@outerlayer/cli 0.8.1 → 0.8.3

package/dist/{chunk-QB5JQH5V.js → chunk-NT5M6LF3.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-4FPWKV7L.js';
-import { DOCKERD_LOG } from './chunk-WVGSB3Z2.js';
-import { installScrubContext } from './chunk-BF4KKEFY.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, senderSignalScript } from './chunk-M4ERCYDB.js';
-import { readBranchHead, fetchCommit } from './chunk-TTNFGMHO.js';
+import { senderPidfile } from './chunk-SMPKFYKY.js';
+import { DOCKERD_LOG } from './chunk-J5DPVNL3.js';
+import { installScrubContext } from './chunk-YCHJIAP2.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-BPTAOD6W.js';
+import { readBranchHead, diffBetween, fetchCommit } from './chunk-Y7UQHKFY.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-TEKZRTM3.js';
+import { childEnvironment } from './chunk-NPBLDMSD.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
-import { waitForAgent, vmExecArgs } from './chunk-ZOAEPWGL.js';
-import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-KV47VQJZ.js';
+import { waitForAgent, vmExecArgs } from './chunk-HWMYGAKF.js';
+import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-2E2MG3KW.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-2OZH6ZY2.js';
 import { planArtifactUpload } from './chunk-ZYHKJKSU.js';
-import { scrubText } from './chunk-GAYWY4GI.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-PWBILI5P.js';
+import { scrubText } from './chunk-HN2JBGSI.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-7KI224YS.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment } from './chunk-OD2VTIHN.js';
+import { claudeCredential, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment, EVAL_INPUT_DIR } from './chunk-2FWL7CE2.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-HKMPVPO7.js';
-import { parsePolicy } from './chunk-7ZR5UPMB.js';
+import { parsePolicy } from './chunk-36H5BONJ.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
@@ -75,8 +75,8 @@ async function writeGuestGhConfig(runtime, state, token) {
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], ghHostsYml(token));
   if (result.status !== 0) throw new Error(`writing gh's configuration in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
 }
-async function unpackIntoGuest(runtime, state, dir, target) {
-  const script = `set -e; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX ${target}`;
+async function unpackIntoGuest(runtime, state, dir, target, opts = {}) {
+  const script = opts.readOnly === true ? `set -e; rm -rf ${target}; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX,a-w ${target}` : `set -e; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX ${target}`;
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], tarOf(dir));
   if (result.status !== 0) throw new Error(`unpacking into ${target} in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
 }
@@ -307,6 +307,7 @@ async function provisionMicroVm(input) {
     removeStagedContext: () => removeStagedContext(buildDir2)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
+  state.startCommit = steps.startCommit;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
 async function waitForDocker(runtime, state, agentUser, now) {
@@ -409,6 +410,10 @@ async function copyHookErrors(runtime, state, jobDir) {
   } catch {
   }
 }
+async function copyTranscriptsFromMicroVm(runtime, state) {
+  if (!isRunning(runtime, state)) return { ok: false, reason: "the build's microVM is gone" };
+  return copyTranscripts((argv) => asRoot(runtime, state, argv));
+}
 async function startCheckMicroVm(input) {
   const { config, runtime, job, jobDir, tokens, log } = input;
   const { vm } = runtime;
@@ -523,10 +528,16 @@ async function startCheckMicroVm(input) {
   if (failed !== void 0) return fail(failed);
   if (abandoned()) return fail(ABANDONED);
   const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {} });
+  const evalInput = { dir: join(checksDir, EVAL_INPUT_NAME), delivered: false };
+  const deliverEvalInput = async () => {
+    await unpackIntoGuest(runtime, state, evalInput.dir, EVAL_INPUT_DIR, { readOnly: true });
+    evalInput.delivered = true;
+  };
   return {
     ok: true,
     environment: {
       state,
+      evalInput: { dir: evalInput.dir, deliver: deliverEvalInput },
       exec: async (argv, workdir, opts) => {
         const ran = await vm.exec(state.vsockPath, { argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
         if (opts?.logPath !== void 0) appendFileSync(opts.logPath, ran.stdout + ran.stderr);
@@ -536,7 +547,9 @@ async function startCheckMicroVm(input) {
         try {
           await vm.firecracker.stop(state.firecracker);
           rmSync(state.vsockPath, { force: true });
-          return await boot() === void 0;
+          if (await boot() !== void 0) return false;
+          if (evalInput.delivered) await deliverEvalInput();
+          return true;
         } catch {
           return false;
         }
@@ -785,10 +798,15 @@ function parseEvaluation(value) {
   }
   return { verdict, sentence: text(raw.sentence), waitingOn: raw.waitingOn, open };
 }
+async function readWorkItem(config, item, fetchImpl) {
+  const { data } = await getJson(config.url, `/v1/work-items/${item}`, config.apiKey, config.appId, fetchImpl, await signerFor(config.configPath));
+  return data;
+}
 async function readItemEvaluation(config, item, fetchImpl) {
   try {
-    const { data } = await getJson(config.url, `/v1/work-items/${item}`, config.apiKey, config.appId, fetchImpl, await signerFor(config.configPath));
-    return { ok: true, evaluation: parseEvaluation(fields(data).evaluation) };
+    const body = fields(await readWorkItem(config, item, fetchImpl));
+    const hasPullRequest = Array.isArray(body.pullRequests) ? body.pullRequests.length > 0 : void 0;
+    return { ok: true, evaluation: parseEvaluation(body.evaluation), hasPullRequest };
   } catch (err) {
     return { ok: false, reason: describeCallFailure(err) };
   }
@@ -806,6 +824,9 @@ function fit(prefix, parts) {
 }
 function decideFromEvaluation(read) {
   if (!read.ok) return { outcome: "incomplete", reason: fit("the item's status could not be read: ", [read.reason]) };
+  if (read.hasPullRequest === false) {
+    return { outcome: "incomplete", reason: "the build opened no pull request for the item" };
+  }
   const evaluation = read.evaluation;
   if (evaluation === void 0) return { outcome: "ok" };
   if (evaluation === null) return { outcome: "incomplete", reason: "the item has no evidence evaluation yet" };
@@ -1035,6 +1056,14 @@ async function runHostChecks(input) {
     const limitMinutes = config.checks?.timeLimitMinutes ?? DEFAULT_CHECK_TIME_LIMIT_MINUTES;
     const minutes = `${limitMinutes} ${limitMinutes === 1 ? "minute" : "minutes"}`;
     const environmentLog = join(jobDir, "checks", "environment.log");
+    let transcripts = { ok: false, reason: "the runner holds no way to read the build's sessions" };
+    if (deps.collectSessions !== void 0) {
+      try {
+        transcripts = await deps.collectSessions();
+      } catch (err) {
+        transcripts = { ok: false, reason: describeCallFailure(err) };
+      }
+    }
     if (job.microvm !== void 0) {
       if (deps.endBuildMicroVm === void 0) return await failAll("the runner has no way to stop the build's microVM, so no check environment was made");
       try {
@@ -1113,6 +1142,24 @@ async function runHostChecks(input) {
     }
     if (typeof settled === "string") return await failAll(settled);
     const ready = settled;
+    try {
+      await writeEvalInput({
+        job,
+        dir: ready.evalInput.dir,
+        scratch,
+        remote,
+        readToken,
+        branchHead: read.sha,
+        transcripts,
+        scrub: transcriptScrub(config, [config.apiKey, job.itemKey, readToken]),
+        readWorkItem: () => readWorkItem(config, job.item, deps.fetchImpl),
+        fetchDiff: deps.fetchDiff ?? ((input2) => diffBetween(input2)),
+        log
+      });
+      await ready.evalInput.deliver();
+    } catch (err) {
+      return await failAll(`the checks' input could not be written: ${describeCallFailure(err)}`);
+    }
     let usable = true;
     for (const check of checks) {
       if (!usable) {
@@ -1163,6 +1210,7 @@ async function runHostChecks(input) {
       writeJobFile(jobFilePath, job);
     }
     rmSync(scratch, { recursive: true, force: true });
+    rmSync(join(jobDir, "checks", EVAL_INPUT_NAME), { recursive: true, force: true });
     if (existsSync(scratch)) log.error(`${tag} the checks' scratch directory could not be removed`);
     log.line(`${tag} checks done (${formatDuration(now().getTime() - startedMs)})`);
   }
@@ -1362,6 +1410,10 @@ function releaseScrub(config, home) {
   const secrets = [...headerVariables(config.build?.destinations), ...CLAUDE_CREDENTIAL_VARIABLES].map((name) => process.env[name] ?? "");
   return { literals: [...scrubList(merged?.literals), ...secrets], patterns: scrubList(merged?.patterns) };
 }
+function transcriptScrub(config, secrets) {
+  const base = releaseScrub(config, homeFromEnv());
+  return { literals: [...scrubList(base.literals), ...secrets.filter((secret) => secret !== void 0 && secret !== "")], patterns: scrubList(base.patterns) };
+}
 function stripUnsendableReasonChars(text2) {
   return text2.replace(/\u0000/g, "").replace(/\p{Cs}/gu, "");
 }
@@ -1671,6 +1723,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     }
     await stopBuildMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath);
   };
+  const collectSessions = build !== void 0 ? () => copyTranscriptsFromContainer(build.runtime, build.state) : vmBuild !== void 0 ? () => copyTranscriptsFromMicroVm(vmBuild.runtime, vmBuild.state) : void 0;
   if (job.checkContainer !== void 0 && job.checksRan === true) {
     try {
       await cleanupContainer(deps.container ?? createContainerRuntime(), job.checkContainer);
@@ -1698,7 +1751,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
         config,
         job,
         jobDir: jobDirPath,
-        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, endBuildMicroVm, ...deps.hostChecks }
+        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, endBuildMicroVm, collectSessions, ...deps.hostChecks }
       });
     } catch (err) {
       log.error(`${tag} the host's checks stopped: ${describeCallFailure(err)} \xB7 continuing`);

package/dist/{chunk-Z2THOHPP.js → chunk-OCHRV5A6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-QNRSFEGY.js';
-import { MIN_ENGINE_MAJOR } from './chunk-M4ERCYDB.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-VITHLJOZ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-BPTAOD6W.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-VXLJORHL.js → chunk-OPSPDEVU.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-7ZR5UPMB.js';
+import { splitRawFile } from './chunk-36H5BONJ.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-EV3M3EH7.js → chunk-OULFBETM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-7ZR5UPMB.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-OPSPDEVU.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-36H5BONJ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-BOLTI6LR.js → chunk-PLMTLGYH.js}

@@ -28,7 +28,7 @@ function resolveGatewayCredentials(sources = {}) {
     return { ok: false, message, url, credential, appId, kind };
   }
   if (!url || !credential || !appId) {
-    const missing = [!url && "--url", !credential && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
+    const missing = [!url && "--url", !credential && "a login or OUTERLAYER_API_KEY", !appId && "--app-id"].filter(Boolean).join(", ");
     return { ok: false, message: `missing ${missing}. ${MISSING_HELP}`, url, credential, appId, kind };
   }
   return { ok: true, url, credential, appId, kind };

package/dist/{chunk-4FPWKV7L.js → chunk-SMPKFYKY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-BF4KKEFY.js';
-import { CaptureDaemon } from './chunk-GAYWY4GI.js';
+import { LiveUploader } from './chunk-YCHJIAP2.js';
+import { CaptureDaemon } from './chunk-HN2JBGSI.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-KSLNQOOS.js';
+import { spoolDir } from './chunk-7HWIKEU5.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-5ODHQP6O.js → chunk-SPUWEK2Q.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
+import { decideInstalledSwitch, fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-IS4DIGBQ.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-QB5JQH5V.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-NT5M6LF3.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
 import { RUNNER_PROTOCOL } from './chunk-AIW6GLET.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-Q4432IZT.js';
-import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-TI7B7UEO.js';
+import { placeholderQueues, placeholderProblem } from './chunk-BORFBENT.js';
+import { currentVersion, entryIn, versionDir, startedThroughCurrent, writeMarker, readMarker, removeMarker, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-M4ERCYDB.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-BPTAOD6W.js';
 import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-TEKZRTM3.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-2BRSMBBB.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KV47VQJZ.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-PWBILI5P.js';
+import { spawnRun } from './chunk-NPBLDMSD.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-CLURXEWV.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-2OZH6ZY2.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-7KI224YS.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
-import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-OD2VTIHN.js';
+import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-2FWL7CE2.js';
 import { parseClaimIdentity } from './chunk-HKMPVPO7.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-V7NIVOFD.js';
@@ -980,6 +980,48 @@ function reportUpdateResult(state, version, result) {
   const retryAt = new Date(result.retryAtMs).toISOString().slice(11, 16);
   logOf(state).error(`could not update to ${version}: ${result.detail} \xB7 attempt ${result.attempts}, trying again after ${retryAt} UTC`);
 }
+function restartOntoInstalled(state) {
+  const update = state.deps.update;
+  if (update === void 0) return false;
+  const configPath = state.config.configPath;
+  const own = ownVersionOf(state.deps);
+  const current = currentVersion(configPath);
+  const decision = decideInstalledSwitch({
+    own,
+    current,
+    fromCurrent: startedThroughCurrent(configPath, update.entryPath),
+    underService: update.underService === true,
+    installed: current !== void 0 && existsSync(entryIn(versionDir(configPath, current)))
+  });
+  if (decision.kind === "none") {
+    state.installedSwitch = void 0;
+    return false;
+  }
+  const said = `${decision.kind}:${decision.to}`;
+  const first = state.installedSwitch !== said;
+  state.installedSwitch = said;
+  const log = logOf(state);
+  if (decision.kind === "missing") {
+    if (first) log.error(`current names ${decision.to}, which is not installed \xB7 staying on ${own}; run \`outerlayer runner install\` again`);
+    return false;
+  }
+  if (decision.kind === "foreground") {
+    if (first) log.line(`${decision.to} is installed and current names it \xB7 this runner keeps running ${own} until it is restarted`);
+    return false;
+  }
+  if (state.jobs.size > 0) {
+    if (first) log.line(`${decision.to} is installed \xB7 taking no new work, restarting onto it once ${state.jobs.size} running build(s) finish`);
+    return true;
+  }
+  try {
+    writeMarker(configPath, { from: own, to: decision.to, starts: 0 });
+  } catch (err) {
+    log.error(`could not write the update marker, so ${decision.to} starts without going back to ${own} if its checks fail: ${describeCallFailure(err)}`);
+  }
+  log.line(`restarting ${own} -> ${decision.to}, which runner install put in place`);
+  (state.exitForUpdate ?? (() => update.exit(RESTART_EXIT_STATUS)))();
+  return true;
+}
 async function updateWhenIdle(state) {
   const update = state.deps.update;
   const version = state.pendingUpdate;
@@ -1133,6 +1175,7 @@ async function housekeepingPass(state) {
 }
 async function runTick(state) {
   reloadConfig(state);
+  if (restartOntoInstalled(state)) return;
   if (await updateWhenIdle(state)) return;
   if (holdWhenBlocked(state)) return;
   if (holdOffForDisk(state)) return;
@@ -1189,7 +1232,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-CNWPTH7W.js');
+  const { postJson: postJson2 } = await import('./work-cmd-66GA4ETV.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1913,7 +1956,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-GX5ND6RO.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-AFYUJ5SQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-QNRSFEGY.js → chunk-VITHLJOZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-M4ERCYDB.js';
+import { MIN_ENGINE_MAJOR } from './chunk-BPTAOD6W.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-4ACZCY4I.js → chunk-WMPO3SKK.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, connectedLine } from './chunk-ILEA3YHM.js';
-import { resolveRepoIdentity } from './chunk-GAYWY4GI.js';
-import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, connectedLine } from './chunk-EWBM2USM.js';
+import { resolveRepoIdentity } from './chunk-HN2JBGSI.js';
+import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-TTNFGMHO.js → chunk-Y7UQHKFY.js}

@@ -111,6 +111,24 @@ async function fetchCommit(input) {
     return { ok: false, reason: `the fetch of ${input.commit.slice(0, 8)} from ${input.remote} failed: ${detail}` };
   }
 }
+async function diffBetween(input) {
+  const credential = input.token === void 0 ? void 0 : tokenSettings(input.remote, input.token);
+  try {
+    mkdirSync(input.dir, { recursive: true, mode: RUNNER_DIR_MODE });
+    await git(input.dir, ["init", "--quiet"]);
+    await git(input.dir, ["fetch", "--quiet", "--no-tags", "--filter=blob:none", input.remote, input.base, input.head], CLONE_TIMEOUT_MS, credential);
+    await git(
+      input.dir,
+      ["diff", "--no-ext-diff", "--no-textconv", "--no-color", "--binary", `--output=${input.output}`, `${input.base}...${input.head}`],
+      CLONE_TIMEOUT_MS,
+      credential
+    );
+    return { ok: true };
+  } catch (err) {
+    const detail = (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n")[0];
+    return { ok: false, reason: `the diff of ${input.head.slice(0, 8)} from ${input.base.slice(0, 8)} could not be read from ${input.remote}: ${detail}` };
+  }
+}
 var CLONE_TIMEOUT_MS = 6e5;
 async function cloneRepository(remote, dest, timeoutMs = CLONE_TIMEOUT_MS) {
   mkdirSync(dirname(dest), { recursive: true, mode: RUNNER_DIR_MODE });
@@ -485,4 +503,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath) {
   return removed;
 }
 
-export { buildRepositoryImage, cloneRepository, fetchCommit, readBranchHead, readDefaultBranchHead };
+export { buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, readBranchHead, readDefaultBranchHead };

package/dist/{chunk-BF4KKEFY.js → chunk-YCHJIAP2.js}

@@ -5,16 +5,16 @@ import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-ZYHKJKSU.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-GAYWY4GI.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-HN2JBGSI.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-YNJEOGDL.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { signerFor, signRunnerRequest } from './chunk-V7NIVOFD.js';
-import { writeSyncStatus, spoolDir } from './chunk-KSLNQOOS.js';
+import { writeSyncStatus, spoolDir } from './chunk-7HWIKEU5.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';