@notiamo/runner 0.1.2 → 0.2.1

package/dist/cli.js

@@ -1045,8 +1045,8 @@ var require_safePathNames = __commonJS({
     })();
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.isSafePathName = isSafePathName;
-    var path11 = __importStar(__require("path"));
-    function isSafePathName(name, localPath = path11) {
+    var path13 = __importStar(__require("path"));
+    function isSafePathName(name, localPath = path13) {
       if (!name || name === "." || name === ".." || name.includes("/")) {
         return false;
       }
@@ -1704,8 +1704,8 @@ var require_Client = __commonJS({
       /**
        * Set the working directory.
        */
-      async cd(path11) {
-        const validPath = await this.protectWhitespace(path11);
+      async cd(path13) {
+        const validPath = await this.protectWhitespace(path13);
         return this.send("CWD " + validPath);
       }
       /**
@@ -1718,8 +1718,8 @@ var require_Client = __commonJS({
        * Get the last modified time of a file. This is not supported by every FTP server, in which case
        * calling this method will throw an exception.
        */
-      async lastMod(path11) {
-        const validPath = await this.protectWhitespace(path11);
+      async lastMod(path13) {
+        const validPath = await this.protectWhitespace(path13);
         const res = await this.send(`MDTM ${validPath}`);
         const date5 = res.message.slice(4);
         return (0, parseListMLSD_1.parseMLSxDate)(date5);
@@ -1727,8 +1727,8 @@ var require_Client = __commonJS({
       /**
        * Get the size of a file.
        */
-      async size(path11) {
-        const validPath = await this.protectWhitespace(path11);
+      async size(path13) {
+        const validPath = await this.protectWhitespace(path13);
         const command = `SIZE ${validPath}`;
         const res = await this.send(command);
         const size = parseInt(res.message.slice(4), 10);
@@ -1755,8 +1755,8 @@ var require_Client = __commonJS({
        * You can ignore FTP error return codes which won't throw an exception if e.g.
        * the file doesn't exist.
        */
-      async remove(path11, ignoreErrorCodes = false) {
-        const validPath = await this.protectWhitespace(path11);
+      async remove(path13, ignoreErrorCodes = false) {
+        const validPath = await this.protectWhitespace(path13);
         if (ignoreErrorCodes) {
           return this.sendIgnoringError(`DELE ${validPath}`);
         }
@@ -1915,8 +1915,8 @@ var require_Client = __commonJS({
        *
        * @param [path]  Path to remote file or directory.
        */
-      async list(path11 = "") {
-        const validPath = await this.protectWhitespace(path11);
+      async list(path13 = "") {
+        const validPath = await this.protectWhitespace(path13);
         let lastError;
         for (const candidate of this.availableListCommands) {
           const command = validPath === "" ? candidate : `${candidate} ${validPath}`;
@@ -2085,21 +2085,21 @@ var require_Client = __commonJS({
       /**
        * Remove an empty directory, will fail if not empty.
        */
-      async removeEmptyDir(path11) {
-        const validPath = await this.protectWhitespace(path11);
+      async removeEmptyDir(path13) {
+        const validPath = await this.protectWhitespace(path13);
         return this.send(`RMD ${validPath}`);
       }
       /**
        * FTP servers can't handle filenames that have leading whitespace. This method transforms
        * a given path to fix that issue for most cases.
        */
-      async protectWhitespace(path11) {
-        if (!path11.startsWith(" ")) {
-          return path11;
+      async protectWhitespace(path13) {
+        if (!path13.startsWith(" ")) {
+          return path13;
         }
         const pwd = await this.pwd();
         const absolutePathPrefix = pwd.endsWith("/") ? pwd : pwd + "/";
-        return absolutePathPrefix + path11;
+        return absolutePathPrefix + path13;
       }
       async _exitAtCurrentDirectory(func) {
         const userDir = await this.pwd();
@@ -2176,11 +2176,11 @@ var require_Client = __commonJS({
       }
     };
     exports.Client = Client3;
-    async function ensureLocalDirectory(path11) {
+    async function ensureLocalDirectory(path13) {
       try {
-        await fsStat(path11);
+        await fsStat(path13);
       } catch (_a3) {
-        await fsMkDir(path11, { recursive: true });
+        await fsMkDir(path13, { recursive: true });
       }
     }
     async function expectedBytesFromLocalFile(fd, options) {
@@ -5477,8 +5477,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path11) {
-      let input2 = path11;
+    function removeDotSegments(path13) {
+      let input2 = path13;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -5887,8 +5887,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path11 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path11 && path11 !== "/" ? path11 : void 0;
+        const path13 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path13 && path13 !== "/" ? path13 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -16025,7 +16025,7 @@ var require_keyParser = __commonJS({
     var {
       createDecipheriv,
       createECDH,
-      createHash,
+      createHash: createHash2,
       createHmac,
       createSign,
       createVerify,
@@ -16713,11 +16713,11 @@ ${formatted}-----END ${type} KEY-----`;
                 );
               }
               const ivSlice = bufferSlice(cipherIV, 0, 8);
-              let cipherKey = createHash("md5").update(passphrase).update(ivSlice).digest();
+              let cipherKey = createHash2("md5").update(passphrase).update(ivSlice).digest();
               while (cipherKey.length < encInfo.keyLen) {
                 cipherKey = combineBuffers(
                   cipherKey,
-                  createHash("md5").update(cipherKey).update(passphrase).update(ivSlice).digest()
+                  createHash2("md5").update(cipherKey).update(passphrase).update(ivSlice).digest()
                 );
               }
               if (cipherKey.length > encInfo.keyLen)
@@ -16882,8 +16882,8 @@ ${formatted}-----END ${type} KEY-----`;
         if (encrypted) {
           const encInfo = CIPHER_INFO[cipherName];
           let cipherKey = combineBuffers(
-            createHash("sha1").update(PPK_PP1).update(passphrase).digest(),
-            createHash("sha1").update(PPK_PP2).update(passphrase).digest()
+            createHash2("sha1").update(PPK_PP1).update(passphrase).digest(),
+            createHash2("sha1").update(PPK_PP2).update(passphrase).digest()
           );
           if (cipherKey.length > encInfo.keyLen)
             cipherKey = bufferSlice(cipherKey, 0, encInfo.keyLen);
@@ -16923,7 +16923,7 @@ ${formatted}-----END ${type} KEY-----`;
           passphrase = EMPTY_PASSPHRASE;
         const calcMAC = createHmac(
           "sha1",
-          createHash("sha1").update("putty-private-key-file-mac-key").update(passphrase).digest()
+          createHash2("sha1").update("putty-private-key-file-mac-key").update(passphrase).digest()
         ).update(macData).digest("hex");
         if (calcMAC !== mac3) {
           if (encrypted) {
@@ -17567,11 +17567,11 @@ var require_agent = __commonJS({
       };
     })();
     var WINDOWS_PIPE_REGEX = /^[/\\][/\\]\.[/\\]pipe[/\\].+/;
-    function createAgent(path11) {
-      if (process.platform === "win32" && !WINDOWS_PIPE_REGEX.test(path11)) {
-        return path11 === "pageant" ? new PageantAgent() : new CygwinAgent(path11);
+    function createAgent(path13) {
+      if (process.platform === "win32" && !WINDOWS_PIPE_REGEX.test(path13)) {
+        return path13 === "pageant" ? new PageantAgent() : new CygwinAgent(path13);
       }
-      return new OpenSSHAgent(path11);
+      return new OpenSSHAgent(path13);
     }
     var AgentProtocol = (() => {
       const SSH_AGENTC_REQUEST_IDENTITIES = 11;
@@ -19245,7 +19245,7 @@ var require_kex = __commonJS({
       createDiffieHellman,
       createDiffieHellmanGroup,
       createECDH,
-      createHash,
+      createHash: createHash2,
       createPublicKey,
       diffieHellman,
       generateKeyPairSync,
@@ -19671,7 +19671,7 @@ var require_kex = __commonJS({
               DISCONNECT_REASON.KEY_EXCHANGE_FAILED
             );
           }
-          const hash2 = createHash(this.hashName);
+          const hash2 = createHash2(this.hashName);
           hashString(hash2, isServer ? this._remoteIdentRaw : this._identRaw);
           hashString(hash2, isServer ? this._identRaw : this._remoteIdentRaw);
           hashString(hash2, isServer ? this._remoteKexinit : this._kexinit);
@@ -20679,9 +20679,9 @@ var require_kex = __commonJS({
     function generateKEXVal(len, hashName, secret, exchangeHash, sessionID, char) {
       let ret;
       if (len) {
-        let digest = createHash(hashName).update(secret).update(exchangeHash).update(char).update(sessionID).digest();
+        let digest = createHash2(hashName).update(secret).update(exchangeHash).update(char).update(sessionID).digest();
         while (digest.length < len) {
-          const chunk = createHash(hashName).update(secret).update(exchangeHash).update(digest).digest();
+          const chunk = createHash2(hashName).update(secret).update(exchangeHash).update(digest).digest();
           const extended2 = Buffer.allocUnsafe(digest.length + chunk.length);
           extended2.set(digest, 0);
           extended2.set(chunk, digest.length);
@@ -22815,17 +22815,17 @@ var require_SFTP = __commonJS({
       // ===========================================================================
       // Client-specific ===========================================================
       // ===========================================================================
-      createReadStream(path11, options) {
+      createReadStream(path13, options) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        return new ReadStream(this, path11, options);
+        return new ReadStream(this, path13, options);
       }
-      createWriteStream(path11, options) {
+      createWriteStream(path13, options) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        return new WriteStream(this, path11, options);
+        return new WriteStream(this, path13, options);
       }
-      open(path11, flags_, attrs, cb) {
+      open(path13, flags_, attrs, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         if (typeof attrs === "function") {
@@ -22844,7 +22844,7 @@ var require_SFTP = __commonJS({
           attrsFlags = attrs.flags;
           attrsLen = attrs.nb;
         }
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + 4 + attrsLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -22852,7 +22852,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         writeUInt32BE(buf, flags, p += pathLen);
         writeUInt32BE(buf, attrsFlags, p += 4);
         if (attrsLen) {
@@ -22983,7 +22983,7 @@ var require_SFTP = __commonJS({
           throw new Error("Client-only method called in server mode");
         fastXfer(fs, this, localPath, remotePath, opts, cb);
       }
-      readFile(path11, options, callback_) {
+      readFile(path13, options, callback_) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let callback;
@@ -23056,13 +23056,13 @@ var require_SFTP = __commonJS({
             return callback && callback(er, buffer);
           });
         };
-        this.open(path11, flag, 438, (er, handle_) => {
+        this.open(path13, flag, 438, (er, handle_) => {
           if (er)
             return callback && callback(er);
           handle = handle_;
           const tryStat = (er2, st) => {
             if (er2) {
-              this.stat(path11, (er_, st_) => {
+              this.stat(path13, (er_, st_) => {
                 if (er_) {
                   return this.close(handle, () => {
                     callback && callback(er2);
@@ -23083,7 +23083,7 @@ var require_SFTP = __commonJS({
           this.fstat(handle, tryStat);
         });
       }
-      writeFile(path11, data, options, callback_) {
+      writeFile(path13, data, options, callback_) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let callback;
@@ -23102,7 +23102,7 @@ var require_SFTP = __commonJS({
         if (options.encoding && !Buffer.isEncoding(options.encoding))
           throw new Error(`Unknown encoding: ${options.encoding}`);
         const flag = options.flag || "w";
-        this.open(path11, flag, options.mode, (openErr, handle) => {
+        this.open(path13, flag, options.mode, (openErr, handle) => {
           if (openErr) {
             callback && callback(openErr);
           } else {
@@ -23111,7 +23111,7 @@ var require_SFTP = __commonJS({
             if (position === null) {
               const tryStat = (er, st) => {
                 if (er) {
-                  this.stat(path11, (er_, st_) => {
+                  this.stat(path13, (er_, st_) => {
                     if (er_) {
                       return this.close(handle, () => {
                         callback && callback(er);
@@ -23130,7 +23130,7 @@ var require_SFTP = __commonJS({
           }
         });
       }
-      appendFile(path11, data, options, callback_) {
+      appendFile(path13, data, options, callback_) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let callback;
@@ -23148,12 +23148,12 @@ var require_SFTP = __commonJS({
           throw new TypeError("Bad arguments");
         if (!options.flag)
           options = Object.assign({ flag: "a" }, options);
-        this.writeFile(path11, data, options, callback);
+        this.writeFile(path13, data, options, callback);
       }
-      exists(path11, cb) {
+      exists(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        this.stat(path11, (err) => {
+        this.stat(path13, (err) => {
           cb && cb(err ? false : true);
         });
       }
@@ -23196,7 +23196,7 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} RENAME`
         );
       }
-      mkdir(path11, attrs, cb) {
+      mkdir(path13, attrs, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let flags = 0;
@@ -23210,7 +23210,7 @@ var require_SFTP = __commonJS({
           flags = attrs.flags;
           attrsLen = attrs.nb;
         }
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + attrsLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23218,7 +23218,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         writeUInt32BE(buf, flags, p += pathLen);
         if (attrsLen) {
           p += 4;
@@ -23234,10 +23234,10 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} MKDIR`
         );
       }
-      rmdir(path11, cb) {
+      rmdir(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23245,7 +23245,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { cb };
         const isBuffered = sendOrBuffer(this, buf);
         this._debug && this._debug(
@@ -23335,10 +23335,10 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} FSTAT`
         );
       }
-      stat(path11, cb) {
+      stat(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23346,17 +23346,17 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { cb };
         const isBuffered = sendOrBuffer(this, buf);
         this._debug && this._debug(
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} STAT`
         );
       }
-      lstat(path11, cb) {
+      lstat(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23364,17 +23364,17 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { cb };
         const isBuffered = sendOrBuffer(this, buf);
         this._debug && this._debug(
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} LSTAT`
         );
       }
-      opendir(path11, cb) {
+      opendir(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23382,14 +23382,14 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { cb };
         const isBuffered = sendOrBuffer(this, buf);
         this._debug && this._debug(
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} OPENDIR`
         );
       }
-      setstat(path11, attrs, cb) {
+      setstat(path13, attrs, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         let flags = 0;
@@ -23401,7 +23401,7 @@ var require_SFTP = __commonJS({
         } else if (typeof attrs === "function") {
           cb = attrs;
         }
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + attrsLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23409,7 +23409,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         writeUInt32BE(buf, flags, p += pathLen);
         if (attrsLen) {
           p += 4;
@@ -23469,8 +23469,8 @@ var require_SFTP = __commonJS({
           mtime: toUnixTimestamp(mtime)
         }, cb);
       }
-      utimes(path11, atime, mtime, cb) {
-        return this.setstat(path11, {
+      utimes(path13, atime, mtime, cb) {
+        return this.setstat(path13, {
           atime: toUnixTimestamp(atime),
           mtime: toUnixTimestamp(mtime)
         }, cb);
@@ -23481,8 +23481,8 @@ var require_SFTP = __commonJS({
           gid
         }, cb);
       }
-      chown(path11, uid, gid, cb) {
-        return this.setstat(path11, {
+      chown(path13, uid, gid, cb) {
+        return this.setstat(path13, {
           uid,
           gid
         }, cb);
@@ -23492,15 +23492,15 @@ var require_SFTP = __commonJS({
           mode
         }, cb);
       }
-      chmod(path11, mode, cb) {
-        return this.setstat(path11, {
+      chmod(path13, mode, cb) {
+        return this.setstat(path13, {
           mode
         }, cb);
       }
-      readlink(path11, cb) {
+      readlink(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23508,7 +23508,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = {
           cb: (err, names) => {
             if (typeof cb !== "function")
@@ -23553,10 +23553,10 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} SYMLINK`
         );
       }
-      realpath(path11, cb) {
+      realpath(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23564,7 +23564,7 @@ var require_SFTP = __commonJS({
         const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
         writeUInt32BE(buf, reqid, 5);
         writeUInt32BE(buf, pathLen, p);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = {
           cb: (err, names) => {
             if (typeof cb !== "function")
@@ -23609,13 +23609,13 @@ var require_SFTP = __commonJS({
           this._debug(`SFTP: Outbound: ${which} posix-rename@openssh.com`);
         }
       }
-      ext_openssh_statvfs(path11, cb) {
+      ext_openssh_statvfs(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         const ext = this._extensions["statvfs@openssh.com"];
         if (!ext || ext !== "2")
           throw new Error("Server does not support this extended request");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 19 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23625,7 +23625,7 @@ var require_SFTP = __commonJS({
         writeUInt32BE(buf, 19, p);
         buf.utf8Write("statvfs@openssh.com", p += 4, 19);
         writeUInt32BE(buf, pathLen, p += 19);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = { extended: "statvfs@openssh.com", cb };
         const isBuffered = sendOrBuffer(this, buf);
         if (this._debug) {
@@ -23711,7 +23711,7 @@ var require_SFTP = __commonJS({
           `SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} fsync@openssh.com`
         );
       }
-      ext_openssh_lsetstat(path11, attrs, cb) {
+      ext_openssh_lsetstat(path13, attrs, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         const ext = this._extensions["lsetstat@openssh.com"];
@@ -23726,7 +23726,7 @@ var require_SFTP = __commonJS({
         } else if (typeof attrs === "function") {
           cb = attrs;
         }
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 20 + 4 + pathLen + 4 + attrsLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23736,7 +23736,7 @@ var require_SFTP = __commonJS({
         writeUInt32BE(buf, 20, p);
         buf.utf8Write("lsetstat@openssh.com", p += 4, 20);
         writeUInt32BE(buf, pathLen, p += 20);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         writeUInt32BE(buf, flags, p += pathLen);
         if (attrsLen) {
           p += 4;
@@ -23753,13 +23753,13 @@ var require_SFTP = __commonJS({
           this._debug(`SFTP: Outbound: ${status5} lsetstat@openssh.com`);
         }
       }
-      ext_openssh_expandPath(path11, cb) {
+      ext_openssh_expandPath(path13, cb) {
         if (this.server)
           throw new Error("Client-only method called in server mode");
         const ext = this._extensions["expand-path@openssh.com"];
         if (ext !== "1")
           throw new Error("Server does not support this extended request");
-        const pathLen = Buffer.byteLength(path11);
+        const pathLen = Buffer.byteLength(path13);
         let p = 9;
         const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 23 + 4 + pathLen);
         writeUInt32BE(buf, buf.length - 4, 0);
@@ -23769,7 +23769,7 @@ var require_SFTP = __commonJS({
         writeUInt32BE(buf, 23, p);
         buf.utf8Write("expand-path@openssh.com", p += 4, 23);
         writeUInt32BE(buf, pathLen, p += 20);
-        buf.utf8Write(path11, p += 4, pathLen);
+        buf.utf8Write(path13, p += 4, pathLen);
         this._requests[reqid] = {
           cb: (err, names) => {
             if (typeof cb !== "function")
@@ -25047,12 +25047,12 @@ var require_SFTP = __commonJS({
       [REQUEST.LSTAT]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed LSTAT packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received LSTAT (id:${reqID})`);
-        if (!sftp.emit("LSTAT", reqID, path11)) {
+        if (!sftp.emit("LSTAT", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25071,13 +25071,13 @@ var require_SFTP = __commonJS({
       [REQUEST.SETSTAT]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         const attrs = readAttrs(sftp._biOpt);
         bufferParser.clear();
         if (attrs === void 0)
           return doFatalSFTPError(sftp, "Malformed SETSTAT packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received SETSTAT (id:${reqID})`);
-        if (!sftp.emit("SETSTAT", reqID, path11, attrs)) {
+        if (!sftp.emit("SETSTAT", reqID, path13, attrs)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25099,12 +25099,12 @@ var require_SFTP = __commonJS({
       [REQUEST.OPENDIR]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed OPENDIR packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received OPENDIR (id:${reqID})`);
-        if (!sftp.emit("OPENDIR", reqID, path11)) {
+        if (!sftp.emit("OPENDIR", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25123,63 +25123,63 @@ var require_SFTP = __commonJS({
       [REQUEST.REMOVE]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed REMOVE packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received REMOVE (id:${reqID})`);
-        if (!sftp.emit("REMOVE", reqID, path11)) {
+        if (!sftp.emit("REMOVE", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
       [REQUEST.MKDIR]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         const attrs = readAttrs(sftp._biOpt);
         bufferParser.clear();
         if (attrs === void 0)
           return doFatalSFTPError(sftp, "Malformed MKDIR packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received MKDIR (id:${reqID})`);
-        if (!sftp.emit("MKDIR", reqID, path11, attrs)) {
+        if (!sftp.emit("MKDIR", reqID, path13, attrs)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
       [REQUEST.RMDIR]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed RMDIR packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received RMDIR (id:${reqID})`);
-        if (!sftp.emit("RMDIR", reqID, path11)) {
+        if (!sftp.emit("RMDIR", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
       [REQUEST.REALPATH]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed REALPATH packet");
         sftp._debug && sftp._debug(
           `SFTP: Inbound: Received REALPATH (id:${reqID})`
         );
-        if (!sftp.emit("REALPATH", reqID, path11)) {
+        if (!sftp.emit("REALPATH", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
       [REQUEST.STAT]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed STAT packet");
         sftp._debug && sftp._debug(`SFTP: Inbound: Received STAT (id:${reqID})`);
-        if (!sftp.emit("STAT", reqID, path11)) {
+        if (!sftp.emit("STAT", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25199,14 +25199,14 @@ var require_SFTP = __commonJS({
       [REQUEST.READLINK]: (sftp, payload) => {
         bufferParser.init(payload, 1);
         const reqID = bufferParser.readUInt32BE();
-        const path11 = bufferParser.readString(true);
+        const path13 = bufferParser.readString(true);
         bufferParser.clear();
-        if (path11 === void 0)
+        if (path13 === void 0)
           return doFatalSFTPError(sftp, "Malformed READLINK packet");
         sftp._debug && sftp._debug(
           `SFTP: Inbound: Received READLINK (id:${reqID})`
         );
-        if (!sftp.emit("READLINK", reqID, path11)) {
+        if (!sftp.emit("READLINK", reqID, path13)) {
           sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
         }
       },
@@ -25277,7 +25277,7 @@ var require_SFTP = __commonJS({
     function roundUpToMultipleOf8(n) {
       return n + 7 & ~7;
     }
-    function ReadStream(sftp, path11, options) {
+    function ReadStream(sftp, path13, options) {
       if (options === void 0)
         options = {};
       else if (typeof options === "string")
@@ -25291,7 +25291,7 @@ var require_SFTP = __commonJS({
       options.emitClose = false;
       options.autoDestroy = false;
       ReadableStream2.call(this, options);
-      this.path = path11;
+      this.path = path13;
       this.flags = options.flags === void 0 ? "r" : options.flags;
       this.mode = options.mode === void 0 ? 438 : options.mode;
       this.start = options.start;
@@ -25422,7 +25422,7 @@ var require_SFTP = __commonJS({
       },
       configurable: true
     });
-    function WriteStream(sftp, path11, options) {
+    function WriteStream(sftp, path13, options) {
       if (options === void 0)
         options = {};
       else if (typeof options === "string")
@@ -25434,7 +25434,7 @@ var require_SFTP = __commonJS({
       options.emitClose = false;
       options.autoDestroy = false;
       WritableStream.call(this, options);
-      this.path = path11;
+      this.path = path13;
       this.flags = options.flags === void 0 ? "w" : options.flags;
       this.mode = options.mode === void 0 ? 438 : options.mode;
       this.start = options.start;
@@ -26116,7 +26116,7 @@ var require_client = __commonJS({
   "../../node_modules/.pnpm/ssh2@1.17.0/node_modules/ssh2/lib/client.js"(exports, module) {
     "use strict";
     var {
-      createHash,
+      createHash: createHash2,
       getHashes,
       randomFillSync
     } = __require("crypto");
@@ -26338,7 +26338,7 @@ var require_client = __commonJS({
           }
           hostVerifier = (key, verify) => {
             if (hashAlgo)
-              key = createHash(hashAlgo).update(key).digest("hex");
+              key = createHash2(hashAlgo).update(key).digest("hex");
             const ret = hashCb(key, verify);
             if (ret !== void 0)
               verify(ret);
@@ -29655,7 +29655,11 @@ function paths(dir) {
     log: path.join(dir, "runner.log"),
     claudeConfigDir: path.join(dir, "claude"),
     projectsDir: path.join(dir, "projects"),
-    stateFile: path.join(dir, "state.json")
+    stateFile: path.join(dir, "state.json"),
+    /** Each run's Claude Code settings file, `<runId>.json`, there only while the run lasts. */
+    runsDir: path.join(dir, "runs"),
+    /** The runner's bare mirrors of the projects' repositories: the only ones that talk to GitHub. */
+    gitDir: path.join(dir, "git")
   };
 }
 function loadConfig(dir = defaultDir()) {
@@ -29693,8 +29697,8 @@ function parseArgs(argv) {
 }
 
 // src/commands.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-import os3 from "node:os";
+import { readFileSync as readFileSync4 } from "node:fs";
+import os6 from "node:os";
 import { createInterface } from "node:readline/promises";
 import { Writable as Writable2 } from "node:stream";
 
@@ -29736,6 +29740,10 @@ var NotiamoApi = class {
   done(runId, body) {
     return this.json("POST", `/api/runner/runs/${encodeURIComponent(runId)}/done`, body);
   }
+  /** A fresh GitHub token for the run's repository, when the spec's one is close to its end. */
+  gitToken(runId) {
+    return this.json("POST", `/api/runner/runs/${encodeURIComponent(runId)}/git-token`, {});
+  }
   /** Uploads a gzip backup of what the run changed. */
   async backup(runId, gzip) {
     await this.call("POST", `/api/runner/runs/${encodeURIComponent(runId)}/backup`, gzip, "application/gzip");
@@ -29758,10 +29766,91 @@ var NotiamoApi = class {
 
 // src/engine/claude.ts
 import * as child_process from "node:child_process";
+import os2 from "node:os";
 var MAX_TEXT = 2e3;
 var KILL_GRACE_MS = 1e4;
 var CLOSE_GRACE_MS = 2e3;
 var cut = (s) => s.length > MAX_TEXT ? s.slice(0, MAX_TEXT) : s;
+var ENV_ALLOW = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "TMPDIR",
+  "TZ",
+  // A machine behind a proxy or with its own CA needs these to reach anything.
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR"
+];
+var ENV_ALLOW_PREFIX = ["XDG_"];
+var ENV_ALLOW_WINDOWS = [
+  "PATHEXT",
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "USERPROFILE",
+  "USERNAME",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PROGRAMDATA",
+  "PROGRAMFILES",
+  "PROGRAMFILES(X86)",
+  "TEMP",
+  "TMP"
+];
+function baseEnv(env, windows) {
+  const out = {};
+  for (const [k, v] of Object.entries(env)) {
+    if (v === void 0) continue;
+    const key = windows ? k.toUpperCase() : k;
+    if (!(ENV_ALLOW.includes(key) || ENV_ALLOW_PREFIX.some((p) => key.startsWith(p)) || windows && ENV_ALLOW_WINDOWS.includes(key))) continue;
+    if (PROXY_URLS.includes(key.toUpperCase())) {
+      const url2 = withoutUserinfo(v);
+      if (url2 !== null) out[k] = url2;
+      continue;
+    }
+    out[k] = v;
+  }
+  return out;
+}
+var PROXY_URLS = ["HTTP_PROXY", "HTTPS_PROXY"];
+function withoutUserinfo(value) {
+  try {
+    const u = new URL(value);
+    u.username = "";
+    u.password = "";
+    return u.toString();
+  } catch {
+    return null;
+  }
+}
+var AGENT_GIT_ENV = {
+  GIT_CONFIG_GLOBAL: os2.devNull,
+  GIT_CONFIG_NOSYSTEM: "1",
+  GIT_TERMINAL_PROMPT: "0",
+  GIT_AUTHOR_NAME: "Notiamo agent",
+  GIT_AUTHOR_EMAIL: "agent@notiamo.com",
+  GIT_COMMITTER_NAME: "Notiamo agent",
+  GIT_COMMITTER_EMAIL: "agent@notiamo.com"
+};
+function isSandboxUnavailable(line) {
+  return /sandbox/i.test(line) && /(unavailable|not available|stopped being available|failed to (start|initiali[sz]e)|requires wsl2|bubblewrap|bwrap|socat)/i.test(line);
+}
 function claudeEngine(deps = {}) {
   const spawn4 = deps.spawn ?? child_process.spawn;
   const bin = deps.claudeBin ?? "claude";
@@ -29782,13 +29871,22 @@ function claudeEngine(deps = {}) {
     // tokens never show on the command line (`ps`). --mcp-config is variadic: the next argument must be a --flag.
     "--mcp-config",
     JSON.stringify(mcpConfig(o)),
-    // Only Notiamo's servers: permissions are skipped, so no .mcp.json of the cloned repo or of the config dir may load.
+    // Only Notiamo's servers: no .mcp.json of the cloned repo or of the config dir may load.
     "--strict-mcp-config",
-    "--dangerously-skip-permissions"
+    // Edits are accepted only inside the working folder; the settings file allows every (sandboxed) Bash command and
+    // Notiamo's tools. Anything else would prompt, and in -p mode a prompt is a refusal.
+    "--permission-mode",
+    "acceptEdits",
+    // The run's settings file (allow and deny rules, read and write block, shell sandbox): only paths and domains, never a secret.
+    ...o.settingsFile ? ["--settings", o.settingsFile] : [],
+    // Only the runner's own user settings (in CLAUDE_CONFIG_DIR): the clone's .claude/settings*.json never load.
+    "--setting-sources",
+    "user"
   ];
   const engineEnv = (o) => ({
-    ...process.env,
+    ...baseEnv(deps.env ?? process.env, windows),
     ...o.env,
+    ...AGENT_GIT_ENV,
     CLAUDE_CONFIG_DIR: o.claudeConfigDir,
     NOTIAMO_RUN_TOKEN: o.mcp.token,
     ...o.helper ? { NOTIAMO_WP_TOKEN: o.helper.token } : {}
@@ -29799,6 +29897,7 @@ function claudeEngine(deps = {}) {
         reported: false,
         result: false,
         resultError: void 0,
+        sandboxError: false,
         limitAt: void 0,
         timedOut: false,
         spawnError: void 0,
@@ -29881,7 +29980,9 @@ function claudeEngine(deps = {}) {
       }
       lines(child.stdout, onLine);
       lines(child.stderr, (l) => {
-        if (l.trim()) onText("error", l, true);
+        if (!l.trim()) return;
+        if (isSandboxUnavailable(l)) st.sandboxError = true;
+        onText("error", l, true);
       });
       for (const s of [child.stdout, child.stderr]) s?.on("error", (e) => emit({ kind: "error", text: cut(`stream error: ${e.message}`) }));
       const kill = (sig) => {
@@ -29908,6 +30009,12 @@ function claudeEngine(deps = {}) {
         clearTimeout(timer);
         clearTimeout(killTimer);
         clearTimeout(closeTimer);
+        if (!windows && child.pid) {
+          try {
+            processKill(-child.pid, "SIGKILL");
+          } catch {
+          }
+        }
         const usage = { costUsd: st.costUsd, inputTokens: st.inputTokens, outputTokens: st.outputTokens, sessionId: st.sessionId };
         const succeeded = st.result && !st.resultError;
         if (st.timedOut) return resolve({ outcome: "failed", error: "timeout", ...usage });
@@ -29916,6 +30023,7 @@ function claudeEngine(deps = {}) {
         if (st.resultError) return resolve({ outcome: "failed", error: st.resultError, ...usage });
         if (st.reported) return resolve({ outcome: "reported", ...usage });
         if (st.result) return resolve({ outcome: "ended", ...usage });
+        if (code !== 0 && st.sandboxError) return resolve({ outcome: "failed", error: "sandbox_unavailable", ...usage });
         if (code !== 0) return resolve({ outcome: "failed", error: `claude exited with code ${code}`, ...usage });
         resolve({ outcome: "ended", ...usage });
       };
@@ -30044,15 +30152,15 @@ async function reportRun(mcp, args, fetchImpl) {
 // src/exec.ts
 import { spawn as spawn2 } from "node:child_process";
 var realExec = async (file2, args, opts) => {
-  const r = await run(file2, args, opts?.env, false);
-  if (r.code === 127 && process.platform === "win32") return run(file2, args.map(quoteForCmd), opts?.env, true);
+  const r = await run(file2, args, opts?.env, false, opts?.timeout);
+  if (r.code === 127 && process.platform === "win32") return run(file2, args.map(quoteForCmd), opts?.env, true, opts?.timeout);
   return r;
 };
-function run(file2, args, env, shell) {
+function run(file2, args, env, shell, timeout) {
   return new Promise((resolve) => {
     let stdout = "";
     let stderr = "";
-    const child = spawn2(file2, args, { env: env ?? process.env, shell, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const child = spawn2(file2, args, { env: env ?? process.env, shell, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, ...timeout ? { timeout, killSignal: "SIGKILL" } : {} });
     child.stdout.on("data", (d) => {
       stdout += d.toString();
     });
@@ -30067,7 +30175,259 @@ var quoteForCmd = (a) => /^[\w.:/\\=-]+$/.test(a) ? a : `"${a.replace(/"/g, '""'
 
 // src/init.ts
 import { spawn as spawn3 } from "node:child_process";
-import os2 from "node:os";
+import os4 from "node:os";
+
+// src/sandbox.ts
+import { accessSync, constants as fsConstants, existsSync, readdirSync, realpathSync } from "node:fs";
+import os3 from "node:os";
+import path2 from "node:path";
+var ENGINE_MIN_VERSION = "2.1.314";
+var DEFAULT_DOMAINS = ["github.com", "api.github.com", "codeload.github.com", "objects.githubusercontent.com", "registry.npmjs.org"];
+function versionAtLeast(version2, min) {
+  const parse3 = (v) => /(\d+)\.(\d+)\.(\d+)/.exec(v)?.slice(1).map(Number);
+  const a = version2 ? parse3(version2) : void 0;
+  const b = parse3(min);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+function engineTooOld(version2) {
+  return !versionAtLeast(version2, ENGINE_MIN_VERSION);
+}
+var CREDENTIALS = [
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".netrc",
+  ".docker",
+  path2.join(".config", "gh"),
+  ".git-credentials",
+  path2.join(".config", "git"),
+  ".npmrc",
+  ".pypirc",
+  path2.join(".config", "gcloud"),
+  path2.join(".config", "hub")
+];
+var BASH_DENY = [
+  "Bash(security *)",
+  "Bash(git credential*)",
+  "Bash(git-credential*)",
+  "Bash(gh auth*)",
+  "Bash(ssh-add *)",
+  // A `*` may stand anywhere in a Bash rule: these also catch `git -c x=y credential fill`, a helper by its full path, `sh -c '…'`.
+  "Bash(*credential*)",
+  "Bash(*osxkeychain*)",
+  "Bash(*libsecret*)",
+  "Bash(*security find-*)",
+  "Bash(*secret-tool*)",
+  "Bash(*gh auth*)"
+];
+var GIT_HELPERS = [
+  "git-credential-osxkeychain",
+  "git-credential-libsecret",
+  "git-credential-store",
+  "git-credential-cache",
+  "git-credential-manager",
+  "git-credential-manager-core"
+];
+var HELPER_DIRS = [
+  "/Library/Developer/CommandLineTools/usr/libexec/git-core",
+  "/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core",
+  "/usr/libexec/git-core",
+  "/usr/lib/git-core",
+  "/usr/local/share/gcm-core",
+  "/opt/homebrew/share/gcm-core",
+  "/usr/local/bin"
+];
+var KEYCHAIN_TOOLS = {
+  darwin: ["/usr/bin/security", "/usr/bin/osascript"],
+  linux: ["/usr/bin/secret-tool", "/usr/bin/gnome-keyring"]
+};
+async function credentialTools(exec, platform = process.platform) {
+  const first = (out) => out.split(/\r?\n/).map((l) => l.trim()).find(Boolean) ?? null;
+  const git = await exec("git", ["--exec-path"]).catch(() => null);
+  const gh = await exec(platform === "win32" ? "where" : "which", ["gh"]).catch(() => null);
+  const ghFound = gh?.code === 0 ? first(gh.stdout) : null;
+  return {
+    gitExecPath: git?.code === 0 ? first(git.stdout) : null,
+    ghPath: ghFound && path2.isAbsolute(ghFound) ? realPath(ghFound) : null
+  };
+}
+function findOnPath(name, dirs, platform) {
+  const names = platform === "win32" ? [`${name}.exe`, `${name}.cmd`, name] : [name];
+  for (const d of dirs) {
+    for (const n of names) {
+      const file2 = path2.join(d, n);
+      try {
+        accessSync(file2, fsConstants.X_OK);
+        return realpathSync(file2);
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function machineToolDirs(env = process.env, argv1 = process.argv[1], execPath = process.execPath, platform = process.platform) {
+  const pathDirs = (env.PATH ?? env.Path ?? "").split(path2.delimiter).filter((d) => d && path2.isAbsolute(d));
+  const dirs = pathDirs.map(realPath);
+  for (const bin of ["git", "claude"]) {
+    const found = findOnPath(bin, pathDirs, platform);
+    if (found) dirs.push(path2.dirname(found));
+  }
+  dirs.push(path2.dirname(realPath(execPath)));
+  if (argv1) {
+    const install4 = path2.dirname(realPath(argv1));
+    dirs.push(install4);
+    if (path2.basename(install4) === "dist") dirs.push(path2.dirname(install4));
+  }
+  return [...new Set(dirs)];
+}
+function realListEntries(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isFile() || e.isSymbolicLink()).map((e) => ({ name: e.name, dir: e.isDirectory() }));
+  } catch {
+    return [];
+  }
+}
+function realPath(p) {
+  const abs = path2.resolve(p);
+  const rest = [];
+  for (let cur = abs; ; ) {
+    try {
+      return path2.join(realpathSync(cur), ...rest);
+    } catch {
+      const parent = path2.dirname(cur);
+      if (parent === cur) return abs;
+      rest.unshift(path2.basename(cur));
+      cur = parent;
+    }
+  }
+}
+function rulePath(p) {
+  const posix = p.replace(/\\/g, "/").replace(/^([A-Za-z]):/, (_m, d) => `/${d.toLowerCase()}`);
+  return `/${posix}`;
+}
+function credentialBinaries(o, toolDirs, listEntries, exists2) {
+  const out = [];
+  const gitReal = /* @__PURE__ */ new Set();
+  const scan = [];
+  const execDir = o.gitExecPath && path2.isAbsolute(o.gitExecPath) ? realPath(o.gitExecPath) : null;
+  for (const d of /* @__PURE__ */ new Set([...execDir ? [execDir] : [], ...toolDirs, ...HELPER_DIRS.map(realPath)])) {
+    const names = listEntries(d).map((e) => e.name);
+    if (names.includes("git")) gitReal.add(realPath(path2.join(d, "git")));
+    const helpers = names.filter((n) => n.startsWith("git-credential-"));
+    scan.push({ dir: d, names: d === execDir ? [.../* @__PURE__ */ new Set([...helpers, ...GIT_HELPERS])] : helpers });
+  }
+  for (const { dir, names } of scan) {
+    for (const n of names) {
+      const own2 = path2.join(dir, n);
+      const real = realPath(own2);
+      out.push(gitReal.has(real) ? own2 : real);
+    }
+  }
+  for (const t of KEYCHAIN_TOOLS[o.platform] ?? []) if (exists2(t)) out.push(realPath(t));
+  if (o.ghPath && path2.isAbsolute(o.ghPath) && !gitReal.has(realPath(o.ghPath))) out.push(realPath(o.ghPath));
+  return out;
+}
+function sandboxSettings(o) {
+  const root = realPath(o.runnerRoot);
+  const claudeDir = realPath(o.claudeConfigDir);
+  const runDir = realPath(o.runDir);
+  const home = realPath(o.home ?? os3.homedir());
+  const at = (...parts) => path2.join(...parts);
+  const edit = (p) => `Edit(${rulePath(p)})`;
+  const gitHooks = at(runDir, ".git", "hooks");
+  const gitConfig = at(runDir, ".git", "config");
+  const listEntries = o.listEntries ?? realListEntries;
+  const exists2 = o.exists ?? existsSync;
+  const walked = [];
+  const visited = /* @__PURE__ */ new Set();
+  const holds = (dir, p) => p === dir || p.startsWith(dir.endsWith(path2.sep) ? dir : dir + path2.sep);
+  const denyAllBut = (dir) => {
+    if (visited.has(dir)) return;
+    visited.add(dir);
+    for (const e of listEntries(dir)) {
+      const child = realPath(at(dir, e.name));
+      if (child === runDir) continue;
+      if (holds(child, runDir)) {
+        if (holds(root, child) && child !== root) denyAllBut(child);
+      } else if (child !== path2.parse(child).root) walked.push({ name: child, dir: e.dir });
+    }
+  };
+  denyAllBut(root);
+  const profiles = listEntries(at(root, "profiles")).filter((e) => e.dir).map((e) => at(root, "profiles", e.name));
+  const known = [root, ...profiles].flatMap((d) => [realPath(at(d, "config.json")), realPath(at(d, "state.json"))]);
+  const toolDirs = (o.toolDirs ?? machineToolDirs()).map(realPath);
+  const denyRead = [...walked.map((e) => e.name), ...known];
+  if (exists2(claudeDir)) denyRead.push(claudeDir);
+  for (const c of CREDENTIALS) if (exists2(at(home, c))) denyRead.push(realPath(at(home, c)));
+  denyRead.push(...credentialBinaries(o, toolDirs, listEntries, exists2));
+  const holdsRun = (dir) => holds(dir, runDir);
+  const editTree = (dir) => holdsRun(dir) ? [] : [edit(`${dir}/**`)];
+  const deny = [
+    edit(at(root, "config.json")),
+    edit(at(root, "state.json")),
+    edit(at(root, "runner.log")),
+    ...editTree(at(root, "runs")),
+    edit(at(root, "profiles", "*", "config.json")),
+    edit(at(root, "profiles", "*", "state.json")),
+    edit(`${at(root, "profiles", "*", "runs")}/**`),
+    ...editTree(claudeDir),
+    edit(`${at(root, "profiles", "*", "claude")}/**`),
+    ...[".ssh", ".aws", ".gnupg", ".docker", ".config", ".npm", ".local", ".claude", ...o.platform === "darwin" ? ["Library"] : []].flatMap((d) => editTree(at(home, d))),
+    ...[
+      ".netrc",
+      ".git-credentials",
+      ".npmrc",
+      ".pypirc",
+      ".zshrc",
+      ".zshenv",
+      ".zprofile",
+      ".bashrc",
+      ".bash_profile",
+      ".bash_login",
+      ".profile",
+      ".gitconfig"
+    ].map((f) => edit(at(home, f))),
+    edit(`${gitHooks}/**`),
+    edit(gitConfig),
+    edit(`${at(runDir, ".claude")}/**`),
+    ...walked.flatMap((e) => e.dir ? editTree(e.name) : [edit(e.name)]),
+    ...toolDirs.filter((d) => d !== path2.parse(d).root).flatMap(editTree),
+    ...BASH_DENY
+  ];
+  const allow = [
+    "Bash",
+    "mcp__notiamo__*",
+    "mcp__notiamo-wp__*",
+    `Read(${rulePath(runDir)}/**)`,
+    "Glob",
+    "Grep",
+    `Edit(${rulePath(runDir)}/**)`,
+    "WebFetch(domain:github.com)"
+  ];
+  const permissions = { blockReadsOutsideWorkingDirectories: true, blockWritesOutsideWorkingDirectories: true, allow, deny: [...new Set(deny)] };
+  if (o.platform === "win32") return { permissions };
+  const domains = [...DEFAULT_DOMAINS, o.notiamoHost, ...o.wordpressHost ? [o.wordpressHost] : [], ...o.extraDomains].map((d) => d.trim().toLowerCase()).filter((d) => d.length > 0);
+  return {
+    permissions,
+    sandbox: {
+      enabled: true,
+      failIfUnavailable: true,
+      allowUnsandboxedCommands: false,
+      filesystem: {
+        denyRead: [...new Set(denyRead)],
+        allowWrite: [runDir],
+        denyWrite: [gitHooks, gitConfig]
+      },
+      network: {
+        allowedDomains: [...new Set(domains)],
+        // macOS: lets the engine's shell commands reach the run's local helper on 127.0.0.1 (no effect on Linux).
+        ...o.wordpressHost ? { allowLocalBinding: true } : {}
+      }
+    }
+  };
+}
 
 // src/service/darwin.ts
 var darwin_exports = {};
@@ -30079,8 +30439,8 @@ __export(darwin_exports, {
   uninstall: () => uninstall
 });
 import { setTimeout as delay } from "node:timers/promises";
-import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2, existsSync } from "node:fs";
-import path2 from "node:path";
+import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "node:fs";
+import path3 from "node:path";
 
 // src/service/common.ts
 var startArgs = (profile) => profile ? ["start", "--profile", profile] : ["start"];
@@ -30095,7 +30455,7 @@ function must(what, r) {
 
 // src/service/darwin.ts
 var label = (profile) => profile ? `com.notiamo.runner.${profile}` : "com.notiamo.runner";
-var plistPath = (home, profile) => path2.join(home, "Library", "LaunchAgents", `${label(profile)}.plist`);
+var plistPath = (home, profile) => path3.join(home, "Library", "LaunchAgents", `${label(profile)}.plist`);
 var domain = (uid) => `gui/${uid}`;
 var BOOTSTRAP_TRIES = 5;
 var BOOTSTRAP_RETRY_MS = 500;
@@ -30135,7 +30495,7 @@ ${env}
 }
 async function install(o) {
   const file2 = plistPath(o.home, o.profile);
-  mkdirSync2(path2.dirname(file2), { recursive: true });
+  mkdirSync2(path3.dirname(file2), { recursive: true });
   writeFileSync2(file2, renderPlist({ nodePath: o.nodePath, cliPath: o.cliPath, log: o.paths.log, env: o.env, profile: o.profile }));
   await o.exec("launchctl", ["bootout", domain(o.uid), file2]);
   const sleep = o.sleep ?? ((ms) => delay(ms));
@@ -30156,7 +30516,7 @@ async function uninstall(o) {
   rmSync(plistPath(o.home, o.profile), { force: true });
 }
 async function status(o) {
-  if (!existsSync(plistPath(o.home, o.profile))) return "not_installed";
+  if (!existsSync2(plistPath(o.home, o.profile))) return "not_installed";
   const r = await o.exec("launchctl", ["print", `${domain(o.uid)}/${label(o.profile)}`]);
   return r.code === 0 ? "running" : "stopped";
 }
@@ -30170,10 +30530,10 @@ __export(linux_exports, {
   stop: () => stop2,
   uninstall: () => uninstall2
 });
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import path3 from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import path4 from "node:path";
 var unit = (profile) => profile ? `notiamo-runner-${profile}` : "notiamo-runner";
-var unitPath = (home, profile) => path3.join(home, ".config", "systemd", "user", `${unit(profile)}.service`);
+var unitPath = (home, profile) => path4.join(home, ".config", "systemd", "user", `${unit(profile)}.service`);
 var q = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 function renderUnit(o) {
   const env = Object.entries(serviceEnv(o.env)).map(([k, v]) => `Environment=${q(`${k}=${v}`)}`).join("\n");
@@ -30195,7 +30555,7 @@ WantedBy=default.target
 }
 async function install2(o) {
   const file2 = unitPath(o.home, o.profile);
-  mkdirSync3(path3.dirname(file2), { recursive: true });
+  mkdirSync3(path4.dirname(file2), { recursive: true });
   writeFileSync3(file2, renderUnit({ nodePath: o.nodePath, cliPath: o.cliPath, log: o.paths.log, env: o.env, profile: o.profile }));
   must("systemctl --user daemon-reload", await o.exec("systemctl", ["--user", "daemon-reload"]));
   must("systemctl --user enable", await o.exec("systemctl", ["--user", "enable", unit(o.profile)]));
@@ -30211,7 +30571,7 @@ async function uninstall2(o) {
   await o.exec("systemctl", ["--user", "daemon-reload"]);
 }
 async function status2(o) {
-  if (!existsSync2(unitPath(o.home, o.profile))) return "not_installed";
+  if (!existsSync3(unitPath(o.home, o.profile))) return "not_installed";
   const r = await o.exec("systemctl", ["--user", "is-active", unit(o.profile)]);
   return r.stdout.trim() === "active" ? "running" : "stopped";
 }
@@ -30262,6 +30622,7 @@ var serviceStatus = async (o) => impl(o).status(withUid(o));
 
 // src/init.ts
 var DEFAULT_HOST = "https://my.notiamo.com";
+var KEYCHAIN_WARNING = "Warning: this user's keychain holds a GitHub login. A run on this machine could reach it. Remove it (Keychain Access, search github.com) or install the runner under a separate macOS user. The runner itself does not need it.";
 var runInteractive = (file2, args, env) => new Promise((resolve, reject) => {
   const child = spawn3(file2, args, { stdio: "inherit", env, shell: process.platform === "win32" });
   child.on("error", reject);
@@ -30281,11 +30642,9 @@ async function runInit(deps) {
   const token = (await deps.prompt("Runner token (made in Notiamo under Settings \u203A Agent runs \u203A Runners; nothing shows while you paste it): ", { hidden: true })).trim();
   if (!token.startsWith("ntr_")) throw new Error("That is not a runner token: it starts with ntr_. Make one in Notiamo: Settings \u203A Agent runs \u203A Runners.");
   const host = normalizeHost(await ask("Notiamo address: ", DEFAULT_HOST));
-  const hostname3 = deps.hostname ?? os2.hostname();
+  const hostname3 = deps.hostname ?? os4.hostname();
   const name = await ask("Name of this runner: ", hostname3);
-  const version2 = await deps.exec("claude", ["--version"], { env });
-  if (version2.code !== 0) throw new Error("Claude Code is not installed. Install it first: https://claude.com/claude-code");
-  const engineVersion = version2.stdout.trim().slice(0, 100) || "unknown";
+  const engineVersion = await checkMachine(deps, env, platform, print);
   try {
     await new NotiamoApi({ host, token }, deps.fetch).hello({ version: VERSION, os: platform, engine: "claude", engineVersion });
   } catch (e) {
@@ -30299,26 +30658,84 @@ async function runInit(deps) {
   }
   const check2 = await deps.exec("claude", ["-p", "say ok"], { env: claudeEnv });
   if (check2.code !== 0) throw new Error("Claude Code is not signed in for the runner.");
+  await warnKeychain(deps, env, platform, print);
   saveConfig({ host, token, name, dataDir: dir, engine: "claude" }, dir);
   await installService({
     platform,
     profile: deps.profile,
     paths: p,
     exec: deps.exec,
-    home: deps.home ?? os2.homedir(),
+    home: deps.home ?? os4.homedir(),
     env,
     nodePath: deps.nodePath ?? process.execPath,
     cliPath: deps.cliPath ?? process.argv[1]
   });
   print(`Runner ${name}${deps.profile ? ` (profile ${deps.profile})` : ""} is installed and running. Logs: ${p.log}`);
 }
+async function checkMachine(deps, env, platform, print) {
+  const version2 = await deps.exec("claude", ["--version"], { env });
+  if (version2.code !== 0) throw new Error("Claude Code is not installed. Install it first: https://claude.com/claude-code");
+  const engineVersion = version2.stdout.trim().slice(0, 100) || "unknown";
+  if (engineTooOld(engineVersion)) throw new Error(`Claude Code 2.1.314 or newer is needed (yours: ${engineVersion}). Update it: claude update`);
+  const git = await deps.exec("git", ["--version"], { env });
+  const gitVersion = git.code === 0 ? /git version (\d+)\.(\d+)/.exec(git.stdout) ?? null : null;
+  if (!gitVersion || Number(gitVersion[1]) < 2 || Number(gitVersion[1]) === 2 && Number(gitVersion[2]) < 31) {
+    const yours = git.code === 0 ? git.stdout.trim().replace(/^git version /, "").slice(0, 60) || "unknown" : "not installed";
+    throw new Error(`git 2.31 or newer is needed (yours: ${yours}). Update git.`);
+  }
+  if (platform === "linux") {
+    const bwrap = await deps.exec("which", ["bwrap"], { env });
+    const socat = await deps.exec("which", ["socat"], { env });
+    if (bwrap.code !== 0 || socat.code !== 0) {
+      throw new Error("The sandbox needs bubblewrap and socat. Install them (Debian/Ubuntu: sudo apt install bubblewrap socat), then run init again.");
+    }
+  } else if (platform === "win32") {
+    print("Note: on Windows without WSL2, shell commands of a run are not sandboxed; Claude's own file tools are still limited to the run folder.");
+  }
+  return engineVersion;
+}
+async function warnKeychain(deps, env, platform, print) {
+  if (platform !== "darwin") return;
+  const git = await deps.exec("security", ["find-internet-password", "-s", "github.com"], { env, timeout: 1e4 });
+  const gh = await deps.exec("security", ["find-generic-password", "-s", "gh:github.com"], { env, timeout: 1e4 });
+  if (git.code === 0 || gh.code === 0) print(KEYCHAIN_WARNING);
+}
+async function runUpdate(deps) {
+  const dir = deps.dir ?? profileDir(deps.profile);
+  const platform = deps.platform ?? process.platform;
+  const p = paths(dir);
+  const env = deps.env ?? process.env;
+  const print = deps.print ?? ((s) => console.log(s));
+  const cfg = loadConfig(dir);
+  const engineVersion = await checkMachine(deps, env, platform, print);
+  try {
+    await new NotiamoApi({ host: cfg.host, token: cfg.token }, deps.fetch).hello({ version: VERSION, os: platform, engine: "claude", engineVersion });
+  } catch (e) {
+    if (e instanceof ApiError && e.status === 401) throw new Error("The saved runner token is not accepted any more (revoked or deleted). Make a new runner in Notiamo and run init.");
+    throw new Error(`Notiamo at ${cfg.host} did not answer: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const check2 = await deps.exec("claude", ["-p", "say ok"], { env: { ...env, CLAUDE_CONFIG_DIR: p.claudeConfigDir } });
+  if (check2.code !== 0) throw new Error("Claude Code is not signed in for the runner. Run: notiamo-runner init");
+  await warnKeychain(deps, env, platform, print);
+  await installService({
+    platform,
+    profile: deps.profile,
+    paths: p,
+    exec: deps.exec,
+    home: deps.home ?? os4.homedir(),
+    env,
+    nodePath: deps.nodePath ?? process.execPath,
+    cliPath: deps.cliPath ?? process.argv[1]
+  });
+  print(`Runner ${cfg.name}${deps.profile ? ` (profile ${deps.profile})` : ""} now runs version ${VERSION}. Logs: ${p.log}`);
+}
 
 // src/log.ts
 import { appendFileSync, mkdirSync as mkdirSync4, renameSync, statSync } from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 var MAX_BYTES = 10 * 1024 * 1024;
 function createLogger(file2) {
-  mkdirSync4(path4.dirname(file2), { recursive: true, mode: 448 });
+  mkdirSync4(path5.dirname(file2), { recursive: true, mode: 448 });
   const write = (level, msg) => {
     try {
       if (statSync(file2).size > MAX_BYTES) renameSync(file2, file2 + ".1");
@@ -30331,18 +30748,110 @@ function createLogger(file2) {
 }
 
 // src/loop.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync2, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import path10 from "node:path";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import path12 from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 
+// src/clones.ts
+import { lstatSync, mkdirSync as mkdirSync5, readdirSync as readdirSync2, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import path6 from "node:path";
+var lastRunPath = (gitDir, projectId) => path6.join(gitDir, `${projectId}.last-run`);
+function touchLastRun(gitDir, projectId, now) {
+  mkdirSync5(gitDir, { recursive: true, mode: 448 });
+  const file2 = lastRunPath(gitDir, projectId);
+  rmSync3(file2, { force: true });
+  writeFileSync4(file2, now.toISOString() + "\n", { flag: "wx", mode: 384 });
+}
+var DAY_MS = 864e5;
+var SLOT_RE = /^\d+$/;
+var ID_RE = /^[\w-]+$/;
+function removeStaleClones(projectsDir, gitDir, keepDays, busyProjectIds, now, log) {
+  const removed = [];
+  let names;
+  try {
+    names = readdirSync2(projectsDir);
+  } catch (e) {
+    if (e.code !== "ENOENT") log.warn(`project folders not listed: ${errorText(e)}`);
+    return removed;
+  }
+  const cutoff = now.getTime() - keepDays * DAY_MS;
+  const isDir = (p) => {
+    try {
+      return lstatSync(p).isDirectory();
+    } catch {
+      return false;
+    }
+  };
+  const gone = /* @__PURE__ */ new Set();
+  const remove = (folder, label2, id, extra, why) => {
+    try {
+      rmSync3(folder, { recursive: true, force: true });
+      for (const f of extra) rmSync3(f, { force: true });
+      removed.push(label2);
+      gone.add(id);
+      log.info(`removed project folder ${label2}: ${why}`);
+    } catch (e) {
+      log.warn(`project folder ${label2} not removed: ${errorText(e)}`);
+    }
+  };
+  const slots = names.filter((n) => SLOT_RE.test(n) && isDir(path6.join(projectsDir, n)));
+  for (const name of names) {
+    if (SLOT_RE.test(name) || !ID_RE.test(name) || busyProjectIds.has(name)) continue;
+    const folder = path6.join(projectsDir, name);
+    if (!isDir(folder)) continue;
+    remove(folder, name, name, [path6.join(gitDir, `${name}.worktree.json`)], "left by an older runner");
+  }
+  for (const slot of slots) {
+    let ids;
+    try {
+      ids = readdirSync2(path6.join(projectsDir, slot));
+    } catch (e) {
+      log.warn(`slot ${slot} not listed: ${errorText(e)}`);
+      continue;
+    }
+    for (const id of ids) {
+      if (!ID_RE.test(id) || busyProjectIds.has(id)) continue;
+      const folder = path6.join(projectsDir, slot, id);
+      try {
+        const st = lstatSync(folder);
+        if (!st.isDirectory()) continue;
+        let lastUse = st.mtimeMs;
+        try {
+          const marker = lstatSync(lastRunPath(gitDir, id));
+          if (marker.isFile()) lastUse = marker.mtimeMs;
+        } catch {
+        }
+        if (lastUse >= cutoff) continue;
+      } catch (e) {
+        log.warn(`project folder ${slot}/${id} not checked: ${errorText(e)}`);
+        continue;
+      }
+      remove(folder, `${slot}/${id}`, id, [path6.join(gitDir, `${id}.${slot}.worktree.json`)], `unused for more than ${keepDays} days`);
+    }
+  }
+  for (const id of gone) {
+    if (slots.some((s) => isDir(path6.join(projectsDir, s, id)))) continue;
+    try {
+      rmSync3(path6.join(gitDir, `${id}.git`), { recursive: true, force: true });
+      rmSync3(lastRunPath(gitDir, id), { force: true });
+    } catch (e) {
+      log.warn(`mirror of ${id} not removed: ${errorText(e)}`);
+    }
+  }
+  return removed;
+}
+var errorText = (e) => e instanceof Error ? e.message : String(e);
+
 // src/run.ts
-import { mkdirSync as mkdirSync6, mkdtempSync, rmSync as rmSync3 } from "node:fs";
-import path9 from "node:path";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import path11 from "node:path";
 
 // src/project-folder.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync5 } from "node:fs";
-import path5 from "node:path";
+import { createHash } from "node:crypto";
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync2, realpathSync as realpathSync2, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import os5 from "node:os";
+import path7 from "node:path";
 import { promisify } from "node:util";
 var execFileAsync = async (file2, args, opts) => {
   const { stdout, stderr } = await promisify(execFile)(file2, args, {
@@ -30354,25 +30863,182 @@ var execFileAsync = async (file2, args, opts) => {
   });
   return { stdout: String(stdout), stderr: String(stderr) };
 };
+var SAFE_GIT = ["-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false"];
+function gitEnv() {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: os5.devNull };
+  for (const k of Object.keys(env)) if (/^GIT_CONFIG_(COUNT|KEY_\d+|VALUE_\d+|PARAMETERS)$/.test(k) || k === "GIT_ASKPASS") delete env[k];
+  return env;
+}
+function githubAuthEnv(token) {
+  return {
+    ...gitEnv(),
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: `http.${GITHUB_URL}.extraheader`,
+    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`
+  };
+}
 var CLONE_TIMEOUT_MS = 10 * 6e4;
 var GIT_TIMEOUT_MS = 2 * 6e4;
-async function prepareGithubFolder(projectsDir, projectId, g, exec = execFileAsync) {
-  const folder = path5.join(projectsDir, projectId);
-  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-  const git = (args, timeout = GIT_TIMEOUT_MS) => exec("git", ["-C", folder, ...args], { env, timeout });
-  if (existsSync3(path5.join(folder, ".git"))) {
-    await git(["fetch", "origin", "--prune"]);
+var barePath = (gitDir, projectId) => path7.join(gitDir, `${projectId}.git`);
+var projectFolder = (projectsDir, slot, projectId) => path7.join(projectsDir, String(slot), projectId);
+var GITHUB_URL = "https://github.com/";
+async function prepareGithubFolder(dirs, projectId, g, token, exec = execFileAsync) {
+  if (!/^[\w-]+$/.test(projectId)) throw new Error("runner_error");
+  if (typeof g.cloneUrl !== "string" || !g.cloneUrl.startsWith(GITHUB_URL) || /\s/.test(g.cloneUrl)) throw new Error("runner_error");
+  const slot = dirs.slot ?? 0;
+  const slotDir = path7.join(dirs.projectsDir, String(slot));
+  const folder = projectFolder(dirs.projectsDir, slot, projectId);
+  const bare = barePath(dirs.gitDir, projectId);
+  const saved = savedSnapshotPath(dirs.gitDir, projectId, slot);
+  const env = gitEnv();
+  const gitIn = (dir, args, timeout = GIT_TIMEOUT_MS) => exec("git", [...SAFE_GIT, "-C", dir, ...args], { env, timeout });
+  if (existsSync4(path7.join(bare, "HEAD"))) {
+    await gitIn(bare, ["remote", "set-url", "--", "origin", g.cloneUrl]);
+    await exec("git", [...SAFE_GIT, "-C", bare, "fetch", "origin", "--prune", "+refs/heads/*:refs/heads/*"], { env: githubAuthEnv(await token()), timeout: CLONE_TIMEOUT_MS });
+  } else {
+    mkdirSync6(dirs.gitDir, { recursive: true, mode: 448 });
+    await exec("git", [...SAFE_GIT, "clone", "--bare", "--", g.cloneUrl, bare], { cwd: dirs.gitDir, env: githubAuthEnv(await token()), timeout: CLONE_TIMEOUT_MS });
+  }
+  if (exists(folder)) {
+    const snap2 = readSavedSnapshot(saved);
+    let ok = snap2 !== null;
+    if (snap2) {
+      try {
+        verifyGit(folder, snap2);
+      } catch {
+        ok = false;
+      }
+    }
+    if (!ok) rmSync4(folder, { recursive: true, force: true });
+  }
+  if (existsSync4(path7.join(folder, ".git"))) {
+    await gitIn(folder, ["fetch", "origin", "--prune"]);
   } else {
-    mkdirSync5(projectsDir, { recursive: true, mode: 448 });
-    await exec("git", ["clone", g.cloneUrl, folder], { cwd: projectsDir, env, timeout: CLONE_TIMEOUT_MS });
+    mkdirSync6(slotDir, { recursive: true, mode: 448 });
+    await exec("git", [...SAFE_GIT, "clone", "--no-hardlinks", "--", bare, folder], { cwd: slotDir, env, timeout: CLONE_TIMEOUT_MS });
   }
-  const { stdout } = await git(["rev-parse", "--abbrev-ref", "HEAD"]);
+  const { stdout } = await gitIn(folder, ["rev-parse", "--abbrev-ref", "HEAD"]);
   if (stdout.trim() !== g.branch) {
-    await git(["reset", "--hard"]);
-    await git(["clean", "-fd"]);
-    await git(["checkout", "-B", g.branch, `origin/${g.fromBranch ?? g.defaultBranch}`]);
+    await gitIn(folder, ["reset", "--hard"]);
+    await gitIn(folder, ["clean", "-fd"]);
+    await gitIn(folder, ["checkout", "-B", g.branch, `origin/${g.fromBranch ?? g.defaultBranch}`]);
+  }
+  const snap = snapshotGit(folder);
+  saveSnapshot(dirs.gitDir, projectId, slot, snap);
+  return { folder, snap };
+}
+var savedSnapshotPath = (gitDir, projectId, slot) => path7.join(gitDir, `${projectId}.${slot}.worktree.json`);
+function saveSnapshot(gitDir, projectId, slot, snap) {
+  if (snap.missing) return;
+  mkdirSync6(gitDir, { recursive: true, mode: 448 });
+  const body = { gitRealPath: snap.real, dev: snap.dev, ino: snap.ino, configHash: snap.configHash };
+  writeFileSync5(savedSnapshotPath(gitDir, projectId, slot), JSON.stringify(body) + "\n", { mode: 384 });
+}
+function forgetSnapshot(gitDir, projectId, slot) {
+  rmSync4(savedSnapshotPath(gitDir, projectId, slot), { force: true });
+}
+function readSavedSnapshot(file2) {
+  try {
+    const j = JSON.parse(readFileSync2(file2, "utf8"));
+    if (typeof j.gitRealPath !== "string" || typeof j.dev !== "number" || typeof j.ino !== "number" || typeof j.configHash !== "string") return null;
+    return { missing: false, real: j.gitRealPath, dev: j.dev, ino: j.ino, configHash: j.configHash };
+  } catch {
+    return null;
+  }
+}
+async function pushBranch(folder, bare, branch, token, exec = execFileAsync) {
+  const env = gitEnv();
+  await exec("git", [...SAFE_GIT, "-C", bare, "fetch", folder, `+refs/heads/${branch}:refs/heads/${branch}`], { env, timeout: GIT_TIMEOUT_MS }).catch(gitError);
+  const auth = githubAuthEnv(await token());
+  await exec("git", [...SAFE_GIT, "-C", bare, "push", "--no-verify", "origin", branch], { env: auth, timeout: GIT_TIMEOUT_MS }).catch(gitError);
+}
+function gitError(e) {
+  const stderr = typeof e.stderr === "string" ? e.stderr : "";
+  const line = stderr.split("\n").map((l) => l.trim()).find(Boolean);
+  throw new Error(line ?? "git push failed");
+}
+var RepoTamperedError = class extends Error {
+  constructor(detail) {
+    super("repo_tampered");
+    this.detail = detail;
+  }
+  detail;
+};
+function snapshotGit(folder) {
+  const dir = path7.join(folder, ".git");
+  let st;
+  try {
+    st = lstatSync2(dir);
+  } catch {
+    return { missing: true };
+  }
+  if (!st.isDirectory()) throw new RepoTamperedError(".git is not a folder");
+  return { missing: false, ino: st.ino, dev: st.dev, real: realpathSync2(dir), configHash: configHash(dir) };
+}
+function verifyGit(folder, snap) {
+  const dir = path7.join(folder, ".git");
+  let st;
+  try {
+    st = lstatSync2(dir);
+  } catch {
+    if (snap.missing) return;
+    throw new RepoTamperedError(".git is gone");
+  }
+  if (snap.missing) throw new RepoTamperedError(".git appeared");
+  if (st.isSymbolicLink() || !st.isDirectory()) throw new RepoTamperedError(".git is not a folder");
+  if (st.ino !== snap.ino || st.dev !== snap.dev || realpathSync2(dir) !== snap.real) throw new RepoTamperedError(".git was replaced");
+  if (existsSync4(path7.join(dir, "commondir"))) throw new RepoTamperedError(".git has a commondir file");
+  for (const f of [path7.join("objects", "info", "alternates"), path7.join("objects", "info", "http-alternates"), "worktrees"]) {
+    if (exists(path7.join(dir, f))) throw new RepoTamperedError(`.git/${f} exists`);
+  }
+  const link = findSymlink(dir);
+  if (link) throw new RepoTamperedError(`.git/${link} is a symlink`);
+  if (configHash(dir) !== snap.configHash) throw new RepoTamperedError(".git/config changed");
+}
+var WALK_MAX_DEPTH = 12;
+var WALK_MAX_ENTRIES = 2e5;
+function findSymlink(dir) {
+  let count = 0;
+  const walk = (rel, depth) => {
+    if (depth > WALK_MAX_DEPTH) throw new RepoTamperedError(`.git is nested too deep: ${rel}`);
+    let entries;
+    try {
+      entries = readdirSync3(path7.join(dir, rel), { withFileTypes: true });
+    } catch {
+      throw new RepoTamperedError(`unreadable entry in .git: ${rel || "."}`);
+    }
+    count += entries.length;
+    if (count > WALK_MAX_ENTRIES) throw new RepoTamperedError(".git has too many entries");
+    for (const e of entries) {
+      const child = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isSymbolicLink()) return child;
+      if (e.isDirectory()) {
+        const found = walk(child, depth + 1);
+        if (found) return found;
+      }
+    }
+    return null;
+  };
+  return walk("", 0);
+}
+function configHash(gitDir) {
+  const file2 = path7.join(gitDir, "config");
+  let st;
+  try {
+    st = lstatSync2(file2);
+  } catch {
+    return "none";
+  }
+  if (!st.isFile()) throw new RepoTamperedError(".git/config is not a file");
+  return createHash("sha256").update(readFileSync2(file2)).digest("hex");
+}
+function exists(p) {
+  try {
+    lstatSync2(p);
+    return true;
+  } catch {
+    return false;
   }
-  return folder;
 }
 
 // src/scrub.ts
@@ -30444,12 +31110,12 @@ function resolveRoute(siteUrl, route) {
     return { error: "route is not a valid URL path" };
   }
   if (url2.origin !== site.origin || !url2.pathname.startsWith(prefix + "/wp/v2/")) return { error: "route must stay under /wp/v2/" };
-  const path11 = url2.pathname.slice(prefix.length);
-  return { path: path11, route: path11 + url2.search, query: url2.searchParams };
+  const path13 = url2.pathname.slice(prefix.length);
+  return { path: path13, route: path13 + url2.search, query: url2.searchParams };
 }
 
 // src/wp/backup.ts
-import path6 from "node:path";
+import path8 from "node:path";
 
 // src/wp/transport.ts
 var shellQuote = (a) => /^[A-Za-z0-9_\-.,/:=@%+]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`;
@@ -30468,7 +31134,7 @@ async function backupBefore(t, root) {
   const wp = await dump(`{ wp db export - --path=${shellQuote(root)} || echo ${FAILED} >&2; } | gzip`);
   if (wp === "overflow") throw new Error("backup_failed: the database dump is over 200 MB");
   if (wp) return { dump: wp, how: "wp-cli" };
-  const config2 = await t.getFile(path6.posix.join(root, "wp-config.php")).catch(() => null);
+  const config2 = await t.getFile(path8.posix.join(root, "wp-config.php")).catch(() => null);
   const db = config2 ? dbCredentials(config2) : null;
   if (!db) throw new Error("backup_failed: no wp-cli export and no database credentials in wp-config.php");
   const [host, port] = splitHost(db.host);
@@ -30600,7 +31266,7 @@ async function ftpTransport(conn) {
 // src/wp/helper.ts
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import http from "node:http";
-import path7 from "node:path";
+import path9 from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v3/helpers/util.js
 var util;
@@ -30976,8 +31642,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path11, errorMaps, issueData } = params;
-  const fullPath = [...path11, ...issueData.path || []];
+  const { data, path: path13, errorMaps, issueData } = params;
+  const fullPath = [...path13, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -31092,11 +31758,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path11, key) {
+  constructor(parent, value, path13, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path11;
+    this._path = path13;
     this._key = key;
   }
   get path() {
@@ -35051,10 +35717,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path11) {
-  if (!path11)
+function getElementAtPath(obj, path13) {
+  if (!path13)
     return obj;
-  return path11.reduce((acc, key) => acc?.[key], obj);
+  return path13.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -35394,11 +36060,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path11, issues) {
+function prefixIssues(path13, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path11);
+    iss.path.unshift(path13);
     return iss;
   });
 }
@@ -35860,16 +36526,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path11 = []) => {
+  const processError = (error63, path13 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -35908,17 +36574,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path11 = []) => {
+  const processError = (error63, path13 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path13, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path13, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path13, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -35957,8 +36623,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path11 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path11) {
+  const path13 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path13) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -51509,11 +52175,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path11) {
-  if (path11.length === 0) {
+function getDotPath(path13) {
+  if (path13.length === 0) {
     return "object root";
   }
-  return path11.reduce((acc, seg, index) => {
+  return path13.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -53740,13 +54406,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path11 = ref.slice(1).split("/").filter(Boolean);
-  if (path11.length === 0) {
+  const path13 = ref.slice(1).split("/").filter(Boolean);
+  if (path13.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path11[0] === defsKey) {
-    const key = path11[1] === void 0 ? void 0 : decodeJSONPointerSegment(path11[1]);
+  if (path13[0] === defsKey) {
+    const key = path13[1] === void 0 ? void 0 : decodeJSONPointerSegment(path13[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -62194,7 +62860,7 @@ function buildServer(t) {
     if (!t.allow.files && !t.allow.all) return fail("the files group is off for this project");
     if (t.root === null) return fail("wordpress_root_not_found: the WordPress folder was not found on the server");
     const bad = pathRefusal(p, t.allow.all);
-    return bad ? fail(bad) : path7.posix.join(t.root, p);
+    return bad ? fail(bad) : path9.posix.join(t.root, p);
   };
   server.registerTool("wp_get_file", {
     description: "Reads a file of the WordPress site, by its path relative to the WordPress folder (e.g. wp-content/themes/x/style.css).",
@@ -62266,9 +62932,9 @@ function apiRefusal(route, query, method, body, allow) {
 }
 function pathRefusal(p, all) {
   if (p.startsWith("/") || p.includes("\\") || p.includes("\0")) return "path must be relative to the WordPress folder";
-  const norm = path7.posix.normalize(p);
+  const norm = path9.posix.normalize(p);
   if (norm === ".." || norm.startsWith("../") || p.split("/").includes("..")) return "path must stay inside the WordPress folder";
-  if (!all && PROTECTED_FILES.has(path7.posix.basename(norm))) return `refused: ${path7.posix.basename(norm)} is never changed unless "Allow everything" is on`;
+  if (!all && PROTECTED_FILES.has(path9.posix.basename(norm))) return `refused: ${path9.posix.basename(norm)} is never changed unless "Allow everything" is on`;
   return null;
 }
 function publishedLink(json3) {
@@ -62280,7 +62946,7 @@ var cut2 = (s) => s.length > MAX_OUTPUT ? `${s.slice(0, MAX_OUTPUT)}
 [cut at ${MAX_OUTPUT} characters]` : s;
 
 // src/wp/root.ts
-import path8 from "node:path";
+import path10 from "node:path";
 var FTP_CANDIDATES = [".", "public_html", "www", "htdocs", "httpdocs", "html", "web"];
 async function findRoot(t) {
   if (t.run) {
@@ -62288,10 +62954,10 @@ async function findRoot(t) {
     if (home?.code === 0) return ".";
     const found = await t.run(["find", ".", "-maxdepth", "3", "-name", "wp-config.php"]).catch(() => null);
     const first = found?.stdout.toString("utf8").split("\n").map((l) => l.trim()).filter(Boolean).sort((a, b) => a.split("/").length - b.split("/").length)[0];
-    return first ? path8.posix.normalize(path8.posix.dirname(first)) : null;
+    return first ? path10.posix.normalize(path10.posix.dirname(first)) : null;
   }
   for (const dir of FTP_CANDIDATES) {
-    if (await t.getFile(path8.posix.join(dir, "wp-config.php")).catch(() => null) !== null) return dir;
+    if (await t.getFile(path10.posix.join(dir, "wp-config.php")).catch(() => null) !== null) return dir;
   }
   return null;
 }
@@ -62390,29 +63056,45 @@ async function runOne(spec, deps) {
     return ms <= 0 ? 0 : Math.max(1, Math.ceil(ms / 6e4));
   };
   const sendDone = (input2) => doneWithRetry(spec.runId, input2, api, log, sleep);
+  if (engineTooOld(deps.sandbox.engineVersion)) {
+    log.error(`run ${spec.runId}: Claude Code ${deps.sandbox.engineVersion ?? "(unknown version)"} is too old; update it (claude update)`);
+    await sendDone({ outcome: "failed", error: "engine_too_old", costUsd: 0, inputTokens: 0, outputTokens: 0 }).catch((e) => log.warn(`run ${spec.runId}: done failed: ${errorText2(e)}`));
+    return;
+  }
   const secrets = [
     spec.mcp.accessToken,
     spec.mcp.refreshToken,
     spec.wordpress?.apiPassword,
     spec.wordpress?.ssh?.privateKey,
     spec.wordpress?.ssh?.password,
-    spec.wordpress?.ftp?.password
+    spec.wordpress?.ftp?.password,
+    ...tokenForms(spec.github?.token)
   ].filter((s) => Boolean(s));
+  const gitToken = spec.github ? githubToken(spec.runId, spec.github, api, secrets, now) : void 0;
   const totals = { costUsd: 0, inputTokens: 0, outputTokens: 0 };
   const events = transcript(spec.runId, api, log, secrets, now, totals);
   let helper;
   let tempDir;
+  let settingsFile;
+  let clone2;
   let pendingDone = true;
+  const slot = deps.slot ?? 0;
+  let started = false;
   try {
+    if (!/^[\w-]+$/.test(spec.projectId)) throw new Error("runner_error");
     let cwd;
     if (spec.kind === "github" && spec.github) {
-      cwd = await prepareGithubFolder(deps.paths.projectsDir, spec.projectId, spec.github, deps.exec);
+      started = true;
+      clone2 = await prepareGithubFolder({ ...deps.paths, slot }, spec.projectId, spec.github, gitToken, deps.exec);
+      cwd = clone2.folder;
     } else {
-      const parent = path9.join(deps.paths.projectsDir, spec.projectId);
-      mkdirSync6(parent, { recursive: true, mode: 448 });
-      cwd = tempDir = mkdtempSync(path9.join(parent, "run-"));
+      started = true;
+      const parent = projectFolder(deps.paths.projectsDir, slot, spec.projectId);
+      mkdirSync7(parent, { recursive: true, mode: 448 });
+      cwd = tempDir = mkdtempSync(path11.join(parent, "run-"));
       if (deps.helperFactory) helper = await deps.helperFactory(spec);
     }
+    settingsFile = writeSettings(spec, deps, cwd);
     const base = {
       cwd,
       systemPrompt: spec.systemPrompt,
@@ -62420,7 +63102,8 @@ async function runOne(spec, deps) {
       helper: helper ? { url: helper.url, token: helper.token } : void 0,
       env: {},
       maxMinutes: spec.maxRunMinutes,
-      claudeConfigDir: deps.paths.claudeConfigDir
+      claudeConfigDir: deps.paths.claudeConfigDir,
+      settingsFile
     };
     log.info(`run ${spec.runId}: start`);
     const timedOut = (sessionId) => ({ outcome: "failed", error: "timeout", costUsd: 0, inputTokens: 0, outputTokens: 0, sessionId });
@@ -62433,10 +63116,26 @@ async function runOne(spec, deps) {
       if (result.sessionId) totals.sessionId = result.sessionId;
       const site = skipped ? void 0 : await helper?.checkSite?.();
       await events.flush(totals);
-      const input2 = site && site !== "ok" ? { outcome: "failed", error: site, ...totals } : doneInput(result, totals, secrets);
+      let input2 = site && site !== "ok" ? { outcome: "failed", error: site, ...totals } : doneInput(result, totals, secrets);
+      let pushFailed = false;
+      if (input2.outcome === "reported" && spec.kind === "github" && spec.github) {
+        try {
+          if (clone2) verifyGit(clone2.folder, clone2.snap);
+          await pushBranch(cwd, barePath(deps.paths.gitDir, spec.projectId), spec.github.branch, gitToken, deps.exec);
+        } catch (e) {
+          pushFailed = true;
+          if (e instanceof RepoTamperedError) {
+            log.error(`run ${spec.runId}: not pushed: the run changed the repository's own settings (${e.detail})`);
+            input2 = { outcome: "failed", error: "repo_tampered", ...totals };
+          } else {
+            log.error(`run ${spec.runId}: push failed: ${scrub(errorText2(e), secrets).slice(0, 200)}`);
+            input2 = { outcome: "failed", error: "push_failed", ...totals };
+          }
+        }
+      }
       const answer = await sendDone(input2);
       log.info(`run ${spec.runId}: done ${input2.outcome}${input2.error ? ` ${input2.error}` : ""}`);
-      if (!answer.followUp || skipped) {
+      if (!answer.followUp || skipped || pushFailed) {
         pendingDone = false;
         break;
       }
@@ -62456,7 +63155,7 @@ async function runOne(spec, deps) {
     log.error(`run ${spec.runId}: ${message}`);
     if (pendingDone && helper?.checkSite) {
       const site = await helper.checkSite().catch((e) => {
-        log.warn(`run ${spec.runId}: site check failed: ${errorText(e)}`);
+        log.warn(`run ${spec.runId}: site check failed: ${errorText2(e)}`);
         return "ok";
       });
       if (site !== "ok") message = site;
@@ -62464,20 +63163,98 @@ async function runOne(spec, deps) {
     if (pendingDone) {
       const usage = events.usage();
       await events.flush();
-      await sendDone({ outcome: "failed", error: message, ...usage }).catch((e) => log.warn(`run ${spec.runId}: done failed: ${errorText(e)}`));
+      await sendDone({ outcome: "failed", error: message, ...usage }).catch((e) => log.warn(`run ${spec.runId}: done failed: ${errorText2(e)}`));
     }
   } finally {
     events.stop();
-    if (helper) await helper.stop().catch((e) => log.warn(`run ${spec.runId}: helper stop failed: ${errorText(e)}`));
+    if (helper) await helper.stop().catch((e) => log.warn(`run ${spec.runId}: helper stop failed: ${errorText2(e)}`));
+    if (clone2) {
+      try {
+        verifyGit(clone2.folder, clone2.snap);
+        saveSnapshot(deps.paths.gitDir, spec.projectId, slot, clone2.snap);
+      } catch (e) {
+        log.warn(`run ${spec.runId}: removing the project folder: ${e instanceof RepoTamperedError ? e.detail : errorText2(e)}`);
+        try {
+          forgetSnapshot(deps.paths.gitDir, spec.projectId, slot);
+        } catch {
+        }
+        try {
+          rmSync5(clone2.folder, { recursive: true, force: true });
+        } catch (err) {
+          log.warn(`run ${spec.runId}: could not remove ${clone2.folder}: ${errorText2(err)}`);
+        }
+      }
+    }
+    if (started) {
+      try {
+        touchLastRun(deps.paths.gitDir, spec.projectId, now());
+      } catch (e) {
+        log.warn(`run ${spec.runId}: could not write the last-run marker: ${errorText2(e)}`);
+      }
+    }
+    if (settingsFile) {
+      try {
+        rmSync5(settingsFile, { force: true });
+      } catch (e) {
+        log.warn(`run ${spec.runId}: could not remove ${settingsFile}: ${errorText2(e)}`);
+      }
+    }
     if (tempDir) {
       try {
-        rmSync3(tempDir, { recursive: true, force: true });
+        rmSync5(tempDir, { recursive: true, force: true });
       } catch (e) {
-        log.warn(`run ${spec.runId}: could not remove ${tempDir}: ${errorText(e)}`);
+        log.warn(`run ${spec.runId}: could not remove ${tempDir}: ${errorText2(e)}`);
       }
     }
   }
 }
+var tokenForms = (token) => token ? [token, Buffer.from(`x-access-token:${token}`).toString("base64")] : [];
+var TOKEN_MARGIN_MS = 5 * 6e4;
+function githubToken(runId, g, api, secrets, now) {
+  let token = g.token;
+  let expiresAt = Date.parse(g.tokenExpiresAt);
+  return async () => {
+    if (!token || !Number.isFinite(expiresAt) || expiresAt - TOKEN_MARGIN_MS <= now().getTime()) {
+      const fresh = await api.gitToken(runId);
+      if (typeof fresh?.token !== "string" || !fresh.token) throw new Error("no GitHub token from Notiamo");
+      token = fresh.token;
+      expiresAt = Date.parse(fresh.expiresAt);
+      secrets.push(...tokenForms(token));
+    }
+    return token;
+  };
+}
+function writeSettings(spec, deps, cwd) {
+  const { sandbox } = deps;
+  let wordpressHost;
+  if (spec.wordpress) {
+    try {
+      wordpressHost = new URL(spec.wordpress.siteUrl).hostname;
+    } catch {
+    }
+  }
+  if (!/^[\w-]+$/.test(spec.runId)) throw new Error("bad run id");
+  const dir = path11.resolve(deps.paths.runsDir);
+  mkdirSync7(dir, { recursive: true, mode: 448 });
+  const settings = sandboxSettings({
+    platform: sandbox.platform,
+    runnerRoot: sandbox.runnerRoot,
+    claudeConfigDir: deps.paths.claudeConfigDir,
+    runDir: cwd,
+    notiamoHost: sandbox.notiamoHost,
+    extraDomains: sandbox.allowedDomains(),
+    wordpressHost,
+    gitExecPath: sandbox.gitExecPath,
+    ghPath: sandbox.ghPath
+  });
+  const file2 = path11.join(dir, `${spec.runId}.json`);
+  writeFileSync6(file2, JSON.stringify(settings, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync2(file2, 384);
+  } catch {
+  }
+  return file2;
+}
 function wordpressHelperFactory(deps) {
   const { log } = deps;
   return async (spec) => {
@@ -62490,7 +63267,7 @@ function wordpressHelperFactory(deps) {
       const backup = await backupBefore(transport, root);
       if (backup.dump) {
         log.info(`run ${spec.runId}: database backed up with ${backup.how} (${backup.dump.byteLength} bytes gzip)`);
-        await uploadDump(deps.api, spec.runId, backup.dump).catch((e) => log.warn(`run ${spec.runId}: backup upload failed: ${errorText(e)}`));
+        await uploadDump(deps.api, spec.runId, backup.dump).catch((e) => log.warn(`run ${spec.runId}: backup upload failed: ${errorText2(e)}`));
       } else {
         log.warn(`run ${spec.runId}: no database backup (${transport ? "WordPress folder not found" : "no SSH"})`);
       }
@@ -62548,12 +63325,12 @@ async function doneWithRetry(runId, input2, api, log, sleep) {
       const retryable = !(e instanceof ApiError) || e.status >= 500;
       const wait = DONE_BACKOFF_MS[attempt];
       if (!retryable || wait === void 0) throw e;
-      log.warn(`run ${runId}: done failed (${errorText(e)}); retrying in ${wait / 1e3} s`);
+      log.warn(`run ${runId}: done failed (${errorText2(e)}); retrying in ${wait / 1e3} s`);
       await sleep(wait);
     }
   }
 }
-var errorText = (e) => e instanceof Error ? e.message : String(e);
+var errorText2 = (e) => e instanceof Error ? e.message : String(e);
 function doneInput(r, totals, secrets) {
   const usage = { ...totals };
   if (r.outcome === "ended") return { outcome: "failed", error: "no_report", ...usage };
@@ -62579,7 +63356,7 @@ function transcript(runId, api, log, secrets, now, totals) {
       try {
         await api.events(runId, body);
       } catch (err) {
-        log.warn(`run ${runId}: dropped ${body.lines.length} event lines: ${errorText(err)}`);
+        log.warn(`run ${runId}: dropped ${body.lines.length} event lines: ${errorText2(err)}`);
       }
     }
   };
@@ -62612,72 +63389,144 @@ function transcript(runId, api, log, secrets, now, totals) {
 }
 
 // src/loop.ts
+var defaultSettings = (notiamoHost) => ({ runsAtOnce: 1, keepClonesDays: 7, allowedDomains: [], notiamoHost });
+function applyHello(settings, answer, defaultHost) {
+  const d = defaultSettings(defaultHost);
+  settings.runsAtOnce = Number.isInteger(answer.runsAtOnce) && answer.runsAtOnce >= 1 ? answer.runsAtOnce : d.runsAtOnce;
+  settings.keepClonesDays = typeof answer.keepClonesDays === "number" && Number.isFinite(answer.keepClonesDays) && answer.keepClonesDays > 0 ? answer.keepClonesDays : d.keepClonesDays;
+  settings.allowedDomains = Array.isArray(answer.allowedDomains) ? answer.allowedDomains.filter((x) => typeof x === "string" && x.length > 0) : d.allowedDomains;
+  settings.notiamoHost = typeof answer.notiamoHost === "string" && answer.notiamoHost ? answer.notiamoHost : d.notiamoHost;
+}
 var HELLO_MS = 6e4;
+var SLOT_FOLDERS = 3;
 var NETWORK_BACKOFF_MS = 5e3;
 var NEXT_WAIT_SECONDS = 25;
 async function startLoop(deps) {
   const { api, log, signal } = deps;
   const sleep = deps.sleep ?? ((ms) => delay2(ms, void 0, { signal }).catch(() => {
   }));
+  const defaultHost = deps.sandbox.notiamoHost;
+  const settings = deps.settings ?? defaultSettings(defaultHost);
+  const clones = deps.clones ?? removeStaleClones;
+  const running = /* @__PURE__ */ new Map();
+  for (let i = 0; i < SLOT_FOLDERS; i++) {
+    try {
+      mkdirSync8(path12.join(deps.paths.projectsDir, String(i)), { recursive: true, mode: 448 });
+    } catch (e) {
+      log.warn(`slot folder ${i} not made: ${errorText3(e)}`);
+    }
+  }
+  const freeSlot = () => {
+    const used = new Set([...running.values()].map((r) => r.slot));
+    let i = 0;
+    while (used.has(i)) i++;
+    return i;
+  };
+  const saveState = () => {
+    try {
+      writeState(deps.paths.stateFile, [...running.keys()]);
+    } catch (e) {
+      log.warn(`state file not written: ${errorText3(e)}`);
+    }
+  };
   const leftover = readState(deps.paths.stateFile);
-  if (leftover) {
-    log.warn(`run ${leftover}: the runner restarted during it`);
-    await api.done(leftover, { outcome: "failed", error: "runner_restarted", costUsd: 0, inputTokens: 0, outputTokens: 0 }).catch(() => {
+  for (const runId of leftover) {
+    log.warn(`run ${runId}: the runner restarted during it`);
+    await api.done(runId, { outcome: "failed", error: "runner_restarted", costUsd: 0, inputTokens: 0, outputTokens: 0 }).catch(() => {
     });
-    clearState(deps.paths.stateFile);
   }
-  const hello = () => api.hello({ version: deps.version, os: deps.os, engine: deps.engineName ?? "claude", engineVersion: deps.engineVersion }).then(() => {
-  }, (e) => log.warn(`hello failed: ${errorText2(e)}`));
+  if (leftover.length) {
+    try {
+      writeState(deps.paths.stateFile, []);
+    } catch (e) {
+      log.warn(`state file not cleared: ${errorText3(e)}`);
+    }
+  }
+  let helloInFlight = false;
+  const hello = async () => {
+    if (helloInFlight) return;
+    helloInFlight = true;
+    try {
+      await helloOnce();
+    } finally {
+      helloInFlight = false;
+    }
+  };
+  const helloOnce = async () => {
+    try {
+      applyHello(settings, await api.hello({ version: deps.version, os: deps.os, engine: deps.engineName ?? "claude", engineVersion: deps.engineVersion }), defaultHost);
+    } catch (e) {
+      log.warn(`hello failed: ${errorText3(e)}`);
+    }
+    try {
+      clones(deps.paths.projectsDir, deps.paths.gitDir, settings.keepClonesDays, new Set([...running.values()].map((r) => r.projectId)), /* @__PURE__ */ new Date(), log);
+    } catch (e) {
+      log.warn(`project folder clean-up failed: ${errorText3(e)}`);
+    }
+  };
   await hello();
-  const timer = setInterval(() => void hello(), HELLO_MS);
+  const timer = setInterval(() => void hello(), deps.helloEveryMs ?? HELLO_MS);
   timer.unref();
   try {
     while (!signal?.aborted) {
+      if (running.size >= settings.runsAtOnce) {
+        await Promise.race([...running.values()].map((r) => r.ended));
+        continue;
+      }
       let spec;
       try {
         spec = await api.next(NEXT_WAIT_SECONDS, signal);
       } catch (e) {
         if (signal?.aborted) break;
-        log.warn(`next failed: ${errorText2(e)}`);
+        log.warn(`next failed: ${errorText3(e)}`);
         await sleep(NETWORK_BACKOFF_MS);
         continue;
       }
       if (!spec) continue;
-      try {
-        writeState(deps.paths.stateFile, spec.runId);
-      } catch (e) {
-        log.warn(`state file not written: ${errorText2(e)}`);
-      }
-      try {
-        await runOne(spec, { engine: deps.engine, api, paths: deps.paths, log, helperFactory: deps.helperFactory });
-      } catch (e) {
-        log.error(`run ${spec.runId}: ${errorText2(e)}`);
+      const s = spec;
+      if (running.has(s.runId)) {
+        log.warn(`run ${s.runId}: handed out again while it runs here; ignored`);
+        continue;
       }
-      try {
-        clearState(deps.paths.stateFile);
-      } catch (e) {
-        log.warn(`state file not cleared: ${errorText2(e)}`);
+      if ([...running.values()].some((r) => r.projectId === s.projectId)) {
+        log.warn(`run ${s.runId}: refused: its project is already running here`);
+        await api.done(s.runId, { outcome: "failed", error: "runner_busy", costUsd: 0, inputTokens: 0, outputTokens: 0 }).catch((e) => log.warn(`run ${s.runId}: done failed: ${errorText3(e)}`));
+        continue;
       }
+      const slot = freeSlot();
+      const entry = { projectId: s.projectId, slot, ended: Promise.resolve() };
+      running.set(s.runId, entry);
+      saveState();
+      const sandbox = { ...deps.sandbox, notiamoHost: settings.notiamoHost, allowedDomains: () => settings.allowedDomains };
+      entry.ended = runOne(s, { engine: deps.engine, api, paths: deps.paths, slot, sandbox, log, helperFactory: deps.helperFactory }).catch((e) => log.error(`run ${s.runId}: ${errorText3(e)}`)).finally(() => {
+        running.delete(s.runId);
+        saveState();
+      });
     }
+    await Promise.all([...running.values()].map((r) => r.ended));
   } finally {
     clearInterval(timer);
   }
 }
-var errorText2 = (e) => e instanceof Error ? e.message : String(e);
+var errorText3 = (e) => e instanceof Error ? e.message : String(e);
 function readState(file2) {
   try {
-    const s = JSON.parse(readFileSync2(file2, "utf8"));
-    return typeof s.busyRunId === "string" ? s.busyRunId : null;
+    const s = JSON.parse(readFileSync3(file2, "utf8"));
+    if (Array.isArray(s.busyRunIds)) return s.busyRunIds.filter((x) => typeof x === "string");
+    return typeof s.busyRunId === "string" ? [s.busyRunId] : [];
   } catch {
-    return null;
+    return [];
   }
 }
-function writeState(file2, busyRunId) {
-  mkdirSync7(path10.dirname(file2), { recursive: true, mode: 448 });
-  writeFileSync4(file2, JSON.stringify({ busyRunId }) + "\n", { mode: 384 });
-}
-function clearState(file2) {
-  rmSync4(file2, { force: true });
+function writeState(file2, busyRunIds) {
+  if (!busyRunIds.length) {
+    rmSync6(file2, { force: true });
+    return;
+  }
+  mkdirSync8(path12.dirname(file2), { recursive: true, mode: 448 });
+  const tmp = `${file2}.tmp`;
+  writeFileSync7(tmp, JSON.stringify({ busyRunIds }) + "\n", { mode: 384 });
+  renameSync2(tmp, file2);
 }
 
 // src/commands.ts
@@ -62687,7 +63536,7 @@ var serviceOptions = (profile) => ({
   profile,
   paths: paths(profileDir(profile)),
   exec: realExec,
-  home: os3.homedir(),
+  home: os6.homedir(),
   env: process.env,
   nodePath: process.execPath,
   cliPath: process.argv[1]
@@ -62715,6 +63564,9 @@ async function prompt(q2, opts = {}) {
 async function init({ profile } = {}) {
   await runInit({ prompt, exec: realExec, fetch, profile });
 }
+async function update({ profile } = {}) {
+  await runUpdate({ exec: realExec, fetch, profile });
+}
 async function start({ profile } = {}) {
   const dir = profileDir(profile);
   const cfg = loadConfig(dir);
@@ -62724,6 +63576,20 @@ async function start({ profile } = {}) {
   const engine = fake ? fakeEngine([{ kind: "message", text: "Fake engine run." }, { kind: "result", costUsd: 0, inputTokens: 0, outputTokens: 0, sessionId: "fake-session" }], { report: true }) : claudeEngine({});
   const v = fake ? null : await realExec("claude", ["--version"], { env: { ...process.env, CLAUDE_CONFIG_DIR: p.claudeConfigDir } });
   const engineVersion = fake ? "fake" : v?.code === 0 && v.stdout.trim().slice(0, 100) || "unknown";
+  const settings = defaultSettings(hostOf(cfg.host));
+  const tools = await credentialTools(realExec);
+  const sandbox = {
+    platform: process.platform,
+    runnerRoot: defaultDir(),
+    get notiamoHost() {
+      return settings.notiamoHost;
+    },
+    allowedDomains: () => settings.allowedDomains,
+    // The fake engine ignores the settings file: it passes the check.
+    engineVersion: fake ? ENGINE_MIN_VERSION : v?.code === 0 ? engineVersion : null,
+    gitExecPath: tools.gitExecPath,
+    ghPath: tools.ghPath
+  };
   const ctrl = new AbortController();
   const stop5 = (signal) => {
     if (ctrl.signal.aborted) return;
@@ -62734,12 +63600,15 @@ async function start({ profile } = {}) {
   process.on("SIGTERM", () => stop5("SIGTERM"));
   process.on("SIGINT", () => stop5("SIGINT"));
   log.info(`runner ${cfg.name} ${VERSION} started (${engineVersion}), host ${cfg.host}`);
+  if (engineTooOld(sandbox.engineVersion)) log.warn(`Claude Code ${engineVersion} is older than ${ENGINE_MIN_VERSION}: runs fail until it is updated (claude update)`);
   if (process.stdout.isTTY) console.log(`Runner ${cfg.name} is waiting for runs from ${cfg.host}. Logs: ${p.log}`);
   const api = new NotiamoApi(cfg);
   await startLoop({
     api,
     engine,
     paths: p,
+    sandbox,
+    settings,
     log,
     version: VERSION,
     os: process.platform,
@@ -62780,10 +63649,17 @@ function logs({ profile } = {}) {
   const lines2 = tail(paths(profileDir(profile)).log, 50);
   console.log(lines2.length ? lines2.join("\n") : "No log yet.");
 }
+function hostOf(url2) {
+  try {
+    return new URL(url2).hostname;
+  } catch {
+    return url2;
+  }
+}
 function tail(file2, n) {
   let text;
   try {
-    text = readFileSync3(file2, "utf8");
+    text = readFileSync4(file2, "utf8");
   } catch {
     return [];
   }
@@ -62796,6 +63672,7 @@ var HELP = `notiamo-runner ${VERSION}: runs Notiamo agent runs on this machine w
 Usage: notiamo-runner <command> [--profile <name>]
 
   init       Set the runner up: token, Claude Code sign-in, start at login or boot
+  update     Move a runner that is set up to this version: keeps its token and sign-in
   start      Run in the foreground (what the service runs)
   stop       Stop the service until the next login or boot
   status     Whether the service is installed and running, and the last log line
@@ -62818,6 +63695,8 @@ ${HELP}`);
   switch (cmd) {
     case "init":
       return init(o);
+    case "update":
+      return update(o);
     case "start":
       return start(o);
     case "stop":