@odla-ai/cli 0.14.1 → 0.16.0

package/dist/index.cjs

@@ -509,12 +509,13 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   const { token, expiresAt } = await (0, import_db2.requestToken)({
     endpoint: audience,
     email,
-    label: options.label ?? `odla CLI admin AI (${scope})`,
+    label: options.label ?? `odla CLI (${scope})`,
     scopes: [scope],
     fetch: doFetch,
     onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
       const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
-      out.log(`Review, then approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      const requestName = scope === "app:code:host:connect" ? "terminal connection" : "scoped request";
+      out.log(`Review, then approve ${requestName} ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
       if (approvalBrowser({ open: options.open }).open) {
         await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
       }
@@ -576,8 +577,8 @@ async function responseBody(response2) {
 }
 function apiError(status, body) {
   const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
-  const message3 = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `read System AI admin changes failed (${status}): ${message3}`;
+  const message2 = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `read System AI admin changes failed (${status}): ${message2}`;
 }
 function timestamp(value) {
   if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
@@ -678,8 +679,8 @@ async function responseBody2(res) {
 }
 function apiError2(action, status, body) {
   const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
-  const message3 = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message3}`;
+  const message2 = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message2}`;
 }
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -859,8 +860,8 @@ async function responseBody3(res) {
 }
 function apiError3(action, status, body) {
   const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
-  const message3 = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message3}`;
+  const message2 = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message2}`;
 }
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -1540,8 +1541,8 @@ var CAPABILITIES = {
     "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
   ]
 };
-function printCapabilities(json2 = false, out = console) {
-  if (json2) {
+function printCapabilities(json = false, out = console) {
+  if (json) {
     out.log(JSON.stringify(CAPABILITIES, null, 2));
     return;
   }
@@ -1571,8 +1572,8 @@ var CalendarRequestError = class extends Error {
   status;
   /** Machine-readable `error.code` from the response body, when present. */
   code;
-  constructor(message3, status, code) {
-    super(message3);
+  constructor(message2, status, code) {
+    super(message2);
     this.name = "CalendarRequestError";
     this.status = status;
     if (code !== void 0) this.code = code;
@@ -1739,8 +1740,8 @@ async function calendarJson(ctx, suffix, init) {
   const body = await response2.json().catch(() => ({}));
   if (!response2.ok) {
     const code = textField(body.error?.code, 128);
-    const message3 = textField(body.error?.message, 500);
-    const detail = `${code ? ` ${code}` : ""}${message3 ? `: ${message3}` : ""}`;
+    const message2 = textField(body.error?.message, 500);
+    const detail = `${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`;
     throw new CalendarRequestError(redactSecrets(`calendar request failed (${response2.status})${detail}`), response2.status, code);
   }
   return body;
@@ -1976,8 +1977,8 @@ function pollTimeout(value = 10 * 6e4) {
 function productionConsent(env, yes, action) {
   if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
 }
-function printStatus(status, json2, out) {
-  if (json2) {
+function printStatus(status, json, out) {
+  if (json) {
     out.log(JSON.stringify(status, null, 2));
     return;
   }
@@ -2019,63 +2020,63 @@ function parseAgentOutput(line) {
   } catch {
     throw new HarnessProtocolError("agent emitted invalid JSON");
   }
-  const message3 = record2(value);
-  if (!message3 || message3.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
+  const message2 = record2(value);
+  if (!message2 || message2.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
     throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
   }
-  if (message3.type === "event") {
+  if (message2.type === "event") {
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "event",
-      kind: boundedText(message3.kind, "event.kind", 120),
-      ...message3.payload === void 0 ? {} : { payload: message3.payload }
+      kind: boundedText(message2.kind, "event.kind", 120),
+      ...message2.payload === void 0 ? {} : { payload: message2.payload }
     };
   }
-  if (message3.type === "inference.request") {
-    const call = record2(message3.call);
+  if (message2.type === "inference.request") {
+    const call = record2(message2.call);
     if (!call || !Array.isArray(call.messages) || !Number.isSafeInteger(call.maxTokens)) {
       throw new HarnessProtocolError("inference.request.call requires messages and maxTokens");
     }
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "inference.request",
-      requestId: boundedText(message3.requestId, "requestId", 180),
+      requestId: boundedText(message2.requestId, "requestId", 180),
       call
     };
   }
-  if (message3.type === "tool.request") {
-    const input = record2(message3.input);
-    const tool = String(message3.tool);
+  if (message2.type === "tool.request") {
+    const input = record2(message2.input);
+    const tool = String(message2.tool);
     if (!input || !["sandbox.read", "sandbox.apply_patch", "sandbox.run_recipe"].includes(tool)) {
       throw new HarnessProtocolError("tool.request requires a registered tool and object input");
     }
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "tool.request",
-      requestId: boundedText(message3.requestId, "requestId", 180),
+      requestId: boundedText(message2.requestId, "requestId", 180),
       tool,
       input
     };
   }
-  if (message3.type === "attempt.complete") {
-    if (!(/* @__PURE__ */ new Set(["completed", "failed", "cancelled"])).has(String(message3.status))) {
+  if (message2.type === "attempt.complete") {
+    if (!(/* @__PURE__ */ new Set(["completed", "failed", "cancelled"])).has(String(message2.status))) {
       throw new HarnessProtocolError("attempt.complete.status is invalid");
     }
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "attempt.complete",
-      status: message3.status,
-      ...message3.result === void 0 ? {} : { result: message3.result }
+      status: message2.status,
+      ...message2.result === void 0 ? {} : { result: message2.result }
     };
   }
   throw new HarnessProtocolError("agent message type is unsupported");
 }
-function encodeAgentInput(message3) {
-  return `${JSON.stringify(message3)}
+function encodeAgentInput(message2) {
+  return `${JSON.stringify(message2)}
 `;
 }
 
-// ../harness/dist/chunk-FNYUIJUN.js
+// ../harness/dist/chunk-TA2FKK27.js
 var import_child_process = require("child_process");
 var import_fs = require("fs");
 var import_promises2 = require("fs/promises");
@@ -2085,6 +2086,11 @@ var import_promises3 = require("fs/promises");
 var import_os = require("os");
 var import_path2 = require("path");
 var import_child_process2 = require("child_process");
+var import_path3 = require("path");
+var import_promises4 = require("fs/promises");
+var import_os2 = require("os");
+var import_path4 = require("path");
+var import_child_process3 = require("child_process");
 var DIGEST_IMAGE = /^[a-z0-9][a-z0-9._/-]*(?::[a-zA-Z0-9._-]+)?@sha256:[0-9a-f]{64}$/;
 function assertPinnedImage(image) {
   if (!DIGEST_IMAGE.test(image)) throw new TypeError("container image must be pinned by sha256 digest");
@@ -2128,7 +2134,7 @@ async function selectContainerEngine(requested = "auto", options = {}) {
   throw new TypeError("no supported container engine found");
 }
 function inspectRootlessPodman() {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve33, reject) => {
     (0, import_child_process.execFile)(
       "podman",
       ["info", "--format", "{{.Host.Security.Rootless}}"],
@@ -2138,7 +2144,7 @@ function inspectRootlessPodman() {
           reject(new TypeError("could not verify that the active Podman service is rootless"));
           return;
         }
-        resolve23(stdout.trim() === "true");
+        resolve33(stdout.trim() === "true");
       }
     );
   });
@@ -2249,9 +2255,9 @@ async function runContainerAttempt(options) {
       if (bytes.byteLength > 1e6) throw new Error("agent message exceeds 1 MB");
       const line = bytes.toString("utf8");
       if (!line.trim()) return;
-      const message3 = parseAgentOutput(line);
-      if (message3.type === "attempt.complete") complete = message3;
-      const response2 = await options.onMessage(message3);
+      const message2 = parseAgentOutput(line);
+      if (message2.type === "attempt.complete") complete = message2;
+      const response2 = await options.onMessage(message2);
       if (response2 && !child.stdin.destroyed) child.stdin.write(encodeAgentInput(response2));
     };
     try {
@@ -2299,29 +2305,142 @@ async function runContainerAttempt(options) {
     options.signal?.removeEventListener("abort", abort);
   }
 }
-var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
-var SECRET_FILE = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+var SKIP_WORKSPACE_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".odla",
+  ".wrangler",
+  "node_modules",
+  "dist",
+  "coverage"
+]);
+var SECRET_WORKSPACE_FILE = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+function allowedWorkspacePath(relativePath) {
+  const parts = relativePath.split("/");
+  return !(0, import_path3.isAbsolute)(relativePath) && !relativePath.includes("\\") && !relativePath.includes("\0") && !parts.some((part) => !part || part === "." || part === ".." || SKIP_WORKSPACE_DIRS.has(part)) && !SECRET_WORKSPACE_FILE.test(parts.at(-1) ?? "");
+}
+async function gitOutput(cwd, args, maxBytes) {
+  const child = (0, import_child_process2.spawn)("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);
+  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  return Buffer.concat(stdout);
+}
+async function gitBlobs(cwd, entries, maxBytes) {
+  const child = (0, import_child_process2.spawn)("git", ["cat-file", "--batch"], { cwd, stdio: ["pipe", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes + entries.length * 100) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  child.stdin.end(`${entries.map((entry) => entry.hash).join("\n")}
+`);
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);
+  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  const output = Buffer.concat(stdout);
+  const blobs = [];
+  let offset = 0;
+  let total = 0;
+  for (const entry of entries) {
+    const newline = output.indexOf(10, offset);
+    if (newline < 0) throw new Error("git object output is truncated");
+    const match = /^([0-9a-f]{40,64}) blob ([0-9]+)$/.exec(output.subarray(offset, newline).toString("utf8"));
+    if (!match || match[1] !== entry.hash) throw new Error("git object output does not match its inventory");
+    const length = Number(match[2]);
+    if (!Number.isSafeInteger(length) || length < 0 || newline + 1 + length >= output.length) {
+      throw new Error("git object output has an invalid length");
+    }
+    const content = output.subarray(newline + 1, newline + 1 + length);
+    if (output[newline + 1 + length] !== 10) throw new Error("git object output is malformed");
+    total += content.byteLength;
+    if (total > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+    blobs.push(content);
+    offset = newline + 1 + length + 1;
+  }
+  return blobs;
+}
+async function materializeGitTree(source, commitSha, options = {}) {
+  if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError("Git tree requires an exact commit SHA");
+  const sourceDir = await (0, import_promises3.realpath)((0, import_path2.resolve)(source));
+  const maxFiles = options.maxFiles ?? 2e4;
+  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+  const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
+  const entries = inventory.flatMap((record5) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record5);
+    return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
+  });
+  if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const root = await (0, import_promises3.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
+  const targetRoot = (0, import_path2.join)(root, "source");
+  await (0, import_promises3.mkdir)(targetRoot);
+  let byteCount = 0;
+  try {
+    const blobs = await gitBlobs(sourceDir, entries, maxBytes);
+    for (const [index, entry] of entries.entries()) {
+      const content = blobs[index];
+      byteCount += content.byteLength;
+      if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+      const target = (0, import_path2.resolve)(targetRoot, entry.path);
+      if (!target.startsWith(`${(0, import_path2.resolve)(targetRoot)}${import_path2.sep}`)) throw new TypeError("Git tree path escapes workspace");
+      await (0, import_promises3.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
+      await (0, import_promises3.writeFile)(target, content, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
+    }
+    return {
+      root,
+      sourceDir: targetRoot,
+      fileCount: entries.length,
+      byteCount,
+      cleanup: () => (0, import_promises3.rm)(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await (0, import_promises3.rm)(root, { recursive: true, force: true });
+    throw error;
+  }
+}
 async function sourceFiles(sourceDir, maxFiles, maxBytes) {
   const files = [];
   let bytes = 0;
   const walk = async (dir) => {
-    for (const entry of await (0, import_promises3.readdir)(dir, { withFileTypes: true })) {
-      if (entry.isDirectory() && SKIP_DIRS.has(entry.name)) continue;
-      if (!entry.isDirectory() && SECRET_FILE.test(entry.name)) continue;
-      const path = (0, import_path2.join)(dir, entry.name);
+    for (const entry of await (0, import_promises4.readdir)(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
+      if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;
+      const path = (0, import_path4.join)(dir, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         await walk(path);
         continue;
       }
       if (!entry.isFile()) continue;
-      const metadata2 = await (0, import_promises3.stat)(path);
+      const metadata2 = await (0, import_promises4.stat)(path);
       bytes += metadata2.size;
       if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
       if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
       files.push({
         source: path,
-        relativePath: (0, import_path2.relative)(sourceDir, path),
+        relativePath: (0, import_path4.relative)(sourceDir, path),
         mode: metadata2.mode & 511,
         bytes: metadata2.size
       });
@@ -2330,16 +2449,62 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
   await walk(sourceDir);
   return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
 }
+async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
+  const child = (0, import_child_process3.spawn)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    cwd: sourceDir,
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
+  });
+  const stdout = [];
+  const stderr = [];
+  let outputBytes = 0;
+  child.stdout.on("data", (chunk) => {
+    outputBytes += chunk.byteLength;
+    if (outputBytes > 8 * 1024 * 1024) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
+  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
+  if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const root = (0, import_path4.resolve)(sourceDir);
+  const files = [];
+  let bytes = 0;
+  for (const relativePath of paths) {
+    if (!allowedWorkspacePath(relativePath)) continue;
+    const source = (0, import_path4.resolve)(root, relativePath);
+    if (!source.startsWith(`${root}${import_path4.sep}`)) throw new TypeError("git file path escapes workspace");
+    let metadata2;
+    try {
+      metadata2 = await (0, import_promises4.lstat)(source);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    if (metadata2.isSymbolicLink() || !metadata2.isFile()) continue;
+    bytes += metadata2.size;
+    if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+    files.push({ source, relativePath, mode: metadata2.mode & 511, bytes: metadata2.size });
+  }
+  return files;
+}
 async function copyTree(files, destination) {
   for (const file of files) {
-    const target = (0, import_path2.join)(destination, file.relativePath);
-    await (0, import_promises3.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
-    await (0, import_promises3.copyFile)(file.source, target);
-    await (0, import_promises3.chmod)(target, file.mode);
+    const target = (0, import_path4.join)(destination, file.relativePath);
+    await (0, import_promises4.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
+    await (0, import_promises4.copyFile)(file.source, target);
+    await (0, import_promises4.chmod)(target, file.mode);
   }
 }
 async function captureGitDiff(root, maxBytes) {
-  const child = (0, import_child_process2.spawn)("git", [
+  const child = (0, import_child_process3.spawn)("git", [
     "diff",
     "--no-index",
     "--binary",
@@ -2372,15 +2537,17 @@ async function captureGitDiff(root, maxBytes) {
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
 async function stageWorkspace(source, options = {}) {
-  const sourceDir = await (0, import_promises3.realpath)((0, import_path2.resolve)(source));
-  const sourceStat = await (0, import_promises3.stat)(sourceDir);
+  const sourceDir = await (0, import_promises4.realpath)((0, import_path4.resolve)(source));
+  const sourceStat = await (0, import_promises4.stat)(sourceDir);
   if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
-  const root = await (0, import_promises3.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-harness-"));
-  const baselineDir = (0, import_path2.join)(root, "baseline");
-  const workspaceDir = (0, import_path2.join)(root, "workspace");
-  await Promise.all([(0, import_promises3.mkdir)(baselineDir), (0, import_promises3.mkdir)(workspaceDir)]);
+  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const baselineDir = (0, import_path4.join)(root, "baseline");
+  const workspaceDir = (0, import_path4.join)(root, "workspace");
+  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
   try {
-    const files = await sourceFiles(sourceDir, options.maxFiles ?? 2e4, options.maxBytes ?? 512 * 1024 * 1024);
+    const maxFiles = options.maxFiles ?? 2e4;
+    const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+    const files = options.gitTrackedAndUnignored ? await gitSourceFiles(sourceDir, maxFiles, maxBytes) : await sourceFiles(sourceDir, maxFiles, maxBytes);
     await Promise.all([copyTree(files, baselineDir), copyTree(files, workspaceDir)]);
     return {
       root,
@@ -2388,15 +2555,49 @@ async function stageWorkspace(source, options = {}) {
       workspaceDir,
       fileCount: files.length,
       byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
-      patch: (maxBytes) => captureGitDiff(root, maxBytes),
-      cleanup: () => (0, import_promises3.rm)(root, { recursive: true, force: true })
+      patch: (maxBytes2) => captureGitDiff(root, maxBytes2),
+      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises3.rm)(root, { recursive: true, force: true });
+    await (0, import_promises4.rm)(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+async function stageWorkspacePair(baselineSource, workspaceSource, options = {}) {
+  const baselineDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(baselineSource));
+  const workspaceDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(workspaceSource));
+  const maxFiles = options.maxFiles ?? 2e4;
+  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
+  const [baselineFiles, workspaceFiles] = await Promise.all([
+    sourceFiles(baselineDirSource, maxFiles, maxBytes),
+    sourceFiles(workspaceDirSource, maxFiles, maxBytes)
+  ]);
+  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const baselineDir = (0, import_path4.join)(root, "baseline");
+  const workspaceDir = (0, import_path4.join)(root, "workspace");
+  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
+  try {
+    await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);
+    return {
+      root,
+      baselineDir,
+      workspaceDir,
+      fileCount: workspaceFiles.length,
+      byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),
+      patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),
+      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await (0, import_promises4.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 
+// ../harness/dist/chunk-4EM6NMET.js
+var import_crypto = require("crypto");
+var import_promises5 = require("fs/promises");
+var import_path5 = require("path");
+
 // ../camel/dist/chunk-7FHPOQVP.js
 var CamelError = class extends Error {
   code;
@@ -2415,8 +2616,8 @@ function canonicalJson(value) {
 }
 async function sha256Hex(value) {
   const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
-  const digest2 = await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes).buffer);
-  return [...new Uint8Array(digest2)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const digest = await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes).buffer);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 function utf8Length(value) {
   if (typeof value === "string") return new TextEncoder().encode(value).byteLength;
@@ -2693,8 +2894,8 @@ function freeze(value) {
     })
   });
 }
-function invalid2(message3) {
-  return new CamelError("state_conflict", message3);
+function invalid2(message2) {
+  return new CamelError("state_conflict", message2);
 }
 var SHA4 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
 var REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -2729,25 +2930,22 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-RVUUURK2.js
-var import_child_process3 = require("child_process");
-var import_promises4 = require("fs/promises");
-var import_path3 = require("path");
+// ../harness/dist/chunk-4EM6NMET.js
 var import_child_process4 = require("child_process");
+var import_promises6 = require("fs/promises");
+var import_path6 = require("path");
+var import_child_process5 = require("child_process");
 var import_process2 = require("process");
-var import_crypto = require("crypto");
 var import_crypto2 = require("crypto");
-var import_fs2 = require("fs");
-var import_promises5 = require("fs/promises");
-var import_path4 = require("path");
 var import_crypto3 = require("crypto");
-var import_promises6 = require("fs/promises");
-var import_path5 = require("path");
+var import_fs2 = require("fs");
 var import_promises7 = require("fs/promises");
-var import_os2 = require("os");
-var import_path6 = require("path");
-var import_promises8 = require("fs/promises");
 var import_path7 = require("path");
+var import_promises8 = require("fs/promises");
+var import_os3 = require("os");
+var import_path8 = require("path");
+var import_promises9 = require("fs/promises");
+var import_path9 = require("path");
 
 // ../camel/dist/chunk-LAXU2AVK.js
 function conversionPolicyDigest(policy) {
@@ -3025,8 +3223,34 @@ function looksLikeDestination(value) {
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
 }
 
-// ../harness/dist/chunk-RVUUURK2.js
+// ../harness/dist/chunk-4EM6NMET.js
 var import_crypto4 = require("crypto");
+async function digestStagedWorkspace(root, limits) {
+  const files = [];
+  const walk = async (directory) => {
+    const entries = await (0, import_promises5.readdir)(directory, { withFileTypes: true });
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+      if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
+      const target = (0, import_path5.resolve)(directory, entry.name);
+      if (entry.isDirectory()) await walk(target);
+      else if (entry.isFile()) {
+        files.push({ path: (0, import_path5.relative)(root, target).split("\\").join("/"), target });
+        if (files.length > limits.maxFiles) throw new TypeError("workspace digest exceeds its file bound");
+      }
+    }
+  };
+  await walk((0, import_path5.resolve)(root));
+  const hash = (0, import_crypto.createHash)("sha256");
+  let bytes = 0;
+  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
+    const content = await (0, import_promises5.readFile)(file.target);
+    bytes += Buffer.byteLength(file.path) + content.byteLength;
+    if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
+    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);
+    hash.update(content);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
 var CODE_RUNTIME_PROTOCOL_VERSION = 1;
 async function runCodeRuntimeHeartbeatLoop(options) {
   const heartbeatMs = options.heartbeatMs ?? 15e3;
@@ -3098,8 +3322,8 @@ function wait(ms, signal) {
   });
 }
 var CodeRuntimeControlError = class extends Error {
-  constructor(message3, status, code = "control_error") {
-    super(message3);
+  constructor(message2, status, code = "control_error") {
+    super(message2);
     this.status = status;
     this.code = code;
   }
@@ -3178,9 +3402,9 @@ function createCodeRuntimeControlClient(options) {
       }
       await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
     },
-    reportSessionFailure: async (sessionId, message3) => {
-      if (!message3.trim() || message3.length > 2e3) throw new TypeError("invalid Code session failure");
-      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message3 });
+    reportSessionFailure: async (sessionId, message2) => {
+      if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
     }
   };
 }
@@ -3247,10 +3471,28 @@ async function parseSource(value) {
     if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
     return { path: file.path, content: file.content };
   });
+  const referencesValue = snapshot.references === void 0 ? [] : snapshot.references;
+  if (!Array.isArray(referencesValue) || referencesValue.length > 5) throw invalid("reference sources");
+  const aliases = /* @__PURE__ */ new Set();
+  const references = [];
+  for (const item of referencesValue) {
+    const reference = record3(item);
+    if (!reference || typeof reference.alias !== "string" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias) || aliases.has(reference.alias) || reference.alias === "primary" || typeof reference.repository !== "string" || typeof reference.commitSha !== "string" || typeof reference.treeDigest !== "string" || !Array.isArray(reference.files)) throw invalid("reference source");
+    aliases.add(reference.alias);
+    const referenceFiles = reference.files.map((entry) => {
+      const file = record3(entry);
+      if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("reference source file");
+      return { path: file.path, content: file.content };
+    });
+    const source2 = { repository: reference.repository, commitSha: reference.commitSha, files: referenceFiles };
+    const referenceDigest = await digestCodeRepositorySnapshot(source2, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+    if (referenceDigest !== reference.treeDigest) throw invalid("reference source digest");
+    references.push({ alias: reference.alias, ...source2, treeDigest: referenceDigest });
+  }
   const source = { repository: snapshot.repository, commitSha: snapshot.commitSha, files };
-  const digest2 = await digestCodeRepositorySnapshot(source, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
-  if (digest2 !== snapshot.treeDigest) throw invalid("source digest");
-  return { ...source, treeDigest: digest2 };
+  const digest = await digestCodeRepositorySnapshot(source, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+  if (digest !== snapshot.treeDigest) throw invalid("source digest");
+  return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
 }
 function parseReview(value) {
   const review = record3(record3(value)?.review);
@@ -3309,9 +3551,9 @@ function validateRelativePath(path) {
 }
 function resolveCodePath(workspaceDir, path) {
   validateRelativePath(path);
-  const root = (0, import_path3.resolve)(workspaceDir);
-  const target = (0, import_path3.resolve)(root, path);
-  if (target !== root && !target.startsWith(`${root}${import_path3.sep}`)) throw new TypeError("path escapes the staged workspace");
+  const root = (0, import_path6.resolve)(workspaceDir);
+  const target = (0, import_path6.resolve)(root, path);
+  if (target !== root && !target.startsWith(`${root}${import_path6.sep}`)) throw new TypeError("path escapes the staged workspace");
   return target;
 }
 async function applyCodePatch(workspaceDir, patch2, paths) {
@@ -3319,7 +3561,7 @@ async function applyCodePatch(workspaceDir, patch2, paths) {
   await gitApply(workspaceDir, patch2, false);
   for (const path of paths) {
     try {
-      const info = await (0, import_promises4.lstat)(resolveCodePath(workspaceDir, path));
+      const info = await (0, import_promises6.lstat)(resolveCodePath(workspaceDir, path));
       if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
         throw new TypeError("patch created a non-regular workspace entry");
       }
@@ -3331,7 +3573,7 @@ async function applyCodePatch(workspaceDir, patch2, paths) {
 function gitApply(cwd, patch2, check) {
   return new Promise((accept, reject) => {
     const args = ["apply", "--recount", "--whitespace=nowarn", ...check ? ["--check"] : [], "-"];
-    const child = (0, import_child_process3.spawn)("git", args, {
+    const child = (0, import_child_process4.spawn)("git", args, {
       cwd,
       shell: false,
       stdio: ["pipe", "ignore", "pipe"],
@@ -3375,7 +3617,7 @@ async function restoreCodeWorkspaceCheckpoint(input) {
 }
 var ARTIFACT_PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
 var PRIVATE_ARTIFACT_PART = /^(?:\.git|\.odla|\.wrangler|\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json)$/i;
-function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-recipe-${(0, import_crypto.randomUUID)().slice(0, 12)}`) {
+function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-recipe-${(0, import_crypto2.randomUUID)().slice(0, 12)}`) {
   assertCodeBuildRecipe(recipe2);
   if (/[,\r\n]/.test(workspaceDir)) throw new TypeError("workspace path contains unsupported mount characters");
   const uid = typeof import_process2.getuid === "function" ? (0, import_process2.getuid)() : 1e3;
@@ -3430,7 +3672,7 @@ function createContainerRecipeExecutor(engine) {
   return {
     async run(input) {
       await verifyContainerEngineBoundary(engine);
-      const name = `odla-recipe-${(0, import_crypto.randomUUID)().slice(0, 12)}`;
+      const name = `odla-recipe-${(0, import_crypto2.randomUUID)().slice(0, 12)}`;
       const args = buildRecipeContainerArgs(engine, input.workspaceDir, input.recipe, name);
       return execute(engine, args, name, input.recipe, input.signal);
     }
@@ -3454,7 +3696,7 @@ function parseMemory(value) {
 function execute(engine, args, name, recipe2, signal) {
   return new Promise((accept, reject) => {
     const started = Date.now();
-    const child = (0, import_child_process4.spawn)(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    const child = (0, import_child_process5.spawn)(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
     const stdout = [];
     const stderr = [];
     let bytes = 0;
@@ -3467,7 +3709,7 @@ function execute(engine, args, name, recipe2, signal) {
       timedOut = reason === "timeout";
       outputLimitExceeded = reason === "output";
       const remove = engine === "container" ? ["delete", "--force", name] : ["rm", "-f", name];
-      const killer = (0, import_child_process4.spawn)(engine, remove, { shell: false, stdio: "ignore" });
+      const killer = (0, import_child_process5.spawn)(engine, remove, { shell: false, stdio: "ignore" });
       killer.unref();
       child.kill("SIGTERM");
     };
@@ -3501,32 +3743,6 @@ function execute(engine, args, name, recipe2, signal) {
     });
   });
 }
-async function digestStagedWorkspace(root, limits) {
-  const files = [];
-  const walk = async (directory) => {
-    const entries = await (0, import_promises6.readdir)(directory, { withFileTypes: true });
-    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-      if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
-      const target = (0, import_path5.resolve)(directory, entry.name);
-      if (entry.isDirectory()) await walk(target);
-      else if (entry.isFile()) {
-        files.push({ path: (0, import_path5.relative)(root, target).split("\\").join("/"), target });
-        if (files.length > limits.maxFiles) throw new TypeError("workspace digest exceeds its file bound");
-      }
-    }
-  };
-  await walk((0, import_path5.resolve)(root));
-  const hash = (0, import_crypto3.createHash)("sha256");
-  let bytes = 0;
-  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
-    const content = await (0, import_promises6.readFile)(file.target);
-    bytes += Buffer.byteLength(file.path) + content.byteLength;
-    if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
-    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);
-    hash.update(content);
-  }
-  return `sha256:${hash.digest("hex")}`;
-}
 var SHA3 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
 var DIGEST3 = /^sha256:[0-9a-f]{64}$/;
 var ID3 = /^[A-Za-z0-9._:-]{1,160}$/;
@@ -3574,7 +3790,7 @@ async function verifyCodeCandidate(input) {
     }
     const fields = {
       schemaVersion: 1,
-      verificationId: input.verificationId ?? `verify-${(0, import_crypto2.randomUUID)()}`,
+      verificationId: input.verificationId ?? `verify-${(0, import_crypto3.randomUUID)()}`,
       trustedBaseCommitSha: input.trustedBaseCommitSha,
       trustedBaseDigest: input.trustedBaseDigest,
       patchDigest,
@@ -3635,8 +3851,8 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = (0, import_path4.join)(workspaceDir, artifact.path);
-      const info = await (0, import_promises5.lstat)(path);
+      const path = (0, import_path7.join)(workspaceDir, artifact.path);
+      const info = await (0, import_promises7.lstat)(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
       } else if (info.size > artifact.maximumBytes) {
@@ -3653,7 +3869,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
 }
 function hashFile(path) {
   return new Promise((accept, reject) => {
-    const hash = (0, import_crypto2.createHash)("sha256");
+    const hash = (0, import_crypto3.createHash)("sha256");
     const stream = (0, import_fs2.createReadStream)(path);
     stream.on("data", (chunk) => {
       hash.update(chunk);
@@ -3711,7 +3927,7 @@ function digestJson(value) {
   return digestBytes(JSON.stringify(value));
 }
 function digestBytes(value) {
-  return `sha256:${(0, import_crypto2.createHash)("sha256").update(value).digest("hex")}`;
+  return `sha256:${(0, import_crypto3.createHash)("sha256").update(value).digest("hex")}`;
 }
 function integer(value, minimum, maximum) {
   return Number.isSafeInteger(value) && value >= minimum && value <= maximum;
@@ -3732,8 +3948,8 @@ async function prepareRuntimeCheckpoint(input) {
         policy: {
           policyId: "code.runtime",
           recipes: input.recipes,
-          maximumFiles: 1e4,
-          maximumBytes: 16 * 1024 * 1024
+          maximumFiles: 2e4,
+          maximumBytes: 512 * 1024 * 1024
         },
         recipeExecutor: input.recipeExecutor
       });
@@ -3807,7 +4023,7 @@ var CodeRuntimeCheckpointManager = class {
     await this.options.event(command, {
       type: "message",
       actor: "system",
-      body: `Candidate ${candidate.candidateId} is ready for exact owner publication approval`
+      body: command.payload.sourceSet ? `Candidate ${candidate.candidateId} was verified and delivered to the session PR branch` : `Candidate ${candidate.candidateId} is ready for legacy owner publication approval`
     }, pending.refs);
     this.#pending.delete(command.commandId);
     return true;
@@ -3815,11 +4031,11 @@ var CodeRuntimeCheckpointManager = class {
 };
 var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
 var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
-async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os2.tmpdir)()) {
+async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.tmpdir)()) {
   if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
-  const root = await (0, import_promises7.mkdtemp)((0, import_path6.join)(tempRoot, "odla-code-source-"));
-  const sourceDir = (0, import_path6.join)(root, "source");
-  await (0, import_promises7.mkdir)(sourceDir);
+  const root = await (0, import_promises8.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
+  const sourceDir = (0, import_path8.join)(root, "source");
+  await (0, import_promises8.mkdir)(sourceDir);
   const seen = /* @__PURE__ */ new Set();
   let bytes = 0;
   try {
@@ -3829,17 +4045,56 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os2.
       seen.add(file.path);
       bytes += Buffer.byteLength(file.path) + Buffer.byteLength(file.content);
       if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
-      const target = (0, import_path6.resolve)(sourceDir, file.path);
-      if (!target.startsWith(`${(0, import_path6.resolve)(sourceDir)}${import_path6.sep}`)) throw new TypeError("Code source path escapes its root");
-      await (0, import_promises7.mkdir)((0, import_path6.dirname)(target), { recursive: true });
-      await (0, import_promises7.writeFile)(target, file.content, { flag: "wx", mode: 420 });
+      const target = (0, import_path8.resolve)(sourceDir, file.path);
+      if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code source path escapes its root");
+      await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+      await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 420 });
+    }
+    for (const reference of snapshot.references ?? []) {
+      validateAlias(reference.alias);
+      if (!reference.files.length || reference.files.length > 1e4) throw new TypeError("Code reference file count is invalid");
+      for (const file of reference.files) {
+        validatePath(file.path);
+        const path = `.odla-references/${reference.alias}/${file.path}`;
+        if (seen.has(path)) throw new TypeError("Code reference repeats a path");
+        seen.add(path);
+        bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
+        if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
+        const target = (0, import_path8.resolve)(sourceDir, path);
+        if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
+        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+      }
     }
-    return { sourceDir, cleanup: () => (0, import_promises7.rm)(root, { recursive: true, force: true }) };
+    return { sourceDir, cleanup: () => (0, import_promises8.rm)(root, { recursive: true, force: true }) };
   } catch (cause) {
-    await (0, import_promises7.rm)(root, { recursive: true, force: true });
+    await (0, import_promises8.rm)(root, { recursive: true, force: true });
     throw cause;
   }
 }
+function validateAlias(alias) {
+  if (!/^[a-z][a-z0-9-]{0,39}$/.test(alias) || alias === "primary") {
+    throw new TypeError("Code reference alias is invalid");
+  }
+}
+async function attachCodeRuntimeReferences(workspace, references) {
+  let bytes = 0;
+  for (const reference of references) {
+    validateAlias(reference.alias);
+    for (const file of reference.files) {
+      validatePath(file.path);
+      const path = `.odla-references/${reference.alias}/${file.path}`;
+      bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
+      if (bytes > 64 * 1024 * 1024) throw new TypeError("Code reference set exceeds its byte bound");
+      for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
+        const target = (0, import_path8.resolve)(root, path);
+        if (!target.startsWith(`${(0, import_path8.resolve)(root)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
+        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+      }
+    }
+  }
+}
 function validatePath(path) {
   const parts = path.split("/");
   if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || parts.some((part) => !part || part === "." || part === ".." || RESERVED2.has(part) || SECRET2.test(part))) {
@@ -3942,15 +4197,15 @@ async function environment(input, options, tool) {
     { id: "authority", value: `lease:${input.lease.leaseId}`, readers: input.readers },
     { id: "reader", value: options.readerId, readers: input.readers }
   ]);
-  const digest2 = await destinationRegistryDigest([input.workspaceId]);
+  const digest = await destinationRegistryDigest([input.workspaceId]);
   const approvals = ["irreversible_mutation", "external_send", "financial", "secret_read"];
   if (options.recipeAuthorization === "exact_approval") approvals.push("code_execution");
   const policy = createEffectPolicy({
-    destinationRegistries: { [DESTINATIONS]: { digest: digest2, values: [input.workspaceId] } },
+    destinationRegistries: { [DESTINATIONS]: { digest, values: [input.workspaceId] } },
     approvalEffects: approvals
   });
   const fixedArgs = {
-    workspace: { role: "destination", value: ingress.control("workspace"), registryId: DESTINATIONS, registryDigest: digest2 },
+    workspace: { role: "destination", value: ingress.control("workspace"), registryId: DESTINATIONS, registryDigest: digest },
     authority: { role: "authority", value: ingress.control("authority") }
   };
   return { ingress, policy, fixedArgs, reader: ingress.control("reader"), runId: `${input.request.requestId}:${tool}` };
@@ -4021,11 +4276,11 @@ async function read(context, request, options, policy) {
   const allowed = await policy.read(policyContext(context, request, options, { paths, path, startLine, endLine }));
   if (!allowed) return response(request, false, "tool denied by CaMeL policy");
   const target = resolveCodePath(context.workspaceDir, path);
-  const info = await (0, import_promises8.stat)(target);
+  const info = await (0, import_promises9.stat)(target);
   if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
     throw new TypeError("file is not a bounded regular source file");
   }
-  const source = await (0, import_promises8.readFile)(target);
+  const source = await (0, import_promises9.readFile)(target);
   if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
   const lines = source.toString("utf8").split("\n");
   const content = lines.slice(startLine - 1, endLine).join("\n");
@@ -4038,6 +4293,9 @@ async function patch(context, request, options, policy) {
   exactKeys(request.input, ["patch"]);
   const value = stringField(request.input, "patch");
   const paths = validateCodePatch(value, options.maxPatchBytes ?? 256 * 1024);
+  if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
+    throw new TypeError("patch targets a read-only reference source");
+  }
   const allowed = await policy.patch(policyContext(context, request, options, { patch: value }));
   if (!allowed) return response(request, false, "tool denied by CaMeL policy");
   await applyCodePatch(context.workspaceDir, value, paths);
@@ -4099,12 +4357,12 @@ function policyContext(context, request, options, extra) {
 async function registeredFiles(root, limit) {
   const paths = [];
   const walk = async (directory) => {
-    for (const entry of await (0, import_promises8.readdir)(directory, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises9.readdir)(directory, { withFileTypes: true })) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace contains a symbolic link");
-      const target = (0, import_path7.resolve)(directory, entry.name);
+      const target = (0, import_path9.resolve)(directory, entry.name);
       if (entry.isDirectory()) await walk(target);
       else if (entry.isFile()) {
-        const path = (0, import_path7.relative)(root, target).split("\\").join("/");
+        const path = (0, import_path9.relative)(root, target).split("\\").join("/");
         try {
           validateRelativePath(path);
         } catch {
@@ -4115,7 +4373,7 @@ async function registeredFiles(root, limit) {
       }
     }
   };
-  await walk((0, import_path7.resolve)(root));
+  await walk((0, import_path9.resolve)(root));
   return paths.sort();
 }
 function validateOptions(options) {
@@ -4123,6 +4381,9 @@ function validateOptions(options) {
     throw new TypeError("Code tool broker requires a reader and unique registered recipes");
   }
   for (const recipe2 of options.recipes) assertCodeBuildRecipe(recipe2);
+  if (options.readOnlyPrefixes?.some((prefix) => !/^[A-Za-z0-9_.-]+$/.test(prefix) || prefix === "." || prefix === "..")) {
+    throw new TypeError("Code tool broker read-only prefix is invalid");
+  }
 }
 function exactKeys(input, allowed) {
   if (Object.keys(input).some((key) => !allowed.includes(key))) throw new TypeError("tool input contains an unsupported field");
@@ -4150,14 +4411,31 @@ function codeCommandMetadata(payload, resume) {
   }
   const planning = trusted?.planningInputDigest;
   const attestation = trusted?.attestationDigest;
+  const repository = trusted?.repository;
+  const baseCommitSha = trusted?.commitSha;
+  const sourceTreeDigest = trusted?.treeDigest;
+  if (typeof repository !== "string" || !repository.includes("/") || typeof baseCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(baseCommitSha) || typeof sourceTreeDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(sourceTreeDigest)) {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} trusted base`);
+  }
   return {
     role,
     title,
     prompt,
     planningInputDigest: typeof planning === "string" && /^sha256:[0-9a-f]{64}$/.test(planning) ? planning : null,
-    attestationDigest: typeof attestation === "string" ? attestation : "resume"
+    attestationDigest: typeof attestation === "string" ? attestation : "resume",
+    repository,
+    baseCommitSha,
+    sourceTreeDigest
   };
 }
+function codeLocalSource(payload) {
+  const source = record22(payload.source);
+  if (!source) return null;
+  if (source.kind !== "local_checkout" || typeof source.repository !== "string" || typeof source.headCommitSha !== "string" || !/^[0-9a-f]{40}$/.test(source.headCommitSha) || typeof source.trustedBaseDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.trustedBaseDigest) || typeof source.developerPatchDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.developerPatchDigest) || typeof source.snapshotDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(source.snapshotDigest) || typeof source.modified !== "boolean" || !Number.isSafeInteger(source.fileCount) || Number(source.fileCount) < 1 || Number(source.fileCount) > 2e4 || !Number.isSafeInteger(source.byteCount) || Number(source.byteCount) < 1 || Number(source.byteCount) > 512 * 1024 * 1024 || !Number.isSafeInteger(source.capturedAt) || Number(source.capturedAt) < 1) {
+    throw new TypeError("invalid local checkout source descriptor");
+  }
+  return source;
+}
 function codeCheckpointPayload(payload) {
   const value = payload.checkpoint;
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("resume checkpoint is missing");
@@ -4186,11 +4464,63 @@ function fakeCodeLease(command, metadata2) {
   };
 }
 var record22 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var SOURCE_LIMITS = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
+async function prepareRuntimeLocalSource(input) {
+  const { command, descriptor: descriptor2, available, repository, baseCommitSha, resume } = input;
+  if (!available || JSON.stringify(available.descriptor) !== JSON.stringify(descriptor2) || descriptor2.repository.toLowerCase() !== repository.toLowerCase() || descriptor2.headCommitSha !== baseCommitSha) {
+    throw new TypeError("the session's local checkout snapshot is not available on this terminal");
+  }
+  const workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+    trustedBaseDir: available.trustedBaseDir,
+    trustedBaseCommitSha: baseCommitSha,
+    checkpoint: codeCheckpointPayload(command.payload)
+  })).workspace : await stageWorkspacePair(available.trustedBaseDir, available.sourceDir, SOURCE_LIMITS);
+  const trustedBaseDigest = await digestStagedWorkspace(workspace.baselineDir, SOURCE_LIMITS);
+  if (trustedBaseDigest !== descriptor2.trustedBaseDigest) {
+    await workspace.cleanup();
+    throw new TypeError("trusted Git base digest changed after connection");
+  }
+  if (!resume && await digestStagedWorkspace(workspace.workspaceDir, SOURCE_LIMITS) !== descriptor2.snapshotDigest) {
+    await workspace.cleanup();
+    throw new TypeError("local checkout snapshot digest changed after connection");
+  }
+  return { workspace, sourceDigest: descriptor2.snapshotDigest, trustedBaseDigest };
+}
+function createCodeRuntimeToolBroker(input, lease, role) {
+  const broker = createCodeToolBroker({
+    recipes: input.recipes,
+    recipeExecutor: createContainerRecipeExecutor(input.engine),
+    recipeAuthorization: input.recipeAuthorization ?? "registered_recipe",
+    readerId: `code-session:${lease.task.taskId}`,
+    readOnlyPrefixes: [".odla-references"]
+  });
+  return role === "coding" ? broker : { execute: (context, request) => request.tool === "sandbox.read" ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
+}
+async function appendCodeRuntimeEvent(control, command, event, refs) {
+  const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
+  refs.push(eventId);
+  const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
+  await control.appendSessionEvent(command.sessionId, eventId, bounded);
+}
+var digestRuntimeValue = (value) => `sha256:${(0, import_crypto4.createHash)("sha256").update(value).digest("hex")}`;
+var runtimeErrorMessage = (value) => value instanceof Error ? value.message : String(value);
+var runtimeRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var safeRuntimeJson = (value) => {
+  try {
+    return JSON.stringify(value).slice(0, 1e4);
+  } catch {
+    return "[event]";
+  }
+};
+function runtimeResultText(value) {
+  const record32 = runtimeRecord(value);
+  return record32 && typeof record32.text === "string" ? record32.text.slice(0, 2e4) : null;
+}
 var CodePiRuntimeEngine = class {
   constructor(options) {
     this.options = options;
     this.#run = options.runAttempt ?? runContainerAttempt;
-    this.#buildPolicyDigest = digest(JSON.stringify(options.recipes));
+    this.#buildPolicyDigest = digestRuntimeValue(JSON.stringify(options.recipes));
     this.#checkpoints = new CodeRuntimeCheckpointManager({
       control: options.control,
       recipes: options.recipes,
@@ -4225,19 +4555,43 @@ var CodePiRuntimeEngine = class {
   }
   async #start(command, resume) {
     if (this.#active.has(command.sessionId)) throw new TypeError("Code session is already active on this runtime");
-    const source = await this.options.control.source(command.sessionId);
-    const materialized = await materializeCodeRuntimeSource(source);
+    const metadata2 = codeCommandMetadata(command.payload, resume);
+    const requestedLocal = codeLocalSource(command.payload);
     let workspace;
-    try {
-      workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
-        trustedBaseDir: materialized.sourceDir,
-        trustedBaseCommitSha: source.commitSha,
-        checkpoint: codeCheckpointPayload(command.payload)
-      })).workspace : await stageWorkspace(materialized.sourceDir);
-    } finally {
-      await materialized.cleanup();
+    let sourceDigest;
+    let localTrustedBaseDigest;
+    if (requestedLocal) {
+      const prepared = await prepareRuntimeLocalSource({
+        command,
+        descriptor: requestedLocal,
+        available: this.options.localSource,
+        repository: metadata2.repository,
+        baseCommitSha: metadata2.baseCommitSha,
+        resume
+      });
+      ({ workspace, sourceDigest, trustedBaseDigest: localTrustedBaseDigest } = prepared);
+      if (command.payload.sourceSet) {
+        const selected = await this.options.control.source(command.sessionId);
+        if (selected.repository !== metadata2.repository || selected.commitSha !== metadata2.baseCommitSha || selected.treeDigest !== metadata2.sourceTreeDigest) {
+          await workspace.cleanup();
+          throw new TypeError("Code local source does not match the selected GitHub primary source");
+        }
+        await attachCodeRuntimeReferences(workspace, selected.references ?? []);
+      }
+    } else {
+      const source = await this.options.control.source(command.sessionId);
+      const materialized = await materializeCodeRuntimeSource(source);
+      try {
+        workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+          trustedBaseDir: materialized.sourceDir,
+          trustedBaseCommitSha: source.commitSha,
+          checkpoint: codeCheckpointPayload(command.payload)
+        })).workspace : await stageWorkspace(materialized.sourceDir);
+      } finally {
+        await materialized.cleanup();
+      }
+      sourceDigest = source.treeDigest;
     }
-    const metadata2 = codeCommandMetadata(command.payload, resume);
     const abort = new AbortController();
     const conversationRefs = [];
     const active = {
@@ -4247,21 +4601,30 @@ var CodePiRuntimeEngine = class {
       acknowledged: false,
       role: metadata2.role,
       title: metadata2.title,
-      baseCommitSha: source.commitSha,
-      trustedBaseDigest: await digestStagedWorkspace(workspace.baselineDir, {
-        maxFiles: 1e4,
-        maxBytes: 16 * 1024 * 1024
+      baseCommitSha: metadata2.baseCommitSha,
+      repository: metadata2.repository,
+      sourceTreeDigest: metadata2.sourceTreeDigest,
+      trustedBaseDigest: requestedLocal ? localTrustedBaseDigest : await digestStagedWorkspace(workspace.baselineDir, {
+        maxFiles: 2e4,
+        maxBytes: 512 * 1024 * 1024
       }),
-      planningInputDigest: metadata2.planningInputDigest ?? digest(
-        JSON.stringify({ attestation: metadata2.attestationDigest, prompt: metadata2.prompt, tree: source.treeDigest })
+      planningInputDigest: metadata2.planningInputDigest ?? digestRuntimeValue(
+        JSON.stringify({ attestation: metadata2.attestationDigest, prompt: metadata2.prompt, tree: sourceDigest })
       ),
       done: Promise.resolve(null)
     };
     this.#active.set(command.sessionId, active);
+    if (requestedLocal) {
+      await this.#event(command, {
+        type: "message",
+        actor: "system",
+        body: `Source snapshot: local checkout ${requestedLocal.snapshotDigest} \xB7 ${requestedLocal.modified ? "modified" : "clean"} \xB7 Git ${requestedLocal.headCommitSha}`
+      }, conversationRefs);
+    }
     active.done = this.#runAttempt(command, metadata2, active).catch(async (cause) => {
-      await this.#event(command, { type: "message", actor: "system", body: `Pi failed: ${message2(cause)}` }, conversationRefs).catch(() => void 0);
+      await this.#event(command, { type: "message", actor: "system", body: `Pi failed: ${runtimeErrorMessage(cause)}` }, conversationRefs).catch(() => void 0);
       await this.#event(command, { type: "status", status: "failed" }, conversationRefs).catch(() => void 0);
-      await this.#failure(command, active, message2(cause));
+      await this.#failure(command, active, runtimeErrorMessage(cause));
       return null;
     });
     return { status: "running", message: resume ? "Pi resumed from a portable checkpoint" : "Pi started" };
@@ -4281,22 +4644,29 @@ var CodePiRuntimeEngine = class {
       title: active.title,
       prompt,
       planningInputDigest: active.planningInputDigest,
-      attestationDigest: "follow-up"
+      attestationDigest: "follow-up",
+      repository: active.repository,
+      baseCommitSha: active.baseCommitSha,
+      sourceTreeDigest: active.sourceTreeDigest
     }, active).catch(async (cause) => {
       await this.#event(
         command,
-        { type: "message", actor: "system", body: `Pi failed: ${message2(cause)}` },
+        { type: "message", actor: "system", body: `Pi failed: ${runtimeErrorMessage(cause)}` },
         active.conversationRefs
       ).catch(() => void 0);
       await this.#event(command, { type: "status", status: "failed" }, active.conversationRefs).catch(() => void 0);
-      await this.#failure(command, active, message2(cause));
+      await this.#failure(command, active, runtimeErrorMessage(cause));
       return null;
     });
     return { status: "running", message: "Pi accepted the owner prompt" };
   }
   async #runAttempt(command, metadata2, active) {
     const lease = fakeCodeLease(command, metadata2);
-    const broker = this.#toolBroker(lease, metadata2.role);
+    const broker = createCodeRuntimeToolBroker({
+      recipes: this.options.recipes,
+      engine: this.options.engine,
+      recipeAuthorization: this.options.recipeAuthorization
+    }, lease, metadata2.role);
     const startedAt = Date.now();
     let completionSeen = false;
     const result = await this.#run({
@@ -4356,7 +4726,7 @@ var CodePiRuntimeEngine = class {
           return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "tool.response", ...response2 };
         }
         if (output.type === "event") {
-          const payload = object2(output.payload);
+          const payload = runtimeRecord(output.payload);
           if (output.kind === "pi.started") {
             await this.#event(command, { type: "status", status: "running" }, active.conversationRefs);
           } else if (output.kind === "pi.thinking" && payload?.available === true && Number.isSafeInteger(payload.durationMs) && Number(payload.durationMs) >= 0) {
@@ -4369,12 +4739,12 @@ var CodePiRuntimeEngine = class {
             await this.#event(command, {
               type: "message",
               actor: "system",
-              body: `${output.kind}${output.payload === void 0 ? "" : ` ${json(output.payload)}`}`
+              body: `${output.kind}${output.payload === void 0 ? "" : ` ${safeRuntimeJson(output.payload)}`}`
             }, active.conversationRefs);
           }
         } else if (output.type === "attempt.complete") {
           completionSeen = true;
-          const body = resultText(output.result) ?? `Pi ${output.status}.`;
+          const body = runtimeResultText(output.result) ?? `Pi ${output.status}.`;
           await this.#event(command, {
             type: "message",
             actor: output.status === "completed" ? "agent" : "system",
@@ -4401,15 +4771,6 @@ var CodePiRuntimeEngine = class {
     }
     return result;
   }
-  #toolBroker(lease, role) {
-    const broker = createCodeToolBroker({
-      recipes: this.options.recipes,
-      recipeExecutor: createContainerRecipeExecutor(this.options.engine),
-      recipeAuthorization: this.options.recipeAuthorization ?? "registered_recipe",
-      readerId: `code-session:${lease.task.taskId}`
-    });
-    return role === "coding" ? broker : { execute: (context, request) => request.tool === "sandbox.read" ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
-  }
   async #checkpoint(command) {
     const active = this.#active.get(command.sessionId);
     if (!active) throw new TypeError("Code session workspace is not active on this runtime");
@@ -4424,26 +4785,9 @@ var CodePiRuntimeEngine = class {
     }
   }
   async #event(command, event, refs) {
-    const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
-    refs.push(eventId);
-    const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
-    await this.options.control.appendSessionEvent(command.sessionId, eventId, bounded);
-  }
-};
-var object2 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
-var digest = (value) => `sha256:${(0, import_crypto4.createHash)("sha256").update(value).digest("hex")}`;
-var message2 = (value) => value instanceof Error ? value.message : String(value);
-var json = (value) => {
-  try {
-    return JSON.stringify(value).slice(0, 1e4);
-  } catch {
-    return "[event]";
+    await appendCodeRuntimeEvent(this.options.control, command, event, refs);
   }
 };
-function resultText(value) {
-  const record32 = object2(value);
-  return record32 && typeof record32.text === "string" ? record32.text.slice(0, 2e4) : null;
-}
 
 // src/help.ts
 var import_node_fs6 = require("fs");
@@ -4585,8 +4929,8 @@ async function requestHostedSecurityJson(options, path, init, action) {
   const body = await response2.json().catch(() => ({}));
   if (!response2.ok) {
     const code = optionalHostedText(body.error?.code, "error code", 128);
-    const message3 = optionalHostedText(body.error?.message, "error message", 300);
-    throw new Error(`${action} failed (${response2.status})${code ? ` ${code}` : ""}${message3 ? `: ${message3}` : ""}`);
+    const message2 = optionalHostedText(body.error?.message, "error message", 300);
+    throw new Error(`${action} failed (${response2.status})${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`);
   }
   return body;
 }
@@ -4775,24 +5119,111 @@ async function defaultReadOrigin(cwd) {
   return result.stdout;
 }
 
-// src/code-connect.ts
-var CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:713db58428bc05cb486167c5747de8fd826669c9b283ff78e0139ac194c3d058";
+// src/code-local-source.ts
+var import_node_child_process3 = require("child_process");
+var import_node_crypto = require("crypto");
+var SOURCE_LIMITS2 = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
+async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
+  const headCommitSha = await readHead(cwd);
+  const staged = await stageWorkspace(cwd, { ...SOURCE_LIMITS2, gitTrackedAndUnignored: true });
+  let trusted;
+  try {
+    trusted = await materializeGitTree(cwd, headCommitSha, SOURCE_LIMITS2);
+    const comparison = await stageWorkspacePair(trusted.sourceDir, staged.baselineDir, SOURCE_LIMITS2);
+    let developerPatch;
+    try {
+      developerPatch = await comparison.patch(4 * 1024 * 1024);
+    } finally {
+      await comparison.cleanup();
+    }
+    const descriptor2 = {
+      kind: "local_checkout",
+      repository,
+      headCommitSha,
+      trustedBaseDigest: await digestStagedWorkspace(trusted.sourceDir, SOURCE_LIMITS2),
+      developerPatchDigest: digestText(developerPatch),
+      snapshotDigest: await digestStagedWorkspace(staged.baselineDir, SOURCE_LIMITS2),
+      modified: developerPatch.length > 0,
+      fileCount: staged.fileCount,
+      byteCount: staged.byteCount,
+      capturedAt: Date.now()
+    };
+    return {
+      descriptor: descriptor2,
+      trustedBaseDir: trusted.sourceDir,
+      sourceDir: staged.baselineDir,
+      cleanup: async () => {
+        await Promise.all([staged.cleanup(), trusted.cleanup()]);
+      }
+    };
+  } catch (error) {
+    await Promise.all([staged.cleanup(), trusted?.cleanup()]);
+    throw error;
+  }
+}
+async function readGitHead(cwd) {
+  const value = await new Promise((accept, reject) => {
+    (0, import_node_child_process3.execFile)("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", maxBuffer: 16384 }, (error, stdout) => {
+      if (error) reject(new Error("code connect requires a Git checkout with an initial commit"));
+      else accept(stdout.trim());
+    });
+  });
+  if (!/^[0-9a-f]{40}$/.test(value)) throw new Error("code connect could not resolve the checkout HEAD commit");
+  return value;
+}
+function digestText(value) {
+  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(value).digest("hex")}`;
+}
+
+// src/code-images.ts
+var import_node_child_process4 = require("child_process");
+async function prepareCodeImages(engine, images) {
+  for (const image of images) {
+    await new Promise((accept, reject) => {
+      const args = engine === "container" ? ["image", "pull", image] : ["pull", image];
+      (0, import_node_child_process4.execFile)(engine, args, { encoding: "utf8", maxBuffer: 2 * 1024 * 1024, timeout: 10 * 6e4 }, (error) => {
+        if (error) reject(new Error(`could not prepare pinned Code image ${image}`));
+        else accept();
+      });
+    });
+  }
+}
+
+// src/code-runtime-config.ts
+var CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:e7858b4f0291543171b2659b47c5d00f97acc4767cafd9b74ae5228899e0cde4";
 var CODE_BUILD_RECIPES = Object.freeze([{
-  id: "node-test",
+  id: "odla-code-contracts",
   image: "node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd",
-  command: ["node", "--test"],
+  command: [
+    "node",
+    "--test",
+    "scripts/lib/directories.test.mjs",
+    "scripts/lib/internal-deps.test.mjs",
+    "scripts/lib/npm-audit.test.mjs",
+    "scripts/lib/npm-release-contract.test.mjs",
+    "scripts/lib/release-surfaces.test.mjs"
+  ],
   timeoutMs: 12e4,
   maxOutputBytes: 1024 * 1024,
   cpus: 1,
   memory: "512m",
   pids: 128
 }]);
+
+// src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = (0, import_node_path4.resolve)(cwd, options.configPath);
   const cfg = (0, import_node_fs7.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
-  const repository = cfg ? null : await inferGitHubRepository(cwd, options.readGitOrigin);
-  const platform = cfg?.platformUrl ?? process.env.ODLA_PLATFORM_URL ?? "https://odla.ai";
+  const requestedAppId = options.appId?.trim();
+  if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
+    throw new Error("--app-id must be a valid odla app id");
+  }
+  if (requestedAppId && cfg && requestedAppId !== cfg.app.id) {
+    throw new Error(`--app-id ${requestedAppId} does not match ${options.configPath} (${cfg.app.id})`);
+  }
+  const appId = requestedAppId ?? cfg?.app.id;
+  const platform = (options.platform ?? cfg?.platformUrl ?? process.env.ODLA_PLATFORM_URL ?? "https://odla.ai").replace(/\/+$/, "");
   const appEnv = options.env ?? (cfg ? cfg.envs.includes("dev") ? "dev" : cfg.envs[0] : "dev");
   if (appEnv !== "dev" && appEnv !== "prod" || cfg && !cfg.envs.includes(appEnv)) {
     throw new Error(cfg ? `Code env "${appEnv ?? ""}" must be dev or prod and declared in ${options.configPath}` : `Code env "${appEnv ?? ""}" must be dev or prod`);
@@ -4811,53 +5242,77 @@ async function codeConnect(options) {
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
   const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? "auto");
+  await (options.prepareImages ?? prepareCodeImages)(engine, [
+    CODE_PI_IMAGE,
+    ...new Set(CODE_BUILD_RECIPES.map((recipe2) => recipe2.image))
+  ]);
   const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
   const hostName = (options.name ?? (0, import_node_os.hostname)()).trim();
   if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
-  const approval = await (options.getToken ?? getScopedPlatformToken)({
-    platform,
-    scope: "platform:code:host:connect",
-    email: options.email,
-    open: options.open,
-    fetch: doFetch,
-    stdout: out,
-    openApprovalUrl: options.openApprovalUrl,
-    cache: false,
-    label: `odla CLI Code host for ${cfg?.app.id ?? repository}/${appEnv}`
-  });
-  const target = cfg ? { appId: cfg.app.id } : { repository };
-  const response2 = await doFetch(`${platform}/registry/code/hosts/connect`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${approval}`, "content-type": "application/json" },
-    body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),
-    redirect: "error",
-    signal: options.signal
-  });
-  const raw = await response2.json().catch(() => null);
-  if (!response2.ok) throw new Error(apiFailure("connect Code host", response2.status, raw));
-  const connection = parseConnection(raw, cfg?.app.id, appEnv);
-  const capabilities = {
-    protocolVersion: CODE_RUNTIME_PROTOCOL_VERSION,
-    platform: hostPlatform,
-    arch: process.arch,
-    engines: [engine],
-    cpuCount: (0, import_node_os.cpus)().length,
-    memoryBytes: (0, import_node_os.totalmem)()
-  };
-  out.log(`${connection.resumed ? "reconnected" : "enrolled"}: ${connection.host.name} (${connection.host.hostId})`);
-  out.log(`binding: ${connection.binding.appId}/${connection.binding.env} \xB7 ${connection.offer.slots} slot(s) \xB7 ${engine}`);
-  out.log("credentials: stored in odla-ai/db; host plaintext is memory-only");
-  await (options.runRuntime ?? runCodeRuntime)({
-    endpoint: platform,
-    token: connection.token,
-    engine,
-    capabilities,
-    heartbeatMs,
-    once: options.once === true,
-    signal: options.signal,
-    stdout: out,
-    fetch: doFetch
-  });
+  const repository = await inferGitHubRepository(cwd, options.readGitOrigin);
+  const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(
+    cwd,
+    repository,
+    options.readGitHead
+  );
+  try {
+    const descriptor2 = localSource.descriptor;
+    const approval = await (options.getToken ?? getScopedPlatformToken)({
+      platform,
+      scope: "app:code:host:connect",
+      email: options.email,
+      open: options.open,
+      fetch: doFetch,
+      stdout: out,
+      openApprovalUrl: options.openApprovalUrl,
+      cache: false,
+      label: `Terminal connection for ${appId ?? repository}/${appEnv}`
+    });
+    const target = appId ? { appId } : { repository };
+    const response2 = await doFetch(`${platform}/registry/code/hosts/connect`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${approval}`, "content-type": "application/json" },
+      body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),
+      redirect: "error",
+      signal: options.signal
+    });
+    const raw = await response2.json().catch(() => null);
+    if (!response2.ok) throw new Error(apiFailure("connect Code host", response2.status, raw));
+    const connection = parseConnection(raw, appId, appEnv);
+    const capabilities = {
+      protocolVersion: CODE_RUNTIME_PROTOCOL_VERSION,
+      platform: hostPlatform,
+      arch: process.arch,
+      engines: [engine],
+      cpuCount: (0, import_node_os.cpus)().length,
+      memoryBytes: (0, import_node_os.totalmem)(),
+      source: descriptor2,
+      images: {
+        ready: true,
+        pi: CODE_PI_IMAGE,
+        recipes: CODE_BUILD_RECIPES.map((recipe2) => ({ id: recipe2.id, image: recipe2.image }))
+      }
+    };
+    out.log(`${connection.resumed ? "reconnected" : "enrolled"}: ${connection.host.name} (${connection.host.hostId})`);
+    out.log(`binding: ${connection.binding.appId}/${connection.binding.env} \xB7 ${connection.offer.slots} slot(s) \xB7 ${engine}`);
+    out.log(`source: local checkout \xB7 ${descriptor2.headCommitSha.slice(0, 10)} \xB7 ${descriptor2.fileCount} files \xB7 staged copy`);
+    out.log("credentials: stored in odla-ai/db; host plaintext is memory-only");
+    out.log(`Studio: ${platform}/studio/apps/${encodeURIComponent(connection.binding.appId)}/${connection.binding.env}/code/sessions`);
+    await (options.runRuntime ?? runCodeRuntime)({
+      endpoint: platform,
+      token: connection.token,
+      engine,
+      capabilities,
+      localSource,
+      heartbeatMs,
+      once: options.once === true,
+      signal: options.signal,
+      stdout: out,
+      fetch: doFetch
+    });
+  } finally {
+    await localSource.cleanup();
+  }
 }
 async function runCodeRuntime(input) {
   const controller = new AbortController();
@@ -4880,7 +5335,8 @@ async function runCodeRuntime(input) {
     engine: input.engine,
     image: CODE_PI_IMAGE,
     recipes: CODE_BUILD_RECIPES,
-    recipeAuthorization: "registered_recipe"
+    recipeAuthorization: "registered_recipe",
+    localSource: input.localSource
   });
   const reconciler = new CodeRuntimeReconciler(control, commandEngine);
   try {
@@ -4921,8 +5377,8 @@ function parseConnection(value, appId, appEnv) {
   return root;
 }
 function apiFailure(action, status, value) {
-  const message3 = record4(record4(value)?.error)?.message;
-  return `${action} failed (${status})${typeof message3 === "string" ? `: ${message3}` : ""}`;
+  const message2 = record4(record4(value)?.error)?.message;
+  return `${action} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
 function record4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -4937,6 +5393,8 @@ async function codeCommand(parsed, dependencies) {
   assertArgs(parsed, [
     "config",
     "env",
+    "platform",
+    "app-id",
     "email",
     "open",
     "name",
@@ -4952,6 +5410,8 @@ async function codeCommand(parsed, dependencies) {
   await (dependencies.codeConnect ?? codeConnect)({
     configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
     env: stringOpt(parsed.options.env),
+    platform: stringOpt(parsed.options.platform),
+    appId: stringOpt(parsed.options["app-id"]),
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     name: stringOpt(parsed.options.name),
@@ -4967,16 +5427,16 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/doctor-checks.ts
-var import_node_child_process4 = require("child_process");
+var import_node_child_process6 = require("child_process");
 var import_node_fs9 = require("fs");
 var import_node_path6 = require("path");
 
 // src/wrangler.ts
-var import_node_child_process3 = require("child_process");
+var import_node_child_process5 = require("child_process");
 var import_node_fs8 = require("fs");
 var import_node_path5 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
-  const child = (0, import_node_child_process3.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  const child = (0, import_node_child_process5.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
   child.stdout.on("data", (chunk) => stdout += chunk.toString());
@@ -5067,7 +5527,7 @@ function lintRules(rules, entities, publicRead) {
   }
   return warnings;
 }
-var defaultExec = (cmd, args, cwd) => (0, import_node_child_process4.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+var defaultExec = (cmd, args, cwd) => (0, import_node_child_process6.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
 function trackedSecretFiles(rootDir, exec = defaultExec, localPaths = []) {
   let output;
   try {
@@ -5675,8 +6135,8 @@ async function readRegistryApp(cfg, token, doFetch) {
   });
   if (res.status === 404) return null;
   if (!res.ok) return null;
-  const json2 = await res.json();
-  return json2.app ?? null;
+  const json = await res.json();
+  return json.app ?? null;
 }
 async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
@@ -5915,10 +6375,10 @@ async function provision(options) {
           stdout: out
         });
       } catch (error) {
-        const message3 = error instanceof Error ? error.message : String(error);
+        const message2 = error instanceof Error ? error.message : String(error);
         const consent = env === "prod" || env === "production" ? " --yes" : "";
         throw new Error(
-          `${message3}
+          `${message2}
 ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
           { cause: error }
         );
@@ -6034,7 +6494,7 @@ async function resolveVaultWrite(options) {
 }
 
 // src/security-command-context.ts
-var import_promises9 = require("readline/promises");
+var import_promises10 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -6057,12 +6517,12 @@ async function hostedSecurityContext(parsed, dependencies) {
   );
   return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
 }
-async function interactiveConfirmation(message3, dependencies) {
-  if (dependencies.confirm) return dependencies.confirm(message3);
+async function interactiveConfirmation(message2, dependencies) {
+  if (dependencies.confirm) return dependencies.confirm(message2);
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises9.createInterface)({ input: process.stdin, output: process.stdout });
+  const prompt = (0, import_promises10.createInterface)({ input: process.stdin, output: process.stdout });
   try {
-    const answer = await prompt.question(`${message3} [y/N] `);
+    const answer = await prompt.question(`${message2} [y/N] `);
     return /^y(?:es)?$/i.test(answer.trim());
   } finally {
     prompt.close();
@@ -6189,7 +6649,7 @@ var import_security2 = require("@odla-ai/security");
 // src/security.ts
 var import_node_path8 = require("path");
 var import_security = require("@odla-ai/security");
-var import_node2 = require("@odla-ai/security/node");
+var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
   if (options.sourceDisclosureAck !== "redacted") {
     throw new Error("Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process");
@@ -6212,7 +6672,7 @@ async function runHostedSecurity(options) {
     scope: selfAudit ? "platform:security:self" : null
   };
   const token = await injectedToken(options, tokenRequest);
-  const snapshot = await (0, import_node2.snapshotDirectory)(target, {
+  const snapshot = await (0, import_node3.snapshotDirectory)(target, {
     exclude: !outputRelative.startsWith("../") && !(0, import_node_path8.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
@@ -6231,7 +6691,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node2.FileRunStore((0, import_node_path8.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path8.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -6241,7 +6701,7 @@ async function runHostedSecurity(options) {
     }
   });
   const report2 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await (0, import_node2.writeSecurityArtifacts)(output, report2);
+  await (0, import_node3.writeSecurityArtifacts)(output, report2);
   const reportDigest = await (0, import_security.securityFingerprint)(report2);
   await hosted.complete({
     reportDigest,
@@ -6374,8 +6834,8 @@ async function startHostedSecurityJob(options) {
       "start hosted security job"
     );
   } catch (error) {
-    const message3 = error instanceof Error ? error.message : String(error);
-    if (/\b(?:plan_conflict|policy_conflict|intent_conflict|security_ai_not_ready)\b/.test(message3)) {
+    const message2 = error instanceof Error ? error.message : String(error);
+    if (/\b(?:plan_conflict|policy_conflict|intent_conflict|security_ai_not_ready)\b/.test(message2)) {
       throw new Error("Hosted security plan or execution intent changed or became unavailable after review; fetch a fresh intent and explicitly acknowledge its digest before enqueueing again", { cause: error });
     }
     throw error;