@notiamo/runner 0.1.2 → 0.2.0

package/dist/cli.js

@@ -1045,8 +1045,8 @@ var require_safePathNames = __commonJS({
     })();
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.isSafePathName = isSafePathName;
-    var path11 = __importStar(__require("path"));
-    function isSafePathName(name, localPath = path11) {
+    var path13 = __importStar(__require("path"));
+    function isSafePathName(name, localPath = path13) {
       if (!name || name === "." || name === ".." || name.includes("/")) {
         return false;
       }
@@ -1704,8 +1704,8 @@ var require_Client = __commonJS({
       /**
        * Set the working directory.
        */
-      async cd(path11) {
-        const validPath = await this.protectWhitespace(path11);
+      async cd(path13) {
+        const validPath = await this.protectWhitespace(path13);
         return this.send("CWD " + validPath);
       }
       /**
@@ -1718,8 +1718,8 @@ var require_Client = __commonJS({
        * Get the last modified time of a file. This is not supported by every FTP server, in which case
        * calling this method will throw an exception.
        */
-      async lastMod(path11) {
-        const validPath = await this.protectWhitespace(path11);
+      async lastMod(path13) {
+        const validPath = await this.protectWhitespace(path13);
         const res = await this.send(`MDTM ${validPath}`);
         const date5 = res.message.slice(4);
         return (0, parseListMLSD_1.parseMLSxDate)(date5);
@@ -1727,8 +1727,8 @@ var require_Client = __commonJS({
       /**
        * Get the size of a file.
        */
-      async size(path11) {
-        const validPath = await this.protectWhitespace(path11);
+      async size(path13) {
+        const validPath = await this.protectWhitespace(path13);
         const command = `SIZE ${validPath}`;
         const res = await this.send(command);
         const size = parseInt(res.message.slice(4), 10);
@@ -1755,8 +1755,8 @@ var require_Client = __commonJS({
        * You can ignore FTP error return codes which won't throw an exception if e.g.
        * the file doesn't exist.
        */
-      async remove(path11, ignoreErrorCodes = false) {
-        const validPath = await this.protectWhitespace(path11);
+      async remove(path13, ignoreErrorCodes = false) {
+        const validPath = await this.protectWhitespace(path13);
         if (ignoreErrorCodes) {
           return this.sendIgnoringError(`DELE ${validPath}`);
         }
@@ -1915,8 +1915,8 @@ var require_Client = __commonJS({
        *
        * @param [path]  Path to remote file or directory.
        */
-      async list(path11 = "") {
-        const validPath = await this.protectWhitespace(path11);
+      async list(path13 = "") {
+        const validPath = await this.protectWhitespace(path13);
         let lastError;
         for (const candidate of this.availableListCommands) {
           const command = validPath === "" ? candidate : `${candidate} ${validPath}`;
@@ -2085,21 +2085,21 @@ var require_Client = __commonJS({
       /**
        * Remove an empty directory, will fail if not empty.
        */
-      async removeEmptyDir(path11) {
-        const validPath = await this.protectWhitespace(path11);
+      async removeEmptyDir(path13) {
+        const validPath = await this.protectWhitespace(path13);
         return this.send(`RMD ${validPath}`);
       }
       /**
        * FTP servers can't handle filenames that have leading whitespace. This method transforms
        * a given path to fix that issue for most cases.
        */
-      async protectWhitespace(path11) {
-        if (!path11.startsWith(" ")) {
-          return path11;
+      async protectWhitespace(path13) {
+        if (!path13.startsWith(" ")) {
+          return path13;
         }
         const pwd = await this.pwd();
         const absolutePathPrefix = pwd.endsWith("/") ? pwd : pwd + "/";
-        return absolutePathPrefix + path11;
+        return absolutePathPrefix + path13;
       }
       async _exitAtCurrentDirectory(func) {
         const userDir = await this.pwd();
@@ -2176,11 +2176,11 @@ var require_Client = __commonJS({
       }
     };
     exports.Client = Client3;
-    async function ensureLocalDirectory(path11) {
+    async function ensureLocalDirectory(path13) {
       try {
-        await fsStat(path11);
+        await fsStat(path13);
       } catch (_a3) {
-        await fsMkDir(path11, { recursive: true });
+        await fsMkDir(path13, { recursive: true });
       }
     }
     async function expectedBytesFromLocalFile(fd, options) {
@@ -5477,8 +5477,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path11) {
-      let input2 = path11;
+    function removeDotSegments(path13) {
+      let input2 = path13;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -5887,8 +5887,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path11 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path11 && path11 !== "/" ? path11 : void 0;
+        const path13 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path13 && path13 !== "/" ? path13 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -16025,7 +16025,7 @@ var require_keyParser = __commonJS({
     var {
       createDecipheriv,
       createECDH,
-      createHash,
+      createHash: createHash2,
       createHmac,
       createSign,
       createVerify,
@@ -16713,11 +16713,11 @@ ${formatted}-----END ${type} KEY-----`;
                 );
               }
               const ivSlice = bufferSlice(cipherIV, 0, 8);
-              let cipherKey = createHash("md5").update(passphrase).update(ivSlice).digest();
+              let cipherKey = createHash2("md5").update(passphrase).update(ivSlice).digest();
               while (cipherKey.length < encInfo.keyLen) {
                 cipherKey = combineBuffers(
                   cipherKey,
-                  createHash("md5").update(cipherKey).update(passphrase).update(ivSlice).digest()
+                  createHash2("md5").update(cipherKey).update(passphrase).update(ivSlice).digest()
                 );
               }
               if (cipherKey.length > encInfo.keyLen)
@@ -16882,8 +16882,8 @@ ${formatted}-----END ${type} KEY-----`;
         if (encrypted) {
           const encInfo = CIPHER_INFO[cipherName];
           let cipherKey = combineBuffers(
-            createHash("sha1").update(PPK_PP1).update(passphrase).digest(),
-            createHash("sha1").update(PPK_PP2).update(passphrase).digest()
+            createHash2("sha1").update(PPK_PP1).update(passphrase).digest(),
+            createHash2("sha1").update(PPK_PP2).update(passphrase).digest()
           );
           if (cipherKey.length > encInfo.keyLen)
             cipherKey = bufferSlice(cipherKey, 0, encInfo.keyLen);
@@ -16923,7 +16923,7 @@ ${formatted}-----END ${type} KEY-----`;
           passphrase = EMPTY_PASSPHRASE;
         const calcMAC = createHmac(
           "sha1",
-          createHash("sha1").update("putty-private-key-file-mac-key").update(passphrase).digest()
+          createHash2("sha1").update("putty-private-key-file-mac-key").update(passphrase).digest()
         ).update(macData).digest("hex");
         if (calcMAC !== mac3) {
           if (encrypted) {
@@ -17567,11 +17567,11 @@ var require_agent = __commonJS({
       };
     })();
     var WINDOWS_PIPE_REGEX = /^[/\\][/\\]\.[/\\]pipe[/\\].+/;
-    function createAgent(path11) {
-      if (process.platform === "win32" && !WINDOWS_PIPE_REGEX.test(path11)) {
-        return path11 === "pageant" ? new PageantAgent() : new CygwinAgent(path11);
+    function createAgent(path13) {
+      if (process.platform === "win32" && !WINDOWS_PIPE_REGEX.test(path13)) {
+        return path13 === "pageant" ? new PageantAgent() : new CygwinAgent(path13);
       }
-      return new OpenSSHAgent(path11);
+      return new OpenSSHAgent(path13);
     }
     var AgentProtocol = (() => {
       const SSH_AGENTC_REQUEST_IDENTITIES = 11;
@@ -19245,7 +19245,7 @@ var require_kex = __commonJS({
       createDiffieHellman,
       createDiffieHellmanGroup,
       createECDH,
-      createHash,
+      createHash: createHash2,
       createPublicKey,
       diffieHellman,
       generateKeyPairSync,
@@ -19671,7 +19671,7 @@ var require_kex = __commonJS({
               DISCONNECT_REASON.KEY_EXCHANGE_FAILED
             );
           }
-          const hash2 = createHash(this.hashName);
+          const hash2 = createHash2(this.hashName);
           hashString(hash2, isServer ? this._remoteIdentRaw : this._identRaw);
           hashString(hash2, isServer ? this._identRaw : this._remoteIdentRaw);
           hashString(hash2, isServer ? this._remoteKexinit : this._kexinit);
@@ -20679,9 +20679,9 @@ var require_kex = __commonJS({
     function generateKEXVal(len, hashName, secret, exchangeHash, sessionID, char) {
       let ret;
       if (len) {
-        let digest = createHash(hashName).update(secret).update(exchangeHash).update(char).update(sessionID).digest();
+        let digest = createHash2(hashName).update(secret).update(exchangeHash).update(char).update(sessionID).digest();
         while (digest.length < len) {
-          const chunk = createHash(hashName).update(secret).update(exchangeHash).update(digest).digest();
+          const chunk = createHash2(hashName).update(secret).update(exchangeHash).update(digest).digest();
           const extended2 = Buffer.allocUnsafe(digest.length + chunk.length);
           extended2.set(digest, 0);
           extended2.set(chunk, digest.length);
@@ -22815,17 +22815,17 @@ var require_SFTP = __commonJS({
       // ===========================================================================
       // Client-specific ===========================================================
       // ===========================================================================
-      createReadStream(path11, options) {
+      createReadStream(path13, options) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        return new ReadStream(this, path11, options);
+        return new ReadStream(this, path13, options);
       }
-      createWriteStream(path11, options) {
+      createWriteStream(path13, options) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        return new WriteStream(this, path11, options);
+        return new WriteStream(this, path13, options);
       }
-      open(path11, flags_, attrs, cb) {
+      open(path13, flags_, attrs, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         if (typeof attrs === "function") {
@@ -22844,7 +22844,7 @@ var require_SFTP = __commonJS({
           attrsFlags = attrs.flags;
           attrsLen = attrs.nb;
         }
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + 4 + attrsLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -22852,7 +22852,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         writeUInt32BE(buf, flags, p += pathLen);
         writeUInt32BE(buf, attrsFlags, p += 4);
         if (attrsLen) {
@@ -22983,7 +22983,7 @@ var require_SFTP = __commonJS({
           throw new Error("Client-only method called in server mode");
         fastXfer(fs, this, localPath, remotePath, opts, cb);
       }
-      readFile(path11, options, callback_) {
+      readFile(path13, options, callback_) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let callback;
@@ -23056,13 +23056,13 @@ var require_SFTP = __commonJS({
             return callback && callback(er, buffer);
           });
         };
-        this.open(path11, flag, 438, (er, handle_) => {
+        this.open(path13, flag, 438, (er, handle_) => {
           if (er)
             return callback && callback(er);
           handle = handle_;
           const tryStat = (er2, st) => {
             if (er2) {
-              this.stat(path11, (er_, st_) => {
+              this.stat(path13, (er_, st_) => {
                 if (er_) {
                   return this.close(handle, () => {
                     callback && callback(er2);
@@ -23083,7 +23083,7 @@ var require_SFTP = __commonJS({
           this.fstat(handle, tryStat);
         });
       }
-      writeFile(path11, data, options, callback_) {
+      writeFile(path13, data, options, callback_) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let callback;
@@ -23102,7 +23102,7 @@ var require_SFTP = __commonJS({
         if (options.encoding && !Buffer.isEncoding(options.encoding))
           throw new Error(`Unknown encoding: ${options.encoding}`);
         const flag = options.flag || "w";
-        this.open(path11, flag, options.mode, (openErr, handle) => {
+        this.open(path13, flag, options.mode, (openErr, handle) => {
           if (openErr) {
             callback && callback(openErr);
           } else {
@@ -23111,7 +23111,7 @@ var require_SFTP = __commonJS({
             if (position === null) {
               const tryStat = (er, st) => {
                 if (er) {
-                  this.stat(path11, (er_, st_) => {
+                  this.stat(path13, (er_, st_) => {
                     if (er_) {
                       return this.close(handle, () => {
                         callback && callback(er);
@@ -23130,7 +23130,7 @@ var require_SFTP = __commonJS({
           }
         });
       }
-      appendFile(path11, data, options, callback_) {
+      appendFile(path13, data, options, callback_) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let callback;
@@ -23148,12 +23148,12 @@ var require_SFTP = __commonJS({
           throw new TypeError("Bad arguments");
         if (!options.flag)
           options = Object.assign({ flag: "a" }, options);
-        this.writeFile(path11, data, options, callback);
+        this.writeFile(path13, data, options, callback);
       }
-      exists(path11, cb) {
+      exists(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        this.stat(path11, (err) => {
+        this.stat(path13, (err) => {
           cb && cb(err ? false : true);
         });
       }
@@ -23196,7 +23196,7 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} RENAME`
         );
       }
-      mkdir(path11, attrs, cb) {
+      mkdir(path13, attrs, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let flags = 0;
@@ -23210,7 +23210,7 @@ var require_SFTP = __commonJS({
           flags = attrs.flags;
           attrsLen = attrs.nb;
         }
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + attrsLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23218,7 +23218,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         writeUInt32BE(buf, flags, p += pathLen);
         if (attrsLen) {
           p += 4;
@@ -23234,10 +23234,10 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} MKDIR`
         );
       }
-      rmdir(path11, cb) {
+      rmdir(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23245,7 +23245,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { cb };
         const isBuffered = sendOrBuffer(this, buf);
         this._debug && this._debug(
@@ -23335,10 +23335,10 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} FSTAT`
         );
       }
-      stat(path11, cb) {
+      stat(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23346,17 +23346,17 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { cb };
         const isBuffered = sendOrBuffer(this, buf);
         this._debug && this._debug(
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} STAT`
         );
       }
-      lstat(path11, cb) {
+      lstat(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23364,17 +23364,17 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { cb };
         const isBuffered = sendOrBuffer(this, buf);
         this._debug && this._debug(
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} LSTAT`
         );
       }
-      opendir(path11, cb) {
+      opendir(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23382,14 +23382,14 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { cb };
         const isBuffered = sendOrBuffer(this, buf);
         this._debug && this._debug(
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} OPENDIR`
         );
       }
-      setstat(path11, attrs, cb) {
+      setstat(path13, attrs, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let flags = 0;
@@ -23401,7 +23401,7 @@ var require_SFTP = __commonJS({
         } else if (typeof attrs === "function") {
           cb = attrs;
         }
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + attrsLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23409,7 +23409,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         writeUInt32BE(buf, flags, p += pathLen);
         if (attrsLen) {
           p += 4;
@@ -23469,8 +23469,8 @@ var require_SFTP = __commonJS({
           mtime: toUnixTimestamp(mtime)
         }, cb);
       }
-      utimes(path11, atime, mtime, cb) {
-        return this.setstat(path11, {
+      utimes(path13, atime, mtime, cb) {
+        return this.setstat(path13, {
           atime: toUnixTimestamp(atime),
           mtime: toUnixTimestamp(mtime)
         }, cb);
@@ -23481,8 +23481,8 @@ var require_SFTP = __commonJS({
           gid
         }, cb);
       }
-      chown(path11, uid, gid, cb) {
-        return this.setstat(path11, {
+      chown(path13, uid, gid, cb) {
+        return this.setstat(path13, {
           uid,
           gid
         }, cb);
@@ -23492,15 +23492,15 @@ var require_SFTP = __commonJS({
           mode
         }, cb);
       }
-      chmod(path11, mode, cb) {
-        return this.setstat(path11, {
+      chmod(path13, mode, cb) {
+        return this.setstat(path13, {
           mode
         }, cb);
       }
-      readlink(path11, cb) {
+      readlink(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23508,7 +23508,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = {
           cb: (err, names) => {
             if (typeof cb !== "function")
@@ -23553,10 +23553,10 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} SYMLINK`
         );
       }
-      realpath(path11, cb) {
+      realpath(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23564,7 +23564,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = {
           cb: (err, names) => {
             if (typeof cb !== "function")
@@ -23609,13 +23609,13 @@ var require_SFTP = __commonJS({
           this._debug(`SFTP: Outbound: ${which} posix-rename@openssh.com`);
         }
       }
-      ext_openssh_statvfs(path11, cb) {
+      ext_openssh_statvfs(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         const ext = this._extensions["statvfs@openssh.com"];
         if (!ext || ext !== "2")
           throw new Error("Server does not support this extended request");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 19 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23625,7 +23625,7 @@ var require_SFTP = __commonJS({
         writeUInt32BE(buf, 19, p);
         buf.utf8Write("statvfs@openssh.com", p += 4, 19);
         writeUInt32BE(buf, pathLen, p += 19);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { extended: "statvfs@openssh.com", cb };
         const isBuffered = sendOrBuffer(this, buf);
         if (this._debug) {
@@ -23711,7 +23711,7 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} fsync@openssh.com`
         );
       }
-      ext_openssh_lsetstat(path11, attrs, cb) {
+      ext_openssh_lsetstat(path13, attrs, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         const ext = this._extensions["lsetstat@openssh.com"];
@@ -23726,7 +23726,7 @@ var require_SFTP = __commonJS({
         } else if (typeof attrs === "function") {
           cb = attrs;
         }
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 20 + 4 + pathLen + 4 + attrsLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23736,7 +23736,7 @@ var require_SFTP = __commonJS({
         writeUInt32BE(buf, 20, p);
         buf.utf8Write("lsetstat@openssh.com", p += 4, 20);
         writeUInt32BE(buf, pathLen, p += 20);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         writeUInt32BE(buf, flags, p += pathLen);
         if (attrsLen) {
           p += 4;
@@ -23753,13 +23753,13 @@ var require_SFTP = __commonJS({
           this._debug(`SFTP: Outbound: ${status5} lsetstat@openssh.com`);
         }
       }
-      ext_openssh_expandPath(path11, cb) {
+      ext_openssh_expandPath(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         const ext = this._extensions["expand-path@openssh.com"];
         if (ext !== "1")
           throw new Error("Server does not support this extended request");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 23 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23769,7 +23769,7 @@ var require_SFTP = __commonJS({
         writeUInt32BE(buf, 23, p);
         buf.utf8Write("expand-path@openssh.com", p += 4, 23);
         writeUInt32BE(buf, pathLen, p += 20);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = {
           cb: (err, names) => {
             if (typeof cb !== "function")
@@ -25047,12 +25047,12 @@ var require_SFTP = __commonJS({
       [REQUEST.LSTAT]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed LSTAT packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received LSTAT (id:${reqID})`);
-        if (!sftp.emit("LSTAT", reqID, path11)) {
+        if (!sftp.emit("LSTAT", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25071,13 +25071,13 @@ var require_SFTP = __commonJS({
       [REQUEST.SETSTAT]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         const attrs = readAttrs(sftp._biOpt);
         bufferParser.clear();
         if (attrs === void 0)
           return doFatalSFTPError(sftp, "Malformed SETSTAT packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received SETSTAT (id:${reqID})`);
-        if (!sftp.emit("SETSTAT", reqID, path11, attrs)) {
+        if (!sftp.emit("SETSTAT", reqID, path13, attrs)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25099,12 +25099,12 @@ var require_SFTP = __commonJS({
       [REQUEST.OPENDIR]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed OPENDIR packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received OPENDIR (id:${reqID})`);
-        if (!sftp.emit("OPENDIR", reqID, path11)) {
+        if (!sftp.emit("OPENDIR", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25123,63 +25123,63 @@ var require_SFTP = __commonJS({
       [REQUEST.REMOVE]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed REMOVE packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received REMOVE (id:${reqID})`);
-        if (!sftp.emit("REMOVE", reqID, path11)) {
+        if (!sftp.emit("REMOVE", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
       [REQUEST.MKDIR]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         const attrs = readAttrs(sftp._biOpt);
         bufferParser.clear();
         if (attrs === void 0)
           return doFatalSFTPError(sftp, "Malformed MKDIR packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received MKDIR (id:${reqID})`);
-        if (!sftp.emit("MKDIR", reqID, path11, attrs)) {
+        if (!sftp.emit("MKDIR", reqID, path13, attrs)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
       [REQUEST.RMDIR]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed RMDIR packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received RMDIR (id:${reqID})`);
-        if (!sftp.emit("RMDIR", reqID, path11)) {
+        if (!sftp.emit("RMDIR", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
       [REQUEST.REALPATH]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed REALPATH packet");
         sftp._debug && sftp._debug(
           `SFTP: Inbound: Received REALPATH (id:${reqID})`
         );
-        if (!sftp.emit("REALPATH", reqID, path11)) {
+        if (!sftp.emit("REALPATH", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
       [REQUEST.STAT]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed STAT packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received STAT (id:${reqID})`);
-        if (!sftp.emit("STAT", reqID, path11)) {
+        if (!sftp.emit("STAT", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25199,14 +25199,14 @@ var require_SFTP = __commonJS({
       [REQUEST.READLINK]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed READLINK packet");
         sftp._debug && sftp._debug(
           `SFTP: Inbound: Received READLINK (id:${reqID})`
         );
-        if (!sftp.emit("READLINK", reqID, path11)) {
+        if (!sftp.emit("READLINK", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25277,7 +25277,7 @@ var require_SFTP = __commonJS({
     function roundUpToMultipleOf8(n) {
       return n + 7 & ~7;
     }
-    function ReadStream(sftp, path11, options) {
+    function ReadStream(sftp, path13, options) {
       if (options === void 0)
         options = {};
       else if (typeof options === "string")
@@ -25291,7 +25291,7 @@ var require_SFTP = __commonJS({
       options.emitClose = false;
       options.autoDestroy = false;
       ReadableStream2.call(this, options);
-      this.path = path11;
+      this.path = path13;
       this.flags = options.flags === void 0 ? "r" : options.flags;
       this.mode = options.mode === void 0 ? 438 : options.mode;
       this.start = options.start;
@@ -25422,7 +25422,7 @@ var require_SFTP = __commonJS({
       },
       configurable: true
     });
-    function WriteStream(sftp, path11, options) {
+    function WriteStream(sftp, path13, options) {
       if (options === void 0)
         options = {};
       else if (typeof options === "string")
@@ -25434,7 +25434,7 @@ var require_SFTP = __commonJS({
       options.emitClose = false;
       options.autoDestroy = false;
       WritableStream.call(this, options);
-      this.path = path11;
+      this.path = path13;
       this.flags = options.flags === void 0 ? "w" : options.flags;
       this.mode = options.mode === void 0 ? 438 : options.mode;
       this.start = options.start;
@@ -26116,7 +26116,7 @@ var require_client = __commonJS({
   "../../node_modules/.pnpm/ssh2@1.17.0/node_modules/ssh2/lib/client.js"(exports, module) {
     "use strict";
     var {
-      createHash,
+      createHash: createHash2,
       getHashes,
       randomFillSync
     } = __require("crypto");
@@ -26338,7 +26338,7 @@ var require_client = __commonJS({
           }
           hostVerifier = (key, verify) => {
             if (hashAlgo)
-              key = createHash(hashAlgo).update(key).digest("hex");
+              key = createHash2(hashAlgo).update(key).digest("hex");
             const ret = hashCb(key, verify);
             if (ret !== void 0)
               verify(ret);
@@ -29655,7 +29655,11 @@ function paths(dir) {
     log: path.join(dir, "runner.log"),
     claudeConfigDir: path.join(dir, "claude"),
     projectsDir: path.join(dir, "projects"),
-    stateFile: path.join(dir, "state.json")
+    stateFile: path.join(dir, "state.json"),
+    /** Each run's Claude Code settings file, `<runId>.json`, there only while the run lasts. */
+    runsDir: path.join(dir, "runs"),
+    /** The runner's bare mirrors of the projects' repositories: the only ones that talk to GitHub. */
+    gitDir: path.join(dir, "git")
   };
 }
 function loadConfig(dir = defaultDir()) {
@@ -29693,8 +29697,8 @@ function parseArgs(argv) {
 }
 
 // src/commands.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-import os3 from "node:os";
+import { readFileSync as readFileSync4 } from "node:fs";
+import os6 from "node:os";
 import { createInterface } from "node:readline/promises";
 import { Writable as Writable2 } from "node:stream";
 
@@ -29736,6 +29740,10 @@ var NotiamoApi = class {
   done(runId, body) {
     return this.json("POST", `/api/runner/runs/${encodeURIComponent(runId)}/done`, body);
   }
+  /** A fresh GitHub token for the run's repository, when the spec's one is close to its end. */
+  gitToken(runId) {
+    return this.json("POST", `/api/runner/runs/${encodeURIComponent(runId)}/git-token`, {});
+  }
   /** Uploads a gzip backup of what the run changed. */
   async backup(runId, gzip) {
     await this.call("POST", `/api/runner/runs/${encodeURIComponent(runId)}/backup`, gzip, "application/gzip");
@@ -29758,10 +29766,91 @@ var NotiamoApi = class {
 
 // src/engine/claude.ts
 import * as child_process from "node:child_process";
+import os2 from "node:os";
 var MAX_TEXT = 2e3;
 var KILL_GRACE_MS = 1e4;
 var CLOSE_GRACE_MS = 2e3;
 var cut = (s) => s.length > MAX_TEXT ? s.slice(0, MAX_TEXT) : s;
+var ENV_ALLOW = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "TMPDIR",
+  "TZ",
+  // A machine behind a proxy or with its own CA needs these to reach anything.
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR"
+];
+var ENV_ALLOW_PREFIX = ["XDG_"];
+var ENV_ALLOW_WINDOWS = [
+  "PATHEXT",
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "USERPROFILE",
+  "USERNAME",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PROGRAMDATA",
+  "PROGRAMFILES",
+  "PROGRAMFILES(X86)",
+  "TEMP",
+  "TMP"
+];
+function baseEnv(env, windows) {
+  const out = {};
+  for (const [k, v] of Object.entries(env)) {
+    if (v === void 0) continue;
+    const key = windows ? k.toUpperCase() : k;
+    if (!(ENV_ALLOW.includes(key) || ENV_ALLOW_PREFIX.some((p) => key.startsWith(p)) || windows && ENV_ALLOW_WINDOWS.includes(key))) continue;
+    if (PROXY_URLS.includes(key.toUpperCase())) {
+      const url2 = withoutUserinfo(v);
+      if (url2 !== null) out[k] = url2;
+      continue;
+    }
+    out[k] = v;
+  }
+  return out;
+}
+var PROXY_URLS = ["HTTP_PROXY", "HTTPS_PROXY"];
+function withoutUserinfo(value) {
+  try {
+    const u = new URL(value);
+    u.username = "";
+    u.password = "";
+    return u.toString();
+  } catch {
+    return null;
+  }
+}
+var AGENT_GIT_ENV = {
+  GIT_CONFIG_GLOBAL: os2.devNull,
+  GIT_CONFIG_NOSYSTEM: "1",
+  GIT_TERMINAL_PROMPT: "0",
+  GIT_AUTHOR_NAME: "Notiamo agent",
+  GIT_AUTHOR_EMAIL: "agent@notiamo.com",
+  GIT_COMMITTER_NAME: "Notiamo agent",
+  GIT_COMMITTER_EMAIL: "agent@notiamo.com"
+};
+function isSandboxUnavailable(line) {
+  return /sandbox/i.test(line) && /(unavailable|not available|stopped being available|failed to (start|initiali[sz]e)|requires wsl2|bubblewrap|bwrap|socat)/i.test(line);
+}
 function claudeEngine(deps = {}) {
   const spawn4 = deps.spawn ?? child_process.spawn;
   const bin = deps.claudeBin ?? "claude";
@@ -29782,13 +29871,22 @@ function claudeEngine(deps = {}) {
     // tokens never show on the command line (`ps`). --mcp-config is variadic: the next argument must be a --flag.
     "--mcp-config",
     JSON.stringify(mcpConfig(o)),
-    // Only Notiamo's servers: permissions are skipped, so no .mcp.json of the cloned repo or of the config dir may load.
+    // Only Notiamo's servers: no .mcp.json of the cloned repo or of the config dir may load.
     "--strict-mcp-config",
-    "--dangerously-skip-permissions"
+    // Edits are accepted only inside the working folder; the settings file allows every (sandboxed) Bash command and
+    // Notiamo's tools. Anything else would prompt, and in -p mode a prompt is a refusal.
+    "--permission-mode",
+    "acceptEdits",
+    // The run's settings file (allow and deny rules, read and write block, shell sandbox): only paths and domains, never a secret.
+    ...o.settingsFile ? ["--settings", o.settingsFile] : [],
+    // Only the runner's own user settings (in CLAUDE_CONFIG_DIR): the clone's .claude/settings*.json never load.
+    "--setting-sources",
+    "user"
   ];
   const engineEnv = (o) => ({
-    ...process.env,
+    ...baseEnv(deps.env ?? process.env, windows),
     ...o.env,
+    ...AGENT_GIT_ENV,
     CLAUDE_CONFIG_DIR: o.claudeConfigDir,
     NOTIAMO_RUN_TOKEN: o.mcp.token,
     ...o.helper ? { NOTIAMO_WP_TOKEN: o.helper.token } : {}
@@ -29799,6 +29897,7 @@ function claudeEngine(deps = {}) {
         reported: false,
         result: false,
         resultError: void 0,
+        sandboxError: false,
         limitAt: void 0,
         timedOut: false,
         spawnError: void 0,
@@ -29881,7 +29980,9 @@ function claudeEngine(deps = {}) {
       }
       lines(child.stdout, onLine);
       lines(child.stderr, (l) => {
-        if (l.trim()) onText("error", l, true);
+        if (!l.trim()) return;
+        if (isSandboxUnavailable(l)) st.sandboxError = true;
+        onText("error", l, true);
       });
       for (const s of [child.stdout, child.stderr]) s?.on("error", (e) => emit({ kind: "error", text: cut(`stream error: ${e.message}`) }));
       const kill = (sig) => {
@@ -29908,6 +30009,12 @@ function claudeEngine(deps = {}) {
         clearTimeout(timer);
         clearTimeout(killTimer);
         clearTimeout(closeTimer);
+        if (!windows && child.pid) {
+          try {
+            processKill(-child.pid, "SIGKILL");
+          } catch {
+          }
+        }
         const usage = { costUsd: st.costUsd, inputTokens: st.inputTokens, outputTokens: st.outputTokens, sessionId: st.sessionId };
         const succeeded = st.result && !st.resultError;
         if (st.timedOut) return resolve({ outcome: "failed", error: "timeout", ...usage });
@@ -29916,6 +30023,7 @@ function claudeEngine(deps = {}) {
         if (st.resultError) return resolve({ outcome: "failed", error: st.resultError, ...usage });
         if (st.reported) return resolve({ outcome: "reported", ...usage });
         if (st.result) return resolve({ outcome: "ended", ...usage });
+        if (code !== 0 && st.sandboxError) return resolve({ outcome: "failed", error: "sandbox_unavailable", ...usage });
         if (code !== 0) return resolve({ outcome: "failed", error: `claude exited with code ${code}`, ...usage });
         resolve({ outcome: "ended", ...usage });
       };
@@ -30044,15 +30152,15 @@ async function reportRun(mcp, args, fetchImpl) {
 // src/exec.ts
 import { spawn as spawn2 } from "node:child_process";
 var realExec = async (file2, args, opts) => {
-  const r = await run(file2, args, opts?.env, false);
-  if (r.code === 127 && process.platform === "win32") return run(file2, args.map(quoteForCmd), opts?.env, true);
+  const r = await run(file2, args, opts?.env, false, opts?.timeout);
+  if (r.code === 127 && process.platform === "win32") return run(file2, args.map(quoteForCmd), opts?.env, true, opts?.timeout);
   return r;
 };
-function run(file2, args, env, shell) {
+function run(file2, args, env, shell, timeout) {
   return new Promise((resolve) => {
     let stdout = "";
     let stderr = "";
-    const child = spawn2(file2, args, { env: env ?? process.env, shell, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const child = spawn2(file2, args, { env: env ?? process.env, shell, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, ...timeout ? { timeout, killSignal: "SIGKILL" } : {} });
     child.stdout.on("data", (d) => {
       stdout += d.toString();
     });
@@ -30067,7 +30175,259 @@ var quoteForCmd = (a) => /^[\w.:/\\=-]+$/.test(a) ? a : `"${a.replace(/"/g, '""'
 
 // src/init.ts
 import { spawn as spawn3 } from "node:child_process";
-import os2 from "node:os";
+import os4 from "node:os";
+
+// src/sandbox.ts
+import { accessSync, constants as fsConstants, existsSync, readdirSync, realpathSync } from "node:fs";
+import os3 from "node:os";
+import path2 from "node:path";
+var ENGINE_MIN_VERSION = "2.1.314";
+var DEFAULT_DOMAINS = ["github.com", "api.github.com", "codeload.github.com", "objects.githubusercontent.com", "registry.npmjs.org"];
+function versionAtLeast(version2, min) {
+  const parse3 = (v) => /(\d+)\.(\d+)\.(\d+)/.exec(v)?.slice(1).map(Number);
+  const a = version2 ? parse3(version2) : void 0;
+  const b = parse3(min);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+function engineTooOld(version2) {
+  return !versionAtLeast(version2, ENGINE_MIN_VERSION);
+}
+var CREDENTIALS = [
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".netrc",
+  ".docker",
+  path2.join(".config", "gh"),
+  ".git-credentials",
+  path2.join(".config", "git"),
+  ".npmrc",
+  ".pypirc",
+  path2.join(".config", "gcloud"),
+  path2.join(".config", "hub")
+];
+var BASH_DENY = [
+  "Bash(security *)",
+  "Bash(git credential*)",
+  "Bash(git-credential*)",
+  "Bash(gh auth*)",
+  "Bash(ssh-add *)",
+  // A `*` may stand anywhere in a Bash rule: these also catch `git -c x=y credential fill`, a helper by its full path, `sh -c '…'`.
+  "Bash(*credential*)",
+  "Bash(*osxkeychain*)",
+  "Bash(*libsecret*)",
+  "Bash(*security find-*)",
+  "Bash(*secret-tool*)",
+  "Bash(*gh auth*)"
+];
+var GIT_HELPERS = [
+  "git-credential-osxkeychain",
+  "git-credential-libsecret",
+  "git-credential-store",
+  "git-credential-cache",
+  "git-credential-manager",
+  "git-credential-manager-core"
+];
+var HELPER_DIRS = [
+  "/Library/Developer/CommandLineTools/usr/libexec/git-core",
+  "/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core",
+  "/usr/libexec/git-core",
+  "/usr/lib/git-core",
+  "/usr/local/share/gcm-core",
+  "/opt/homebrew/share/gcm-core",
+  "/usr/local/bin"
+];
+var KEYCHAIN_TOOLS = {
+  darwin: ["/usr/bin/security", "/usr/bin/osascript"],
+  linux: ["/usr/bin/secret-tool", "/usr/bin/gnome-keyring"]
+};
+async function credentialTools(exec, platform = process.platform) {
+  const first = (out) => out.split(/\r?\n/).map((l) => l.trim()).find(Boolean) ?? null;
+  const git = await exec("git", ["--exec-path"]).catch(() => null);
+  const gh = await exec(platform === "win32" ? "where" : "which", ["gh"]).catch(() => null);
+  const ghFound = gh?.code === 0 ? first(gh.stdout) : null;
+  return {
+    gitExecPath: git?.code === 0 ? first(git.stdout) : null,
+    ghPath: ghFound && path2.isAbsolute(ghFound) ? realPath(ghFound) : null
+  };
+}
+function findOnPath(name, dirs, platform) {
+  const names = platform === "win32" ? [`${name}.exe`, `${name}.cmd`, name] : [name];
+  for (const d of dirs) {
+    for (const n of names) {
+      const file2 = path2.join(d, n);
+      try {
+        accessSync(file2, fsConstants.X_OK);
+        return realpathSync(file2);
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function machineToolDirs(env = process.env, argv1 = process.argv[1], execPath = process.execPath, platform = process.platform) {
+  const pathDirs = (env.PATH ?? env.Path ?? "").split(path2.delimiter).filter((d) => d && path2.isAbsolute(d));
+  const dirs = pathDirs.map(realPath);
+  for (const bin of ["git", "claude"]) {
+    const found = findOnPath(bin, pathDirs, platform);
+    if (found) dirs.push(path2.dirname(found));
+  }
+  dirs.push(path2.dirname(realPath(execPath)));
+  if (argv1) {
+    const install4 = path2.dirname(realPath(argv1));
+    dirs.push(install4);
+    if (path2.basename(install4) === "dist") dirs.push(path2.dirname(install4));
+  }
+  return [...new Set(dirs)];
+}
+function realListEntries(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isFile() || e.isSymbolicLink()).map((e) => ({ name: e.name, dir: e.isDirectory() }));
+  } catch {
+    return [];
+  }
+}
+function realPath(p) {
+  const abs = path2.resolve(p);
+  const rest = [];
+  for (let cur = abs; ; ) {
+    try {
+      return path2.join(realpathSync(cur), ...rest);
+    } catch {
+      const parent = path2.dirname(cur);
+      if (parent === cur) return abs;
+      rest.unshift(path2.basename(cur));
+      cur = parent;
+    }
+  }
+}
+function rulePath(p) {
+  const posix = p.replace(/\\/g, "/").replace(/^([A-Za-z]):/, (_m, d) => `/${d.toLowerCase()}`);
+  return `/${posix}`;
+}
+function credentialBinaries(o, toolDirs, listEntries, exists2) {
+  const out = [];
+  const gitReal = /* @__PURE__ */ new Set();
+  const scan = [];
+  const execDir = o.gitExecPath && path2.isAbsolute(o.gitExecPath) ? realPath(o.gitExecPath) : null;
+  for (const d of /* @__PURE__ */ new Set([...execDir ? [execDir] : [], ...toolDirs, ...HELPER_DIRS.map(realPath)])) {
+    const names = listEntries(d).map((e) => e.name);
+    if (names.includes("git")) gitReal.add(realPath(path2.join(d, "git")));
+    const helpers = names.filter((n) => n.startsWith("git-credential-"));
+    scan.push({ dir: d, names: d === execDir ? [.../* @__PURE__ */ new Set([...helpers, ...GIT_HELPERS])] : helpers });
+  }
+  for (const { dir, names } of scan) {
+    for (const n of names) {
+      const own2 = path2.join(dir, n);
+      const real = realPath(own2);
+      out.push(gitReal.has(real) ? own2 : real);
+    }
+  }
+  for (const t of KEYCHAIN_TOOLS[o.platform] ?? []) if (exists2(t)) out.push(realPath(t));
+  if (o.ghPath && path2.isAbsolute(o.ghPath) && !gitReal.has(realPath(o.ghPath))) out.push(realPath(o.ghPath));
+  return out;
+}
+function sandboxSettings(o) {
+  const root = realPath(o.runnerRoot);
+  const claudeDir = realPath(o.claudeConfigDir);
+  const runDir = realPath(o.runDir);
+  const home = realPath(o.home ?? os3.homedir());
+  const at = (...parts) => path2.join(...parts);
+  const edit = (p) => `Edit(${rulePath(p)})`;
+  const gitHooks = at(runDir, ".git", "hooks");
+  const gitConfig = at(runDir, ".git", "config");
+  const listEntries = o.listEntries ?? realListEntries;
+  const exists2 = o.exists ?? existsSync;
+  const walked = [];
+  const visited = /* @__PURE__ */ new Set();
+  const holds = (dir, p) => p === dir || p.startsWith(dir.endsWith(path2.sep) ? dir : dir + path2.sep);
+  const denyAllBut = (dir) => {
+    if (visited.has(dir)) return;
+    visited.add(dir);
+    for (const e of listEntries(dir)) {
+      const child = realPath(at(dir, e.name));
+      if (child === runDir) continue;
+      if (holds(child, runDir)) {
+        if (holds(root, child) && child !== root) denyAllBut(child);
+      } else if (child !== path2.parse(child).root) walked.push({ name: child, dir: e.dir });
+    }
+  };
+  denyAllBut(root);
+  const profiles = listEntries(at(root, "profiles")).filter((e) => e.dir).map((e) => at(root, "profiles", e.name));
+  const known = [root, ...profiles].flatMap((d) => [realPath(at(d, "config.json")), realPath(at(d, "state.json"))]);
+  const toolDirs = (o.toolDirs ?? machineToolDirs()).map(realPath);
+  const denyRead = [...walked.map((e) => e.name), ...known];
+  if (exists2(claudeDir)) denyRead.push(claudeDir);
+  for (const c of CREDENTIALS) if (exists2(at(home, c))) denyRead.push(realPath(at(home, c)));
+  denyRead.push(...credentialBinaries(o, toolDirs, listEntries, exists2));
+  const holdsRun = (dir) => holds(dir, runDir);
+  const editTree = (dir) => holdsRun(dir) ? [] : [edit(`${dir}/**`)];
+  const deny = [
+    edit(at(root, "config.json")),
+    edit(at(root, "state.json")),
+    edit(at(root, "runner.log")),
+    ...editTree(at(root, "runs")),
+    edit(at(root, "profiles", "*", "config.json")),
+    edit(at(root, "profiles", "*", "state.json")),
+    edit(`${at(root, "profiles", "*", "runs")}/**`),
+    ...editTree(claudeDir),
+    edit(`${at(root, "profiles", "*", "claude")}/**`),
+    ...[".ssh", ".aws", ".gnupg", ".docker", ".config", ".npm", ".local", ".claude", ...o.platform === "darwin" ? ["Library"] : []].flatMap((d) => editTree(at(home, d))),
+    ...[
+      ".netrc",
+      ".git-credentials",
+      ".npmrc",
+      ".pypirc",
+      ".zshrc",
+      ".zshenv",
+      ".zprofile",
+      ".bashrc",
+      ".bash_profile",
+      ".bash_login",
+      ".profile",
+      ".gitconfig"
+    ].map((f) => edit(at(home, f))),
+    edit(`${gitHooks}/**`),
+    edit(gitConfig),
+    edit(`${at(runDir, ".claude")}/**`),
+    ...walked.flatMap((e) => e.dir ? editTree(e.name) : [edit(e.name)]),
+    ...toolDirs.filter((d) => d !== path2.parse(d).root).flatMap(editTree),
+    ...BASH_DENY
+  ];
+  const allow = [
+    "Bash",
+    "mcp__notiamo__*",
+    "mcp__notiamo-wp__*",
+    `Read(${rulePath(runDir)}/**)`,
+    "Glob",
+    "Grep",
+    `Edit(${rulePath(runDir)}/**)`,
+    "WebFetch(domain:github.com)"
+  ];
+  const permissions = { blockReadsOutsideWorkingDirectories: true, blockWritesOutsideWorkingDirectories: true, allow, deny: [...new Set(deny)] };
+  if (o.platform === "win32") return { permissions };
+  const domains = [...DEFAULT_DOMAINS, o.notiamoHost, ...o.wordpressHost ? [o.wordpressHost] : [], ...o.extraDomains].map((d) => d.trim().toLowerCase()).filter((d) => d.length > 0);
+  return {
+    permissions,
+    sandbox: {
+      enabled: true,
+      failIfUnavailable: true,
+      allowUnsandboxedCommands: false,
+      filesystem: {
+        denyRead: [...new Set(denyRead)],
+        allowWrite: [runDir],
+        denyWrite: [gitHooks, gitConfig]
+      },
+      network: {
+        allowedDomains: [...new Set(domains)],
+        // macOS: lets the engine's shell commands reach the run's local helper on 127.0.0.1 (no effect on Linux).
+        ...o.wordpressHost ? { allowLocalBinding: true } : {}
+      }
+    }
+  };
+}
 
 // src/service/darwin.ts
 var darwin_exports = {};
@@ -30079,8 +30439,8 @@ __export(darwin_exports, {
   uninstall: () => uninstall
 });
 import { setTimeout as delay } from "node:timers/promises";
-import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2, existsSync } from "node:fs";
-import path2 from "node:path";
+import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "node:fs";
+import path3 from "node:path";
 
 // src/service/common.ts
 var startArgs = (profile) => profile ? ["start", "--profile", profile] : ["start"];
@@ -30095,7 +30455,7 @@ function must(what, r) {
 
 // src/service/darwin.ts
 var label = (profile) => profile ? `com.notiamo.runner.${profile}` : "com.notiamo.runner";
-var plistPath = (home, profile) => path2.join(home, "Library", "LaunchAgents", `${label(profile)}.plist`);
+var plistPath = (home, profile) => path3.join(home, "Library", "LaunchAgents", `${label(profile)}.plist`);
 var domain = (uid) => `gui/${uid}`;
 var BOOTSTRAP_TRIES = 5;
 var BOOTSTRAP_RETRY_MS = 500;
@@ -30135,7 +30495,7 @@ ${env}
 }
 async function install(o) {
   const file2 = plistPath(o.home, o.profile);
-  mkdirSync2(path2.dirname(file2), { recursive: true });
+  mkdirSync2(path3.dirname(file2), { recursive: true });
   writeFileSync2(file2, renderPlist({ nodePath: o.nodePath, cliPath: o.cliPath, log: o.paths.log, env: o.env, profile: o.profile }));
   await o.exec("launchctl", ["bootout", domain(o.uid), file2]);
   const sleep = o.sleep ?? ((ms) => delay(ms));
@@ -30156,7 +30516,7 @@ async function uninstall(o) {
   rmSync(plistPath(o.home, o.profile), { force: true });
 }
 async function status(o) {
-  if (!existsSync(plistPath(o.home, o.profile))) return "not_installed";
+  if (!existsSync2(plistPath(o.home, o.profile))) return "not_installed";
   const r = await o.exec("launchctl", ["print", `${domain(o.uid)}/${label(o.profile)}`]);
   return r.code === 0 ? "running" : "stopped";
 }
@@ -30170,10 +30530,10 @@ __export(linux_exports, {
   stop: () => stop2,
   uninstall: () => uninstall2
 });
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import path3 from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import path4 from "node:path";
 var unit = (profile) => profile ? `notiamo-runner-${profile}` : "notiamo-runner";
-var unitPath = (home, profile) => path3.join(home, ".config", "systemd", "user", `${unit(profile)}.service`);
+var unitPath = (home, profile) => path4.join(home, ".config", "systemd", "user", `${unit(profile)}.service`);
 var q = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 function renderUnit(o) {
   const env = Object.entries(serviceEnv(o.env)).map(([k, v]) => `Environment=${q(`${k}=${v}`)}`).join("\n");
@@ -30195,7 +30555,7 @@ WantedBy=default.target
 }
 async function install2(o) {
   const file2 = unitPath(o.home, o.profile);
-  mkdirSync3(path3.dirname(file2), { recursive: true });
+  mkdirSync3(path4.dirname(file2), { recursive: true });
   writeFileSync3(file2, renderUnit({ nodePath: o.nodePath, cliPath: o.cliPath, log: o.paths.log, env: o.env, profile: o.profile }));
   must("systemctl --user daemon-reload", await o.exec("systemctl", ["--user", "daemon-reload"]));
   must("systemctl --user enable", await o.exec("systemctl", ["--user", "enable", unit(o.profile)]));
@@ -30211,7 +30571,7 @@ async function uninstall2(o) {
   await o.exec("systemctl", ["--user", "daemon-reload"]);
 }
 async function status2(o) {
-  if (!existsSync2(unitPath(o.home, o.profile))) return "not_installed";
+  if (!existsSync3(unitPath(o.home, o.profile))) return "not_installed";
   const r = await o.exec("systemctl", ["--user", "is-active", unit(o.profile)]);
   return r.stdout.trim() === "active" ? "running" : "stopped";
 }
@@ -30262,6 +30622,7 @@ var serviceStatus = async (o) => impl(o).status(withUid(o));
 
 // src/init.ts
 var DEFAULT_HOST = "https://my.notiamo.com";
+var KEYCHAIN_WARNING = "Warning: this user's keychain holds a GitHub login. A run on this machine could reach it. Remove it (Keychain Access, search github.com) or install the runner under a separate macOS user. The runner itself does not need it.";
 var runInteractive = (file2, args, env) => new Promise((resolve, reject) => {
   const child = spawn3(file2, args, { stdio: "inherit", env, shell: process.platform === "win32" });
   child.on("error", reject);
@@ -30281,11 +30642,27 @@ async function runInit(deps) {
   const token = (await deps.prompt("Runner token (made in Notiamo under Settings \u203A Agent runs \u203A Runners; nothing shows while you paste it): ", { hidden: true })).trim();
   if (!token.startsWith("ntr_")) throw new Error("That is not a runner token: it starts with ntr_. Make one in Notiamo: Settings \u203A Agent runs \u203A Runners.");
   const host = normalizeHost(await ask("Notiamo address: ", DEFAULT_HOST));
-  const hostname3 = deps.hostname ?? os2.hostname();
+  const hostname3 = deps.hostname ?? os4.hostname();
   const name = await ask("Name of this runner: ", hostname3);
   const version2 = await deps.exec("claude", ["--version"], { env });
   if (version2.code !== 0) throw new Error("Claude Code is not installed. Install it first: https://claude.com/claude-code");
   const engineVersion = version2.stdout.trim().slice(0, 100) || "unknown";
+  if (engineTooOld(engineVersion)) throw new Error(`Claude Code 2.1.314 or newer is needed (yours: ${engineVersion}). Update it: claude update`);
+  const git = await deps.exec("git", ["--version"], { env });
+  const gitVersion = git.code === 0 ? /git version (\d+)\.(\d+)/.exec(git.stdout) ?? null : null;
+  if (!gitVersion || Number(gitVersion[1]) < 2 || Number(gitVersion[1]) === 2 && Number(gitVersion[2]) < 31) {
+    const yours = git.code === 0 ? git.stdout.trim().replace(/^git version /, "").slice(0, 60) || "unknown" : "not installed";
+    throw new Error(`git 2.31 or newer is needed (yours: ${yours}). Update git.`);
+  }
+  if (platform === "linux") {
+    const bwrap = await deps.exec("which", ["bwrap"], { env });
+    const socat = await deps.exec("which", ["socat"], { env });
+    if (bwrap.code !== 0 || socat.code !== 0) {
+      throw new Error("The sandbox needs bubblewrap and socat. Install them (Debian/Ubuntu: sudo apt install bubblewrap socat), then run init again.");
+    }
+  } else if (platform === "win32") {
+    print("Note: on Windows without WSL2, shell commands of a run are not sandboxed; Claude's own file tools are still limited to the run folder.");
+  }
   try {
     await new NotiamoApi({ host, token }, deps.fetch).hello({ version: VERSION, os: platform, engine: "claude", engineVersion });
   } catch (e) {
@@ -30299,13 +30676,18 @@ async function runInit(deps) {
   }
   const check2 = await deps.exec("claude", ["-p", "say ok"], { env: claudeEnv });
   if (check2.code !== 0) throw new Error("Claude Code is not signed in for the runner.");
+  if (platform === "darwin") {
+    const git2 = await deps.exec("security", ["find-internet-password", "-s", "github.com"], { env, timeout: 1e4 });
+    const gh = await deps.exec("security", ["find-generic-password", "-s", "gh:github.com"], { env, timeout: 1e4 });
+    if (git2.code === 0 || gh.code === 0) print(KEYCHAIN_WARNING);
+  }
   saveConfig({ host, token, name, dataDir: dir, engine: "claude" }, dir);
   await installService({
     platform,
     profile: deps.profile,
     paths: p,
     exec: deps.exec,
-    home: deps.home ?? os2.homedir(),
+    home: deps.home ?? os4.homedir(),
     env,
     nodePath: deps.nodePath ?? process.execPath,
     cliPath: deps.cliPath ?? process.argv[1]
@@ -30315,10 +30697,10 @@ async function runInit(deps) {
 
 // src/log.ts
 import { appendFileSync, mkdirSync as mkdirSync4, renameSync, statSync } from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 var MAX_BYTES = 10 * 1024 * 1024;
 function createLogger(file2) {
-  mkdirSync4(path4.dirname(file2), { recursive: true, mode: 448 });
+  mkdirSync4(path5.dirname(file2), { recursive: true, mode: 448 });
   const write = (level, msg) => {
     try {
       if (statSync(file2).size > MAX_BYTES) renameSync(file2, file2 + ".1");
@@ -30331,18 +30713,110 @@ function createLogger(file2) {
 }
 
 // src/loop.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync2, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import path10 from "node:path";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import path12 from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 
+// src/clones.ts
+import { lstatSync, mkdirSync as mkdirSync5, readdirSync as readdirSync2, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import path6 from "node:path";
+var lastRunPath = (gitDir, projectId) => path6.join(gitDir, `${projectId}.last-run`);
+function touchLastRun(gitDir, projectId, now) {
+  mkdirSync5(gitDir, { recursive: true, mode: 448 });
+  const file2 = lastRunPath(gitDir, projectId);
+  rmSync3(file2, { force: true });
+  writeFileSync4(file2, now.toISOString() + "\n", { flag: "wx", mode: 384 });
+}
+var DAY_MS = 864e5;
+var SLOT_RE = /^\d+$/;
+var ID_RE = /^[\w-]+$/;
+function removeStaleClones(projectsDir, gitDir, keepDays, busyProjectIds, now, log) {
+  const removed = [];
+  let names;
+  try {
+    names = readdirSync2(projectsDir);
+  } catch (e) {
+    if (e.code !== "ENOENT") log.warn(`project folders not listed: ${errorText(e)}`);
+    return removed;
+  }
+  const cutoff = now.getTime() - keepDays * DAY_MS;
+  const isDir = (p) => {
+    try {
+      return lstatSync(p).isDirectory();
+    } catch {
+      return false;
+    }
+  };
+  const gone = /* @__PURE__ */ new Set();
+  const remove = (folder, label2, id, extra, why) => {
+    try {
+      rmSync3(folder, { recursive: true, force: true });
+      for (const f of extra) rmSync3(f, { force: true });
+      removed.push(label2);
+      gone.add(id);
+      log.info(`removed project folder ${label2}: ${why}`);
+    } catch (e) {
+      log.warn(`project folder ${label2} not removed: ${errorText(e)}`);
+    }
+  };
+  const slots = names.filter((n) => SLOT_RE.test(n) && isDir(path6.join(projectsDir, n)));
+  for (const name of names) {
+    if (SLOT_RE.test(name) || !ID_RE.test(name) || busyProjectIds.has(name)) continue;
+    const folder = path6.join(projectsDir, name);
+    if (!isDir(folder)) continue;
+    remove(folder, name, name, [path6.join(gitDir, `${name}.worktree.json`)], "left by an older runner");
+  }
+  for (const slot of slots) {
+    let ids;
+    try {
+      ids = readdirSync2(path6.join(projectsDir, slot));
+    } catch (e) {
+      log.warn(`slot ${slot} not listed: ${errorText(e)}`);
+      continue;
+    }
+    for (const id of ids) {
+      if (!ID_RE.test(id) || busyProjectIds.has(id)) continue;
+      const folder = path6.join(projectsDir, slot, id);
+      try {
+        const st = lstatSync(folder);
+        if (!st.isDirectory()) continue;
+        let lastUse = st.mtimeMs;
+        try {
+          const marker = lstatSync(lastRunPath(gitDir, id));
+          if (marker.isFile()) lastUse = marker.mtimeMs;
+        } catch {
+        }
+        if (lastUse >= cutoff) continue;
+      } catch (e) {
+        log.warn(`project folder ${slot}/${id} not checked: ${errorText(e)}`);
+        continue;
+      }
+      remove(folder, `${slot}/${id}`, id, [path6.join(gitDir, `${id}.${slot}.worktree.json`)], `unused for more than ${keepDays} days`);
+    }
+  }
+  for (const id of gone) {
+    if (slots.some((s) => isDir(path6.join(projectsDir, s, id)))) continue;
+    try {
+      rmSync3(path6.join(gitDir, `${id}.git`), { recursive: true, force: true });
+      rmSync3(lastRunPath(gitDir, id), { force: true });
+    } catch (e) {
+      log.warn(`mirror of ${id} not removed: ${errorText(e)}`);
+    }
+  }
+  return removed;
+}
+var errorText = (e) => e instanceof Error ? e.message : String(e);
+
 // src/run.ts
-import { mkdirSync as mkdirSync6, mkdtempSync, rmSync as rmSync3 } from "node:fs";
-import path9 from "node:path";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import path11 from "node:path";
 
 // src/project-folder.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync5 } from "node:fs";
-import path5 from "node:path";
+import { createHash } from "node:crypto";
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync2, realpathSync as realpathSync2, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import os5 from "node:os";
+import path7 from "node:path";
 import { promisify } from "node:util";
 var execFileAsync = async (file2, args, opts) => {
   const { stdout, stderr } = await promisify(execFile)(file2, args, {
@@ -30354,25 +30828,182 @@ var execFileAsync = async (file2, args, opts) => {
   });
   return { stdout: String(stdout), stderr: String(stderr) };
 };
+var SAFE_GIT = ["-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false"];
+function gitEnv() {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: os5.devNull };
+  for (const k of Object.keys(env)) if (/^GIT_CONFIG_(COUNT|KEY_\d+|VALUE_\d+|PARAMETERS)$/.test(k) || k === "GIT_ASKPASS") delete env[k];
+  return env;
+}
+function githubAuthEnv(token) {
+  return {
+    ...gitEnv(),
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: `http.${GITHUB_URL}.extraheader`,
+    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`
+  };
+}
 var CLONE_TIMEOUT_MS = 10 * 6e4;
 var GIT_TIMEOUT_MS = 2 * 6e4;
-async function prepareGithubFolder(projectsDir, projectId, g, exec = execFileAsync) {
-  const folder = path5.join(projectsDir, projectId);
-  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-  const git = (args, timeout = GIT_TIMEOUT_MS) => exec("git", ["-C", folder, ...args], { env, timeout });
-  if (existsSync3(path5.join(folder, ".git"))) {
-    await git(["fetch", "origin", "--prune"]);
+var barePath = (gitDir, projectId) => path7.join(gitDir, `${projectId}.git`);
+var projectFolder = (projectsDir, slot, projectId) => path7.join(projectsDir, String(slot), projectId);
+var GITHUB_URL = "https://github.com/";
+async function prepareGithubFolder(dirs, projectId, g, token, exec = execFileAsync) {
+  if (!/^[\w-]+$/.test(projectId)) throw new Error("runner_error");
+  if (typeof g.cloneUrl !== "string" || !g.cloneUrl.startsWith(GITHUB_URL) || /\s/.test(g.cloneUrl)) throw new Error("runner_error");
+  const slot = dirs.slot ?? 0;
+  const slotDir = path7.join(dirs.projectsDir, String(slot));
+  const folder = projectFolder(dirs.projectsDir, slot, projectId);
+  const bare = barePath(dirs.gitDir, projectId);
+  const saved = savedSnapshotPath(dirs.gitDir, projectId, slot);
+  const env = gitEnv();
+  const gitIn = (dir, args, timeout = GIT_TIMEOUT_MS) => exec("git", [...SAFE_GIT, "-C", dir, ...args], { env, timeout });
+  if (existsSync4(path7.join(bare, "HEAD"))) {
+    await gitIn(bare, ["remote", "set-url", "--", "origin", g.cloneUrl]);
+    await exec("git", [...SAFE_GIT, "-C", bare, "fetch", "origin", "--prune", "+refs/heads/*:refs/heads/*"], { env: githubAuthEnv(await token()), timeout: CLONE_TIMEOUT_MS });
+  } else {
+    mkdirSync6(dirs.gitDir, { recursive: true, mode: 448 });
+    await exec("git", [...SAFE_GIT, "clone", "--bare", "--", g.cloneUrl, bare], { cwd: dirs.gitDir, env: githubAuthEnv(await token()), timeout: CLONE_TIMEOUT_MS });
+  }
+  if (exists(folder)) {
+    const snap2 = readSavedSnapshot(saved);
+    let ok = snap2 !== null;
+    if (snap2) {
+      try {
+        verifyGit(folder, snap2);
+      } catch {
+        ok = false;
+      }
+    }
+    if (!ok) rmSync4(folder, { recursive: true, force: true });
+  }
+  if (existsSync4(path7.join(folder, ".git"))) {
+    await gitIn(folder, ["fetch", "origin", "--prune"]);
   } else {
-    mkdirSync5(projectsDir, { recursive: true, mode: 448 });
-    await exec("git", ["clone", g.cloneUrl, folder], { cwd: projectsDir, env, timeout: CLONE_TIMEOUT_MS });
+    mkdirSync6(slotDir, { recursive: true, mode: 448 });
+    await exec("git", [...SAFE_GIT, "clone", "--no-hardlinks", "--", bare, folder], { cwd: slotDir, env, timeout: CLONE_TIMEOUT_MS });
   }
-  const { stdout } = await git(["rev-parse", "--abbrev-ref", "HEAD"]);
+  const { stdout } = await gitIn(folder, ["rev-parse", "--abbrev-ref", "HEAD"]);
   if (stdout.trim() !== g.branch) {
-    await git(["reset", "--hard"]);
-    await git(["clean", "-fd"]);
-    await git(["checkout", "-B", g.branch, `origin/${g.fromBranch ?? g.defaultBranch}`]);
+    await gitIn(folder, ["reset", "--hard"]);
+    await gitIn(folder, ["clean", "-fd"]);
+    await gitIn(folder, ["checkout", "-B", g.branch, `origin/${g.fromBranch ?? g.defaultBranch}`]);
+  }
+  const snap = snapshotGit(folder);
+  saveSnapshot(dirs.gitDir, projectId, slot, snap);
+  return { folder, snap };
+}
+var savedSnapshotPath = (gitDir, projectId, slot) => path7.join(gitDir, `${projectId}.${slot}.worktree.json`);
+function saveSnapshot(gitDir, projectId, slot, snap) {
+  if (snap.missing) return;
+  mkdirSync6(gitDir, { recursive: true, mode: 448 });
+  const body = { gitRealPath: snap.real, dev: snap.dev, ino: snap.ino, configHash: snap.configHash };
+  writeFileSync5(savedSnapshotPath(gitDir, projectId, slot), JSON.stringify(body) + "\n", { mode: 384 });
+}
+function forgetSnapshot(gitDir, projectId, slot) {
+  rmSync4(savedSnapshotPath(gitDir, projectId, slot), { force: true });
+}
+function readSavedSnapshot(file2) {
+  try {
+    const j = JSON.parse(readFileSync2(file2, "utf8"));
+    if (typeof j.gitRealPath !== "string" || typeof j.dev !== "number" || typeof j.ino !== "number" || typeof j.configHash !== "string") return null;
+    return { missing: false, real: j.gitRealPath, dev: j.dev, ino: j.ino, configHash: j.configHash };
+  } catch {
+    return null;
+  }
+}
+async function pushBranch(folder, bare, branch, token, exec = execFileAsync) {
+  const env = gitEnv();
+  await exec("git", [...SAFE_GIT, "-C", bare, "fetch", folder, `+refs/heads/${branch}:refs/heads/${branch}`], { env, timeout: GIT_TIMEOUT_MS }).catch(gitError);
+  const auth = githubAuthEnv(await token());
+  await exec("git", [...SAFE_GIT, "-C", bare, "push", "--no-verify", "origin", branch], { env: auth, timeout: GIT_TIMEOUT_MS }).catch(gitError);
+}
+function gitError(e) {
+  const stderr = typeof e.stderr === "string" ? e.stderr : "";
+  const line = stderr.split("\n").map((l) => l.trim()).find(Boolean);
+  throw new Error(line ?? "git push failed");
+}
+var RepoTamperedError = class extends Error {
+  constructor(detail) {
+    super("repo_tampered");
+    this.detail = detail;
+  }
+  detail;
+};
+function snapshotGit(folder) {
+  const dir = path7.join(folder, ".git");
+  let st;
+  try {
+    st = lstatSync2(dir);
+  } catch {
+    return { missing: true };
+  }
+  if (!st.isDirectory()) throw new RepoTamperedError(".git is not a folder");
+  return { missing: false, ino: st.ino, dev: st.dev, real: realpathSync2(dir), configHash: configHash(dir) };
+}
+function verifyGit(folder, snap) {
+  const dir = path7.join(folder, ".git");
+  let st;
+  try {
+    st = lstatSync2(dir);
+  } catch {
+    if (snap.missing) return;
+    throw new RepoTamperedError(".git is gone");
+  }
+  if (snap.missing) throw new RepoTamperedError(".git appeared");
+  if (st.isSymbolicLink() || !st.isDirectory()) throw new RepoTamperedError(".git is not a folder");
+  if (st.ino !== snap.ino || st.dev !== snap.dev || realpathSync2(dir) !== snap.real) throw new RepoTamperedError(".git was replaced");
+  if (existsSync4(path7.join(dir, "commondir"))) throw new RepoTamperedError(".git has a commondir file");
+  for (const f of [path7.join("objects", "info", "alternates"), path7.join("objects", "info", "http-alternates"), "worktrees"]) {
+    if (exists(path7.join(dir, f))) throw new RepoTamperedError(`.git/${f} exists`);
+  }
+  const link = findSymlink(dir);
+  if (link) throw new RepoTamperedError(`.git/${link} is a symlink`);
+  if (configHash(dir) !== snap.configHash) throw new RepoTamperedError(".git/config changed");
+}
+var WALK_MAX_DEPTH = 12;
+var WALK_MAX_ENTRIES = 2e5;
+function findSymlink(dir) {
+  let count = 0;
+  const walk = (rel, depth) => {
+    if (depth > WALK_MAX_DEPTH) throw new RepoTamperedError(`.git is nested too deep: ${rel}`);
+    let entries;
+    try {
+      entries = readdirSync3(path7.join(dir, rel), { withFileTypes: true });
+    } catch {
+      throw new RepoTamperedError(`unreadable entry in .git: ${rel || "."}`);
+    }
+    count += entries.length;
+    if (count > WALK_MAX_ENTRIES) throw new RepoTamperedError(".git has too many entries");
+    for (const e of entries) {
+      const child = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isSymbolicLink()) return child;
+      if (e.isDirectory()) {
+        const found = walk(child, depth + 1);
+        if (found) return found;
+      }
+    }
+    return null;
+  };
+  return walk("", 0);
+}
+function configHash(gitDir) {
+  const file2 = path7.join(gitDir, "config");
+  let st;
+  try {
+    st = lstatSync2(file2);
+  } catch {
+    return "none";
+  }
+  if (!st.isFile()) throw new RepoTamperedError(".git/config is not a file");
+  return createHash("sha256").update(readFileSync2(file2)).digest("hex");
+}
+function exists(p) {
+  try {
+    lstatSync2(p);
+    return true;
+  } catch {
+    return false;
   }
-  return folder;
 }
 
 // src/scrub.ts
@@ -30444,12 +31075,12 @@ function resolveRoute(siteUrl, route) {
     return { error: "route is not a valid URL path" };
   }
   if (url2.origin !== site.origin || !url2.pathname.startsWith(prefix + "/wp/v2/")) return { error: "route must stay under /wp/v2/" };
-  const path11 = url2.pathname.slice(prefix.length);
-  return { path: path11, route: path11 + url2.search, query: url2.searchParams };
+  const path13 = url2.pathname.slice(prefix.length);
+  return { path: path13, route: path13 + url2.search, query: url2.searchParams };
 }
 
 // src/wp/backup.ts
-import path6 from "node:path";
+import path8 from "node:path";
 
 // src/wp/transport.ts
 var shellQuote = (a) => /^[A-Za-z0-9_\-.,/:=@%+]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`;
@@ -30468,7 +31099,7 @@ async function backupBefore(t, root) {
   const wp = await dump(`{ wp db export - --path=${shellQuote(root)} || echo ${FAILED} >&2; } | gzip`);
   if (wp === "overflow") throw new Error("backup_failed: the database dump is over 200 MB");
   if (wp) return { dump: wp, how: "wp-cli" };
-  const config2 = await t.getFile(path6.posix.join(root, "wp-config.php")).catch(() => null);
+  const config2 = await t.getFile(path8.posix.join(root, "wp-config.php")).catch(() => null);
   const db = config2 ? dbCredentials(config2) : null;
   if (!db) throw new Error("backup_failed: no wp-cli export and no database credentials in wp-config.php");
   const [host, port] = splitHost(db.host);
@@ -30600,7 +31231,7 @@ async function ftpTransport(conn) {
 // src/wp/helper.ts
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import http from "node:http";
-import path7 from "node:path";
+import path9 from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v3/helpers/util.js
 var util;
@@ -30976,8 +31607,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path11, errorMaps, issueData } = params;
-  const fullPath = [...path11, ...issueData.path || []];
+  const { data, path: path13, errorMaps, issueData } = params;
+  const fullPath = [...path13, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -31092,11 +31723,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path11, key) {
+  constructor(parent, value, path13, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path11;
+    this._path = path13;
     this._key = key;
   }
   get path() {
@@ -35051,10 +35682,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path11) {
-  if (!path11)
+function getElementAtPath(obj, path13) {
+  if (!path13)
     return obj;
-  return path11.reduce((acc, key) => acc?.[key], obj);
+  return path13.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -35394,11 +36025,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path11, issues) {
+function prefixIssues(path13, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path11);
+    iss.path.unshift(path13);
     return iss;
   });
 }
@@ -35860,16 +36491,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path11 = []) => {
+  const processError = (error63, path13 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -35908,17 +36539,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path11 = []) => {
+  const processError = (error63, path13 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -35957,8 +36588,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path11 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path11) {
+  const path13 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path13) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -51509,11 +52140,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path11) {
-  if (path11.length === 0) {
+function getDotPath(path13) {
+  if (path13.length === 0) {
     return "object root";
   }
-  return path11.reduce((acc, seg, index) => {
+  return path13.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -53740,13 +54371,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path11 = ref.slice(1).split("/").filter(Boolean);
-  if (path11.length === 0) {
+  const path13 = ref.slice(1).split("/").filter(Boolean);
+  if (path13.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path11[0] === defsKey) {
-    const key = path11[1] === void 0 ? void 0 : decodeJSONPointerSegment(path11[1]);
+  if (path13[0] === defsKey) {
+    const key = path13[1] === void 0 ? void 0 : decodeJSONPointerSegment(path13[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -62194,7 +62825,7 @@ function buildServer(t) {
     if (!t.allow.files && !t.allow.all) return fail("the files group is off for this project");
     if (t.root === null) return fail("wordpress_root_not_found: the WordPress folder was not found on the server");
     const bad = pathRefusal(p, t.allow.all);
-    return bad ? fail(bad) : path7.posix.join(t.root, p);
+    return bad ? fail(bad) : path9.posix.join(t.root, p);
   };
   server.registerTool("wp_get_file", {
     description: "Reads a file of the WordPress site, by its path relative to the WordPress folder (e.g. wp-content/themes/x/style.css).",
@@ -62266,9 +62897,9 @@ function apiRefusal(route, query, method, body, allow) {
 }
 function pathRefusal(p, all) {
   if (p.startsWith("/") || p.includes("\\") || p.includes("\0")) return "path must be relative to the WordPress folder";
-  const norm = path7.posix.normalize(p);
+  const norm = path9.posix.normalize(p);
   if (norm === ".." || norm.startsWith("../") || p.split("/").includes("..")) return "path must stay inside the WordPress folder";
-  if (!all && PROTECTED_FILES.has(path7.posix.basename(norm))) return `refused: ${path7.posix.basename(norm)} is never changed unless "Allow everything" is on`;
+  if (!all && PROTECTED_FILES.has(path9.posix.basename(norm))) return `refused: ${path9.posix.basename(norm)} is never changed unless "Allow everything" is on`;
   return null;
 }
 function publishedLink(json3) {
@@ -62280,7 +62911,7 @@ var cut2 = (s) => s.length > MAX_OUTPUT ? `${s.slice(0, MAX_OUTPUT)}
 [cut at ${MAX_OUTPUT} characters]` : s;
 
 // src/wp/root.ts
-import path8 from "node:path";
+import path10 from "node:path";
 var FTP_CANDIDATES = [".", "public_html", "www", "htdocs", "httpdocs", "html", "web"];
 async function findRoot(t) {
   if (t.run) {
@@ -62288,10 +62919,10 @@ async function findRoot(t) {
     if (home?.code === 0) return ".";
     const found = await t.run(["find", ".", "-maxdepth", "3", "-name", "wp-config.php"]).catch(() => null);
     const first = found?.stdout.toString("utf8").split("\n").map((l) => l.trim()).filter(Boolean).sort((a, b) => a.split("/").length - b.split("/").length)[0];
-    return first ? path8.posix.normalize(path8.posix.dirname(first)) : null;
+    return first ? path10.posix.normalize(path10.posix.dirname(first)) : null;
   }
   for (const dir of FTP_CANDIDATES) {
-    if (await t.getFile(path8.posix.join(dir, "wp-config.php")).catch(() => null) !== null) return dir;
+    if (await t.getFile(path10.posix.join(dir, "wp-config.php")).catch(() => null) !== null) return dir;
   }
   return null;
 }
@@ -62390,29 +63021,45 @@ async function runOne(spec, deps) {
     return ms <= 0 ? 0 : Math.max(1, Math.ceil(ms / 6e4));
   };
   const sendDone = (input2) => doneWithRetry(spec.runId, input2, api, log, sleep);
+  if (engineTooOld(deps.sandbox.engineVersion)) {
+    log.error(`run ${spec.runId}: Claude Code ${deps.sandbox.engineVersion ?? "(unknown version)"} is too old; update it (claude update)`);
+    await sendDone({ outcome: "failed", error: "engine_too_old", costUsd: 0, inputTokens: 0, outputTokens: 0 }).catch((e) => log.warn(`run ${spec.runId}: done failed: ${errorText2(e)}`));
+    return;
+  }
   const secrets = [
     spec.mcp.accessToken,
     spec.mcp.refreshToken,
     spec.wordpress?.apiPassword,
     spec.wordpress?.ssh?.privateKey,
     spec.wordpress?.ssh?.password,
-    spec.wordpress?.ftp?.password
+    spec.wordpress?.ftp?.password,
+    ...tokenForms(spec.github?.token)
   ].filter((s) => Boolean(s));
+  const gitToken = spec.github ? githubToken(spec.runId, spec.github, api, secrets, now) : void 0;
   const totals = { costUsd: 0, inputTokens: 0, outputTokens: 0 };
   const events = transcript(spec.runId, api, log, secrets, now, totals);
   let helper;
   let tempDir;
+  let settingsFile;
+  let clone2;
   let pendingDone = true;
+  const slot = deps.slot ?? 0;
+  let started = false;
   try {
+    if (!/^[\w-]+$/.test(spec.projectId)) throw new Error("runner_error");
     let cwd;
     if (spec.kind === "github" && spec.github) {
-      cwd = await prepareGithubFolder(deps.paths.projectsDir, spec.projectId, spec.github, deps.exec);
+      started = true;
+      clone2 = await prepareGithubFolder({ ...deps.paths, slot }, spec.projectId, spec.github, gitToken, deps.exec);
+      cwd = clone2.folder;
     } else {
-      const parent = path9.join(deps.paths.projectsDir, spec.projectId);
-      mkdirSync6(parent, { recursive: true, mode: 448 });
-      cwd = tempDir = mkdtempSync(path9.join(parent, "run-"));
+      started = true;
+      const parent = projectFolder(deps.paths.projectsDir, slot, spec.projectId);
+      mkdirSync7(parent, { recursive: true, mode: 448 });
+      cwd = tempDir = mkdtempSync(path11.join(parent, "run-"));
       if (deps.helperFactory) helper = await deps.helperFactory(spec);
     }
+    settingsFile = writeSettings(spec, deps, cwd);
     const base = {
       cwd,
       systemPrompt: spec.systemPrompt,
@@ -62420,7 +63067,8 @@ async function runOne(spec, deps) {
       helper: helper ? { url: helper.url, token: helper.token } : void 0,
       env: {},
       maxMinutes: spec.maxRunMinutes,
-      claudeConfigDir: deps.paths.claudeConfigDir
+      claudeConfigDir: deps.paths.claudeConfigDir,
+      settingsFile
     };
     log.info(`run ${spec.runId}: start`);
     const timedOut = (sessionId) => ({ outcome: "failed", error: "timeout", costUsd: 0, inputTokens: 0, outputTokens: 0, sessionId });
@@ -62433,10 +63081,26 @@ async function runOne(spec, deps) {
       if (result.sessionId) totals.sessionId = result.sessionId;
       const site = skipped ? void 0 : await helper?.checkSite?.();
       await events.flush(totals);
-      const input2 = site && site !== "ok" ? { outcome: "failed", error: site, ...totals } : doneInput(result, totals, secrets);
+      let input2 = site && site !== "ok" ? { outcome: "failed", error: site, ...totals } : doneInput(result, totals, secrets);
+      let pushFailed = false;
+      if (input2.outcome === "reported" && spec.kind === "github" && spec.github) {
+        try {
+          if (clone2) verifyGit(clone2.folder, clone2.snap);
+          await pushBranch(cwd, barePath(deps.paths.gitDir, spec.projectId), spec.github.branch, gitToken, deps.exec);
+        } catch (e) {
+          pushFailed = true;
+          if (e instanceof RepoTamperedError) {
+            log.error(`run ${spec.runId}: not pushed: the run changed the repository's own settings (${e.detail})`);
+            input2 = { outcome: "failed", error: "repo_tampered", ...totals };
+          } else {
+            log.error(`run ${spec.runId}: push failed: ${scrub(errorText2(e), secrets).slice(0, 200)}`);
+            input2 = { outcome: "failed", error: "push_failed", ...totals };
+          }
+        }
+      }
       const answer = await sendDone(input2);
       log.info(`run ${spec.runId}: done ${input2.outcome}${input2.error ? ` ${input2.error}` : ""}`);
-      if (!answer.followUp || skipped) {
+      if (!answer.followUp || skipped || pushFailed) {
         pendingDone = false;
         break;
       }
@@ -62456,7 +63120,7 @@ async function runOne(spec, deps) {
     log.error(`run ${spec.runId}: ${message}`);
     if (pendingDone && helper?.checkSite) {
       const site = await helper.checkSite().catch((e) => {
-        log.warn(`run ${spec.runId}: site check failed: ${errorText(e)}`);
+        log.warn(`run ${spec.runId}: site check failed: ${errorText2(e)}`);
         return "ok";
       });
       if (site !== "ok") message = site;
@@ -62464,20 +63128,98 @@ async function runOne(spec, deps) {
     if (pendingDone) {
       const usage = events.usage();
       await events.flush();
-      await sendDone({ outcome: "failed", error: message, ...usage }).catch((e) => log.warn(`run ${spec.runId}: done failed: ${errorText(e)}`));
+      await sendDone({ outcome: "failed", error: message, ...usage }).catch((e) => log.warn(`run ${spec.runId}: done failed: ${errorText2(e)}`));
     }
   } finally {
     events.stop();
-    if (helper) await helper.stop().catch((e) => log.warn(`run ${spec.runId}: helper stop failed: ${errorText(e)}`));
+    if (helper) await helper.stop().catch((e) => log.warn(`run ${spec.runId}: helper stop failed: ${errorText2(e)}`));
+    if (clone2) {
+      try {
+        verifyGit(clone2.folder, clone2.snap);
+        saveSnapshot(deps.paths.gitDir, spec.projectId, slot, clone2.snap);
+      } catch (e) {
+        log.warn(`run ${spec.runId}: removing the project folder: ${e instanceof RepoTamperedError ? e.detail : errorText2(e)}`);
+        try {
+          forgetSnapshot(deps.paths.gitDir, spec.projectId, slot);
+        } catch {
+        }
+        try {
+          rmSync5(clone2.folder, { recursive: true, force: true });
+        } catch (err) {
+          log.warn(`run ${spec.runId}: could not remove ${clone2.folder}: ${errorText2(err)}`);
+        }
+      }
+    }
+    if (started) {
+      try {
+        touchLastRun(deps.paths.gitDir, spec.projectId, now());
+      } catch (e) {
+        log.warn(`run ${spec.runId}: could not write the last-run marker: ${errorText2(e)}`);
+      }
+    }
+    if (settingsFile) {
+      try {
+        rmSync5(settingsFile, { force: true });
+      } catch (e) {
+        log.warn(`run ${spec.runId}: could not remove ${settingsFile}: ${errorText2(e)}`);
+      }
+    }
     if (tempDir) {
       try {
-        rmSync3(tempDir, { recursive: true, force: true });
+        rmSync5(tempDir, { recursive: true, force: true });
       } catch (e) {
-        log.warn(`run ${spec.runId}: could not remove ${tempDir}: ${errorText(e)}`);
+        log.warn(`run ${spec.runId}: could not remove ${tempDir}: ${errorText2(e)}`);
       }
     }
   }
 }
+var tokenForms = (token) => token ? [token, Buffer.from(`x-access-token:${token}`).toString("base64")] : [];
+var TOKEN_MARGIN_MS = 5 * 6e4;
+function githubToken(runId, g, api, secrets, now) {
+  let token = g.token;
+  let expiresAt = Date.parse(g.tokenExpiresAt);
+  return async () => {
+    if (!token || !Number.isFinite(expiresAt) || expiresAt - TOKEN_MARGIN_MS <= now().getTime()) {
+      const fresh = await api.gitToken(runId);
+      if (typeof fresh?.token !== "string" || !fresh.token) throw new Error("no GitHub token from Notiamo");
+      token = fresh.token;
+      expiresAt = Date.parse(fresh.expiresAt);
+      secrets.push(...tokenForms(token));
+    }
+    return token;
+  };
+}
+function writeSettings(spec, deps, cwd) {
+  const { sandbox } = deps;
+  let wordpressHost;
+  if (spec.wordpress) {
+    try {
+      wordpressHost = new URL(spec.wordpress.siteUrl).hostname;
+    } catch {
+    }
+  }
+  if (!/^[\w-]+$/.test(spec.runId)) throw new Error("bad run id");
+  const dir = path11.resolve(deps.paths.runsDir);
+  mkdirSync7(dir, { recursive: true, mode: 448 });
+  const settings = sandboxSettings({
+    platform: sandbox.platform,
+    runnerRoot: sandbox.runnerRoot,
+    claudeConfigDir: deps.paths.claudeConfigDir,
+    runDir: cwd,
+    notiamoHost: sandbox.notiamoHost,
+    extraDomains: sandbox.allowedDomains(),
+    wordpressHost,
+    gitExecPath: sandbox.gitExecPath,
+    ghPath: sandbox.ghPath
+  });
+  const file2 = path11.join(dir, `${spec.runId}.json`);
+  writeFileSync6(file2, JSON.stringify(settings, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync2(file2, 384);
+  } catch {
+  }
+  return file2;
+}
 function wordpressHelperFactory(deps) {
   const { log } = deps;
   return async (spec) => {
@@ -62490,7 +63232,7 @@ function wordpressHelperFactory(deps) {
       const backup = await backupBefore(transport, root);
       if (backup.dump) {
         log.info(`run ${spec.runId}: database backed up with ${backup.how} (${backup.dump.byteLength} bytes gzip)`);
-        await uploadDump(deps.api, spec.runId, backup.dump).catch((e) => log.warn(`run ${spec.runId}: backup upload failed: ${errorText(e)}`));
+        await uploadDump(deps.api, spec.runId, backup.dump).catch((e) => log.warn(`run ${spec.runId}: backup upload failed: ${errorText2(e)}`));
       } else {
         log.warn(`run ${spec.runId}: no database backup (${transport ? "WordPress folder not found" : "no SSH"})`);
       }
@@ -62548,12 +63290,12 @@ async function doneWithRetry(runId, input2, api, log, sleep) {
       const retryable = !(e instanceof ApiError) || e.status >= 500;
       const wait = DONE_BACKOFF_MS[attempt];
       if (!retryable || wait === void 0) throw e;
-      log.warn(`run ${runId}: done failed (${errorText(e)}); retrying in ${wait / 1e3} s`);
+      log.warn(`run ${runId}: done failed (${errorText2(e)}); retrying in ${wait / 1e3} s`);
       await sleep(wait);
     }
   }
 }
-var errorText = (e) => e instanceof Error ? e.message : String(e);
+var errorText2 = (e) => e instanceof Error ? e.message : String(e);
 function doneInput(r, totals, secrets) {
   const usage = { ...totals };
   if (r.outcome === "ended") return { outcome: "failed", error: "no_report", ...usage };
@@ -62579,7 +63321,7 @@ function transcript(runId, api, log, secrets, now, totals) {
       try {
         await api.events(runId, body);
       } catch (err) {
-        log.warn(`run ${runId}: dropped ${body.lines.length} event lines: ${errorText(err)}`);
+        log.warn(`run ${runId}: dropped ${body.lines.length} event lines: ${errorText2(err)}`);
       }
     }
   };
@@ -62612,72 +63354,144 @@ function transcript(runId, api, log, secrets, now, totals) {
 }
 
 // src/loop.ts
+var defaultSettings = (notiamoHost) => ({ runsAtOnce: 1, keepClonesDays: 7, allowedDomains: [], notiamoHost });
+function applyHello(settings, answer, defaultHost) {
+  const d = defaultSettings(defaultHost);
+  settings.runsAtOnce = Number.isInteger(answer.runsAtOnce) && answer.runsAtOnce >= 1 ? answer.runsAtOnce : d.runsAtOnce;
+  settings.keepClonesDays = typeof answer.keepClonesDays === "number" && Number.isFinite(answer.keepClonesDays) && answer.keepClonesDays > 0 ? answer.keepClonesDays : d.keepClonesDays;
+  settings.allowedDomains = Array.isArray(answer.allowedDomains) ? answer.allowedDomains.filter((x) => typeof x === "string" && x.length > 0) : d.allowedDomains;
+  settings.notiamoHost = typeof answer.notiamoHost === "string" && answer.notiamoHost ? answer.notiamoHost : d.notiamoHost;
+}
 var HELLO_MS = 6e4;
+var SLOT_FOLDERS = 3;
 var NETWORK_BACKOFF_MS = 5e3;
 var NEXT_WAIT_SECONDS = 25;
 async function startLoop(deps) {
   const { api, log, signal } = deps;
   const sleep = deps.sleep ?? ((ms) => delay2(ms, void 0, { signal }).catch(() => {
   }));
+  const defaultHost = deps.sandbox.notiamoHost;
+  const settings = deps.settings ?? defaultSettings(defaultHost);
+  const clones = deps.clones ?? removeStaleClones;
+  const running = /* @__PURE__ */ new Map();
+  for (let i = 0; i < SLOT_FOLDERS; i++) {
+    try {
+      mkdirSync8(path12.join(deps.paths.projectsDir, String(i)), { recursive: true, mode: 448 });
+    } catch (e) {
+      log.warn(`slot folder ${i} not made: ${errorText3(e)}`);
+    }
+  }
+  const freeSlot = () => {
+    const used = new Set([...running.values()].map((r) => r.slot));
+    let i = 0;
+    while (used.has(i)) i++;
+    return i;
+  };
+  const saveState = () => {
+    try {
+      writeState(deps.paths.stateFile, [...running.keys()]);
+    } catch (e) {
+      log.warn(`state file not written: ${errorText3(e)}`);
+    }
+  };
   const leftover = readState(deps.paths.stateFile);
-  if (leftover) {
-    log.warn(`run ${leftover}: the runner restarted during it`);
-    await api.done(leftover, { outcome: "failed", error: "runner_restarted", costUsd: 0, inputTokens: 0, outputTokens: 0 }).catch(() => {
+  for (const runId of leftover) {
+    log.warn(`run ${runId}: the runner restarted during it`);
+    await api.done(runId, { outcome: "failed", error: "runner_restarted", costUsd: 0, inputTokens: 0, outputTokens: 0 }).catch(() => {
     });
-    clearState(deps.paths.stateFile);
   }
-  const hello = () => api.hello({ version: deps.version, os: deps.os, engine: deps.engineName ?? "claude", engineVersion: deps.engineVersion }).then(() => {
-  }, (e) => log.warn(`hello failed: ${errorText2(e)}`));
+  if (leftover.length) {
+    try {
+      writeState(deps.paths.stateFile, []);
+    } catch (e) {
+      log.warn(`state file not cleared: ${errorText3(e)}`);
+    }
+  }
+  let helloInFlight = false;
+  const hello = async () => {
+    if (helloInFlight) return;
+    helloInFlight = true;
+    try {
+      await helloOnce();
+    } finally {
+      helloInFlight = false;
+    }
+  };
+  const helloOnce = async () => {
+    try {
+      applyHello(settings, await api.hello({ version: deps.version, os: deps.os, engine: deps.engineName ?? "claude", engineVersion: deps.engineVersion }), defaultHost);
+    } catch (e) {
+      log.warn(`hello failed: ${errorText3(e)}`);
+    }
+    try {
+      clones(deps.paths.projectsDir, deps.paths.gitDir, settings.keepClonesDays, new Set([...running.values()].map((r) => r.projectId)), /* @__PURE__ */ new Date(), log);
+    } catch (e) {
+      log.warn(`project folder clean-up failed: ${errorText3(e)}`);
+    }
+  };
   await hello();
-  const timer = setInterval(() => void hello(), HELLO_MS);
+  const timer = setInterval(() => void hello(), deps.helloEveryMs ?? HELLO_MS);
   timer.unref();
   try {
     while (!signal?.aborted) {
+      if (running.size >= settings.runsAtOnce) {
+        await Promise.race([...running.values()].map((r) => r.ended));
+        continue;
+      }
       let spec;
       try {
         spec = await api.next(NEXT_WAIT_SECONDS, signal);
       } catch (e) {
         if (signal?.aborted) break;
-        log.warn(`next failed: ${errorText2(e)}`);
+        log.warn(`next failed: ${errorText3(e)}`);
         await sleep(NETWORK_BACKOFF_MS);
         continue;
       }
       if (!spec) continue;
-      try {
-        writeState(deps.paths.stateFile, spec.runId);
-      } catch (e) {
-        log.warn(`state file not written: ${errorText2(e)}`);
-      }
-      try {
-        await runOne(spec, { engine: deps.engine, api, paths: deps.paths, log, helperFactory: deps.helperFactory });
-      } catch (e) {
-        log.error(`run ${spec.runId}: ${errorText2(e)}`);
+      const s = spec;
+      if (running.has(s.runId)) {
+        log.warn(`run ${s.runId}: handed out again while it runs here; ignored`);
+        continue;
       }
-      try {
-        clearState(deps.paths.stateFile);
-      } catch (e) {
-        log.warn(`state file not cleared: ${errorText2(e)}`);
+      if ([...running.values()].some((r) => r.projectId === s.projectId)) {
+        log.warn(`run ${s.runId}: refused: its project is already running here`);
+        await api.done(s.runId, { outcome: "failed", error: "runner_busy", costUsd: 0, inputTokens: 0, outputTokens: 0 }).catch((e) => log.warn(`run ${s.runId}: done failed: ${errorText3(e)}`));
+        continue;
       }
+      const slot = freeSlot();
+      const entry = { projectId: s.projectId, slot, ended: Promise.resolve() };
+      running.set(s.runId, entry);
+      saveState();
+      const sandbox = { ...deps.sandbox, notiamoHost: settings.notiamoHost, allowedDomains: () => settings.allowedDomains };
+      entry.ended = runOne(s, { engine: deps.engine, api, paths: deps.paths, slot, sandbox, log, helperFactory: deps.helperFactory }).catch((e) => log.error(`run ${s.runId}: ${errorText3(e)}`)).finally(() => {
+        running.delete(s.runId);
+        saveState();
+      });
     }
+    await Promise.all([...running.values()].map((r) => r.ended));
   } finally {
     clearInterval(timer);
   }
 }
-var errorText2 = (e) => e instanceof Error ? e.message : String(e);
+var errorText3 = (e) => e instanceof Error ? e.message : String(e);
 function readState(file2) {
   try {
-    const s = JSON.parse(readFileSync2(file2, "utf8"));
-    return typeof s.busyRunId === "string" ? s.busyRunId : null;
+    const s = JSON.parse(readFileSync3(file2, "utf8"));
+    if (Array.isArray(s.busyRunIds)) return s.busyRunIds.filter((x) => typeof x === "string");
+    return typeof s.busyRunId === "string" ? [s.busyRunId] : [];
   } catch {
-    return null;
+    return [];
   }
 }
-function writeState(file2, busyRunId) {
-  mkdirSync7(path10.dirname(file2), { recursive: true, mode: 448 });
-  writeFileSync4(file2, JSON.stringify({ busyRunId }) + "\n", { mode: 384 });
-}
-function clearState(file2) {
-  rmSync4(file2, { force: true });
+function writeState(file2, busyRunIds) {
+  if (!busyRunIds.length) {
+    rmSync6(file2, { force: true });
+    return;
+  }
+  mkdirSync8(path12.dirname(file2), { recursive: true, mode: 448 });
+  const tmp = `${file2}.tmp`;
+  writeFileSync7(tmp, JSON.stringify({ busyRunIds }) + "\n", { mode: 384 });
+  renameSync2(tmp, file2);
 }
 
 // src/commands.ts
@@ -62687,7 +63501,7 @@ var serviceOptions = (profile) => ({
   profile,
   paths: paths(profileDir(profile)),
   exec: realExec,
-  home: os3.homedir(),
+  home: os6.homedir(),
   env: process.env,
   nodePath: process.execPath,
   cliPath: process.argv[1]
@@ -62724,6 +63538,20 @@ async function start({ profile } = {}) {
   const engine = fake ? fakeEngine([{ kind: "message", text: "Fake engine run." }, { kind: "result", costUsd: 0, inputTokens: 0, outputTokens: 0, sessionId: "fake-session" }], { report: true }) : claudeEngine({});
   const v = fake ? null : await realExec("claude", ["--version"], { env: { ...process.env, CLAUDE_CONFIG_DIR: p.claudeConfigDir } });
   const engineVersion = fake ? "fake" : v?.code === 0 && v.stdout.trim().slice(0, 100) || "unknown";
+  const settings = defaultSettings(hostOf(cfg.host));
+  const tools = await credentialTools(realExec);
+  const sandbox = {
+    platform: process.platform,
+    runnerRoot: defaultDir(),
+    get notiamoHost() {
+      return settings.notiamoHost;
+    },
+    allowedDomains: () => settings.allowedDomains,
+    // The fake engine ignores the settings file: it passes the check.
+    engineVersion: fake ? ENGINE_MIN_VERSION : v?.code === 0 ? engineVersion : null,
+    gitExecPath: tools.gitExecPath,
+    ghPath: tools.ghPath
+  };
   const ctrl = new AbortController();
   const stop5 = (signal) => {
     if (ctrl.signal.aborted) return;
@@ -62734,12 +63562,15 @@ async function start({ profile } = {}) {
   process.on("SIGTERM", () => stop5("SIGTERM"));
   process.on("SIGINT", () => stop5("SIGINT"));
   log.info(`runner ${cfg.name} ${VERSION} started (${engineVersion}), host ${cfg.host}`);
+  if (engineTooOld(sandbox.engineVersion)) log.warn(`Claude Code ${engineVersion} is older than ${ENGINE_MIN_VERSION}: runs fail until it is updated (claude update)`);
   if (process.stdout.isTTY) console.log(`Runner ${cfg.name} is waiting for runs from ${cfg.host}. Logs: ${p.log}`);
   const api = new NotiamoApi(cfg);
   await startLoop({
     api,
     engine,
     paths: p,
+    sandbox,
+    settings,
     log,
     version: VERSION,
     os: process.platform,
@@ -62780,10 +63611,17 @@ function logs({ profile } = {}) {
   const lines2 = tail(paths(profileDir(profile)).log, 50);
   console.log(lines2.length ? lines2.join("\n") : "No log yet.");
 }
+function hostOf(url2) {
+  try {
+    return new URL(url2).hostname;
+  } catch {
+    return url2;
+  }
+}
 function tail(file2, n) {
   let text;
   try {
-    text = readFileSync3(file2, "utf8");
+    text = readFileSync4(file2, "utf8");
   } catch {
     return [];
   }