@outerlayer/cli 0.8.0 → 0.8.2

package/dist/chunk-I2UOAV7X.js

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/update/version-order.ts
+function parse(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(version);
+  if (match === null) return void 0;
+  return { core: [Number(match[1]), Number(match[2]), Number(match[3])], pre: match[4] };
+}
+function comparePre(a, b) {
+  const left = a.split(".");
+  const right = b.split(".");
+  for (let i = 0; i < Math.max(left.length, right.length); i++) {
+    const x = left[i];
+    const y = right[i];
+    if (x === void 0) return -1;
+    if (y === void 0) return 1;
+    const xNum = /^\d+$/.test(x);
+    const yNum = /^\d+$/.test(y);
+    if (xNum && yNum) {
+      const difference = Number(x) - Number(y);
+      if (difference !== 0) return Math.sign(difference);
+    } else if (xNum !== yNum) {
+      return xNum ? -1 : 1;
+    } else if (x < y) {
+      return -1;
+    } else if (x > y) {
+      return 1;
+    }
+  }
+  return 0;
+}
+function compareVersions(a, b) {
+  const left = parse(a);
+  const right = parse(b);
+  if (left === void 0 || right === void 0) return void 0;
+  for (let i = 0; i < 3; i++) {
+    const difference = left.core[i] - right.core[i];
+    if (difference !== 0) return Math.sign(difference);
+  }
+  if (left.pre === right.pre) return 0;
+  if (left.pre === void 0) return 1;
+  if (right.pre === void 0) return -1;
+  return comparePre(left.pre, right.pre);
+}
+function compareCores(a, b) {
+  for (let i = 0; i < 3; i++) {
+    const difference = a[i] - b[i];
+    if (difference !== 0) return Math.sign(difference);
+  }
+  return 0;
+}
+function parsePartial(text) {
+  if (text === "" || text === "*" || text === "x" || text === "X") return [];
+  const match = /^v?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?$/.exec(text);
+  if (match === null) return void 0;
+  const numbers = [];
+  for (const part of [match[1], match[2], match[3]]) {
+    if (part === void 0 || !/^\d+$/.test(part)) break;
+    numbers.push(Number(part));
+  }
+  return numbers;
+}
+function bumpLast(numbers) {
+  const core = [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
+  const last = numbers.length - 1;
+  core[last] = core[last] + 1;
+  for (let i = last + 1; i < 3; i++) core[i] = 0;
+  return core;
+}
+function fill(numbers) {
+  return [numbers[0] ?? 0, numbers[1] ?? 0, numbers[2] ?? 0];
+}
+function meets(version, comparator) {
+  const match = /^(>=|<=|>|<|=|\^|~)?(.*)$/.exec(comparator);
+  const op = match[1] ?? "";
+  const numbers = parsePartial(match[2]);
+  if (numbers === void 0) return void 0;
+  if (numbers.length === 0) return op === "" || op === "=" || op === ">=" || op === "<=" ? true : void 0;
+  const low = fill(numbers);
+  const whole = numbers.length === 3;
+  switch (op) {
+    case ">=":
+      return compareCores(version, low) >= 0;
+    case ">":
+      return whole ? compareCores(version, low) > 0 : compareCores(version, bumpLast(numbers)) >= 0;
+    case "<":
+      return compareCores(version, low) < 0;
+    case "<=":
+      return whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0;
+    case "~":
+      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, Math.min(numbers.length, 2)))) < 0;
+    case "^": {
+      let pivot = numbers.findIndex((n) => n !== 0);
+      if (pivot === -1) pivot = numbers.length - 1;
+      return compareCores(version, low) >= 0 && compareCores(version, bumpLast(numbers.slice(0, pivot + 1))) < 0;
+    }
+    default:
+      return compareCores(version, low) >= 0 && (whole ? compareCores(version, low) <= 0 : compareCores(version, bumpLast(numbers)) < 0);
+  }
+}
+function satisfiesRange(version, range) {
+  const parsed = parse(version.trim().replace(/^v/, ""));
+  if (parsed === void 0 || parsed.pre !== void 0) return void 0;
+  let anyUnreadable = false;
+  for (const alternative of range.split("||")) {
+    if (/\s-\s/.test(alternative)) {
+      anyUnreadable = true;
+      continue;
+    }
+    const comparators = alternative.trim().replace(/(>=|<=|>|<|=|\^|~)\s+/g, "$1").split(/\s+/).filter((c) => c !== "");
+    if (comparators.length === 0) comparators.push("*");
+    let all = true;
+    for (const comparator of comparators) {
+      const met = meets(parsed.core, comparator);
+      if (met === void 0) {
+        anyUnreadable = true;
+        all = false;
+        break;
+      }
+      if (!met) {
+        all = false;
+        break;
+      }
+    }
+    if (all) return true;
+  }
+  return anyUnreadable ? void 0 : false;
+}
+
+export { compareVersions, satisfiesRange };

package/dist/{chunk-ABIWDUMS.js → chunk-IS4DIGBQ.js}

@@ -6,6 +6,18 @@ import { join, dirname } from 'path';
 import { createHash } from 'crypto';
 
 createRequire(import.meta.url);
+
+// src/runner/update/installed-switch.ts
+function decideInstalledSwitch(input) {
+  const to = input.current;
+  if (to === void 0 || to === input.own || !input.fromCurrent) return { kind: "none" };
+  if (!input.installed) return { kind: "missing", to };
+  if (!input.underService) return { kind: "foreground", to };
+  return { kind: "restart", to };
+}
+function startedByService(env, parentPid) {
+  return (env.INVOCATION_ID ?? "") !== "" && parentPid === 1;
+}
 var REGISTRY_URL = "https://registry.npmjs.org";
 var PACKAGE_NAME = "@outerlayer/cli";
 var PACKAGE_PATH = "@outerlayer%2fcli";
@@ -101,4 +113,4 @@ async function auditSignatures(runNpm, dir) {
   return { ok: true };
 }
 
-export { auditSignatures, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm };
+export { auditSignatures, decideInstalledSwitch, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm, startedByService };

package/dist/{chunk-WVGSB3Z2.js → chunk-J5DPVNL3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-R7STSBLC.js';
-import { RELAY_PORT } from './chunk-OD2VTIHN.js';
+import { EXEC_PORT } from './chunk-2E2MG3KW.js';
+import { RELAY_PORT } from './chunk-2FWL7CE2.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-VXLJORHL.js → chunk-JXH6LEEH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-7ZR5UPMB.js';
+import { splitRawFile } from './chunk-CMFCCIQN.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-JPR2WHHF.js → chunk-KI7VPNKC.js}

@@ -628,7 +628,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-QL33HDJN.js');
+          const { materializeContext: materialize } = await import('./context-materialize-YR3JQCUF.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-TUUMW4TC.js → chunk-LSPJHYHM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-CM5QTKM4.js';
+import { MIN_ENGINE_MAJOR } from './chunk-EQG7L6LM.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-7VNURP6M.js → chunk-M2F2RAMK.js}

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-3S4P55NE.js';
-import { DOCKERD_LOG } from './chunk-WVGSB3Z2.js';
-import { installScrubContext } from './chunk-AIL2R4SI.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, senderSignalScript } from './chunk-CM5QTKM4.js';
-import { readBranchHead, fetchCommit } from './chunk-TTNFGMHO.js';
+import { senderPidfile } from './chunk-4ZZR5SKG.js';
+import { DOCKERD_LOG } from './chunk-J5DPVNL3.js';
+import { installScrubContext } from './chunk-YU4Z2O3W.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-EQG7L6LM.js';
+import { readBranchHead, diffBetween, fetchCommit } from './chunk-Y7UQHKFY.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-U3GOI2B4.js';
+import { childEnvironment } from './chunk-NPBLDMSD.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
-import { waitForAgent, vmExecArgs } from './chunk-ZOAEPWGL.js';
-import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-5QLNZGAQ.js';
+import { waitForAgent, vmExecArgs } from './chunk-HWMYGAKF.js';
+import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-2E2MG3KW.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-R5SPFO6F.js';
 import { planArtifactUpload } from './chunk-ZYHKJKSU.js';
-import { scrubText } from './chunk-GAYWY4GI.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-PWBILI5P.js';
+import { scrubText } from './chunk-HN2JBGSI.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-7KI224YS.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment } from './chunk-OD2VTIHN.js';
+import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2FWL7CE2.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-HKMPVPO7.js';
-import { parsePolicy } from './chunk-7ZR5UPMB.js';
+import { parsePolicy } from './chunk-CMFCCIQN.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-M5POMKKW.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
 import { runnerDir, buildDir, vsockPath, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { spawn, spawnSync } from 'child_process';
@@ -43,6 +43,9 @@ var DOCKER_LOG_LINES = 20;
 var GUEST_GH_DIR = `${JOB_MOUNT}/gh`;
 var GUEST_HOOKS_DIR = `${JOB_MOUNT}/git-hooks`;
 var GUEST_CONTEXT_DIR = `${JOB_MOUNT}/context`;
+function buildMemoryBytes(config) {
+  return parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY);
+}
 function firstLine(text2) {
   return text2.trim().split("\n")[0] ?? "";
 }
@@ -72,8 +75,8 @@ async function writeGuestGhConfig(runtime, state, token) {
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], ghHostsYml(token));
   if (result.status !== 0) throw new Error(`writing gh's configuration in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
 }
-async function unpackIntoGuest(runtime, state, dir, target) {
-  const script = `set -e; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX ${target}`;
+async function unpackIntoGuest(runtime, state, dir, target, opts = {}) {
+  const script = opts.readOnly === true ? `set -e; rm -rf ${target}; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX,a-w ${target}` : `set -e; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX ${target}`;
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], tarOf(dir));
   if (result.status !== 0) throw new Error(`unpacking into ${target} in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
 }
@@ -166,7 +169,7 @@ async function provisionMicroVm(input) {
   if (input.aborted()) return bail("", true);
   let imageConfig;
   try {
-    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId });
+    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId, memoryBytes: buildMemoryBytes(config) });
     imageConfig = await vm.rootfs.imageConfig(report.imageId);
   } catch (err) {
     return bail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
@@ -186,14 +189,14 @@ async function provisionMicroVm(input) {
   }
   const limits = {
     cpus: config.build?.cpus ?? DEFAULT_CPUS,
-    memoryBytes: parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY),
+    memoryBytes: buildMemoryBytes(config),
     diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: true });
   const configPath = join(buildDir2, "vm.json");
   try {
     linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
-    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk });
+    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
     writeFileSync(
       configPath,
       JSON.stringify(
@@ -304,6 +307,7 @@ async function provisionMicroVm(input) {
     removeStagedContext: () => removeStagedContext(buildDir2)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
+  state.startCommit = steps.startCommit;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
 async function waitForDocker(runtime, state, agentUser, now) {
@@ -406,6 +410,10 @@ async function copyHookErrors(runtime, state, jobDir) {
   } catch {
   }
 }
+async function copyTranscriptsFromMicroVm(runtime, state) {
+  if (!isRunning(runtime, state)) return { ok: false, reason: "the build's microVM is gone" };
+  return copyTranscripts((argv) => asRoot(runtime, state, argv));
+}
 async function startCheckMicroVm(input) {
   const { config, runtime, job, jobDir, tokens, log } = input;
   const { vm } = runtime;
@@ -455,7 +463,7 @@ async function startCheckMicroVm(input) {
   }
   if (abandoned()) return fail(ABANDONED);
   try {
-    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: built.imageId });
+    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: built.imageId, memoryBytes: buildMemoryBytes(config) });
   } catch (err) {
     return fail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
   }
@@ -473,14 +481,14 @@ async function startCheckMicroVm(input) {
   if (abandoned()) return fail(ABANDONED);
   const limits = {
     cpus: config.build?.cpus ?? DEFAULT_CPUS,
-    memoryBytes: parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY),
+    memoryBytes: buildMemoryBytes(config),
     diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: false });
   const configPath = join(buildDir2, "vm.json");
   try {
     linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
-    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk });
+    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
     writeFileSync(
       configPath,
       JSON.stringify(
@@ -520,10 +528,16 @@ async function startCheckMicroVm(input) {
   if (failed !== void 0) return fail(failed);
   if (abandoned()) return fail(ABANDONED);
   const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {} });
+  const evalInput = { dir: join(checksDir, EVAL_INPUT_NAME), delivered: false };
+  const deliverEvalInput = async () => {
+    await unpackIntoGuest(runtime, state, evalInput.dir, EVAL_INPUT_DIR, { readOnly: true });
+    evalInput.delivered = true;
+  };
   return {
     ok: true,
     environment: {
       state,
+      evalInput: { dir: evalInput.dir, deliver: deliverEvalInput },
       exec: async (argv, workdir, opts) => {
         const ran = await vm.exec(state.vsockPath, { argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
         if (opts?.logPath !== void 0) appendFileSync(opts.logPath, ran.stdout + ran.stderr);
@@ -533,7 +547,9 @@ async function startCheckMicroVm(input) {
         try {
           await vm.firecracker.stop(state.firecracker);
           rmSync(state.vsockPath, { force: true });
-          return await boot() === void 0;
+          if (await boot() !== void 0) return false;
+          if (evalInput.delivered) await deliverEvalInput();
+          return true;
         } catch {
           return false;
         }
@@ -782,10 +798,15 @@ function parseEvaluation(value) {
   }
   return { verdict, sentence: text(raw.sentence), waitingOn: raw.waitingOn, open };
 }
+async function readWorkItem(config, item, fetchImpl) {
+  const { data } = await getJson(config.url, `/v1/work-items/${item}`, config.apiKey, config.appId, fetchImpl, await signerFor(config.configPath));
+  return data;
+}
 async function readItemEvaluation(config, item, fetchImpl) {
   try {
-    const { data } = await getJson(config.url, `/v1/work-items/${item}`, config.apiKey, config.appId, fetchImpl, await signerFor(config.configPath));
-    return { ok: true, evaluation: parseEvaluation(fields(data).evaluation) };
+    const body = fields(await readWorkItem(config, item, fetchImpl));
+    const hasPullRequest = Array.isArray(body.pullRequests) ? body.pullRequests.length > 0 : void 0;
+    return { ok: true, evaluation: parseEvaluation(body.evaluation), hasPullRequest };
   } catch (err) {
     return { ok: false, reason: describeCallFailure(err) };
   }
@@ -803,6 +824,9 @@ function fit(prefix, parts) {
 }
 function decideFromEvaluation(read) {
   if (!read.ok) return { outcome: "incomplete", reason: fit("the item's status could not be read: ", [read.reason]) };
+  if (read.hasPullRequest === false) {
+    return { outcome: "incomplete", reason: "the build opened no pull request for the item" };
+  }
   const evaluation = read.evaluation;
   if (evaluation === void 0) return { outcome: "ok" };
   if (evaluation === null) return { outcome: "incomplete", reason: "the item has no evidence evaluation yet" };
@@ -1032,6 +1056,14 @@ async function runHostChecks(input) {
     const limitMinutes = config.checks?.timeLimitMinutes ?? DEFAULT_CHECK_TIME_LIMIT_MINUTES;
     const minutes = `${limitMinutes} ${limitMinutes === 1 ? "minute" : "minutes"}`;
     const environmentLog = join(jobDir, "checks", "environment.log");
+    let transcripts = { ok: false, reason: "the runner holds no way to read the build's sessions" };
+    if (deps.collectSessions !== void 0) {
+      try {
+        transcripts = await deps.collectSessions();
+      } catch (err) {
+        transcripts = { ok: false, reason: describeCallFailure(err) };
+      }
+    }
     if (job.microvm !== void 0) {
       if (deps.endBuildMicroVm === void 0) return await failAll("the runner has no way to stop the build's microVM, so no check environment was made");
       try {
@@ -1110,6 +1142,24 @@ async function runHostChecks(input) {
     }
     if (typeof settled === "string") return await failAll(settled);
     const ready = settled;
+    try {
+      await writeEvalInput({
+        job,
+        dir: ready.evalInput.dir,
+        scratch,
+        remote,
+        readToken,
+        branchHead: read.sha,
+        transcripts,
+        scrub: transcriptScrub(config, [config.apiKey, job.itemKey, readToken]),
+        readWorkItem: () => readWorkItem(config, job.item, deps.fetchImpl),
+        fetchDiff: deps.fetchDiff ?? ((input2) => diffBetween(input2)),
+        log
+      });
+      await ready.evalInput.deliver();
+    } catch (err) {
+      return await failAll(`the checks' input could not be written: ${describeCallFailure(err)}`);
+    }
     let usable = true;
     for (const check of checks) {
       if (!usable) {
@@ -1160,6 +1210,7 @@ async function runHostChecks(input) {
       writeJobFile(jobFilePath, job);
     }
     rmSync(scratch, { recursive: true, force: true });
+    rmSync(join(jobDir, "checks", EVAL_INPUT_NAME), { recursive: true, force: true });
     if (existsSync(scratch)) log.error(`${tag} the checks' scratch directory could not be removed`);
     log.line(`${tag} checks done (${formatDuration(now().getTime() - startedMs)})`);
   }
@@ -1359,6 +1410,10 @@ function releaseScrub(config, home) {
   const secrets = [...headerVariables(config.build?.destinations), ...CLAUDE_CREDENTIAL_VARIABLES].map((name) => process.env[name] ?? "");
   return { literals: [...scrubList(merged?.literals), ...secrets], patterns: scrubList(merged?.patterns) };
 }
+function transcriptScrub(config, secrets) {
+  const base = releaseScrub(config, homeFromEnv());
+  return { literals: [...scrubList(base.literals), ...secrets.filter((secret) => secret !== void 0 && secret !== "")], patterns: scrubList(base.patterns) };
+}
 function stripUnsendableReasonChars(text2) {
   return text2.replace(/\u0000/g, "").replace(/\p{Cs}/gu, "");
 }
@@ -1668,6 +1723,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     }
     await stopBuildMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath);
   };
+  const collectSessions = build !== void 0 ? () => copyTranscriptsFromContainer(build.runtime, build.state) : vmBuild !== void 0 ? () => copyTranscriptsFromMicroVm(vmBuild.runtime, vmBuild.state) : void 0;
   if (job.checkContainer !== void 0 && job.checksRan === true) {
     try {
       await cleanupContainer(deps.container ?? createContainerRuntime(), job.checkContainer);
@@ -1695,7 +1751,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
         config,
         job,
         jobDir: jobDirPath,
-        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, endBuildMicroVm, ...deps.hostChecks }
+        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, endBuildMicroVm, collectSessions, ...deps.hostChecks }
       });
     } catch (err) {
       log.error(`${tag} the host's checks stopped: ${describeCallFailure(err)} \xB7 continuing`);

package/dist/{chunk-NALVDFIS.js → chunk-MJLUWGUD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-TUUMW4TC.js';
-import { MIN_ENGINE_MAJOR } from './chunk-CM5QTKM4.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-LSPJHYHM.js';
+import { MIN_ENGINE_MAJOR } from './chunk-EQG7L6LM.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-5FWNEQNZ.js → chunk-NACLOOXP.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-ZZXLM64C.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
-import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-7ZR5UPMB.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
-import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-ZJ3WRVRG.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-JXH6LEEH.js';
+import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-CMFCCIQN.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
+import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';

package/dist/{chunk-U3GOI2B4.js → chunk-NPBLDMSD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-5TNS3PL7.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-CLURXEWV.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-BOLTI6LR.js → chunk-PLMTLGYH.js}

@@ -28,7 +28,7 @@ function resolveGatewayCredentials(sources = {}) {
     return { ok: false, message, url, credential, appId, kind };
   }
   if (!url || !credential || !appId) {
-    const missing = [!url && "--url", !credential && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
+    const missing = [!url && "--url", !credential && "a login or OUTERLAYER_API_KEY", !appId && "--app-id"].filter(Boolean).join(", ");
     return { ok: false, message: `missing ${missing}. ${MISSING_HELP}`, url, credential, appId, kind };
   }
   return { ok: true, url, credential, appId, kind };

package/dist/{chunk-IRCBTGWF.js → chunk-QJPO42VI.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-NALVDFIS.js';
-import { describeCallFailure } from './chunk-CM5QTKM4.js';
-import { WorkCommandError, getJson } from './chunk-5QLNZGAQ.js';
+import { isPlaceholderCommand } from './chunk-MJLUWGUD.js';
+import { describeCallFailure } from './chunk-EQG7L6LM.js';
+import { WorkCommandError, getJson } from './chunk-R5SPFO6F.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { builtinKind } from './chunk-PWBILI5P.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-OD2VTIHN.js';
-import { signerFor } from './chunk-M5POMKKW.js';
+import { builtinKind } from './chunk-7KI224YS.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-2FWL7CE2.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-5QLNZGAQ.js → chunk-R5SPFO6F.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-4ACZCY4I.js';
+import { autoConnect } from './chunk-WMPO3SKK.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { resolveRepoIdentity } from './chunk-GAYWY4GI.js';
+import { resolveRepoIdentity } from './chunk-HN2JBGSI.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
-import { signRunnerRequest } from './chunk-M5POMKKW.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
+import { signRunnerRequest } from './chunk-V7NIVOFD.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -347,7 +347,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-XBOZ3N6L.js');
+      const { logHookError } = await import('./hook-fast-OCHVQZTU.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-M5POMKKW.js → chunk-V7NIVOFD.js}

@@ -6,7 +6,7 @@ import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 
 createRequire(import.meta.url);
 
-// ../../node_modules/structured-headers/dist/util.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/util.js
 var asciiRe = /^[\x20-\x7E]*$/;
 var tokenRe = /^[a-zA-Z*][:/!#$%&'*+\-.^_`|~A-Za-z0-9]*$/;
 var keyRe = /^[a-z*][*\-_.a-z0-9]*$/;
@@ -40,7 +40,7 @@ function base64ToArrayBuffer(b64) {
   return bytes.buffer;
 }
 
-// ../../node_modules/structured-headers/dist/token.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/token.js
 var Token = class {
   constructor(value) {
     if (!isValidTokenStr(value)) {
@@ -53,7 +53,7 @@ var Token = class {
   }
 };
 
-// ../../node_modules/structured-headers/dist/displaystring.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/displaystring.js
 var DisplayString = class {
   constructor(value) {
     this.value = value;
@@ -63,7 +63,7 @@ var DisplayString = class {
   }
 };
 
-// ../../node_modules/structured-headers/dist/serializer.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/serializer.js
 var SerializeError = class extends Error {
 };
 function serializeDictionary(input) {
@@ -186,7 +186,7 @@ function serializeKey(input) {
   return input;
 }
 
-// ../../node_modules/structured-headers/dist/parser.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/parser.js
 function parseDictionary(input) {
   const parser = new Parser(input);
   return parser.parseDictionary();