@kitman-sh/cli 0.7.2 → 0.7.4

package/dist/index.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env bun
 // @bun
 import {
-  pipeArguments,
   identity,
   isUndefined,
   isNotUndefined,
@@ -20,12 +19,8 @@ import {
   fromUndefinedOr,
   getOrUndefined,
   Service,
-  add,
-  get,
   Reference,
   of,
-  fromInputUnsafe,
-  isFinite,
   toMillis,
   TaggedError,
   squash,
@@ -34,19 +29,12 @@ import {
   UnknownError,
   succeed2,
   fail2,
-  void_,
-  isSuccess2,
-  isFailure2,
   makeUnsafe,
   _await,
   isDone,
   isDoneUnsafe,
   doneUnsafe,
-  Scope,
-  makeUnsafe2,
-  addFinalizerExit,
   addFinalizer,
-  close,
   succeed4,
   effect,
   mergeAll,
@@ -66,8 +54,7 @@ import {
   gen,
   fail4,
   try_,
-  withFiber,
-  flatMap,
+  flatMap2,
   andThen,
   tap,
   map3,
@@ -86,31 +73,22 @@ import {
   provide3,
   provideContext,
   provideService,
-  scope,
   scoped,
   acquireRelease,
   addFinalizer2,
   ensuring,
-  onExit,
-  interrupt2,
   uninterruptible,
-  uninterruptibleMask,
   forever,
   forkScoped,
-  runForkWith,
   fnUntraced,
   logWarning,
   logError,
   runMain,
   systemError,
   badArgument,
-  join,
-  interrupt3,
-  getCurrent,
-  runIn,
   makeUnsafe3,
-  make7,
   make8,
+  make9,
   offerUnsafe,
   endUnsafe,
   take,
@@ -120,6 +98,8 @@ import {
   isSink,
   fromChannel,
   drain,
+  make10,
+  get2,
   isStream,
   fromChannel2,
   empty2,
@@ -135,9 +115,9 @@ import {
   ExitCode,
   ProcessId,
   makeHandle,
-  make10,
+  make12,
   ChildProcessSpawner,
-  make11,
+  make13,
   parseFdName,
   fdName,
   handleErrnoException,
@@ -203,8 +183,8 @@ import {
   agentCredentialForApi,
   storeAgentCredential,
   raw,
-  make12,
-  get2,
+  make14,
+  get3,
   put,
   execute,
   Fetch,
@@ -227,146 +207,7 @@ import {
   runCommand2,
   detectHarnesses2,
   herdrRunnerCapabilities2
-} from "./chunk-704ws2q7.js";
-
-// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/internal/rcRef.js
-var TypeId = "~effect/RcRef";
-var stateEmpty = {
-  _tag: "Empty"
-};
-var stateClosed = {
-  _tag: "Closed"
-};
-var variance = {
-  _A: identity,
-  _E: identity
-};
-
-class RcRefImpl {
-  [TypeId] = variance;
-  pipe() {
-    return pipeArguments(this, arguments);
-  }
-  state = stateEmpty;
-  acquire;
-  context;
-  scope;
-  idleTimeToLive;
-  constructor(acquire, context, scope, idleTimeToLive) {
-    this.acquire = acquire;
-    this.context = context;
-    this.scope = scope;
-    this.idleTimeToLive = idleTimeToLive;
-  }
-}
-var make = (options) => withFiber((fiber) => {
-  const context = fiber.context;
-  const scope = get(context, Scope);
-  const ref = new RcRefImpl(options.acquire, context, scope, options.idleTimeToLive !== undefined ? fromInputUnsafe(options.idleTimeToLive) : undefined);
-  return as(addFinalizerExit(scope, () => {
-    const state = ref.state;
-    ref.state = stateClosed;
-    if (state._tag === "Acquired")
-      return close(state.scope, void_);
-    if (state._tag === "Acquiring")
-      return interrupt3(state.fiber);
-    return void_2;
-  }), ref);
-});
-var getState = (self, restore) => {
-  switch (self.state._tag) {
-    case "Closed": {
-      return interrupt2;
-    }
-    case "Acquired": {
-      const state = self.state;
-      state.refCount++;
-      return state.fiber ? as(interrupt3(state.fiber), state) : succeed5(state);
-    }
-    case "Acquiring": {
-      const state = self.state;
-      state.awaiters++;
-      return awaitAcquiring(self, state, restore);
-    }
-    case "Empty": {
-      const acquiring = {
-        _tag: "Acquiring",
-        fiber: undefined,
-        awaiters: 1,
-        acquired: undefined
-      };
-      self.state = acquiring;
-      const scope = makeUnsafe2();
-      const acquire = provideContext(self.acquire, add(self.context, Scope, scope)).pipe(flatMap((value) => {
-        if (self.state !== acquiring) {
-          return interrupt2;
-        }
-        const state = {
-          _tag: "Acquired",
-          value,
-          scope,
-          fiber: undefined,
-          refCount: acquiring.awaiters,
-          invalidated: false
-        };
-        self.state = state;
-        acquiring.acquired = state;
-        return succeed5(state);
-      }), onExit((exit) => {
-        if (isSuccess2(exit))
-          return void_2;
-        if (self.state === acquiring)
-          self.state = stateEmpty;
-        return close(scope, exit);
-      }));
-      acquiring.fiber = runForkWith(getCurrent().context)(acquire);
-      return awaitAcquiring(self, acquiring, restore);
-    }
-  }
-};
-var awaitAcquiring = (self, acquiring, restore) => onExit(restore(join(acquiring.fiber)), (exit) => {
-  const acquired = acquiring.acquired;
-  if (acquired !== undefined) {
-    return isFailure2(exit) ? release(self, acquired) : void_2;
-  }
-  if (--acquiring.awaiters > 0 || self.state !== acquiring)
-    return void_2;
-  self.state = stateEmpty;
-  return interrupt3(acquiring.fiber);
-});
-var get3 = (self_) => {
-  const self = self_;
-  return uninterruptibleMask((restore) => flatMap(scope, (scope) => flatMap(getState(self, restore), (state) => as(addFinalizerExit(scope, () => release(self, state)), state.value))));
-};
-var release = (self, state) => {
-  state.refCount--;
-  if (state.refCount > 0) {
-    return void_2;
-  }
-  const idleTimeToLive = self.idleTimeToLive;
-  if (idleTimeToLive === undefined || state.invalidated) {
-    if (self.state === state) {
-      self.state = stateEmpty;
-    }
-    return close(state.scope, void_);
-  } else if (!isFinite(idleTimeToLive)) {
-    return void_2;
-  }
-  state.fiber = uninterruptibleMask((restore) => flatMap(restore(sleep(idleTimeToLive)), () => {
-    if (self.state === state && state.refCount === 0) {
-      self.state = stateEmpty;
-      return close(state.scope, void_);
-    }
-    return void_2;
-  })).pipe(ensuring(sync(() => {
-    state.fiber = undefined;
-  })), runForkWith(self.context), runIn(self.scope));
-  return void_2;
-};
-
-// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/RcRef.js
-var make2 = make;
-var get4 = get3;
+} from "./chunk-jd09xfx0.js";
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeChildProcessSpawner.js
 import * as NodeChildProcess from "child_process";
@@ -393,7 +234,7 @@ var fromWritableChannel = (options) => fromTransform((pull) => {
     pull
   }));
 });
-var pullIntoWritable = (options) => options.pull.pipe(flatMap((chunk) => {
+var pullIntoWritable = (options) => options.pull.pipe(flatMap2((chunk) => {
   let i = 0;
   return callback((resume) => {
     let cancelled = false;
@@ -454,7 +295,7 @@ var fromReadableChannel = (options) => fromTransform((_, scope) => readableToPul
 var readableToPullUnsafe = (options) => {
   const readable = options.readable;
   const closeOnDone = options.closeOnDone ?? true;
-  const exit = options.exit ?? make7(undefined);
+  const exit = options.exit ?? make8(undefined);
   const latch = options.latch ?? makeUnsafe3(false);
   function onReadable() {
     latch.openUnsafe();
@@ -480,7 +321,7 @@ var readableToPullUnsafe = (options) => {
         return fail4(Done());
       }
       latch.closeUnsafe();
-      return flatMap(latch.await, loop);
+      return flatMap2(latch.await, loop);
     }
     const chunk = of(item);
     while (true) {
@@ -544,7 +385,7 @@ var taskkill = (childProcess, onExit = () => {}) => {
     windowsHide: true
   }, onExit);
 };
-var make3 = /* @__PURE__ */ gen(function* () {
+var make = /* @__PURE__ */ gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
   const resolveWorkingDirectory = fnUntraced(function* (options) {
@@ -910,7 +751,7 @@ var make3 = /* @__PURE__ */ gen(function* () {
           getOutputFd
         } = yield* setupAdditionalFds(cmd, childProcess, resolvedAdditionalFds);
         const isRunning = map3(isDone(exitSignal), (done) => !done);
-        const exitCode = flatMap(_await(exitSignal), ([code, signal]) => {
+        const exitCode = flatMap2(_await(exitSignal), ([code, signal]) => {
           if (isNotNull(code)) {
             return succeed5(ExitCode(code));
           }
@@ -946,7 +787,7 @@ var make3 = /* @__PURE__ */ gen(function* () {
           const sourceStream = unwrap(succeed5(getSourceStream(handles[handles.length - 1], options.from)));
           const toOption = options.to ?? "stdin";
           if (toOption === "stdin") {
-            handles.push(yield* spawnCommand(make11(command.command, command.args, {
+            handles.push(yield* spawnCommand(make13(command.command, command.args, {
               ...command.options,
               stdin: {
                 ...stdinConfig,
@@ -958,7 +799,7 @@ var make3 = /* @__PURE__ */ gen(function* () {
             if (isNotUndefined(fd)) {
               const fdName2 = fdName(fd);
               const existingFds = command.options.additionalFds ?? {};
-              handles.push(yield* spawnCommand(make11(command.command, command.args, {
+              handles.push(yield* spawnCommand(make13(command.command, command.args, {
                 ...command.options,
                 additionalFds: {
                   ...existingFds,
@@ -969,7 +810,7 @@ var make3 = /* @__PURE__ */ gen(function* () {
                 }
               })));
             } else {
-              handles.push(yield* spawnCommand(make11(command.command, command.args, {
+              handles.push(yield* spawnCommand(make13(command.command, command.args, {
                 ...command.options,
                 stdin: {
                   ...stdinConfig,
@@ -1008,9 +849,9 @@ var make3 = /* @__PURE__ */ gen(function* () {
       }
     }
   });
-  return make10(spawnCommand);
+  return make12(spawnCommand);
 });
-var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make3);
+var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make);
 var flattenCommand = (command) => {
   const commands = [];
   const pipeOptions = [];
@@ -1041,10 +882,10 @@ var flattenCommand = (command) => {
 };
 
 // node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Stdio.js
-var TypeId2 = "~effect/Stdio";
-var Stdio = /* @__PURE__ */ Service(TypeId2);
-var make4 = (options) => ({
-  [TypeId2]: TypeId2,
+var TypeId = "~effect/Stdio";
+var Stdio = /* @__PURE__ */ Service(TypeId);
+var make2 = (options) => ({
+  [TypeId]: TypeId,
   stdinIsTerminal: succeed5(false),
   stdoutIsTerminal: succeed5(false),
   stderrIsTerminal: succeed5(false),
@@ -1052,7 +893,7 @@ var make4 = (options) => ({
 });
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeStdio.js
-var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make4({
+var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make2({
   args: /* @__PURE__ */ sync(() => process.argv.slice(2)),
   stdinIsTerminal: /* @__PURE__ */ sync(() => process.stdin.isTTY === true),
   stdoutIsTerminal: /* @__PURE__ */ sync(() => process.stdout.isTTY === true),
@@ -1093,7 +934,7 @@ var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make4({
 var layer7 = layer6;
 
 // node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Terminal.js
-var TypeId3 = "~effect/Terminal";
+var TypeId2 = "~effect/Terminal";
 var QuitErrorTypeId = "~effect/Terminal/QuitError";
 
 class QuitError extends (/* @__PURE__ */ Error2("QuitError")({
@@ -1102,17 +943,17 @@ class QuitError extends (/* @__PURE__ */ Error2("QuitError")({
   [QuitErrorTypeId] = QuitErrorTypeId;
 }
 var Terminal = /* @__PURE__ */ Service("effect/Terminal");
-var make5 = (impl) => Terminal.of({
+var make3 = (impl) => Terminal.of({
   ...impl,
-  [TypeId3]: TypeId3
+  [TypeId2]: TypeId2
 });
 
 // node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeTerminal.js
 import * as readline from "readline";
-var make6 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
+var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
   const stdin = process.stdin;
   const stdout = process.stdout;
-  const lines = yield* make8();
+  const lines = yield* make9();
   let inputEnded = stdin.readableEnded;
   let readlineActive = false;
   const onStdinEnd = () => {
@@ -1123,7 +964,7 @@ var make6 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
   };
   stdin.once("end", onStdinEnd);
   yield* addFinalizer2(() => sync(() => stdin.off("end", onStdinEnd)));
-  const rlRef = yield* make2({
+  const rlRef = yield* make10({
     acquire: acquireRelease(sync(() => {
       const rl = readline.createInterface({
         input: stdin,
@@ -1167,7 +1008,7 @@ var make6 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
   const columns = sync(() => stdout.columns ?? 0);
   const rows = sync(() => stdout.rows ?? 0);
   const readInput = gen(function* () {
-    const queue = yield* make8();
+    const queue = yield* make9();
     const handleKeypress = (s, k) => {
       const userInput = {
         input: fromUndefinedOr(s),
@@ -1197,13 +1038,13 @@ var make6 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
     if (inputEnded) {
       handleEnd();
     } else {
-      yield* get4(rlRef);
+      yield* get2(rlRef);
       stdin.once("end", handleEnd);
     }
     return queue;
   });
-  const readLine = suspend(() => poll(lines).pipe(flatMap(match({
-    onNone: () => scoped(andThen(get4(rlRef), take(lines))),
+  const readLine = suspend(() => poll(lines).pipe(flatMap2(match({
+    onNone: () => scoped(andThen(get2(rlRef), take(lines))),
     onSome: succeed5
   })), mapError(() => new QuitError({}))));
   const display = (prompt2) => uninterruptible(callback((resume) => {
@@ -1214,7 +1055,7 @@ var make6 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
       cause: err
     }))));
   }));
-  return make5({
+  return make3({
     columns,
     rows,
     readInput,
@@ -1222,7 +1063,7 @@ var make6 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit
     display
   });
 });
-var layer8 = /* @__PURE__ */ effect(Terminal, /* @__PURE__ */ make6(defaultShouldQuit));
+var layer8 = /* @__PURE__ */ effect(Terminal, /* @__PURE__ */ make4(defaultShouldQuit));
 function defaultShouldQuit(input) {
   const key = input.key;
   return key.name === "escape" || key.ctrl && (key.name === "c" || key.name === "d");
@@ -1334,9 +1175,9 @@ function renderMaterializationPlan(plan) {
     harness: plan.harness,
     operations: plan.operations.map((operation) => ({
       kind: operation.kind,
-      skillName: operation.skillName,
+      skillName: auditOperationName(operation),
       skillIdentityHash: hashIdentity(auditOperationIdentity(operation)),
-      target: operation.kind === "write_skill" ? operation.path : operation.targetPath
+      target: operation.kind === "symlink_skill" ? operation.targetPath : operation.path
     })),
     materializedSkills: plan.materializedSkills.map((skill) => ({
       name: skill.name,
@@ -1361,8 +1202,25 @@ function renderConfigPlan(plan) {
     warnings: plan.warnings.map((warning) => warning.message)
   };
 }
+function auditOperationName(operation) {
+  if (operation.kind === "fetch_git_plugin")
+    return operation.pluginName;
+  if (operation.kind === "write_codex_marketplace" || operation.kind === "unlink_stale_links")
+    return "kitman";
+  return operation.skillName;
+}
 function auditOperationIdentity(operation) {
-  return operation.kind === "write_skill" ? `write_skill:${operation.skillName}:content_sha256:${hashIdentity(operation.content)}:${operation.path}` : `symlink_skill:${operation.skillName}:symlink:${operation.sourcePath}:${operation.targetPath}`;
+  if (operation.kind === "write_skill")
+    return `write_skill:${operation.skillName}:content_sha256:${hashIdentity(operation.content)}:${operation.path}`;
+  if (operation.kind === "fetch_git_skill")
+    return `fetch_git_skill:${operation.skillName}:${operation.url}#${operation.ref}:${operation.repositoryPath ?? ""}:${operation.path}`;
+  if (operation.kind === "fetch_git_plugin")
+    return `fetch_git_plugin:${operation.pluginName}:${operation.url}#${operation.ref}:${operation.path}`;
+  if (operation.kind === "write_codex_marketplace")
+    return `write_codex_marketplace:content_sha256:${hashIdentity(operation.content)}:${operation.path}`;
+  if (operation.kind === "unlink_stale_links")
+    return `unlink_stale_links:${operation.sourceRoot}:${operation.keepPaths.join(",")}:${operation.path}`;
+  return `symlink_skill:${operation.skillName}:symlink:${operation.sourcePath}:${operation.targetPath}`;
 }
 function auditMaterializedSkillIdentity(skill) {
   return `${skill.harness}:${skill.name}:${skill.source.kind}:${skill.skillPath ?? ""}:${skill.managed}`;
@@ -1468,7 +1326,7 @@ function createOperationalCliClient(client) {
   };
 }
 function parseJsonInput(value, label) {
-  return decodeJsonString(value).pipe(mapError(() => new CliError({ message: `${label} requires valid JSON` })), flatMap((json) => isJsonObject(json) ? succeed5(json) : fail4(new CliError({ message: `${label} requires a JSON object` }))));
+  return decodeJsonString(value).pipe(mapError(() => new CliError({ message: `${label} requires valid JSON` })), flatMap2((json) => isJsonObject(json) ? succeed5(json) : fail4(new CliError({ message: `${label} requires a JSON object` }))));
 }
 function idempotencyKey(value, operation) {
   const explicit = value?.trim();
@@ -1527,7 +1385,7 @@ import { hostname } from "os";
 var Git = Reference("kitman/cli/Git", {
   defaultValue: () => (args) => runCommand2("git", args).pipe(map3((stdout) => stdout.trim()))
 });
-var repoBindingInputFromCurrentRepo = flatMap(Git, repoBindingInput);
+var repoBindingInputFromCurrentRepo = flatMap2(Git, repoBindingInput);
 function repoBindingInput(git) {
   return gen(function* () {
     const remoteUrl = yield* git(["remote", "get-url", "origin"]);
@@ -1790,7 +1648,7 @@ var kitmanCommand = () => {
   const [runtime, script] = process.argv;
   return script === undefined || script.startsWith("/$bunfs/") ? [process.execPath] : [runtime ?? process.execPath, script];
 };
-var readText = (path) => flatMap(FileSystem, (fs) => fs.readFileString(path)).pipe(orElseSucceed(() => {
+var readText = (path) => flatMap2(FileSystem, (fs) => fs.readFileString(path)).pipe(orElseSucceed(() => {
   return;
 }));
 var verificationStep = (client, projectId, binding, confirm, step) => gen(function* () {
@@ -1929,7 +1787,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.7.2";
+var cliVersion = "0.7.4";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -2049,7 +1907,7 @@ var scaffoldPackage = (directory, scaffold = {}) => gen(function* () {
   const path = yield* Path;
   const root = path.resolve(directory);
   if (scaffold.fork !== undefined) {
-    const { shippedLoops } = yield* promise(() => import("./chunk-epdajq63.js"));
+    const { shippedLoops } = yield* promise(() => import("./chunk-jwtkec1w.js"));
     if (!(scaffold.fork in shippedLoops))
       return yield* new CliError({
         message: `Kitman ships no Loop ${scaffold.fork}; fork one of ${Object.keys(shippedLoops).join(", ")}`
@@ -2143,7 +2001,7 @@ var Usage = [
 `);
 var KitCreateValidator = guard(KitCreate);
 var KitUpdateValidator = guard(KitUpdate);
-var agentRuntime = promise(() => import("./chunk-vjnae06n.js"));
+var agentRuntime = promise(() => import("./chunk-s92k78ef.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -2623,7 +2481,7 @@ function harnessSync(args) {
       };
     });
     const projectRoot = command.flags.projectScope ? yield* resolveProjectWriteRoot : undefined;
-    const targetPlans = yield* previewEnvironmentPlans(environments, command, projectRoot, config.mcpCredentialName, syncKits);
+    const targetPlans = yield* previewEnvironmentPlans(environments, command, projectRoot, config.mcpCredentialName, syncKits, (yield* readUserConfig()) ?? {});
     const environmentPlan = composeAgentEnvironmentSyncPlan(targetPlans);
     const materializationPlans = targetPlans.map((target) => target.skills);
     const userConfigPlans = command.flags.projectScope ? [] : targetPlans.map((target) => target.harnessConfig);
@@ -2640,15 +2498,14 @@ function harnessSync(args) {
       syncKits
     });
     const applied = !command.flags.preview;
-    if (applied) {
+    if (applied)
       yield* writeHarnessSyncPlan(outputPath, plan);
-      yield* applyAgentEnvironmentPlans(environmentPlan);
-    }
+    const resultPlan = applied ? yield* applyAgentEnvironmentPlans(environmentPlan) : environmentPlan;
     return {
       command,
       plan,
-      environmentPlan,
-      materializationPlans,
+      environmentPlan: resultPlan,
+      materializationPlans: resultPlan.targets.map((target) => target.skills),
       configPlans,
       userConfigPlans,
       projectConfigPlans,
@@ -2795,8 +2652,8 @@ function isInstallDefaultKit(kit) {
   const rollout = isObject(marketplace) && marketplace !== null && "rollout" in marketplace ? marketplace.rollout : undefined;
   return isObject(rollout) && rollout !== null && "installDefault" in rollout && rollout.installDefault === true;
 }
-function previewEnvironmentPlans(environments, command, projectRoot, mcpCredentialName, syncKits = []) {
-  return forEach(environments, (environment, index) => gen(function* () {
+function previewEnvironmentPlans(environments, command, projectRoot, mcpCredentialName, syncKits = [], userConfig = {}) {
+  const previews = forEach(environments, (environment, index) => gen(function* () {
     const rootDir = command.flags.projectScope ? projectRoot : getOrUndefined(yield* option2(String3("HOME")));
     const { previewAgentEnvironmentPlan } = yield* agentRuntime;
     return yield* previewAgentEnvironmentPlan({
@@ -2805,12 +2662,16 @@ function previewEnvironmentPlans(environments, command, projectRoot, mcpCredenti
       scope: command.flags.projectScope ? "project" : "user",
       ...rootDir === undefined ? undefined : { rootDir },
       ...command.flags.noInstall === undefined ? undefined : { noInstall: command.flags.noInstall },
+      ...userConfig.approvedSkillSources === undefined ? undefined : { approvedSkillSources: userConfig.approvedSkillSources },
+      ...userConfig.requireReviewedSources === undefined ? undefined : { requireReviewedSources: userConfig.requireReviewedSources },
+      ...userConfig.versions === undefined ? undefined : { versions: userConfig.versions },
       ...mcpCredentialName === undefined ? undefined : { mcpCredentialName }
     });
   }));
+  return flatMap2(agentRuntime, ({ withSourceResolutionCache }) => withSourceResolutionCache(previews));
 }
 var confirmSyncAfterKitToggle = map3(promptLine("Sync enabled kits now? [Y/n] "), (answer) => ["", "y", "yes"].includes(answer.trim().toLowerCase()));
-var readStdin = Stdio.pipe(flatMap((stdio) => mkString(decodeText(stdio.stdin))), map3((text) => text.trim()));
+var readStdin = Stdio.pipe(flatMap2((stdio) => mkString(decodeText(stdio.stdin))), map3((text) => text.trim()));
 function promptLine(prompt2) {
   return gen(function* () {
     const terminal = yield* Terminal;
@@ -2935,7 +2796,7 @@ function interactiveKitToggle(kits, harnesses, preferences) {
       }
     }
     return { ...preferences, perHarnessKitActivations: [...updates.values()] };
-  }).pipe(ensuring(ignore(Terminal.pipe(flatMap((terminal) => terminal.display("\x1B[?25h"))))), scoped);
+  }).pipe(ensuring(ignore(Terminal.pipe(flatMap2((terminal) => terminal.display("\x1B[?25h"))))), scoped);
 }
 function mixedKitState(kit, harnesses, preferences) {
   const states = harnesses.map((harness) => kitEnabledForHarness(preferences, harness, kit.id));
@@ -3041,7 +2902,7 @@ function browserSession(apiUrl) {
       clientId: ClientId,
       onUrl: (url) => andThen(log(`Open this URL to log in:
 ${url}`), openBrowser(url)),
-      onTimeout: (state) => promptLine("Paste the full callback URL: ").pipe(mapError(() => new CliError({ message: "No callback URL provided" })), flatMap((line) => parseCallbackUrl(line.trim(), state)))
+      onTimeout: (state) => promptLine("Paste the full callback URL: ").pipe(mapError(() => new CliError({ message: "No callback URL provided" })), flatMap2((line) => parseCallbackUrl(line.trim(), state)))
     });
     const session = toStoredSession(token);
     yield* storeSession(apiUrl, session);
@@ -3393,7 +3254,7 @@ function runnerCommand(args) {
   });
 }
 var SandboxHostProbe = Reference("kitman/cli/SandboxHostProbe", {
-  defaultValue: () => flatMap(agentRuntime, (runtime) => runtime.commandHostProbe)
+  defaultValue: () => flatMap2(agentRuntime, (runtime) => runtime.commandHostProbe)
 });
 var runnerSettings = gen(function* () {
   const optional = (name) => String3(name).pipe(option2, map3((value) => getOrUndefined(value)?.trim()));
@@ -3449,7 +3310,7 @@ function startCanonicalHerdrRunnerCommand(input) {
       superviseReplica,
       verificationExecutor
     } = yield* agentRuntime;
-    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-gzhxsb25.js"));
+    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-5cc3fb7y.js"));
     const settings = yield* runnerSettings;
     const { concurrency, fullAccess, sshAgentAvailable } = settings;
     const personal = input.runner.ownership.kind === "personal";
@@ -3461,6 +3322,15 @@ function startCanonicalHerdrRunnerCommand(input) {
       });
     const repoBinding = input.projectId === undefined ? undefined : (yield* input.client.listRepoBindings(input.projectId)).items.find((binding) => binding.status === "active");
     const harnesses = yield* detectHarnesses;
+    if (harnesses.harnesses.length > 0)
+      yield* harnessSync([
+        "sync",
+        ...harnesses.harnesses.map((harness) => harness === "claude" ? "claude-code" : harness),
+        "--workspace",
+        input.workspaceId,
+        "--api-url",
+        input.apiUrl
+      ]).pipe(catch_((error2) => error(`Harness sync failed; the Runner starts on the previous one: ${error2.message}`)));
     const advertisedCapabilities = repoBinding === undefined ? herdrRunnerCapabilities({ harnesses, fullAccess, sandbox: host, shared: !personal }) : herdrRunnerCapabilitiesForRepoBinding(repoBinding, {
       harnesses,
       fullAccess,
@@ -3602,7 +3472,7 @@ function startCanonicalHerdrRunnerCommand(input) {
             healthStatus: "healthy",
             capabilities,
             labels: input.runner.labels
-          }).pipe(flatMap(() => controlPlane.client.heartbeatRunnerReplica(input.runner.id, replica.id, {
+          }).pipe(flatMap2(() => controlPlane.client.heartbeatRunnerReplica(input.runner.id, replica.id, {
             healthStatus: "healthy",
             drainState: "accepting",
             capacity: { maxConcurrentRuns: concurrency },
@@ -3667,7 +3537,7 @@ function mcpCommand(args) {
     if (command.action === "run") {
       if (command.args.length > 0)
         return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
-      const { runMcpServerCommand } = yield* promise(() => import("./chunk-226sychh.js"));
+      const { runMcpServerCommand } = yield* promise(() => import("./chunk-120n71cv.js"));
       return yield* runMcpServerCommand({ flags: command.flags });
     }
     if (command.action !== "setup")
@@ -4003,7 +3873,7 @@ function taskCommand(args) {
       const sourcePath = command.args[1];
       if (!sourcePath)
         return yield* new CliError({ message: `${command.group} upload-asset requires file path` });
-      const bytes = yield* FileSystem.pipe(flatMap((fs) => fs.readFile(sourcePath)));
+      const bytes = yield* FileSystem.pipe(flatMap2((fs) => fs.readFile(sourcePath)));
       const input = {
         filename: command.flags.filename ?? (yield* Path).basename(sourcePath),
         contentType: command.flags.contentType ?? "application/octet-stream",
@@ -4278,7 +4148,7 @@ function loopCatalogCommand(args) {
     return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
   });
 }
-var taskTypeNamed = (client, workspaceId, named) => flatMap(client.listTaskTypes(workspaceId), (types) => {
+var taskTypeNamed = (client, workspaceId, named) => flatMap2(client.listTaskTypes(workspaceId), (types) => {
   const found = types.items.find((type) => type.id === named || type.name.toLowerCase() === named.toLowerCase());
   return found === undefined ? fail4(new CliError({
     message: `No Task Type "${named}"; the Workspace has ${types.items.map((type) => type.name).join(", ")}`
@@ -4653,7 +4523,7 @@ function verifyCommand(args) {
     }
   });
 }
-var secretValueFromStdin = Stdio.pipe(flatMap((stdio) => mkString(decodeText(stdio.stdin))), map3((text) => text.replace(/\r?\n$/, "")));
+var secretValueFromStdin = Stdio.pipe(flatMap2((stdio) => mkString(decodeText(stdio.stdin))), map3((text) => text.replace(/\r?\n$/, "")));
 function secretCommand(args) {
   return gen(function* () {
     const command = parseCommand(args.length === 1 ? [...args, "list"] : args);
@@ -4687,7 +4557,7 @@ function secretCommand(args) {
   });
 }
 var PackageBuilder = Reference("kitman/cli/PackageBuilder", {
-  defaultValue: () => (directory) => flatMap(promise(() => import("./chunk-hrd7xmax.js")), (build) => build.buildPackage(directory))
+  defaultValue: () => (directory) => flatMap2(promise(() => import("./chunk-gew1a5p6.js")), (build) => build.buildPackage(directory))
 });
 var optionalEnv = (name) => String3(name).pipe(option2, map3(getOrUndefined));
 var ciIdToken = (apiUrl) => gen(function* () {
@@ -4701,7 +4571,7 @@ var ciIdToken = (apiUrl) => gen(function* () {
   const url = new URL(requestUrl);
   const refused = (reason) => new CliError({ message: `GitHub Actions issued no ID token: ${reason}` });
   url.searchParams.set("audience", apiUrl.replace(/\/+$/, ""));
-  const response = yield* send(get2(url, { headers: { authorization: `Bearer ${requestToken}` } }), (cause) => refused(String(cause)));
+  const response = yield* send(get3(url, { headers: { authorization: `Bearer ${requestToken}` } }), (cause) => refused(String(cause)));
   if (response.status < 200 || response.status >= 300)
     return yield* refused(`${response.status}; does the job have id-token: write?`);
   const body = yield* response.text.pipe(mapError((error) => refused(error.message)));
@@ -5192,9 +5062,7 @@ function runnerOwnershipFromCommand(command, required) {
     const ownerUserId = command.flags.scopeId;
     if (!ownerUserId)
       throw new Error("personal runner scope requires --scope-id <owner-user-id>");
-    if (command.flags.projectAccess !== undefined)
-      throw new Error("personal runner scope does not accept --project-access");
-    return { kind: "personal", ownerUserId };
+    return { kind: "personal", ownerUserId, projectAccess: command.flags.projectAccess ?? "all" };
   }
   throw new Error("--scope-type must be workspace, project, or personal");
 }
@@ -5450,12 +5318,12 @@ function repoBindingCredentialRefLabel(ref) {
 function runnerRow(runner) {
   const ownership = runner.ownership;
   let effectiveProjectAccess;
-  if (ownership.kind === "workspace")
-    effectiveProjectAccess = ownership.projectAccess === "all" ? "workspace_all" : runner.projectGrantIds.join(",") || "selected_none";
-  else if (ownership.kind === "project")
+  if (ownership.kind === "project")
     effectiveProjectAccess = `project:${ownership.projectId}`;
+  else if (ownership.projectAccess === "selected")
+    effectiveProjectAccess = runner.projectGrantIds.join(",") || "selected_none";
   else
-    effectiveProjectAccess = `personal:${ownership.ownerUserId}`;
+    effectiveProjectAccess = ownership.kind === "workspace" ? "workspace_all" : `personal:${ownership.ownerUserId}`;
   return {
     id: runner.id,
     name: runner.name,
@@ -5469,7 +5337,7 @@ function runnerRow(runner) {
     sandboxes: runner.capabilities.sandboxBackends.join(","),
     labels: runner.labels.join(","),
     ownership: ownership.kind,
-    projectAccess: ownership.kind === "workspace" ? ownership.projectAccess : undefined,
+    projectAccess: ownership.kind === "project" ? undefined : ownership.projectAccess,
     ownerUserId: ownership.kind === "personal" ? ownership.ownerUserId : undefined,
     scopedProjectId: ownership.kind === "project" ? ownership.projectId : undefined,
     effectiveProjectAccess,
@@ -5588,7 +5456,7 @@ function downloadPresignedAsset(download, outputPath) {
   return gen(function* () {
     const fs = yield* FileSystem;
     const failed = (cause) => new CliError({ message: `Asset download failed: ${String(cause)}` });
-    const response = yield* send(make12(download.method)(download.url), failed);
+    const response = yield* send(make14(download.method)(download.url), failed);
     if (response.status < 200 || response.status >= 300)
       return yield* new CliError({ message: `Asset download failed with ${response.status}` });
     const body = yield* response.arrayBuffer.pipe(mapError((error) => failed(error.message)));
@@ -5774,7 +5642,7 @@ function kitCreateInput(command) {
         return yield* new CliError({
           message: "kit create --source cannot be combined with --name, --description, --kind, --content, or --stdin"
         });
-      const content = yield* FileSystem.pipe(flatMap((fs) => fs.readFileString(command.flags.source ?? "")));
+      const content = yield* FileSystem.pipe(flatMap2((fs) => fs.readFileString(command.flags.source ?? "")));
       return yield* parseKitCreateSource(content);
     }
     const name = command.flags.name ?? prompt("Kit name: ");
@@ -5801,7 +5669,7 @@ function kitUpdateInput(command) {
         return yield* new CliError({
           message: "kit update --source cannot be combined with --name, --description, --kind, --content, or --stdin"
         });
-      const content = yield* FileSystem.pipe(flatMap((fs) => fs.readFileString(command.flags.source ?? "")));
+      const content = yield* FileSystem.pipe(flatMap2((fs) => fs.readFileString(command.flags.source ?? "")));
       return yield* parseKitUpdateSource(content);
     }
     const input = {