
-    const { WorkCommandError } = await import('./work-cmd-B3FOXZAL.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-HH45S6UE.js');
+    const { WorkCommandError } = await import('./work-cmd-CNWPTH7W.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4325,7 +4325,7 @@ live addition remains on it.
 `
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-B3FOXZAL.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-CNWPTH7W.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4338,7 +4338,7 @@ live addition remains on it.
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-B3FOXZAL.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-CNWPTH7W.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4351,7 +4351,7 @@ live addition remains on it.
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items with an unused build request and no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-B3FOXZAL.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-CNWPTH7W.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4367,7 +4367,7 @@ live addition remains on it.
     "\n  outerlayer work claim --item 42 --kind implement\n\nRecords a lease for this host. A live lease already held by a\ndifferent host is refused; claiming again under the same host extends\nit.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-ARIYZARE.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-KAD3ZAH7.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4383,7 +4383,7 @@ live addition remains on it.
     "\n  outerlayer work renew --item 42\n\nExtends this host's own live lease. Refused with a 410 if the lease\nhas expired, or a 403 if a different host holds it.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-ARIYZARE.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-KAD3ZAH7.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4402,7 +4402,7 @@ live addition remains on it.
     "\n  outerlayer work release --item 42 --outcome ok\n\nMarks this host's lease released, optionally with an outcome.\nReleasing an already-released lease is a no-op that returns the\nrecorded release time and outcome.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-ARIYZARE.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-KAD3ZAH7.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4418,7 +4418,7 @@ live addition remains on it.
     "\n  outerlayer work pr 481\n\nRun inside a session already on a work item. Records that pull\nrequest 481 in the checkout's repository belongs to that item \u2014 the\nsame fact a `pr-link` in the session's own transcript records on\nsync. Idempotent: declaring the same pull request twice is a no-op.\n"
   ).action(async (number, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-C4YEGKD6.js');
+    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-TTEGCP76.js');
     try {
       await runWorkPr({ ...opts, number });
     } catch (err) {
@@ -4434,8 +4434,8 @@ live addition remains on it.
     '\n  outerlayer work open-pr --title "Add the thing" --body-file pr.md\n\nIn a host build, which holds an item key, the gateway opens the pull\nrequest as the factory\'s GitHub App, from the branch the claim named,\nor edits the one already open on that branch. No gh command runs.\nIn your own session it runs `gh pr create` (or `gh pr edit`) under your\nlogin, then declares the pull request on the item, as `work pr` does.\nRun it again after a change to the title or description.\n'
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-M6CQW7KW.js');
-    const { WorkCommandError } = await import('./work-cmd-B3FOXZAL.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-5KR3KFCN.js');
+    const { WorkCommandError } = await import('./work-cmd-CNWPTH7W.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4452,7 +4452,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-Z3USDBLU.js');
-    const { start, RunnerStartError } = await import('./loop-AG3PLXPO.js');
+    const { start, RunnerStartError } = await import('./loop-ODMRE3CW.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-UZRH774M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4468,7 +4468,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-Z3USDBLU.js');
-    const { runRunnerCheck } = await import('./check-FOF3PUKI.js');
+    const { runRunnerCheck } = await import('./check-GX5ND6RO.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4483,9 +4483,9 @@ function registerRunnerCommands(program2) {
     process.stdout.write(`${result.lines.join("\n")}
 `);
   });
-  runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").addOption(new Option("--unit-name <name>", "with --service, the unit's name").hideHelp()).action(async (opts) => {
+  runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").option("--allow-downgrade", "install this CLI even when it is older than the version the runner runs").addOption(new Option("--unit-name <name>", "with --service, the unit's name").hideHelp()).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-Z3USDBLU.js');
-    const { runRunnerInstall, RunnerInstallError, launcherSummary } = await import('./install-cmd-DCF7TVXD.js');
+    const { runRunnerInstall, RunnerInstallError, launcherSummary } = await import('./install-cmd-BEC7XTNG.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.service !== true) {
       for (const flag of ["print", "user", "unitName"]) {
@@ -4497,12 +4497,13 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-SY3SVLAI.js');
+        const { installServiceCommand } = await import('./command-7NFU3IPO.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
           user: opts.user,
           replace: opts.replace,
+          allowDowngrade: opts.allowDowngrade,
           unitName: opts.unitName,
           entryPath: process.argv[1] ?? "",
           nodePath: process.execPath,
@@ -4517,7 +4518,15 @@ function registerRunnerCommands(program2) {
         } else fail(result2.lines.length > 0 ? result2.lines.join("\n  ") : "the service was not set up");
         return;
       }
-      const result = runRunnerInstall({ configPath, entryPath: process.argv[1] ?? "", nodePath: process.execPath, home: homeFromEnv(), PATH: process.env.PATH, replace: opts.replace });
+      const result = runRunnerInstall({
+        configPath,
+        entryPath: process.argv[1] ?? "",
+        nodePath: process.execPath,
+        home: homeFromEnv(),
+        PATH: process.env.PATH,
+        replace: opts.replace,
+        allowDowngrade: opts.allowDowngrade
+      });
       process.stdout.write(`${C.green}\u2713${C.reset} installed ${result.version} for the runner; \`current\` names it
 `);
       printLauncher(result, launcherSummary);
@@ -4541,7 +4550,7 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-Z3USDBLU.js');
-    const { uninstallServiceCommand } = await import('./command-SY3SVLAI.js');
+    const { uninstallServiceCommand } = await import('./command-7NFU3IPO.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -4549,9 +4558,9 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
   });
   runnerCmd.command("init").description("Write a runner block that fits this machine; on macOS, offers a Linux VM").option("--config <path>", configOption).option("--vm", "on macOS, run the runner in a Linux VM (Lima), with container builds").option("--no-vm", "on macOS, skip the VM and run builds as unisolated processes").option("--allow-process-builds", "where builds cannot be isolated, run them as processes anyway").addOption(new Option("--config-stdin", "the VM-side hand-off: read the whole config as JSON on stdin").hideHelp()).addOption(new Option("--vm-cli-package <path>", "install this packed CLI tarball in the VM instead of the published version").hideHelp()).addOption(new Option("--unit-name <name>", "the service unit's name").hideHelp()).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-Z3USDBLU.js');
-    const { runRunnerInit, RunnerInitError } = await import('./init-KDK5QLQZ.js');
-    const { detectMachine } = await import('./machine-LV6WBRRK.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-R2FJ5KNS.js');
+    const { runRunnerInit, RunnerInitError } = await import('./init-S4DH6PWW.js');
+    const { detectMachine } = await import('./machine-J4SAB3Z2.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-B4CECVOX.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
       const machine = detectMachine();
@@ -4559,7 +4568,7 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
         const chunks = [];
         for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
         const result2 = runRunnerInit(configPath, { machine, configFromStdin: Buffer.concat(chunks).toString("utf8"), requireContainer: true });
-        const { ensureHostKey: ensureHostKey2 } = await import('./host-key-KDYZ5ECC.js');
+        const { ensureHostKey: ensureHostKey2 } = await import('./host-key-YMLXY6QB.js');
         const hostKey2 = await ensureHostKey2(configPath);
         process.stdout.write(`host key ${hostKey2.fingerprint}
 hooks: ${result2.hooks}
@@ -4602,7 +4611,7 @@ hooks: ${result2.hooks}
       }
       const allowProcess = opts.allowProcessBuilds === true || machine.platform === "darwin" && declinedVm;
       const result = runRunnerInit(configPath, { machine, allowProcess });
-      const { ensureHostKey } = await import('./host-key-KDYZ5ECC.js');
+      const { ensureHostKey } = await import('./host-key-YMLXY6QB.js');
       const hostKey = await ensureHostKey(configPath);
       process.stdout.write(`${C.green}\u2713${C.reset} wrote a runner block into ${result.configPath}
 `);
@@ -4620,23 +4629,38 @@ ${C.yellow}${result.note}${C.reset}
 To isolate builds in containers instead, run ${C.yellow}outerlayer runner init --vm${C.reset}.
 `);
       }
-      const { runRunnerInstall, RunnerInstallError, launcherSummary } = await import('./install-cmd-DCF7TVXD.js');
+      const { runRunnerInstall, RunnerInstallError, RunnerDowngradeError, launcherSummary } = await import('./install-cmd-BEC7XTNG.js');
       let installedLayout = false;
+      let noService = "it starts the runner from the install layout, which needs a CLI installed with npm";
       try {
-        const installed = runRunnerInstall({ configPath, entryPath: process.argv[1] ?? "", nodePath: process.execPath, home: homeFromEnv(), PATH: process.env.PATH });
+        const installed = runRunnerInstall({
+          configPath,
+          entryPath: process.argv[1] ?? "",
+          nodePath: process.execPath,
+          home: homeFromEnv(),
+          PATH: process.env.PATH,
+          command: "runner install --service"
+        });
         installedLayout = true;
         process.stdout.write(`${C.green}\u2713${C.reset} installed ${installed.version} for the runner, so it can update itself
 `);
         printLauncher(installed, launcherSummary);
       } catch (installErr) {
         if (!(installErr instanceof RunnerInstallError)) throw installErr;
-        process.stdout.write(`
+        if (installErr instanceof RunnerDowngradeError) {
+          noService = "the install layout was left as it is";
+          process.stdout.write(`
+${C.yellow}The install layout was left alone: ${installErr.message}${C.reset}
+`);
+        } else {
+          process.stdout.write(`
 ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
 `);
+        }
       }
       let serviceUp = false;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-SY3SVLAI.js');
+        const { installServiceCommand } = await import('./command-7NFU3IPO.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -4650,7 +4674,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
 ` : `${C.yellow}${line}${C.reset}
 `);
       } else {
-        process.stdout.write(`${C.yellow}No service was set up: it starts the runner from the install layout, which needs a CLI installed with npm.${C.reset}
+        process.stdout.write(`${C.yellow}No service was set up: ${noService}.${C.reset}
 `);
       }
       process.stdout.write(
@@ -4677,8 +4701,8 @@ Next:
     const { defaultRunnerConfigPath } = await import('./config-Z3USDBLU.js');
     const { buildRepositoryImage, RecipeError } = await import('./build-MS34XEGN.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-676FD3CQ.js');
-    const { builderSpec } = await import('./builder-G52A6GW2.js');
+    const { createDockerHost } = await import('./docker-PRHRSJM5.js');
+    const { builderSpec } = await import('./builder-IG6FNA54.js');
     const { loadRunnerConfig } = await import('./config-Z3USDBLU.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const memory = (() => {
@@ -4741,15 +4765,15 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-Z3USDBLU.js');
-    const { requestStop } = await import('./loop-AG3PLXPO.js');
+    const { requestStop } = await import('./loop-ODMRE3CW.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-Z3USDBLU.js');
     const { jobsDir, runnerDir } = await import('./paths-OYKMVYJP.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-AG3PLXPO.js');
-    const { renderStatus } = await import('./status-HH4OSOHR.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-ODMRE3CW.js');
+    const { renderStatus } = await import('./status-QBKSH3QE.js');
     const { readHousekeepingRecord } = await import('./record-C43U4PKS.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -4801,7 +4825,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-Z3USDBLU.js');
-    const { listJobFiles } = await import('./loop-AG3PLXPO.js');
+    const { listJobFiles } = await import('./loop-ODMRE3CW.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-H55NWW4H.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5047,7 +5071,7 @@ function registerMcpCommands(program2) {
     "after",
     "\nWhat the stdio .mcp.json entry spawns. Reads newline-delimited JSON-RPC 2.0 on\nstdin and writes responses on stdout. The API key comes from OUTERLAYER_API_KEY\nor ~/.outerlayer/config.json at start-up; with neither the command exits 1 and\nprints why, which the MCP client shows as the connect error.\n"
   ).action(async (opts) => {
-    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-N6UD2KBX.js');
+    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-CT47P4YQ.js');
     try {
       await runMcpServe({ url: opts.url, appId: opts.appId });
     } catch (err) {
@@ -5117,7 +5141,7 @@ function registerContextCommands(program2) {
     await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
   });
   contextCmd.command("adopt <stagedDir>", { hidden: true }).description("Copy context the runner staged into this checkout (container builds)").option("--json", "machine-readable JSON output").action(async (stagedDir) => {
-    const { runContextAdopt } = await import('./context-adopt-CE4KDXS3.js');
+    const { runContextAdopt } = await import('./context-adopt-D2Z7F7PB.js');
     const { exitCode, stdout } = runContextAdopt(stagedDir, process.cwd());
     process.stdout.write(stdout);
     process.exitCode = exitCode;
@@ -5126,7 +5150,7 @@ function registerContextCommands(program2) {
     "after",
     "\nThe same flow SessionStart runs automatically, exposed for a manual retry or a\nfirst check outside a session. Writes AGENTS.md, .claude/**, and .outerlayer/**.\n"
   ).action(async (opts) => {
-    const { materializeContext } = await import('./context-materialize-QL33HDJN.js');
+    const { materializeContext } = await import('./context-materialize-4PMTDS6K.js');
     const result = await materializeContext({ cwd: process.cwd(), sessionId: `manual-${Date.now()}` });
     const output = formatContextMaterializeOutput(result);
     if (output.exitCode !== void 0) process.exitCode = output.exitCode;

package/dist/{command-SY3SVLAI.js → command-7NFU3IPO.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runRunnerInstall, launcherSummary } from './chunk-OEK4JEB3.js';
+import { runRunnerInstall, launcherSummary } from './chunk-I7CJIRMM.js';
+import './chunk-I2UOAV7X.js';
 import { readJobFile } from './chunk-T6OIJQRT.js';
 import './chunk-PTW6W5NR.js';
 import { currentLink, execStartCommand } from './chunk-TI7B7UEO.js';
-import { detectMachine } from './chunk-TUUMW4TC.js';
-import './chunk-CM5QTKM4.js';
+import { detectMachine } from './chunk-QNRSFEGY.js';
+import './chunk-M4ERCYDB.js';
 import { installService, uninstallService, realTaskScheduler } from './chunk-AX23QKHS.js';
 import './chunk-FBTE2A2X.js';
 import './chunk-JKIWMRFH.js';
@@ -14,13 +15,13 @@ import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
 import './chunk-TTNFGMHO.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-U3GOI2B4.js';
+import './chunk-TEKZRTM3.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-5TNS3PL7.js';
+import './chunk-2BRSMBBB.js';
 import './chunk-CX22S5BA.js';
 import './chunk-ZOAEPWGL.js';
 import './chunk-R7STSBLC.js';
-import './chunk-5QLNZGAQ.js';
+import './chunk-KV47VQJZ.js';
 import './chunk-4ACZCY4I.js';
 import './chunk-BFESLKPP.js';
 import './chunk-ILEA3YHM.js';
@@ -35,17 +36,17 @@ import './chunk-7RQ73DLO.js';
 import './chunk-OD2VTIHN.js';
 import './chunk-HKMPVPO7.js';
 import './chunk-WZBHBH3J.js';
-import './chunk-5FWNEQNZ.js';
+import './chunk-BQFNZOMQ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-ZZXLM64C.js';
 import './chunk-VXLJORHL.js';
 import './chunk-7ZR5UPMB.js';
-import './chunk-BCLJSQCV.js';
+import './chunk-YO4PSLVB.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
-import './chunk-M5POMKKW.js';
+import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
@@ -142,7 +143,7 @@ function accountCannotStart(account, nodePath, entry, can) {
   return void 0;
 }
 function vmArgs(input) {
-  return [...input.print === true ? ["--print"] : [], ...input.replace === true ? ["--replace"] : [], ...input.user === void 0 ? [] : ["--user", input.user], ...input.unitName === void 0 ? [] : ["--unit-name", input.unitName]];
+  return [...input.print === true ? ["--print"] : [], ...input.replace === true ? ["--replace"] : [], ...input.allowDowngrade === true ? ["--allow-downgrade"] : [], ...input.user === void 0 ? [] : ["--user", input.user], ...input.unitName === void 0 ? [] : ["--unit-name", input.unitName]];
 }
 async function installServiceCommand(input, deps = {}) {
   const vm = runnerVmOf(input.configPath);
@@ -160,7 +161,9 @@ async function installServiceCommand(input, deps = {}) {
       nodePath: input.nodePath,
       home: input.home,
       PATH: process.env.PATH,
-      replace: input.replace
+      replace: input.replace,
+      allowDowngrade: input.allowDowngrade,
+      command: "runner install --service"
     });
     launcherLines = [launcherSummary(installed.launcher)].filter((line) => line !== void 0);
     launcherNotes = installed.launcher.notes;

package/dist/{context-adopt-CE4KDXS3.js → context-adopt-D2Z7F7PB.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { defaultGitRunner, hasSymlinkComponent } from './chunk-5FWNEQNZ.js';
+import { defaultGitRunner, hasSymlinkComponent } from './chunk-BQFNZOMQ.js';
 import './chunk-ZJSNLVCE.js';
 import { writeContextManifest, writePinIfChanged, touchLastCheck, clearDegraded, writeSourceCache, SOURCE_CACHE_TTL_SUCCESS_MS, writeBuildHold } from './chunk-ZZXLM64C.js';
 import './chunk-VXLJORHL.js';
 import './chunk-7ZR5UPMB.js';
-import './chunk-BCLJSQCV.js';
+import './chunk-YO4PSLVB.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
-import './chunk-M5POMKKW.js';
+import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
 import { ensureContextExcludes, installPreCommitGuardInGitDir } from './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';

package/dist/{context-materialize-QL33HDJN.js → context-materialize-4PMTDS6K.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir } from './chunk-5FWNEQNZ.js';
+export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir } from './chunk-BQFNZOMQ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-ZZXLM64C.js';
 import './chunk-VXLJORHL.js';
 import './chunk-7ZR5UPMB.js';
-import './chunk-BCLJSQCV.js';
+import './chunk-YO4PSLVB.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
-import './chunk-M5POMKKW.js';
+import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';

package/dist/{docker-676FD3CQ.js → docker-PRHRSJM5.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { childEnvironment, createDockerHost, spawnRun } from './chunk-U3GOI2B4.js';
+export { childEnvironment, createDockerHost, spawnRun } from './chunk-TEKZRTM3.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-5TNS3PL7.js';
+import './chunk-2BRSMBBB.js';
 import './chunk-CX22S5BA.js';
 import './chunk-GAYWY4GI.js';
 import './chunk-7RQ73DLO.js';

package/dist/{doctor-WR6TRPSU.js → doctor-KALLPCRB.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-IRCBTGWF.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-Q4432IZT.js';
 import { launcherCheck } from './chunk-PTW6W5NR.js';
 import './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-NALVDFIS.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-TUUMW4TC.js';
-import { MIN_ENGINE_MAJOR } from './chunk-CM5QTKM4.js';
+import './chunk-Z2THOHPP.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-QNRSFEGY.js';
+import { MIN_ENGINE_MAJOR } from './chunk-M4ERCYDB.js';
 import './chunk-TTNFGMHO.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import { resolveDevcontainerCli, spawnRun } from './chunk-U3GOI2B4.js';
+import { resolveDevcontainerCli, spawnRun } from './chunk-TEKZRTM3.js';
 import { locateRecipe, assertBuildable, readRecipe, RecipeError } from './chunk-QOZKPLVJ.js';
-import { buildxState } from './chunk-5TNS3PL7.js';
+import { buildxState } from './chunk-2BRSMBBB.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import './chunk-ZOAEPWGL.js';
 import './chunk-R7STSBLC.js';
-import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-5QLNZGAQ.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-KV47VQJZ.js';
 import './chunk-4ACZCY4I.js';
 import './chunk-BFESLKPP.js';
 import './chunk-ILEA3YHM.js';
@@ -32,17 +32,17 @@ import { parseSize } from './chunk-7RQ73DLO.js';
 import './chunk-OD2VTIHN.js';
 import './chunk-HKMPVPO7.js';
 import './chunk-WZBHBH3J.js';
-import { defaultGitRunner } from './chunk-5FWNEQNZ.js';
+import { defaultGitRunner } from './chunk-BQFNZOMQ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-ZZXLM64C.js';
 import './chunk-VXLJORHL.js';
 import './chunk-7ZR5UPMB.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import './chunk-BOLTI6LR.js';
 import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
-import { loadHostKey } from './chunk-M5POMKKW.js';
+import { loadHostKey } from './chunk-V7NIVOFD.js';
 import { runnerDir, hostKeyPath } from './chunk-ZM2IMMYN.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';