@outerlayer/cli 0.8.1 → 0.8.2

package/dist/{chunk-M4ERCYDB.js → chunk-EQG7L6LM.js}

@@ -1,21 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTNFGMHO.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-Y7UQHKFY.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-TEKZRTM3.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-NPBLDMSD.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-2BRSMBBB.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-CLURXEWV.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
-import { execCapture } from './chunk-ZOAEPWGL.js';
-import { GUEST_CID } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson } from './chunk-KV47VQJZ.js';
+import { execCapture } from './chunk-HWMYGAKF.js';
+import { GUEST_CID } from './chunk-2E2MG3KW.js';
+import { WorkCommandError, postJson } from './chunk-R5SPFO6F.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-HN2JBGSI.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
-import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-OD2VTIHN.js';
-import { defaultGitRunner, materializeContext } from './chunk-BQFNZOMQ.js';
-import { readContextManifest, readSourceCache } from './chunk-ZZXLM64C.js';
+import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-2FWL7CE2.js';
+import { defaultGitRunner, materializeContext } from './chunk-NACLOOXP.js';
+import { readContextManifest, readSourceCache } from './chunk-ZJ3WRVRG.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-CMFCCIQN.js';
 import { signingFetchFor } from './chunk-YO4PSLVB.js';
+import { downconvertSession } from './chunk-YNJEOGDL.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, basename } from 'path';
@@ -430,7 +433,11 @@ async function prepareBranch(opts) {
     throw new BranchPrepareError(`the pull request's branch ${branch} is not on the remote`);
   }
   await mustGit(git2, workdir, `checking out ${branch}`, ["checkout", "--quiet", "-B", branch, start]);
-  return { branch, head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]) };
+  return {
+    branch,
+    head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]),
+    startCommit: await mustGit(git2, workdir, `reading the commit of ${defaultBranch}`, ["rev-parse", `origin/${defaultBranch}`])
+  };
 }
 async function isMerged(git2, workdir, branch, defaultBranch) {
   const result = await git2(workdir, ["merge-base", "--is-ancestor", `origin/${branch}`, `origin/${defaultBranch}`]);
@@ -892,6 +899,7 @@ function adoptionFailureReason(result) {
 }
 async function runBuildSteps(input) {
   const { exec, log, tag, repository } = input;
+  let startCommit = "";
   const rewrite = await exec(["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"], "/build/work");
   if (rewrite.status !== 0) return { ok: false, reason: `configuring the build's git remote failed (exit ${rewrite.status})` };
   const clone = await exec(["git", "clone", "--filter=blob:none", "--single-branch", `https://github.com/${repository}.git`, CHECKOUT_DIR], "/build/work");
@@ -908,6 +916,7 @@ async function runBuildSteps(input) {
         return { status: ran.status, stdout: ran.stdout.trim(), stderr: ran.stderr.trim() };
       }
     });
+    startCommit = prepared.startCommit;
     log.line(`${tag} on ${prepared.branch} at ${prepared.head.slice(0, 8)}`);
   } catch (err) {
     if (err instanceof BranchPrepareError) return { ok: false, reason: err.message };
@@ -934,7 +943,200 @@ async function runBuildSteps(input) {
     }
     if (input.aborted()) return aborted();
   }
-  return { ok: true };
+  return { ok: true, startCommit };
+}
+var EVAL_INPUT_NAME = "eval-input";
+var TRANSCRIPT_ROOT = "/build/home/.claude/projects";
+var MAX_TRANSCRIPT_BYTES = 7 * 1024 * 1024;
+var MAX_TRANSCRIPTS = 500;
+var MAX_TOTAL_TRANSCRIPT_BYTES = 64 * 1024 * 1024;
+var TRANSCRIPT_COPY_MS = 2 * 60 * 1e3;
+var BUILD_HOME = "/build/home";
+function firstLine4(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+async function copyTranscripts(run, now = Date.now) {
+  const deadline = now() + TRANSCRIPT_COPY_MS;
+  let listed;
+  try {
+    listed = await run(["find", TRANSCRIPT_ROOT, "-type", "f", "-name", "*.jsonl", "-print0"]);
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+  if (listed.status !== 0 && !/No such file or directory/.test(listed.stderr)) {
+    return { ok: false, reason: `listing the transcripts failed (exit ${listed.status})${firstLine4(listed.stderr) === "" ? "" : `: ${firstLine4(listed.stderr)}`}` };
+  }
+  const paths = listed.stdout.split("\0").filter((entry) => entry.startsWith(`${TRANSCRIPT_ROOT}/`) && !entry.includes("\n") && !entry.slice(TRANSCRIPT_ROOT.length + 1).split("/").includes("..")).map((entry) => entry.slice(TRANSCRIPT_ROOT.length + 1)).sort();
+  const copied = [];
+  const missed = [];
+  let total = 0;
+  for (const [index, path] of paths.entries()) {
+    if (index >= MAX_TRANSCRIPTS) {
+      missed.push({ path, reason: `the build wrote more than ${MAX_TRANSCRIPTS} transcripts` });
+      continue;
+    }
+    if (now() >= deadline) {
+      missed.push({ path, reason: `copying the transcripts took longer than ${TRANSCRIPT_COPY_MS / 1e3} seconds` });
+      continue;
+    }
+    try {
+      const read = await run(["head", "-c", String(MAX_TRANSCRIPT_BYTES + 1), `${TRANSCRIPT_ROOT}/${path}`]);
+      if (read.status !== 0) missed.push({ path, reason: `reading it failed (exit ${read.status})${firstLine4(read.stderr) === "" ? "" : `: ${firstLine4(read.stderr)}`}` });
+      else if (Buffer.byteLength(read.stdout) > MAX_TRANSCRIPT_BYTES) missed.push({ path, reason: `it is larger than ${MAX_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
+      else if (total + Buffer.byteLength(read.stdout) > MAX_TOTAL_TRANSCRIPT_BYTES) missed.push({ path, reason: `copying it would take the transcripts past ${MAX_TOTAL_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
+      else {
+        total += Buffer.byteLength(read.stdout);
+        copied.push({ path, content: read.stdout });
+      }
+    } catch (err) {
+      missed.push({ path, reason: describeCallFailure(err) });
+    }
+  }
+  return { ok: true, copied, missed };
+}
+function traceIdForSession(sessionId) {
+  const stripped = sessionId.replace(/-/g, "").toLowerCase();
+  if (/^[0-9a-f]{32}$/.test(stripped)) return stripped;
+  return createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
+}
+function sessionOptionsOf(path) {
+  const segments = path.split("/");
+  const stem = (segments.at(-1) ?? path).replace(/\.jsonl$/, "");
+  const at = segments.lastIndexOf("subagents");
+  if (at <= 0) return { fallbackId: stem };
+  const parent = segments[at - 1];
+  return {
+    fallbackId: stem,
+    isSubagent: true,
+    ...parent ? { parentSessionId: parent } : {},
+    ownId: stem,
+    ...segments[at + 1] === "workflows" && segments[at + 2] ? { workflowRunId: segments[at + 2] } : {}
+  };
+}
+function scrubbing(scrub, author, work) {
+  setCustomScrubbers(scrub, () => void 0);
+  setLocalIdentity({ home: BUILD_HOME, ...author?.name === void 0 ? {} : { name: author.name }, ...author?.email === void 0 ? {} : { email: author.email } });
+  setRepoRoot(CHECKOUT_DIR);
+  try {
+    return work();
+  } finally {
+    setCustomScrubbers(void 0, () => void 0);
+    setLocalIdentity({});
+    setRepoRoot(void 0);
+  }
+}
+function scrubLine(line) {
+  try {
+    return JSON.stringify(scrubDeep(JSON.parse(line)));
+  } catch {
+    return scrubText(line);
+  }
+}
+function writeReadOnly(path, text) {
+  writeFileSync(path, text);
+  chmodSync(path, 292);
+}
+function diffBase(job) {
+  const recorded = (job.container ?? job.microvm)?.startCommit;
+  if (recorded !== void 0 && recorded !== "") return { commit: recorded, source: "build" };
+  const recipe = job.environment?.recipe?.sourceCommit;
+  return recipe === void 0 || recipe === "" ? void 0 : { commit: recipe, source: "recipe" };
+}
+async function writeEvalInput(request) {
+  const { job, dir, log } = request;
+  const tag = `#${job.item}`;
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(join(dir, "sessions"), { recursive: true });
+  chmodSync(dir, 493);
+  chmodSync(join(dir, "sessions"), 493);
+  let workItem;
+  try {
+    const data = await request.readWorkItem();
+    writeReadOnly(join(dir, "work-item.json"), `${JSON.stringify(data, null, 2)}
+`);
+    workItem = { status: "written" };
+  } catch (err) {
+    workItem = { status: "unavailable", reason: describeCallFailure(err) };
+    log.error(`${tag} the work item could not be read for the checks' input: ${workItem.reason}`);
+  }
+  const patch = join(dir, "diff.patch");
+  const base = diffBase(job);
+  let diff;
+  if (base === void 0) {
+    diff = { status: "unavailable", reason: "the build recorded no commit it started from" };
+  } else {
+    const fetched = await request.fetchDiff({ remote: request.remote, dir: join(request.scratch, "diff"), base: base.commit, head: request.branchHead, token: request.readToken, output: patch });
+    diff = fetched.ok ? { status: "written", base: base.commit, head: request.branchHead, baseSource: base.source } : { status: "unavailable", base: base.commit, head: request.branchHead, baseSource: base.source, reason: fetched.reason };
+    if (!fetched.ok) log.error(`${tag} the diff could not be read for the checks' input: ${fetched.reason}`);
+  }
+  if (diff.status === "unavailable") writeFileSync(patch, "");
+  chmodSync(patch, 292);
+  const sessions = [];
+  const parsed = [];
+  const copiedByTrace = /* @__PURE__ */ new Map();
+  let sessionsUnavailable;
+  if (!request.transcripts.ok) {
+    sessionsUnavailable = request.transcripts.reason;
+    log.error(`${tag} the sessions could not be copied for the checks' input: ${sessionsUnavailable}`);
+  } else {
+    const { copied, missed } = request.transcripts;
+    scrubbing(request.scrub, request.job.commitIdentity?.author, () => {
+      for (const transcript of copied) {
+        const options = sessionOptionsOf(transcript.path);
+        const subagent = options.isSubagent === true;
+        const stem = options.fallbackId ?? transcript.path;
+        let session = null;
+        try {
+          session = parseTranscript(transcript.content, options).session;
+        } catch {
+        }
+        const traceId = traceIdForSession(session?.id ?? stem);
+        if (session === null) {
+          sessions.push({ traceId, subagent, status: "missing", reason: "the transcript holds no session" });
+          log.error(`${tag} the transcript ${transcript.path} holds no session, so the checks' input leaves it out`);
+          continue;
+        }
+        const kept = copiedByTrace.get(traceId);
+        if (kept !== void 0) {
+          kept.duplicates = (kept.duplicates ?? 0) + 1;
+          log.error(`${tag} the transcript ${transcript.path} repeats session ${traceId}, so the checks' input leaves it out`);
+          continue;
+        }
+        const file = `sessions/${traceId}.jsonl`;
+        const text = transcript.content.split("\n").filter((line) => line.trim() !== "").map(scrubLine).join("\n");
+        writeReadOnly(join(dir, file), `${text}
+`);
+        scrubDeep(session);
+        parsed.push({ session: downconvertSession(session, "full"), traceId, subagent });
+        const entry = { traceId, subagent, file, status: "copied" };
+        copiedByTrace.set(traceId, entry);
+        sessions.push(entry);
+      }
+      for (const miss of missed) {
+        const options = sessionOptionsOf(miss.path);
+        sessions.push({ traceId: traceIdForSession(options.fallbackId ?? miss.path), subagent: options.isSubagent === true, status: "missing", reason: miss.reason });
+        log.error(`${tag} the transcript ${miss.path} could not be copied for the checks' input: ${miss.reason}`);
+      }
+    });
+  }
+  const ordered = orderSessions(parsed.map((entry) => entry.session));
+  const traceOf = new Map(parsed.map((entry) => [entry.session.id, entry.traceId]));
+  const facts = extractFacts(sessionsToTimeline(parsed.map((entry) => entry.session)));
+  const traceAt = (index) => traceOf.get(ordered[index].id);
+  const recorded = { commands: facts.coverage.has("commands"), edits: facts.coverage.has("edits") };
+  const activity = {
+    schemaVersion: 1,
+    sessions: sessions.sort((a, b) => a.traceId.localeCompare(b.traceId)),
+    // Left out of the file when undefined.
+    sessionsUnavailable,
+    workItem,
+    diff,
+    recorded,
+    commands: recorded.commands ? facts.runs.map((run) => ({ seq: run.seq, traceId: traceAt(run.sessionIndex), turn: run.turnIndex, command: run.normalized, kind: run.kind, status: run.status })) : null,
+    edits: recorded.edits ? facts.edits.map((edit) => ({ seq: edit.seq, traceId: traceAt(edit.sessionIndex), turn: edit.turnIndex, file: edit.file, status: edit.status })) : null
+  };
+  writeReadOnly(join(dir, "activity.json"), `${JSON.stringify(activity, null, 2)}
+`);
 }
 
 // src/runner/container/agent-user.ts
@@ -1996,7 +2198,7 @@ function gitRemoteFor(runtime, input) {
     ...input.readOnly === true ? { readOnly: true } : {}
   });
 }
-function firstLine4(text) {
+function firstLine5(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 var NO_ENV = { literals: {}, passed: {} };
@@ -2121,7 +2323,7 @@ async function provisionContainer(input) {
     }
     return aborted2 ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(reason);
   };
-  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`);
+  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`);
   if (input.aborted()) return bail("", true);
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
@@ -2206,6 +2408,7 @@ async function provisionContainer(input) {
     removeStagedContext: () => removeStagedContext(buildDir2)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
+  state.startCommit = steps.startCommit;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
 function agentVersionOf(toolsJson) {
@@ -2341,6 +2544,18 @@ async function syncInContainer(input) {
     return { ok: false, reason: describeCallFailure(err) };
   }
 }
+async function copyTranscriptsFromContainer(runtime, state) {
+  try {
+    if (state.stopped) {
+      const started = await runtime.host.start(state.container);
+      if (started.status !== 0) return { ok: false, reason: `the build's container could not be started again (exit ${started.status})` };
+      state.stopped = false;
+    }
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+  return copyTranscripts((argv) => runtime.host.exec({ container: state.container, user: state.agentUser ?? ADDED_USER, env: NO_ENV, argv }));
+}
 var HOOK_ERRORS_IN_CONTAINER = "/build/home/.outerlayer/spool/hook-errors.log";
 async function copyHookErrors(runtime, state, jobDir) {
   try {
@@ -2403,7 +2618,7 @@ async function startCheckContainer(input) {
     }
     return { ok: false, reason };
   };
-  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`);
+  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`);
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
   try {
@@ -2438,6 +2653,8 @@ async function startCheckContainer(input) {
     ok: true,
     container: {
       state,
+      // The directory the container sees read-only at `JOB_MOUNT` is the build's directory on the host, so a folder written there is already in place.
+      evalInput: { dir: join(buildDir2, EVAL_INPUT_NAME), deliver: async () => void 0 },
       exec: (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env, argv }, opts?.logPath === void 0 ? void 0 : { logPath: opts.logPath }),
       restart: async () => {
         await host.stop(name);
@@ -2448,4 +2665,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BuildTokens, EVAL_INPUT_NAME, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };

package/dist/{chunk-I7CJIRMM.js → chunk-ERI5GBNI.js}

@@ -59,6 +59,7 @@ function runRunnerInstall(args) {
   }
   return {
     version,
+    previous: installed,
     execStart: execStartLine(configPath, nodePath),
     launcher: {
       path: launcherPath(args.home),
@@ -89,5 +90,9 @@ function launcherSummary(launcher) {
   if (launcher.state === "foreign") return void 0;
   return `${launcher.state === "unchanged" ? "outerlayer command already at" : "wrote the outerlayer command at"} ${launcher.path}, which runs the CLI that ${launcher.follows} names`;
 }
+function restartNote(result) {
+  if (result.previous === void 0 || result.previous === result.version) return void 0;
+  return `current moved from ${result.previous} to ${result.version}: a runner its service started takes no new work, waits for its running builds to finish, then restarts on ${result.version}. A runner started by hand keeps running until you restart it`;
+}
 
-export { RunnerDowngradeError, RunnerInstallError, launcherSummary, runRunnerInstall };
+export { RunnerDowngradeError, RunnerInstallError, launcherSummary, restartNote, runRunnerInstall };

package/dist/{chunk-ILEA3YHM.js → chunk-EWBM2USM.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { remoteLookupFailed } from './chunk-GAYWY4GI.js';
+import { remoteLookupFailed } from './chunk-HN2JBGSI.js';
 import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
-import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { createInterface } from 'readline/promises';

package/dist/{chunk-EV3M3EH7.js → chunk-G54QHBTI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-7ZR5UPMB.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-JXH6LEEH.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-CMFCCIQN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-M3SQ4YGD.js → chunk-GXSMDL4M.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-VXLJORHL.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-JXH6LEEH.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-GAYWY4GI.js → chunk-HN2JBGSI.js}

@@ -21663,6 +21663,7 @@ function buildTokenPricingDictionary(models) {
 }
 var CACHE_CREATE_1H_INPUT_MULTIPLIER = 2;
 var isCount = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
+var tokensOf = (n) => isCount(n) ? n : 0;
 var hasTokens = (usage) => isCount(usage.in) || isCount(usage.out) || isCount(usage.cacheRead) || isCount(usage.cacheCreate5m) || isCount(usage.cacheCreate1h);
 function selectRates(price, context = {}) {
   var _a5, _b, _c;
@@ -21704,7 +21705,7 @@ function priceUsage(usage, price, context = {}) {
   if (isCount(usage.cacheCreate5m) && rates.cacheCreate === void 0) unpriced.push("cacheCreate5m");
   if (unpriced.length > 0) return { costUsd: null, unpricedClasses: unpriced };
   return {
-    costUsd: rates.in * usage.in + rates.out * usage.out + ((_a5 = rates.cacheRead) != null ? _a5 : 0) * usage.cacheRead + ((_b = rates.cacheCreate) != null ? _b : 0) * usage.cacheCreate5m + ((_c = rates.cacheCreate1h) != null ? _c : rates.in * CACHE_CREATE_1H_INPUT_MULTIPLIER) * usage.cacheCreate1h
+    costUsd: rates.in * tokensOf(usage.in) + rates.out * tokensOf(usage.out) + ((_a5 = rates.cacheRead) != null ? _a5 : 0) * tokensOf(usage.cacheRead) + ((_b = rates.cacheCreate) != null ? _b : 0) * tokensOf(usage.cacheCreate5m) + ((_c = rates.cacheCreate1h) != null ? _c : rates.in * CACHE_CREATE_1H_INPUT_MULTIPLIER) * tokensOf(usage.cacheCreate1h)
   };
 }
 function priceBuckets(buckets, dict) {

package/dist/{chunk-ZOAEPWGL.js → chunk-HWMYGAKF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-R7STSBLC.js';
+import { EXEC_PORT } from './chunk-2E2MG3KW.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-ABIWDUMS.js → chunk-IS4DIGBQ.js}

@@ -6,6 +6,18 @@ import { join, dirname } from 'path';
 import { createHash } from 'crypto';
 
 createRequire(import.meta.url);
+
+// src/runner/update/installed-switch.ts
+function decideInstalledSwitch(input) {
+  const to = input.current;
+  if (to === void 0 || to === input.own || !input.fromCurrent) return { kind: "none" };
+  if (!input.installed) return { kind: "missing", to };
+  if (!input.underService) return { kind: "foreground", to };
+  return { kind: "restart", to };
+}
+function startedByService(env, parentPid) {
+  return (env.INVOCATION_ID ?? "") !== "" && parentPid === 1;
+}
 var REGISTRY_URL = "https://registry.npmjs.org";
 var PACKAGE_NAME = "@outerlayer/cli";
 var PACKAGE_PATH = "@outerlayer%2fcli";
@@ -101,4 +113,4 @@ async function auditSignatures(runNpm, dir) {
   return { ok: true };
 }
 
-export { auditSignatures, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm };
+export { auditSignatures, decideInstalledSwitch, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm, startedByService };

package/dist/{chunk-WVGSB3Z2.js → chunk-J5DPVNL3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-R7STSBLC.js';
-import { RELAY_PORT } from './chunk-OD2VTIHN.js';
+import { EXEC_PORT } from './chunk-2E2MG3KW.js';
+import { RELAY_PORT } from './chunk-2FWL7CE2.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-VXLJORHL.js → chunk-JXH6LEEH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-7ZR5UPMB.js';
+import { splitRawFile } from './chunk-CMFCCIQN.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-KSLNQOOS.js → chunk-KI7VPNKC.js}

@@ -628,7 +628,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-4PMTDS6K.js');
+          const { materializeContext: materialize } = await import('./context-materialize-YR3JQCUF.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-QNRSFEGY.js → chunk-LSPJHYHM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-M4ERCYDB.js';
+import { MIN_ENGINE_MAJOR } from './chunk-EQG7L6LM.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';