@codesona/runner 0.1.0 → 0.2.0

package/dist/cli.js

@@ -2276,7 +2276,7 @@ var require_websocket = __commonJS({
     var http2 = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes8, createHash: createHash5 } = __require("crypto");
+    var { randomBytes: randomBytes9, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2827,7 +2827,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes8(16).toString("base64");
+      const key = randomBytes9(16).toString("base64");
       const request = isSecure ? https2.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -3722,9 +3722,9 @@ var require_websocket_server = __commonJS({
 
 // src/runner/doctor.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 import os6 from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 
 // src/harness/host.ts
@@ -5383,12 +5383,12 @@ var NativeUsageReader = class {
   cursor = -1;
   childTrajectories = false;
   async read() {
-    const path27 = join5(this.home, "antigravity-acp", "conversations", `${this.sessionId}.db`);
+    const path30 = join5(this.home, "antigravity-acp", "conversations", `${this.sessionId}.db`);
     let cursor = this.cursor;
     let complete = false;
     const result = [];
     for (let batch = 0; batch < 16; batch++) {
-      const rows = await this.readRows(path27, cursor);
+      const rows = await this.readRows(path30, cursor);
       for (const row of rows) {
         if (!Number.isSafeInteger(row.idx) || row.idx <= cursor || !/^(?:[a-f0-9]{2})*$/i.test(row.data) || row.data.length > 8 * 1024 * 1024) throw new Error("Invalid native usage row");
         if (row.has_children) this.childTrajectories = true;
@@ -5406,11 +5406,11 @@ var NativeUsageReader = class {
     return { samples: result, complete, ...this.childTrajectories ? { incompleteScope: true } : {} };
   }
 };
-async function queryNativeRowsWithCli(path27, cursor) {
-  const output = await readLocalCommand("sqlite3", ["-readonly", "-json", path27, QUERY.replace("idx>?", `idx>${cursor}`)], 16 * 1024 * 1024);
+async function queryNativeRowsWithCli(path30, cursor) {
+  const output = await readLocalCommand("sqlite3", ["-readonly", "-json", path30, QUERY.replace("idx>?", `idx>${cursor}`)], 16 * 1024 * 1024);
   return output.trim() ? JSON.parse(output) : [];
 }
-async function queryNativeRows(path27, cursor, loadSqlite = async () => {
+async function queryNativeRows(path30, cursor, loadSqlite = async () => {
   const module = "node:sqlite";
   return await import(module);
 }) {
@@ -5418,9 +5418,9 @@ async function queryNativeRows(path27, cursor, loadSqlite = async () => {
   try {
     sqlite = await loadSqlite();
   } catch {
-    return queryNativeRowsWithCli(path27, cursor);
+    return queryNativeRowsWithCli(path30, cursor);
   }
-  const db = new sqlite.DatabaseSync(path27, { readOnly: true });
+  const db = new sqlite.DatabaseSync(path30, { readOnly: true });
   try {
     return db.prepare(QUERY).all(cursor);
   } finally {
@@ -7309,14 +7309,14 @@ function normalizeFileChangeInput(item) {
   const changePaths = Array.isArray(item?.changes) ? item.changes.map((change) => change?.path) : [];
   for (const candidate of changePaths) {
     if (typeof candidate !== "string") continue;
-    const path27 = candidate.trim();
-    if (!path27 || seen.has(path27)) continue;
-    seen.add(path27);
-    paths.push(path27);
+    const path30 = candidate.trim();
+    if (!path30 || seen.has(path30)) continue;
+    seen.add(path30);
+    paths.push(path30);
   }
   if (paths.length === 0 && typeof item?.path === "string") {
-    const path27 = item.path.trim();
-    if (path27) paths.push(path27);
+    const path30 = item.path.trim();
+    if (path30) paths.push(path30);
   }
   return paths.length > 0 ? { path: paths.join(", ") } : {};
 }
@@ -10842,7 +10842,7 @@ var OpenCodeServiceLane = class {
     const document = record4(body);
     const paths = record4(document?.paths);
     const required = this.requiredApiPaths;
-    if (!paths || required.some((path27) => !record4(paths[path27]))) {
+    if (!paths || required.some((path30) => !record4(paths[path30]))) {
       throw new OpenCodeIncompatibleError("Installed OpenCode service is missing required session capabilities");
     }
   }
@@ -10932,8 +10932,8 @@ var OpenCodeServiceLane = class {
       const controller = new AbortController();
       this.durableAbort = controller;
       try {
-        const path27 = `/api/session/${encodeURIComponent(this.sessionId)}/event?after=${this.lastDurableSeq}`;
-        const response = await this.openStream(path27, controller, "durable event stream");
+        const path30 = `/api/session/${encodeURIComponent(this.sessionId)}/event?after=${this.lastDurableSeq}`;
+        const response = await this.openStream(path30, controller, "durable event stream");
         await this.catchUpHistory(true);
         if (!this.isIdentity(identity)) return;
         this.durableGap = false;
@@ -11000,12 +11000,12 @@ var OpenCodeServiceLane = class {
     if (this.stopping) return;
     this.protocolFailure(`OpenCode ${kind} stream stopped unexpectedly`, error);
   }
-  async openStream(path27, lifecycle, operation) {
+  async openStream(path30, lifecycle, operation) {
     const deadline = new AbortController();
     const timeout = setTimeout(() => deadline.abort(), this.options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS);
     timeout.unref?.();
     try {
-      const response = await this.fetchFn(`${this.baseUrl}${path27}`, {
+      const response = await this.fetchFn(`${this.baseUrl}${path30}`, {
         method: "GET",
         headers: this.headers({ accept: "text/event-stream" }),
         signal: AbortSignal.any([lifecycle.signal, deadline.signal])
@@ -11437,8 +11437,8 @@ var OpenCodeServiceLane = class {
       turnOwner: root.receipt
     });
   }
-  async requestNoContent(path27, method, body, operation) {
-    const response = await this.fetchWithTimeout(path27, {
+  async requestNoContent(path30, method, body, operation) {
+    const response = await this.fetchWithTimeout(path30, {
       method,
       ...body ? {
         headers: { "content-type": "application/json" },
@@ -11447,14 +11447,14 @@ var OpenCodeServiceLane = class {
     }, operation);
     if (!response.ok) throw new OpenCodeHttpError(response.status, operation);
   }
-  async fetchWithTimeout(path27, init, operation, timeoutMs = this.options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS) {
+  async fetchWithTimeout(path30, init, operation, timeoutMs = this.options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS) {
     if (this.stopping) throw new Error("OpenCode service lane is stopping");
     const controller = new AbortController();
     this.requestControllers.add(controller);
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     timer.unref?.();
     try {
-      return await this.fetchFn(`${this.baseUrl}${path27}`, {
+      return await this.fetchFn(`${this.baseUrl}${path30}`, {
         ...init,
         headers: this.headers(init.headers),
         signal: controller.signal
@@ -11466,7 +11466,7 @@ var OpenCodeServiceLane = class {
       this.requestControllers.delete(controller);
     }
   }
-  async fetchJsonWithTimeout(path27, init, operation, timeoutMs = this.options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS) {
+  async fetchJsonWithTimeout(path30, init, operation, timeoutMs = this.options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS) {
     if (this.stopping) throw new OpenCodeStoppedError("OpenCode service lane is stopping");
     const controller = new AbortController();
     this.requestControllers.add(controller);
@@ -11477,7 +11477,7 @@ var OpenCodeServiceLane = class {
     }, timeoutMs);
     timer.unref?.();
     try {
-      const response = await this.fetchFn(`${this.baseUrl}${path27}`, {
+      const response = await this.fetchFn(`${this.baseUrl}${path30}`, {
         ...init,
         headers: this.headers(init.headers),
         signal: controller.signal
@@ -14608,9 +14608,9 @@ function parseBffUrl(value) {
   const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]";
   return url.protocol === "http:" && loopback ? url : void 0;
 }
-function bffEndpoint(base, path27) {
+function bffEndpoint(base, path30) {
   const url = new URL(base.href);
-  url.pathname = `${url.pathname.replace(/\/+$/, "")}/${path27.replace(/^\/+/, "")}`;
+  url.pathname = `${url.pathname.replace(/\/+$/, "")}/${path30.replace(/^\/+/, "")}`;
   url.search = "";
   url.hash = "";
   return url;
@@ -14700,7 +14700,7 @@ function parseRunBundle(response, runId) {
   if (typeof response.sessionId !== "string" || !UUID.test(response.sessionId)) throw new BundleError("the bundle's session id is not a uuid");
   const raw = response.bundle;
   if (!raw || typeof raw !== "object") throw new BundleError("the run has no bundle");
-  if (raw.v !== 1) throw new BundleError(`bundle version ${String(raw.v)} is not one this Runner reads; update Codesona Runner`);
+  if (raw.v !== 1 && raw.v !== 2) throw new BundleError(`bundle version ${String(raw.v)} is not one this Runner reads; update Codesona Runner`);
   if (raw.harness !== Harness.ClaudeCode) throw new BundleError(`the bundle is for ${String(raw.harness)}, which this Runner does not start`);
   if (typeof raw.instructions !== "string") throw new BundleError("the bundle has no instructions");
   const files = stringRecord(raw.files ?? {}, "files");
@@ -14716,7 +14716,7 @@ function parseRunBundle(response, runId) {
     sessionId: response.sessionId,
     resume: response.resume === true,
     bundle: {
-      v: 1,
+      v: raw.v,
       harness: Harness.ClaudeCode,
       instructions: raw.instructions,
       files,
@@ -14726,10 +14726,71 @@ function parseRunBundle(response, runId) {
       limits: {
         wallSeconds: seconds(limits.wallSeconds, DEFAULT_LIMITS.wallSeconds),
         idleSeconds: seconds(limits.idleSeconds, DEFAULT_LIMITS.idleSeconds)
-      }
+      },
+      // A v1 bundle has none, whatever it carries.
+      prepare: raw.v === 2 && raw.prepare != null ? parsePrepare(raw.prepare) : null
     }
   };
 }
+var SHA = /^[0-9a-f]{40}$/i;
+function parsePrepare(value) {
+  if (typeof value !== "object" || Array.isArray(value)) throw new BundleError("the bundle's prepare is not an object");
+  const list = value.repos ?? [];
+  if (!Array.isArray(list)) throw new BundleError("the bundle's prepare.repos is not a list");
+  const repos = list.map((item, index) => parseRepo(item, index));
+  for (const key of ["repoId", "name"]) {
+    const seen = /* @__PURE__ */ new Set();
+    for (const repo of repos) {
+      const folded = repo[key].toLowerCase();
+      if (seen.has(folded)) throw new BundleError(`the bundle names the repository ${key} ${JSON.stringify(repo[key])} twice`);
+      seen.add(folded);
+    }
+  }
+  return { repos };
+}
+function parseRepo(value, index) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new BundleError(`the bundle's repository ${index} is not an object`);
+  const raw = value;
+  const text = (field) => {
+    const item = raw[field];
+    if (typeof item !== "string" || !item) throw new BundleError(`the bundle's repository ${index} has no ${field}`);
+    return item;
+  };
+  const repoId = text("repoId");
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(repoId)) throw new BundleError(`the bundle's repository ${index} has an id the Runner cannot name a directory after`);
+  const name = text("name");
+  if (!isPathSegment(name)) throw new BundleError(`the bundle's repository name ${JSON.stringify(name.slice(0, 80))} is not one plain directory name`);
+  const cloneUrl = text("cloneUrl");
+  let url;
+  try {
+    url = new URL(cloneUrl);
+  } catch {
+    throw new BundleError(`the clone URL of ${name} is not a URL`);
+  }
+  if (url.protocol !== "https:") throw new BundleError(`the clone URL of ${name} is not https`);
+  if (url.username || url.password || /^https:\/\/[^/]*@/i.test(cloneUrl)) throw new BundleError(`the clone URL of ${name} carries a user name or password`);
+  const defaultBranch = branchName(text("defaultBranch"), "default branch", name);
+  const taskBranch = branchName(text("taskBranch"), "task branch", name);
+  const baseSha = text("baseSha");
+  if (!SHA.test(baseSha)) throw new BundleError(`the base commit of ${name} is not a 40-character SHA`);
+  const holding = raw.holdingRef ?? null;
+  if (holding !== null && typeof holding !== "string") throw new BundleError(`the holding ref of ${name} is not a string`);
+  const holdingRef = holding ? refName(holding, "holding ref", name) : null;
+  return { repoId, name, cloneUrl, defaultBranch, taskBranch, baseSha: baseSha.toLowerCase(), holdingRef };
+}
+function isPathSegment(name) {
+  return name.length <= 100 && name !== "." && name !== ".." && !name.startsWith("-") && !/[/\\\x00-\x1f\x7f]/.test(name) && name.trim() === name;
+}
+function refName(ref, what, repo) {
+  const bad = ref.length > 255 || ref.startsWith("-") || ref.startsWith("/") || ref.endsWith("/") || ref.endsWith(".") || ref.endsWith(".lock") || ref.includes("..") || ref.includes("//") || ref.includes("@{") || /[\s~^:?*[\\\x00-\x1f\x7f]/.test(ref) || ref.split("/").some((part) => part.startsWith("."));
+  if (bad) throw new BundleError(`the ${what} of ${repo} is not a ref name git takes`);
+  return ref;
+}
+function branchName(branch, what, repo) {
+  refName(branch, what, repo);
+  if (branch.startsWith("refs/") || branch === "HEAD") throw new BundleError(`the ${what} of ${repo} is not a branch's short name`);
+  return branch;
+}
 function stringRecord(value, what) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new BundleError(`the bundle's ${what} are not an object`);
   for (const [key, item] of Object.entries(value)) {
@@ -14741,7 +14802,7 @@ function seconds(value, fallback) {
   if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
   return Math.min(86400, Math.max(60, Math.round(value)));
 }
-var RESERVED = /* @__PURE__ */ new Set(["AGENTS.md", "CLAUDE.md", ".codesona"]);
+var RESERVED = /* @__PURE__ */ new Set(["AGENTS.md", "CLAUDE.md", ".codesona", "repos"]);
 function bundleFilePath(name) {
   const segments = name.split("/");
   if (!name || path14.isAbsolute(name) || name.includes("\\") || name.includes("\0") || segments.some((segment) => !segment || segment === "." || segment === "..") || RESERVED.has(segments[0])) {
@@ -14941,6 +15002,8 @@ function runnerFiles(home) {
     spool: path16.join(home, "spool"),
     /** One working directory per agent: the same one every session, so `--resume` finds its transcript. */
     agents: path16.join(home, "agents"),
+    /** One bare clone per repository (`<repoId>.git`), shared by the agents' worktrees of it (KT2 §4). */
+    repos: path16.join(home, "repos"),
     /** The background service's log (`run --service`), turned over at 10 MB. */
     log: path16.join(state, "runner.log"),
     /** What the background service's process wrote outside its log (a crash), as launchd keeps it. */
@@ -15009,7 +15072,7 @@ var ExitCode = {
   Failed: 1,
   Usage: 2
 };
-var runnerVersion = true ? "0.1.0" : "0.0.0-dev";
+var runnerVersion = true ? "0.2.0" : "0.0.0-dev";
 
 // src/runner/log.ts
 var LogLevel = {
@@ -15411,7 +15474,7 @@ var LaunchdError = class extends Error {
 };
 function runCommand(file, args, options = {}) {
   return new Promise((resolve4) => {
-    execFile(file, [...args], { timeout: options.timeoutMs ?? 15e3, encoding: "utf8", maxBuffer: 4 * 1024 * 1024, env: options.env }, (error, stdout, stderr) => {
+    execFile(file, [...args], { timeout: options.timeoutMs ?? 15e3, encoding: "utf8", maxBuffer: 4 * 1024 * 1024, env: options.env, cwd: options.cwd }, (error, stdout, stderr) => {
       const exit = error?.code;
       const code = !error ? 0 : typeof exit === "number" ? exit : -1;
       resolve4({ code, stdout: stdout ?? "", stderr: stderr || (code === -1 && error ? error.message : "") });
@@ -15757,6 +15820,68 @@ async function statusCommand(args, io, env = process.env) {
   return ExitCode.Ok;
 }
 
+// src/runner/tools.ts
+import fs11 from "node:fs";
+import path18 from "node:path";
+var TOOL_TIMEOUT_MS = 1e4;
+function parseGitVersion(output) {
+  return /git version (\S+)/.exec(output)?.[1] ?? null;
+}
+function parseDotnetSdks(output) {
+  return output.split("\n").map((line) => /^(\d\S*)\s+\[/.exec(line.trim())?.[1]).filter((version) => version !== void 0);
+}
+function parseNodeVersion(output) {
+  return /^v?(\d+\.\d+\.\d+\S*)/.exec(output.trim())?.[1] ?? null;
+}
+async function readMachineTools(environment = process.env, run = runCommand) {
+  const options = { env: agentEnvironment(environment), timeoutMs: TOOL_TIMEOUT_MS, cwd: "/" };
+  const look = (file, args) => run(file, args, options).catch(() => void 0);
+  const [git, dotnet, node] = await Promise.all([look("git", ["--version"]), look("dotnet", ["--list-sdks"]), look("node", ["--version"])]);
+  return {
+    git: git?.code === 0 ? parseGitVersion(git.stdout) : null,
+    dotnet: dotnet?.code === 0 ? parseDotnetSdks(dotnet.stdout) : null,
+    node: node?.code === 0 ? parseNodeVersion(node.stdout) : null
+  };
+}
+async function readGitSetup(environment = process.env, run = runCommand) {
+  const options = { env: agentEnvironment(environment), timeoutMs: TOOL_TIMEOUT_MS, cwd: "/" };
+  const look = (args) => run("git", args, options).catch(() => void 0);
+  const version = await look(["--version"]);
+  if (version?.code !== 0) return { version: null, credentialHelpers: [], commitSigning: false };
+  const [helpers, signing] = await Promise.all([look(["config", "--get-all", "credential.helper"]), look(["config", "--get", "--type=bool", "commit.gpgsign"])]);
+  return {
+    version: parseGitVersion(version.stdout),
+    // An empty value resets the list before it: what is after the last one counts.
+    credentialHelpers: helpers?.code === 0 ? helpers.stdout.replace(/\n$/, "").split("\n").reduce((list, line) => line.trim() ? [...list, line.trim()] : [], []) : [],
+    commitSigning: signing?.code === 0 && signing.stdout.trim() === "true"
+  };
+}
+function isSshUrl(url) {
+  if (/^(ssh|git\+ssh|ssh\+git):\/\//i.test(url)) return true;
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(url) || url.startsWith("/")) return false;
+  return /^[^/:]+:/.test(url);
+}
+async function cachedSshRemotes(cacheDirectory, environment = process.env, run = runCommand) {
+  let names;
+  try {
+    names = fs11.readdirSync(cacheDirectory).filter((name) => name.endsWith(".git"));
+  } catch {
+    return [];
+  }
+  const options = { env: agentEnvironment(environment), timeoutMs: TOOL_TIMEOUT_MS, cwd: "/" };
+  const found = [];
+  for (const name of names) {
+    const directory = path18.join(cacheDirectory, name);
+    for (const args of [["remote", "get-url", "--all", "origin"], ["remote", "get-url", "--push", "--all", "origin"]]) {
+      const result = await run("git", ["-C", directory, ...args], options).catch(() => void 0);
+      for (const url of result?.code === 0 ? result.stdout.split("\n").map((line) => line.trim()).filter(Boolean) : []) {
+        if (isSshUrl(url) && !found.some((remote) => remote.repository === name && remote.url === url)) found.push({ repository: name, url });
+      }
+    }
+  }
+  return found;
+}
+
 // src/runner/versions.ts
 function isOlder(version, minimum) {
   if (!minimum) return false;
@@ -15850,18 +15975,20 @@ function machineEnvironment(env = process.env, launchAgent, machine = {}) {
     // A Runner run by hand gives its sessions this terminal's environment, less Codesona's names.
     terminalClaudeLogin: service ? () => readClaudeLogin((file, args) => run(file, args, { env: agentEnvironment(env), timeoutMs: 2e4 })) : void 0,
     claudeSettings: () => readClaudeSettings(claudeConfigDir(sessions())),
-    terminalClaudeSettings: service ? () => path18.resolve(claudeConfigDir(env)) === path18.resolve(claudeConfigDir(sessions())) ? void 0 : readClaudeSettings(claudeConfigDir(env)) : void 0,
+    terminalClaudeSettings: service ? () => path19.resolve(claudeConfigDir(env)) === path19.resolve(claudeConfigDir(sessions())) ? void 0 : readClaudeSettings(claudeConfigDir(env)) : void 0,
     shellClaudeSettings: service ? () => shellOnlyClaudeSettings(env, userHome) : void 0,
     powerSettings: () => readPowerSettings(run, platform),
     probeEdge: (baseUrl) => probeEdge(baseUrl, { userAgent: runnerUserAgent() }),
     launchAgent: service ? launchAgent ?? new LaunchAgent() : void 0,
-    claudeOnServicePath: () => currentLaunchAgentSpec(env, userHome).path.split(":").some((directory) => isExecutable(path18.join(directory, "claude")))
+    claudeOnServicePath: () => currentLaunchAgentSpec(env, userHome).path.split(":").some((directory) => isExecutable(path19.join(directory, "claude"))),
+    gitSetup: () => readGitSetup(sessions(), run),
+    sshRemotes: () => cachedSshRemotes(runnerFiles(runnerHome(env)).repos, sessions(), run)
   };
 }
 function isExecutable(file) {
   try {
-    fs11.accessSync(file, fs11.constants.X_OK);
-    return fs11.statSync(file).isFile();
+    fs12.accessSync(file, fs12.constants.X_OK);
+    return fs12.statSync(file).isFile();
   } catch {
     return false;
   }
@@ -15974,6 +16101,35 @@ ${setting}`)).map(({ file, setting }) => {
     }
   });
 }
+function gitChecks(setup, sshRemotes) {
+  if (!setup.version) {
+    return [{
+      status: CheckStatus.Warning,
+      message: "git is not installed, or not on the sessions' PATH: a Developer's sessions need it (a Tester's do not)",
+      hint: "Install it: xcode-select --install, or brew install git"
+    }];
+  }
+  const checks = [{ status: CheckStatus.Ok, message: `git ${setup.version}` }];
+  checks.push(setup.credentialHelpers.length > 0 ? { status: CheckStatus.Ok, message: `git has a credential helper (${setup.credentialHelpers.join(", ")})` } : {
+    status: CheckStatus.Warning,
+    message: "git has no credential helper: a Developer's sessions could not fetch or push over https",
+    hint: "Set one up and sign in once in a terminal: Git Credential Manager (brew install --cask git-credential-manager), or gh auth setup-git"
+  });
+  if (setup.commitSigning) {
+    checks.push({
+      status: CheckStatus.Warning,
+      message: "commit.gpgsign is true in your git config: sessions run with commit signing off, so the agents' commits are not signed with your key"
+    });
+  }
+  for (const remote of sshRemotes) {
+    checks.push({
+      status: CheckStatus.Warning,
+      message: `The cached repository ${remote.repository} reaches its remote over SSH (${remote.url}): the background service has no SSH agent, so its git cannot use your SSH key`,
+      hint: "Use https with a credential helper; a url.<base>.insteadOf in your git config that turns https into SSH does the same"
+    });
+  }
+  return checks;
+}
 function addressCheck(url, paired) {
   const which = paired ? "This machine's Codesona" : "Codesona (the default; no machine paired yet)";
   if (url.protocol === "https:") return { status: CheckStatus.Ok, message: `${which} is ${url.origin}, over https` };
@@ -16051,7 +16207,7 @@ function permissionChecks(home) {
   const files = runnerFiles(home);
   const wide = [home, files.config].filter((file) => {
     try {
-      return (fs11.statSync(file).mode & 63) !== 0;
+      return (fs12.statSync(file).mode & 63) !== 0;
     } catch {
       return false;
     }
@@ -16094,6 +16250,7 @@ async function runChecks(environment, options = {}) {
   if (sessionSettings) checks.push(...hookChecks(sessionSettings));
   const terminalSettings = environment.terminalClaudeSettings && service && !service.installed ? environment.terminalClaudeSettings() : void 0;
   if (terminalSettings) checks.push(...hookChecks(terminalSettings, SESSIONS_WHERE[SessionPlace.Terminal], stopHookBlocks(sessionSettings ?? [])));
+  if (environment.gitSetup) checks.push(...gitChecks(await environment.gitSetup(), await environment.sshRemotes?.() ?? []));
   if (unreadable) {
     checks.push({ status: CheckStatus.Failed, message: unreadable.message, hint: "Pair this machine again: codesona-runner logout --local, then the command Factory shows." });
   }
@@ -16148,8 +16305,8 @@ async function applyFix(fix, environment) {
   switch (fix) {
     case DoctorFix.Permissions: {
       const files = runnerFiles(environment.runnerHome);
-      fs11.chmodSync(environment.runnerHome, 448);
-      if (fs11.existsSync(files.config)) fs11.chmodSync(files.config, 384);
+      fs12.chmodSync(environment.runnerHome, 448);
+      if (fs12.existsSync(files.config)) fs12.chmodSync(files.config, 384);
       return `${environment.runnerHome} and its config can be read by this user only`;
     }
     case DoctorFix.InstallService:
@@ -16193,8 +16350,8 @@ async function doctorCommand(args, io, environment = machineEnvironment()) {
 }
 
 // src/runner/logout.ts
-import fs13 from "node:fs";
-import path20 from "node:path";
+import fs14 from "node:fs";
+import path21 from "node:path";
 import { parseArgs as parseArgs3 } from "node:util";
 
 // src/runner/bff.ts
@@ -16262,13 +16419,13 @@ var BffClient = class {
   async logout(connectionKey) {
     await this.request("POST", "v1/machine-auth/logout", connectionKey, void 0, { emptyAnswer: true });
   }
-  async request(method, path27, bearer, body, options = {}) {
+  async request(method, path30, bearer, body, options = {}) {
     const headers = { "User-Agent": this.options.userAgent, Accept: "application/json" };
     if (bearer) headers.Authorization = `Bearer ${bearer}`;
     if (body !== void 0) headers["Content-Type"] = "application/json";
     let response;
     try {
-      response = await this.fetchImpl(bffEndpoint(this.options.baseUrl, path27), {
+      response = await this.fetchImpl(bffEndpoint(this.options.baseUrl, path30), {
         method,
         headers,
         body: body === void 0 ? void 0 : JSON.stringify(body),
@@ -16276,7 +16433,7 @@ var BffClient = class {
         redirect: "error"
       });
     } catch (error) {
-      throw new BffError(`${method} /${path27}: ${describeFetchError(error)}`, 0);
+      throw new BffError(`${method} /${path30}: ${describeFetchError(error)}`, 0);
     }
     const serverTime = Date.parse(response.headers.get("date") ?? "");
     if (Number.isFinite(serverTime)) {
@@ -16289,7 +16446,7 @@ var BffClient = class {
       const code = typeof problem?.code === "string" ? problem.code : void 0;
       const detail = typeof problem?.detail === "string" ? problem.detail : void 0;
       throw new BffError(
-        `${method} /${path27}: ${response.status}${code ? ` ${code}` : ""}${detail ? `: ${detail}` : ""}`,
+        `${method} /${path30}: ${response.status}${code ? ` ${code}` : ""}${detail ? `: ${detail}` : ""}`,
         response.status,
         code,
         retryAfter(response.headers.get("retry-after"))
@@ -16298,7 +16455,7 @@ var BffClient = class {
     if (options.emptyAnswer) return void 0;
     const parsed = parseJson(text);
     if (parsed === void 0 || parsed === null || typeof parsed !== "object") {
-      throw new BffError(`${method} /${path27}: ${response.status} with a body that is not JSON`, 502);
+      throw new BffError(`${method} /${path30}: ${response.status} with a body that is not JSON`, 502);
     }
     return parsed;
   }
@@ -16343,6 +16500,9 @@ var AuthRefusalCode = {
   AlreadyConnected: "already_connected",
   InvalidRequest: "invalid_request"
 };
+var LaunchErrorKind = {
+  PrepareFailed: "PrepareFailed"
+};
 var EndResult = {
   Written: "Written",
   AlreadyEnded: "AlreadyEnded",
@@ -16386,6 +16546,11 @@ var StartRefusal = {
   BundleInvalid: "BundleInvalid",
   /** The run's bundle could not be read in time (the BFF away, or not this machine's run any more). */
   BundleUnavailable: "BundleUnavailable",
+  /**
+   * A repository the run works in cannot be reached with this machine's git (`git ls-remote` failed or did not answer in
+   * time): holds until a person acts (the machine's credentials, its network, the repository's access).
+   */
+  RepoUnavailable: "RepoUnavailable",
   UpdateRequired: "UpdateRequired",
   ShuttingDown: "ShuttingDown"
 };
@@ -16498,14 +16663,14 @@ function refusalMessage(reason) {
 }
 
 // src/runner/lock.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 import net from "node:net";
-import path19 from "node:path";
+import path20 from "node:path";
 var TAKEOVER_STALE_MS = 3e4;
 var TAKEOVER_WAIT_MS = 50;
 var ATTEMPTS = 40;
 async function acquireInstanceLock(file) {
-  ensurePrivateDirectory(path19.dirname(file));
+  ensurePrivateDirectory(path20.dirname(file));
   const takeover = `${file}.takeover`;
   for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
     const lock = await listen(file);
@@ -16517,10 +16682,10 @@ async function acquireInstanceLock(file) {
     }
     try {
       if (await isHeld(file)) return void 0;
-      fs12.rmSync(file, { force: true });
+      fs13.rmSync(file, { force: true });
       return await listen(file);
     } finally {
-      fs12.rmSync(takeover, { recursive: true, force: true });
+      fs13.rmSync(takeover, { recursive: true, force: true });
     }
   }
   return void 0;
@@ -16542,13 +16707,13 @@ async function listen(file) {
 }
 function enterTakeover(directory) {
   try {
-    fs12.mkdirSync(directory, { mode: 448 });
+    fs13.mkdirSync(directory, { mode: 448 });
     return true;
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
   }
   try {
-    if (Date.now() - fs12.statSync(directory).mtimeMs > TAKEOVER_STALE_MS) fs12.rmSync(directory, { recursive: true, force: true });
+    if (Date.now() - fs13.statSync(directory).mtimeMs > TAKEOVER_STALE_MS) fs13.rmSync(directory, { recursive: true, force: true });
   } catch {
   }
   return false;
@@ -16630,7 +16795,7 @@ async function logoutCommand(args, io, environment = {}) {
     removeRunnerFiles(home);
   } finally {
     await lock.release();
-    fs13.rmSync(files.state, { recursive: true, force: true });
+    fs14.rmSync(files.state, { recursive: true, force: true });
     removeIfEmpty(home);
   }
   const name = config?.machineName ? `"${config.machineName}"` : "This machine";
@@ -16671,30 +16836,378 @@ async function tellCodesona(store, config, fetchImpl) {
 }
 function removeRunnerFiles(home) {
   const files = runnerFiles(home);
-  fs13.rmSync(files.config, { force: true });
-  for (const directory of [files.outbox, files.spool, files.agents]) fs13.rmSync(directory, { recursive: true, force: true });
+  fs14.rmSync(files.config, { force: true });
+  for (const directory of [files.outbox, files.spool, files.agents]) fs14.rmSync(directory, { recursive: true, force: true });
   for (const name of safeList(files.state)) {
-    if (name !== path20.basename(files.lock)) fs13.rmSync(path20.join(files.state, name), { recursive: true, force: true });
+    if (name !== path21.basename(files.lock)) fs14.rmSync(path21.join(files.state, name), { recursive: true, force: true });
   }
 }
 function safeList(directory) {
   try {
-    return fs13.readdirSync(directory);
+    return fs14.readdirSync(directory);
   } catch {
     return [];
   }
 }
 function removeIfEmpty(directory) {
   try {
-    fs13.rmdirSync(directory);
+    fs14.rmdirSync(directory);
   } catch {
   }
 }
 
-// src/runner/restart.ts
+// src/runner/prune.ts
+import fs16 from "node:fs";
+import path23 from "node:path";
 import { parseArgs as parseArgs4 } from "node:util";
+
+// src/runner/repos.ts
+import { execFile as execFile2 } from "node:child_process";
+import { randomBytes as randomBytes8 } from "node:crypto";
+import fs15 from "node:fs";
+import path22 from "node:path";
+function gitWith(environment = process.env) {
+  const base = { ...agentEnvironment(environment), GIT_TERMINAL_PROMPT: "0" };
+  return (args, options = {}) => new Promise((resolve4) => {
+    execFile2("git", [...args], {
+      cwd: options.cwd ?? "/",
+      env: withGitEnvironment(base, options.env),
+      timeout: options.timeoutMs ?? COMMAND_TIMEOUT_MS,
+      maxBuffer: 16 * 1024 * 1024,
+      encoding: "utf8",
+      signal: options.signal
+    }, (error, stdout, stderr) => {
+      if (!error) return resolve4({ code: 0, stdout, stderr });
+      const failure = error;
+      if (failure.name === "AbortError") return resolve4({ code: -1, stdout: stdout ?? "", stderr: stderr ?? "", aborted: true });
+      const code = typeof failure.code === "number" ? failure.code : -1;
+      resolve4({ code, stdout: stdout ?? "", stderr: stderr || (code === -1 ? failure.message : ""), timedOut: failure.killed === true && code === -1 });
+    });
+  });
+}
+function withGitEnvironment(base, extra = {}) {
+  const result = {};
+  for (const [name, value] of Object.entries(base)) if (value !== void 0) result[name] = value;
+  const extraCount = Number(extra.GIT_CONFIG_COUNT ?? 0);
+  for (const [name, value] of Object.entries(extra)) if (!/^GIT_CONFIG_(COUNT|KEY_\d+|VALUE_\d+)$/.test(name)) result[name] = value;
+  if (Number.isSafeInteger(extraCount) && extraCount > 0) {
+    const baseCount = Number(result.GIT_CONFIG_COUNT ?? 0);
+    const offset = Number.isSafeInteger(baseCount) && baseCount > 0 ? baseCount : 0;
+    let added = 0;
+    for (let index = 0; index < extraCount; index++) {
+      const key = extra[`GIT_CONFIG_KEY_${index}`];
+      const value = extra[`GIT_CONFIG_VALUE_${index}`];
+      if (key === void 0 || value === void 0) continue;
+      result[`GIT_CONFIG_KEY_${offset + added}`] = key;
+      result[`GIT_CONFIG_VALUE_${offset + added}`] = value;
+      added++;
+    }
+    result.GIT_CONFIG_COUNT = String(offset + added);
+  }
+  return result;
+}
+function sessionGitEnvironment(env) {
+  return Object.fromEntries(Object.entries(env).filter(([name]) => /^GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL)$|^GIT_CONFIG_(COUNT|KEY_\d+|VALUE_\d+)$/.test(name)));
+}
+var COMMAND_TIMEOUT_MS = 2 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 30 * 60 * 1e3;
+var LS_REMOTE_TIMEOUT_MS = 15e3;
+var KEPT_BUILD_CACHES = ["node_modules", "bin", "obj", ".nuget", ".gradle", "target", "dist"];
+function withoutUserinfo(text) {
+  return text.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^/@\s]*@/gi, "$1");
+}
+function shortGitError(result, timeoutMs) {
+  if (result.timedOut) return timeoutMs ? `git did not answer within ${Math.round(timeoutMs / 1e3)}s` : "git did not answer in time";
+  const lines = result.stderr.split("\n").map((line2) => line2.trim()).filter(Boolean);
+  const line = [...lines].reverse().find((candidate) => /^(fatal|error):/i.test(candidate)) ?? lines.at(-1) ?? `git exited with ${result.code}`;
+  const clean = redactCredentials(withoutUserinfo(line)).replace(/^(fatal|error):\s*/i, "");
+  return clean.length > 300 ? `${clean.slice(0, 297)}\u2026` : clean;
+}
+var PrepareError = class extends Error {
+};
+var PrepareAborted = class extends Error {
+};
+var repoLocks = /* @__PURE__ */ new Map();
+async function withRepoLock(key, work) {
+  const before = repoLocks.get(key) ?? Promise.resolve();
+  const current = before.catch(() => void 0).then(work);
+  const settled = current.catch(() => void 0);
+  repoLocks.set(key, settled);
+  try {
+    return await current;
+  } finally {
+    if (repoLocks.get(key) === settled) repoLocks.delete(key);
+  }
+}
+var RepoPreparer = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  /**
+   * Whether this machine's git reaches every repository (`git ls-remote` of its task and default branches), within
+   * `withinMs` at most; undefined when it does, else a sentence for a person naming the first that it does not.
+   */
+  async checkAccess(repos, withinMs) {
+    const timeoutMs = Math.max(1e3, Math.min(LS_REMOTE_TIMEOUT_MS, withinMs));
+    const answers = await Promise.all(repos.map(async (repo) => {
+      const result = await this.options.git(["ls-remote", "--quiet", repo.cloneUrl, `refs/heads/${repo.taskBranch}`, `refs/heads/${repo.defaultBranch}`], { timeoutMs });
+      return result.code === 0 ? void 0 : `This Mac cannot reach the repository ${repo.name} (${withoutUserinfo(repo.cloneUrl)}) with its git: ${shortGitError(result, timeoutMs)}`;
+    }));
+    return answers.find((answer) => answer !== void 0);
+  }
+  /** Each repository's worktree under `<agentDirectory>/repos/`, on its task branch. Throws PrepareError, or PrepareAborted. */
+  async prepare(agentDirectory, repos, options = {}) {
+    for (const repo of repos) {
+      const cache = path22.join(this.options.cacheDirectory, `${repo.repoId}.git`);
+      await withRepoLock(cache, () => new RepoWork(this.options, repo, cache, path22.join(agentDirectory, "repos", repo.name), options).run());
+    }
+  }
+};
+var RepoWork = class {
+  constructor(options, repo, cache, worktree, prepare) {
+    this.options = options;
+    this.repo = repo;
+    this.cache = cache;
+    this.worktree = worktree;
+    this.prepare = prepare;
+  }
+  options;
+  repo;
+  cache;
+  worktree;
+  prepare;
+  async run() {
+    await this.updateCache();
+    const start = await this.startPoint();
+    const state = this.worktreeState(await this.commonDirectory());
+    if (state !== "ours") {
+      if (state === "other") {
+        this.options.log.warn(`${this.repo.name}: ${this.worktree} is not a worktree of the repository's cache; it is made again`);
+        fs15.rmSync(this.worktree, { recursive: true, force: true });
+      }
+      fs15.mkdirSync(path22.dirname(this.worktree), { recursive: true, mode: 448 });
+      await this.git(["worktree", "prune"], "the cache's worktrees could not be pruned", { cwd: this.cache });
+      await this.git(["worktree", "add", "--quiet", "-B", this.repo.taskBranch, this.worktree, start.ref], `the worktree could not be made on ${this.repo.taskBranch}`, { cwd: this.cache });
+      if (start.local) await this.fastForward();
+    } else {
+      const current = (await this.exec(["symbolic-ref", "--quiet", "--short", "HEAD"], { cwd: this.worktree })).stdout.trim();
+      if (current !== this.repo.taskBranch) {
+        await this.git(["reset", "--hard", "--quiet"], "the worktree could not be reset", { cwd: this.worktree });
+        await this.git(["clean", "-f", "-d", "-x", "-q", ...KEPT_BUILD_CACHES.flatMap((name) => ["-e", name])], "the worktree could not be cleaned", { cwd: this.worktree });
+        await this.git(["checkout", "--quiet", "-B", this.repo.taskBranch, start.ref], `the worktree could not be switched to ${this.repo.taskBranch}`, { cwd: this.worktree });
+        if (start.local) await this.fastForward();
+      } else {
+        await this.fastForward();
+      }
+    }
+    if (this.repo.holdingRef) await this.mergeHoldingRef(this.repo.holdingRef);
+  }
+  /**
+   * The cache made (a bare repository with origin's branches under refs/remotes/origin, the layout `git clone --bare`
+   * would give with that refspec, minus local copies of every branch) or brought up to date. The fetch prunes only
+   * refs/remotes/origin: a local branch is never pruned, so work pushed to a holding ref and never to its feature
+   * branch keeps its local branch.
+   */
+  async updateCache() {
+    if (!fs15.existsSync(path22.join(this.cache, "HEAD"))) {
+      ensurePrivateDirectory(path22.dirname(this.cache));
+      const making = `${this.cache}.${process.pid}.${randomBytes8(4).toString("hex")}.tmp`;
+      try {
+        await this.git(["init", "--bare", "--quiet", making], "the repository's cache could not be made");
+        await this.git(["remote", "add", "origin", this.repo.cloneUrl], "the repository's cache could not be made", { cwd: making });
+        await this.fetch(making);
+        fs15.renameSync(making, this.cache);
+      } finally {
+        fs15.rmSync(making, { recursive: true, force: true });
+      }
+      return;
+    }
+    await this.git(["config", "remote.origin.url", this.repo.cloneUrl], "the repository's cache could not be set up", { cwd: this.cache });
+    await this.git(["config", "--replace-all", "remote.origin.fetch", "+refs/heads/*:refs/remotes/origin/*"], "the repository's cache could not be set up", { cwd: this.cache });
+    await this.fetch(this.cache);
+  }
+  async fetch(directory) {
+    await this.git(["fetch", "--prune", "--quiet", "origin"], "fetching from origin failed", { cwd: directory, timeoutMs: FETCH_TIMEOUT_MS });
+  }
+  /** Where the task branch starts: the machine's own branch, else origin's, else the planned base commit. */
+  async startPoint() {
+    const branch = this.repo.taskBranch;
+    if (await this.exists(`refs/heads/${branch}`)) return { ref: branch, local: true };
+    if (await this.exists(`refs/remotes/origin/${branch}`)) return { ref: `refs/remotes/origin/${branch}`, local: false };
+    if (!await this.exists(this.repo.baseSha)) {
+      await this.exec(["fetch", "--quiet", "origin", this.repo.baseSha], { cwd: this.cache, timeoutMs: FETCH_TIMEOUT_MS });
+      if (!await this.exists(this.repo.baseSha)) throw this.failure(`its base commit ${this.repo.baseSha.slice(0, 12)} is not in the repository`);
+    }
+    return { ref: this.repo.baseSha, local: false };
+  }
+  async exists(ref) {
+    return (await this.exec(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], { cwd: this.cache })).code === 0;
+  }
+  /** The repository the directory at the worktree's path belongs to, when it is a worktree at all. */
+  async commonDirectory() {
+    if (!fs15.existsSync(path22.join(this.worktree, ".git"))) return void 0;
+    const result = await this.exec(["rev-parse", "--git-common-dir"], { cwd: this.worktree });
+    return result.code === 0 && result.stdout.trim() ? path22.resolve(this.worktree, result.stdout.trim()) : void 0;
+  }
+  worktreeState(common) {
+    if (!fs15.existsSync(this.worktree)) return "missing";
+    if (!common) return "other";
+    try {
+      return fs15.realpathSync(common) === fs15.realpathSync(this.cache) ? "ours" : "other";
+    } catch {
+      return "other";
+    }
+  }
+  /** The task branch brought up to origin's, only when it has no commit origin lacks: unpushed work is never dropped. */
+  async fastForward() {
+    const remote = `refs/remotes/origin/${this.repo.taskBranch}`;
+    if (!await this.exists(remote)) return;
+    const behind = await this.exec(["merge-base", "--is-ancestor", "HEAD", remote], { cwd: this.worktree });
+    if (behind.code === 1) {
+      this.options.log.info(`${this.repo.name}: ${this.repo.taskBranch} has commits origin does not; left as it is`);
+      return;
+    }
+    if (behind.code !== 0) throw this.failure(`its branch could not be compared with origin's: ${shortGitError(behind)}`);
+    const merged = await this.exec(["merge", "--ff-only", "--quiet", remote], { cwd: this.worktree });
+    if (merged.code !== 0) this.options.log.warn(`${this.repo.name}: ${this.repo.taskBranch} could not be brought up to origin's (${shortGitError(merged)}); left as it is`);
+  }
+  /** The holding ref's work brought into the task branch: a fast-forward when it can be, else a merge; a conflict fails. */
+  async mergeHoldingRef(ref) {
+    await this.git(["fetch", "--quiet", "origin", ref], `the holding ref ${ref} could not be fetched`, { cwd: this.worktree, timeoutMs: FETCH_TIMEOUT_MS });
+    if ((await this.exec(["merge-base", "--is-ancestor", "FETCH_HEAD", "HEAD"], { cwd: this.worktree })).code === 0) return;
+    if ((await this.exec(["merge", "--ff-only", "--quiet", "FETCH_HEAD"], { cwd: this.worktree })).code === 0) return;
+    const merged = await this.exec(["-c", "commit.gpgsign=false", "merge", "--no-edit", "--quiet", "FETCH_HEAD"], { cwd: this.worktree });
+    if (merged.code === 0) return;
+    await this.exec(["merge", "--abort"], { cwd: this.worktree });
+    throw this.failure(`the holding ref ${ref} does not merge into ${this.repo.taskBranch}: ${shortGitError(merged)}`);
+  }
+  failure(what) {
+    return new PrepareError(`${this.repo.name}: ${what}`);
+  }
+  /** git, failing the preparation with `what` and git's own words when it fails. */
+  async git(args, what, options = {}) {
+    const result = await this.exec(args, options);
+    if (result.code !== 0) throw this.failure(`${what}: ${shortGitError(result, options.timeoutMs ?? COMMAND_TIMEOUT_MS)}`);
+    return result;
+  }
+  async exec(args, options = {}) {
+    if (this.prepare.signal?.aborted) throw new PrepareAborted("stopped");
+    let result;
+    try {
+      result = await this.options.git(args, { ...options, env: { ...this.prepare.gitEnvironment, ...options.env }, signal: this.prepare.signal });
+    } catch (error) {
+      throw this.failure(`git could not be run: ${describeError(error)}`);
+    }
+    if (result.aborted) throw new PrepareAborted("stopped");
+    return result;
+  }
+};
+
+// src/runner/prune.ts
+var PRUNE_AFTER_MS = 14 * 24 * 60 * 60 * 1e3;
+async function pruneCommand(args, io, environment = {}) {
+  parseArgs4({ args, options: {}, strict: true, allowPositionals: false });
+  const env = environment.env ?? process.env;
+  const home = runnerHome(env);
+  const darwin = (environment.platform ?? process.platform) === "darwin";
+  const busy = await runningSessions(home, environment.launchAgent ?? (darwin ? new LaunchAgent() : void 0));
+  if (busy.count > 0) {
+    io.err(`Not pruned: Codesona Runner is running ${busy.count === 1 ? "a session" : `${busy.count} sessions`}. Run codesona-runner prune again once it is idle (codesona-runner status shows its sessions).`);
+    return ExitCode.Failed;
+  }
+  const report = await pruneRepositories(runnerFiles(home), environment.git ?? gitWith(env), (environment.now ?? Date.now)());
+  for (const worktree of report.removedWorktrees) io.out(`removed ${worktree}`);
+  for (const branch of report.deletedBranches) io.out(`deleted branch ${branch}`);
+  for (const sentence of report.kept) io.out(`kept ${sentence}`);
+  if (report.removedWorktrees.length === 0 && report.deletedBranches.length === 0) io.out("Nothing to prune.");
+  return ExitCode.Ok;
+}
+async function pruneRepositories(files, git, now, olderThanMs = PRUNE_AFTER_MS) {
+  const report = { removedWorktrees: [], deletedBranches: [], kept: [] };
+  let caches;
+  try {
+    caches = fs16.readdirSync(files.repos).filter((name) => name.endsWith(".git")).map((name) => path23.join(files.repos, name));
+  } catch {
+    return report;
+  }
+  for (const cache of caches) await pruneRepository(cache, git, now - olderThanMs, report);
+  return report;
+}
+async function pruneRepository(cache, git, before, report) {
+  const name = path23.basename(cache, ".git");
+  const fetched = await git(["fetch", "--prune", "--quiet", "origin"], { cwd: cache, timeoutMs: 5 * 60 * 1e3 });
+  if (fetched.code !== 0) {
+    report.kept.push(`everything of ${name}: origin could not be asked (${shortGitError(fetched)})`);
+    return;
+  }
+  await git(["worktree", "prune"], { cwd: cache });
+  const onOrigin = async (branch) => (await git(["merge-base", "--is-ancestor", `refs/heads/${branch}`, `refs/remotes/origin/${branch}`], { cwd: cache })).code === 0;
+  const worktrees = await listWorktrees(cache, git);
+  const checkedOut = /* @__PURE__ */ new Set();
+  for (const worktree of worktrees) {
+    if (!worktree.branch) continue;
+    checkedOut.add(worktree.branch);
+    if (lastTouched(worktree.path) > before) continue;
+    const status = await git(["status", "--porcelain"], { cwd: worktree.path });
+    if (status.code !== 0 || status.stdout.trim()) {
+      report.kept.push(`${worktree.path}: it has changes that were never committed`);
+      continue;
+    }
+    if (!await onOrigin(worktree.branch)) {
+      report.kept.push(`${worktree.path}: ${worktree.branch} has commits origin does not`);
+      continue;
+    }
+    if ((await git(["worktree", "remove", "--force", worktree.path], { cwd: cache })).code !== 0) continue;
+    report.removedWorktrees.push(worktree.path);
+    checkedOut.delete(worktree.branch);
+  }
+  const refs = await git(["for-each-ref", "--format=%(refname:short)%09%(committerdate:unix)", "refs/heads"], { cwd: cache });
+  for (const line of refs.code === 0 ? refs.stdout.split("\n").filter(Boolean) : []) {
+    const [branch = "", committed = "0"] = line.split("	");
+    if (!branch || checkedOut.has(branch) || Number(committed) * 1e3 > before) continue;
+    if (!await onOrigin(branch)) {
+      report.kept.push(`branch ${branch} of ${name}: it has commits origin does not`);
+      continue;
+    }
+    if ((await git(["branch", "-D", "--quiet", branch], { cwd: cache })).code === 0) report.deletedBranches.push(`${branch} (${name})`);
+  }
+}
+async function listWorktrees(cache, git) {
+  const listed = await git(["worktree", "list", "--porcelain"], { cwd: cache });
+  if (listed.code !== 0) return [];
+  const entries = [];
+  for (const block of listed.stdout.split("\n\n")) {
+    const lines = block.split("\n");
+    const at = lines.find((line) => line.startsWith("worktree "))?.slice("worktree ".length);
+    if (!at || lines.includes("bare")) continue;
+    const branch = lines.find((line) => line.startsWith("branch refs/heads/"))?.slice("branch refs/heads/".length);
+    entries.push({ path: at, branch });
+  }
+  return entries;
+}
+function lastTouched(worktree) {
+  let gitDirectory;
+  try {
+    const pointer = /^gitdir:\s*(.+)$/m.exec(fs16.readFileSync(path23.join(worktree, ".git"), "utf8"))?.[1]?.trim();
+    if (pointer) gitDirectory = path23.resolve(worktree, pointer);
+  } catch {
+  }
+  const candidates = [worktree, ...gitDirectory ? ["index", "HEAD", path23.join("logs", "HEAD")].map((file) => path23.join(gitDirectory, file)) : []];
+  let latest = 0;
+  for (const file of candidates) {
+    try {
+      latest = Math.max(latest, fs16.statSync(file).mtimeMs);
+    } catch {
+    }
+  }
+  return latest;
+}
+
+// src/runner/restart.ts
+import { parseArgs as parseArgs5 } from "node:util";
 async function restartCommand(args, io, environment = {}) {
-  const { values } = parseArgs4({ args, options: { force: { type: "boolean" } }, strict: true, allowPositionals: false });
+  const { values } = parseArgs5({ args, options: { force: { type: "boolean" } }, strict: true, allowPositionals: false });
   const byHand = "A Runner run by hand (codesona-runner run) is restarted by stopping it (Ctrl-C) and running it again.";
   if ((environment.platform ?? process.platform) !== "darwin") {
     io.err(`codesona-runner restart restarts the background service, which Codesona Runner sets up on macOS only. ${byHand}`);
@@ -16750,11 +17263,11 @@ async function restartCommand(args, io, environment = {}) {
 }
 
 // src/runner/run.ts
-import { parseArgs as parseArgs5 } from "node:util";
+import { parseArgs as parseArgs6 } from "node:util";
 
 // src/runner/logfile.ts
-import fs14 from "node:fs";
-import path21 from "node:path";
+import fs17 from "node:fs";
+import path24 from "node:path";
 var LOG_MAX_BYTES = 10 * 1024 * 1024;
 var RotatingLogFile = class {
   constructor(file, maxBytes = LOG_MAX_BYTES) {
@@ -16772,36 +17285,36 @@ var RotatingLogFile = class {
       const bytes = Buffer.byteLength(data);
       if (this.fd === void 0) this.open();
       if (this.size > 0 && this.size + bytes > this.maxBytes) this.turnOver();
-      fs14.writeSync(this.fd, data);
+      fs17.writeSync(this.fd, data);
       this.size += bytes;
     } catch {
     }
   }
   close() {
-    if (this.fd !== void 0) fs14.closeSync(this.fd);
+    if (this.fd !== void 0) fs17.closeSync(this.fd);
     this.fd = void 0;
   }
   open() {
-    ensurePrivateDirectory(path21.dirname(this.file));
-    this.fd = fs14.openSync(this.file, "a", 384);
-    this.size = fs14.fstatSync(this.fd).size;
+    ensurePrivateDirectory(path24.dirname(this.file));
+    this.fd = fs17.openSync(this.file, "a", 384);
+    this.size = fs17.fstatSync(this.fd).size;
   }
   turnOver() {
     this.close();
-    fs14.renameSync(this.file, `${this.file}.1`);
+    fs17.renameSync(this.file, `${this.file}.1`);
     this.open();
   }
 };
 function trimFile(file, maxBytes = LOG_MAX_BYTES) {
   try {
-    if (fs14.statSync(file).size > maxBytes) fs14.truncateSync(file, 0);
+    if (fs17.statSync(file).size > maxBytes) fs17.truncateSync(file, 0);
   } catch {
   }
 }
 
 // src/runner/events.ts
-import fs15 from "node:fs";
-import path22 from "node:path";
+import fs18 from "node:fs";
+import path25 from "node:path";
 var MAX_TEXT = 2 * 1024;
 var MAX_BATCH_EVENTS = 32;
 var MAX_BATCH_BYTES = 24 * 1024;
@@ -16892,7 +17405,7 @@ var ActivityChannel = class {
     }
     try {
       ensurePrivateDirectory(this.options.spoolDirectory);
-      fs15.appendFileSync(path22.join(this.options.spoolDirectory, `${safeFileStem(runId)}.ndjson`), lines, { mode: 384 });
+      fs18.appendFileSync(path25.join(this.options.spoolDirectory, `${safeFileStem(runId)}.ndjson`), lines, { mode: 384 });
       this.spooled += bytes;
     } catch (error) {
       this.options.log.warn(`Run ${runId}: activity could not be spooled (${describeError(error)})`);
@@ -16909,7 +17422,7 @@ var ActivityChannel = class {
   async replayFiles() {
     for (const name of listSpool(this.options.spoolDirectory)) {
       if (!this.online) return;
-      const file = path22.join(this.options.spoolDirectory, name);
+      const file = path25.join(this.options.spoolDirectory, name);
       const runId = name.slice(0, -".ndjson".length);
       let events;
       try {
@@ -16926,7 +17439,7 @@ var ActivityChannel = class {
         }
       }
       if (!sentAll) return;
-      fs15.rmSync(file, { force: true });
+      fs18.rmSync(file, { force: true });
     }
     this.spooled = spoolSize(this.options.spoolDirectory);
     this.droppedReported = false;
@@ -16954,7 +17467,7 @@ function batchBytes(events) {
 }
 function listSpool(directory) {
   try {
-    return fs15.readdirSync(directory).filter((name) => name.endsWith(".ndjson")).sort();
+    return fs18.readdirSync(directory).filter((name) => name.endsWith(".ndjson")).sort();
   } catch {
     return [];
   }
@@ -16962,7 +17475,7 @@ function listSpool(directory) {
 function spoolSize(directory) {
   return listSpool(directory).reduce((total, name) => {
     try {
-      return total + fs15.statSync(path22.join(directory, name)).size;
+      return total + fs18.statSync(path25.join(directory, name)).size;
     } catch {
       return total;
     }
@@ -16970,7 +17483,7 @@ function spoolSize(directory) {
 }
 function readSpool(file) {
   const events = [];
-  for (const line of fs15.readFileSync(file, "utf8").split("\n")) {
+  for (const line of fs18.readFileSync(file, "utf8").split("\n")) {
     if (!line) continue;
     try {
       events.push(JSON.parse(line));
@@ -20029,7 +20542,7 @@ var HubClient = class {
     }
     this.stateValue = HubState.Connected;
     this.lastError = void 0;
-    this.factsTold = { connection, facts: { harnesses: hello.harnesses, sleepPrevented: hello.sleepPrevented } };
+    this.factsTold = { connection, facts: { harnesses: hello.harnesses, sleepPrevented: hello.sleepPrevented, tools: hello.tools } };
     this.options.log.info(`Connected to Codesona as ${reply.machineName ?? reply.machineId} (${reply.agents?.length ?? 0} agent(s) bound)`);
     await this.accept(connection, reply, credential);
     const error = await closed;
@@ -20188,7 +20701,8 @@ var HubClient = class {
     });
     return {
       ...sameHarnesses(harnesses, told.facts.harnesses) ? {} : { harnesses },
-      ...now.sleepPrevented == null || now.sleepPrevented === told.facts.sleepPrevented ? {} : { sleepPrevented: now.sleepPrevented }
+      ...now.sleepPrevented == null || now.sleepPrevented === told.facts.sleepPrevented ? {} : { sleepPrevented: now.sleepPrevented },
+      ...now.tools == null || JSON.stringify(now.tools) === JSON.stringify(told.facts.tools ?? null) ? {} : { tools: now.tools }
     };
   }
   scheduleRenewal(credential) {
@@ -20296,11 +20810,11 @@ var SignalRLog = class {
 };
 
 // src/runner/leftovers.ts
-import { execFile as execFile2 } from "node:child_process";
-import fs16 from "node:fs";
-import path23 from "node:path";
+import { execFile as execFile3 } from "node:child_process";
+import fs19 from "node:fs";
+import path26 from "node:path";
 var listProcesses = () => new Promise((resolve4) => {
-  execFile2("ps", ["-axww", "-o", "pid=,ppid=,pgid=,command="], { timeout: 5e3, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => {
+  execFile3("ps", ["-axww", "-o", "pid=,ppid=,pgid=,command="], { timeout: 5e3, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => {
     if (error) {
       resolve4([]);
       return;
@@ -20335,7 +20849,7 @@ var LiveRuns = class {
   /** Never throws: it is called on the way out of a run, and a run that does not get out holds the service's stop. */
   remove(runId) {
     try {
-      fs16.rmSync(this.file(runId), { force: true });
+      fs19.rmSync(this.file(runId), { force: true });
     } catch (error) {
       this.log.warn(`Run ${runId}: its state file could not be removed (${describeError(error)})`);
     }
@@ -20351,11 +20865,11 @@ var LiveRuns = class {
     const records = [];
     for (const name of listJsonFiles(this.directory)) {
       try {
-        const record6 = readJsonFile(path23.join(this.directory, name));
+        const record6 = readJsonFile(path26.join(this.directory, name));
         if (record6?.runId) records.push(record6);
       } catch {
       }
-      fs16.rmSync(path23.join(this.directory, name), { force: true });
+      fs19.rmSync(path26.join(this.directory, name), { force: true });
     }
     const withGroups = records.filter((record6) => Number.isSafeInteger(record6.processGroup) && record6.processGroup > 1);
     if (withGroups.length === 0) return 0;
@@ -20378,13 +20892,13 @@ var LiveRuns = class {
     }
   }
   file(runId) {
-    return path23.join(this.directory, `${safeFileStem(runId)}.json`);
+    return path26.join(this.directory, `${safeFileStem(runId)}.json`);
   }
 };
 
 // src/runner/outbox.ts
-import fs17 from "node:fs";
-import path24 from "node:path";
+import fs20 from "node:fs";
+import path27 from "node:path";
 var OUTBOX_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
 var END_BODY_MAX_BYTES = 1024 * 1024;
 var END_BODY_RETRY_BYTES = 64 * 1024;
@@ -20446,26 +20960,26 @@ var Outbox = class {
   list(log) {
     const entries = [];
     for (const name of listJsonFiles(this.directory)) {
-      const file = path24.join(this.directory, name);
+      const file = path27.join(this.directory, name);
       try {
         const entry = readJsonFile(file);
         if (!entry?.end?.runId) throw new Error("no run id");
         entries.push({ end: entry.end, recordedAt: Date.parse(entry.recordedAt) || 0 });
       } catch (error) {
         log.error(`Outbox entry ${name} cannot be read (${describeError(error)}); moved aside`);
-        fs17.renameSync(file, `${file}.unreadable`);
+        fs20.renameSync(file, `${file}.unreadable`);
       }
     }
     return entries.sort((a, b) => a.recordedAt - b.recordedAt);
   }
   has(runId) {
-    return fs17.existsSync(this.file(runId));
+    return fs20.existsSync(this.file(runId));
   }
   remove(runId) {
-    fs17.rmSync(this.file(runId), { force: true });
+    fs20.rmSync(this.file(runId), { force: true });
   }
   file(runId) {
-    return path24.join(this.directory, `${safeFileStem(runId)}.json`);
+    return path27.join(this.directory, `${safeFileStem(runId)}.json`);
   }
 };
 function deliveryOutcomeOf(result) {
@@ -20598,8 +21112,8 @@ var EndReporter = class {
 };
 
 // src/runner/supervisor.ts
-import fs18 from "node:fs";
-import path25 from "node:path";
+import fs21 from "node:fs";
+import path28 from "node:path";
 
 // src/harness/claude-result.ts
 var ZERO_USAGE = { costUsd: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0 };
@@ -20856,6 +21370,7 @@ var Supervisor = class {
   constructor(options) {
     this.options = options;
     this.hubWatchdog = new HubWatchdog(() => this.hubLost(), options.hubOfflineLimitMs, options.clock);
+    this.repos = options.repos ?? new RepoPreparer({ cacheDirectory: options.files.repos, git: gitWith(process.env), log: options.log });
   }
   options;
   sessions = /* @__PURE__ */ new Map();
@@ -20867,6 +21382,7 @@ var Supervisor = class {
   machinePaused = false;
   updateRequired = false;
   shuttingDown = false;
+  repos;
   // ── What the hub says ──
   /** The machine's bindings, from Hello or AgentsChanged. Attachment is kept for an agent the hub still lists. */
   setAgents(assignments) {
@@ -20946,6 +21462,11 @@ var Supervisor = class {
     if (harness) return this.refuse(runId, harness.reason, harness.detail);
     const bundle = await this.readBundle(runId, Math.max(0, deadline - Date.now()));
     if ("reason" in bundle) return this.refuse(runId, bundle.reason, bundle.detail);
+    const repos = bundle.bundle.prepare?.repos ?? [];
+    if (repos.length > 0) {
+      const unreachable = await this.repoRefusal(repos, Math.max(0, deadline - Date.now()));
+      if (unreachable) return this.refuse(runId, StartRefusal.RepoUnavailable, unreachable);
+    }
     const refusal = this.stateRefusal(message);
     if (refusal) return this.refuse(runId, refusal);
     const session = new RunSession(this, message);
@@ -21013,6 +21534,14 @@ var Supervisor = class {
     });
     return Promise.race([reading, late]).finally(() => clearTimeout(timer));
   }
+  /** A sentence naming a repository this machine's git cannot reach, within `withinMs`; undefined when it reaches them all. */
+  async repoRefusal(repos, withinMs) {
+    try {
+      return await this.repos.checkAccess(repos, withinMs);
+    } catch (error) {
+      return `This Mac could not check its access to the run's repositories: ${describeError(error)}`;
+    }
+  }
   stopSession(message, why = "Codesona stopped the run") {
     const session = this.sessions.get(message?.runId);
     if (!session) return { known: this.ended.has(message?.runId) };
@@ -21128,6 +21657,8 @@ var RunSession = class {
   turnEnded;
   cwd;
   over = false;
+  /** Stops the git that prepares the run's repositories, when the run is stopped before its session opens. */
+  preparing = new AbortController();
   done;
   resolveDone;
   get options() {
@@ -21154,6 +21685,7 @@ var RunSession = class {
     if (this.stop) return;
     this.stop = stop;
     this.options.log.info(`Run ${this.runId}: stopping (${why})`);
+    this.preparing.abort();
     void this.stopDriver();
   }
   async reportStarted() {
@@ -21182,7 +21714,7 @@ var RunSession = class {
   async execute(bundle) {
     if (this.stop) return this.stoppedBeforeStart();
     const route = this.options.proxy.register(this.runId, this.ticket, (refusal) => this.requestStop(gatewayStop(refusal), `the gateway answered ${refusal}`));
-    const cwd = path25.join(this.options.files.agents, safeFileStem(this.agentId));
+    const cwd = path28.join(this.options.files.agents, safeFileStem(this.agentId));
     this.cwd = cwd;
     let workspace;
     try {
@@ -21190,6 +21722,18 @@ var RunSession = class {
     } catch (error) {
       return this.endOf({ launchError: `The session's files could not be written: ${describeError(error)}` });
     }
+    const repos = bundle.bundle.prepare?.repos ?? [];
+    if (repos.length > 0) {
+      try {
+        await this.supervisor.repos.prepare(cwd, repos, { signal: this.preparing.signal, gitEnvironment: sessionGitEnvironment(bundle.bundle.env) });
+        this.options.log.info(`Run ${this.runId}: ${repos.length} repositor${repos.length === 1 ? "y" : "ies"} prepared under ${path28.join(cwd, "repos")}`);
+      } catch (error) {
+        if (this.stop || error instanceof PrepareAborted) return this.stoppedBeforeStart();
+        const why = error instanceof PrepareError ? error.message : `git failed: ${describeError(error)}`;
+        return this.endOf({ launchError: `The repositories could not be prepared: ${why}`, launchErrorKind: LaunchErrorKind.PrepareFailed });
+      }
+      if (this.stop) return this.stoppedBeforeStart();
+    }
     let resume = bundle.resume && this.transcriptExists(cwd, bundle.sessionId);
     if (bundle.resume && !resume) this.options.log.info(`Run ${this.runId}: no transcript of session ${bundle.sessionId} on this machine; starting it as a new conversation`);
     this.options.liveRuns.record({
@@ -21216,10 +21760,10 @@ var RunSession = class {
   transcriptExists(cwd, sessionId) {
     const candidates = /* @__PURE__ */ new Set([cwd]);
     try {
-      candidates.add(fs18.realpathSync(cwd));
+      candidates.add(fs21.realpathSync(cwd));
     } catch {
     }
-    return [...candidates].some((directory) => fs18.existsSync(claudeTranscriptPath(this.options.claudeConfigDir, directory, sessionId)));
+    return [...candidates].some((directory) => fs21.existsSync(claudeTranscriptPath(this.options.claudeConfigDir, directory, sessionId)));
   }
   async attempt(number3, bundle, workspace, resume) {
     const reader = new ClaudeResultReader();
@@ -21430,6 +21974,7 @@ var RunSession = class {
       harnessSessionId: this.harnessSessionId ?? null,
       stopReason: parts.stopReason ?? null,
       launchError: parts.launchError ?? null,
+      launchErrorKind: parts.launchError ? parts.launchErrorKind ?? null : null,
       result
     };
   }
@@ -21448,7 +21993,7 @@ function sleep2(ms) {
 }
 
 // src/runner/usage.ts
-import path26 from "node:path";
+import path29 from "node:path";
 var SessionUsageLedger = class {
   constructor(directory, log) {
     this.directory = directory;
@@ -21480,7 +22025,7 @@ var SessionUsageLedger = class {
 `);
   }
   file(sessionId) {
-    return path26.join(this.directory, `${safeFileStem(sessionId)}.json`);
+    return path29.join(this.directory, `${safeFileStem(sessionId)}.json`);
   }
 };
 function number2(value) {
@@ -21519,7 +22064,8 @@ function sleep3(ms) {
 function setupFacts(harnesses, setup) {
   return {
     harnesses: harnesses.map((found) => found.harness === Harness.ClaudeCode && setup.claudeLogin ? { ...found, loggedIn: setup.claudeLogin.loggedIn } : found),
-    ...setup.sleepPrevented === void 0 ? {} : { sleepPrevented: setup.sleepPrevented }
+    ...setup.sleepPrevented === void 0 ? {} : { sleepPrevented: setup.sleepPrevented },
+    ...setup.tools === void 0 ? {} : { tools: setup.tools }
   };
 }
 function until(work, deadline) {
@@ -21570,6 +22116,8 @@ var RunnerService = class _RunnerService {
     this.supervisor = new Supervisor({
       files: this.files,
       host,
+      // The owner's git, with their credential helper: the sessions' environment, as the session's own git has it.
+      repos: new RepoPreparer({ cacheDirectory: this.files.repos, git: gitWith(options.environment ?? process.env), log }),
       sdk: createHarnessSdk(host),
       proxy: this.proxy,
       fetchBundle: async (runId) => {
@@ -21850,8 +22398,9 @@ var RunnerService = class _RunnerService {
     }
   }
   /**
-   * Claude Code's login, as the sessions' environment runs `claude auth status` (the CLI the sessions run), and `pmset -g`;
-   * looked at again after ten minutes, as the CLIs are. Neither holds Hello up for long, and neither fails it.
+   * Claude Code's login, as the sessions' environment runs `claude auth status` (the CLI the sessions run), `pmset -g`, and
+   * `git --version`, `dotnet --list-sdks` and `node --version` in that environment; looked at again after ten minutes, as
+   * the CLIs are. Neither holds Hello up for long, and neither fails it.
    */
   machineSetup() {
     if (this.setup && Date.now() - this.setup.at < this.factsTtlMs) return Promise.resolve(this.setup.value);
@@ -21861,11 +22410,12 @@ var RunnerService = class _RunnerService {
   async lookAtSetup() {
     const environment = this.options.environment ?? process.env;
     const login = this.options.claudeLogin ?? (() => readClaudeLogin((file, args) => runCommand(file, args, { env: agentEnvironment(environment), timeoutMs: CLAUDE_LOGIN_TIMEOUT_MS }), this.options.claudeCommand));
-    const [claudeLogin, power] = await Promise.all([
+    const [claudeLogin, power, tools] = await Promise.all([
       login().catch(() => void 0),
-      (this.options.powerSettings ?? (() => readPowerSettings()))().catch(() => void 0)
+      (this.options.powerSettings ?? (() => readPowerSettings()))().catch(() => void 0),
+      (this.options.machineTools ?? (() => readMachineTools(environment)))().catch(() => void 0)
     ]);
-    const value = { claudeLogin, sleepPrevented: power === void 0 ? void 0 : sleepPrevented(power) };
+    const value = { claudeLogin, sleepPrevented: power === void 0 ? void 0 : sleepPrevented(power), tools };
     this.setup = { at: Date.now(), value };
     return value;
   }
@@ -21929,7 +22479,7 @@ var RunnerService = class _RunnerService {
 
 // src/runner/run.ts
 async function runCommand2(args, io, env = process.env) {
-  const { values } = parseArgs5({ args, options: { verbose: { type: "boolean" }, service: { type: "boolean" } }, strict: true, allowPositionals: false });
+  const { values } = parseArgs6({ args, options: { verbose: { type: "boolean" }, service: { type: "boolean" } }, strict: true, allowPositionals: false });
   const home = runnerHome(env);
   const asService = values.service === true;
   let logFile;
@@ -21977,7 +22527,7 @@ async function serve(home, io, log, asService) {
 
 // src/runner/start.ts
 import os7 from "node:os";
-import { parseArgs as parseArgs6 } from "node:util";
+import { parseArgs as parseArgs7 } from "node:util";
 
 // src/runner/pair.ts
 async function pairMachine(store, client, input) {
@@ -22064,7 +22614,7 @@ function machineKeyKind(key) {
   return KEY_PREFIXES[key.slice(0, 4)];
 }
 function parseStart(args) {
-  const { values } = parseArgs6({
+  const { values } = parseArgs7({
     args,
     options: {
       "machine-key": { type: "string" },
@@ -22176,6 +22726,7 @@ var Command = {
   Doctor: "doctor",
   Status: "status",
   Restart: "restart",
+  Prune: "prune",
   Logout: "logout"
 };
 var COMMANDS = {
@@ -22184,6 +22735,7 @@ var COMMANDS = {
   [Command.Doctor]: doctorCommand,
   [Command.Status]: statusCommand,
   [Command.Restart]: restartCommand,
+  [Command.Prune]: (args, io) => pruneCommand(args, io),
   [Command.Logout]: logoutCommand
 };
 var HELP = `Codesona Runner ${runnerVersion}
@@ -22202,6 +22754,9 @@ Commands:
                 restart the background service, so it connects anew and runs
                 the Codesona Runner installed now; not while it runs sessions
                 (--force: restart it all the same, ending them)
+  prune         remove the agents' repository worktrees and local task
+                branches untouched for 14 days that origin already has;
+                never unpushed work
   logout [--local]
                 disconnect this machine from Codesona and remove the service
                 (--local: remove this machine's side even if Codesona