@kitman-sh/cli 0.10.54 → 0.10.56

package/dist/{chunk-eerh2t20.js → chunk-7kernadf.js}

@@ -20,22 +20,22 @@ import {
 import {
   FileSystem,
   Path
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
   tomlTableHeader2,
   tomlKeyPath2,
   kitmanSkillEntry,
   isPathWithin2
-} from "./chunk-5y5axze6.js";
+} from "./chunk-s97jvqxb.js";
 import {
   instructionsStart,
   instructionsEnd,
   renderMcpServer,
   materializeKitSetup,
   tomlInline
-} from "./chunk-m32wb6t0.js";
-import"./chunk-twp7aprz.js";
-import"./chunk-mmetyep8.js";
+} from "./chunk-jb9dcsfn.js";
+import"./chunk-bdxhb63t.js";
+import"./chunk-kdyzndvx.js";
 
 // packages/agent-runtime/src/kit-setup-sync.ts
 class KitSyncError extends TaggedError("KitSyncError") {

package/dist/{chunk-19aqk325.js → chunk-99ver3za.js}

@@ -6,7 +6,7 @@ import {
   decideSecretRequest,
   readSecretRegistry,
   appendSecretRefusals
-} from "./chunk-3d6abgjh.js";
+} from "./chunk-g53wn1q8.js";
 
 // packages/agent-runtime/src/srt-step.ts
 import { SandboxRuntimeConfigSchema } from "@anthropic-ai/sandbox-runtime";

package/dist/{chunk-twp7aprz.js → chunk-bdxhb63t.js}

@@ -28,7 +28,7 @@ import {
 import {
   withDefault,
   String2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
   digestSha256,
   digestSha512,
@@ -36,9 +36,9 @@ import {
   schemaBodyJson,
   filterStatusOk,
   get2,
-  layer2,
+  layer4,
   KitDigest
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-jb9dcsfn.js";
 
 // packages/core/src/npm-registry.ts
 var KitManifest = Struct({
@@ -107,7 +107,7 @@ var npmRegistryAt = (url = registryUrl) => {
     message: `npm did not answer for ${name}@${version}: ${error.message}; try again`
   });
   const packument = (name, version) => gen(function* () {
-    const response = yield* get2(`${yield* base}/${name.replace("/", "%2F")}`).pipe(mapError2(unreachable(name, version)), provide3(layer2));
+    const response = yield* get2(`${yield* base}/${name.replace("/", "%2F")}`).pipe(mapError2(unreachable(name, version)), provide3(layer4));
     if (response.status === 404)
       return yield* new NpmRegistryError({ kind: "not_found", message: `npm has no package ${name}` });
     return yield* filterStatusOk(response).pipe(flatMap3(schemaBodyJson(Packument)), mapError2(unreachable(name, version)));
@@ -123,7 +123,7 @@ var npmRegistryAt = (url = registryUrl) => {
       const dist = found.versions[version]?.dist;
       if (dist === undefined)
         return yield* new NpmRegistryError({ kind: "not_found", message: `npm has no ${name}@${wanted}` });
-      const tarball = yield* get2(dist.tarball).pipe(flatMap3(filterStatusOk), flatMap3((response) => response.arrayBuffer), map8((buffer) => new Uint8Array(buffer)), mapError2(unreachable(name, version)), provide3(layer2));
+      const tarball = yield* get2(dist.tarball).pipe(flatMap3(filterStatusOk), flatMap3((response) => response.arrayBuffer), map8((buffer) => new Uint8Array(buffer)), mapError2(unreachable(name, version)), provide3(layer4));
       if (!tarballMatches(tarball, dist))
         return yield* new NpmRegistryError({
           kind: "integrity",

package/dist/{chunk-xgwjcq4z.js → chunk-emabyaj0.js}

@@ -3471,13 +3471,16 @@ var pinnedSrtCommand2 = () => compiled2 ? [process.execPath, "srt"] : [process.e
 var pinnedSrtStepCommand2 = () => compiled2 ? [process.execPath, "srt-step"] : [process.execPath, fileURLToPath(new URL("./srt-step.main.ts", import.meta.url))];
 var srtPackageDir = () => fileURLToPath(new URL("../", import.meta.resolve("@anthropic-ai/sandbox-runtime/dist/cli.js")));
 var runSrtCli2 = () => import("@anthropic-ai/sandbox-runtime/dist/cli.js");
+var kitmanCacheDirectory2 = gen(function* () {
+  const path = yield* Path;
+  const cacheHome = yield* String2("XDG_CACHE_HOME").pipe(withDefault(""));
+  return path.join(cacheHome === "" ? path.join(homedir(), ".cache") : cacheHome, "kitman");
+});
 var embeddedApplySeccomp = gen(function* () {
   const file = compiled2 && process.platform === "linux" ? embeddedFile(Bun.embeddedFiles, "apply-seccomp") : undefined;
   if (file === undefined)
     return;
-  const path = yield* Path;
-  const cacheHome = yield* String2("XDG_CACHE_HOME").pipe(withDefault(""));
-  return yield* extractEmbeddedFile(path.join(cacheHome === "" ? path.join(homedir(), ".cache") : cacheHome, "kitman"), file, "apply-seccomp");
+  return yield* extractEmbeddedFile(yield* kitmanCacheDirectory2, file, "apply-seccomp");
 }).pipe(orDie);
 var globCharacters = /[*?[\]{}]/;
 var readAllowEntry = (path) => globCharacters.test(path) ? { path, literal: true } : path;
@@ -3548,4 +3551,4 @@ var srtArgv2 = (srtCommand, settingsFile, argv) => [
   ...argv
 ];
 
-export { map, makeEquivalence, bytes, join, interrupt, getCurrent, BadArgument, systemError, badArgument, makeUnsafe2, make8, unbounded, publishUnsafe, make9, bounded, sliding, unbounded2, offer, offerUnsafe, offerAll, fail, failCause, failCauseUnsafe, end, endUnsafe, shutdownUnsafe, take, poll, makeUnsafe3, fromTransform, mapDone, isSink, fromChannel, drain, make10, get3, isStream, fromChannel2, callback, empty2, make11, suspend, fail2, fromQueue, fromPubSub, fromReadableStream, unwrap, map2, tap, drainFork, concat, merge2, filter, catchCause, tapError, mapError, transduce, decodeText, encodeText, splitLines, interruptWhen, ensuring, provideContext, run, runCollect, runFold, runHead, runForEach, runDrain, mkString, mkArrayBuffer, toReadableStreamEffect, FileSystem, make12, FileTypeId, WatchBackend, Path, make13, embeddedFile, extractEmbeddedFile, map3, all, withDefault, option, String2, optionalEnv, harnessesUnsupportedInSrt2, compiled2, pinnedSrtCommand2, pinnedSrtStepCommand2, runSrtCli2, srtSettings2, srtCacheEnvironment2, srtInheritedEnv2, inheritedEnvironment2, withOnlyEnvironment2, writeSrtSettings2, srtStepArgv2, srtArgv2 };
+export { map, makeEquivalence, bytes, join, interrupt, getCurrent, BadArgument, systemError, badArgument, makeUnsafe2, make8, unbounded, publishUnsafe, make9, bounded, sliding, unbounded2, offer, offerUnsafe, offerAll, fail, failCause, failCauseUnsafe, end, endUnsafe, shutdownUnsafe, take, poll, makeUnsafe3, fromTransform, mapDone, isSink, fromChannel, drain, make10, get3, isStream, fromChannel2, callback, empty2, make11, suspend, fail2, fromQueue, fromPubSub, fromReadableStream, unwrap, map2, tap, drainFork, concat, merge2, filter, catchCause, tapError, mapError, transduce, decodeText, encodeText, splitLines, interruptWhen, ensuring, provideContext, run, runCollect, runFold, runHead, runForEach, runDrain, mkString, mkArrayBuffer, toReadableStreamEffect, FileSystem, make12, FileTypeId, WatchBackend, Path, make13, embeddedFile, extractEmbeddedFile, map3, all, withDefault, option, String2, optionalEnv, harnessesUnsupportedInSrt2, compiled2, pinnedSrtCommand2, pinnedSrtStepCommand2, runSrtCli2, kitmanCacheDirectory2, srtSettings2, srtCacheEnvironment2, srtInheritedEnv2, inheritedEnvironment2, withOnlyEnvironment2, writeSrtSettings2, srtStepArgv2, srtArgv2 };

package/dist/{chunk-q0yna8sw.js → chunk-hma82ban.js}

@@ -153,7 +153,7 @@ import {
   runMcpEffect,
   createAgentAuthSignedFetch,
   setupMcpAgentCredential
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-jb9dcsfn.js";
 import {
   guard,
   Id,
@@ -187,7 +187,7 @@ import {
   withDefault,
   option,
   String2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
   nextInt
 } from "./chunk-gwcqz1bj.js";
@@ -197,7 +197,7 @@ import {
   withHeaders,
   layerProtocolSocket,
   ConnectionHooks
-} from "./chunk-148mjppg.js";
+} from "./chunk-338c1c1x.js";
 
 // apps/cli/src/mcp.ts
 import { tmpdir } from "os";

package/dist/{chunk-m32wb6t0.js → chunk-jb9dcsfn.js}

@@ -315,7 +315,7 @@ import {
   String2,
   optionalEnv,
   harnessesUnsupportedInSrt2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
   isDateTime,
   Numeric,
@@ -355,7 +355,7 @@ import {
   make3,
   parseFdName,
   fdName
-} from "./chunk-mmetyep8.js";
+} from "./chunk-kdyzndvx.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Tuple.js
 var makeEquivalence3 = Tuple;
@@ -1756,7 +1756,7 @@ var make19 = /* @__PURE__ */ gen(function* () {
   });
   return make2(spawnCommand);
 });
-var layer3 = /* @__PURE__ */ effect(ChildProcessSpawner, make19);
+var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make19);
 var flattenCommand = (command) => {
   const commands = [];
   const pipeOptions = [];
@@ -2270,10 +2270,10 @@ var makeFileSystem = /* @__PURE__ */ map8(/* @__PURE__ */ serviceOption(WatchBac
   },
   writeFile: writeFile2
 }));
-var layer4 = /* @__PURE__ */ effect(FileSystem)(makeFileSystem);
+var layer6 = /* @__PURE__ */ effect(FileSystem)(makeFileSystem);
 
 // node_modules/.bun/@effect+platform-bun@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-bun/dist/BunFileSystem.js
-var layer5 = layer4;
+var layer = layer6;
 
 // node_modules/.bun/@effect+platform-node-shared@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-node-shared/dist/NodePath.js
 import * as NodePath from "path";
@@ -2308,13 +2308,13 @@ var layerWin32 = /* @__PURE__ */ succeed5(Path)(/* @__PURE__ */ make13({
   ...NodePath.win32,
   .../* @__PURE__ */ fileUrlOps(true)
 }));
-var layer6 = /* @__PURE__ */ succeed5(Path)(/* @__PURE__ */ make13({
+var layer7 = /* @__PURE__ */ succeed5(Path)(/* @__PURE__ */ make13({
   ...NodePath,
   .../* @__PURE__ */ fileUrlOps(undefined)
 }));
 
 // node_modules/.bun/@effect+platform-bun@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-bun/dist/BunPath.js
-var layer7 = layer6;
+var layer2 = layer7;
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Stdio.js
 var TypeId3 = "~effect/Stdio";
@@ -3174,7 +3174,7 @@ function defaultShouldQuit(input) {
 var layer11 = layer10;
 
 // node_modules/.bun/@effect+platform-bun@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-bun/dist/BunServices.js
-var layer = /* @__PURE__ */ layer3.pipe(/* @__PURE__ */ provideMerge(/* @__PURE__ */ mergeAll(layer5, layer7, layer9, layer11)));
+var layer3 = /* @__PURE__ */ layer5.pipe(/* @__PURE__ */ provideMerge(/* @__PURE__ */ mergeAll(layer, layer2, layer9, layer11)));
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Console.js
 var Console = ConsoleRef;
@@ -10125,7 +10125,7 @@ var fetch2 = /* @__PURE__ */ make27((request, url, signal, fiber) => {
   }
   return send(undefined);
 });
-var layer2 = /* @__PURE__ */ layerMergedContext(/* @__PURE__ */ succeed6(fetch2));
+var layer4 = /* @__PURE__ */ layerMergedContext(/* @__PURE__ */ succeed6(fetch2));
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/socket/Socket.js
 var TypeId14 = "~effect/socket/Socket";
 var Socket = /* @__PURE__ */ Service2("effect/socket/Socket");
@@ -10867,7 +10867,7 @@ var collectorHttpClient = effect(HttpClient)(map8(HttpClient, (client) => transf
       description: `The collector did not answer in ${collectorTimeout}`
     })
   }))
-})))).pipe(provide2(layer2));
+})))).pipe(provide2(layer4));
 var metricLabels = new Map;
 // packages/core/src/run-display.ts
 var runDisplayLabels = {
@@ -14606,7 +14606,7 @@ function stringValue(value) {
 // node_modules/.bun/@effect+platform-node-shared@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-node-shared/dist/NodeCrypto.js
 var layerSecureRandom = layerWebCrypto;
 // apps/mcp/src/platform.ts
-var McpPlatformLive = mergeAll(layerSecureRandom, layer5, layer7);
+var McpPlatformLive = mergeAll(layerSecureRandom, layer, layer2);
 function runMcpEffect(effect) {
   return runPromise(provide3(effect, McpPlatformLive));
 }
@@ -15456,4 +15456,4 @@ function checkServices(declaration) {
   return isSome(decoded) ? [...new Set(decoded.value.services)] : undefined;
 }
 
-export { Clock, currentTimeMillis, WebCrypto, SecureRandom, layerWebCrypto, makeUnsafe, formatIso, empty, fromInput, merge, runMain, Stdio, Terminal, layer, error, log, toDate, parseDate, toIso, currentDate, wallClockMillis, waitingOnWords, queueWords, scanDurableSurface, redactResponseSurface, redactCredentials, redactedOutputTail, SafeJson, AgentHarnessIds, AgentSkillRequirement, AgentMcpServerRequirement, AgentEnvironmentFragment, findForbiddenAgentEnvironmentSecretPath, RepoBindingProviders, RepoBindingCredentialProviderTypes, findForbiddenRepoBindingSecretPath, AgentSandboxNetwork, runnerAgentSandboxPolicy, agentNetworkAllowlist, verificationNetworkAllowlist, programNetworkHosts, ContextPackModes, DefaultContextPackMode, ProposalStatuses, ProposalTargetTypes, canonicalJson, canonicalSha256, AgentEfforts, AgentCapabilities, LoopDataSchemaRef, RunDisplayStates, LoopVersion, ProgramLoop, AgentFallback, ProgramWorkUnit, MeasureSample, MeasureEvidence, catchUpPathLimit, CatchUp, RunnerOwnership, defaultRunnerCapabilities, MemoryStatuses, MemoryScopes, MaxMemoryListLimit, DecisionStatuses, Session, SessionEnd, SessionUpdate, SessionUpdateCreate, FixFlowRecoveryActions, KitmanAgentCapabilityNames, sha2562, isRunFileRefusalReason, runFileRefusalWords, RunFileRefused, runFileContentType, repositoryKey, createId, digestSha256, digestSha512, digestWith, sha256Hasher, AgentEvent, raw, make5, get, put, setHeaders, bodyUint8Array, schemaBodyJson, filterStatusOk, HttpClient, execute, get2, Fetch, layer2, Socket, SocketReadError, SocketError, WebSocketConstructor, layerWebSocketConstructorGlobal, layerWebSocket, runDisplayLabels, listedSummary, KitName, KitDigest, defaultKitName, KitSetup, SetupArchive, kitMcpSecretNames, kitmanMcpServer, KitmanClientError, KitmanEffectClient, CliError, DefaultApiUrl, resolveConfig, apiUrlFromEnv, stepCredentialFromEnv, stepWorkspaceFromEnv, stepSkillsDirFromEnv, stepFittingSkillsFromEnv, stepOutputOnlyFromEnv, mcpCredentialNameFromEnv, userConfigPath, userAuthPath, userHarnessSyncPath, kitSetupCacheDir, bundleCacheDir, localConfigPath, readUserConfig, writeUserConfig, sessionForApi, readAuthStore, storeSession, removeSession, removeAllSessions, agentCredentialForApi, storeAgentCredential, removeAgentCredential, normalizeApiUrl, isStoredAgentCredential, isStreamSchema, getStreamSchemas, make6, exitSchema, ParseOptions, RpcClientDefect, RpcClientError, make7, Service, RunnerHeaders, RunnerRpcProtocolVersion, RunnerRpcError, RunSettled, UpdateAvailable, RunnerReplicaRpcs, RunnerRunFileRpcs, ProgramRpcs, parseCallbackUrl, revokeToken, toStoredSession, browserLogin, openBrowser, shouldRefresh, createSdkClient, refreshSession, AgentAuthClientError, executeAgentCapability, createAgentAuthBearerToken, McpPlatformLive, runMcpEffect, createAgentAuthSignedFetch, setupMcpAgentCredential, generateAgentKeyPair, HERDR_CORE_GENERATION2, HERDR_CORE_INSTALL_COMMAND2, HerdrCoreMissing2, HerdrCoreIncompatible2, HerdrCoreConnectionLost2, HerdrCoreRpcError2, HerdrCoreUpdateFailed2, HerdrCore2, herdrCoreLayer2, herdrCoreTransportLayer2, updateHerdrCore2, CommandFailed2, runCommand2, withoutPreloads2, shellOutputTailChars2, runProcess2, CommandRunner2, runShell2, detectHarnesses2, kitHarnesses, isKitHarness, instructionsStart, instructionsEnd, harnessNames, renderMcpServer, materializeKitSetup, tomlInline, herdrExecutionExtension2, herdrNativeExtensionIds2, herdrRunnerCapabilitiesForRepoBinding2, herdrRunnerCapabilities2, assertHerdrRunnerCapability2, declaredChecks, installCommand, checkServicesFile, checkServices };
+export { Clock, currentTimeMillis, WebCrypto, SecureRandom, layerWebCrypto, makeUnsafe, formatIso, empty, fromInput, merge, runMain, layer, layer2, Stdio, Terminal, layer3, error, log, toDate, parseDate, toIso, currentDate, wallClockMillis, waitingOnWords, queueWords, scanDurableSurface, redactResponseSurface, redactCredentials, redactedOutputTail, SafeJson, AgentHarnessIds, AgentSkillRequirement, AgentMcpServerRequirement, AgentEnvironmentFragment, findForbiddenAgentEnvironmentSecretPath, RepoBindingProviders, RepoBindingCredentialProviderTypes, findForbiddenRepoBindingSecretPath, AgentSandboxNetwork, runnerAgentSandboxPolicy, agentNetworkAllowlist, verificationNetworkAllowlist, programNetworkHosts, ContextPackModes, DefaultContextPackMode, ProposalStatuses, ProposalTargetTypes, canonicalJson, canonicalSha256, AgentEfforts, AgentCapabilities, LoopDataSchemaRef, RunDisplayStates, LoopVersion, ProgramLoop, AgentFallback, ProgramWorkUnit, MeasureSample, MeasureEvidence, catchUpPathLimit, CatchUp, RunnerOwnership, defaultRunnerCapabilities, MemoryStatuses, MemoryScopes, MaxMemoryListLimit, DecisionStatuses, Session, SessionEnd, SessionUpdate, SessionUpdateCreate, FixFlowRecoveryActions, KitmanAgentCapabilityNames, sha2562, isRunFileRefusalReason, runFileRefusalWords, RunFileRefused, runFileContentType, repositoryKey, createId, digestSha256, digestSha512, digestWith, sha256Hasher, AgentEvent, raw, make5, get, put, setHeaders, bodyUint8Array, schemaBodyJson, filterStatusOk, HttpClient, execute, get2, Fetch, layer4, Socket, SocketReadError, SocketError, WebSocketConstructor, layerWebSocketConstructorGlobal, layerWebSocket, runDisplayLabels, listedSummary, KitName, KitDigest, defaultKitName, KitSetup, SetupArchive, kitMcpSecretNames, kitmanMcpServer, KitmanClientError, KitmanEffectClient, CliError, DefaultApiUrl, resolveConfig, apiUrlFromEnv, stepCredentialFromEnv, stepWorkspaceFromEnv, stepSkillsDirFromEnv, stepFittingSkillsFromEnv, stepOutputOnlyFromEnv, mcpCredentialNameFromEnv, userConfigPath, userAuthPath, userHarnessSyncPath, kitSetupCacheDir, bundleCacheDir, localConfigPath, readUserConfig, writeUserConfig, sessionForApi, readAuthStore, storeSession, removeSession, removeAllSessions, agentCredentialForApi, storeAgentCredential, removeAgentCredential, normalizeApiUrl, isStoredAgentCredential, isStreamSchema, getStreamSchemas, make6, exitSchema, ParseOptions, RpcClientDefect, RpcClientError, make7, Service, RunnerHeaders, RunnerRpcProtocolVersion, RunnerRpcError, RunSettled, UpdateAvailable, RunnerReplicaRpcs, RunnerRunFileRpcs, ProgramRpcs, parseCallbackUrl, revokeToken, toStoredSession, browserLogin, openBrowser, shouldRefresh, createSdkClient, refreshSession, AgentAuthClientError, executeAgentCapability, createAgentAuthBearerToken, McpPlatformLive, runMcpEffect, createAgentAuthSignedFetch, setupMcpAgentCredential, generateAgentKeyPair, HERDR_CORE_GENERATION2, HERDR_CORE_INSTALL_COMMAND2, HerdrCoreMissing2, HerdrCoreIncompatible2, HerdrCoreConnectionLost2, HerdrCoreRpcError2, HerdrCoreUpdateFailed2, HerdrCore2, herdrCoreLayer2, herdrCoreTransportLayer2, updateHerdrCore2, CommandFailed2, runCommand2, withoutPreloads2, shellOutputTailChars2, runProcess2, CommandRunner2, runShell2, detectHarnesses2, kitHarnesses, isKitHarness, instructionsStart, instructionsEnd, harnessNames, renderMcpServer, materializeKitSetup, tomlInline, herdrExecutionExtension2, herdrNativeExtensionIds2, herdrRunnerCapabilitiesForRepoBinding2, herdrRunnerCapabilities2, assertHerdrRunnerCapability2, declaredChecks, installCommand, checkServicesFile, checkServices };

package/dist/{chunk-mmetyep8.js → chunk-kdyzndvx.js}

@@ -31,7 +31,7 @@ import {
   runCollect,
   runDrain,
   mkString
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/internal/redacted.js
 var redactedRegistry = /* @__PURE__ */ new WeakMap;

package/dist/{chunk-5j3cxsnp.js → chunk-pvkwhesj.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-61k67vxh.js";
 import {
   runForEach
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
   WebSocketConstructor,
   layerWebSocketConstructorGlobal,
@@ -19,13 +19,13 @@ import {
   RunnerReplicaRpcs,
   RunnerRunFileRpcs,
   ProgramRpcs
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-jb9dcsfn.js";
 import {
   layerJson,
   make4,
   withHeaders,
   layerProtocolSocket
-} from "./chunk-148mjppg.js";
+} from "./chunk-338c1c1x.js";
 
 // packages/live/src/rpc/runner-client.ts
 var proxiedWebSocket = (proxy) => succeed5(WebSocketConstructor)((target) => {

package/dist/{chunk-5y5axze6.js → chunk-s97jvqxb.js}

@@ -32,15 +32,15 @@ import {
   FileSystem,
   Path,
   optionalEnv
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
   AgentHarnessIds,
   sha2562,
   runCommand2
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-jb9dcsfn.js";
 import {
   NpmRegistry
-} from "./chunk-twp7aprz.js";
+} from "./chunk-bdxhb63t.js";
 
 // packages/agent-runtime/src/config-convergence.ts
 var writeAgentEnvironmentConfigFile2 = fnUntraced(function* (file, content, keep = {}) {

package/dist/{chunk-wczs5vrq.js → chunk-st9mym1j.js}

@@ -5,6 +5,7 @@ import {
   pinnedSrtCommand2,
   pinnedSrtStepCommand2,
   runSrtCli2,
+  kitmanCacheDirectory2,
   srtSettings2,
   srtCacheEnvironment2,
   srtInheritedEnv2,
@@ -13,12 +14,13 @@ import {
   writeSrtSettings2,
   srtStepArgv2,
   srtArgv2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import"./chunk-61k67vxh.js";
 export {
   compiled2 as compiled,
   harnessesUnsupportedInSrt2 as harnessesUnsupportedInSrt,
   inheritedEnvironment2 as inheritedEnvironment,
+  kitmanCacheDirectory2 as kitmanCacheDirectory,
   pinnedSrtCommand2 as pinnedSrtCommand,
   pinnedSrtStepCommand2 as pinnedSrtStepCommand,
   runSrtCli2 as runSrtCli,

package/dist/{chunk-vtn088tq.js → chunk-vn3x7bzf.js}

@@ -32,11 +32,11 @@ import {
   make11,
   runForEach,
   compiled2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-mmetyep8.js";
+} from "./chunk-kdyzndvx.js";
 
 // packages/agent-runtime/src/opencode-store.ts
 import { lstatSync, readFileSync, realpathSync } from "fs";

package/dist/{chunk-y48wz1sa.js → chunk-w9kg1784.js}

@@ -97,7 +97,7 @@ import {
   withDefault,
   option,
   String2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
   currentTimeMillis,
   SecureRandom,
@@ -105,7 +105,7 @@ import {
   runMain,
   Stdio,
   Terminal,
-  layer,
+  layer3,
   error,
   log,
   toIso,
@@ -141,7 +141,7 @@ import {
   HttpClient,
   execute,
   Fetch,
-  layer2,
+  layer4,
   runDisplayLabels,
   listedSummary,
   defaultKitName,
@@ -197,7 +197,7 @@ import {
   harnessNames,
   herdrRunnerCapabilities2,
   declaredChecks
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-jb9dcsfn.js";
 import {
   Id
 } from "./chunk-4kssrezn.js";
@@ -214,7 +214,7 @@ import {
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-mmetyep8.js";
+} from "./chunk-kdyzndvx.js";
 
 // apps/cli/src/cli-error.ts
 function cliErrorCode(error, status) {
@@ -496,12 +496,18 @@ var sandboxMissing = (sandbox, missing) => ({
 });
 var personalCheckBackend = (agentSandbox, dockerAvailable) => agentSandbox === "srt" || agentSandbox === "docker" && dockerAvailable ? agentSandbox : undefined;
 var checkHostsSetting = (value) => (value ?? "").split(",").map((host) => host.trim()).filter((host) => host !== "");
+var pinnedImage = (value) => {
+  const image = value?.trim();
+  return image !== undefined && /@sha256:[a-f0-9]{64}$/.test(image) ? image : undefined;
+};
+var checkDockerImageSetting = pinnedImage;
+var checkRegistryImageSetting = pinnedImage;
 var herdrCoreSession = (runnerId, personal) => personal ? undefined : `kitman-${sha2562(runnerId).slice(0, 16)}`;
 var OpenHerdrCore = Reference("kitman/cli/OpenHerdrCore", {
-  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-mtgkvbk4.js")), ({ HerdrCore, herdrCoreLayer }) => provide3(service(HerdrCore), herdrCoreLayer(options)))
+  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-2md3k83r.js")), ({ HerdrCore, herdrCoreLayer }) => provide3(service(HerdrCore), herdrCoreLayer(options)))
 });
 var UpdateHerdrCore = Reference("kitman/cli/UpdateHerdrCore", {
-  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-mtgkvbk4.js")), (module) => module.updateHerdrCore(options))
+  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-2md3k83r.js")), (module) => module.updateHerdrCore(options))
 });
 var herdrCoreMissing = (error) => {
   if (isTagged(error, "HerdrCoreMissing"))
@@ -727,7 +733,7 @@ var syncTargets = (harness) => gen(function* () {
 });
 var syncKits = (input) => gen(function* () {
   const fs = yield* FileSystem;
-  const { syncKitSetup } = yield* promise(() => import("./chunk-eerh2t20.js"));
+  const { syncKitSetup } = yield* promise(() => import("./chunk-7kernadf.js"));
   const harnesses = yield* syncTargets(input.harness);
   const chain = yield* input.client.getKitChain(input.workspaceId);
   for (const { name, problem } of chain.skipped)
@@ -759,7 +765,7 @@ var syncKits = (input) => gen(function* () {
 
 // apps/cli/src/assets.ts
 function send(request, failure) {
-  return execute(request).pipe(mapError2((error) => failure(error.cause ?? error)), provide3(layer2));
+  return execute(request).pipe(mapError2((error) => failure(error.cause ?? error)), provide3(layer4));
 }
 function putPresignedAsset(upload, bytes) {
   return gen(function* () {
@@ -1645,7 +1651,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.10.54";
+var cliVersion = "0.10.56";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1894,7 +1900,7 @@ var Usage = [
   "Every run, loop, agent, verify, constraint, secret, claim, deploy, dev and kit command takes --json."
 ].join(`
 `);
-var agentRuntime = promise(() => import("./chunk-c0wrcam4.js"));
+var agentRuntime = promise(() => import("./chunk-48dn3enn.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -2740,7 +2746,7 @@ var SandboxHostProbe = Reference("kitman/cli/SandboxHostProbe", {
 });
 var OpenRunnerRpc = Reference("kitman/cli/OpenRunnerRpc", {
   defaultValue: () => (options) => gen(function* () {
-    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-dkpqwk0q.js"));
+    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-2t06f3vz.js"));
     return yield* makeRunnerRpcClient({
       runnerId: options.runnerId,
       bearer: options.bearer,
@@ -2762,7 +2768,9 @@ var runnerSettings = gen(function* () {
     sshAgentAvailable: (yield* optional("SSH_AUTH_SOCK")) !== undefined,
     sandbox,
     dockerImage: yield* optional("KITMAN_RUNNER_DOCKER_IMAGE"),
-    checkHosts: checkHostsSetting(yield* optional("KITMAN_RUNNER_CHECK_HOSTS"))
+    checkHosts: checkHostsSetting(yield* optional("KITMAN_RUNNER_CHECK_HOSTS")),
+    checkDockerImage: checkDockerImageSetting(yield* optional("KITMAN_RUNNER_CHECK_DOCKER_IMAGE")),
+    checkRegistryImage: checkRegistryImageSetting(yield* optional("KITMAN_RUNNER_CHECK_REGISTRY_IMAGE"))
   };
 });
 var herdrRunnerRootDir = gen(function* () {
@@ -2787,8 +2795,10 @@ function startCanonicalHerdrRunnerCommand(input) {
       HerdrCore,
       herdrCoreAgentBackendLayer,
       detectHarnesses,
+      dockerCheckDaemon,
       dockerCheckPostgres,
       liveReplicaIds,
+      removeCheckDocker,
       removeCheckPostgres,
       checkPostgresSweepInterval,
       herdrRunnerCapabilities,
@@ -2895,7 +2905,7 @@ function startCanonicalHerdrRunnerCommand(input) {
       sandboxBackends: host.backends,
       ...inSrt === undefined ? undefined : { srtBinaries: inSrt.binaries },
       ...docker === undefined ? undefined : { docker: { ...docker, runnerId: input.runnerId } }
-    }).pipe(provide2(succeed5(HerdrCore, core)), provide2(layer));
+    }).pipe(provide2(succeed5(HerdrCore, core)), provide2(layer3));
     const activeSlots = new Set;
     let claimsInFlight = 0;
     const updater = runnerUpdater({
@@ -2976,7 +2986,7 @@ function startCanonicalHerdrRunnerCommand(input) {
             ...secrets.length === 0 ? undefined : { secrets }
           });
         };
-        const storage = yield* provide3(service(HttpClient), layer2);
+        const storage = yield* provide3(service(HttpClient), layer4);
         const runAgentStep = agentStepExecutor({
           rootDir: path.join(runnerRootDir, ".kitman"),
           sandbox,
@@ -3016,7 +3026,9 @@ function startCanonicalHerdrRunnerCommand(input) {
         const removeOrphanedCheckPostgres = gen(function* () {
           const now = yield* currentTimeMillis;
           const { items } = yield* controlPlane.client.listRunnerReplicas(input.runnerId);
-          yield* removeCheckPostgres(input.runnerId, liveReplicaIds(items, replica.id, now));
+          const live = liveReplicaIds(items, replica.id, now);
+          yield* removeCheckPostgres(input.runnerId, live);
+          yield* removeCheckDocker(input.runnerId, live);
         }).pipe(ignore);
         yield* removeOrphanedCheckPostgres;
         yield* removeOrphanedCheckPostgres.pipe(delay(checkPostgresSweepInterval), forever, forkScoped);
@@ -3026,6 +3038,14 @@ function startCanonicalHerdrRunnerCommand(input) {
           gitCredentials: rpc.gitCredential,
           runFiles: { client: rpc, storage },
           postgres: dockerCheckPostgres(input.runnerId, replica.id),
+          ...settings.checkDockerImage === undefined || settings.checkRegistryImage === undefined ? undefined : {
+            docker: dockerCheckDaemon({
+              runnerId: input.runnerId,
+              replicaId: replica.id,
+              image: settings.checkDockerImage,
+              registryImage: settings.checkRegistryImage
+            })
+          },
           ...checkSandbox === undefined ? undefined : { sandbox: { ...checkSandbox, apiUrl: input.apiUrl, hosts: settings.checkHosts } }
         });
         const control = (capacitySlot) => {
@@ -3084,7 +3104,7 @@ function startCanonicalHerdrRunnerCommand(input) {
         });
         return yield* raceFirst(stopWhenRefused(supervised), _await(updated));
       }));
-    }).pipe(ensuring2(ignore(controlPlane.client.stopRunnerReplica(input.runnerId, replica.id))), provide3(provideMerge(root, layer)));
+    }).pipe(ensuring2(ignore(controlPlane.client.stopRunnerReplica(input.runnerId, replica.id))), provide3(provideMerge(root, layer3)));
   }).pipe(scoped, catchTag("RunnerStopped", ({ problem }) => error(`Runner stopped (${problem.code}): ${problem.message}
 Fix: ${problem.fix}`)));
 }
@@ -3110,7 +3130,7 @@ function mcpCommand(args) {
     if (command.action === "run") {
       if (command.args.length > 0)
         return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
-      const { runMcpServerCommand } = yield* promise(() => import("./chunk-q0yna8sw.js"));
+      const { runMcpServerCommand } = yield* promise(() => import("./chunk-hma82ban.js"));
       return yield* runMcpServerCommand({ flags: command.flags });
     }
     if (command.action !== "setup")
@@ -4312,9 +4332,9 @@ function claimCommand(args) {
     }
   });
 }
-var KitWriter = map8(promise(() => import("./chunk-my987gxf.js")), (build) => build.writeKit);
+var KitWriter = map8(promise(() => import("./chunk-zf3vq701.js")), (build) => build.writeKit);
 var KitBuilder = Reference("kitman/cli/KitBuilder", {
-  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-my987gxf.js")), (build) => build.buildKit(directory))
+  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-zf3vq701.js")), (build) => build.buildKit(directory))
 });
 var uploadKit = (client, workspaceId, built) => gen(function* () {
   yield* client.uploadKitBundle(workspaceId, built.digest, { bundle: encode2(built.bundle) });
@@ -5358,7 +5378,7 @@ var runCli = (args) => {
   const program = runEffect(args).pipe(tapCause((cause) => {
     const error2 = squash(cause);
     return args.includes("--json") ? printJson(cliErrorJson(error2)) : error(cliErrorLine(error2));
-  }), provide3(layer));
+  }), provide3(layer3));
   runMain(program, { disableErrorReporting: true });
 };
 export {

package/dist/{chunk-g7vk5tjp.js → chunk-wbrv4705.js}

@@ -105,11 +105,11 @@ import {
   KitDigest,
   KitSetup,
   RunnerRpcError
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-jb9dcsfn.js";
 import {
   runForEach,
   FileSystem
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/crypto/internal/webCrypto.js
 var subtleUnavailable = () => new Error("crypto.subtle is unavailable; browsers expose it only in secure contexts");

package/dist/{chunk-rjfxnk05.js → chunk-yfdktxzg.js}

@@ -7,10 +7,10 @@ import {
   decoded2,
   readOpencode2,
   runOpencodeReader2
-} from "./chunk-vtn088tq.js";
-import"./chunk-mmetyep8.js";
+} from "./chunk-vn3x7bzf.js";
+import"./chunk-kdyzndvx.js";
 import"./chunk-7evwar6b.js";
-import"./chunk-xgwjcq4z.js";
+import"./chunk-emabyaj0.js";
 import"./chunk-61k67vxh.js";
 export {
   decoded2 as decoded,

package/dist/{chunk-my987gxf.js → chunk-zf3vq701.js}

@@ -42,33 +42,35 @@ import {
   Path,
   withDefault,
   String2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-emabyaj0.js";
 import {
+  SecureRandom,
+  layerWebCrypto,
   canonicalJson,
   digestSha256,
   schemaBodyJson,
   filterStatusOk,
   get2,
-  layer2,
+  layer4,
   kitmanMcpServer,
   RunnerRpcProtocolVersion
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-jb9dcsfn.js";
 import {
   Packument,
   tarballMatches
-} from "./chunk-twp7aprz.js";
-import"./chunk-5j3cxsnp.js";
+} from "./chunk-bdxhb63t.js";
+import"./chunk-pvkwhesj.js";
 import {
   AgentDeclaration,
   KitDeclarations,
   describeFlag,
   Described
-} from "./chunk-g7vk5tjp.js";
+} from "./chunk-wbrv4705.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-mmetyep8.js";
-import"./chunk-148mjppg.js";
+} from "./chunk-kdyzndvx.js";
+import"./chunk-338c1c1x.js";
 
 // packages/sdk/src/build/index.ts
 class DependencyInstallFailed extends TaggedError2()("DependencyInstallFailed", {
@@ -227,7 +229,7 @@ var fetchNpm = (name, wanted, what) => gen(function* () {
   if (!extracted.ok)
     return yield* failed(`the tarball does not extract: ${failure(extracted)}`);
   return yield* confined(directory, "package", what);
-}).pipe(provide3(layer2));
+}).pipe(provide3(layer4));
 var sourceTree = (directory, source, what, checkouts) => gen(function* () {
   switch (source.kind) {
     case "local_path":
@@ -408,7 +410,9 @@ var buildKit = (directory, options = {}) => gen(function* () {
   if (!installed.ok)
     return yield* new DependencyInstallFailed({ reason: failure(installed) });
   const packages = yield* kitModules(root);
-  const entry = path.join(root, ".kitman-build-entry.ts");
+  const id = yield* SecureRandom.pipe(flatMap3((random) => random.uuidV4()), provide3(layerWebCrypto));
+  const entryName = `.kitman-build-entry-${id}.ts`;
+  const entry = path.join(root, entryName);
   yield* acquireRelease(fs.writeFileString(entry, buildEntry(identity, packages)), () => ignore(fs.remove(entry)));
   const out = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-kit-" });
   const bundleFile = path.join(out, "bundle.js");
@@ -474,7 +478,7 @@ var buildKit = (directory, options = {}) => gen(function* () {
     ...own.schedules === undefined ? undefined : { schedules: own.schedules },
     carried
   }).pipe(mapError2((error) => new DeclarationsInvalid({ reason: error.message })));
-  const bundle = yield* fs.readFile(bundleFile).pipe(mapError2((error) => new BundleFailed({ reason: error.message })));
+  const bundle = yield* fs.readFileString(bundleFile).pipe(map8((text) => new TextEncoder().encode(text.replaceAll(entryName, ".kitman-build-entry.ts"))), mapError2((error) => new BundleFailed({ reason: error.message })));
   return {
     ...identity,
     bundle,