@kitman-sh/cli 0.6.0 → 0.7.1

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   getOrElse,
   fromUndefinedOr,
   getOrUndefined,
-  Service2,
+  Service,
   Reference,
   of,
   toMillis,
@@ -29,7 +29,7 @@ import {
   UnknownError,
   succeed2,
   fail2,
-  makeUnsafe2,
+  makeUnsafe,
   _await,
   isDone,
   isDoneUnsafe,
@@ -86,9 +86,9 @@ import {
   runMain,
   systemError,
   badArgument,
-  makeUnsafe4,
-  make10,
-  make11,
+  makeUnsafe3,
+  make7,
+  make8,
   offerUnsafe,
   endUnsafe,
   take,
@@ -98,7 +98,7 @@ import {
   isSink,
   fromChannel,
   drain,
-  make12,
+  make9,
   get2,
   isStream,
   fromChannel2,
@@ -115,9 +115,9 @@ import {
   ExitCode,
   ProcessId,
   makeHandle,
-  make14,
+  make11,
   ChildProcessSpawner,
-  make15,
+  make12,
   parseFdName,
   fdName,
   handleErrnoException,
@@ -158,6 +158,7 @@ import {
   isSyncKitSafe,
   resolveSyncKit,
   decodeJsonString,
+  decodeJsonStringOption,
   encodeJsonStringSync,
   encodePrettyJsonString,
   encodeUnknownJsonStringSync,
@@ -182,11 +183,13 @@ import {
   agentCredentialForApi,
   storeAgentCredential,
   raw,
-  make17,
+  make13,
   get3,
   put,
   execute,
+  Fetch,
   layer4,
+  KitmanEffectClient,
   digestSha256,
   parseCallbackUrl,
   revokeToken,
@@ -198,11 +201,13 @@ import {
   refreshSession,
   createAgentAuthBearerToken,
   createAgentAuthSignedFetch,
+  RunnerHeaders,
   setupMcpAgentCredential,
   generateAgentKeyPair,
   runCommand2,
-  herdrPiRunnerCapabilities2
-} from "./chunk-txyq8r41.js";
+  detectHarnesses2,
+  herdrRunnerCapabilities2
+} from "./chunk-5rp5hvc0.js";
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeChildProcessSpawner.js
 import * as NodeChildProcess from "child_process";
@@ -290,8 +295,8 @@ var fromReadableChannel = (options) => fromTransform((_, scope) => readableToPul
 var readableToPullUnsafe = (options) => {
   const readable = options.readable;
   const closeOnDone = options.closeOnDone ?? true;
-  const exit = options.exit ?? make10(undefined);
-  const latch = options.latch ?? makeUnsafe4(false);
+  const exit = options.exit ?? make7(undefined);
+  const latch = options.latch ?? makeUnsafe3(false);
   function onReadable() {
     latch.openUnsafe();
   }
@@ -582,7 +587,7 @@ var make = /* @__PURE__ */ gen(function* () {
     };
   };
   const spawn2 = (command, spawnOptions) => callback((resume) => {
-    const deferred = makeUnsafe2();
+    const deferred = makeUnsafe();
     const handle = NodeChildProcess.spawn(command.command, command.args, spawnOptions);
     handle.on("error", (error) => {
       resume(fail4(toPlatformError("spawn", error, command)));
@@ -782,7 +787,7 @@ var make = /* @__PURE__ */ gen(function* () {
           const sourceStream = unwrap(succeed5(getSourceStream(handles[handles.length - 1], options.from)));
           const toOption = options.to ?? "stdin";
           if (toOption === "stdin") {
-            handles.push(yield* spawnCommand(make15(command.command, command.args, {
+            handles.push(yield* spawnCommand(make12(command.command, command.args, {
               ...command.options,
               stdin: {
                 ...stdinConfig,
@@ -794,7 +799,7 @@ var make = /* @__PURE__ */ gen(function* () {
             if (isNotUndefined(fd)) {
               const fdName2 = fdName(fd);
               const existingFds = command.options.additionalFds ?? {};
-              handles.push(yield* spawnCommand(make15(command.command, command.args, {
+              handles.push(yield* spawnCommand(make12(command.command, command.args, {
                 ...command.options,
                 additionalFds: {
                   ...existingFds,
@@ -805,7 +810,7 @@ var make = /* @__PURE__ */ gen(function* () {
                 }
               })));
             } else {
-              handles.push(yield* spawnCommand(make15(command.command, command.args, {
+              handles.push(yield* spawnCommand(make12(command.command, command.args, {
                 ...command.options,
                 stdin: {
                   ...stdinConfig,
@@ -844,7 +849,7 @@ var make = /* @__PURE__ */ gen(function* () {
       }
     }
   });
-  return make14(spawnCommand);
+  return make11(spawnCommand);
 });
 var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make);
 var flattenCommand = (command) => {
@@ -878,7 +883,7 @@ var flattenCommand = (command) => {
 
 // node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Stdio.js
 var TypeId = "~effect/Stdio";
-var Stdio = /* @__PURE__ */ Service2(TypeId);
+var Stdio = /* @__PURE__ */ Service(TypeId);
 var make2 = (options) => ({
   [TypeId]: TypeId,
   stdinIsTerminal: succeed5(false),
@@ -937,7 +942,7 @@ class QuitError extends (/* @__PURE__ */ Error2("QuitError")({
 })) {
   [QuitErrorTypeId] = QuitErrorTypeId;
 }
-var Terminal = /* @__PURE__ */ Service2("effect/Terminal");
+var Terminal = /* @__PURE__ */ Service("effect/Terminal");
 var make3 = (impl) => Terminal.of({
   ...impl,
   [TypeId2]: TypeId2
@@ -948,7 +953,7 @@ import * as readline from "readline";
 var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
   const stdin = process.stdin;
   const stdout = process.stdout;
-  const lines = yield* make11();
+  const lines = yield* make8();
   let inputEnded = stdin.readableEnded;
   let readlineActive = false;
   const onStdinEnd = () => {
@@ -959,7 +964,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
   };
   stdin.once("end", onStdinEnd);
   yield* addFinalizer2(() => sync(() => stdin.off("end", onStdinEnd)));
-  const rlRef = yield* make12({
+  const rlRef = yield* make9({
     acquire: acquireRelease(sync(() => {
       const rl = readline.createInterface({
         input: stdin,
@@ -1003,7 +1008,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
   const columns = sync(() => stdout.columns ?? 0);
   const rows = sync(() => stdout.rows ?? 0);
   const readInput = gen(function* () {
-    const queue = yield* make11();
+    const queue = yield* make8();
     const handleKeypress = (s, k) => {
       const userInput = {
         input: fromUndefinedOr(s),
@@ -1105,9 +1110,14 @@ function createHerdrRunnerClient(input) {
       credential,
       ...input.fetch === undefined ? undefined : { fetch: input.fetch }
     });
+    const runnerFetch = (requestInput, init) => {
+      const request = new Request(requestInput, init);
+      request.headers.set(RunnerHeaders.runnerId, input.runnerId);
+      return signedFetch(request);
+    };
     const client = yield* createSdkClient({
       apiUrl: input.apiUrl,
-      fetch: signedFetch,
+      fetch: runnerFetch,
       session: { accessToken: "runner-agent-auth" }
     });
     const rpcBearer = createAgentAuthBearerToken({
@@ -1341,6 +1351,16 @@ function queryString(query) {
   return query.size === 0 ? "" : `?${query.toString()}`;
 }
 
+// packages/core/src/check-scripts.ts
+var verificationScripts = ["typecheck", "type-check", "lint", "test", "check"];
+function declaredChecks(manifest, rootFiles) {
+  const value = manifest === undefined ? undefined : getOrUndefined(decodeJsonStringOption(manifest));
+  const scripts = isJsonObject(value) && isJsonObject(value.scripts) ? value.scripts : {};
+  const has = (file) => rootFiles.includes(file);
+  const runner = has("bun.lock") || has("bun.lockb") ? "bun run" : has("pnpm-lock.yaml") ? "pnpm run" : has("yarn.lock") ? "yarn" : "npm run";
+  return verificationScripts.flatMap((name) => (name in scripts) ? [{ name, command: `${runner} ${name}` }] : []);
+}
+
 // apps/cli/src/init.ts
 import { hostname } from "os";
 
@@ -1455,11 +1475,12 @@ function stripPathSuffix(value) {
 }
 
 // apps/cli/src/init.ts
-var RunnerService = Reference("kitman/cli/RunnerService", { defaultValue: () => userService });
+var ServiceManager = Reference("kitman/cli/ServiceManager", {
+  defaultValue: () => ({ platform: process.platform, run: (command, args) => runCommand2(command, args) })
+});
 var Login = Reference("kitman/cli/Login", {
   defaultValue: () => browserSession
 });
-var verificationScripts = ["typecheck", "type-check", "lint", "test", "check"];
 var outcomeLabel = {
   set_up: "set up",
   already: "already set up",
@@ -1515,6 +1536,34 @@ function initCommand(args) {
     yield* log(changed.length === 0 ? "Nothing to change: Kitman is already set up here." : `Set up ${changed.map((entry) => entry.name).join(", ")}. Start work with kitman run start build "<what to build>".`);
   });
 }
+function pairCommand(args) {
+  return gen(function* () {
+    const [code, ...rest] = args;
+    if (code === undefined || code.startsWith("-"))
+      return yield* new CliError({ message: "Usage: kitman pair <pairing code> [--api-url <url>]" });
+    const flags = parseInitFlags(rest);
+    const apiUrl = yield* resolveApiUrl(flags.apiUrl);
+    const step = (name, outcome, detail) => log(`${name}: ${outcomeLabel[outcome]} (${detail})`);
+    const anonymous = new KitmanEffectClient({ baseUrl: apiUrl, fetch: yield* Fetch });
+    const credentials = yield* anonymous.redeemPairingCode({ code });
+    const session = toStoredSession({
+      access_token: credentials.accessToken,
+      ...credentials.refreshToken === undefined ? undefined : { refresh_token: credentials.refreshToken },
+      ...credentials.expiresIn === undefined ? undefined : { expires_in: credentials.expiresIn }
+    });
+    yield* storeSession(apiUrl, session);
+    yield* writeUserConfig({ ...yield* readUserConfig(), apiUrl, activeWorkspaceId: credentials.workspaceId });
+    yield* step("Login", "set_up", apiUrl);
+    const client = yield* clientFor(apiUrl, session);
+    yield* runnerStep(client, { apiUrl, session, workspaceId: credentials.workspaceId, userId: credentials.userId }, step);
+    const detected = yield* detectHarnesses2;
+    if (detected.harnesses.length === 0)
+      return yield* step("Harness", "skipped", `none logged in: ${detected.unavailable.map((harness) => harness.missing.join(", ")).join("; ")}`);
+    const harnesses = detected.harnesses.map((harness) => harness === "claude" ? "claude-code" : harness);
+    yield* harnessSync(["sync", ...harnesses]);
+    yield* step("Harness", "set_up", `${harnesses.join(", ")} synced`);
+  });
+}
 var parseInitFlags = (args) => {
   const flags = { yes: false };
   for (let index = 0;index < args.length; index += 1) {
@@ -1558,7 +1607,7 @@ var runnerStep = (client, input, step) => gen(function* () {
   const existing = runners.find((runner) => runner.ownership.kind === "personal" && runner.ownership.ownerUserId === input.userId && runner.name === name && runner.status === "active");
   const runner = existing ?? (yield* client.registerRunner(input.workspaceId, {
     name,
-    capabilities: herdrPiRunnerCapabilities2(),
+    capabilities: herdrRunnerCapabilities2({ harnesses: yield* detectHarnesses2 }),
     labels: ["kitman-runner", "kitman-loop", "herdr"]
   })).runner;
   const credentialMissing = agentCredentialForApi(yield* readAuthStore(), input.apiUrl, `herdr-runner:${runner.id}`) === undefined;
@@ -1566,8 +1615,8 @@ var runnerStep = (client, input, step) => gen(function* () {
     yield* ensureHerdrRunnerCredential({ apiUrl: input.apiUrl, accessToken: input.session.accessToken, runner });
   yield* step("Runner", existing === undefined ? "set_up" : credentialMissing ? "repaired" : "already", `${name}${credentialMissing && existing !== undefined ? ", credential restored" : ""}`);
   const home = yield* String3("HOME");
-  const service = yield* (yield* RunnerService)({
-    name: `kitman-runner-${runner.id}`,
+  const service = yield* runnerService({
+    name: runnerServiceName(runner.id),
     command: [...kitmanCommand(), "runner", "start", runner.id, "--api-url", input.apiUrl],
     workingDirectory: home,
     path: getOrElse(yield* option2(String3("PATH")), () => "/usr/local/bin:/usr/bin:/bin")
@@ -1603,14 +1652,8 @@ var scriptChecks = gen(function* () {
   const path = yield* Path;
   const top = yield* (yield* Git)(["rev-parse", "--show-toplevel"]).pipe(orElseSucceed(() => ""));
   const root = top === "" ? path.resolve(".") : top;
-  const manifest = yield* readText(path.join(root, "package.json"));
-  const parsed = manifest === undefined ? undefined : yield* decodeJsonString(manifest).pipe(orElseSucceed(() => {
-    return;
-  }));
-  const scripts = isJsonObject(parsed) && isJsonObject(parsed.scripts) ? parsed.scripts : {};
-  const has = (file) => fs.exists(path.join(root, file));
-  const runner = (yield* has("bun.lock")) || (yield* has("bun.lockb")) ? "bun run" : (yield* has("pnpm-lock.yaml")) ? "pnpm run" : (yield* has("yarn.lock")) ? "yarn" : "npm run";
-  return verificationScripts.flatMap((name) => (name in scripts) ? [{ name, command: `${runner} ${name}` }] : []);
+  const rootFiles = yield* fs.readDirectory(root).pipe(orElseSucceed(() => []));
+  return declaredChecks(yield* readText(path.join(root, "package.json")), rootFiles);
 });
 var systemdUnit = (spec) => [
   "[Unit]",
@@ -1644,12 +1687,28 @@ var launchdPlist = (label, spec) => [
 ].join(`
 `);
 var escapeXml = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-function userService(spec) {
+var runnerServiceName = (runnerId) => `kitman-runner-${runnerId}`;
+var launchdLabel = (name) => `dev.kitman.${name}`;
+var launchdDomain = gen(function* () {
+  const manager = yield* ServiceManager;
+  return `gui/${(yield* manager.run("id", ["-u"])).trim()}`;
+});
+function runnerServiceState(name) {
+  return gen(function* () {
+    const manager = yield* ServiceManager;
+    if (manager.platform === "linux")
+      return yield* manager.run("systemctl", ["--user", "is-active", `${name}.service`]).pipe(map3((state) => `systemd: ${state.trim()}`), orElseSucceed(() => "systemd: not running"));
+    if (manager.platform === "darwin")
+      return yield* manager.run("launchctl", ["print", `${yield* launchdDomain}/${launchdLabel(name)}`]).pipe(map3((printed) => `launchd: ${/^\s*state = (\S+)/mu.exec(printed)?.[1] ?? "loaded"}`), orElseSucceed(() => "launchd: not installed"));
+    return;
+  });
+}
+function runnerService(spec) {
   return gen(function* () {
     const fs = yield* FileSystem;
     const path = yield* Path;
+    const manager = yield* ServiceManager;
     const home = yield* String3("HOME");
-    const succeeded = (command, args) => runCommand2(command, args).pipe(as(true), orElseSucceed(() => false));
     const define = (file, content) => gen(function* () {
       if ((yield* readText(file)) === content)
         return false;
@@ -1657,25 +1716,25 @@ function userService(spec) {
       yield* fs.writeFileString(file, content);
       return true;
     });
-    if (process.platform === "linux") {
+    if (manager.platform === "linux") {
       const unit = `${spec.name}.service`;
       const changed = yield* define(path.join(home, ".config", "systemd", "user", unit), systemdUnit(spec));
-      if (!changed && (yield* succeeded("systemctl", ["--user", "is-active", "--quiet", unit])))
+      if (!changed && (yield* runnerServiceState(spec.name)) === "systemd: active")
         return "running";
-      yield* runCommand2("systemctl", ["--user", "daemon-reload"]);
-      yield* runCommand2("systemctl", ["--user", "enable", unit]);
-      yield* runCommand2("systemctl", ["--user", "restart", unit]);
+      yield* manager.run("systemctl", ["--user", "daemon-reload"]);
+      yield* manager.run("systemctl", ["--user", "enable", unit]);
+      yield* manager.run("systemctl", ["--user", "restart", unit]);
       return changed ? "installed" : "started";
     }
-    if (process.platform === "darwin") {
-      const label = `dev.kitman.${spec.name}`;
+    if (manager.platform === "darwin") {
+      const label = launchdLabel(spec.name);
       const file = path.join(home, "Library", "LaunchAgents", `${label}.plist`);
       const changed = yield* define(file, launchdPlist(label, spec));
-      const domain = `gui/${(yield* runCommand2("id", ["-u"])).trim()}`;
-      if (!changed && (yield* succeeded("launchctl", ["print", `${domain}/${label}`])))
+      if (!changed && (yield* runnerServiceState(spec.name)) === "launchd: running")
         return "running";
-      yield* succeeded("launchctl", ["bootout", `${domain}/${label}`]);
-      yield* runCommand2("launchctl", ["bootstrap", domain, file]);
+      const domain = yield* launchdDomain;
+      yield* ignore(manager.run("launchctl", ["bootout", `${domain}/${label}`]));
+      yield* manager.run("launchctl", ["bootstrap", domain, file]);
       return changed ? "installed" : "started";
     }
     return "unsupported";
@@ -1711,7 +1770,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.6.0";
+var cliVersion = "0.7.1";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1831,7 +1890,7 @@ var scaffoldPackage = (directory, scaffold = {}) => gen(function* () {
   const path = yield* Path;
   const root = path.resolve(directory);
   if (scaffold.fork !== undefined) {
-    const { shippedLoops } = yield* promise(() => import("./chunk-dsefng1v.js"));
+    const { shippedLoops } = yield* promise(() => import("./chunk-gj8pz39x.js"));
     if (!(scaffold.fork in shippedLoops))
       return yield* new CliError({
         message: `Kitman ships no Loop ${scaffold.fork}; fork one of ${Object.keys(shippedLoops).join(", ")}`
@@ -1863,10 +1922,11 @@ var scaffoldPackage = (directory, scaffold = {}) => gen(function* () {
 // apps/cli/src/commands.ts
 var ClientId = "kitman-cli";
 var Usage = [
-  "Usage: kitman <init|run|inbox|loop|agent|deploy|package|verify|secret|constraint|mcp|sync|whoami|config|kit|task|memory|proposal|decision|context|schedule|delivery|reconcile|lifecycle|logout> [options]",
+  "Usage: kitman <init|pair|run|inbox|loop|agent|deploy|package|verify|secret|constraint|mcp|sync|whoami|config|kit|task|memory|proposal|decision|context|schedule|delivery|reconcile|lifecycle|logout> [options]",
   "",
   "Set up, in a repository (run it again to repair what is missing):",
   "  kitman init [--yes] [--api-url <url>]",
+  "  kitman pair <pairing code> [--api-url <url>]   (what the command the web shows runs)",
   "",
   "Runs:",
   '  kitman run start <loop> "<words>" [--input <json>] [--project <project>] [--type <task type>] [--constraint <text>]...',
@@ -1924,7 +1984,7 @@ var Usage = [
 `);
 var KitCreateValidator = guard(KitCreate);
 var KitUpdateValidator = guard(KitUpdate);
-var agentRuntime = promise(() => import("./chunk-3j7sewn0.js"));
+var agentRuntime = promise(() => import("./chunk-f1f60hgt.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -1951,6 +2011,8 @@ function runEffect(args) {
       return yield* scaffoldPackage(rest[1] ?? ".");
     if (command === "init")
       return yield* initCommand(rest);
+    if (command === "pair")
+      return yield* pairCommand(rest);
     if (command === "login")
       return yield* login(rest);
     if (command === "logout")
@@ -3108,7 +3170,7 @@ function runnerCommand(args) {
         ...command.flags.agentIdentityId === undefined ? undefined : { agentIdentityId: command.flags.agentIdentityId },
         ...ownership === undefined ? undefined : { ownership },
         ...command.flags.project === undefined ? undefined : { projectId: command.flags.project },
-        capabilities: herdr ? (yield* agentRuntime).herdrPiRunnerCapabilities() : loopRunnerCapabilities(),
+        capabilities: herdr ? (yield* agentRuntime).herdrRunnerCapabilities({ harnesses: yield* (yield* agentRuntime).detectHarnesses }) : loopRunnerCapabilities(),
         labels: herdr ? ["kitman-runner", "kitman-loop", "herdr"] : ["kitman-runner", "kitman-loop"]
       });
       const setup = response.setup;
@@ -3154,7 +3216,7 @@ function runnerCommand(args) {
     if (command.action === "doctor") {
       const runners = yield* client.listRunners(workspaceId);
       if (command.flags.runnerId === undefined && command.args.length === 0 && command.flags.backend === undefined)
-        return yield* runners.items.length === 0 ? printRows([{ status: "no_runners", workspaceId, message: "No Runner registered for workspace." }], command.flags.json) : printRows(runners.items.map(runnerDoctorRow), command.flags.json);
+        return yield* runners.items.length === 0 ? printRows([{ status: "no_runners", workspaceId, message: "No Runner registered for workspace." }], command.flags.json) : printRows(yield* forEach(runners.items, runnerDoctorRowHere), command.flags.json);
       const runner = command.flags.runnerId === undefined && command.args.length === 0 ? runners.items.find((item) => item.status === "active") ?? runners.items[0] : resolveRunnerRef(runners.items, command.flags.runnerId ?? command.args.join(" "));
       if (runner === undefined) {
         const rows = [{ status: "no_runners", workspaceId, message: "No Runner registered for workspace." }];
@@ -3166,7 +3228,7 @@ function runnerCommand(args) {
         const readiness = yield* checkHerdrRunnerReadiness(runner);
         return yield* printRows([readiness], command.flags.json);
       }
-      return yield* printRows([runnerDoctorRow(runner)], command.flags.json);
+      return yield* printRows([yield* runnerDoctorRowHere(runner)], command.flags.json);
     }
     return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
   });
@@ -3207,12 +3269,14 @@ function startCanonicalHerdrRunnerCommand(input) {
       agentStepExecutor,
       agentStepSandboxPolicy,
       assertHerdrRunnerCapability,
+      bundleCacheDir,
       dockerContainerRunner,
       herdrAgentBackendLayer,
       herdrExecutorSurface,
       herdrHarnessLayer,
-      herdrPiRunnerCapabilities,
-      herdrPiRunnerCapabilitiesForRepoBinding,
+      detectHarnesses,
+      herdrRunnerCapabilities,
+      herdrRunnerCapabilitiesForRepoBinding,
       kitmanBundles,
       kitmanMcpPreflight,
       listenForSignals,
@@ -3226,7 +3290,7 @@ function startCanonicalHerdrRunnerCommand(input) {
       superviseReplica,
       verificationExecutor
     } = yield* agentRuntime;
-    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-6h8ghah0.js"));
+    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-mx1x1b6a.js"));
     const settings = yield* runnerSettings;
     const { concurrency, fullAccess, sshAgentAvailable } = settings;
     const personal = input.runner.ownership.kind === "personal";
@@ -3237,7 +3301,9 @@ function startCanonicalHerdrRunnerCommand(input) {
         message: `\`${sandbox}\` is not available on this host (${host.unavailable.find((entry) => entry.backend === sandbox)?.missing.join("; ") ?? "unsupported"}); unset KITMAN_RUNNER_SANDBOX to run agents on the host.`
       });
     const repoBinding = input.projectId === undefined ? undefined : (yield* input.client.listRepoBindings(input.projectId)).items.find((binding) => binding.status === "active");
-    const advertisedCapabilities = repoBinding === undefined ? herdrPiRunnerCapabilities({ fullAccess, sandbox: host, shared: !personal }) : herdrPiRunnerCapabilitiesForRepoBinding(repoBinding, {
+    const harnesses = yield* detectHarnesses;
+    const advertisedCapabilities = repoBinding === undefined ? herdrRunnerCapabilities({ harnesses, fullAccess, sandbox: host, shared: !personal }) : herdrRunnerCapabilitiesForRepoBinding(repoBinding, {
+      harnesses,
       fullAccess,
       sandbox: host,
       shared: !personal,
@@ -3253,11 +3319,12 @@ function startCanonicalHerdrRunnerCommand(input) {
       accessToken: input.accessToken,
       runner: input.runner
     });
-    const controlPlane = yield* createHerdrRunnerClient({ apiUrl: input.apiUrl, credential });
+    const controlPlane = yield* createHerdrRunnerClient({ apiUrl: input.apiUrl, runnerId: input.runner.id, credential });
     const fs = yield* FileSystem;
     const path = yield* Path;
     const runnerRootDir = yield* herdrRunnerRootDir;
     yield* fs.makeDirectory(path.join(runnerRootDir, ".kitman", "worktrees"), { recursive: true });
+    yield* fs.makeDirectory(bundleCacheDir, { recursive: true });
     const replica = yield* controlPlane.client.registerRunnerReplica(input.runner.id, {
       name: `replica-${createId()}`,
       capacity: { maxConcurrentRuns: concurrency },
@@ -3266,17 +3333,15 @@ function startCanonicalHerdrRunnerCommand(input) {
     const backend = herdrExecutorSurface({ runnerId: input.runner.id, session: personal ? "default" : "own" });
     const uid = process.getuid?.();
     const gid = process.getgid?.();
+    const docker = host.backends.includes("docker") && settings.dockerImage !== undefined ? {
+      containers: yield* dockerContainerRunner,
+      image: settings.dockerImage,
+      ...uid === undefined || gid === undefined ? undefined : { user: `${uid}:${gid}` }
+    } : undefined;
     const root = herdrAgentBackendLayer({
       client: () => backend.executionClient,
       sandboxBackends: host.backends,
-      ...host.backends.includes("docker") && settings.dockerImage !== undefined ? {
-        docker: {
-          containers: yield* dockerContainerRunner,
-          image: settings.dockerImage,
-          runnerId: input.runner.id,
-          ...uid === undefined || gid === undefined ? undefined : { user: `${uid}:${gid}` }
-        }
-      } : undefined
+      ...docker === undefined ? undefined : { docker: { ...docker, runnerId: input.runner.id } }
     }).pipe(provide2(herdrHarnessLayer({ client: () => backend.executionClient })), provide2(layer10));
     const activeSlots = new Set;
     return yield* gen(function* () {
@@ -3303,7 +3368,6 @@ function startCanonicalHerdrRunnerCommand(input) {
         const bundles = yield* kitmanBundles({
           fetch: (digest) => rpc.bundle(digest).pipe(map3((found) => found.bundle))
         });
-        const runPackageProgram = programProcessExecutor({ bundles, apiUrl: input.apiUrl });
         const checkouts = runCheckouts(path.join(runnerRootDir, ".kitman"));
         const platform = yield* context();
         yield* listenForSignals({
@@ -3314,6 +3378,21 @@ function startCanonicalHerdrRunnerCommand(input) {
           reconnectAfter: "2 seconds"
         }).pipe(forkScoped);
         const authStore = yield* userAuthPath;
+        const runnerState = {
+          workRoot: path.join(runnerRootDir, ".kitman"),
+          bundleCache: path.resolve(bundleCacheDir),
+          kitmanConfigDir: path.dirname(authStore),
+          authStore
+        };
+        const sharedSandbox = personal ? undefined : {
+          runner: runnerState,
+          ...docker !== undefined ? { backend: "docker", docker, runnerId: input.runner.id } : { backend: host.backends.includes("srt") ? "srt" : undefined }
+        };
+        const runPackageProgram = programProcessExecutor({
+          bundles,
+          apiUrl: input.apiUrl,
+          ...sharedSandbox === undefined ? undefined : { sandbox: sharedSandbox }
+        });
         const agentLaunch = (brief, stepCredential) => ({
           brief,
           stepCredential,
@@ -3338,7 +3417,7 @@ function startCanonicalHerdrRunnerCommand(input) {
             },
             sandbox: {
               backend: work.sandbox ?? sandbox,
-              policy: agentStepSandboxPolicy(work, input.apiUrl, authStore)
+              policy: agentStepSandboxPolicy(work, input.apiUrl, runnerState)
             },
             settled: heartbeatOf(work).pipe(map3((state) => state.settled || state.outputSubmitted === true)),
             steering: {
@@ -3349,7 +3428,8 @@ function startCanonicalHerdrRunnerCommand(input) {
         });
         const runVerification = verificationExecutor({
           rootDir: path.join(runnerRootDir, ".kitman"),
-          known: rpcKnownEvidence(rpc)
+          known: rpcKnownEvidence(rpc),
+          ...sharedSandbox === undefined ? undefined : { sandbox: { ...sharedSandbox, apiUrl: input.apiUrl } }
         });
         yield* acquireRelease(backend.start(), () => backend.stop());
         const control = (capacitySlot) => ({
@@ -3414,8 +3494,7 @@ function checkHerdrRunnerReadiness(runner) {
 function herdrReadinessCode(error) {
   const message = error instanceof Error ? error.message : "";
   const known = new Set([
-    "herdr_linux_required",
-    "herdr_pi_unavailable",
+    "herdr_platform_unsupported",
     "herdr_protocol_mismatch",
     "herdr_readiness_timeout",
     "herdr_socket_ownership_unknown",
@@ -3429,7 +3508,7 @@ function mcpCommand(args) {
     if (command.action === "run") {
       if (command.args.length > 0)
         return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
-      const { runMcpServerCommand } = yield* promise(() => import("./chunk-tfr74ays.js"));
+      const { runMcpServerCommand } = yield* promise(() => import("./chunk-eynqc0vm.js"));
       return yield* runMcpServerCommand({ flags: command.flags });
     }
     if (command.action !== "setup")
@@ -4449,7 +4528,7 @@ function secretCommand(args) {
   });
 }
 var PackageBuilder = Reference("kitman/cli/PackageBuilder", {
-  defaultValue: () => (directory) => flatMap(promise(() => import("./chunk-h8ctzn91.js")), (build) => build.buildPackage(directory))
+  defaultValue: () => (directory) => flatMap(promise(() => import("./chunk-50w9z6we.js")), (build) => build.buildPackage(directory))
 });
 var optionalEnv = (name) => String3(name).pipe(option2, map3(getOrUndefined));
 var ciIdToken = (apiUrl) => gen(function* () {
@@ -5225,6 +5304,8 @@ function runnerRow(runner) {
     health: runner.healthStatus,
     agentIdentityId: runner.agentIdentityId,
     harnesses: runner.capabilities.harnesses.join(","),
+    defaultHarness: runner.capabilities.defaultHarness ?? "",
+    unavailableHarnesses: (runner.capabilities.harnessUnavailable ?? []).map((entry) => `${entry.harness}: ${entry.missing.join(", ")}`).join("; "),
     executionBackends: runner.capabilities.executionBackends?.join(",") ?? "",
     sandboxes: runner.capabilities.sandboxBackends.join(","),
     labels: runner.labels.join(","),
@@ -5258,6 +5339,8 @@ function runnerDoctorRow(runner) {
     health: runner.healthStatus,
     runs: runner.capabilities.runs?.supported === true,
     harnesses: runner.capabilities.harnesses.join(","),
+    defaultHarness: runner.capabilities.defaultHarness ?? "",
+    unavailableHarnesses: (runner.capabilities.harnessUnavailable ?? []).map((entry) => `${entry.harness}: ${entry.missing.join(", ")}`).join("; "),
     executionBackends: runner.capabilities.executionBackends?.join(",") ?? "",
     sandboxes: runner.capabilities.sandboxBackends.join(","),
     agentSteps: runner.capabilities.runs?.stepKinds.includes("agent") === true,
@@ -5265,6 +5348,10 @@ function runnerDoctorRow(runner) {
     maxConcurrentRuns: runner.capabilities.resourceLimits?.maxConcurrentRuns
   };
 }
+var runnerDoctorRowHere = (runner) => map3(runnerServiceState(runnerServiceName(runner.id)), (service) => ({
+  ...runnerDoctorRow(runner),
+  ...service === undefined ? undefined : { service }
+}));
 function taskRow(task) {
   return {
     id: task.id,
@@ -5342,7 +5429,7 @@ function downloadPresignedAsset(download, outputPath) {
   return gen(function* () {
     const fs = yield* FileSystem;
     const failed = (cause) => new CliError({ message: `Asset download failed: ${String(cause)}` });
-    const response = yield* send(make17(download.method)(download.url), failed);
+    const response = yield* send(make13(download.method)(download.url), failed);
     if (response.status < 200 || response.status >= 300)
       return yield* new CliError({ message: `Asset download failed with ${response.status}` });
     const body = yield* response.arrayBuffer.pipe(mapError((error) => failed(error.message)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/cli",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "type": "module",
   "license": "UNLICENSED",
   "bin": {