@kitman-sh/cli 0.10.55 → 0.10.57

package/dist/{chunk-5j3cxsnp.js → chunk-23vene3j.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-61k67vxh.js";
 import {
   runForEach
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
   WebSocketConstructor,
   layerWebSocketConstructorGlobal,
@@ -19,13 +19,13 @@ import {
   RunnerReplicaRpcs,
   RunnerRunFileRpcs,
   ProgramRpcs
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
 import {
   layerJson,
   make4,
   withHeaders,
   layerProtocolSocket
-} from "./chunk-148mjppg.js";
+} from "./chunk-de4cfe40.js";
 
 // packages/live/src/rpc/runner-client.ts
 var proxiedWebSocket = (proxy) => succeed5(WebSocketConstructor)((target) => {

package/dist/{chunk-rjfxnk05.js → chunk-253add07.js}

@@ -7,10 +7,10 @@ import {
   decoded2,
   readOpencode2,
   runOpencodeReader2
-} from "./chunk-vtn088tq.js";
-import"./chunk-mmetyep8.js";
+} from "./chunk-jc920h47.js";
+import"./chunk-5tfxtw9z.js";
 import"./chunk-7evwar6b.js";
-import"./chunk-xgwjcq4z.js";
+import"./chunk-cy5fbrfm.js";
 import"./chunk-61k67vxh.js";
 export {
   decoded2 as decoded,

package/dist/{chunk-mmetyep8.js → chunk-5tfxtw9z.js}

@@ -31,7 +31,7 @@ import {
   runCollect,
   runDrain,
   mkString
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/internal/redacted.js
 var redactedRegistry = /* @__PURE__ */ new WeakMap;

package/dist/{chunk-twp7aprz.js → chunk-a1yf46xt.js}

@@ -28,7 +28,7 @@ import {
 import {
   withDefault,
   String2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
   digestSha256,
   digestSha512,
@@ -36,9 +36,9 @@ import {
   schemaBodyJson,
   filterStatusOk,
   get2,
-  layer2,
+  layer4,
   KitDigest
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
 
 // packages/core/src/npm-registry.ts
 var KitManifest = Struct({
@@ -107,7 +107,7 @@ var npmRegistryAt = (url = registryUrl) => {
     message: `npm did not answer for ${name}@${version}: ${error.message}; try again`
   });
   const packument = (name, version) => gen(function* () {
-    const response = yield* get2(`${yield* base}/${name.replace("/", "%2F")}`).pipe(mapError2(unreachable(name, version)), provide3(layer2));
+    const response = yield* get2(`${yield* base}/${name.replace("/", "%2F")}`).pipe(mapError2(unreachable(name, version)), provide3(layer4));
     if (response.status === 404)
       return yield* new NpmRegistryError({ kind: "not_found", message: `npm has no package ${name}` });
     return yield* filterStatusOk(response).pipe(flatMap3(schemaBodyJson(Packument)), mapError2(unreachable(name, version)));
@@ -123,7 +123,7 @@ var npmRegistryAt = (url = registryUrl) => {
       const dist = found.versions[version]?.dist;
       if (dist === undefined)
         return yield* new NpmRegistryError({ kind: "not_found", message: `npm has no ${name}@${wanted}` });
-      const tarball = yield* get2(dist.tarball).pipe(flatMap3(filterStatusOk), flatMap3((response) => response.arrayBuffer), map8((buffer) => new Uint8Array(buffer)), mapError2(unreachable(name, version)), provide3(layer2));
+      const tarball = yield* get2(dist.tarball).pipe(flatMap3(filterStatusOk), flatMap3((response) => response.arrayBuffer), map8((buffer) => new Uint8Array(buffer)), mapError2(unreachable(name, version)), provide3(layer4));
       if (!tarballMatches(tarball, dist))
         return yield* new NpmRegistryError({
           kind: "integrity",

package/dist/{chunk-xgwjcq4z.js → chunk-cy5fbrfm.js}

@@ -79,6 +79,8 @@ import {
   fiberRunIn,
   makeLatchUnsafe,
   makeLatch,
+  ClockRef,
+  currentTimeMillis2,
   succeed3,
   failCause2,
   fail4,
@@ -248,6 +250,10 @@ var makeEquivalence = (equivalence) => {
   return (self, that) => is(self, that) && is(that, self);
 };
 
+// node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Clock.js
+var Clock = ClockRef;
+var currentTimeMillis = currentTimeMillis2;
+
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/ByteSize.js
 var bigint0 = /* @__PURE__ */ BigInt(0);
 var bigint1 = /* @__PURE__ */ BigInt(1);
@@ -3471,13 +3477,16 @@ var pinnedSrtCommand2 = () => compiled2 ? [process.execPath, "srt"] : [process.e
 var pinnedSrtStepCommand2 = () => compiled2 ? [process.execPath, "srt-step"] : [process.execPath, fileURLToPath(new URL("./srt-step.main.ts", import.meta.url))];
 var srtPackageDir = () => fileURLToPath(new URL("../", import.meta.resolve("@anthropic-ai/sandbox-runtime/dist/cli.js")));
 var runSrtCli2 = () => import("@anthropic-ai/sandbox-runtime/dist/cli.js");
+var kitmanCacheDirectory2 = gen(function* () {
+  const path = yield* Path;
+  const cacheHome = yield* String2("XDG_CACHE_HOME").pipe(withDefault(""));
+  return path.join(cacheHome === "" ? path.join(homedir(), ".cache") : cacheHome, "kitman");
+});
 var embeddedApplySeccomp = gen(function* () {
   const file = compiled2 && process.platform === "linux" ? embeddedFile(Bun.embeddedFiles, "apply-seccomp") : undefined;
   if (file === undefined)
     return;
-  const path = yield* Path;
-  const cacheHome = yield* String2("XDG_CACHE_HOME").pipe(withDefault(""));
-  return yield* extractEmbeddedFile(path.join(cacheHome === "" ? path.join(homedir(), ".cache") : cacheHome, "kitman"), file, "apply-seccomp");
+  return yield* extractEmbeddedFile(yield* kitmanCacheDirectory2, file, "apply-seccomp");
 }).pipe(orDie);
 var globCharacters = /[*?[\]{}]/;
 var readAllowEntry = (path) => globCharacters.test(path) ? { path, literal: true } : path;
@@ -3548,4 +3557,4 @@ var srtArgv2 = (srtCommand, settingsFile, argv) => [
   ...argv
 ];
 
-export { map, makeEquivalence, bytes, join, interrupt, getCurrent, BadArgument, systemError, badArgument, makeUnsafe2, make8, unbounded, publishUnsafe, make9, bounded, sliding, unbounded2, offer, offerUnsafe, offerAll, fail, failCause, failCauseUnsafe, end, endUnsafe, shutdownUnsafe, take, poll, makeUnsafe3, fromTransform, mapDone, isSink, fromChannel, drain, make10, get3, isStream, fromChannel2, callback, empty2, make11, suspend, fail2, fromQueue, fromPubSub, fromReadableStream, unwrap, map2, tap, drainFork, concat, merge2, filter, catchCause, tapError, mapError, transduce, decodeText, encodeText, splitLines, interruptWhen, ensuring, provideContext, run, runCollect, runFold, runHead, runForEach, runDrain, mkString, mkArrayBuffer, toReadableStreamEffect, FileSystem, make12, FileTypeId, WatchBackend, Path, make13, embeddedFile, extractEmbeddedFile, map3, all, withDefault, option, String2, optionalEnv, harnessesUnsupportedInSrt2, compiled2, pinnedSrtCommand2, pinnedSrtStepCommand2, runSrtCli2, srtSettings2, srtCacheEnvironment2, srtInheritedEnv2, inheritedEnvironment2, withOnlyEnvironment2, writeSrtSettings2, srtStepArgv2, srtArgv2 };
+export { map, makeEquivalence, Clock, currentTimeMillis, bytes, join, interrupt, getCurrent, BadArgument, systemError, badArgument, makeUnsafe2, make8, unbounded, publishUnsafe, make9, bounded, sliding, unbounded2, offer, offerUnsafe, offerAll, fail, failCause, failCauseUnsafe, end, endUnsafe, shutdownUnsafe, take, poll, makeUnsafe3, fromTransform, mapDone, isSink, fromChannel, drain, make10, get3, isStream, fromChannel2, callback, empty2, make11, suspend, fail2, fromQueue, fromPubSub, fromReadableStream, unwrap, map2, tap, drainFork, concat, merge2, filter, catchCause, tapError, mapError, transduce, decodeText, encodeText, splitLines, interruptWhen, ensuring, provideContext, run, runCollect, runFold, runHead, runForEach, runDrain, mkString, mkArrayBuffer, toReadableStreamEffect, FileSystem, make12, FileTypeId, WatchBackend, Path, make13, embeddedFile, extractEmbeddedFile, map3, all, withDefault, option, String2, optionalEnv, harnessesUnsupportedInSrt2, compiled2, pinnedSrtCommand2, pinnedSrtStepCommand2, runSrtCli2, kitmanCacheDirectory2, srtSettings2, srtCacheEnvironment2, srtInheritedEnv2, inheritedEnvironment2, withOnlyEnvironment2, writeSrtSettings2, srtStepArgv2, srtArgv2 };

package/dist/{chunk-148mjppg.js → chunk-de4cfe40.js}

@@ -98,6 +98,7 @@ import {
   toCodecJson
 } from "./chunk-61k67vxh.js";
 import {
+  Clock,
   interrupt,
   getCurrent,
   makeUnsafe2,
@@ -108,9 +109,8 @@ import {
   shutdownUnsafe,
   fromQueue,
   unwrap
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
-  Clock,
   empty,
   fromInput,
   merge,
@@ -123,7 +123,7 @@ import {
   ParseOptions,
   RpcClientDefect,
   RpcClientError
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/workers/Transferable.js
 class Collector extends (/* @__PURE__ */ Service2()("effect/workers/Transferable/Collector")) {

package/dist/{chunk-mtgkvbk4.js → chunk-fmhy6tss.js}

@@ -1,5 +1,5 @@
 // @bun
-import"./chunk-mmetyep8.js";
+import"./chunk-5tfxtw9z.js";
 import {
   HERDR_CORE_GENERATION2,
   HERDR_CORE_INSTALL_COMMAND2,
@@ -12,8 +12,8 @@ import {
   herdrCoreLayer2,
   herdrCoreTransportLayer2,
   updateHerdrCore2
-} from "./chunk-m32wb6t0.js";
-import"./chunk-xgwjcq4z.js";
+} from "./chunk-qhpyzn7c.js";
+import"./chunk-cy5fbrfm.js";
 import"./chunk-61k67vxh.js";
 export {
   HERDR_CORE_GENERATION2 as HERDR_CORE_GENERATION,

package/dist/{chunk-q0yna8sw.js → chunk-h8s4vh47.js}

@@ -104,7 +104,6 @@ import {
   encodePrettyJsonString
 } from "./chunk-61k67vxh.js";
 import {
-  currentTimeMillis,
   SecureRandom,
   makeUnsafe,
   formatIso,
@@ -153,7 +152,7 @@ import {
   runMcpEffect,
   createAgentAuthSignedFetch,
   setupMcpAgentCredential
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
 import {
   guard,
   Id,
@@ -175,6 +174,7 @@ import {
   kindOf
 } from "./chunk-7evwar6b.js";
 import {
+  currentTimeMillis,
   join,
   interrupt,
   runForEach,
@@ -187,7 +187,7 @@ import {
   withDefault,
   option,
   String2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
   nextInt
 } from "./chunk-gwcqz1bj.js";
@@ -197,7 +197,7 @@ import {
   withHeaders,
   layerProtocolSocket,
   ConnectionHooks
-} from "./chunk-148mjppg.js";
+} from "./chunk-de4cfe40.js";
 
 // apps/cli/src/mcp.ts
 import { tmpdir } from "os";

package/dist/{chunk-5y5axze6.js → chunk-hwd2gg2f.js}

@@ -32,15 +32,15 @@ import {
   FileSystem,
   Path,
   optionalEnv
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
   AgentHarnessIds,
   sha2562,
   runCommand2
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
 import {
   NpmRegistry
-} from "./chunk-twp7aprz.js";
+} from "./chunk-a1yf46xt.js";
 
 // packages/agent-runtime/src/config-convergence.ts
 var writeAgentEnvironmentConfigFile2 = fnUntraced(function* (file, content, keep = {}) {

package/dist/{chunk-vtn088tq.js → chunk-jc920h47.js}

@@ -32,11 +32,11 @@ import {
   make11,
   runForEach,
   compiled2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-mmetyep8.js";
+} from "./chunk-5tfxtw9z.js";
 
 // packages/agent-runtime/src/opencode-store.ts
 import { lstatSync, readFileSync, realpathSync } from "fs";

package/dist/{chunk-dj7pp4w4.js → chunk-kyqsbr2n.js}

@@ -87,6 +87,7 @@ import {
   encodePrettyJsonString
 } from "./chunk-61k67vxh.js";
 import {
+  currentTimeMillis,
   tap,
   mapError,
   decodeText,
@@ -97,15 +98,14 @@ import {
   withDefault,
   option,
   String2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
-  currentTimeMillis,
   SecureRandom,
   layerWebCrypto,
   runMain,
   Stdio,
   Terminal,
-  layer,
+  layer3,
   error,
   log,
   toIso,
@@ -141,7 +141,7 @@ import {
   HttpClient,
   execute,
   Fetch,
-  layer2,
+  layer4,
   runDisplayLabels,
   listedSummary,
   defaultKitName,
@@ -197,7 +197,7 @@ import {
   harnessNames,
   herdrRunnerCapabilities2,
   declaredChecks
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
 import {
   Id
 } from "./chunk-4kssrezn.js";
@@ -214,7 +214,7 @@ import {
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-mmetyep8.js";
+} from "./chunk-5tfxtw9z.js";
 
 // apps/cli/src/cli-error.ts
 function cliErrorCode(error, status) {
@@ -504,10 +504,10 @@ var checkDockerImageSetting = pinnedImage;
 var checkRegistryImageSetting = pinnedImage;
 var herdrCoreSession = (runnerId, personal) => personal ? undefined : `kitman-${sha2562(runnerId).slice(0, 16)}`;
 var OpenHerdrCore = Reference("kitman/cli/OpenHerdrCore", {
-  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-mtgkvbk4.js")), ({ HerdrCore, herdrCoreLayer }) => provide3(service(HerdrCore), herdrCoreLayer(options)))
+  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-fmhy6tss.js")), ({ HerdrCore, herdrCoreLayer }) => provide3(service(HerdrCore), herdrCoreLayer(options)))
 });
 var UpdateHerdrCore = Reference("kitman/cli/UpdateHerdrCore", {
-  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-mtgkvbk4.js")), (module) => module.updateHerdrCore(options))
+  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-fmhy6tss.js")), (module) => module.updateHerdrCore(options))
 });
 var herdrCoreMissing = (error) => {
   if (isTagged(error, "HerdrCoreMissing"))
@@ -733,7 +733,7 @@ var syncTargets = (harness) => gen(function* () {
 });
 var syncKits = (input) => gen(function* () {
   const fs = yield* FileSystem;
-  const { syncKitSetup } = yield* promise(() => import("./chunk-eerh2t20.js"));
+  const { syncKitSetup } = yield* promise(() => import("./chunk-mjzvfh9d.js"));
   const harnesses = yield* syncTargets(input.harness);
   const chain = yield* input.client.getKitChain(input.workspaceId);
   for (const { name, problem } of chain.skipped)
@@ -765,7 +765,7 @@ var syncKits = (input) => gen(function* () {
 
 // apps/cli/src/assets.ts
 function send(request, failure) {
-  return execute(request).pipe(mapError2((error) => failure(error.cause ?? error)), provide3(layer2));
+  return execute(request).pipe(mapError2((error) => failure(error.cause ?? error)), provide3(layer4));
 }
 function putPresignedAsset(upload, bytes) {
   return gen(function* () {
@@ -1651,7 +1651,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.10.55";
+var cliVersion = "0.10.57";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1900,7 +1900,7 @@ var Usage = [
   "Every run, loop, agent, verify, constraint, secret, claim, deploy, dev and kit command takes --json."
 ].join(`
 `);
-var agentRuntime = promise(() => import("./chunk-dgb6s5vq.js"));
+var agentRuntime = promise(() => import("./chunk-q5s64k8g.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -2746,7 +2746,7 @@ var SandboxHostProbe = Reference("kitman/cli/SandboxHostProbe", {
 });
 var OpenRunnerRpc = Reference("kitman/cli/OpenRunnerRpc", {
   defaultValue: () => (options) => gen(function* () {
-    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-dkpqwk0q.js"));
+    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-nrkwrajj.js"));
     return yield* makeRunnerRpcClient({
       runnerId: options.runnerId,
       bearer: options.bearer,
@@ -2905,7 +2905,7 @@ function startCanonicalHerdrRunnerCommand(input) {
       sandboxBackends: host.backends,
       ...inSrt === undefined ? undefined : { srtBinaries: inSrt.binaries },
       ...docker === undefined ? undefined : { docker: { ...docker, runnerId: input.runnerId } }
-    }).pipe(provide2(succeed5(HerdrCore, core)), provide2(layer));
+    }).pipe(provide2(succeed5(HerdrCore, core)), provide2(layer3));
     const activeSlots = new Set;
     let claimsInFlight = 0;
     const updater = runnerUpdater({
@@ -2986,7 +2986,7 @@ function startCanonicalHerdrRunnerCommand(input) {
             ...secrets.length === 0 ? undefined : { secrets }
           });
         };
-        const storage = yield* provide3(service(HttpClient), layer2);
+        const storage = yield* provide3(service(HttpClient), layer4);
         const runAgentStep = agentStepExecutor({
           rootDir: path.join(runnerRootDir, ".kitman"),
           sandbox,
@@ -3104,7 +3104,7 @@ function startCanonicalHerdrRunnerCommand(input) {
         });
         return yield* raceFirst(stopWhenRefused(supervised), _await(updated));
       }));
-    }).pipe(ensuring2(ignore(controlPlane.client.stopRunnerReplica(input.runnerId, replica.id))), provide3(provideMerge(root, layer)));
+    }).pipe(ensuring2(ignore(controlPlane.client.stopRunnerReplica(input.runnerId, replica.id))), provide3(provideMerge(root, layer3)));
   }).pipe(scoped, catchTag("RunnerStopped", ({ problem }) => error(`Runner stopped (${problem.code}): ${problem.message}
 Fix: ${problem.fix}`)));
 }
@@ -3130,7 +3130,7 @@ function mcpCommand(args) {
     if (command.action === "run") {
       if (command.args.length > 0)
         return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
-      const { runMcpServerCommand } = yield* promise(() => import("./chunk-q0yna8sw.js"));
+      const { runMcpServerCommand } = yield* promise(() => import("./chunk-h8s4vh47.js"));
       return yield* runMcpServerCommand({ flags: command.flags });
     }
     if (command.action !== "setup")
@@ -4332,9 +4332,9 @@ function claimCommand(args) {
     }
   });
 }
-var KitWriter = map8(promise(() => import("./chunk-axdmbr61.js")), (build) => build.writeKit);
+var KitWriter = map8(promise(() => import("./chunk-v43h8s08.js")), (build) => build.writeKit);
 var KitBuilder = Reference("kitman/cli/KitBuilder", {
-  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-axdmbr61.js")), (build) => build.buildKit(directory))
+  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-v43h8s08.js")), (build) => build.buildKit(directory))
 });
 var uploadKit = (client, workspaceId, built) => gen(function* () {
   yield* client.uploadKitBundle(workspaceId, built.digest, { bundle: encode2(built.bundle) });
@@ -5378,7 +5378,7 @@ var runCli = (args) => {
   const program = runEffect(args).pipe(tapCause((cause) => {
     const error2 = squash(cause);
     return args.includes("--json") ? printJson(cliErrorJson(error2)) : error(cliErrorLine(error2));
-  }), provide3(layer));
+  }), provide3(layer3));
   runMain(program, { disableErrorReporting: true });
 };
 export {

package/dist/{chunk-eerh2t20.js → chunk-mjzvfh9d.js}

@@ -20,22 +20,22 @@ import {
 import {
   FileSystem,
   Path
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
   tomlTableHeader2,
   tomlKeyPath2,
   kitmanSkillEntry,
   isPathWithin2
-} from "./chunk-5y5axze6.js";
+} from "./chunk-hwd2gg2f.js";
 import {
   instructionsStart,
   instructionsEnd,
   renderMcpServer,
   materializeKitSetup,
   tomlInline
-} from "./chunk-m32wb6t0.js";
-import"./chunk-twp7aprz.js";
-import"./chunk-mmetyep8.js";
+} from "./chunk-qhpyzn7c.js";
+import"./chunk-a1yf46xt.js";
+import"./chunk-5tfxtw9z.js";
 
 // packages/agent-runtime/src/kit-setup-sync.ts
 class KitSyncError extends TaggedError("KitSyncError") {

package/dist/{chunk-dkpqwk0q.js → chunk-nrkwrajj.js}

@@ -4,12 +4,12 @@ import {
   runnerRpcUrl2,
   makeRunnerRpcClient2,
   makeProgramRpcClient2
-} from "./chunk-5j3cxsnp.js";
-import"./chunk-148mjppg.js";
-import"./chunk-m32wb6t0.js";
+} from "./chunk-23vene3j.js";
+import"./chunk-de4cfe40.js";
+import"./chunk-qhpyzn7c.js";
 import"./chunk-4kssrezn.js";
 import"./chunk-7evwar6b.js";
-import"./chunk-xgwjcq4z.js";
+import"./chunk-cy5fbrfm.js";
 import"./chunk-61k67vxh.js";
 export {
   makeProgramRpcClient2 as makeProgramRpcClient,

package/dist/{chunk-dgb6s5vq.js → chunk-q5s64k8g.js}

@@ -51,6 +51,7 @@ import {
   makeUnsafe6,
   provide,
   effect,
+  mergeAll,
   die2,
   findErrorOption,
   pretty,
@@ -160,9 +161,10 @@ import {
   secretReference
 } from "./chunk-4kssrezn.js";
 import {
-  currentTimeMillis,
   SecureRandom,
   layerWebCrypto,
+  layer,
+  layer2,
   toDate,
   toIso,
   wallClockMillis,
@@ -221,8 +223,9 @@ import {
   installCommand,
   checkServicesFile,
   checkServices
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
 import {
+  currentTimeMillis,
   join,
   interrupt,
   unbounded,
@@ -243,12 +246,15 @@ import {
   runForEach,
   FileSystem,
   Path,
+  embeddedFile,
+  extractEmbeddedFile,
   optionalEnv,
   harnessesUnsupportedInSrt2,
   compiled2,
   pinnedSrtCommand2,
   pinnedSrtStepCommand2,
   runSrtCli2,
+  kitmanCacheDirectory2,
   srtSettings2,
   srtCacheEnvironment2,
   srtInheritedEnv2,
@@ -257,7 +263,7 @@ import {
   writeSrtSettings2,
   srtStepArgv2,
   srtArgv2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
   writeAgentEnvironmentConfigFile2,
   readManifestSkillPaths2,
@@ -273,8 +279,8 @@ import {
   applyAgentEnvironmentMaterialization2,
   isPathWithin2,
   skillIdentity2
-} from "./chunk-5y5axze6.js";
-import"./chunk-twp7aprz.js";
+} from "./chunk-hwd2gg2f.js";
+import"./chunk-a1yf46xt.js";
 import {
   sliceBytes2,
   maxLineBytes2,
@@ -282,7 +288,7 @@ import {
   decodedOption2,
   decoded2,
   readOpencode2
-} from "./chunk-vtn088tq.js";
+} from "./chunk-jc920h47.js";
 import {
   writeSecretRegistry,
   secretRefusalLog,
@@ -294,16 +300,16 @@ import {
   rpcRunFiles,
   programHostsEnv,
   undeclaredHostsEnv
-} from "./chunk-g7vk5tjp.js";
-import"./chunk-5j3cxsnp.js";
+} from "./chunk-wd0rvdt4.js";
+import"./chunk-23vene3j.js";
 import {
   nextInt
 } from "./chunk-gwcqz1bj.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-mmetyep8.js";
-import"./chunk-148mjppg.js";
+} from "./chunk-5tfxtw9z.js";
+import"./chunk-de4cfe40.js";
 
 // packages/core/src/sync-kit.ts
 import { createHash } from "crypto";
@@ -2577,8 +2583,19 @@ var prepareDockerHome = (input) => gen(function* () {
   }
 });
 
-// packages/agent-runtime/src/docker-sandbox.ts
+// packages/agent-runtime/src/helper-scripts.ts
 import { fileURLToPath } from "url";
+var helperScriptPath = (name) => gen(function* () {
+  if (!compiled2)
+    return fileURLToPath(import.meta.resolve(`./${name}`));
+  const path = yield* Path;
+  const file = embeddedFile(Bun.embeddedFiles, name.replace(/\.ts$/, ""));
+  if (file === undefined)
+    return yield* die3(new Error(`This Runner was compiled without ${name}`));
+  return yield* extractEmbeddedFile(path.join(yield* kitmanCacheDirectory2, "helper-scripts"), file, name);
+}).pipe(orDie, provide3(mergeAll(layer, layer2)));
+
+// packages/agent-runtime/src/docker-sandbox.ts
 var RunnerLabel = "kitman.runner";
 var StepAttemptLabel = "kitman.step-attempt";
 var EgressProxyImage = "oven/bun@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a";
@@ -2661,7 +2678,7 @@ var startDockerSandbox = (input) => gen(function* () {
       labels,
       mounts: [
         {
-          source: fileURLToPath(import.meta.resolve("./egress-proxy.ts")),
+          source: yield* helperScriptPath("egress-proxy.ts"),
           target: "/kitman/egress-proxy.ts",
           readOnly: true
         }
@@ -5310,9 +5327,6 @@ var harnessesInSrt = (input) => gen(function* () {
     binaries: Object.fromEntries(probed.flatMap((entry) => entry.binary === undefined ? [] : [[entry.harness, entry.binary]]))
   };
 });
-// packages/agent-runtime/src/check-docker.ts
-import { fileURLToPath as fileURLToPath2 } from "url";
-
 // packages/agent-runtime/src/loopback-tunnel.ts
 import * as net from "net";
 
@@ -5633,7 +5647,7 @@ var dockerCheckDaemon = (input) => ({ id, network: allowed }) => gen(function* (
   const proxy = allowed === "open" ? undefined : yield* gen(function* () {
     yield* helper(proxyContainer, [
       "--volume",
-      `${fileURLToPath2(import.meta.resolve("./egress-proxy.ts"))}:/kitman/egress-proxy.ts:ro`,
+      `${yield* helperScriptPath("egress-proxy.ts")}:/kitman/egress-proxy.ts:ro`,
       input.proxyImage ?? EgressProxyImage,
       "bun",
       "/kitman/egress-proxy.ts",
@@ -5653,7 +5667,7 @@ var dockerCheckDaemon = (input) => ({ id, network: allowed }) => gen(function* (
     "--publish",
     `127.0.0.1::${checkDockerPort}`,
     "--volume",
-    `${fileURLToPath2(import.meta.resolve("./tcp-forwarder.ts"))}:/kitman/tcp-forwarder.ts:ro`,
+    `${yield* helperScriptPath("tcp-forwarder.ts")}:/kitman/tcp-forwarder.ts:ro`,
     input.proxyImage ?? EgressProxyImage,
     "bun",
     "/kitman/tcp-forwarder.ts",
@@ -6040,15 +6054,14 @@ if (false)
   ;
 
 // packages/agent-runtime/src/verification-executor.ts
-import { fileURLToPath as fileURLToPath3 } from "url";
 var checkTimeout = "30 minutes";
 var checkFilesPerVerification = 50;
-var halfCloseEncoder = [process.execPath, fileURLToPath3(import.meta.resolve("./half-close-relay.ts"))];
-var srtDockerTunnel = (relayPort) => srtLoopbackTunnel({
+var halfCloseListener = (encoder, listenPort, relayPort) => `BUN_BE_BUN=1 ${encoder.map(quoted).join(" ")} ${listenPort} "$HTTP_PROXY" ${relayPort}`;
+var srtDockerTunnel = (relayPort, encoder) => srtLoopbackTunnel({
   service: "Docker daemon",
   hostPort: relayPort,
   listenPort: checkDockerPort,
-  listener: `${halfCloseEncoder.map(quoted).join(" ")} ${checkDockerPort} "$HTTP_PROXY" ${relayPort}`,
+  listener: halfCloseListener(encoder, checkDockerPort, relayPort),
   probe: String.raw`printf 'GET /_ping HTTP/1.0\r\n\r\n'`,
   read: "tail -c 2",
   answers: "OK"
@@ -6088,7 +6101,7 @@ var dockerRoute = (backend, docker) => {
         hosts: [`127.0.0.1:${docker.route.port}`],
         unixSockets: [],
         services: [],
-        tunnel: srtDockerTunnel(docker.route.port)
+        tunnel: srtDockerTunnel(docker.route.port, docker.route.encoder)
       };
     case "direct":
       throw new Error("A pipeline check in srt reaches its daemon through a socket or the relay, never directly.");
@@ -6130,13 +6143,14 @@ var postgresRoute = (backend, postgres) => {
     tunnel: srtPostgresTunnel(postgres.hostPort)
   };
 };
-var checkSandboxPolicy = (work, sandbox, checkout, cache, filesDir, postgresHosts, clientDir) => ({
+var checkSandboxPolicy = (work, sandbox, checkout, cache, filesDir, postgresHosts, docker) => ({
   ...runnerStateSandboxPolicy(sandbox.runner, [
     repositoryClone(sandbox.runner.workRoot, work.repoBinding.id),
     checkout,
-    ...clientDir === undefined ? [] : [clientDir, ...halfCloseEncoder]
+    ...docker === undefined ? [] : [docker.clientDir],
+    ...docker?.route.kind === "relay" ? docker.route.encoder : []
   ]),
-  writablePaths: [checkout, cache, filesDir, ...clientDir === undefined ? [] : [clientDir]],
+  writablePaths: [checkout, cache, filesDir, ...docker === undefined ? [] : [docker.clientDir]],
   network: verificationNetworkAllowlist({
     apiUrl: sandbox.apiUrl,
     storageOrigin: work.storageOrigin,
@@ -6164,7 +6178,7 @@ var checkRunner = (work, sandbox, cache, inherited) => (checkout) => ({ command,
   }
   const route = postgresRoute(sandbox.backend, postgres);
   const daemon = dockerRoute(sandbox.backend, docker);
-  const policy = checkSandboxPolicy(work, sandbox, checkout, cache, filesDir, [...route.hosts, ...daemon.hosts], docker?.clientDir);
+  const policy = checkSandboxPolicy(work, sandbox, checkout, cache, filesDir, [...route.hosts, ...daemon.hosts], docker);
   const [tunnel, ...innerTunnels] = [route.tunnel, daemon.tunnel].filter((script) => script !== undefined);
   const tunnelled = innerTunnels.reduceRight((inner, script) => `sh -c ${quoted(script)} sh ${quoted(inner)}`, command);
   const sandboxCommand = {
@@ -6266,7 +6280,8 @@ var pipelineDaemon = (services, check) => gen(function* () {
     const { port } = yield* decodeListeningPort(relay.address()).pipe(mapError2(() => new ServicesUnavailable({
       reason: `The pipeline check ${check} cannot reach its Docker daemon: its relay has no port`
     })));
-    return { ...started, clientDir, route: { kind: "relay", port } };
+    const encoder = [process.execPath, yield* helperScriptPath("half-close-relay.ts")];
+    return { ...started, clientDir, route: { kind: "relay", port, encoder } };
   }
   return {
     ...started,
@@ -6592,6 +6607,7 @@ export {
   firstMessage,
   gitCheckouts2 as gitCheckouts,
   gitRemote,
+  halfCloseListener,
   harnessAdapter,
   harnessConfigUnwritable,
   harnessesInSrt,
@@ -6610,6 +6626,7 @@ export {
   isPathWithin2 as isPathWithin,
   kitMcpHosts,
   kitmanBundles,
+  kitmanCacheDirectory2 as kitmanCacheDirectory,
   kitmanMcpPreflight,
   kitmanMcpToolTimeout,
   kitmanMcpToolTimeoutSeconds,
@@ -6623,6 +6640,7 @@ export {
   orphanedCheckPostgres,
   pinnedSrtCommand2 as pinnedSrtCommand,
   pinnedSrtStepCommand2 as pinnedSrtStepCommand,
+  pipelineDaemon,
   postgresSocketForwarder,
   prepareHarness,
   previewAgentEnvironmentConfigSync,

package/dist/{chunk-m32wb6t0.js → chunk-qhpyzn7c.js}

@@ -84,8 +84,6 @@ import {
   DisablePropagation,
   sync,
   map7,
-  ClockRef,
-  currentTimeMillis2,
   ConsoleRef,
   succeed3,
   fail4,
@@ -252,6 +250,8 @@ import {
 import {
   map,
   makeEquivalence,
+  Clock,
+  currentTimeMillis,
   bytes,
   BadArgument,
   systemError,
@@ -315,7 +315,7 @@ import {
   String2,
   optionalEnv,
   harnessesUnsupportedInSrt2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import {
   isDateTime,
   Numeric,
@@ -355,15 +355,11 @@ import {
   make3,
   parseFdName,
   fdName
-} from "./chunk-mmetyep8.js";
+} from "./chunk-5tfxtw9z.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Tuple.js
 var makeEquivalence3 = Tuple;
 
-// node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Clock.js
-var Clock = ClockRef;
-var currentTimeMillis = currentTimeMillis2;
-
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/internal/dateTime.js
 var TypeId = "~effect/DateTime";
 var TimeZoneTypeId = "~effect/DateTime/TimeZone";
@@ -1756,7 +1752,7 @@ var make19 = /* @__PURE__ */ gen(function* () {
   });
   return make2(spawnCommand);
 });
-var layer3 = /* @__PURE__ */ effect(ChildProcessSpawner, make19);
+var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make19);
 var flattenCommand = (command) => {
   const commands = [];
   const pipeOptions = [];
@@ -2270,10 +2266,10 @@ var makeFileSystem = /* @__PURE__ */ map8(/* @__PURE__ */ serviceOption(WatchBac
   },
   writeFile: writeFile2
 }));
-var layer4 = /* @__PURE__ */ effect(FileSystem)(makeFileSystem);
+var layer6 = /* @__PURE__ */ effect(FileSystem)(makeFileSystem);
 
 // node_modules/.bun/@effect+platform-bun@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-bun/dist/BunFileSystem.js
-var layer5 = layer4;
+var layer = layer6;
 
 // node_modules/.bun/@effect+platform-node-shared@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-node-shared/dist/NodePath.js
 import * as NodePath from "path";
@@ -2308,13 +2304,13 @@ var layerWin32 = /* @__PURE__ */ succeed5(Path)(/* @__PURE__ */ make13({
   ...NodePath.win32,
   .../* @__PURE__ */ fileUrlOps(true)
 }));
-var layer6 = /* @__PURE__ */ succeed5(Path)(/* @__PURE__ */ make13({
+var layer7 = /* @__PURE__ */ succeed5(Path)(/* @__PURE__ */ make13({
   ...NodePath,
   .../* @__PURE__ */ fileUrlOps(undefined)
 }));
 
 // node_modules/.bun/@effect+platform-bun@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-bun/dist/BunPath.js
-var layer7 = layer6;
+var layer2 = layer7;
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Stdio.js
 var TypeId3 = "~effect/Stdio";
@@ -3174,7 +3170,7 @@ function defaultShouldQuit(input) {
 var layer11 = layer10;
 
 // node_modules/.bun/@effect+platform-bun@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-bun/dist/BunServices.js
-var layer = /* @__PURE__ */ layer3.pipe(/* @__PURE__ */ provideMerge(/* @__PURE__ */ mergeAll(layer5, layer7, layer9, layer11)));
+var layer3 = /* @__PURE__ */ layer5.pipe(/* @__PURE__ */ provideMerge(/* @__PURE__ */ mergeAll(layer, layer2, layer9, layer11)));
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Console.js
 var Console = ConsoleRef;
@@ -3434,6 +3430,7 @@ function classifyAnything(key, value) {
   const text = value.replace(uuidPattern, "uuid");
   return VALUE_RULES.find(([, pattern]) => pattern.test(text))?.[0];
 }
+var durableTextLimit = 1024;
 function scanDurableSurface(value, path = "surface", options = {}) {
   const findings = [];
   scanValue(value, path, undefined, findings, 0, options);
@@ -3477,7 +3474,7 @@ function scanValue(value, path, key, findings, depth, options = {}) {
   const classification = classifyDurableSurfaceValue(key ?? path, value, options);
   if (classification !== undefined)
     findings.push(finding(path, classification, value));
-  else if (isString(value) && value.length > (options.maxTextLength ?? 1024))
+  else if (isString(value) && value.length > (options.maxTextLength ?? durableTextLimit))
     findings.push(finding(path, "unknown", value, "unbounded-text"));
 }
 function finding(path, classification, value, rule = "classified-key") {
@@ -10125,7 +10122,7 @@ var fetch2 = /* @__PURE__ */ make27((request, url, signal, fiber) => {
   }
   return send(undefined);
 });
-var layer2 = /* @__PURE__ */ layerMergedContext(/* @__PURE__ */ succeed6(fetch2));
+var layer4 = /* @__PURE__ */ layerMergedContext(/* @__PURE__ */ succeed6(fetch2));
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/socket/Socket.js
 var TypeId14 = "~effect/socket/Socket";
 var Socket = /* @__PURE__ */ Service2("effect/socket/Socket");
@@ -10867,7 +10864,7 @@ var collectorHttpClient = effect(HttpClient)(map8(HttpClient, (client) => transf
       description: `The collector did not answer in ${collectorTimeout}`
     })
   }))
-})))).pipe(provide2(layer2));
+})))).pipe(provide2(layer4));
 var metricLabels = new Map;
 // packages/core/src/run-display.ts
 var runDisplayLabels = {
@@ -14606,7 +14603,7 @@ function stringValue(value) {
 // node_modules/.bun/@effect+platform-node-shared@4.1.2+edf248c88a527e3e/node_modules/@effect/platform-node-shared/dist/NodeCrypto.js
 var layerSecureRandom = layerWebCrypto;
 // apps/mcp/src/platform.ts
-var McpPlatformLive = mergeAll(layerSecureRandom, layer5, layer7);
+var McpPlatformLive = mergeAll(layerSecureRandom, layer, layer2);
 function runMcpEffect(effect) {
   return runPromise(provide3(effect, McpPlatformLive));
 }
@@ -15456,4 +15453,4 @@ function checkServices(declaration) {
   return isSome(decoded) ? [...new Set(decoded.value.services)] : undefined;
 }
 
-export { Clock, currentTimeMillis, WebCrypto, SecureRandom, layerWebCrypto, makeUnsafe, formatIso, empty, fromInput, merge, runMain, Stdio, Terminal, layer, error, log, toDate, parseDate, toIso, currentDate, wallClockMillis, waitingOnWords, queueWords, scanDurableSurface, redactResponseSurface, redactCredentials, redactedOutputTail, SafeJson, AgentHarnessIds, AgentSkillRequirement, AgentMcpServerRequirement, AgentEnvironmentFragment, findForbiddenAgentEnvironmentSecretPath, RepoBindingProviders, RepoBindingCredentialProviderTypes, findForbiddenRepoBindingSecretPath, AgentSandboxNetwork, runnerAgentSandboxPolicy, agentNetworkAllowlist, verificationNetworkAllowlist, programNetworkHosts, ContextPackModes, DefaultContextPackMode, ProposalStatuses, ProposalTargetTypes, canonicalJson, canonicalSha256, AgentEfforts, AgentCapabilities, LoopDataSchemaRef, RunDisplayStates, LoopVersion, ProgramLoop, AgentFallback, ProgramWorkUnit, MeasureSample, MeasureEvidence, catchUpPathLimit, CatchUp, RunnerOwnership, defaultRunnerCapabilities, MemoryStatuses, MemoryScopes, MaxMemoryListLimit, DecisionStatuses, Session, SessionEnd, SessionUpdate, SessionUpdateCreate, FixFlowRecoveryActions, KitmanAgentCapabilityNames, sha2562, isRunFileRefusalReason, runFileRefusalWords, RunFileRefused, runFileContentType, repositoryKey, createId, digestSha256, digestSha512, digestWith, sha256Hasher, AgentEvent, raw, make5, get, put, setHeaders, bodyUint8Array, schemaBodyJson, filterStatusOk, HttpClient, execute, get2, Fetch, layer2, Socket, SocketReadError, SocketError, WebSocketConstructor, layerWebSocketConstructorGlobal, layerWebSocket, runDisplayLabels, listedSummary, KitName, KitDigest, defaultKitName, KitSetup, SetupArchive, kitMcpSecretNames, kitmanMcpServer, KitmanClientError, KitmanEffectClient, CliError, DefaultApiUrl, resolveConfig, apiUrlFromEnv, stepCredentialFromEnv, stepWorkspaceFromEnv, stepSkillsDirFromEnv, stepFittingSkillsFromEnv, stepOutputOnlyFromEnv, mcpCredentialNameFromEnv, userConfigPath, userAuthPath, userHarnessSyncPath, kitSetupCacheDir, bundleCacheDir, localConfigPath, readUserConfig, writeUserConfig, sessionForApi, readAuthStore, storeSession, removeSession, removeAllSessions, agentCredentialForApi, storeAgentCredential, removeAgentCredential, normalizeApiUrl, isStoredAgentCredential, isStreamSchema, getStreamSchemas, make6, exitSchema, ParseOptions, RpcClientDefect, RpcClientError, make7, Service, RunnerHeaders, RunnerRpcProtocolVersion, RunnerRpcError, RunSettled, UpdateAvailable, RunnerReplicaRpcs, RunnerRunFileRpcs, ProgramRpcs, parseCallbackUrl, revokeToken, toStoredSession, browserLogin, openBrowser, shouldRefresh, createSdkClient, refreshSession, AgentAuthClientError, executeAgentCapability, createAgentAuthBearerToken, McpPlatformLive, runMcpEffect, createAgentAuthSignedFetch, setupMcpAgentCredential, generateAgentKeyPair, HERDR_CORE_GENERATION2, HERDR_CORE_INSTALL_COMMAND2, HerdrCoreMissing2, HerdrCoreIncompatible2, HerdrCoreConnectionLost2, HerdrCoreRpcError2, HerdrCoreUpdateFailed2, HerdrCore2, herdrCoreLayer2, herdrCoreTransportLayer2, updateHerdrCore2, CommandFailed2, runCommand2, withoutPreloads2, shellOutputTailChars2, runProcess2, CommandRunner2, runShell2, detectHarnesses2, kitHarnesses, isKitHarness, instructionsStart, instructionsEnd, harnessNames, renderMcpServer, materializeKitSetup, tomlInline, herdrExecutionExtension2, herdrNativeExtensionIds2, herdrRunnerCapabilitiesForRepoBinding2, herdrRunnerCapabilities2, assertHerdrRunnerCapability2, declaredChecks, installCommand, checkServicesFile, checkServices };
+export { WebCrypto, SecureRandom, layerWebCrypto, makeUnsafe, formatIso, empty, fromInput, merge, runMain, layer, layer2, Stdio, Terminal, layer3, error, log, toDate, parseDate, toIso, currentDate, wallClockMillis, waitingOnWords, queueWords, scanDurableSurface, redactResponseSurface, redactCredentials, redactedOutputTail, SafeJson, AgentHarnessIds, AgentSkillRequirement, AgentMcpServerRequirement, AgentEnvironmentFragment, findForbiddenAgentEnvironmentSecretPath, RepoBindingProviders, RepoBindingCredentialProviderTypes, findForbiddenRepoBindingSecretPath, AgentSandboxNetwork, runnerAgentSandboxPolicy, agentNetworkAllowlist, verificationNetworkAllowlist, programNetworkHosts, ContextPackModes, DefaultContextPackMode, ProposalStatuses, ProposalTargetTypes, canonicalJson, canonicalSha256, AgentEfforts, AgentCapabilities, LoopDataSchemaRef, RunDisplayStates, LoopVersion, ProgramLoop, AgentFallback, ProgramWorkUnit, MeasureSample, MeasureEvidence, catchUpPathLimit, CatchUp, RunnerOwnership, defaultRunnerCapabilities, MemoryStatuses, MemoryScopes, MaxMemoryListLimit, DecisionStatuses, Session, SessionEnd, SessionUpdate, SessionUpdateCreate, FixFlowRecoveryActions, KitmanAgentCapabilityNames, sha2562, isRunFileRefusalReason, runFileRefusalWords, RunFileRefused, runFileContentType, repositoryKey, createId, digestSha256, digestSha512, digestWith, sha256Hasher, AgentEvent, raw, make5, get, put, setHeaders, bodyUint8Array, schemaBodyJson, filterStatusOk, HttpClient, execute, get2, Fetch, layer4, Socket, SocketReadError, SocketError, WebSocketConstructor, layerWebSocketConstructorGlobal, layerWebSocket, runDisplayLabels, listedSummary, KitName, KitDigest, defaultKitName, KitSetup, SetupArchive, kitMcpSecretNames, kitmanMcpServer, KitmanClientError, KitmanEffectClient, CliError, DefaultApiUrl, resolveConfig, apiUrlFromEnv, stepCredentialFromEnv, stepWorkspaceFromEnv, stepSkillsDirFromEnv, stepFittingSkillsFromEnv, stepOutputOnlyFromEnv, mcpCredentialNameFromEnv, userConfigPath, userAuthPath, userHarnessSyncPath, kitSetupCacheDir, bundleCacheDir, localConfigPath, readUserConfig, writeUserConfig, sessionForApi, readAuthStore, storeSession, removeSession, removeAllSessions, agentCredentialForApi, storeAgentCredential, removeAgentCredential, normalizeApiUrl, isStoredAgentCredential, isStreamSchema, getStreamSchemas, make6, exitSchema, ParseOptions, RpcClientDefect, RpcClientError, make7, Service, RunnerHeaders, RunnerRpcProtocolVersion, RunnerRpcError, RunSettled, UpdateAvailable, RunnerReplicaRpcs, RunnerRunFileRpcs, ProgramRpcs, parseCallbackUrl, revokeToken, toStoredSession, browserLogin, openBrowser, shouldRefresh, createSdkClient, refreshSession, AgentAuthClientError, executeAgentCapability, createAgentAuthBearerToken, McpPlatformLive, runMcpEffect, createAgentAuthSignedFetch, setupMcpAgentCredential, generateAgentKeyPair, HERDR_CORE_GENERATION2, HERDR_CORE_INSTALL_COMMAND2, HerdrCoreMissing2, HerdrCoreIncompatible2, HerdrCoreConnectionLost2, HerdrCoreRpcError2, HerdrCoreUpdateFailed2, HerdrCore2, herdrCoreLayer2, herdrCoreTransportLayer2, updateHerdrCore2, CommandFailed2, runCommand2, withoutPreloads2, shellOutputTailChars2, runProcess2, CommandRunner2, runShell2, detectHarnesses2, kitHarnesses, isKitHarness, instructionsStart, instructionsEnd, harnessNames, renderMcpServer, materializeKitSetup, tomlInline, herdrExecutionExtension2, herdrNativeExtensionIds2, herdrRunnerCapabilitiesForRepoBinding2, herdrRunnerCapabilities2, assertHerdrRunnerCapability2, declaredChecks, installCommand, checkServicesFile, checkServices };

package/dist/{chunk-axdmbr61.js → chunk-v43h8s08.js}

@@ -35,14 +35,6 @@ import {
 } from "./chunk-61k67vxh.js";
 import"./chunk-4kssrezn.js";
 import"./chunk-7evwar6b.js";
-import {
-  decodeText,
-  mkString,
-  FileSystem,
-  Path,
-  withDefault,
-  String2
-} from "./chunk-xgwjcq4z.js";
 import {
   SecureRandom,
   layerWebCrypto,
@@ -51,26 +43,34 @@ import {
   schemaBodyJson,
   filterStatusOk,
   get2,
-  layer2,
+  layer4,
   kitmanMcpServer,
   RunnerRpcProtocolVersion
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
+import {
+  decodeText,
+  mkString,
+  FileSystem,
+  Path,
+  withDefault,
+  String2
+} from "./chunk-cy5fbrfm.js";
 import {
   Packument,
   tarballMatches
-} from "./chunk-twp7aprz.js";
-import"./chunk-5j3cxsnp.js";
+} from "./chunk-a1yf46xt.js";
+import"./chunk-23vene3j.js";
 import {
   AgentDeclaration,
   KitDeclarations,
   describeFlag,
   Described
-} from "./chunk-g7vk5tjp.js";
+} from "./chunk-wd0rvdt4.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-mmetyep8.js";
-import"./chunk-148mjppg.js";
+} from "./chunk-5tfxtw9z.js";
+import"./chunk-de4cfe40.js";
 
 // packages/sdk/src/build/index.ts
 class DependencyInstallFailed extends TaggedError2()("DependencyInstallFailed", {
@@ -229,7 +229,7 @@ var fetchNpm = (name, wanted, what) => gen(function* () {
   if (!extracted.ok)
     return yield* failed(`the tarball does not extract: ${failure(extracted)}`);
   return yield* confined(directory, "package", what);
-}).pipe(provide3(layer2));
+}).pipe(provide3(layer4));
 var sourceTree = (directory, source, what, checkouts) => gen(function* () {
   switch (source.kind) {
     case "local_path":

package/dist/{chunk-g7vk5tjp.js → chunk-wd0rvdt4.js}

@@ -80,7 +80,6 @@ import {
   guard
 } from "./chunk-4kssrezn.js";
 import {
-  currentTimeMillis,
   WebCrypto,
   SafeJson,
   AgentSandboxNetwork,
@@ -105,11 +104,12 @@ import {
   KitDigest,
   KitSetup,
   RunnerRpcError
-} from "./chunk-m32wb6t0.js";
+} from "./chunk-qhpyzn7c.js";
 import {
+  currentTimeMillis,
   runForEach,
   FileSystem
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/crypto/internal/webCrypto.js
 var subtleUnavailable = () => new Error("crypto.subtle is unavailable; browsers expose it only in secure contexts");

package/dist/{chunk-wczs5vrq.js → chunk-x3mgznk2.js}

@@ -5,6 +5,7 @@ import {
   pinnedSrtCommand2,
   pinnedSrtStepCommand2,
   runSrtCli2,
+  kitmanCacheDirectory2,
   srtSettings2,
   srtCacheEnvironment2,
   srtInheritedEnv2,
@@ -13,12 +14,13 @@ import {
   writeSrtSettings2,
   srtStepArgv2,
   srtArgv2
-} from "./chunk-xgwjcq4z.js";
+} from "./chunk-cy5fbrfm.js";
 import"./chunk-61k67vxh.js";
 export {
   compiled2 as compiled,
   harnessesUnsupportedInSrt2 as harnessesUnsupportedInSrt,
   inheritedEnvironment2 as inheritedEnvironment,
+  kitmanCacheDirectory2 as kitmanCacheDirectory,
   pinnedSrtCommand2 as pinnedSrtCommand,
   pinnedSrtStepCommand2 as pinnedSrtStepCommand,
   runSrtCli2 as runSrtCli,

package/dist/index.js

@@ -5,15 +5,15 @@
 var args = process.argv.slice(2);
 if (args[0] === "srt") {
   process.argv.splice(2, 1);
-  const { runSrtCli } = await import("./chunk-wczs5vrq.js");
+  const { runSrtCli } = await import("./chunk-x3mgznk2.js");
   await runSrtCli();
 } else if (args[0] === "srt-step") {
   const { runSrtStep } = await import("./chunk-99ver3za.js");
   await runSrtStep(args.slice(1));
 } else if (args[0] === "opencode-read") {
-  const { runOpencodeReader } = await import("./chunk-rjfxnk05.js");
+  const { runOpencodeReader } = await import("./chunk-253add07.js");
   runOpencodeReader();
 } else {
-  const { runCli } = await import("./chunk-dj7pp4w4.js");
+  const { runCli } = await import("./chunk-kyqsbr2n.js");
   runCli(args);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/cli",
-  "version": "0.10.55",
+  "version": "0.10.57",
   "type": "module",
   "license": "UNLICENSED",
   "bin": {