@claudexor/cli 3.6.0 → 3.8.0

package/dist/setup-attach-command.js

@@ -0,0 +1,118 @@
+import { spawn } from "node:child_process";
+import { closeSync, constants, existsSync, openSync } from "node:fs";
+import { platform } from "node:os";
+import { join } from "node:path";
+import { daemonDir } from "@claudexor/daemon";
+import { printUsageError } from "./cli-io.js";
+import { connectDaemonIfRunning } from "./daemon-run.js";
+import { controlApiFetch } from "./live.js";
+import { resolveSetupLoginRunnerPath } from "./setup-job-support.js";
+import { runnerBootstrapEnv } from "./setup-login-runner-support.js";
+function waitForChild(child) {
+    return new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("close", (code, signal) => {
+            if (signal) {
+                process.stderr.write(`claudexor setup attach: runner exited on ${signal}\n`);
+                resolve(1);
+            }
+            else {
+                resolve(code ?? 1);
+            }
+        });
+    });
+}
+export function claimSetupAttachment(directory) {
+    const path = join(directory, "client-pty-attached");
+    let descriptor;
+    try {
+        descriptor = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    }
+    catch {
+        throw new Error("setup job already has a client_pty attachment");
+    }
+    closeSync(descriptor);
+}
+/**
+ * Windows must keep the login worker in the terminal that attached the job:
+ * entering `--worker` directly avoids the detached bootstrap hop that daemon-
+ * hosted jobs require. POSIX retains the existing bootstrap invocation.
+ */
+export function setupAttachRunnerInvocation(input) {
+    if (input.platform === "win32") {
+        return {
+            command: input.nodePath,
+            args: [input.runnerPath, "--worker", input.manifestPath],
+            options: {
+                cwd: input.cwd,
+                stdio: "inherit",
+                env: runnerBootstrapEnv(input.env),
+                detached: false,
+            },
+        };
+    }
+    return {
+        command: input.nodePath,
+        args: [input.runnerPath, input.manifestPath],
+        options: { cwd: input.cwd, stdio: "inherit", env: input.env },
+    };
+}
+/**
+ * One owner for the interactive setup attachment role. The full CLI and the
+ * packaged daemon bundle both enter here; neither re-authors daemon lookup,
+ * the one-use claim, adjacent runner resolution, nor the Windows worker shape.
+ */
+export async function setupAttachCommand(argv, json) {
+    const sub = argv[1];
+    const jobId = argv[2];
+    if (argv[0] !== "setup" ||
+        sub !== "attach" ||
+        typeof jobId !== "string" ||
+        !/^setup-[A-Za-z0-9-]+$/.test(jobId) ||
+        argv.length !== 3) {
+        return printUsageError(json, "usage: claudexor setup attach <jobId>");
+    }
+    if (json) {
+        return printUsageError(true, "claudexor setup attach owns an interactive PTY and cannot use --json");
+    }
+    const daemon = await connectDaemonIfRunning();
+    if (!daemon)
+        throw new Error("setup daemon is not running");
+    const response = await controlApiFetch(daemon.addr, `/setup/jobs/${encodeURIComponent(jobId)}`);
+    const body = (await response.json());
+    if (!response.ok)
+        throw new Error(`setup job lookup failed (HTTP ${response.status})`);
+    if (body.transport !== "client_pty") {
+        throw new Error("setup job is not authorized for client_pty attachment");
+    }
+    if (!["queued", "running", "waiting_for_input"].includes(body.state ?? "") ||
+        !["launching", "awaiting_user"].includes(body.phase ?? "")) {
+        throw new Error(`setup job is not attachable (${body.state ?? "unknown"})`);
+    }
+    const artifactDirectory = join(daemonDir(), "setup-artifacts", jobId);
+    const manifest = join(artifactDirectory, "runner-manifest.json");
+    if (!existsSync(manifest))
+        throw new Error("sealed setup manifest is unavailable");
+    const runner = resolveSetupLoginRunnerPath();
+    if (!existsSync(runner))
+        throw new Error("setup login runner is unavailable");
+    // A sealed login job authorizes exactly one terminal runner. O_EXCL is the
+    // cross-process fence; the marker intentionally survives a crashed client so
+    // users cancel/recreate instead of accidentally launching the vendor login
+    // twice against one daemon-owned job.
+    claimSetupAttachment(artifactDirectory);
+    const invocation = setupAttachRunnerInvocation({
+        platform: platform(),
+        nodePath: process.execPath,
+        runnerPath: runner,
+        manifestPath: manifest,
+        cwd: artifactDirectory,
+        env: process.env,
+    });
+    return waitForChild(spawn(invocation.command, invocation.args, invocation.options));
+}
+/** Full-CLI adapter over the shared raw-argv role owner. */
+export function setupCommand(args, json) {
+    return setupAttachCommand(args._, json);
+}
+//# sourceMappingURL=setup-attach-command.js.map

package/dist/setup-attach-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-attach-command.js","sourceRoot":"","sources":["../src/setup-attach-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,SAAS,YAAY,CAAC,KAA+B;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,MAAM,IAAI,CAAC,CAAC;gBAC7E,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACpD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CACnB,IAAI,EACJ,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAChF,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,SAAS,CAAC,UAAU,CAAC,CAAC;AACxB,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAO3C;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;YACxD,OAAO,EAAE;gBACP,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC;gBAClC,QAAQ,EAAE,KAAK;aAChB;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ;QACvB,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;QAC5C,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAuB,EAAE,IAAa;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IACE,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QACnB,GAAG,KAAK,QAAQ;QAChB,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,eAAe,CACpB,IAAI,EACJ,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACvF,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IACE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACtE,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,sCAAsC;IACtC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,2BAA2B,CAAC;QAC7C,QAAQ,EAAE,QAAQ,EAAE;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,QAAQ;QACtB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,IAA2B,EAAE,IAAa;IACrE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC"}

package/dist/setup-job-store.d.ts

@@ -238,7 +238,7 @@ export declare class SetupJobStore {
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -435,7 +435,7 @@ export declare class SetupJobStore {
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {

package/dist/setup-job-support.d.ts

@@ -1,5 +1,5 @@
 import { type HarnessAdapter, type ProcessGroupHandle } from "@claudexor/core";
-import { ControlHarnessSetupHarness, type ControlSetupJob, type CredentialProfileStatus } from "@claudexor/schema";
+import { ControlHarnessSetupHarness, type ControlSetupJob, type ControlSetupJobCreateRequest as ControlSetupJobCreateRequestValue, type CredentialProfileStatus, type EffectiveCredentialProfilePolicy } from "@claudexor/schema";
 import type { SetupLoginRunnerState } from "./setup-login-protocol.js";
 /** Where a harness's DEFAULT (unnamed) login lands, for the harnesses whose
  * default store Claudexor owns. Absent = the vendor keeps its own default
@@ -10,15 +10,17 @@ export type SetupProfile = {
     note: string;
 };
 export declare const SETUP_PROFILES: Record<ControlHarnessSetupHarness, SetupProfile>;
+export interface ResolvedSetupProfileBinding {
+    profileId: string;
+    configDir: string;
+    credentialPolicy: EffectiveCredentialProfilePolicy;
+}
 /**
  * Resolve an INV-135 profile-targeted login request to its canonical scoped
  * config dir. Typed 400s: an unknown/disabled/secret-ref profile must refuse
  * at create time, never open a Terminal login into the wrong store.
  */
-export declare function resolveProfileBinding(harness: ControlHarnessSetupHarness, profileId: string | undefined): {
-    profileId: string;
-    configDir: string;
-} | null;
+export declare function resolveProfileBinding(harness: ControlHarnessSetupHarness, profileId: string | undefined, platform?: NodeJS.Platform): ResolvedSetupProfileBinding | null;
 /**
  * The login-request binding under the unified account model (K.4): an explicit
  * profileId resolves as before; a profile-less LOGIN request is the bootstrap
@@ -32,17 +34,25 @@ export declare function resolveProfileBinding(harness: ControlHarnessSetupHarnes
  * env-overridden native home outside the owned root, never blocks the login;
  * the startup migration registers the row after the login lands).
  */
-export declare function resolveLoginProfileBinding(harness: ControlHarnessSetupHarness, action: string, requestedProfileId: string | undefined): {
-    profileId: string;
-    configDir: string;
-} | null;
+export declare function resolveLoginProfileBinding(harness: ControlHarnessSetupHarness, action: string, requestedProfileId: string | undefined, platform?: NodeJS.Platform): ResolvedSetupProfileBinding | null;
 /**
- * A harness with no default credential store (agy — owner decision Л-4) can
- * only sign in INTO a named account. Refusing at CREATE time keeps the runner
- * from spawning a vendor login whose token would land in the daemon's own home
- * directory, and gives the caller a 400 instead of an opaque spawn failure.
+ * A harness with no default binding store (agy — owner decision Л-4) can only
+ * start login under a named binding. Refusing at CREATE time keeps the runner
+ * from targeting vendor state/login artifacts at the daemon's own HOME; the
+ * effective platform policy separately owns credential custody. The caller
+ * gets a 400 instead of an opaque spawn failure.
  */
 export declare function assertDefaultLoginAllowed(harness: string, hasProfile: boolean): void;
+/**
+ * Mutation-free setup admission. Request shape, named-profile binding,
+ * required-profile policy and the current cardinality invariant are resolved
+ * before any terminal helper probe or bootstrap-row creation. The durable
+ * manager repeats the binding while creating the single job; this first pass
+ * exists to keep rejected requests at zero probe and zero mutation.
+ */
+export declare function preflightSetupJobCreateRequest(input: unknown, platform?: NodeJS.Platform): ControlSetupJobCreateRequestValue;
+/** Durable, user-facing custody statement for a profile-targeted setup job. */
+export declare function setupProfileBindingMessage(harness: string, binding: ResolvedSetupProfileBinding): string;
 /**
  * Whether a login's deadline may be pushed out. A deadline that IS the
  * vendor's own window cannot be: publishing a later one would promise fifteen

package/dist/setup-job-support.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-job-support.d.ts","sourceRoot":"","sources":["../src/setup-job-support.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,0BAA0B,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAG7B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE;;yCAEyC;AACzC,eAAO,MAAM,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,CAGlE,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,0BAA0B,EAAE,YAAY,CAiB3E,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,0BAA0B,EACnC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsCjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAYjD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAQpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,GAAG,IAAI,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAgBzD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM;IAAE,IAAI,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,0BAA0B,CAAA;KAAE,KAAK,eAAe,EAAE,CAAA;CAAE,EACjG,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,eAAe,GAAG,SAAS,CAO7B;AAED;kFACkF;AAClF,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,GAC1D,CACD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,KACrB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAU3C;AAED,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,MAAwB,EACnC,UAAU,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GACjD,MAAM,CAIR;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,eAAe,EAC3B,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,eAAe,EAC3B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAgCZ;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,GAAG,IAAI,CAOnF;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAQT;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD"}
+{"version":3,"file":"setup-job-support.d.ts","sourceRoot":"","sources":["../src/setup-job-support.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,0BAA0B,EAE1B,KAAK,eAAe,EACpB,KAAK,4BAA4B,IAAI,iCAAiC,EACtE,KAAK,uBAAuB,EAC5B,KAAK,gCAAgC,EAGtC,MAAM,mBAAmB,CAAC;AAU3B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE;;yCAEyC;AACzC,eAAO,MAAM,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,CAGlE,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,0BAA0B,EAAE,YAAY,CAiB3E,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,gCAAgC,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,0BAA0B,EACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,2BAA2B,GAAG,IAAI,CA+CpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,2BAA2B,GAAG,IAAI,CAYpC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAgBpF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,iCAAiC,CASnC;AAED,+EAA+E;AAC/E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,2BAA2B,GACnC,MAAM,CAKR;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,GAAG,IAAI,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAgBzD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM;IAAE,IAAI,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,0BAA0B,CAAA;KAAE,KAAK,eAAe,EAAE,CAAA;CAAE,EACjG,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,eAAe,GAAG,SAAS,CAO7B;AAED;kFACkF;AAClF,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,GAC1D,CACD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,KACrB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAU3C;AAED,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,MAAwB,EACnC,UAAU,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GACjD,MAAM,CAIR;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,eAAe,EAC3B,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,eAAe,EAC3B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAgCZ;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,GAAG,IAAI,CAOnF;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAQT;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/setup-job-support.js

@@ -6,13 +6,14 @@
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { parseProcessGroupHandle, } from "@claudexor/core";
+import { credentialProfilePolicyProblem, credentialProfilePolicyState, parseProcessGroupHandle, } from "@claudexor/core";
 import { loadConfig } from "@claudexor/config";
 import { defaultNativeClaudeConfigDir } from "@claudexor/harness-claude";
 import { defaultNativeCodexHome } from "@claudexor/harness-codex";
-import { ControlHarnessSetupHarness, harnessHasDefaultCredentialStore, harnessSupportsBootstrapLogin, } from "@claudexor/schema";
+import { ControlHarnessSetupHarness, ControlSetupJobCreateRequest, harnessHasDefaultCredentialStore, harnessSupportsBootstrapLogin, } from "@claudexor/schema";
 import { noProjectRepoRoot } from "@claudexor/util";
 import { ensureBootstrapProfile } from "./profile-registration.js";
+import { buildRegistry } from "./registry.js";
 import { canonicalProfileLoginDir, configDirLoginHarnessList, isConfigDirLoginHarness, } from "./config-dir-login-harnesses.js";
 import { ACTIVE_SETUP_STATES } from "./setup-job-store.js";
 const NO_PROJECT_ROOT = noProjectRepoRoot();
@@ -38,7 +39,7 @@ export const SETUP_PROFILES = {
     },
     agy: {
         guideUrl: "https://antigravity.google/docs/cli/install",
-        note: "Antigravity sign-in always targets one named account folder: the CLI keeps its whole state under a home directory, so every Google account you add gets its own.",
+        note: "Antigravity sign-in always targets one named Claudexor binding. Credential custody depends on the host platform and is stated below.",
     },
 };
 /**
@@ -46,13 +47,21 @@ export const SETUP_PROFILES = {
  * config dir. Typed 400s: an unknown/disabled/secret-ref profile must refuse
  * at create time, never open a Terminal login into the wrong store.
  */
-export function resolveProfileBinding(harness, profileId) {
+export function resolveProfileBinding(harness, profileId, platform = process.platform) {
+    const registry = loadConfig(NO_PROJECT_ROOT).global.credential_profiles;
+    const policyState = credentialProfilePolicyState({
+        adapter: buildRegistry({ includeFakes: false }).get(harness),
+        registry,
+        platform,
+    });
+    if (policyState.ambiguous)
+        throw credentialProfilePolicyProblem(policyState, "credential_profile_ambiguous");
     if (!profileId)
         return null;
     if (!isConfigDirLoginHarness(harness)) {
         throw Object.assign(new Error(`harness "${harness}" has no isolated config-dir login; only ${configDirLoginHarnessList()} support profile logins`), { status: 400 });
     }
-    const profile = loadConfig(NO_PROJECT_ROOT).global.credential_profiles.find((entry) => entry.harness_id === harness && entry.profile_id === profileId);
+    const profile = registry.find((entry) => entry.harness_id === harness && entry.profile_id === profileId);
     if (!profile) {
         throw Object.assign(new Error(`no credential profile "${profileId}" for harness "${harness}" — register it first (POST /v2/credential-profiles or \`claudexor profiles add\`)`), { status: 400 });
     }
@@ -67,6 +76,7 @@ export function resolveProfileBinding(harness, profileId) {
     return {
         profileId,
         configDir: canonicalProfileLoginDir(harness, profile.isolation_locator ?? ""),
+        credentialPolicy: policyState.policy,
     };
 }
 /**
@@ -82,12 +92,12 @@ export function resolveProfileBinding(harness, profileId) {
  * env-overridden native home outside the owned root, never blocks the login;
  * the startup migration registers the row after the login lands).
  */
-export function resolveLoginProfileBinding(harness, action, requestedProfileId) {
-    const explicit = resolveProfileBinding(harness, requestedProfileId);
+export function resolveLoginProfileBinding(harness, action, requestedProfileId, platform = process.platform) {
+    const explicit = resolveProfileBinding(harness, requestedProfileId, platform);
     if (explicit || action !== "login" || !harnessSupportsBootstrapLogin(harness))
         return explicit;
     if (!harnessHasDefaultCredentialStore(harness)) {
-        return resolveProfileBinding(harness, ensureBootstrapProfile(harness).profile_id);
+        return resolveProfileBinding(harness, ensureBootstrapProfile(harness).profile_id, platform);
     }
     try {
         ensureBootstrapProfile(harness);
@@ -98,15 +108,47 @@ export function resolveLoginProfileBinding(harness, action, requestedProfileId)
     return null;
 }
 /**
- * A harness with no default credential store (agy — owner decision Л-4) can
- * only sign in INTO a named account. Refusing at CREATE time keeps the runner
- * from spawning a vendor login whose token would land in the daemon's own home
- * directory, and gives the caller a 400 instead of an opaque spawn failure.
+ * A harness with no default binding store (agy — owner decision Л-4) can only
+ * start login under a named binding. Refusing at CREATE time keeps the runner
+ * from targeting vendor state/login artifacts at the daemon's own HOME; the
+ * effective platform policy separately owns credential custody. The caller
+ * gets a 400 instead of an opaque spawn failure.
  */
 export function assertDefaultLoginAllowed(harness, hasProfile) {
     if (hasProfile || harnessHasDefaultCredentialStore(harness))
         return;
-    throw Object.assign(new Error(`harness "${harness}" has no default credential store: sign in from a named account (add one first, then start the login from it)`), { status: 400 });
+    throw Object.assign(new Error(`harness "${harness}" has no default credential store: sign in from a named account (add one first, then start the login from it)`), {
+        status: 400,
+        code: "credential_profile_required",
+        retryable: false,
+        fieldErrors: {
+            "/profileId": ["A named credential profile is required for this harness."],
+        },
+        requiredActions: ["add_named_account"],
+    });
+}
+/**
+ * Mutation-free setup admission. Request shape, named-profile binding,
+ * required-profile policy and the current cardinality invariant are resolved
+ * before any terminal helper probe or bootstrap-row creation. The durable
+ * manager repeats the binding while creating the single job; this first pass
+ * exists to keep rejected requests at zero probe and zero mutation.
+ */
+export function preflightSetupJobCreateRequest(input, platform = process.platform) {
+    const request = ControlSetupJobCreateRequest.parse(input);
+    const explicitBinding = resolveProfileBinding(request.harness, request.profileId, platform);
+    const canBootstrap = request.action === "login" &&
+        request.profileId === undefined &&
+        harnessSupportsBootstrapLogin(request.harness);
+    assertDefaultLoginAllowed(request.harness, explicitBinding !== null || canBootstrap);
+    return request;
+}
+/** Durable, user-facing custody statement for a profile-targeted setup job. */
+export function setupProfileBindingMessage(harness, binding) {
+    if (binding.credentialPolicy.identity_scope === "os_user") {
+        return `This login targets the Claudexor binding "${binding.profileId}". Its folder scopes ${harness} state, while the vendor credential is shared by the current OS user; it is not a separate per-folder identity, and removing the binding does not sign out the vendor account.`;
+    }
+    return `This login targets the scoped Claudexor profile "${binding.profileId}"; the default vendor store is not touched.`;
 }
 /**
  * Whether a login's deadline may be pushed out. A deadline that IS the

package/dist/setup-job-support.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-job-support.js","sourceRoot":"","sources":["../src/setup-job-support.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,0BAA0B,EAG1B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;AAE5C;;yCAEyC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAA0C;IACrE,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,4BAA4B;CACrC,CAAC;AAOF,MAAM,CAAC,MAAM,cAAc,GAAqD;IAC9E,KAAK,EAAE;QACL,QAAQ,EAAE,2CAA2C;QACrD,IAAI,EAAE,mIAAmI;KAC1I;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,gDAAgD;QAC1D,IAAI,EAAE,yIAAyI;KAChJ;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,yDAAyD;QACnE,IAAI,EAAE,mDAAmD;KAC1D;IACD,GAAG,EAAE;QACH,QAAQ,EAAE,6CAA6C;QACvD,IAAI,EAAE,kKAAkK;KACzK;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAmC,EACnC,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,YAAY,OAAO,4CAA4C,yBAAyB,EAAE,yBAAyB,CACpH,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACzE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAC1E,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0BAA0B,SAAS,kBAAkB,OAAO,oFAAoF,CACjJ,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,SAAS,eAAe,CAAC,EAAE;YAC9E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACnD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,uBAAuB,SAAS,QAAQ,OAAO,CAAC,eAAe,uFAAuF,CACvJ,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,SAAS,EAAE,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAmC,EACnC,MAAc,EACd,kBAAsC;IAEtC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACpE,IAAI,QAAQ,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/F,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,UAAmB;IAC5E,IAAI,UAAU,IAAI,gCAAgC,CAAC,OAAO,CAAC;QAAE,OAAO;IACpE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,YAAY,OAAO,+GAA+G,CACnI,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB;IAEpB,IACE,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzD,CAAC,GAAG,CAAC,UAAU,EACf,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,GAAG,GAAG,CAAC,OAAO,qFAAqF,CACpG,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiG,EACjG,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAuC,CAAC,EAAE,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,EAAE;SACf,IAAI,CAAC,EAAE,OAAO,EAAE,SAAuC,EAAE,CAAC;SAC1D,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AACtF,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,kBAAkB,CAChC,UAA2D;IAM3D,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACzE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAC1E,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAAS,GAAW,OAAO,IAAI,CAAC,GAAG,EACnC,UAAU,GAA8B,UAAU;IAElD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAU,EACV,UAA2B,EAC3B,KAAoC;IAEpC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,GAAG,EAAE,CACV,UAAU,CACR,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK;YACvC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CACzC,CACF,CAAC;QACJ,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACzB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAA2B,EAC3B,UAA2B,EAC3B,SAAiB,EACjB,KAAa;IAEb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,EAAE;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,GAAG,EAAE,CACV,eAAe,CACb,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK;YACvC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,CAAC,CAClC,CACF,CAAC;QACJ,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,SAAS,GAAG,IAAI,GAAG,CAAC,EAAE;gBACtF,IAAI,EAAE,eAAe;aACtB,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC,IAAI,CACd,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAChD,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAoB,EACpB,KAA4B;IAE5B,OAAO,CACL,GAAG,CAAC,SAAS,EAAE,WAAW,KAAK,KAAK,CAAC,WAAW;QAChD,GAAG,CAAC,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QACnD,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACrD,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAC7C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"setup-job-support.js","sourceRoot":"","sources":["../src/setup-job-support.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAK5B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;AAE5C;;yCAEyC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAA0C;IACrE,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,4BAA4B;CACrC,CAAC;AAOF,MAAM,CAAC,MAAM,cAAc,GAAqD;IAC9E,KAAK,EAAE;QACL,QAAQ,EAAE,2CAA2C;QACrD,IAAI,EAAE,mIAAmI;KAC1I;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,gDAAgD;QAC1D,IAAI,EAAE,yIAAyI;KAChJ;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,yDAAyD;QACnE,IAAI,EAAE,mDAAmD;KAC1D;IACD,GAAG,EAAE;QACH,QAAQ,EAAE,6CAA6C;QACvD,IAAI,EAAE,sIAAsI;KAC7I;CACF,CAAC;AAQF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAmC,EACnC,SAA6B,EAC7B,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACxE,MAAM,WAAW,GAAG,4BAA4B,CAAC;QAC/C,OAAO,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAC5D,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,SAAS;QACvB,MAAM,8BAA8B,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;IACpF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,YAAY,OAAO,4CAA4C,yBAAyB,EAAE,yBAAyB,CACpH,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAC1E,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0BAA0B,SAAS,kBAAkB,OAAO,oFAAoF,CACjJ,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,SAAS,eAAe,CAAC,EAAE;YAC9E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACnD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,uBAAuB,SAAS,QAAQ,OAAO,CAAC,eAAe,uFAAuF,CACvJ,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,SAAS,EAAE,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC7E,gBAAgB,EAAE,WAAW,CAAC,MAAM;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAmC,EACnC,MAAc,EACd,kBAAsC,EACtC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC9E,IAAI,QAAQ,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/F,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC;QACH,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,UAAmB;IAC5E,IAAI,UAAU,IAAI,gCAAgC,CAAC,OAAO,CAAC;QAAE,OAAO;IACpE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,YAAY,OAAO,+GAA+G,CACnI,EACD;QACE,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,6BAA6B;QACnC,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE;YACX,YAAY,EAAE,CAAC,0DAA0D,CAAC;SAC3E;QACD,eAAe,EAAE,CAAC,mBAAmB,CAAC;KACvC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAc,EACd,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5F,MAAM,YAAY,GAChB,OAAO,CAAC,MAAM,KAAK,OAAO;QAC1B,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,6BAA6B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,yBAAyB,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC;IACrF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,OAAoC;IAEpC,IAAI,OAAO,CAAC,gBAAgB,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,6CAA6C,OAAO,CAAC,SAAS,wBAAwB,OAAO,gLAAgL,CAAC;IACvR,CAAC;IACD,OAAO,oDAAoD,OAAO,CAAC,SAAS,6CAA6C,CAAC;AAC5H,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB;IAEpB,IACE,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzD,CAAC,GAAG,CAAC,UAAU,EACf,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,GAAG,GAAG,CAAC,OAAO,qFAAqF,CACpG,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiG,EACjG,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAuC,CAAC,EAAE,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,EAAE;SACf,IAAI,CAAC,EAAE,OAAO,EAAE,SAAuC,EAAE,CAAC;SAC1D,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AACtF,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,kBAAkB,CAChC,UAA2D;IAM3D,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACzE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAC1E,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAAS,GAAW,OAAO,IAAI,CAAC,GAAG,EACnC,UAAU,GAA8B,UAAU;IAElD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAU,EACV,UAA2B,EAC3B,KAAoC;IAEpC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,GAAG,EAAE,CACV,UAAU,CACR,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK;YACvC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CACzC,CACF,CAAC;QACJ,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACzB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAA2B,EAC3B,UAA2B,EAC3B,SAAiB,EACjB,KAAa;IAEb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,EAAE;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,GAAG,EAAE,CACV,eAAe,CACb,UAAU,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK;YACvC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,CAAC,CAClC,CACF,CAAC;QACJ,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,SAAS,GAAG,IAAI,GAAG,CAAC,EAAE;gBACtF,IAAI,EAAE,eAAe;aACtB,CAAC,CAAC;YACH,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC,IAAI,CACd,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAChD,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAoB,EACpB,KAA4B;IAE5B,OAAO,CACL,GAAG,CAAC,SAAS,EAAE,WAAW,KAAK,KAAK,CAAC,WAAW;QAChD,GAAG,CAAC,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QACnD,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACrD,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAC7C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC"}

package/dist/setup-jobs.d.ts

@@ -235,7 +235,7 @@ export declare function createSetupJobManager(opts?: SetupJobManagerOptions): {
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -421,7 +421,7 @@ export declare function createSetupJobManager(opts?: SetupJobManagerOptions): {
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -622,7 +622,7 @@ export declare function createSetupJobManager(opts?: SetupJobManagerOptions): {
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
@@ -814,7 +814,7 @@ export declare function createSetupJobManager(opts?: SetupJobManagerOptions): {
                 commandStarted: boolean;
                 exitCode: number | null;
                 signal: string | null;
-                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | "terminal_transport_failed" | "terminal_transport_probe_failed" | "terminal_transport_unavailable" | "terminal_transport_unsupported" | undefined;
                 finishedAt: string;
             } | undefined;
             terminationReconciliation?: {

package/dist/setup-jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-jobs.d.ts","sourceRoot":"","sources":["../src/setup-jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAI9D,OAAO,EAEL,qCAAqC,EAGtC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAE/B,KAAK,uBAAuB,EAE5B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAkB3B,OAAO,EAAuB,aAAa,EAAyB,MAAM,sBAAsB,CAAC;AAqCjG,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,eAAe,CAAC,EAAE,CAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,cAAc,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,KAC5E,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzC;;yCAEqC;IACrC,sBAAsB,CAAC,EAAE,CACvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,KACrB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC7C,sBAAsB,CAAC,EAAE;QACvB,OAAO,CAAC,KAAK,EAAE;YACb,SAAS,EAAE,MAAM,CAAC;YAClB,OAAO,EAAE,MAAM,CAAC;YAChB,SAAS,EAAE,cAAc,CAAC;YAC1B,aAAa,EAAE,eAAe,CAAC;YAC/B,cAAc,EAAE,gBAAgB,CAAC;SAClC,GAAG;YAAE,OAAO,EAAE,qBAAqB,CAAA;SAAE,CAAC;QACvC,MAAM,CAAC,KAAK,EAAE;YACZ,OAAO,EAAE,qBAAqB,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC;YAClB,WAAW,CAAC,EAAE,WAAW,CAAC;SAC3B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,+BAA+B,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,YAAY,CAAC;IACpD,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,qCAAqC,CAAC,CAAC;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AACD,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,sBAA2B;;sBAwmC9C,IAAI;oBAGN,OAAO,CAAC,IAAI,CAAC;kBA+BlB,OAAO,gBAAgB;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe;kBAqIxE,yBAAyB,GAAG,eAAe,EAAE;kBAG7C,OAAO,GAAG,eAAe;oBAIvB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQT,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBASD,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;qBAOrC,OAAO,GAAG,eAAe;iBAyB7B,OAAO,GAAG,eAAe;kBAMxB,OAAO,GAAG,eAAe;;;EAmC1C"}
+{"version":3,"file":"setup-jobs.d.ts","sourceRoot":"","sources":["../src/setup-jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAI9D,OAAO,EAEL,qCAAqC,EAGtC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAE/B,KAAK,uBAAuB,EAE5B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAmB3B,OAAO,EAAuB,aAAa,EAAyB,MAAM,sBAAsB,CAAC;AAqCjG,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,eAAe,CAAC,EAAE,CAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,cAAc,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,KAC5E,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzC;;yCAEqC;IACrC,sBAAsB,CAAC,EAAE,CACvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,WAAW,KACrB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC7C,sBAAsB,CAAC,EAAE;QACvB,OAAO,CAAC,KAAK,EAAE;YACb,SAAS,EAAE,MAAM,CAAC;YAClB,OAAO,EAAE,MAAM,CAAC;YAChB,SAAS,EAAE,cAAc,CAAC;YAC1B,aAAa,EAAE,eAAe,CAAC;YAC/B,cAAc,EAAE,gBAAgB,CAAC;SAClC,GAAG;YAAE,OAAO,EAAE,qBAAqB,CAAA;SAAE,CAAC;QACvC,MAAM,CAAC,KAAK,EAAE;YACZ,OAAO,EAAE,qBAAqB,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC;YAClB,WAAW,CAAC,EAAE,WAAW,CAAC;SAC3B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,+BAA+B,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,YAAY,CAAC;IACpD,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,qCAAqC,CAAC,CAAC;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AACD,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,sBAA2B;;sBAgmC9C,IAAI;oBAGN,OAAO,CAAC,IAAI,CAAC;kBA+BlB,OAAO,gBAAgB;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe;kBA0IxE,yBAAyB,GAAG,eAAe,EAAE;kBAG7C,OAAO,GAAG,eAAe;oBAIvB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQT,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBASD,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;qBAOrC,OAAO,GAAG,eAAe;iBAyB7B,OAAO,GAAG,eAAe;kBAMxB,OAAO,GAAG,eAAe;;;EAmC1C"}

package/dist/setup-jobs.js

@@ -7,15 +7,16 @@ import { daemonDir } from "@claudexor/daemon";
 import { ControlSetupJobCreateRequest, SetupNativeCommandReceipt, } from "@claudexor/schema";
 import { noProjectRepoRoot } from "@claudexor/util";
 import * as NativeLogin from "./native-login.js";
-import { SETUP_PROFILES, processGroupFromJob, profileDoctorProbe, DEFAULT_STORE_OF, assertDefaultLoginAllowed, assertSetupJobExtendable, resolveLoginProfileBinding, resolveSetupLoginRunnerPath, shellQuote, stateMatchesDurableExecution, waitWithAbort, withAbortAndTimeout, } from "./setup-job-support.js";
+import { SETUP_PROFILES, processGroupFromJob, profileDoctorProbe, DEFAULT_STORE_OF, assertDefaultLoginAllowed, assertSetupJobExtendable, resolveLoginProfileBinding, resolveSetupLoginRunnerPath, setupProfileBindingMessage, shellQuote, stateMatchesDurableExecution, waitWithAbort, withAbortAndTimeout, } from "./setup-job-support.js";
 import { buildGateway } from "./registry.js";
 import { ACTIVE_SETUP_STATES, SetupJobStore, TERMINAL_SETUP_STATES } from "./setup-job-store.js";
 import { SETUP_LOGIN_PROTOCOL_VERSION, atomicPrivateJson, captureExecutableEvidence, commandDigest, readLoginManifest, readRunnerResult, readRunnerState, sealLoginManifest, verifyExecutableEvidence, } from "./setup-login-protocol.js";
 import { SetupSupervisor } from "./setup-supervisor.js";
 import { createDeviceCodeDisclosureWatcher } from "./setup-device-code-disclosure.js";
-import { awaitingSetupUserMessage, deviceAuthUnsupportedMessage, deviceCodeRejectionRemedy, clientPtyWaitingPatch, isDeviceCodeSetupJob, projectSetupDeviceCode, removeSetupDeviceCodeSidecar, setupTransportConflict, } from "./setup-client-pty.js";
+import { awaitingSetupUserMessage, deviceCodeRejectionRemedy, clientPtyWaitingPatch, isDeviceCodeSetupJob, projectSetupDeviceCode, removeSetupDeviceCodeSidecar, setupTransportConflict, } from "./setup-client-pty.js";
 import { persistSetupLoginPermit, setupLoginDeadlines } from "./setup-login-permit.js";
 import { graceVerifyAfterDeadline, isUrlDisclosureLoginMode, submitSetupLoginInput, } from "./setup-login-completion.js";
+import { setupRunnerFailureOutcome } from "./setup-runner-outcome.js";
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 const LOGIN_EXTENSION_MS = 15 * 60_000;
 export function createSetupJobManager(opts = {}) {
@@ -438,14 +439,9 @@ export function createSetupJobManager(opts = {}) {
             return;
         }
         job = persistNativeCommandOutcome(jobId, result);
-        if (!result.commandStarted) {
-            if (result.errorCode === "device_auth_unsupported") {
-                finish(jobId, "not_supported", "not_supported", deviceAuthUnsupportedMessage(job.harness, platform));
-                return;
-            }
-            finish(jobId, "failed", "launch_failed", result.errorCode === "permit_timeout"
-                ? `${job.harness} login worker timed out before a durable execution permit was issued.`
-                : `${job.harness} login command could not be spawned after authorization.`);
+        const runnerFailure = setupRunnerFailureOutcome(job.harness, result, platform);
+        if (runnerFailure) {
+            finish(jobId, ...runnerFailure);
             return;
         }
         if (result.exitCode === 0 && result.signal === null) {
@@ -691,6 +687,7 @@ export function createSetupJobManager(opts = {}) {
     }
     function startObservableLogin(job, spec, profileConfigDir) {
         const deviceCode = spec.loginMode === "device_code";
+        const clientPty = job.transport === "client_pty";
         // Daemon-hosted modes never touch Terminal and run on any posix platform;
         // only the legacy Terminal handoff (codex browser_redirect) is macOS-only.
         const daemonHosted = deviceCode || isUrlDisclosureLoginMode(spec.loginMode);
@@ -730,24 +727,28 @@ export function createSetupJobManager(opts = {}) {
                 args: [...spec.args],
                 cwd: paths.dir,
                 ...(targetConfigDir ? { profileConfigDir: targetConfigDir } : {}),
-                // D-17 device-code (app-server) login: the runner hosts the app-server
-                // and writes the transient disclosure sidecar. Terminal-mode logins
-                // (claude/cursor, codex fallback) carry the SAME sidecar path so the
-                // runner can capture the vendor login's OAuth URL into it as an
-                // `oauth_url` disclosure — the no-Terminal "open this link" card.
-                // Pre-upgrade sealed manifests (no deviceCodePath) stay digest-valid.
-                deviceCodePath: paths.runnerDeviceCode,
-                ...(deviceCode
-                    ? { loginMode: "device_code", appServerFlow: spec.appServerFlow }
-                    : isUrlDisclosureLoginMode(spec.loginMode)
-                        ? {
-                            loginMode: spec.loginMode,
-                            // ptyStdin only where the vendor refuses a piped stdin.
-                            ...(spec.loginMode === "url_disclosure_with_input"
-                                ? { inputPath: paths.runnerInput, ...(spec.ptyStdin ? { ptyStdin: true } : {}) }
+                // These fields describe DAEMON-owned disclosure/control only. A
+                // client_pty manifest is an external-attach command contract: attach
+                // runs the vendor in the already attached terminal with inherited
+                // stdio, so it must not contain sidecars, login modes, or a PTY helper.
+                ...(!clientPty
+                    ? {
+                        deviceCodePath: paths.runnerDeviceCode,
+                        ...(deviceCode
+                            ? { loginMode: "device_code", appServerFlow: spec.appServerFlow }
+                            : isUrlDisclosureLoginMode(spec.loginMode)
+                                ? {
+                                    loginMode: spec.loginMode,
+                                    ...(spec.loginMode === "url_disclosure_with_input"
+                                        ? {
+                                            inputPath: paths.runnerInput,
+                                            ...(spec.ptyStdin ? { ptyStdin: true } : {}),
+                                        }
+                                        : {}),
+                                }
                                 : {}),
-                        }
-                        : {}),
+                    }
+                    : {}),
                 statePath: paths.runnerState,
                 resultPath: paths.runnerResult,
                 permitPath: paths.runnerPermit,
@@ -757,6 +758,26 @@ export function createSetupJobManager(opts = {}) {
                 commandDigest: authorizedCommandDigest,
             });
             atomicPrivateJson(paths.manifest, manifest);
+            // External attach is a real transport, not a daemon-hosted login with a
+            // second terminal layered on top. Seal and wait before any runner spawn.
+            if (clientPty) {
+                const authorization = {
+                    executionId,
+                    executable,
+                    args: [...spec.args],
+                    commandDigest: authorizedCommandDigest,
+                    manifestDigest: manifest.manifestDigest,
+                };
+                const waiting = update(job.jobId, clientPtyWaitingPatch({
+                    job,
+                    deadlineAt: loginDeadlineAt,
+                    startedAt: iso(),
+                    command: spec.displayCommand,
+                    authorization,
+                }));
+                log(job.jobId, `client_pty attach prepared: ${paths.manifest}`);
+                return waiting;
+            }
             if (daemonHosted) {
                 // D-17 primary flow: launch the app-server runner DETACHED (no Terminal,
                 // no login.command script). The runner survives daemon restart exactly
@@ -802,24 +823,6 @@ export function createSetupJobManager(opts = {}) {
                 runner.unref();
                 return waiting;
             }
-            if (job.transport === "client_pty") {
-                const authorization = {
-                    executionId,
-                    executable,
-                    args: [...spec.args],
-                    commandDigest: authorizedCommandDigest,
-                    manifestDigest: manifest.manifestDigest,
-                };
-                const waiting = update(job.jobId, clientPtyWaitingPatch({
-                    job,
-                    deadlineAt: loginDeadlineAt,
-                    startedAt: iso(),
-                    command: spec.displayCommand,
-                    authorization,
-                }));
-                log(job.jobId, `client_pty attach prepared: ${paths.manifest}`);
-                return waiting;
-            }
             // External-risk disclosure (v3.0.3, Bible): a browser-based OpenAI
             // sign-in completed in a browser holding ANOTHER account's session can
             // revoke sibling sessions (incl. the ChatGPT desktop app) server-side.
@@ -918,7 +921,7 @@ export function createSetupJobManager(opts = {}) {
         create(input, idempotency) {
             const request = ControlSetupJobCreateRequest.parse(input);
             const { harness, action } = request;
-            const profileBinding = resolveLoginProfileBinding(harness, action, request.profileId);
+            const profileBinding = resolveLoginProfileBinding(harness, action, request.profileId, platform);
             assertDefaultLoginAllowed(harness, profileBinding !== null);
             const binding = idempotency ? { ...idempotency, request } : undefined;
             const prior = binding ? store.resolveCreate(binding) : null;
@@ -996,7 +999,7 @@ export function createSetupJobManager(opts = {}) {
                 command: null,
                 guideUrl: profile.guideUrl,
                 message: profileBinding
-                    ? `${profile.note} This login targets the scoped Claudexor profile "${profileBinding.profileId}" (INV-135); the default vendor store is never touched.`
+                    ? `${profile.note} ${setupProfileBindingMessage(harness, profileBinding)}`
                     : `${profile.note} The required same-harness smoke may consume quota; incremental billing is unknown.`,
                 createdAt: iso(),
                 startedAt: null,