@outerlayer/cli 0.8.1 → 0.8.3

package/dist/{chunk-HSN5QNS5.js → chunk-4GS22GWM.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-KV47VQJZ.js';
-import { isLinkedRepository } from './chunk-ILEA3YHM.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-2OZH6ZY2.js';
+import { isLinkedRepository } from './chunk-EWBM2USM.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-GAYWY4GI.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-HN2JBGSI.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-ZZXLM64C.js';
+import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-42OX3Q3A.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-KSLNQOOS.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-7HWIKEU5.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1004,7 +1004,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-Z3USDBLU.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-OOBPCY7Q.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-KALLPCRB.js');
+    const { runnerHostChecks } = await import('./doctor-M65EXDE6.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1042,7 +1042,7 @@ async function gatherDoctorChecks() {
     const runner = (() => {
       try {
         const { concurrency, build, housekeeping } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g", minFreeDisk: housekeeping?.minFreeDisk };
+        return { concurrency, buildMemory: build?.memory ?? "8g", minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts };
       } catch {
         return void 0;
       }
@@ -1051,7 +1051,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync2 } = await import('fs');
       if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-XAUSB7L3.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-FHTVJZS6.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-C33LT5KQ.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-BQFNZOMQ.js → chunk-4NOIKXUL.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-ZZXLM64C.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
-import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-7ZR5UPMB.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-42OX3Q3A.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-OPSPDEVU.js';
+import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-36H5BONJ.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';

package/dist/{chunk-KSLNQOOS.js → chunk-7HWIKEU5.js}

@@ -628,7 +628,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-4PMTDS6K.js');
+          const { materializeContext: materialize } = await import('./context-materialize-YBOW5YCC.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-PWBILI5P.js → chunk-7KI224YS.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-OD2VTIHN.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-2FWL7CE2.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';

package/dist/{chunk-Q4432IZT.js → chunk-BORFBENT.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-Z2THOHPP.js';
-import { describeCallFailure } from './chunk-M4ERCYDB.js';
-import { WorkCommandError, getJson } from './chunk-KV47VQJZ.js';
+import { isPlaceholderCommand } from './chunk-OCHRV5A6.js';
+import { describeCallFailure } from './chunk-BPTAOD6W.js';
+import { WorkCommandError, getJson } from './chunk-2OZH6ZY2.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { builtinKind } from './chunk-PWBILI5P.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-OD2VTIHN.js';
+import { builtinKind } from './chunk-7KI224YS.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-2FWL7CE2.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-M4ERCYDB.js → chunk-BPTAOD6W.js}

@@ -1,21 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTNFGMHO.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-Y7UQHKFY.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-TEKZRTM3.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-NPBLDMSD.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-2BRSMBBB.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-CLURXEWV.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
-import { execCapture } from './chunk-ZOAEPWGL.js';
-import { GUEST_CID } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson } from './chunk-KV47VQJZ.js';
+import { execCapture } from './chunk-HWMYGAKF.js';
+import { GUEST_CID } from './chunk-2E2MG3KW.js';
+import { WorkCommandError, postJson } from './chunk-2OZH6ZY2.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-HN2JBGSI.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
-import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-OD2VTIHN.js';
-import { defaultGitRunner, materializeContext } from './chunk-BQFNZOMQ.js';
-import { readContextManifest, readSourceCache } from './chunk-ZZXLM64C.js';
+import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-2FWL7CE2.js';
+import { defaultGitRunner, materializeContext } from './chunk-4NOIKXUL.js';
+import { readContextManifest, readSourceCache } from './chunk-42OX3Q3A.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-36H5BONJ.js';
 import { signingFetchFor } from './chunk-YO4PSLVB.js';
+import { downconvertSession } from './chunk-YNJEOGDL.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, basename } from 'path';
@@ -430,7 +433,11 @@ async function prepareBranch(opts) {
     throw new BranchPrepareError(`the pull request's branch ${branch} is not on the remote`);
   }
   await mustGit(git2, workdir, `checking out ${branch}`, ["checkout", "--quiet", "-B", branch, start]);
-  return { branch, head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]) };
+  return {
+    branch,
+    head: await mustGit(git2, workdir, "reading the checked-out commit", ["rev-parse", "HEAD"]),
+    startCommit: await mustGit(git2, workdir, `reading the commit of ${defaultBranch}`, ["rev-parse", `origin/${defaultBranch}`])
+  };
 }
 async function isMerged(git2, workdir, branch, defaultBranch) {
   const result = await git2(workdir, ["merge-base", "--is-ancestor", `origin/${branch}`, `origin/${defaultBranch}`]);
@@ -892,6 +899,7 @@ function adoptionFailureReason(result) {
 }
 async function runBuildSteps(input) {
   const { exec, log, tag, repository } = input;
+  let startCommit = "";
   const rewrite = await exec(["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"], "/build/work");
   if (rewrite.status !== 0) return { ok: false, reason: `configuring the build's git remote failed (exit ${rewrite.status})` };
   const clone = await exec(["git", "clone", "--filter=blob:none", "--single-branch", `https://github.com/${repository}.git`, CHECKOUT_DIR], "/build/work");
@@ -908,6 +916,7 @@ async function runBuildSteps(input) {
         return { status: ran.status, stdout: ran.stdout.trim(), stderr: ran.stderr.trim() };
       }
     });
+    startCommit = prepared.startCommit;
     log.line(`${tag} on ${prepared.branch} at ${prepared.head.slice(0, 8)}`);
   } catch (err) {
     if (err instanceof BranchPrepareError) return { ok: false, reason: err.message };
@@ -934,7 +943,200 @@ async function runBuildSteps(input) {
     }
     if (input.aborted()) return aborted();
   }
-  return { ok: true };
+  return { ok: true, startCommit };
+}
+var EVAL_INPUT_NAME = "eval-input";
+var TRANSCRIPT_ROOT = "/build/home/.claude/projects";
+var MAX_TRANSCRIPT_BYTES = 7 * 1024 * 1024;
+var MAX_TRANSCRIPTS = 500;
+var MAX_TOTAL_TRANSCRIPT_BYTES = 64 * 1024 * 1024;
+var TRANSCRIPT_COPY_MS = 2 * 60 * 1e3;
+var BUILD_HOME = "/build/home";
+function firstLine4(text) {
+  return text.trim().split("\n")[0] ?? "";
+}
+async function copyTranscripts(run, now = Date.now) {
+  const deadline = now() + TRANSCRIPT_COPY_MS;
+  let listed;
+  try {
+    listed = await run(["find", TRANSCRIPT_ROOT, "-type", "f", "-name", "*.jsonl", "-print0"]);
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+  if (listed.status !== 0 && !/No such file or directory/.test(listed.stderr)) {
+    return { ok: false, reason: `listing the transcripts failed (exit ${listed.status})${firstLine4(listed.stderr) === "" ? "" : `: ${firstLine4(listed.stderr)}`}` };
+  }
+  const paths = listed.stdout.split("\0").filter((entry) => entry.startsWith(`${TRANSCRIPT_ROOT}/`) && !entry.includes("\n") && !entry.slice(TRANSCRIPT_ROOT.length + 1).split("/").includes("..")).map((entry) => entry.slice(TRANSCRIPT_ROOT.length + 1)).sort();
+  const copied = [];
+  const missed = [];
+  let total = 0;
+  for (const [index, path] of paths.entries()) {
+    if (index >= MAX_TRANSCRIPTS) {
+      missed.push({ path, reason: `the build wrote more than ${MAX_TRANSCRIPTS} transcripts` });
+      continue;
+    }
+    if (now() >= deadline) {
+      missed.push({ path, reason: `copying the transcripts took longer than ${TRANSCRIPT_COPY_MS / 1e3} seconds` });
+      continue;
+    }
+    try {
+      const read = await run(["head", "-c", String(MAX_TRANSCRIPT_BYTES + 1), `${TRANSCRIPT_ROOT}/${path}`]);
+      if (read.status !== 0) missed.push({ path, reason: `reading it failed (exit ${read.status})${firstLine4(read.stderr) === "" ? "" : `: ${firstLine4(read.stderr)}`}` });
+      else if (Buffer.byteLength(read.stdout) > MAX_TRANSCRIPT_BYTES) missed.push({ path, reason: `it is larger than ${MAX_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
+      else if (total + Buffer.byteLength(read.stdout) > MAX_TOTAL_TRANSCRIPT_BYTES) missed.push({ path, reason: `copying it would take the transcripts past ${MAX_TOTAL_TRANSCRIPT_BYTES / (1024 * 1024)} MiB` });
+      else {
+        total += Buffer.byteLength(read.stdout);
+        copied.push({ path, content: read.stdout });
+      }
+    } catch (err) {
+      missed.push({ path, reason: describeCallFailure(err) });
+    }
+  }
+  return { ok: true, copied, missed };
+}
+function traceIdForSession(sessionId) {
+  const stripped = sessionId.replace(/-/g, "").toLowerCase();
+  if (/^[0-9a-f]{32}$/.test(stripped)) return stripped;
+  return createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
+}
+function sessionOptionsOf(path) {
+  const segments = path.split("/");
+  const stem = (segments.at(-1) ?? path).replace(/\.jsonl$/, "");
+  const at = segments.lastIndexOf("subagents");
+  if (at <= 0) return { fallbackId: stem };
+  const parent = segments[at - 1];
+  return {
+    fallbackId: stem,
+    isSubagent: true,
+    ...parent ? { parentSessionId: parent } : {},
+    ownId: stem,
+    ...segments[at + 1] === "workflows" && segments[at + 2] ? { workflowRunId: segments[at + 2] } : {}
+  };
+}
+function scrubbing(scrub, author, work) {
+  setCustomScrubbers(scrub, () => void 0);
+  setLocalIdentity({ home: BUILD_HOME, ...author?.name === void 0 ? {} : { name: author.name }, ...author?.email === void 0 ? {} : { email: author.email } });
+  setRepoRoot(CHECKOUT_DIR);
+  try {
+    return work();
+  } finally {
+    setCustomScrubbers(void 0, () => void 0);
+    setLocalIdentity({});
+    setRepoRoot(void 0);
+  }
+}
+function scrubLine(line) {
+  try {
+    return JSON.stringify(scrubDeep(JSON.parse(line)));
+  } catch {
+    return scrubText(line);
+  }
+}
+function writeReadOnly(path, text) {
+  writeFileSync(path, text);
+  chmodSync(path, 292);
+}
+function diffBase(job) {
+  const recorded = (job.container ?? job.microvm)?.startCommit;
+  if (recorded !== void 0 && recorded !== "") return { commit: recorded, source: "build" };
+  const recipe = job.environment?.recipe?.sourceCommit;
+  return recipe === void 0 || recipe === "" ? void 0 : { commit: recipe, source: "recipe" };
+}
+async function writeEvalInput(request) {
+  const { job, dir, log } = request;
+  const tag = `#${job.item}`;
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(join(dir, "sessions"), { recursive: true });
+  chmodSync(dir, 493);
+  chmodSync(join(dir, "sessions"), 493);
+  let workItem;
+  try {
+    const data = await request.readWorkItem();
+    writeReadOnly(join(dir, "work-item.json"), `${JSON.stringify(data, null, 2)}
+`);
+    workItem = { status: "written" };
+  } catch (err) {
+    workItem = { status: "unavailable", reason: describeCallFailure(err) };
+    log.error(`${tag} the work item could not be read for the checks' input: ${workItem.reason}`);
+  }
+  const patch = join(dir, "diff.patch");
+  const base = diffBase(job);
+  let diff;
+  if (base === void 0) {
+    diff = { status: "unavailable", reason: "the build recorded no commit it started from" };
+  } else {
+    const fetched = await request.fetchDiff({ remote: request.remote, dir: join(request.scratch, "diff"), base: base.commit, head: request.branchHead, token: request.readToken, output: patch });
+    diff = fetched.ok ? { status: "written", base: base.commit, head: request.branchHead, baseSource: base.source } : { status: "unavailable", base: base.commit, head: request.branchHead, baseSource: base.source, reason: fetched.reason };
+    if (!fetched.ok) log.error(`${tag} the diff could not be read for the checks' input: ${fetched.reason}`);
+  }
+  if (diff.status === "unavailable") writeFileSync(patch, "");
+  chmodSync(patch, 292);
+  const sessions = [];
+  const parsed = [];
+  const copiedByTrace = /* @__PURE__ */ new Map();
+  let sessionsUnavailable;
+  if (!request.transcripts.ok) {
+    sessionsUnavailable = request.transcripts.reason;
+    log.error(`${tag} the sessions could not be copied for the checks' input: ${sessionsUnavailable}`);
+  } else {
+    const { copied, missed } = request.transcripts;
+    scrubbing(request.scrub, request.job.commitIdentity?.author, () => {
+      for (const transcript of copied) {
+        const options = sessionOptionsOf(transcript.path);
+        const subagent = options.isSubagent === true;
+        const stem = options.fallbackId ?? transcript.path;
+        let session = null;
+        try {
+          session = parseTranscript(transcript.content, options).session;
+        } catch {
+        }
+        const traceId = traceIdForSession(session?.id ?? stem);
+        if (session === null) {
+          sessions.push({ traceId, subagent, status: "missing", reason: "the transcript holds no session" });
+          log.error(`${tag} the transcript ${transcript.path} holds no session, so the checks' input leaves it out`);
+          continue;
+        }
+        const kept = copiedByTrace.get(traceId);
+        if (kept !== void 0) {
+          kept.duplicates = (kept.duplicates ?? 0) + 1;
+          log.error(`${tag} the transcript ${transcript.path} repeats session ${traceId}, so the checks' input leaves it out`);
+          continue;
+        }
+        const file = `sessions/${traceId}.jsonl`;
+        const text = transcript.content.split("\n").filter((line) => line.trim() !== "").map(scrubLine).join("\n");
+        writeReadOnly(join(dir, file), `${text}
+`);
+        scrubDeep(session);
+        parsed.push({ session: downconvertSession(session, "full"), traceId, subagent });
+        const entry = { traceId, subagent, file, status: "copied" };
+        copiedByTrace.set(traceId, entry);
+        sessions.push(entry);
+      }
+      for (const miss of missed) {
+        const options = sessionOptionsOf(miss.path);
+        sessions.push({ traceId: traceIdForSession(options.fallbackId ?? miss.path), subagent: options.isSubagent === true, status: "missing", reason: miss.reason });
+        log.error(`${tag} the transcript ${miss.path} could not be copied for the checks' input: ${miss.reason}`);
+      }
+    });
+  }
+  const ordered = orderSessions(parsed.map((entry) => entry.session));
+  const traceOf = new Map(parsed.map((entry) => [entry.session.id, entry.traceId]));
+  const facts = extractFacts(sessionsToTimeline(parsed.map((entry) => entry.session)));
+  const traceAt = (index) => traceOf.get(ordered[index].id);
+  const recorded = { commands: facts.coverage.has("commands"), edits: facts.coverage.has("edits") };
+  const activity = {
+    schemaVersion: 1,
+    sessions: sessions.sort((a, b) => a.traceId.localeCompare(b.traceId)),
+    // Left out of the file when undefined.
+    sessionsUnavailable,
+    workItem,
+    diff,
+    recorded,
+    commands: recorded.commands ? facts.runs.map((run) => ({ seq: run.seq, traceId: traceAt(run.sessionIndex), turn: run.turnIndex, command: run.normalized, kind: run.kind, status: run.status })) : null,
+    edits: recorded.edits ? facts.edits.map((edit) => ({ seq: edit.seq, traceId: traceAt(edit.sessionIndex), turn: edit.turnIndex, file: edit.file, status: edit.status })) : null
+  };
+  writeReadOnly(join(dir, "activity.json"), `${JSON.stringify(activity, null, 2)}
+`);
 }
 
 // src/runner/container/agent-user.ts
@@ -1996,7 +2198,7 @@ function gitRemoteFor(runtime, input) {
     ...input.readOnly === true ? { readOnly: true } : {}
   });
 }
-function firstLine4(text) {
+function firstLine5(text) {
   return text.trim().split("\n")[0] ?? "";
 }
 var NO_ENV = { literals: {}, passed: {} };
@@ -2121,7 +2323,7 @@ async function provisionContainer(input) {
     }
     return aborted2 ? { ok: false, reason: "ended before provision finished", aborted: true } : fail(reason);
   };
-  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`);
+  const dockerFailed = (what, result) => bail(`${what} failed (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`);
   if (input.aborted()) return bail("", true);
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
@@ -2206,6 +2408,7 @@ async function provisionContainer(input) {
     removeStagedContext: () => removeStagedContext(buildDir2)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
+  state.startCommit = steps.startCommit;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
 function agentVersionOf(toolsJson) {
@@ -2341,6 +2544,18 @@ async function syncInContainer(input) {
     return { ok: false, reason: describeCallFailure(err) };
   }
 }
+async function copyTranscriptsFromContainer(runtime, state) {
+  try {
+    if (state.stopped) {
+      const started = await runtime.host.start(state.container);
+      if (started.status !== 0) return { ok: false, reason: `the build's container could not be started again (exit ${started.status})` };
+      state.stopped = false;
+    }
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+  return copyTranscripts((argv) => runtime.host.exec({ container: state.container, user: state.agentUser ?? ADDED_USER, env: NO_ENV, argv }));
+}
 var HOOK_ERRORS_IN_CONTAINER = "/build/home/.outerlayer/spool/hook-errors.log";
 async function copyHookErrors(runtime, state, jobDir) {
   try {
@@ -2403,7 +2618,7 @@ async function startCheckContainer(input) {
     }
     return { ok: false, reason };
   };
-  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`);
+  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine5(result.stderr) === "" ? "" : `: ${firstLine5(result.stderr)}`}`);
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
   try {
@@ -2438,6 +2653,8 @@ async function startCheckContainer(input) {
     ok: true,
     container: {
       state,
+      // The directory the container sees read-only at `JOB_MOUNT` is the build's directory on the host, so a folder written there is already in place.
+      evalInput: { dir: join(buildDir2, EVAL_INPUT_NAME), deliver: async () => void 0 },
       exec: (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env, argv }, opts?.logPath === void 0 ? void 0 : { logPath: opts.logPath }),
       restart: async () => {
         await host.stop(name);
@@ -2448,4 +2665,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BuildTokens, EVAL_INPUT_NAME, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };

package/dist/{chunk-2BRSMBBB.js → chunk-CLURXEWV.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-GAYWY4GI.js';
+import { compareVersions } from './chunk-HN2JBGSI.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-OD2VTIHN.js';
+import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-2FWL7CE2.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { createHash } from 'crypto';
 import { realpathSync } from 'fs';

package/dist/{chunk-AX23QKHS.js → chunk-CRLAB4PM.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { runnerUnit, UNIT_MARKER } from './chunk-FBTE2A2X.js';
 import { checkFit } from './chunk-JKIWMRFH.js';
-import { builtinKind } from './chunk-PWBILI5P.js';
+import { builtinKind } from './chunk-7KI224YS.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-I7CJIRMM.js → chunk-ERI5GBNI.js}

@@ -59,6 +59,7 @@ function runRunnerInstall(args) {
   }
   return {
     version,
+    previous: installed,
     execStart: execStartLine(configPath, nodePath),
     launcher: {
       path: launcherPath(args.home),
@@ -89,5 +90,9 @@ function launcherSummary(launcher) {
   if (launcher.state === "foreign") return void 0;
   return `${launcher.state === "unchanged" ? "outerlayer command already at" : "wrote the outerlayer command at"} ${launcher.path}, which runs the CLI that ${launcher.follows} names`;
 }
+function restartNote(result) {
+  if (result.previous === void 0 || result.previous === result.version) return void 0;
+  return `current moved from ${result.previous} to ${result.version}: a runner its service started takes no new work, waits for its running builds to finish, then restarts on ${result.version}. A runner started by hand keeps running until you restart it`;
+}
 
-export { RunnerDowngradeError, RunnerInstallError, launcherSummary, runRunnerInstall };
+export { RunnerDowngradeError, RunnerInstallError, launcherSummary, restartNote, runRunnerInstall };

package/dist/{chunk-ILEA3YHM.js → chunk-EWBM2USM.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
-import { remoteLookupFailed } from './chunk-GAYWY4GI.js';
+import { remoteLookupFailed } from './chunk-HN2JBGSI.js';
 import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
-import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { createInterface } from 'readline/promises';

package/dist/{chunk-GAYWY4GI.js → chunk-HN2JBGSI.js}

@@ -21663,6 +21663,7 @@ function buildTokenPricingDictionary(models) {
 }
 var CACHE_CREATE_1H_INPUT_MULTIPLIER = 2;
 var isCount = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
+var tokensOf = (n) => isCount(n) ? n : 0;
 var hasTokens = (usage) => isCount(usage.in) || isCount(usage.out) || isCount(usage.cacheRead) || isCount(usage.cacheCreate5m) || isCount(usage.cacheCreate1h);
 function selectRates(price, context = {}) {
   var _a5, _b, _c;
@@ -21704,7 +21705,7 @@ function priceUsage(usage, price, context = {}) {
   if (isCount(usage.cacheCreate5m) && rates.cacheCreate === void 0) unpriced.push("cacheCreate5m");
   if (unpriced.length > 0) return { costUsd: null, unpricedClasses: unpriced };
   return {
-    costUsd: rates.in * usage.in + rates.out * usage.out + ((_a5 = rates.cacheRead) != null ? _a5 : 0) * usage.cacheRead + ((_b = rates.cacheCreate) != null ? _b : 0) * usage.cacheCreate5m + ((_c = rates.cacheCreate1h) != null ? _c : rates.in * CACHE_CREATE_1H_INPUT_MULTIPLIER) * usage.cacheCreate1h
+    costUsd: rates.in * tokensOf(usage.in) + rates.out * tokensOf(usage.out) + ((_a5 = rates.cacheRead) != null ? _a5 : 0) * tokensOf(usage.cacheRead) + ((_b = rates.cacheCreate) != null ? _b : 0) * tokensOf(usage.cacheCreate5m) + ((_c = rates.cacheCreate1h) != null ? _c : rates.in * CACHE_CREATE_1H_INPUT_MULTIPLIER) * tokensOf(usage.cacheCreate1h)
   };
 }
 function priceBuckets(buckets, dict) {

package/dist/{chunk-ZOAEPWGL.js → chunk-HWMYGAKF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-R7STSBLC.js';
+import { EXEC_PORT } from './chunk-2E2MG3KW.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-ABIWDUMS.js → chunk-IS4DIGBQ.js}

@@ -6,6 +6,18 @@ import { join, dirname } from 'path';
 import { createHash } from 'crypto';
 
 createRequire(import.meta.url);
+
+// src/runner/update/installed-switch.ts
+function decideInstalledSwitch(input) {
+  const to = input.current;
+  if (to === void 0 || to === input.own || !input.fromCurrent) return { kind: "none" };
+  if (!input.installed) return { kind: "missing", to };
+  if (!input.underService) return { kind: "foreground", to };
+  return { kind: "restart", to };
+}
+function startedByService(env, parentPid) {
+  return (env.INVOCATION_ID ?? "") !== "" && parentPid === 1;
+}
 var REGISTRY_URL = "https://registry.npmjs.org";
 var PACKAGE_NAME = "@outerlayer/cli";
 var PACKAGE_PATH = "@outerlayer%2fcli";
@@ -101,4 +113,4 @@ async function auditSignatures(runNpm, dir) {
   return { ok: true };
 }
 
-export { auditSignatures, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm };
+export { auditSignatures, decideInstalledSwitch, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm, startedByService };

package/dist/{chunk-WVGSB3Z2.js → chunk-J5DPVNL3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-R7STSBLC.js';
-import { RELAY_PORT } from './chunk-OD2VTIHN.js';
+import { EXEC_PORT } from './chunk-2E2MG3KW.js';
+import { RELAY_PORT } from './chunk-2FWL7CE2.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-M3SQ4YGD.js → chunk-KZ2FOICE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-VXLJORHL.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-OPSPDEVU.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-TEKZRTM3.js → chunk-NPBLDMSD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-2BRSMBBB.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-CLURXEWV.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';