@kitman-sh/cli 0.7.1 → 0.7.3

package/dist/{chunk-1d2e4je3.js → chunk-x6j2j12j.js}

@@ -3,7 +3,7 @@ import {
   Random,
   succeed5,
   withFiber
-} from "./chunk-5rp5hvc0.js";
+} from "./chunk-8g2twwm8.js";
 
 // node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Random.js
 var Random2 = Random;

package/dist/{chunk-50w9z6we.js → chunk-yysejjz0.js}

@@ -21,7 +21,7 @@ import {
   FileSystem,
   Path,
   ChildProcessSpawner,
-  make12,
+  make11,
   decodeUnknownEffect,
   decodeEffect,
   optionalKey,
@@ -41,14 +41,14 @@ import {
   KitAssignmentDeclaration,
   PackageDeclarations,
   RunnerRpcProtocolVersion
-} from "./chunk-5rp5hvc0.js";
-import"./chunk-9bje6bm0.js";
-import"./chunk-23ch5vdv.js";
-import"./chunk-tkk2synn.js";
+} from "./chunk-8g2twwm8.js";
+import"./chunk-84t0s0s2.js";
+import"./chunk-c5nwtn11.js";
+import"./chunk-0296rete.js";
 import {
   describeFlag,
   Described
-} from "./chunk-2vcae278.js";
+} from "./chunk-1n61xbaq.js";
 
 // packages/sdk/src/build/index.ts
 class DependencyInstallFailed extends TaggedError2()("DependencyInstallFailed", {
@@ -96,7 +96,7 @@ var ConfigKits = Record(String2, Union([
 ]));
 var run = (command, args, cwd) => gen(function* () {
   const spawner = yield* ChildProcessSpawner;
-  const handle = yield* spawner.spawn(make12(command, args, { cwd, stdin: "ignore" }));
+  const handle = yield* spawner.spawn(make11(command, args, { cwd, stdin: "ignore" }));
   const [stdout, stderr, exitCode] = yield* all([
     mkString(decodeText(handle.stdout)),
     mkString(decodeText(handle.stderr)),

package/dist/{chunk-mx1x1b6a.js → chunk-zc0ebz8f.js}

@@ -3,9 +3,9 @@ import {
   runnerWebSocketProtocol2,
   runnerRpcUrl2,
   makeRunnerRpcClient2
-} from "./chunk-23ch5vdv.js";
-import"./chunk-9bje6bm0.js";
-import"./chunk-5rp5hvc0.js";
+} from "./chunk-c5nwtn11.js";
+import"./chunk-84t0s0s2.js";
+import"./chunk-8g2twwm8.js";
 export {
   makeRunnerRpcClient2 as makeRunnerRpcClient,
   runnerRpcUrl2 as runnerRpcUrl,

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env bun
 // @bun
 import {
+  pipeArguments,
   identity,
   isUndefined,
   isNotUndefined,
@@ -19,8 +20,12 @@ import {
   fromUndefinedOr,
   getOrUndefined,
   Service,
+  add,
+  get,
   Reference,
   of,
+  fromInputUnsafe,
+  isFinite,
   toMillis,
   TaggedError,
   squash,
@@ -29,12 +34,19 @@ import {
   UnknownError,
   succeed2,
   fail2,
+  void_,
+  isSuccess2,
+  isFailure2,
   makeUnsafe,
   _await,
   isDone,
   isDoneUnsafe,
   doneUnsafe,
+  Scope,
+  makeUnsafe2,
+  addFinalizerExit,
   addFinalizer,
+  close,
   succeed4,
   effect,
   mergeAll,
@@ -54,6 +66,7 @@ import {
   gen,
   fail4,
   try_,
+  withFiber,
   flatMap,
   andThen,
   tap,
@@ -73,19 +86,28 @@ import {
   provide3,
   provideContext,
   provideService,
+  scope,
   scoped,
   acquireRelease,
   addFinalizer2,
   ensuring,
+  onExit,
+  interrupt2,
   uninterruptible,
+  uninterruptibleMask,
   forever,
   forkScoped,
+  runForkWith,
   fnUntraced,
   logWarning,
   logError,
   runMain,
   systemError,
   badArgument,
+  join,
+  interrupt3,
+  getCurrent,
+  runIn,
   makeUnsafe3,
   make7,
   make8,
@@ -98,8 +120,6 @@ import {
   isSink,
   fromChannel,
   drain,
-  make9,
-  get2,
   isStream,
   fromChannel2,
   empty2,
@@ -115,9 +135,9 @@ import {
   ExitCode,
   ProcessId,
   makeHandle,
-  make11,
+  make10,
   ChildProcessSpawner,
-  make12,
+  make11,
   parseFdName,
   fdName,
   handleErrnoException,
@@ -183,8 +203,8 @@ import {
   agentCredentialForApi,
   storeAgentCredential,
   raw,
-  make13,
-  get3,
+  make12,
+  get2,
   put,
   execute,
   Fetch,
@@ -207,7 +227,146 @@ import {
   runCommand2,
   detectHarnesses2,
   herdrRunnerCapabilities2
-} from "./chunk-5rp5hvc0.js";
+} from "./chunk-8g2twwm8.js";
+
+// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/internal/rcRef.js
+var TypeId = "~effect/RcRef";
+var stateEmpty = {
+  _tag: "Empty"
+};
+var stateClosed = {
+  _tag: "Closed"
+};
+var variance = {
+  _A: identity,
+  _E: identity
+};
+
+class RcRefImpl {
+  [TypeId] = variance;
+  pipe() {
+    return pipeArguments(this, arguments);
+  }
+  state = stateEmpty;
+  acquire;
+  context;
+  scope;
+  idleTimeToLive;
+  constructor(acquire, context, scope, idleTimeToLive) {
+    this.acquire = acquire;
+    this.context = context;
+    this.scope = scope;
+    this.idleTimeToLive = idleTimeToLive;
+  }
+}
+var make = (options) => withFiber((fiber) => {
+  const context = fiber.context;
+  const scope = get(context, Scope);
+  const ref = new RcRefImpl(options.acquire, context, scope, options.idleTimeToLive !== undefined ? fromInputUnsafe(options.idleTimeToLive) : undefined);
+  return as(addFinalizerExit(scope, () => {
+    const state = ref.state;
+    ref.state = stateClosed;
+    if (state._tag === "Acquired")
+      return close(state.scope, void_);
+    if (state._tag === "Acquiring")
+      return interrupt3(state.fiber);
+    return void_2;
+  }), ref);
+});
+var getState = (self, restore) => {
+  switch (self.state._tag) {
+    case "Closed": {
+      return interrupt2;
+    }
+    case "Acquired": {
+      const state = self.state;
+      state.refCount++;
+      return state.fiber ? as(interrupt3(state.fiber), state) : succeed5(state);
+    }
+    case "Acquiring": {
+      const state = self.state;
+      state.awaiters++;
+      return awaitAcquiring(self, state, restore);
+    }
+    case "Empty": {
+      const acquiring = {
+        _tag: "Acquiring",
+        fiber: undefined,
+        awaiters: 1,
+        acquired: undefined
+      };
+      self.state = acquiring;
+      const scope = makeUnsafe2();
+      const acquire = provideContext(self.acquire, add(self.context, Scope, scope)).pipe(flatMap((value) => {
+        if (self.state !== acquiring) {
+          return interrupt2;
+        }
+        const state = {
+          _tag: "Acquired",
+          value,
+          scope,
+          fiber: undefined,
+          refCount: acquiring.awaiters,
+          invalidated: false
+        };
+        self.state = state;
+        acquiring.acquired = state;
+        return succeed5(state);
+      }), onExit((exit) => {
+        if (isSuccess2(exit))
+          return void_2;
+        if (self.state === acquiring)
+          self.state = stateEmpty;
+        return close(scope, exit);
+      }));
+      acquiring.fiber = runForkWith(getCurrent().context)(acquire);
+      return awaitAcquiring(self, acquiring, restore);
+    }
+  }
+};
+var awaitAcquiring = (self, acquiring, restore) => onExit(restore(join(acquiring.fiber)), (exit) => {
+  const acquired = acquiring.acquired;
+  if (acquired !== undefined) {
+    return isFailure2(exit) ? release(self, acquired) : void_2;
+  }
+  if (--acquiring.awaiters > 0 || self.state !== acquiring)
+    return void_2;
+  self.state = stateEmpty;
+  return interrupt3(acquiring.fiber);
+});
+var get3 = (self_) => {
+  const self = self_;
+  return uninterruptibleMask((restore) => flatMap(scope, (scope) => flatMap(getState(self, restore), (state) => as(addFinalizerExit(scope, () => release(self, state)), state.value))));
+};
+var release = (self, state) => {
+  state.refCount--;
+  if (state.refCount > 0) {
+    return void_2;
+  }
+  const idleTimeToLive = self.idleTimeToLive;
+  if (idleTimeToLive === undefined || state.invalidated) {
+    if (self.state === state) {
+      self.state = stateEmpty;
+    }
+    return close(state.scope, void_);
+  } else if (!isFinite(idleTimeToLive)) {
+    return void_2;
+  }
+  state.fiber = uninterruptibleMask((restore) => flatMap(restore(sleep(idleTimeToLive)), () => {
+    if (self.state === state && state.refCount === 0) {
+      self.state = stateEmpty;
+      return close(state.scope, void_);
+    }
+    return void_2;
+  })).pipe(ensuring(sync(() => {
+    state.fiber = undefined;
+  })), runForkWith(self.context), runIn(self.scope));
+  return void_2;
+};
+
+// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/RcRef.js
+var make2 = make;
+var get4 = get3;
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeChildProcessSpawner.js
 import * as NodeChildProcess from "child_process";
@@ -385,7 +544,7 @@ var taskkill = (childProcess, onExit = () => {}) => {
     windowsHide: true
   }, onExit);
 };
-var make = /* @__PURE__ */ gen(function* () {
+var make3 = /* @__PURE__ */ gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
   const resolveWorkingDirectory = fnUntraced(function* (options) {
@@ -787,7 +946,7 @@ var make = /* @__PURE__ */ gen(function* () {
           const sourceStream = unwrap(succeed5(getSourceStream(handles[handles.length - 1], options.from)));
           const toOption = options.to ?? "stdin";
           if (toOption === "stdin") {
-            handles.push(yield* spawnCommand(make12(command.command, command.args, {
+            handles.push(yield* spawnCommand(make11(command.command, command.args, {
               ...command.options,
               stdin: {
                 ...stdinConfig,
@@ -799,7 +958,7 @@ var make = /* @__PURE__ */ gen(function* () {
             if (isNotUndefined(fd)) {
               const fdName2 = fdName(fd);
               const existingFds = command.options.additionalFds ?? {};
-              handles.push(yield* spawnCommand(make12(command.command, command.args, {
+              handles.push(yield* spawnCommand(make11(command.command, command.args, {
                 ...command.options,
                 additionalFds: {
                   ...existingFds,
@@ -810,7 +969,7 @@ var make = /* @__PURE__ */ gen(function* () {
                 }
               })));
             } else {
-              handles.push(yield* spawnCommand(make12(command.command, command.args, {
+              handles.push(yield* spawnCommand(make11(command.command, command.args, {
                 ...command.options,
                 stdin: {
                   ...stdinConfig,
@@ -849,9 +1008,9 @@ var make = /* @__PURE__ */ gen(function* () {
       }
     }
   });
-  return make11(spawnCommand);
+  return make10(spawnCommand);
 });
-var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make);
+var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make3);
 var flattenCommand = (command) => {
   const commands = [];
   const pipeOptions = [];
@@ -882,10 +1041,10 @@ var flattenCommand = (command) => {
 };
 
 // node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Stdio.js
-var TypeId = "~effect/Stdio";
-var Stdio = /* @__PURE__ */ Service(TypeId);
-var make2 = (options) => ({
-  [TypeId]: TypeId,
+var TypeId2 = "~effect/Stdio";
+var Stdio = /* @__PURE__ */ Service(TypeId2);
+var make4 = (options) => ({
+  [TypeId2]: TypeId2,
   stdinIsTerminal: succeed5(false),
   stdoutIsTerminal: succeed5(false),
   stderrIsTerminal: succeed5(false),
@@ -893,7 +1052,7 @@ var make2 = (options) => ({
 });
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeStdio.js
-var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make2({
+var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make4({
   args: /* @__PURE__ */ sync(() => process.argv.slice(2)),
   stdinIsTerminal: /* @__PURE__ */ sync(() => process.stdin.isTTY === true),
   stdoutIsTerminal: /* @__PURE__ */ sync(() => process.stdout.isTTY === true),
@@ -934,7 +1093,7 @@ var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make2({
 var layer7 = layer6;
 
 // node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Terminal.js
-var TypeId2 = "~effect/Terminal";
+var TypeId3 = "~effect/Terminal";
 var QuitErrorTypeId = "~effect/Terminal/QuitError";
 
 class QuitError extends (/* @__PURE__ */ Error2("QuitError")({
@@ -943,14 +1102,14 @@ class QuitError extends (/* @__PURE__ */ Error2("QuitError")({
   [QuitErrorTypeId] = QuitErrorTypeId;
 }
 var Terminal = /* @__PURE__ */ Service("effect/Terminal");
-var make3 = (impl) => Terminal.of({
+var make5 = (impl) => Terminal.of({
   ...impl,
-  [TypeId2]: TypeId2
+  [TypeId3]: TypeId3
 });
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeTerminal.js
 import * as readline from "readline";
-var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
+var make6 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
   const stdin = process.stdin;
   const stdout = process.stdout;
   const lines = yield* make8();
@@ -964,7 +1123,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
   };
   stdin.once("end", onStdinEnd);
   yield* addFinalizer2(() => sync(() => stdin.off("end", onStdinEnd)));
-  const rlRef = yield* make9({
+  const rlRef = yield* make2({
     acquire: acquireRelease(sync(() => {
       const rl = readline.createInterface({
         input: stdin,
@@ -1038,13 +1197,13 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
     if (inputEnded) {
       handleEnd();
     } else {
-      yield* get2(rlRef);
+      yield* get4(rlRef);
       stdin.once("end", handleEnd);
     }
     return queue;
   });
   const readLine = suspend(() => poll(lines).pipe(flatMap(match({
-    onNone: () => scoped(andThen(get2(rlRef), take(lines))),
+    onNone: () => scoped(andThen(get4(rlRef), take(lines))),
     onSome: succeed5
   })), mapError(() => new QuitError({}))));
   const display = (prompt2) => uninterruptible(callback((resume) => {
@@ -1055,7 +1214,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
       cause: err
     }))));
   }));
-  return make3({
+  return make5({
     columns,
     rows,
     readInput,
@@ -1063,7 +1222,7 @@ var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
     display
   });
 });
-var layer8 = /* @__PURE__ */ effect(Terminal, /* @__PURE__ */ make4(defaultShouldQuit));
+var layer8 = /* @__PURE__ */ effect(Terminal, /* @__PURE__ */ make6(defaultShouldQuit));
 function defaultShouldQuit(input) {
   const key = input.key;
   return key.name === "escape" || key.ctrl && (key.name === "c" || key.name === "d");
@@ -1177,7 +1336,7 @@ function renderMaterializationPlan(plan) {
       kind: operation.kind,
       skillName: operation.skillName,
       skillIdentityHash: hashIdentity(auditOperationIdentity(operation)),
-      target: operation.kind === "write_skill" ? operation.path : operation.targetPath
+      target: operation.kind === "symlink_skill" ? operation.targetPath : operation.path
     })),
     materializedSkills: plan.materializedSkills.map((skill) => ({
       name: skill.name,
@@ -1203,7 +1362,11 @@ function renderConfigPlan(plan) {
   };
 }
 function auditOperationIdentity(operation) {
-  return operation.kind === "write_skill" ? `write_skill:${operation.skillName}:content_sha256:${hashIdentity(operation.content)}:${operation.path}` : `symlink_skill:${operation.skillName}:symlink:${operation.sourcePath}:${operation.targetPath}`;
+  if (operation.kind === "write_skill")
+    return `write_skill:${operation.skillName}:content_sha256:${hashIdentity(operation.content)}:${operation.path}`;
+  if (operation.kind === "fetch_git_skill")
+    return `fetch_git_skill:${operation.skillName}:${operation.url}#${operation.ref}:${operation.repositoryPath ?? ""}:${operation.path}`;
+  return `symlink_skill:${operation.skillName}:symlink:${operation.sourcePath}:${operation.targetPath}`;
 }
 function auditMaterializedSkillIdentity(skill) {
   return `${skill.harness}:${skill.name}:${skill.source.kind}:${skill.skillPath ?? ""}:${skill.managed}`;
@@ -1770,7 +1933,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.7.1";
+var cliVersion = "0.7.3";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1890,7 +2053,7 @@ var scaffoldPackage = (directory, scaffold = {}) => gen(function* () {
   const path = yield* Path;
   const root = path.resolve(directory);
   if (scaffold.fork !== undefined) {
-    const { shippedLoops } = yield* promise(() => import("./chunk-gj8pz39x.js"));
+    const { shippedLoops } = yield* promise(() => import("./chunk-80g9af03.js"));
     if (!(scaffold.fork in shippedLoops))
       return yield* new CliError({
         message: `Kitman ships no Loop ${scaffold.fork}; fork one of ${Object.keys(shippedLoops).join(", ")}`
@@ -1984,7 +2147,7 @@ var Usage = [
 `);
 var KitCreateValidator = guard(KitCreate);
 var KitUpdateValidator = guard(KitUpdate);
-var agentRuntime = promise(() => import("./chunk-f1f60hgt.js"));
+var agentRuntime = promise(() => import("./chunk-kt08et8q.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -2464,7 +2627,7 @@ function harnessSync(args) {
       };
     });
     const projectRoot = command.flags.projectScope ? yield* resolveProjectWriteRoot : undefined;
-    const targetPlans = yield* previewEnvironmentPlans(environments, command, projectRoot, config.mcpCredentialName, syncKits);
+    const targetPlans = yield* previewEnvironmentPlans(environments, command, projectRoot, config.mcpCredentialName, syncKits, (yield* readUserConfig())?.approvedSkillSources);
     const environmentPlan = composeAgentEnvironmentSyncPlan(targetPlans);
     const materializationPlans = targetPlans.map((target) => target.skills);
     const userConfigPlans = command.flags.projectScope ? [] : targetPlans.map((target) => target.harnessConfig);
@@ -2636,7 +2799,7 @@ function isInstallDefaultKit(kit) {
   const rollout = isObject(marketplace) && marketplace !== null && "rollout" in marketplace ? marketplace.rollout : undefined;
   return isObject(rollout) && rollout !== null && "installDefault" in rollout && rollout.installDefault === true;
 }
-function previewEnvironmentPlans(environments, command, projectRoot, mcpCredentialName, syncKits = []) {
+function previewEnvironmentPlans(environments, command, projectRoot, mcpCredentialName, syncKits = [], approvedSkillSources) {
   return forEach(environments, (environment, index) => gen(function* () {
     const rootDir = command.flags.projectScope ? projectRoot : getOrUndefined(yield* option2(String3("HOME")));
     const { previewAgentEnvironmentPlan } = yield* agentRuntime;
@@ -2646,6 +2809,7 @@ function previewEnvironmentPlans(environments, command, projectRoot, mcpCredenti
       scope: command.flags.projectScope ? "project" : "user",
       ...rootDir === undefined ? undefined : { rootDir },
       ...command.flags.noInstall === undefined ? undefined : { noInstall: command.flags.noInstall },
+      ...approvedSkillSources === undefined ? undefined : { approvedSkillSources },
       ...mcpCredentialName === undefined ? undefined : { mcpCredentialName }
     });
   }));
@@ -3290,7 +3454,7 @@ function startCanonicalHerdrRunnerCommand(input) {
       superviseReplica,
       verificationExecutor
     } = yield* agentRuntime;
-    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-mx1x1b6a.js"));
+    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-zc0ebz8f.js"));
     const settings = yield* runnerSettings;
     const { concurrency, fullAccess, sshAgentAvailable } = settings;
     const personal = input.runner.ownership.kind === "personal";
@@ -3508,7 +3672,7 @@ function mcpCommand(args) {
     if (command.action === "run") {
       if (command.args.length > 0)
         return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
-      const { runMcpServerCommand } = yield* promise(() => import("./chunk-eynqc0vm.js"));
+      const { runMcpServerCommand } = yield* promise(() => import("./chunk-nvf0begz.js"));
       return yield* runMcpServerCommand({ flags: command.flags });
     }
     if (command.action !== "setup")
@@ -4528,7 +4692,7 @@ function secretCommand(args) {
   });
 }
 var PackageBuilder = Reference("kitman/cli/PackageBuilder", {
-  defaultValue: () => (directory) => flatMap(promise(() => import("./chunk-50w9z6we.js")), (build) => build.buildPackage(directory))
+  defaultValue: () => (directory) => flatMap(promise(() => import("./chunk-yysejjz0.js")), (build) => build.buildPackage(directory))
 });
 var optionalEnv = (name) => String3(name).pipe(option2, map3(getOrUndefined));
 var ciIdToken = (apiUrl) => gen(function* () {
@@ -4542,7 +4706,7 @@ var ciIdToken = (apiUrl) => gen(function* () {
   const url = new URL(requestUrl);
   const refused = (reason) => new CliError({ message: `GitHub Actions issued no ID token: ${reason}` });
   url.searchParams.set("audience", apiUrl.replace(/\/+$/, ""));
-  const response = yield* send(get3(url, { headers: { authorization: `Bearer ${requestToken}` } }), (cause) => refused(String(cause)));
+  const response = yield* send(get2(url, { headers: { authorization: `Bearer ${requestToken}` } }), (cause) => refused(String(cause)));
   if (response.status < 200 || response.status >= 300)
     return yield* refused(`${response.status}; does the job have id-token: write?`);
   const body = yield* response.text.pipe(mapError((error) => refused(error.message)));
@@ -5033,9 +5197,7 @@ function runnerOwnershipFromCommand(command, required) {
     const ownerUserId = command.flags.scopeId;
     if (!ownerUserId)
       throw new Error("personal runner scope requires --scope-id <owner-user-id>");
-    if (command.flags.projectAccess !== undefined)
-      throw new Error("personal runner scope does not accept --project-access");
-    return { kind: "personal", ownerUserId };
+    return { kind: "personal", ownerUserId, projectAccess: command.flags.projectAccess ?? "all" };
   }
   throw new Error("--scope-type must be workspace, project, or personal");
 }
@@ -5291,12 +5453,12 @@ function repoBindingCredentialRefLabel(ref) {
 function runnerRow(runner) {
   const ownership = runner.ownership;
   let effectiveProjectAccess;
-  if (ownership.kind === "workspace")
-    effectiveProjectAccess = ownership.projectAccess === "all" ? "workspace_all" : runner.projectGrantIds.join(",") || "selected_none";
-  else if (ownership.kind === "project")
+  if (ownership.kind === "project")
     effectiveProjectAccess = `project:${ownership.projectId}`;
+  else if (ownership.projectAccess === "selected")
+    effectiveProjectAccess = runner.projectGrantIds.join(",") || "selected_none";
   else
-    effectiveProjectAccess = `personal:${ownership.ownerUserId}`;
+    effectiveProjectAccess = ownership.kind === "workspace" ? "workspace_all" : `personal:${ownership.ownerUserId}`;
   return {
     id: runner.id,
     name: runner.name,
@@ -5310,7 +5472,7 @@ function runnerRow(runner) {
     sandboxes: runner.capabilities.sandboxBackends.join(","),
     labels: runner.labels.join(","),
     ownership: ownership.kind,
-    projectAccess: ownership.kind === "workspace" ? ownership.projectAccess : undefined,
+    projectAccess: ownership.kind === "project" ? undefined : ownership.projectAccess,
     ownerUserId: ownership.kind === "personal" ? ownership.ownerUserId : undefined,
     scopedProjectId: ownership.kind === "project" ? ownership.projectId : undefined,
     effectiveProjectAccess,
@@ -5429,7 +5591,7 @@ function downloadPresignedAsset(download, outputPath) {
   return gen(function* () {
     const fs = yield* FileSystem;
     const failed = (cause) => new CliError({ message: `Asset download failed: ${String(cause)}` });
-    const response = yield* send(make13(download.method)(download.url), failed);
+    const response = yield* send(make12(download.method)(download.url), failed);
     if (response.status < 200 || response.status >= 300)
       return yield* new CliError({ message: `Asset download failed with ${response.status}` });
     const body = yield* response.arrayBuffer.pipe(mapError((error) => failed(error.message)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/cli",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "type": "module",
   "license": "UNLICENSED",
   "bin": {