@odla-ai/cli 0.14.1 → 0.16.0

package/dist/{chunk-AN6KZMR5.js → chunk-S3OYXHDG.js}

@@ -403,12 +403,13 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   const { token, expiresAt } = await requestToken2({
     endpoint: audience,
     email,
-    label: options.label ?? `odla CLI admin AI (${scope})`,
+    label: options.label ?? `odla CLI (${scope})`,
     scopes: [scope],
     fetch: doFetch,
     onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
       const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
-      out.log(`Review, then approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      const requestName = scope === "app:code:host:connect" ? "terminal connection" : "scoped request";
+      out.log(`Review, then approve ${requestName} ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
       if (approvalBrowser({ open: options.open }).open) {
         await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
       }
@@ -505,8 +506,8 @@ async function responseBody(response2) {
 }
 function apiError(status, body) {
   const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
-  const message3 = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `read System AI admin changes failed (${status}): ${message3}`;
+  const message2 = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `read System AI admin changes failed (${status}): ${message2}`;
 }
 function timestamp(value) {
   if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
@@ -598,8 +599,8 @@ async function responseBody2(res) {
 }
 function apiError2(action, status, body) {
   const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
-  const message3 = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message3}`;
+  const message2 = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message2}`;
 }
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -779,8 +780,8 @@ async function responseBody3(res) {
 }
 function apiError3(action, status, body) {
   const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
-  const message3 = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message3}`;
+  const message2 = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message2}`;
 }
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -1110,8 +1111,8 @@ var CAPABILITIES = {
     "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
   ]
 };
-function printCapabilities(json2 = false, out = console) {
-  if (json2) {
+function printCapabilities(json = false, out = console) {
+  if (json) {
     out.log(JSON.stringify(CAPABILITIES, null, 2));
     return;
   }
@@ -1160,8 +1161,8 @@ var CalendarRequestError = class extends Error {
   status;
   /** Machine-readable `error.code` from the response body, when present. */
   code;
-  constructor(message3, status, code) {
-    super(message3);
+  constructor(message2, status, code) {
+    super(message2);
     this.name = "CalendarRequestError";
     this.status = status;
     if (code !== void 0) this.code = code;
@@ -1309,8 +1310,8 @@ async function calendarJson(ctx, suffix, init) {
   const body = await response2.json().catch(() => ({}));
   if (!response2.ok) {
     const code = textField(body.error?.code, 128);
-    const message3 = textField(body.error?.message, 500);
-    const detail = `${code ? ` ${code}` : ""}${message3 ? `: ${message3}` : ""}`;
+    const message2 = textField(body.error?.message, 500);
+    const detail = `${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`;
     throw new CalendarRequestError(redactSecrets(`calendar request failed (${response2.status})${detail}`), response2.status, code);
   }
   return body;
@@ -1546,8 +1547,8 @@ function pollTimeout(value = 10 * 6e4) {
 function productionConsent(env, yes, action) {
   if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
 }
-function printStatus(status, json2, out) {
-  if (json2) {
+function printStatus(status, json, out) {
+  if (json) {
     out.log(JSON.stringify(status, null, 2));
     return;
   }
@@ -1583,8 +1584,8 @@ async function requestHostedSecurityJson(options, path, init, action) {
   const body = await response2.json().catch(() => ({}));
   if (!response2.ok) {
     const code = optionalHostedText(body.error?.code, "error code", 128);
-    const message3 = optionalHostedText(body.error?.message, "error message", 300);
-    throw new Error(`${action} failed (${response2.status})${code ? ` ${code}` : ""}${message3 ? `: ${message3}` : ""}`);
+    const message2 = optionalHostedText(body.error?.message, "error message", 300);
+    throw new Error(`${action} failed (${response2.status})${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`);
   }
   return body;
 }
@@ -1773,6 +1774,27 @@ async function defaultReadOrigin(cwd) {
   return result.stdout;
 }
 
+// src/code-runtime-config.ts
+var CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:e7858b4f0291543171b2659b47c5d00f97acc4767cafd9b74ae5228899e0cde4";
+var CODE_BUILD_RECIPES = Object.freeze([{
+  id: "odla-code-contracts",
+  image: "node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd",
+  command: [
+    "node",
+    "--test",
+    "scripts/lib/directories.test.mjs",
+    "scripts/lib/internal-deps.test.mjs",
+    "scripts/lib/npm-audit.test.mjs",
+    "scripts/lib/npm-release-contract.test.mjs",
+    "scripts/lib/release-surfaces.test.mjs"
+  ],
+  timeoutMs: 12e4,
+  maxOutputBytes: 1024 * 1024,
+  cpus: 1,
+  memory: "512m",
+  pids: 128
+}]);
+
 // src/code-connect.ts
 import { existsSync as existsSync4 } from "fs";
 import { cpus, hostname, totalmem } from "os";
@@ -1803,72 +1825,77 @@ function parseAgentOutput(line) {
   } catch {
     throw new HarnessProtocolError("agent emitted invalid JSON");
   }
-  const message3 = record2(value);
-  if (!message3 || message3.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
+  const message2 = record2(value);
+  if (!message2 || message2.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
     throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
   }
-  if (message3.type === "event") {
+  if (message2.type === "event") {
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "event",
-      kind: boundedText(message3.kind, "event.kind", 120),
-      ...message3.payload === void 0 ? {} : { payload: message3.payload }
+      kind: boundedText(message2.kind, "event.kind", 120),
+      ...message2.payload === void 0 ? {} : { payload: message2.payload }
     };
   }
-  if (message3.type === "inference.request") {
-    const call = record2(message3.call);
+  if (message2.type === "inference.request") {
+    const call = record2(message2.call);
     if (!call || !Array.isArray(call.messages) || !Number.isSafeInteger(call.maxTokens)) {
       throw new HarnessProtocolError("inference.request.call requires messages and maxTokens");
     }
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "inference.request",
-      requestId: boundedText(message3.requestId, "requestId", 180),
+      requestId: boundedText(message2.requestId, "requestId", 180),
       call
     };
   }
-  if (message3.type === "tool.request") {
-    const input = record2(message3.input);
-    const tool = String(message3.tool);
+  if (message2.type === "tool.request") {
+    const input = record2(message2.input);
+    const tool = String(message2.tool);
     if (!input || !["sandbox.read", "sandbox.apply_patch", "sandbox.run_recipe"].includes(tool)) {
       throw new HarnessProtocolError("tool.request requires a registered tool and object input");
     }
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "tool.request",
-      requestId: boundedText(message3.requestId, "requestId", 180),
+      requestId: boundedText(message2.requestId, "requestId", 180),
       tool,
       input
     };
   }
-  if (message3.type === "attempt.complete") {
-    if (!(/* @__PURE__ */ new Set(["completed", "failed", "cancelled"])).has(String(message3.status))) {
+  if (message2.type === "attempt.complete") {
+    if (!(/* @__PURE__ */ new Set(["completed", "failed", "cancelled"])).has(String(message2.status))) {
       throw new HarnessProtocolError("attempt.complete.status is invalid");
     }
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "attempt.complete",
-      status: message3.status,
-      ...message3.result === void 0 ? {} : { result: message3.result }
+      status: message2.status,
+      ...message2.result === void 0 ? {} : { result: message2.result }
     };
   }
   throw new HarnessProtocolError("agent message type is unsupported");
 }
-function encodeAgentInput(message3) {
-  return `${JSON.stringify(message3)}
+function encodeAgentInput(message2) {
+  return `${JSON.stringify(message2)}
 `;
 }
 
-// ../harness/dist/chunk-FNYUIJUN.js
+// ../harness/dist/chunk-TA2FKK27.js
 import { execFile as execFile2, spawn as spawn2 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
 import { delimiter, join as join2 } from "path";
 import { getgid, getuid } from "process";
-import { chmod, copyFile, mkdir, mkdtemp, readdir, realpath, rm, stat } from "fs/promises";
+import { mkdir, mkdtemp, realpath, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { basename, join as join22, relative as relative2, resolve as resolve3 } from "path";
+import { join as join22, resolve as resolve3, sep } from "path";
 import { spawn as spawn22 } from "child_process";
+import { isAbsolute as isAbsolute3 } from "path";
+import { chmod, copyFile, lstat, mkdir as mkdir2, mkdtemp as mkdtemp2, readdir, realpath as realpath2, rm as rm2, stat } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { basename, join as join3, relative as relative2, resolve as resolve22, sep as sep2 } from "path";
+import { spawn as spawn3 } from "child_process";
 var DIGEST_IMAGE = /^[a-z0-9][a-z0-9._/-]*(?::[a-zA-Z0-9._-]+)?@sha256:[0-9a-f]{64}$/;
 function assertPinnedImage(image) {
   if (!DIGEST_IMAGE.test(image)) throw new TypeError("container image must be pinned by sha256 digest");
@@ -1912,7 +1939,7 @@ async function selectContainerEngine(requested = "auto", options = {}) {
   throw new TypeError("no supported container engine found");
 }
 function inspectRootlessPodman() {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve33, reject) => {
     execFile2(
       "podman",
       ["info", "--format", "{{.Host.Security.Rootless}}"],
@@ -1922,7 +1949,7 @@ function inspectRootlessPodman() {
           reject(new TypeError("could not verify that the active Podman service is rootless"));
           return;
         }
-        resolve23(stdout.trim() === "true");
+        resolve33(stdout.trim() === "true");
       }
     );
   });
@@ -2033,9 +2060,9 @@ async function runContainerAttempt(options) {
       if (bytes.byteLength > 1e6) throw new Error("agent message exceeds 1 MB");
       const line = bytes.toString("utf8");
       if (!line.trim()) return;
-      const message3 = parseAgentOutput(line);
-      if (message3.type === "attempt.complete") complete = message3;
-      const response2 = await options.onMessage(message3);
+      const message2 = parseAgentOutput(line);
+      if (message2.type === "attempt.complete") complete = message2;
+      const response2 = await options.onMessage(message2);
       if (response2 && !child.stdin.destroyed) child.stdin.write(encodeAgentInput(response2));
     };
     try {
@@ -2083,16 +2110,129 @@ async function runContainerAttempt(options) {
     options.signal?.removeEventListener("abort", abort);
   }
 }
-var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
-var SECRET_FILE = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+var SKIP_WORKSPACE_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".odla",
+  ".wrangler",
+  "node_modules",
+  "dist",
+  "coverage"
+]);
+var SECRET_WORKSPACE_FILE = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+function allowedWorkspacePath(relativePath) {
+  const parts = relativePath.split("/");
+  return !isAbsolute3(relativePath) && !relativePath.includes("\\") && !relativePath.includes("\0") && !parts.some((part) => !part || part === "." || part === ".." || SKIP_WORKSPACE_DIRS.has(part)) && !SECRET_WORKSPACE_FILE.test(parts.at(-1) ?? "");
+}
+async function gitOutput(cwd, args, maxBytes) {
+  const child = spawn22("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);
+  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  return Buffer.concat(stdout);
+}
+async function gitBlobs(cwd, entries, maxBytes) {
+  const child = spawn22("git", ["cat-file", "--batch"], { cwd, stdio: ["pipe", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes + entries.length * 100) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  child.stdin.end(`${entries.map((entry) => entry.hash).join("\n")}
+`);
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);
+  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  const output = Buffer.concat(stdout);
+  const blobs = [];
+  let offset = 0;
+  let total = 0;
+  for (const entry of entries) {
+    const newline = output.indexOf(10, offset);
+    if (newline < 0) throw new Error("git object output is truncated");
+    const match = /^([0-9a-f]{40,64}) blob ([0-9]+)$/.exec(output.subarray(offset, newline).toString("utf8"));
+    if (!match || match[1] !== entry.hash) throw new Error("git object output does not match its inventory");
+    const length = Number(match[2]);
+    if (!Number.isSafeInteger(length) || length < 0 || newline + 1 + length >= output.length) {
+      throw new Error("git object output has an invalid length");
+    }
+    const content = output.subarray(newline + 1, newline + 1 + length);
+    if (output[newline + 1 + length] !== 10) throw new Error("git object output is malformed");
+    total += content.byteLength;
+    if (total > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+    blobs.push(content);
+    offset = newline + 1 + length + 1;
+  }
+  return blobs;
+}
+async function materializeGitTree(source, commitSha, options = {}) {
+  if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError("Git tree requires an exact commit SHA");
+  const sourceDir = await realpath(resolve3(source));
+  const maxFiles = options.maxFiles ?? 2e4;
+  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+  const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
+  const entries = inventory.flatMap((record5) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record5);
+    return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
+  });
+  if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const root = await mkdtemp(join22(options.tempRoot ?? tmpdir(), "odla-git-tree-"));
+  const targetRoot = join22(root, "source");
+  await mkdir(targetRoot);
+  let byteCount = 0;
+  try {
+    const blobs = await gitBlobs(sourceDir, entries, maxBytes);
+    for (const [index, entry] of entries.entries()) {
+      const content = blobs[index];
+      byteCount += content.byteLength;
+      if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+      const target = resolve3(targetRoot, entry.path);
+      if (!target.startsWith(`${resolve3(targetRoot)}${sep}`)) throw new TypeError("Git tree path escapes workspace");
+      await mkdir(resolve3(target, ".."), { recursive: true });
+      await writeFile(target, content, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
+    }
+    return {
+      root,
+      sourceDir: targetRoot,
+      fileCount: entries.length,
+      byteCount,
+      cleanup: () => rm(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await rm(root, { recursive: true, force: true });
+    throw error;
+  }
+}
 async function sourceFiles(sourceDir, maxFiles, maxBytes) {
   const files = [];
   let bytes = 0;
   const walk = async (dir) => {
     for (const entry of await readdir(dir, { withFileTypes: true })) {
-      if (entry.isDirectory() && SKIP_DIRS.has(entry.name)) continue;
-      if (!entry.isDirectory() && SECRET_FILE.test(entry.name)) continue;
-      const path = join22(dir, entry.name);
+      if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
+      if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;
+      const path = join3(dir, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         await walk(path);
@@ -2114,16 +2254,62 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
   await walk(sourceDir);
   return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
 }
+async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
+  const child = spawn3("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd: sourceDir,
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
+  });
+  const stdout = [];
+  const stderr = [];
+  let outputBytes = 0;
+  child.stdout.on("data", (chunk) => {
+    outputBytes += chunk.byteLength;
+    if (outputBytes > 8 * 1024 * 1024) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
+  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
+  if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const root = resolve22(sourceDir);
+  const files = [];
+  let bytes = 0;
+  for (const relativePath of paths) {
+    if (!allowedWorkspacePath(relativePath)) continue;
+    const source = resolve22(root, relativePath);
+    if (!source.startsWith(`${root}${sep2}`)) throw new TypeError("git file path escapes workspace");
+    let metadata2;
+    try {
+      metadata2 = await lstat(source);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    if (metadata2.isSymbolicLink() || !metadata2.isFile()) continue;
+    bytes += metadata2.size;
+    if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+    files.push({ source, relativePath, mode: metadata2.mode & 511, bytes: metadata2.size });
+  }
+  return files;
+}
 async function copyTree(files, destination) {
   for (const file of files) {
-    const target = join22(destination, file.relativePath);
-    await mkdir(resolve3(target, ".."), { recursive: true });
+    const target = join3(destination, file.relativePath);
+    await mkdir2(resolve22(target, ".."), { recursive: true });
     await copyFile(file.source, target);
     await chmod(target, file.mode);
   }
 }
 async function captureGitDiff(root, maxBytes) {
-  const child = spawn22("git", [
+  const child = spawn3("git", [
     "diff",
     "--no-index",
     "--binary",
@@ -2156,15 +2342,17 @@ async function captureGitDiff(root, maxBytes) {
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
 async function stageWorkspace(source, options = {}) {
-  const sourceDir = await realpath(resolve3(source));
+  const sourceDir = await realpath2(resolve22(source));
   const sourceStat = await stat(sourceDir);
   if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
-  const root = await mkdtemp(join22(options.tempRoot ?? tmpdir(), "odla-harness-"));
-  const baselineDir = join22(root, "baseline");
-  const workspaceDir = join22(root, "workspace");
-  await Promise.all([mkdir(baselineDir), mkdir(workspaceDir)]);
+  const root = await mkdtemp2(join3(options.tempRoot ?? tmpdir2(), "odla-harness-"));
+  const baselineDir = join3(root, "baseline");
+  const workspaceDir = join3(root, "workspace");
+  await Promise.all([mkdir2(baselineDir), mkdir2(workspaceDir)]);
   try {
-    const files = await sourceFiles(sourceDir, options.maxFiles ?? 2e4, options.maxBytes ?? 512 * 1024 * 1024);
+    const maxFiles = options.maxFiles ?? 2e4;
+    const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+    const files = options.gitTrackedAndUnignored ? await gitSourceFiles(sourceDir, maxFiles, maxBytes) : await sourceFiles(sourceDir, maxFiles, maxBytes);
     await Promise.all([copyTree(files, baselineDir), copyTree(files, workspaceDir)]);
     return {
       root,
@@ -2172,15 +2360,49 @@ async function stageWorkspace(source, options = {}) {
       workspaceDir,
       fileCount: files.length,
       byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
-      patch: (maxBytes) => captureGitDiff(root, maxBytes),
-      cleanup: () => rm(root, { recursive: true, force: true })
+      patch: (maxBytes2) => captureGitDiff(root, maxBytes2),
+      cleanup: () => rm2(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await rm(root, { recursive: true, force: true });
+    await rm2(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+async function stageWorkspacePair(baselineSource, workspaceSource, options = {}) {
+  const baselineDirSource = await realpath2(resolve22(baselineSource));
+  const workspaceDirSource = await realpath2(resolve22(workspaceSource));
+  const maxFiles = options.maxFiles ?? 2e4;
+  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+  const [baselineFiles, workspaceFiles] = await Promise.all([
+    sourceFiles(baselineDirSource, maxFiles, maxBytes),
+    sourceFiles(workspaceDirSource, maxFiles, maxBytes)
+  ]);
+  const root = await mkdtemp2(join3(options.tempRoot ?? tmpdir2(), "odla-harness-"));
+  const baselineDir = join3(root, "baseline");
+  const workspaceDir = join3(root, "workspace");
+  await Promise.all([mkdir2(baselineDir), mkdir2(workspaceDir)]);
+  try {
+    await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);
+    return {
+      root,
+      baselineDir,
+      workspaceDir,
+      fileCount: workspaceFiles.length,
+      byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),
+      patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),
+      cleanup: () => rm2(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await rm2(root, { recursive: true, force: true });
     throw error;
   }
 }
 
+// ../harness/dist/chunk-4EM6NMET.js
+import { createHash } from "crypto";
+import { readFile, readdir as readdir2 } from "fs/promises";
+import { relative as relative3, resolve as resolve4 } from "path";
+
 // ../camel/dist/chunk-7FHPOQVP.js
 var CamelError = class extends Error {
   code;
@@ -2199,8 +2421,8 @@ function canonicalJson(value) {
 }
 async function sha256Hex(value) {
   const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
-  const digest2 = await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes).buffer);
-  return [...new Uint8Array(digest2)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const digest = await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes).buffer);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 function utf8Length(value) {
   if (typeof value === "string") return new TextEncoder().encode(value).byteLength;
@@ -2477,8 +2699,8 @@ function freeze(value) {
     })
   });
 }
-function invalid2(message3) {
-  return new CamelError("state_conflict", message3);
+function invalid2(message2) {
+  return new CamelError("state_conflict", message2);
 }
 var SHA4 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
 var REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -2513,23 +2735,20 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-RVUUURK2.js
-import { spawn as spawn3 } from "child_process";
-import { lstat } from "fs/promises";
-import { resolve as resolve4, sep } from "path";
+// ../harness/dist/chunk-4EM6NMET.js
+import { spawn as spawn4 } from "child_process";
+import { lstat as lstat2 } from "fs/promises";
+import { resolve as resolve23, sep as sep3 } from "path";
 import { spawn as spawn23 } from "child_process";
 import { getgid as getgid2, getuid as getuid2 } from "process";
 import { randomUUID } from "crypto";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
-import { lstat as lstat2 } from "fs/promises";
-import { join as join3 } from "path";
-import { createHash } from "crypto";
-import { readFile, readdir as readdir2 } from "fs/promises";
-import { relative as relative3, resolve as resolve22 } from "path";
-import { mkdir as mkdir2, mkdtemp as mkdtemp2, rm as rm2, writeFile } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname4, join as join23, resolve as resolve32, sep as sep2 } from "path";
+import { lstat as lstat22 } from "fs/promises";
+import { join as join4 } from "path";
+import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile2 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname4, join as join23, resolve as resolve32, sep as sep22 } from "path";
 import { readFile as readFile2, readdir as readdir22, stat as stat2 } from "fs/promises";
 import { relative as relative22, resolve as resolve42 } from "path";
 
@@ -2809,8 +3028,34 @@ function looksLikeDestination(value) {
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
 }
 
-// ../harness/dist/chunk-RVUUURK2.js
+// ../harness/dist/chunk-4EM6NMET.js
 import { createHash as createHash3 } from "crypto";
+async function digestStagedWorkspace(root, limits) {
+  const files = [];
+  const walk = async (directory) => {
+    const entries = await readdir2(directory, { withFileTypes: true });
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+      if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
+      const target = resolve4(directory, entry.name);
+      if (entry.isDirectory()) await walk(target);
+      else if (entry.isFile()) {
+        files.push({ path: relative3(root, target).split("\\").join("/"), target });
+        if (files.length > limits.maxFiles) throw new TypeError("workspace digest exceeds its file bound");
+      }
+    }
+  };
+  await walk(resolve4(root));
+  const hash = createHash("sha256");
+  let bytes = 0;
+  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
+    const content = await readFile(file.target);
+    bytes += Buffer.byteLength(file.path) + content.byteLength;
+    if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
+    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);
+    hash.update(content);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
 var CODE_RUNTIME_PROTOCOL_VERSION = 1;
 async function runCodeRuntimeHeartbeatLoop(options) {
   const heartbeatMs = options.heartbeatMs ?? 15e3;
@@ -2882,8 +3127,8 @@ function wait(ms, signal) {
   });
 }
 var CodeRuntimeControlError = class extends Error {
-  constructor(message3, status, code = "control_error") {
-    super(message3);
+  constructor(message2, status, code = "control_error") {
+    super(message2);
     this.status = status;
     this.code = code;
   }
@@ -2962,9 +3207,9 @@ function createCodeRuntimeControlClient(options) {
       }
       await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
     },
-    reportSessionFailure: async (sessionId, message3) => {
-      if (!message3.trim() || message3.length > 2e3) throw new TypeError("invalid Code session failure");
-      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message3 });
+    reportSessionFailure: async (sessionId, message2) => {
+      if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
     }
   };
 }
@@ -3031,10 +3276,28 @@ async function parseSource(value) {
     if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
     return { path: file.path, content: file.content };
   });
+  const referencesValue = snapshot.references === void 0 ? [] : snapshot.references;
+  if (!Array.isArray(referencesValue) || referencesValue.length > 5) throw invalid("reference sources");
+  const aliases = /* @__PURE__ */ new Set();
+  const references = [];
+  for (const item of referencesValue) {
+    const reference = record3(item);
+    if (!reference || typeof reference.alias !== "string" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias) || aliases.has(reference.alias) || reference.alias === "primary" || typeof reference.repository !== "string" || typeof reference.commitSha !== "string" || typeof reference.treeDigest !== "string" || !Array.isArray(reference.files)) throw invalid("reference source");
+    aliases.add(reference.alias);
+    const referenceFiles = reference.files.map((entry) => {
+      const file = record3(entry);
+      if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("reference source file");
+      return { path: file.path, content: file.content };
+    });
+    const source2 = { repository: reference.repository, commitSha: reference.commitSha, files: referenceFiles };
+    const referenceDigest = await digestCodeRepositorySnapshot(source2, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+    if (referenceDigest !== reference.treeDigest) throw invalid("reference source digest");
+    references.push({ alias: reference.alias, ...source2, treeDigest: referenceDigest });
+  }
   const source = { repository: snapshot.repository, commitSha: snapshot.commitSha, files };
-  const digest2 = await digestCodeRepositorySnapshot(source, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
-  if (digest2 !== snapshot.treeDigest) throw invalid("source digest");
-  return { ...source, treeDigest: digest2 };
+  const digest = await digestCodeRepositorySnapshot(source, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+  if (digest !== snapshot.treeDigest) throw invalid("source digest");
+  return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
 }
 function parseReview(value) {
   const review = record3(record3(value)?.review);
@@ -3093,9 +3356,9 @@ function validateRelativePath(path) {
 }
 function resolveCodePath(workspaceDir, path) {
   validateRelativePath(path);
-  const root = resolve4(workspaceDir);
-  const target = resolve4(root, path);
-  if (target !== root && !target.startsWith(`${root}${sep}`)) throw new TypeError("path escapes the staged workspace");
+  const root = resolve23(workspaceDir);
+  const target = resolve23(root, path);
+  if (target !== root && !target.startsWith(`${root}${sep3}`)) throw new TypeError("path escapes the staged workspace");
   return target;
 }
 async function applyCodePatch(workspaceDir, patch2, paths) {
@@ -3103,7 +3366,7 @@ async function applyCodePatch(workspaceDir, patch2, paths) {
   await gitApply(workspaceDir, patch2, false);
   for (const path of paths) {
     try {
-      const info = await lstat(resolveCodePath(workspaceDir, path));
+      const info = await lstat2(resolveCodePath(workspaceDir, path));
       if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
         throw new TypeError("patch created a non-regular workspace entry");
       }
@@ -3115,7 +3378,7 @@ async function applyCodePatch(workspaceDir, patch2, paths) {
 function gitApply(cwd, patch2, check) {
   return new Promise((accept, reject) => {
     const args = ["apply", "--recount", "--whitespace=nowarn", ...check ? ["--check"] : [], "-"];
-    const child = spawn3("git", args, {
+    const child = spawn4("git", args, {
       cwd,
       shell: false,
       stdio: ["pipe", "ignore", "pipe"],
@@ -3285,32 +3548,6 @@ function execute(engine, args, name, recipe2, signal) {
     });
   });
 }
-async function digestStagedWorkspace(root, limits) {
-  const files = [];
-  const walk = async (directory) => {
-    const entries = await readdir2(directory, { withFileTypes: true });
-    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-      if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
-      const target = resolve22(directory, entry.name);
-      if (entry.isDirectory()) await walk(target);
-      else if (entry.isFile()) {
-        files.push({ path: relative3(root, target).split("\\").join("/"), target });
-        if (files.length > limits.maxFiles) throw new TypeError("workspace digest exceeds its file bound");
-      }
-    }
-  };
-  await walk(resolve22(root));
-  const hash = createHash("sha256");
-  let bytes = 0;
-  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
-    const content = await readFile(file.target);
-    bytes += Buffer.byteLength(file.path) + content.byteLength;
-    if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
-    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);
-    hash.update(content);
-  }
-  return `sha256:${hash.digest("hex")}`;
-}
 var SHA3 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
 var DIGEST3 = /^sha256:[0-9a-f]{64}$/;
 var ID3 = /^[A-Za-z0-9._:-]{1,160}$/;
@@ -3419,8 +3656,8 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join3(workspaceDir, artifact.path);
-      const info = await lstat2(path);
+      const path = join4(workspaceDir, artifact.path);
+      const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
       } else if (info.size > artifact.maximumBytes) {
@@ -3516,8 +3753,8 @@ async function prepareRuntimeCheckpoint(input) {
         policy: {
           policyId: "code.runtime",
           recipes: input.recipes,
-          maximumFiles: 1e4,
-          maximumBytes: 16 * 1024 * 1024
+          maximumFiles: 2e4,
+          maximumBytes: 512 * 1024 * 1024
         },
         recipeExecutor: input.recipeExecutor
       });
@@ -3591,7 +3828,7 @@ var CodeRuntimeCheckpointManager = class {
     await this.options.event(command, {
       type: "message",
       actor: "system",
-      body: `Candidate ${candidate.candidateId} is ready for exact owner publication approval`
+      body: command.payload.sourceSet ? `Candidate ${candidate.candidateId} was verified and delivered to the session PR branch` : `Candidate ${candidate.candidateId} is ready for legacy owner publication approval`
     }, pending.refs);
     this.#pending.delete(command.commandId);
     return true;
@@ -3599,11 +3836,11 @@ var CodeRuntimeCheckpointManager = class {
 };
 var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
 var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
-async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir2()) {
+async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
   if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
-  const root = await mkdtemp2(join23(tempRoot, "odla-code-source-"));
+  const root = await mkdtemp3(join23(tempRoot, "odla-code-source-"));
   const sourceDir = join23(root, "source");
-  await mkdir2(sourceDir);
+  await mkdir3(sourceDir);
   const seen = /* @__PURE__ */ new Set();
   let bytes = 0;
   try {
@@ -3614,16 +3851,55 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir2()) {
       bytes += Buffer.byteLength(file.path) + Buffer.byteLength(file.content);
       if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
       const target = resolve32(sourceDir, file.path);
-      if (!target.startsWith(`${resolve32(sourceDir)}${sep2}`)) throw new TypeError("Code source path escapes its root");
-      await mkdir2(dirname4(target), { recursive: true });
-      await writeFile(target, file.content, { flag: "wx", mode: 420 });
+      if (!target.startsWith(`${resolve32(sourceDir)}${sep22}`)) throw new TypeError("Code source path escapes its root");
+      await mkdir3(dirname4(target), { recursive: true });
+      await writeFile2(target, file.content, { flag: "wx", mode: 420 });
+    }
+    for (const reference of snapshot.references ?? []) {
+      validateAlias(reference.alias);
+      if (!reference.files.length || reference.files.length > 1e4) throw new TypeError("Code reference file count is invalid");
+      for (const file of reference.files) {
+        validatePath(file.path);
+        const path = `.odla-references/${reference.alias}/${file.path}`;
+        if (seen.has(path)) throw new TypeError("Code reference repeats a path");
+        seen.add(path);
+        bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
+        if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
+        const target = resolve32(sourceDir, path);
+        if (!target.startsWith(`${resolve32(sourceDir)}${sep22}`)) throw new TypeError("Code reference path escapes its root");
+        await mkdir3(dirname4(target), { recursive: true });
+        await writeFile2(target, file.content, { flag: "wx", mode: 292 });
+      }
     }
-    return { sourceDir, cleanup: () => rm2(root, { recursive: true, force: true }) };
+    return { sourceDir, cleanup: () => rm3(root, { recursive: true, force: true }) };
   } catch (cause) {
-    await rm2(root, { recursive: true, force: true });
+    await rm3(root, { recursive: true, force: true });
     throw cause;
   }
 }
+function validateAlias(alias) {
+  if (!/^[a-z][a-z0-9-]{0,39}$/.test(alias) || alias === "primary") {
+    throw new TypeError("Code reference alias is invalid");
+  }
+}
+async function attachCodeRuntimeReferences(workspace, references) {
+  let bytes = 0;
+  for (const reference of references) {
+    validateAlias(reference.alias);
+    for (const file of reference.files) {
+      validatePath(file.path);
+      const path = `.odla-references/${reference.alias}/${file.path}`;
+      bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
+      if (bytes > 64 * 1024 * 1024) throw new TypeError("Code reference set exceeds its byte bound");
+      for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
+        const target = resolve32(root, path);
+        if (!target.startsWith(`${resolve32(root)}${sep22}`)) throw new TypeError("Code reference path escapes its root");
+        await mkdir3(dirname4(target), { recursive: true });
+        await writeFile2(target, file.content, { flag: "wx", mode: 292 });
+      }
+    }
+  }
+}
 function validatePath(path) {
   const parts = path.split("/");
   if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || parts.some((part) => !part || part === "." || part === ".." || RESERVED2.has(part) || SECRET2.test(part))) {
@@ -3726,15 +4002,15 @@ async function environment(input, options, tool) {
     { id: "authority", value: `lease:${input.lease.leaseId}`, readers: input.readers },
     { id: "reader", value: options.readerId, readers: input.readers }
   ]);
-  const digest2 = await destinationRegistryDigest([input.workspaceId]);
+  const digest = await destinationRegistryDigest([input.workspaceId]);
   const approvals = ["irreversible_mutation", "external_send", "financial", "secret_read"];
   if (options.recipeAuthorization === "exact_approval") approvals.push("code_execution");
   const policy = createEffectPolicy({
-    destinationRegistries: { [DESTINATIONS]: { digest: digest2, values: [input.workspaceId] } },
+    destinationRegistries: { [DESTINATIONS]: { digest, values: [input.workspaceId] } },
     approvalEffects: approvals
   });
   const fixedArgs = {
-    workspace: { role: "destination", value: ingress.control("workspace"), registryId: DESTINATIONS, registryDigest: digest2 },
+    workspace: { role: "destination", value: ingress.control("workspace"), registryId: DESTINATIONS, registryDigest: digest },
     authority: { role: "authority", value: ingress.control("authority") }
   };
   return { ingress, policy, fixedArgs, reader: ingress.control("reader"), runId: `${input.request.requestId}:${tool}` };
@@ -3822,6 +4098,9 @@ async function patch(context, request, options, policy) {
   exactKeys(request.input, ["patch"]);
   const value = stringField(request.input, "patch");
   const paths = validateCodePatch(value, options.maxPatchBytes ?? 256 * 1024);
+  if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
+    throw new TypeError("patch targets a read-only reference source");
+  }
   const allowed = await policy.patch(policyContext(context, request, options, { patch: value }));
   if (!allowed) return response(request, false, "tool denied by CaMeL policy");
   await applyCodePatch(context.workspaceDir, value, paths);
@@ -3907,6 +4186,9 @@ function validateOptions(options) {
     throw new TypeError("Code tool broker requires a reader and unique registered recipes");
   }
   for (const recipe2 of options.recipes) assertCodeBuildRecipe(recipe2);
+  if (options.readOnlyPrefixes?.some((prefix) => !/^[A-Za-z0-9_.-]+$/.test(prefix) || prefix === "." || prefix === "..")) {
+    throw new TypeError("Code tool broker read-only prefix is invalid");
+  }
 }
 function exactKeys(input, allowed) {
   if (Object.keys(input).some((key) => !allowed.includes(key))) throw new TypeError("tool input contains an unsupported field");
@@ -3934,14 +4216,31 @@ function codeCommandMetadata(payload, resume) {
   }
   const planning = trusted?.planningInputDigest;
   const attestation = trusted?.attestationDigest;
+  const repository = trusted?.repository;
+  const baseCommitSha = trusted?.commitSha;
+  const sourceTreeDigest = trusted?.treeDigest;
+  if (typeof repository !== "string" || !repository.includes("/") || typeof baseCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(baseCommitSha) || typeof sourceTreeDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(sourceTreeDigest)) {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} trusted base`);
+  }
   return {
     role,
     title,
     prompt,
     planningInputDigest: typeof planning === "string" && /^sha256:[0-9a-f]{64}$/.test(planning) ? planning : null,
-    attestationDigest: typeof attestation === "string" ? attestation : "resume"
+    attestationDigest: typeof attestation === "string" ? attestation : "resume",
+    repository,
+    baseCommitSha,
+    sourceTreeDigest
   };
 }
+function codeLocalSource(payload) {
+  const source = record22(payload.source);
+  if (!source) return null;
+  if (source.kind !== "local_checkout" || typeof source.repository !== "string" || typeof source.headCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(source.headCommitSha) || typeof source.trustedBaseDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.trustedBaseDigest) || typeof source.developerPatchDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.developerPatchDigest) || typeof source.snapshotDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.snapshotDigest) || typeof source.modified !== "boolean" || !Number.isSafeInteger(source.fileCount) || Number(source.fileCount) < 1 || Number(source.fileCount) > 2e4 || !Number.isSafeInteger(source.byteCount) || Number(source.byteCount) < 1 || Number(source.byteCount) > 512 * 1024 * 1024 || !Number.isSafeInteger(source.capturedAt) || Number(source.capturedAt) < 1) {
+    throw new TypeError("invalid local checkout source descriptor");
+  }
+  return source;
+}
 function codeCheckpointPayload(payload) {
   const value = payload.checkpoint;
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("resume checkpoint is missing");
@@ -3970,11 +4269,63 @@ function fakeCodeLease(command, metadata2) {
   };
 }
 var record22 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var SOURCE_LIMITS = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
+async function prepareRuntimeLocalSource(input) {
+  const { command, descriptor: descriptor2, available, repository, baseCommitSha, resume } = input;
+  if (!available || JSON.stringify(available.descriptor) !== JSON.stringify(descriptor2) || descriptor2.repository.toLowerCase() !== repository.toLowerCase() || descriptor2.headCommitSha !== baseCommitSha) {
+    throw new TypeError("the session's local checkout snapshot is not available on this terminal");
+  }
+  const workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+    trustedBaseDir: available.trustedBaseDir,
+    trustedBaseCommitSha: baseCommitSha,
+    checkpoint: codeCheckpointPayload(command.payload)
+  })).workspace : await stageWorkspacePair(available.trustedBaseDir, available.sourceDir, SOURCE_LIMITS);
+  const trustedBaseDigest = await digestStagedWorkspace(workspace.baselineDir, SOURCE_LIMITS);
+  if (trustedBaseDigest !== descriptor2.trustedBaseDigest) {
+    await workspace.cleanup();
+    throw new TypeError("trusted Git base digest changed after connection");
+  }
+  if (!resume && await digestStagedWorkspace(workspace.workspaceDir, SOURCE_LIMITS) !== descriptor2.snapshotDigest) {
+    await workspace.cleanup();
+    throw new TypeError("local checkout snapshot digest changed after connection");
+  }
+  return { workspace, sourceDigest: descriptor2.snapshotDigest, trustedBaseDigest };
+}
+function createCodeRuntimeToolBroker(input, lease, role) {
+  const broker = createCodeToolBroker({
+    recipes: input.recipes,
+    recipeExecutor: createContainerRecipeExecutor(input.engine),
+    recipeAuthorization: input.recipeAuthorization ?? "registered_recipe",
+    readerId: `code-session:${lease.task.taskId}`,
+    readOnlyPrefixes: [".odla-references"]
+  });
+  return role === "coding" ? broker : { execute: (context, request) => request.tool === "sandbox.read" ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
+}
+async function appendCodeRuntimeEvent(control, command, event, refs) {
+  const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
+  refs.push(eventId);
+  const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
+  await control.appendSessionEvent(command.sessionId, eventId, bounded);
+}
+var digestRuntimeValue = (value) => `sha256:${createHash3("sha256").update(value).digest("hex")}`;
+var runtimeErrorMessage = (value) => value instanceof Error ? value.message : String(value);
+var runtimeRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var safeRuntimeJson = (value) => {
+  try {
+    return JSON.stringify(value).slice(0, 1e4);
+  } catch {
+    return "[event]";
+  }
+};
+function runtimeResultText(value) {
+  const record32 = runtimeRecord(value);
+  return record32 && typeof record32.text === "string" ? record32.text.slice(0, 2e4) : null;
+}
 var CodePiRuntimeEngine = class {
   constructor(options) {
     this.options = options;
     this.#run = options.runAttempt ?? runContainerAttempt;
-    this.#buildPolicyDigest = digest(JSON.stringify(options.recipes));
+    this.#buildPolicyDigest = digestRuntimeValue(JSON.stringify(options.recipes));
     this.#checkpoints = new CodeRuntimeCheckpointManager({
       control: options.control,
       recipes: options.recipes,
@@ -4009,19 +4360,43 @@ var CodePiRuntimeEngine = class {
   }
   async #start(command, resume) {
     if (this.#active.has(command.sessionId)) throw new TypeError("Code session is already active on this runtime");
-    const source = await this.options.control.source(command.sessionId);
-    const materialized = await materializeCodeRuntimeSource(source);
+    const metadata2 = codeCommandMetadata(command.payload, resume);
+    const requestedLocal = codeLocalSource(command.payload);
     let workspace;
-    try {
-      workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
-        trustedBaseDir: materialized.sourceDir,
-        trustedBaseCommitSha: source.commitSha,
-        checkpoint: codeCheckpointPayload(command.payload)
-      })).workspace : await stageWorkspace(materialized.sourceDir);
-    } finally {
-      await materialized.cleanup();
+    let sourceDigest;
+    let localTrustedBaseDigest;
+    if (requestedLocal) {
+      const prepared = await prepareRuntimeLocalSource({
+        command,
+        descriptor: requestedLocal,
+        available: this.options.localSource,
+        repository: metadata2.repository,
+        baseCommitSha: metadata2.baseCommitSha,
+        resume
+      });
+      ({ workspace, sourceDigest, trustedBaseDigest: localTrustedBaseDigest } = prepared);
+      if (command.payload.sourceSet) {
+        const selected = await this.options.control.source(command.sessionId);
+        if (selected.repository !== metadata2.repository || selected.commitSha !== metadata2.baseCommitSha || selected.treeDigest !== metadata2.sourceTreeDigest) {
+          await workspace.cleanup();
+          throw new TypeError("Code local source does not match the selected GitHub primary source");
+        }
+        await attachCodeRuntimeReferences(workspace, selected.references ?? []);
+      }
+    } else {
+      const source = await this.options.control.source(command.sessionId);
+      const materialized = await materializeCodeRuntimeSource(source);
+      try {
+        workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+          trustedBaseDir: materialized.sourceDir,
+          trustedBaseCommitSha: source.commitSha,
+          checkpoint: codeCheckpointPayload(command.payload)
+        })).workspace : await stageWorkspace(materialized.sourceDir);
+      } finally {
+        await materialized.cleanup();
+      }
+      sourceDigest = source.treeDigest;
     }
-    const metadata2 = codeCommandMetadata(command.payload, resume);
     const abort = new AbortController();
     const conversationRefs = [];
     const active = {
@@ -4031,21 +4406,30 @@ var CodePiRuntimeEngine = class {
       acknowledged: false,
       role: metadata2.role,
       title: metadata2.title,
-      baseCommitSha: source.commitSha,
-      trustedBaseDigest: await digestStagedWorkspace(workspace.baselineDir, {
-        maxFiles: 1e4,
-        maxBytes: 16 * 1024 * 1024
+      baseCommitSha: metadata2.baseCommitSha,
+      repository: metadata2.repository,
+      sourceTreeDigest: metadata2.sourceTreeDigest,
+      trustedBaseDigest: requestedLocal ? localTrustedBaseDigest : await digestStagedWorkspace(workspace.baselineDir, {
+        maxFiles: 2e4,
+        maxBytes: 512 * 1024 * 1024
       }),
-      planningInputDigest: metadata2.planningInputDigest ?? digest(
-        JSON.stringify({ attestation: metadata2.attestationDigest, prompt: metadata2.prompt, tree: source.treeDigest })
+      planningInputDigest: metadata2.planningInputDigest ?? digestRuntimeValue(
+        JSON.stringify({ attestation: metadata2.attestationDigest, prompt: metadata2.prompt, tree: sourceDigest })
       ),
       done: Promise.resolve(null)
     };
     this.#active.set(command.sessionId, active);
+    if (requestedLocal) {
+      await this.#event(command, {
+        type: "message",
+        actor: "system",
+        body: `Source snapshot: local checkout ${requestedLocal.snapshotDigest} \xB7 ${requestedLocal.modified ? "modified" : "clean"} \xB7 Git ${requestedLocal.headCommitSha}`
+      }, conversationRefs);
+    }
     active.done = this.#runAttempt(command, metadata2, active).catch(async (cause) => {
-      await this.#event(command, { type: "message", actor: "system", body: `Pi failed: ${message2(cause)}` }, conversationRefs).catch(() => void 0);
+      await this.#event(command, { type: "message", actor: "system", body: `Pi failed: ${runtimeErrorMessage(cause)}` }, conversationRefs).catch(() => void 0);
       await this.#event(command, { type: "status", status: "failed" }, conversationRefs).catch(() => void 0);
-      await this.#failure(command, active, message2(cause));
+      await this.#failure(command, active, runtimeErrorMessage(cause));
       return null;
     });
     return { status: "running", message: resume ? "Pi resumed from a portable checkpoint" : "Pi started" };
@@ -4065,22 +4449,29 @@ var CodePiRuntimeEngine = class {
       title: active.title,
       prompt,
       planningInputDigest: active.planningInputDigest,
-      attestationDigest: "follow-up"
+      attestationDigest: "follow-up",
+      repository: active.repository,
+      baseCommitSha: active.baseCommitSha,
+      sourceTreeDigest: active.sourceTreeDigest
     }, active).catch(async (cause) => {
       await this.#event(
         command,
-        { type: "message", actor: "system", body: `Pi failed: ${message2(cause)}` },
+        { type: "message", actor: "system", body: `Pi failed: ${runtimeErrorMessage(cause)}` },
         active.conversationRefs
       ).catch(() => void 0);
       await this.#event(command, { type: "status", status: "failed" }, active.conversationRefs).catch(() => void 0);
-      await this.#failure(command, active, message2(cause));
+      await this.#failure(command, active, runtimeErrorMessage(cause));
       return null;
     });
     return { status: "running", message: "Pi accepted the owner prompt" };
   }
   async #runAttempt(command, metadata2, active) {
     const lease = fakeCodeLease(command, metadata2);
-    const broker = this.#toolBroker(lease, metadata2.role);
+    const broker = createCodeRuntimeToolBroker({
+      recipes: this.options.recipes,
+      engine: this.options.engine,
+      recipeAuthorization: this.options.recipeAuthorization
+    }, lease, metadata2.role);
     const startedAt = Date.now();
     let completionSeen = false;
     const result = await this.#run({
@@ -4140,7 +4531,7 @@ var CodePiRuntimeEngine = class {
           return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "tool.response", ...response2 };
         }
         if (output.type === "event") {
-          const payload = object2(output.payload);
+          const payload = runtimeRecord(output.payload);
           if (output.kind === "pi.started") {
             await this.#event(command, { type: "status", status: "running" }, active.conversationRefs);
           } else if (output.kind === "pi.thinking" && payload?.available === true && Number.isSafeInteger(payload.durationMs) && Number(payload.durationMs) >= 0) {
@@ -4153,12 +4544,12 @@ var CodePiRuntimeEngine = class {
             await this.#event(command, {
               type: "message",
               actor: "system",
-              body: `${output.kind}${output.payload === void 0 ? "" : ` ${json(output.payload)}`}`
+              body: `${output.kind}${output.payload === void 0 ? "" : ` ${safeRuntimeJson(output.payload)}`}`
             }, active.conversationRefs);
           }
         } else if (output.type === "attempt.complete") {
           completionSeen = true;
-          const body = resultText(output.result) ?? `Pi ${output.status}.`;
+          const body = runtimeResultText(output.result) ?? `Pi ${output.status}.`;
           await this.#event(command, {
             type: "message",
             actor: output.status === "completed" ? "agent" : "system",
@@ -4185,15 +4576,6 @@ var CodePiRuntimeEngine = class {
     }
     return result;
   }
-  #toolBroker(lease, role) {
-    const broker = createCodeToolBroker({
-      recipes: this.options.recipes,
-      recipeExecutor: createContainerRecipeExecutor(this.options.engine),
-      recipeAuthorization: this.options.recipeAuthorization ?? "registered_recipe",
-      readerId: `code-session:${lease.task.taskId}`
-    });
-    return role === "coding" ? broker : { execute: (context, request) => request.tool === "sandbox.read" ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
-  }
   async #checkpoint(command) {
     const active = this.#active.get(command.sessionId);
     if (!active) throw new TypeError("Code session workspace is not active on this runtime");
@@ -4208,26 +4590,9 @@ var CodePiRuntimeEngine = class {
     }
   }
   async #event(command, event, refs) {
-    const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
-    refs.push(eventId);
-    const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
-    await this.options.control.appendSessionEvent(command.sessionId, eventId, bounded);
-  }
-};
-var object2 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
-var digest = (value) => `sha256:${createHash3("sha256").update(value).digest("hex")}`;
-var message2 = (value) => value instanceof Error ? value.message : String(value);
-var json = (value) => {
-  try {
-    return JSON.stringify(value).slice(0, 1e4);
-  } catch {
-    return "[event]";
+    await appendCodeRuntimeEvent(this.options.control, command, event, refs);
   }
 };
-function resultText(value) {
-  const record32 = object2(value);
-  return record32 && typeof record32.text === "string" ? record32.text.slice(0, 2e4) : null;
-}
 
 // src/help.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -4345,24 +4710,90 @@ Safety:
 `);
 }
 
+// src/code-local-source.ts
+import { execFile as execFile3 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+var SOURCE_LIMITS2 = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
+async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
+  const headCommitSha = await readHead(cwd);
+  const staged = await stageWorkspace(cwd, { ...SOURCE_LIMITS2, gitTrackedAndUnignored: true });
+  let trusted;
+  try {
+    trusted = await materializeGitTree(cwd, headCommitSha, SOURCE_LIMITS2);
+    const comparison = await stageWorkspacePair(trusted.sourceDir, staged.baselineDir, SOURCE_LIMITS2);
+    let developerPatch;
+    try {
+      developerPatch = await comparison.patch(4 * 1024 * 1024);
+    } finally {
+      await comparison.cleanup();
+    }
+    const descriptor2 = {
+      kind: "local_checkout",
+      repository,
+      headCommitSha,
+      trustedBaseDigest: await digestStagedWorkspace(trusted.sourceDir, SOURCE_LIMITS2),
+      developerPatchDigest: digestText(developerPatch),
+      snapshotDigest: await digestStagedWorkspace(staged.baselineDir, SOURCE_LIMITS2),
+      modified: developerPatch.length > 0,
+      fileCount: staged.fileCount,
+      byteCount: staged.byteCount,
+      capturedAt: Date.now()
+    };
+    return {
+      descriptor: descriptor2,
+      trustedBaseDir: trusted.sourceDir,
+      sourceDir: staged.baselineDir,
+      cleanup: async () => {
+        await Promise.all([staged.cleanup(), trusted.cleanup()]);
+      }
+    };
+  } catch (error) {
+    await Promise.all([staged.cleanup(), trusted?.cleanup()]);
+    throw error;
+  }
+}
+async function readGitHead(cwd) {
+  const value = await new Promise((accept, reject) => {
+    execFile3("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", maxBuffer: 16384 }, (error, stdout) => {
+      if (error) reject(new Error("code connect requires a Git checkout with an initial commit"));
+      else accept(stdout.trim());
+    });
+  });
+  if (!/^[0-9a-f]{40}$/.test(value)) throw new Error("code connect could not resolve the checkout HEAD commit");
+  return value;
+}
+function digestText(value) {
+  return `sha256:${createHash4("sha256").update(value).digest("hex")}`;
+}
+
+// src/code-images.ts
+import { execFile as execFile4 } from "child_process";
+async function prepareCodeImages(engine, images) {
+  for (const image of images) {
+    await new Promise((accept, reject) => {
+      const args = engine === "container" ? ["image", "pull", image] : ["pull", image];
+      execFile4(engine, args, { encoding: "utf8", maxBuffer: 2 * 1024 * 1024, timeout: 10 * 6e4 }, (error) => {
+        if (error) reject(new Error(`could not prepare pinned Code image ${image}`));
+        else accept();
+      });
+    });
+  }
+}
+
 // src/code-connect.ts
-var CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:713db58428bc05cb486167c5747de8fd826669c9b283ff78e0139ac194c3d058";
-var CODE_BUILD_RECIPES = Object.freeze([{
-  id: "node-test",
-  image: "node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd",
-  command: ["node", "--test"],
-  timeoutMs: 12e4,
-  maxOutputBytes: 1024 * 1024,
-  cpus: 1,
-  memory: "512m",
-  pids: 128
-}]);
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = resolve5(cwd, options.configPath);
   const cfg = existsSync4(configPath) ? await loadProjectConfig(configPath) : null;
-  const repository = cfg ? null : await inferGitHubRepository(cwd, options.readGitOrigin);
-  const platform = cfg?.platformUrl ?? process.env.ODLA_PLATFORM_URL ?? "https://odla.ai";
+  const requestedAppId = options.appId?.trim();
+  if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
+    throw new Error("--app-id must be a valid odla app id");
+  }
+  if (requestedAppId && cfg && requestedAppId !== cfg.app.id) {
+    throw new Error(`--app-id ${requestedAppId} does not match ${options.configPath} (${cfg.app.id})`);
+  }
+  const appId = requestedAppId ?? cfg?.app.id;
+  const platform = (options.platform ?? cfg?.platformUrl ?? process.env.ODLA_PLATFORM_URL ?? "https://odla.ai").replace(/\/+$/, "");
   const appEnv = options.env ?? (cfg ? cfg.envs.includes("dev") ? "dev" : cfg.envs[0] : "dev");
   if (appEnv !== "dev" && appEnv !== "prod" || cfg && !cfg.envs.includes(appEnv)) {
     throw new Error(cfg ? `Code env "${appEnv ?? ""}" must be dev or prod and declared in ${options.configPath}` : `Code env "${appEnv ?? ""}" must be dev or prod`);
@@ -4381,53 +4812,77 @@ async function codeConnect(options) {
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
   const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? "auto");
+  await (options.prepareImages ?? prepareCodeImages)(engine, [
+    CODE_PI_IMAGE,
+    ...new Set(CODE_BUILD_RECIPES.map((recipe2) => recipe2.image))
+  ]);
   const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
   const hostName = (options.name ?? hostname()).trim();
   if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
-  const approval = await (options.getToken ?? getScopedPlatformToken)({
-    platform,
-    scope: "platform:code:host:connect",
-    email: options.email,
-    open: options.open,
-    fetch: doFetch,
-    stdout: out,
-    openApprovalUrl: options.openApprovalUrl,
-    cache: false,
-    label: `odla CLI Code host for ${cfg?.app.id ?? repository}/${appEnv}`
-  });
-  const target = cfg ? { appId: cfg.app.id } : { repository };
-  const response2 = await doFetch(`${platform}/registry/code/hosts/connect`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${approval}`, "content-type": "application/json" },
-    body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),
-    redirect: "error",
-    signal: options.signal
-  });
-  const raw = await response2.json().catch(() => null);
-  if (!response2.ok) throw new Error(apiFailure("connect Code host", response2.status, raw));
-  const connection = parseConnection(raw, cfg?.app.id, appEnv);
-  const capabilities = {
-    protocolVersion: CODE_RUNTIME_PROTOCOL_VERSION,
-    platform: hostPlatform,
-    arch: process.arch,
-    engines: [engine],
-    cpuCount: cpus().length,
-    memoryBytes: totalmem()
-  };
-  out.log(`${connection.resumed ? "reconnected" : "enrolled"}: ${connection.host.name} (${connection.host.hostId})`);
-  out.log(`binding: ${connection.binding.appId}/${connection.binding.env} \xB7 ${connection.offer.slots} slot(s) \xB7 ${engine}`);
-  out.log("credentials: stored in odla-ai/db; host plaintext is memory-only");
-  await (options.runRuntime ?? runCodeRuntime)({
-    endpoint: platform,
-    token: connection.token,
-    engine,
-    capabilities,
-    heartbeatMs,
-    once: options.once === true,
-    signal: options.signal,
-    stdout: out,
-    fetch: doFetch
-  });
+  const repository = await inferGitHubRepository(cwd, options.readGitOrigin);
+  const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(
+    cwd,
+    repository,
+    options.readGitHead
+  );
+  try {
+    const descriptor2 = localSource.descriptor;
+    const approval = await (options.getToken ?? getScopedPlatformToken)({
+      platform,
+      scope: "app:code:host:connect",
+      email: options.email,
+      open: options.open,
+      fetch: doFetch,
+      stdout: out,
+      openApprovalUrl: options.openApprovalUrl,
+      cache: false,
+      label: `Terminal connection for ${appId ?? repository}/${appEnv}`
+    });
+    const target = appId ? { appId } : { repository };
+    const response2 = await doFetch(`${platform}/registry/code/hosts/connect`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${approval}`, "content-type": "application/json" },
+      body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),
+      redirect: "error",
+      signal: options.signal
+    });
+    const raw = await response2.json().catch(() => null);
+    if (!response2.ok) throw new Error(apiFailure("connect Code host", response2.status, raw));
+    const connection = parseConnection(raw, appId, appEnv);
+    const capabilities = {
+      protocolVersion: CODE_RUNTIME_PROTOCOL_VERSION,
+      platform: hostPlatform,
+      arch: process.arch,
+      engines: [engine],
+      cpuCount: cpus().length,
+      memoryBytes: totalmem(),
+      source: descriptor2,
+      images: {
+        ready: true,
+        pi: CODE_PI_IMAGE,
+        recipes: CODE_BUILD_RECIPES.map((recipe2) => ({ id: recipe2.id, image: recipe2.image }))
+      }
+    };
+    out.log(`${connection.resumed ? "reconnected" : "enrolled"}: ${connection.host.name} (${connection.host.hostId})`);
+    out.log(`binding: ${connection.binding.appId}/${connection.binding.env} \xB7 ${connection.offer.slots} slot(s) \xB7 ${engine}`);
+    out.log(`source: local checkout \xB7 ${descriptor2.headCommitSha.slice(0, 10)} \xB7 ${descriptor2.fileCount} files \xB7 staged copy`);
+    out.log("credentials: stored in odla-ai/db; host plaintext is memory-only");
+    out.log(`Studio: ${platform}/studio/apps/${encodeURIComponent(connection.binding.appId)}/${connection.binding.env}/code/sessions`);
+    await (options.runRuntime ?? runCodeRuntime)({
+      endpoint: platform,
+      token: connection.token,
+      engine,
+      capabilities,
+      localSource,
+      heartbeatMs,
+      once: options.once === true,
+      signal: options.signal,
+      stdout: out,
+      fetch: doFetch
+    });
+  } finally {
+    await localSource.cleanup();
+  }
 }
 async function runCodeRuntime(input) {
   const controller = new AbortController();
@@ -4450,7 +4905,8 @@ async function runCodeRuntime(input) {
     engine: input.engine,
     image: CODE_PI_IMAGE,
     recipes: CODE_BUILD_RECIPES,
-    recipeAuthorization: "registered_recipe"
+    recipeAuthorization: "registered_recipe",
+    localSource: input.localSource
   });
   const reconciler = new CodeRuntimeReconciler(control, commandEngine);
   try {
@@ -4491,8 +4947,8 @@ function parseConnection(value, appId, appEnv) {
   return root;
 }
 function apiFailure(action, status, value) {
-  const message3 = record4(record4(value)?.error)?.message;
-  return `${action} failed (${status})${typeof message3 === "string" ? `: ${message3}` : ""}`;
+  const message2 = record4(record4(value)?.error)?.message;
+  return `${action} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
 function record4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -4501,14 +4957,14 @@ function record4(value) {
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { join as join5, resolve as resolve6 } from "path";
+import { join as join6, resolve as resolve6 } from "path";
 
 // src/wrangler.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
-  const child = spawn4(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  const child = spawn5(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
   child.stdout.on("data", (chunk) => stdout += chunk.toString());
@@ -4520,7 +4976,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join4(rootDir, name);
+    const path = join5(rootDir, name);
     if (existsSync5(path)) return path;
   }
   return null;
@@ -4629,7 +5085,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve6(rootDir, assets.directory);
       if (dir === resolve6(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync6(join5(dir, "node_modules"))) {
+      } else if (existsSync6(join6(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4694,7 +5150,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync5(join5(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync5(join6(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -5261,8 +5717,8 @@ async function readRegistryApp(cfg, token, doFetch) {
   });
   if (res.status === 404) return null;
   if (!res.ok) return null;
-  const json2 = await res.json();
-  return json2.app ?? null;
+  const json = await res.json();
+  return json.app ?? null;
 }
 async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
@@ -5428,10 +5884,10 @@ async function provision(options) {
           stdout: out
         });
       } catch (error) {
-        const message3 = error instanceof Error ? error.message : String(error);
+        const message2 = error instanceof Error ? error.message : String(error);
         const consent = env === "prod" || env === "production" ? " --yes" : "";
         throw new Error(
-          `${message3}
+          `${message2}
 ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
           { cause: error }
         );
@@ -5547,7 +6003,7 @@ async function resolveVaultWrite(options) {
 }
 
 // src/security.ts
-import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve8, sep as sep3 } from "path";
+import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve8, sep as sep4 } from "path";
 import {
   cloudflareAppProfile,
   createPlatformSecurityReasoners,
@@ -5568,7 +6024,7 @@ async function runHostedSecurity(options) {
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
   const target = resolve8(options.target ?? cfg?.rootDir ?? ".");
   const output = resolve8(options.out ?? resolve8(target, ".odla/security/hosted"));
-  const outputRelative = relative4(target, output).split(sep3).join("/");
+  const outputRelative = relative4(target, output).split(sep4).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -5580,7 +6036,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await snapshotDirectory(target, {
-    exclude: !outputRelative.startsWith("../") && !isAbsolute3(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !isAbsolute4(outputRelative) ? [outputRelative] : []
   });
   const hosted = await createPlatformSecurityReasoners({
     platform,
@@ -5741,8 +6197,8 @@ async function startHostedSecurityJob(options) {
       "start hosted security job"
     );
   } catch (error) {
-    const message3 = error instanceof Error ? error.message : String(error);
-    if (/\b(?:plan_conflict|policy_conflict|intent_conflict|security_ai_not_ready)\b/.test(message3)) {
+    const message2 = error instanceof Error ? error.message : String(error);
+    if (/\b(?:plan_conflict|policy_conflict|intent_conflict|security_ai_not_ready)\b/.test(message2)) {
       throw new Error("Hosted security plan or execution intent changed or became unavailable after review; fetch a fresh intent and explicitly acknowledge its digest before enqueueing again", { cause: error });
     }
     throw error;
@@ -5823,7 +6279,7 @@ function securityExecutionDigest(value) {
 // src/skill.ts
 import { existsSync as existsSync8, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync6, readdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join6, relative as relative5, resolve as resolve9, sep as sep4 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute5, join as join7, relative as relative5, resolve as resolve9, sep as sep5 } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -5899,12 +6355,12 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join6(targetDir2, rel), readFileSync6(join6(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join7(targetDir2, rel), readFileSync6(join7(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join6(home, ".claude", "skills");
-    const codexRoot = resolve9(options.codexHomeDir ?? process.env.CODEX_HOME ?? join6(home, ".codex"), "skills");
+    const claudeRoot = join7(home, ".claude", "skills");
+    const codexRoot = resolve9(options.codexHomeDir ?? process.env.CODEX_HOME ?? join7(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
@@ -5912,35 +6368,35 @@ function installSkill(options = {}) {
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join6(root, ".agents", "skills");
+    const sharedRoot = join7(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join6(root, ".claude", "skills");
+    const claudeRoot = join7(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = readFileSync6(join6(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join6(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = readFileSync6(join7(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join7(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join6(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join7(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join6(root, "AGENTS.md");
+      const agentsFile = join7(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join6(root, ".github", "copilot-instructions.md");
+      const copilotFile = join7(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join6(root, "GEMINI.md");
+      const geminiFile = join7(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5996,7 +6452,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => relative5(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${sep4}`) && !isAbsolute4(path)).sort();
+  return [...paths].map((path) => relative5(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${sep5}`) && !isAbsolute5(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -6042,12 +6498,12 @@ function managedFileContent(path, block, force, boundary) {
 }
 function symlinkedComponent(boundary, target) {
   const rel = relative5(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute4(rel)) {
+  if (rel === ".." || rel.startsWith(`..${sep5}`) || isAbsolute5(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(sep4).filter(Boolean)) {
-    current = join6(current, part);
+  for (const part of rel.split(sep5).filter(Boolean)) {
+    current = join7(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -6064,7 +6520,7 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join6(current, entry.name);
+      const path = join7(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative5(dir, path));
     }
@@ -6555,6 +7011,8 @@ async function codeCommand(parsed, dependencies) {
   assertArgs(parsed, [
     "config",
     "env",
+    "platform",
+    "app-id",
     "email",
     "open",
     "name",
@@ -6570,6 +7028,8 @@ async function codeCommand(parsed, dependencies) {
   await (dependencies.codeConnect ?? codeConnect)({
     configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
     env: stringOpt(parsed.options.env),
+    platform: stringOpt(parsed.options.platform),
+    appId: stringOpt(parsed.options["app-id"]),
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     name: stringOpt(parsed.options.name),
@@ -6627,12 +7087,12 @@ async function hostedSecurityContext(parsed, dependencies) {
   );
   return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
 }
-async function interactiveConfirmation(message3, dependencies) {
-  if (dependencies.confirm) return dependencies.confirm(message3);
+async function interactiveConfirmation(message2, dependencies) {
+  if (dependencies.confirm) return dependencies.confirm(message2);
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
   const prompt = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const answer = await prompt.question(`${message3} [y/N] `);
+    const answer = await prompt.question(`${message2} [y/N] `);
     return /^y(?:es)?$/i.test(answer.trim());
   } finally {
     prompt.close();
@@ -7286,4 +7746,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-AN6KZMR5.js.map
+//# sourceMappingURL=chunk-S3OYXHDG.js.map