@kitman-sh/cli 0.6.0 → 0.7.0

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env bun
 // @bun
 import {
+  pipeArguments,
   identity,
   isUndefined,
   isNotUndefined,
@@ -18,9 +19,13 @@ import {
   getOrElse,
   fromUndefinedOr,
   getOrUndefined,
-  Service2,
+  Service,
+  add,
+  get,
   Reference,
   of,
+  fromInputUnsafe,
+  isFinite,
   toMillis,
   TaggedError,
   squash,
@@ -29,12 +34,19 @@ import {
   UnknownError,
   succeed2,
   fail2,
-  makeUnsafe2,
+  void_,
+  isSuccess2,
+  isFailure2,
+  makeUnsafe,
   _await,
   isDone,
   isDoneUnsafe,
   doneUnsafe,
+  Scope,
+  makeUnsafe2,
+  addFinalizerExit,
   addFinalizer,
+  close,
   succeed4,
   effect,
   mergeAll,
@@ -54,6 +66,7 @@ import {
   gen,
   fail4,
   try_,
+  withFiber,
   flatMap,
   andThen,
   tap,
@@ -73,22 +86,31 @@ import {
   provide3,
   provideContext,
   provideService,
+  scope,
   scoped,
   acquireRelease,
   addFinalizer2,
   ensuring,
+  onExit,
+  interrupt2,
   uninterruptible,
+  uninterruptibleMask,
   forever,
   forkScoped,
+  runForkWith,
   fnUntraced,
   logWarning,
   logError,
   runMain,
   systemError,
   badArgument,
-  makeUnsafe4,
-  make10,
-  make11,
+  join,
+  interrupt3,
+  getCurrent,
+  runIn,
+  makeUnsafe3,
+  make7,
+  make8,
   offerUnsafe,
   endUnsafe,
   take,
@@ -98,8 +120,6 @@ import {
   isSink,
   fromChannel,
   drain,
-  make12,
-  get2,
   isStream,
   fromChannel2,
   empty2,
@@ -115,9 +135,9 @@ import {
   ExitCode,
   ProcessId,
   makeHandle,
-  make14,
+  make10,
   ChildProcessSpawner,
-  make15,
+  make11,
   parseFdName,
   fdName,
   handleErrnoException,
@@ -158,6 +178,7 @@ import {
   isSyncKitSafe,
   resolveSyncKit,
   decodeJsonString,
+  decodeJsonStringOption,
   encodeJsonStringSync,
   encodePrettyJsonString,
   encodeUnknownJsonStringSync,
@@ -182,11 +203,13 @@ import {
   agentCredentialForApi,
   storeAgentCredential,
   raw,
-  make17,
-  get3,
+  make12,
+  get2,
   put,
   execute,
+  Fetch,
   layer4,
+  KitmanEffectClient,
   digestSha256,
   parseCallbackUrl,
   revokeToken,
@@ -198,11 +221,152 @@ import {
   refreshSession,
   createAgentAuthBearerToken,
   createAgentAuthSignedFetch,
+  RunnerHeaders,
   setupMcpAgentCredential,
   generateAgentKeyPair,
   runCommand2,
-  herdrPiRunnerCapabilities2
-} from "./chunk-txyq8r41.js";
+  detectHarnesses2,
+  herdrRunnerCapabilities2
+} from "./chunk-704ws2q7.js";
+
+// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/internal/rcRef.js
+var TypeId = "~effect/RcRef";
+var stateEmpty = {
+  _tag: "Empty"
+};
+var stateClosed = {
+  _tag: "Closed"
+};
+var variance = {
+  _A: identity,
+  _E: identity
+};
+
+class RcRefImpl {
+  [TypeId] = variance;
+  pipe() {
+    return pipeArguments(this, arguments);
+  }
+  state = stateEmpty;
+  acquire;
+  context;
+  scope;
+  idleTimeToLive;
+  constructor(acquire, context, scope, idleTimeToLive) {
+    this.acquire = acquire;
+    this.context = context;
+    this.scope = scope;
+    this.idleTimeToLive = idleTimeToLive;
+  }
+}
+var make = (options) => withFiber((fiber) => {
+  const context = fiber.context;
+  const scope = get(context, Scope);
+  const ref = new RcRefImpl(options.acquire, context, scope, options.idleTimeToLive !== undefined ? fromInputUnsafe(options.idleTimeToLive) : undefined);
+  return as(addFinalizerExit(scope, () => {
+    const state = ref.state;
+    ref.state = stateClosed;
+    if (state._tag === "Acquired")
+      return close(state.scope, void_);
+    if (state._tag === "Acquiring")
+      return interrupt3(state.fiber);
+    return void_2;
+  }), ref);
+});
+var getState = (self, restore) => {
+  switch (self.state._tag) {
+    case "Closed": {
+      return interrupt2;
+    }
+    case "Acquired": {
+      const state = self.state;
+      state.refCount++;
+      return state.fiber ? as(interrupt3(state.fiber), state) : succeed5(state);
+    }
+    case "Acquiring": {
+      const state = self.state;
+      state.awaiters++;
+      return awaitAcquiring(self, state, restore);
+    }
+    case "Empty": {
+      const acquiring = {
+        _tag: "Acquiring",
+        fiber: undefined,
+        awaiters: 1,
+        acquired: undefined
+      };
+      self.state = acquiring;
+      const scope = makeUnsafe2();
+      const acquire = provideContext(self.acquire, add(self.context, Scope, scope)).pipe(flatMap((value) => {
+        if (self.state !== acquiring) {
+          return interrupt2;
+        }
+        const state = {
+          _tag: "Acquired",
+          value,
+          scope,
+          fiber: undefined,
+          refCount: acquiring.awaiters,
+          invalidated: false
+        };
+        self.state = state;
+        acquiring.acquired = state;
+        return succeed5(state);
+      }), onExit((exit) => {
+        if (isSuccess2(exit))
+          return void_2;
+        if (self.state === acquiring)
+          self.state = stateEmpty;
+        return close(scope, exit);
+      }));
+      acquiring.fiber = runForkWith(getCurrent().context)(acquire);
+      return awaitAcquiring(self, acquiring, restore);
+    }
+  }
+};
+var awaitAcquiring = (self, acquiring, restore) => onExit(restore(join(acquiring.fiber)), (exit) => {
+  const acquired = acquiring.acquired;
+  if (acquired !== undefined) {
+    return isFailure2(exit) ? release(self, acquired) : void_2;
+  }
+  if (--acquiring.awaiters > 0 || self.state !== acquiring)
+    return void_2;
+  self.state = stateEmpty;
+  return interrupt3(acquiring.fiber);
+});
+var get3 = (self_) => {
+  const self = self_;
+  return uninterruptibleMask((restore) => flatMap(scope, (scope) => flatMap(getState(self, restore), (state) => as(addFinalizerExit(scope, () => release(self, state)), state.value))));
+};
+var release = (self, state) => {
+  state.refCount--;
+  if (state.refCount > 0) {
+    return void_2;
+  }
+  const idleTimeToLive = self.idleTimeToLive;
+  if (idleTimeToLive === undefined || state.invalidated) {
+    if (self.state === state) {
+      self.state = stateEmpty;
+    }
+    return close(state.scope, void_);
+  } else if (!isFinite(idleTimeToLive)) {
+    return void_2;
+  }
+  state.fiber = uninterruptibleMask((restore) => flatMap(restore(sleep(idleTimeToLive)), () => {
+    if (self.state === state && state.refCount === 0) {
+      self.state = stateEmpty;
+      return close(state.scope, void_);
+    }
+    return void_2;
+  })).pipe(ensuring(sync(() => {
+    state.fiber = undefined;
+  })), runForkWith(self.context), runIn(self.scope));
+  return void_2;
+};
+
+// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/RcRef.js
+var make2 = make;
+var get4 = get3;
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeChildProcessSpawner.js
 import * as NodeChildProcess from "child_process";
@@ -290,8 +454,8 @@ var fromReadableChannel = (options) => fromTransform((_, scope) => readableToPul
 var readableToPullUnsafe = (options) => {
   const readable = options.readable;
   const closeOnDone = options.closeOnDone ?? true;
-  const exit = options.exit ?? make10(undefined);
-  const latch = options.latch ?? makeUnsafe4(false);
+  const exit = options.exit ?? make7(undefined);
+  const latch = options.latch ?? makeUnsafe3(false);
   function onReadable() {
     latch.openUnsafe();
   }
@@ -380,7 +544,7 @@ var taskkill = (childProcess, onExit = () => {}) => {
     windowsHide: true
   }, onExit);
 };
-var make = /* @__PURE__ */ gen(function* () {
+var make3 = /* @__PURE__ */ gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
   const resolveWorkingDirectory = fnUntraced(function* (options) {
@@ -582,7 +746,7 @@ var make = /* @__PURE__ */ gen(function* () {
     };
   };
   const spawn2 = (command, spawnOptions) => callback((resume) => {
-    const deferred = makeUnsafe2();
+    const deferred = makeUnsafe();
     const handle = NodeChildProcess.spawn(command.command, command.args, spawnOptions);
     handle.on("error", (error) => {
       resume(fail4(toPlatformError("spawn", error, command)));
@@ -782,7 +946,7 @@ var make = /* @__PURE__ */ gen(function* () {
           const sourceStream = unwrap(succeed5(getSourceStream(handles[handles.length - 1], options.from)));
           const toOption = options.to ?? "stdin";
           if (toOption === "stdin") {
-            handles.push(yield* spawnCommand(make15(command.command, command.args, {
+            handles.push(yield* spawnCommand(make11(command.command, command.args, {
               ...command.options,
               stdin: {
                 ...stdinConfig,
@@ -794,7 +958,7 @@ var make = /* @__PURE__ */ gen(function* () {
             if (isNotUndefined(fd)) {
               const fdName2 = fdName(fd);
               const existingFds = command.options.additionalFds ?? {};
-              handles.push(yield* spawnCommand(make15(command.command, command.args, {
+              handles.push(yield* spawnCommand(make11(command.command, command.args, {
                 ...command.options,
                 additionalFds: {
                   ...existingFds,
@@ -805,7 +969,7 @@ var make = /* @__PURE__ */ gen(function* () {
                 }
               })));
             } else {
-              handles.push(yield* spawnCommand(make15(command.command, command.args, {
+              handles.push(yield* spawnCommand(make11(command.command, command.args, {
                 ...command.options,
                 stdin: {
                   ...stdinConfig,
@@ -844,9 +1008,9 @@ var make = /* @__PURE__ */ gen(function* () {
       }
     }
   });
-  return make14(spawnCommand);
+  return make10(spawnCommand);
 });
-var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make);
+var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make3);
 var flattenCommand = (command) => {
   const commands = [];
   const pipeOptions = [];
@@ -877,10 +1041,10 @@ var flattenCommand = (command) => {
 };
 
 // node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Stdio.js
-var TypeId = "~effect/Stdio";
-var Stdio = /* @__PURE__ */ Service2(TypeId);
-var make2 = (options) => ({
-  [TypeId]: TypeId,
+var TypeId2 = "~effect/Stdio";
+var Stdio = /* @__PURE__ */ Service(TypeId2);
+var make4 = (options) => ({
+  [TypeId2]: TypeId2,
   stdinIsTerminal: succeed5(false),
   stdoutIsTerminal: succeed5(false),
   stderrIsTerminal: succeed5(false),
@@ -888,7 +1052,7 @@ var make2 = (options) => ({
 });
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeStdio.js
-var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make2({
+var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make4({
   args: /* @__PURE__ */ sync(() => process.argv.slice(2)),
   stdinIsTerminal: /* @__PURE__ */ sync(() => process.stdin.isTTY === true),
   stdoutIsTerminal: /* @__PURE__ */ sync(() => process.stdout.isTTY === true),
@@ -929,7 +1093,7 @@ var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make2({
 var layer7 = layer6;
 
 // node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Terminal.js
-var TypeId2 = "~effect/Terminal";
+var TypeId3 = "~effect/Terminal";
 var QuitErrorTypeId = "~effect/Terminal/QuitError";
 
 class QuitError extends (/* @__PURE__ */ Error2("QuitError")({
@@ -937,18 +1101,18 @@ class QuitError extends (/* @__PURE__ */ Error2("QuitError")({
 })) {
   [QuitErrorTypeId] = QuitErrorTypeId;
 }
-var Terminal = /* @__PURE__ */ Service2("effect/Terminal");
-var make3 = (impl) => Terminal.of({
+var Terminal = /* @__PURE__ */ Service("effect/Terminal");
+var make5 = (impl) => Terminal.of({
   ...impl,
-  [TypeId2]: TypeId2
+  [TypeId3]: TypeId3
 });
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeTerminal.js
 import * as readline from "readline";
-var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
+var make6 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
   const stdin = process.stdin;
   const stdout = process.stdout;
-  const lines = yield* make11();
+  const lines = yield* make8();
   let inputEnded = stdin.readableEnded;
   let readlineActive = false;
   const onStdinEnd = () => {
@@ -959,7 +1123,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
   };
   stdin.once("end", onStdinEnd);
   yield* addFinalizer2(() => sync(() => stdin.off("end", onStdinEnd)));
-  const rlRef = yield* make12({
+  const rlRef = yield* make2({
     acquire: acquireRelease(sync(() => {
       const rl = readline.createInterface({
         input: stdin,
@@ -1003,7 +1167,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
   const columns = sync(() => stdout.columns ?? 0);
   const rows = sync(() => stdout.rows ?? 0);
   const readInput = gen(function* () {
-    const queue = yield* make11();
+    const queue = yield* make8();
     const handleKeypress = (s, k) => {
       const userInput = {
         input: fromUndefinedOr(s),
@@ -1033,13 +1197,13 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
     if (inputEnded) {
       handleEnd();
     } else {
-      yield* get2(rlRef);
+      yield* get4(rlRef);
       stdin.once("end", handleEnd);
     }
     return queue;
   });
   const readLine = suspend(() => poll(lines).pipe(flatMap(match({
-    onNone: () => scoped(andThen(get2(rlRef), take(lines))),
+    onNone: () => scoped(andThen(get4(rlRef), take(lines))),
     onSome: succeed5
   })), mapError(() => new QuitError({}))));
   const display = (prompt2) => uninterruptible(callback((resume) => {
@@ -1050,7 +1214,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
       cause: err
     }))));
   }));
-  return make3({
+  return make5({
     columns,
     rows,
     readInput,
@@ -1058,7 +1222,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
     display
   });
 });
-var layer8 = /* @__PURE__ */ effect(Terminal, /* @__PURE__ */ make4(defaultShouldQuit));
+var layer8 = /* @__PURE__ */ effect(Terminal, /* @__PURE__ */ make6(defaultShouldQuit));
 function defaultShouldQuit(input) {
   const key = input.key;
   return key.name === "escape" || key.ctrl && (key.name === "c" || key.name === "d");
@@ -1105,9 +1269,14 @@ function createHerdrRunnerClient(input) {
       credential,
       ...input.fetch === undefined ? undefined : { fetch: input.fetch }
     });
+    const runnerFetch = (requestInput, init) => {
+      const request = new Request(requestInput, init);
+      request.headers.set(RunnerHeaders.runnerId, input.runnerId);
+      return signedFetch(request);
+    };
     const client = yield* createSdkClient({
       apiUrl: input.apiUrl,
-      fetch: signedFetch,
+      fetch: runnerFetch,
       session: { accessToken: "runner-agent-auth" }
     });
     const rpcBearer = createAgentAuthBearerToken({
@@ -1341,6 +1510,16 @@ function queryString(query) {
   return query.size === 0 ? "" : `?${query.toString()}`;
 }
 
+// packages/core/src/check-scripts.ts
+var verificationScripts = ["typecheck", "type-check", "lint", "test", "check"];
+function declaredChecks(manifest, rootFiles) {
+  const value = manifest === undefined ? undefined : getOrUndefined(decodeJsonStringOption(manifest));
+  const scripts = isJsonObject(value) && isJsonObject(value.scripts) ? value.scripts : {};
+  const has = (file) => rootFiles.includes(file);
+  const runner = has("bun.lock") || has("bun.lockb") ? "bun run" : has("pnpm-lock.yaml") ? "pnpm run" : has("yarn.lock") ? "yarn" : "npm run";
+  return verificationScripts.flatMap((name) => (name in scripts) ? [{ name, command: `${runner} ${name}` }] : []);
+}
+
 // apps/cli/src/init.ts
 import { hostname } from "os";
 
@@ -1455,11 +1634,12 @@ function stripPathSuffix(value) {
 }
 
 // apps/cli/src/init.ts
-var RunnerService = Reference("kitman/cli/RunnerService", { defaultValue: () => userService });
+var ServiceManager = Reference("kitman/cli/ServiceManager", {
+  defaultValue: () => ({ platform: process.platform, run: (command, args) => runCommand2(command, args) })
+});
 var Login = Reference("kitman/cli/Login", {
   defaultValue: () => browserSession
 });
-var verificationScripts = ["typecheck", "type-check", "lint", "test", "check"];
 var outcomeLabel = {
   set_up: "set up",
   already: "already set up",
@@ -1515,6 +1695,34 @@ function initCommand(args) {
     yield* log(changed.length === 0 ? "Nothing to change: Kitman is already set up here." : `Set up ${changed.map((entry) => entry.name).join(", ")}. Start work with kitman run start build "<what to build>".`);
   });
 }
+function pairCommand(args) {
+  return gen(function* () {
+    const [code, ...rest] = args;
+    if (code === undefined || code.startsWith("-"))
+      return yield* new CliError({ message: "Usage: kitman pair <pairing code> [--api-url <url>]" });
+    const flags = parseInitFlags(rest);
+    const apiUrl = yield* resolveApiUrl(flags.apiUrl);
+    const step = (name, outcome, detail) => log(`${name}: ${outcomeLabel[outcome]} (${detail})`);
+    const anonymous = new KitmanEffectClient({ baseUrl: apiUrl, fetch: yield* Fetch });
+    const credentials = yield* anonymous.redeemPairingCode({ code });
+    const session = toStoredSession({
+      access_token: credentials.accessToken,
+      ...credentials.refreshToken === undefined ? undefined : { refresh_token: credentials.refreshToken },
+      ...credentials.expiresIn === undefined ? undefined : { expires_in: credentials.expiresIn }
+    });
+    yield* storeSession(apiUrl, session);
+    yield* writeUserConfig({ ...yield* readUserConfig(), apiUrl, activeWorkspaceId: credentials.workspaceId });
+    yield* step("Login", "set_up", apiUrl);
+    const client = yield* clientFor(apiUrl, session);
+    yield* runnerStep(client, { apiUrl, session, workspaceId: credentials.workspaceId, userId: credentials.userId }, step);
+    const detected = yield* detectHarnesses2;
+    if (detected.harnesses.length === 0)
+      return yield* step("Harness", "skipped", `none logged in: ${detected.unavailable.map((harness) => harness.missing.join(", ")).join("; ")}`);
+    const harnesses = detected.harnesses.map((harness) => harness === "claude" ? "claude-code" : harness);
+    yield* harnessSync(["sync", ...harnesses]);
+    yield* step("Harness", "set_up", `${harnesses.join(", ")} synced`);
+  });
+}
 var parseInitFlags = (args) => {
   const flags = { yes: false };
   for (let index = 0;index < args.length; index += 1) {
@@ -1558,7 +1766,7 @@ var runnerStep = (client, input, step) => gen(function* () {
   const existing = runners.find((runner) => runner.ownership.kind === "personal" && runner.ownership.ownerUserId === input.userId && runner.name === name && runner.status === "active");
   const runner = existing ?? (yield* client.registerRunner(input.workspaceId, {
     name,
-    capabilities: herdrPiRunnerCapabilities2(),
+    capabilities: herdrRunnerCapabilities2({ harnesses: yield* detectHarnesses2 }),
     labels: ["kitman-runner", "kitman-loop", "herdr"]
   })).runner;
   const credentialMissing = agentCredentialForApi(yield* readAuthStore(), input.apiUrl, `herdr-runner:${runner.id}`) === undefined;
@@ -1566,8 +1774,8 @@ var runnerStep = (client, input, step) => gen(function* () {
     yield* ensureHerdrRunnerCredential({ apiUrl: input.apiUrl, accessToken: input.session.accessToken, runner });
   yield* step("Runner", existing === undefined ? "set_up" : credentialMissing ? "repaired" : "already", `${name}${credentialMissing && existing !== undefined ? ", credential restored" : ""}`);
   const home = yield* String3("HOME");
-  const service = yield* (yield* RunnerService)({
-    name: `kitman-runner-${runner.id}`,
+  const service = yield* runnerService({
+    name: runnerServiceName(runner.id),
     command: [...kitmanCommand(), "runner", "start", runner.id, "--api-url", input.apiUrl],
     workingDirectory: home,
     path: getOrElse(yield* option2(String3("PATH")), () => "/usr/local/bin:/usr/bin:/bin")
@@ -1603,14 +1811,8 @@ var scriptChecks = gen(function* () {
   const path = yield* Path;
   const top = yield* (yield* Git)(["rev-parse", "--show-toplevel"]).pipe(orElseSucceed(() => ""));
   const root = top === "" ? path.resolve(".") : top;
-  const manifest = yield* readText(path.join(root, "package.json"));
-  const parsed = manifest === undefined ? undefined : yield* decodeJsonString(manifest).pipe(orElseSucceed(() => {
-    return;
-  }));
-  const scripts = isJsonObject(parsed) && isJsonObject(parsed.scripts) ? parsed.scripts : {};
-  const has = (file) => fs.exists(path.join(root, file));
-  const runner = (yield* has("bun.lock")) || (yield* has("bun.lockb")) ? "bun run" : (yield* has("pnpm-lock.yaml")) ? "pnpm run" : (yield* has("yarn.lock")) ? "yarn" : "npm run";
-  return verificationScripts.flatMap((name) => (name in scripts) ? [{ name, command: `${runner} ${name}` }] : []);
+  const rootFiles = yield* fs.readDirectory(root).pipe(orElseSucceed(() => []));
+  return declaredChecks(yield* readText(path.join(root, "package.json")), rootFiles);
 });
 var systemdUnit = (spec) => [
   "[Unit]",
@@ -1644,12 +1846,28 @@ var launchdPlist = (label, spec) => [
 ].join(`
 `);
 var escapeXml = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-function userService(spec) {
+var runnerServiceName = (runnerId) => `kitman-runner-${runnerId}`;
+var launchdLabel = (name) => `dev.kitman.${name}`;
+var launchdDomain = gen(function* () {
+  const manager = yield* ServiceManager;
+  return `gui/${(yield* manager.run("id", ["-u"])).trim()}`;
+});
+function runnerServiceState(name) {
+  return gen(function* () {
+    const manager = yield* ServiceManager;
+    if (manager.platform === "linux")
+      return yield* manager.run("systemctl", ["--user", "is-active", `${name}.service`]).pipe(map3((state) => `systemd: ${state.trim()}`), orElseSucceed(() => "systemd: not running"));
+    if (manager.platform === "darwin")
+      return yield* manager.run("launchctl", ["print", `${yield* launchdDomain}/${launchdLabel(name)}`]).pipe(map3((printed) => `launchd: ${/^\s*state = (\S+)/mu.exec(printed)?.[1] ?? "loaded"}`), orElseSucceed(() => "launchd: not installed"));
+    return;
+  });
+}
+function runnerService(spec) {
   return gen(function* () {
     const fs = yield* FileSystem;
     const path = yield* Path;
+    const manager = yield* ServiceManager;
     const home = yield* String3("HOME");
-    const succeeded = (command, args) => runCommand2(command, args).pipe(as(true), orElseSucceed(() => false));
     const define = (file, content) => gen(function* () {
       if ((yield* readText(file)) === content)
         return false;
@@ -1657,25 +1875,25 @@ function userService(spec) {
       yield* fs.writeFileString(file, content);
       return true;
     });
-    if (process.platform === "linux") {
+    if (manager.platform === "linux") {
       const unit = `${spec.name}.service`;
       const changed = yield* define(path.join(home, ".config", "systemd", "user", unit), systemdUnit(spec));
-      if (!changed && (yield* succeeded("systemctl", ["--user", "is-active", "--quiet", unit])))
+      if (!changed && (yield* runnerServiceState(spec.name)) === "systemd: active")
         return "running";
-      yield* runCommand2("systemctl", ["--user", "daemon-reload"]);
-      yield* runCommand2("systemctl", ["--user", "enable", unit]);
-      yield* runCommand2("systemctl", ["--user", "restart", unit]);
+      yield* manager.run("systemctl", ["--user", "daemon-reload"]);
+      yield* manager.run("systemctl", ["--user", "enable", unit]);
+      yield* manager.run("systemctl", ["--user", "restart", unit]);
       return changed ? "installed" : "started";
     }
-    if (process.platform === "darwin") {
-      const label = `dev.kitman.${spec.name}`;
+    if (manager.platform === "darwin") {
+      const label = launchdLabel(spec.name);
       const file = path.join(home, "Library", "LaunchAgents", `${label}.plist`);
       const changed = yield* define(file, launchdPlist(label, spec));
-      const domain = `gui/${(yield* runCommand2("id", ["-u"])).trim()}`;
-      if (!changed && (yield* succeeded("launchctl", ["print", `${domain}/${label}`])))
+      if (!changed && (yield* runnerServiceState(spec.name)) === "launchd: running")
         return "running";
-      yield* succeeded("launchctl", ["bootout", `${domain}/${label}`]);
-      yield* runCommand2("launchctl", ["bootstrap", domain, file]);
+      const domain = yield* launchdDomain;
+      yield* ignore(manager.run("launchctl", ["bootout", `${domain}/${label}`]));
+      yield* manager.run("launchctl", ["bootstrap", domain, file]);
       return changed ? "installed" : "started";
     }
     return "unsupported";
@@ -1711,7 +1929,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.6.0";
+var cliVersion = "0.7.0";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1831,7 +2049,7 @@ var scaffoldPackage = (directory, scaffold = {}) => gen(function* () {
   const path = yield* Path;
   const root = path.resolve(directory);
   if (scaffold.fork !== undefined) {
-    const { shippedLoops } = yield* promise(() => import("./chunk-dsefng1v.js"));
+    const { shippedLoops } = yield* promise(() => import("./chunk-epdajq63.js"));
     if (!(scaffold.fork in shippedLoops))
       return yield* new CliError({
         message: `Kitman ships no Loop ${scaffold.fork}; fork one of ${Object.keys(shippedLoops).join(", ")}`
@@ -1863,10 +2081,11 @@ var scaffoldPackage = (directory, scaffold = {}) => gen(function* () {
 // apps/cli/src/commands.ts
 var ClientId = "kitman-cli";
 var Usage = [
-  "Usage: kitman <init|run|inbox|loop|agent|deploy|package|verify|secret|constraint|mcp|sync|whoami|config|kit|task|memory|proposal|decision|context|schedule|delivery|reconcile|lifecycle|logout> [options]",
+  "Usage: kitman <init|pair|run|inbox|loop|agent|deploy|package|verify|secret|constraint|mcp|sync|whoami|config|kit|task|memory|proposal|decision|context|schedule|delivery|reconcile|lifecycle|logout> [options]",
   "",
   "Set up, in a repository (run it again to repair what is missing):",
   "  kitman init [--yes] [--api-url <url>]",
+  "  kitman pair <pairing code> [--api-url <url>]   (what the command the web shows runs)",
   "",
   "Runs:",
   '  kitman run start <loop> "<words>" [--input <json>] [--project <project>] [--type <task type>] [--constraint <text>]...',
@@ -1924,7 +2143,7 @@ var Usage = [
 `);
 var KitCreateValidator = guard(KitCreate);
 var KitUpdateValidator = guard(KitUpdate);
-var agentRuntime = promise(() => import("./chunk-3j7sewn0.js"));
+var agentRuntime = promise(() => import("./chunk-vjnae06n.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -1951,6 +2170,8 @@ function runEffect(args) {
       return yield* scaffoldPackage(rest[1] ?? ".");
     if (command === "init")
       return yield* initCommand(rest);
+    if (command === "pair")
+      return yield* pairCommand(rest);
     if (command === "login")
       return yield* login(rest);
     if (command === "logout")
@@ -3108,7 +3329,7 @@ function runnerCommand(args) {
         ...command.flags.agentIdentityId === undefined ? undefined : { agentIdentityId: command.flags.agentIdentityId },
         ...ownership === undefined ? undefined : { ownership },
         ...command.flags.project === undefined ? undefined : { projectId: command.flags.project },
-        capabilities: herdr ? (yield* agentRuntime).herdrPiRunnerCapabilities() : loopRunnerCapabilities(),
+        capabilities: herdr ? (yield* agentRuntime).herdrRunnerCapabilities({ harnesses: yield* (yield* agentRuntime).detectHarnesses }) : loopRunnerCapabilities(),
         labels: herdr ? ["kitman-runner", "kitman-loop", "herdr"] : ["kitman-runner", "kitman-loop"]
       });
       const setup = response.setup;
@@ -3154,7 +3375,7 @@ function runnerCommand(args) {
     if (command.action === "doctor") {
       const runners = yield* client.listRunners(workspaceId);
       if (command.flags.runnerId === undefined && command.args.length === 0 && command.flags.backend === undefined)
-        return yield* runners.items.length === 0 ? printRows([{ status: "no_runners", workspaceId, message: "No Runner registered for workspace." }], command.flags.json) : printRows(runners.items.map(runnerDoctorRow), command.flags.json);
+        return yield* runners.items.length === 0 ? printRows([{ status: "no_runners", workspaceId, message: "No Runner registered for workspace." }], command.flags.json) : printRows(yield* forEach(runners.items, runnerDoctorRowHere), command.flags.json);
       const runner = command.flags.runnerId === undefined && command.args.length === 0 ? runners.items.find((item) => item.status === "active") ?? runners.items[0] : resolveRunnerRef(runners.items, command.flags.runnerId ?? command.args.join(" "));
       if (runner === undefined) {
         const rows = [{ status: "no_runners", workspaceId, message: "No Runner registered for workspace." }];
@@ -3166,7 +3387,7 @@ function runnerCommand(args) {
         const readiness = yield* checkHerdrRunnerReadiness(runner);
         return yield* printRows([readiness], command.flags.json);
       }
-      return yield* printRows([runnerDoctorRow(runner)], command.flags.json);
+      return yield* printRows([yield* runnerDoctorRowHere(runner)], command.flags.json);
     }
     return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
   });
@@ -3207,12 +3428,14 @@ function startCanonicalHerdrRunnerCommand(input) {
       agentStepExecutor,
       agentStepSandboxPolicy,
       assertHerdrRunnerCapability,
+      bundleCacheDir,
       dockerContainerRunner,
       herdrAgentBackendLayer,
       herdrExecutorSurface,
       herdrHarnessLayer,
-      herdrPiRunnerCapabilities,
-      herdrPiRunnerCapabilitiesForRepoBinding,
+      detectHarnesses,
+      herdrRunnerCapabilities,
+      herdrRunnerCapabilitiesForRepoBinding,
       kitmanBundles,
       kitmanMcpPreflight,
       listenForSignals,
@@ -3226,7 +3449,7 @@ function startCanonicalHerdrRunnerCommand(input) {
       superviseReplica,
       verificationExecutor
     } = yield* agentRuntime;
-    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-6h8ghah0.js"));
+    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-gzhxsb25.js"));
     const settings = yield* runnerSettings;
     const { concurrency, fullAccess, sshAgentAvailable } = settings;
     const personal = input.runner.ownership.kind === "personal";
@@ -3237,7 +3460,9 @@ function startCanonicalHerdrRunnerCommand(input) {
         message: `\`${sandbox}\` is not available on this host (${host.unavailable.find((entry) => entry.backend === sandbox)?.missing.join("; ") ?? "unsupported"}); unset KITMAN_RUNNER_SANDBOX to run agents on the host.`
       });
     const repoBinding = input.projectId === undefined ? undefined : (yield* input.client.listRepoBindings(input.projectId)).items.find((binding) => binding.status === "active");
-    const advertisedCapabilities = repoBinding === undefined ? herdrPiRunnerCapabilities({ fullAccess, sandbox: host, shared: !personal }) : herdrPiRunnerCapabilitiesForRepoBinding(repoBinding, {
+    const harnesses = yield* detectHarnesses;
+    const advertisedCapabilities = repoBinding === undefined ? herdrRunnerCapabilities({ harnesses, fullAccess, sandbox: host, shared: !personal }) : herdrRunnerCapabilitiesForRepoBinding(repoBinding, {
+      harnesses,
       fullAccess,
       sandbox: host,
       shared: !personal,
@@ -3253,11 +3478,12 @@ function startCanonicalHerdrRunnerCommand(input) {
       accessToken: input.accessToken,
       runner: input.runner
     });
-    const controlPlane = yield* createHerdrRunnerClient({ apiUrl: input.apiUrl, credential });
+    const controlPlane = yield* createHerdrRunnerClient({ apiUrl: input.apiUrl, runnerId: input.runner.id, credential });
     const fs = yield* FileSystem;
     const path = yield* Path;
     const runnerRootDir = yield* herdrRunnerRootDir;
     yield* fs.makeDirectory(path.join(runnerRootDir, ".kitman", "worktrees"), { recursive: true });
+    yield* fs.makeDirectory(bundleCacheDir, { recursive: true });
     const replica = yield* controlPlane.client.registerRunnerReplica(input.runner.id, {
       name: `replica-${createId()}`,
       capacity: { maxConcurrentRuns: concurrency },
@@ -3266,17 +3492,15 @@ function startCanonicalHerdrRunnerCommand(input) {
     const backend = herdrExecutorSurface({ runnerId: input.runner.id, session: personal ? "default" : "own" });
     const uid = process.getuid?.();
     const gid = process.getgid?.();
+    const docker = host.backends.includes("docker") && settings.dockerImage !== undefined ? {
+      containers: yield* dockerContainerRunner,
+      image: settings.dockerImage,
+      ...uid === undefined || gid === undefined ? undefined : { user: `${uid}:${gid}` }
+    } : undefined;
     const root = herdrAgentBackendLayer({
       client: () => backend.executionClient,
       sandboxBackends: host.backends,
-      ...host.backends.includes("docker") && settings.dockerImage !== undefined ? {
-        docker: {
-          containers: yield* dockerContainerRunner,
-          image: settings.dockerImage,
-          runnerId: input.runner.id,
-          ...uid === undefined || gid === undefined ? undefined : { user: `${uid}:${gid}` }
-        }
-      } : undefined
+      ...docker === undefined ? undefined : { docker: { ...docker, runnerId: input.runner.id } }
     }).pipe(provide2(herdrHarnessLayer({ client: () => backend.executionClient })), provide2(layer10));
     const activeSlots = new Set;
     return yield* gen(function* () {
@@ -3303,7 +3527,6 @@ function startCanonicalHerdrRunnerCommand(input) {
         const bundles = yield* kitmanBundles({
           fetch: (digest) => rpc.bundle(digest).pipe(map3((found) => found.bundle))
         });
-        const runPackageProgram = programProcessExecutor({ bundles, apiUrl: input.apiUrl });
         const checkouts = runCheckouts(path.join(runnerRootDir, ".kitman"));
         const platform = yield* context();
         yield* listenForSignals({
@@ -3314,6 +3537,21 @@ function startCanonicalHerdrRunnerCommand(input) {
           reconnectAfter: "2 seconds"
         }).pipe(forkScoped);
         const authStore = yield* userAuthPath;
+        const runnerState = {
+          workRoot: path.join(runnerRootDir, ".kitman"),
+          bundleCache: path.resolve(bundleCacheDir),
+          kitmanConfigDir: path.dirname(authStore),
+          authStore
+        };
+        const sharedSandbox = personal ? undefined : {
+          runner: runnerState,
+          ...docker !== undefined ? { backend: "docker", docker, runnerId: input.runner.id } : { backend: host.backends.includes("srt") ? "srt" : undefined }
+        };
+        const runPackageProgram = programProcessExecutor({
+          bundles,
+          apiUrl: input.apiUrl,
+          ...sharedSandbox === undefined ? undefined : { sandbox: sharedSandbox }
+        });
         const agentLaunch = (brief, stepCredential) => ({
           brief,
           stepCredential,
@@ -3338,7 +3576,7 @@ function startCanonicalHerdrRunnerCommand(input) {
             },
             sandbox: {
               backend: work.sandbox ?? sandbox,
-              policy: agentStepSandboxPolicy(work, input.apiUrl, authStore)
+              policy: agentStepSandboxPolicy(work, input.apiUrl, runnerState)
             },
             settled: heartbeatOf(work).pipe(map3((state) => state.settled || state.outputSubmitted === true)),
             steering: {
@@ -3349,7 +3587,8 @@ function startCanonicalHerdrRunnerCommand(input) {
         });
         const runVerification = verificationExecutor({
           rootDir: path.join(runnerRootDir, ".kitman"),
-          known: rpcKnownEvidence(rpc)
+          known: rpcKnownEvidence(rpc),
+          ...sharedSandbox === undefined ? undefined : { sandbox: { ...sharedSandbox, apiUrl: input.apiUrl } }
         });
         yield* acquireRelease(backend.start(), () => backend.stop());
         const control = (capacitySlot) => ({
@@ -3414,8 +3653,7 @@ function checkHerdrRunnerReadiness(runner) {
 function herdrReadinessCode(error) {
   const message = error instanceof Error ? error.message : "";
   const known = new Set([
-    "herdr_linux_required",
-    "herdr_pi_unavailable",
+    "herdr_platform_unsupported",
     "herdr_protocol_mismatch",
     "herdr_readiness_timeout",
     "herdr_socket_ownership_unknown",
@@ -3429,7 +3667,7 @@ function mcpCommand(args) {
     if (command.action === "run") {
       if (command.args.length > 0)
         return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
-      const { runMcpServerCommand } = yield* promise(() => import("./chunk-tfr74ays.js"));
+      const { runMcpServerCommand } = yield* promise(() => import("./chunk-226sychh.js"));
       return yield* runMcpServerCommand({ flags: command.flags });
     }
     if (command.action !== "setup")
@@ -4449,7 +4687,7 @@ function secretCommand(args) {
   });
 }
 var PackageBuilder = Reference("kitman/cli/PackageBuilder", {
-  defaultValue: () => (directory) => flatMap(promise(() => import("./chunk-h8ctzn91.js")), (build) => build.buildPackage(directory))
+  defaultValue: () => (directory) => flatMap(promise(() => import("./chunk-hrd7xmax.js")), (build) => build.buildPackage(directory))
 });
 var optionalEnv = (name) => String3(name).pipe(option2, map3(getOrUndefined));
 var ciIdToken = (apiUrl) => gen(function* () {
@@ -4463,7 +4701,7 @@ var ciIdToken = (apiUrl) => gen(function* () {
   const url = new URL(requestUrl);
   const refused = (reason) => new CliError({ message: `GitHub Actions issued no ID token: ${reason}` });
   url.searchParams.set("audience", apiUrl.replace(/\/+$/, ""));
-  const response = yield* send(get3(url, { headers: { authorization: `Bearer ${requestToken}` } }), (cause) => refused(String(cause)));
+  const response = yield* send(get2(url, { headers: { authorization: `Bearer ${requestToken}` } }), (cause) => refused(String(cause)));
   if (response.status < 200 || response.status >= 300)
     return yield* refused(`${response.status}; does the job have id-token: write?`);
   const body = yield* response.text.pipe(mapError((error) => refused(error.message)));
@@ -5225,6 +5463,8 @@ function runnerRow(runner) {
     health: runner.healthStatus,
     agentIdentityId: runner.agentIdentityId,
     harnesses: runner.capabilities.harnesses.join(","),
+    defaultHarness: runner.capabilities.defaultHarness ?? "",
+    unavailableHarnesses: (runner.capabilities.harnessUnavailable ?? []).map((entry) => `${entry.harness}: ${entry.missing.join(", ")}`).join("; "),
     executionBackends: runner.capabilities.executionBackends?.join(",") ?? "",
     sandboxes: runner.capabilities.sandboxBackends.join(","),
     labels: runner.labels.join(","),
@@ -5258,6 +5498,8 @@ function runnerDoctorRow(runner) {
     health: runner.healthStatus,
     runs: runner.capabilities.runs?.supported === true,
     harnesses: runner.capabilities.harnesses.join(","),
+    defaultHarness: runner.capabilities.defaultHarness ?? "",
+    unavailableHarnesses: (runner.capabilities.harnessUnavailable ?? []).map((entry) => `${entry.harness}: ${entry.missing.join(", ")}`).join("; "),
     executionBackends: runner.capabilities.executionBackends?.join(",") ?? "",
     sandboxes: runner.capabilities.sandboxBackends.join(","),
     agentSteps: runner.capabilities.runs?.stepKinds.includes("agent") === true,
@@ -5265,6 +5507,10 @@ function runnerDoctorRow(runner) {
     maxConcurrentRuns: runner.capabilities.resourceLimits?.maxConcurrentRuns
   };
 }
+var runnerDoctorRowHere = (runner) => map3(runnerServiceState(runnerServiceName(runner.id)), (service) => ({
+  ...runnerDoctorRow(runner),
+  ...service === undefined ? undefined : { service }
+}));
 function taskRow(task) {
   return {
     id: task.id,
@@ -5342,7 +5588,7 @@ function downloadPresignedAsset(download, outputPath) {
   return gen(function* () {
     const fs = yield* FileSystem;
     const failed = (cause) => new CliError({ message: `Asset download failed: ${String(cause)}` });
-    const response = yield* send(make17(download.method)(download.url), failed);
+    const response = yield* send(make12(download.method)(download.url), failed);
     if (response.status < 200 || response.status >= 300)
       return yield* new CliError({ message: `Asset download failed with ${response.status}` });
     const body = yield* response.arrayBuffer.pipe(mapError((error) => failed(error.message)));