@outerlayer/cli 0.10.2 → 0.11.0

package/dist/{chunk-BREEX2Z7.js → chunk-E5DC4VZL.js}

@@ -3,17 +3,17 @@ import { createRequire } from 'node:module';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3FMPZPJQ.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-VVIRHTH4.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-2GBCTEN4.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-JSUUXA5W.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-CJGQQZWB.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
-import { execCapture } from './chunk-6CXYORUS.js';
-import { GUEST_CID } from './chunk-S6IUUNCD.js';
+import { execCapture } from './chunk-QKFB4K7X.js';
+import { GUEST_CID } from './chunk-RSNSZ2LJ.js';
 import { WorkCommandError, postJson } from './chunk-DTDZXDQ3.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-IU4NZROR.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
-import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-M6G7TJVF.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath } from './chunk-4Q7OMKAT.js';
 import { defaultGitRunner, materializeContext } from './chunk-RWQWPZB4.js';
 import { readContextManifest, readSourceCache } from './chunk-BMX3L7CR.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-TB7EP24C.js';
@@ -133,6 +133,9 @@ function refusalCode(err) {
   if (!(err instanceof WorkCommandError)) return "unavailable";
   return err.code ?? `http_${err.status ?? "unknown"}`;
 }
+function keyOf(kind, repository) {
+  return repository === void 0 ? kind : `${kind}:${repository}`;
+}
 var BuildTokens = class {
   constructor(options) {
     this.options = options;
@@ -146,23 +149,35 @@ var BuildTokens = class {
   now() {
     return (this.options.now ?? (() => /* @__PURE__ */ new Date()))();
   }
-  /** The token of `kind`, asking the gateway for a new one when the build holds none or its token is within ten minutes of expiry. */
-  token(kind) {
-    const held = this.held.get(kind);
+  /** `repository` as the holder keys it: `undefined` for the primary, which is the one a request names no repository for. */
+  secondary(repository) {
+    if (repository === void 0) return void 0;
+    const primary = this.options.primary;
+    return primary !== void 0 && primary.toLowerCase() === repository.toLowerCase() ? void 0 : repository;
+  }
+  /**
+   * The token of `kind` for `repository`, or for the primary when none is
+   * named, asking the gateway for a new one when the build holds none or its
+   * token is within ten minutes of expiry.
+   */
+  token(kind, repository) {
+    const other = this.secondary(repository);
+    const key = keyOf(kind, other);
+    const held = this.held.get(key);
     if (held !== void 0 && !isDue(held.expiresAtMs, this.now().getTime())) return Promise.resolve(held.token);
-    let asking = this.asking.get(kind);
+    let asking = this.asking.get(key);
     if (asking === void 0) {
-      asking = this.issueOrKeep(kind).finally(() => this.asking.delete(kind));
-      this.asking.set(kind, asking);
+      asking = this.issueOrKeep(kind, other).finally(() => this.asking.delete(key));
+      this.asking.set(key, asking);
     }
     return asking;
   }
   /** A due token that has not yet expired is kept when the gateway cannot issue a new one. */
-  async issueOrKeep(kind) {
+  async issueOrKeep(kind, repository) {
     try {
-      return await this.issue(kind);
+      return await this.issue(kind, repository);
     } catch (err) {
-      const held = this.held.get(kind);
+      const held = this.held.get(keyOf(kind, repository));
       if (held !== void 0 && this.now().getTime() < held.expiresAtMs && classifyRefusal(err).kind === "retry") return held.token;
       throw err;
     }
@@ -221,8 +236,8 @@ var BuildTokens = class {
     this.issued.push(token);
     return { token, expiresAt, repository };
   }
-  async issue(kind) {
-    const asked = await this.ask({ access: kind });
+  async issue(kind, repository) {
+    const asked = await this.ask({ access: kind, ...repository === void 0 ? {} : { repository } });
     let err;
     if (!asked.ok) {
       err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
@@ -234,9 +249,9 @@ var BuildTokens = class {
           await this.revoke([token]);
           throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
         }
-        this.held.set(kind, { token, expiresAtMs });
+        this.held.set(keyOf(kind, repository), { token, expiresAtMs });
         this.issued.push(token);
-        if (kind === "read") this.readSink?.(token);
+        if (kind === "read" && repository === void 0) this.readSink?.(token);
         return token;
       }
       err = new WorkCommandError("the gateway's token answer carried no token or no expiry", false, void 0, "malformed_token_response");
@@ -935,31 +950,45 @@ function adoptionFailureReason(result) {
   }
   return `context_adoption_failed: adopting the control plane's context failed (exit ${result.status})${firstLine3(result.stderr) === "" ? "" : `: ${firstLine3(result.stderr)}`}`;
 }
-async function runBuildSteps(input) {
-  const { exec, log, tag, repository } = input;
-  let startCommit = "";
-  const rewrite = await exec(["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"], "/build/work");
-  if (rewrite.status !== 0) return { ok: false, reason: `configuring the build's git remote failed (exit ${rewrite.status})` };
-  const clone = await exec(["git", "clone", "--filter=blob:none", "--single-branch", `https://github.com/${repository}.git`, CHECKOUT_DIR], "/build/work");
+async function checkOut(input, entry) {
+  const { exec, log, tag } = input;
+  const path = checkoutPath(entry);
+  const clone = await exec(["git", "clone", "--filter=blob:none", "--single-branch", `https://github.com/${entry.repository}.git`, path], "/build/work");
   if (clone.status !== 0) {
     const detail = gitErrorLine(clone.stderr);
-    return { ok: false, reason: `the clone of ${repository} failed (exit ${clone.status})${detail === "" ? "" : `: ${detail}`}` };
+    return { ok: false, reason: `the clone of ${entry.repository} failed (exit ${clone.status})${detail === "" ? "" : `: ${detail}`}` };
   }
   try {
     const prepared = await prepareBranch({
-      workdir: CHECKOUT_DIR,
-      branch: input.branch,
+      workdir: path,
+      branch: entry.branch,
       git: async (cwd, args) => {
         const ran = await exec(["git", ...args], cwd, { quiet: true });
         return { status: ran.status, stdout: ran.stdout.trim(), stderr: ran.stderr.trim() };
       }
     });
-    startCommit = prepared.startCommit;
-    log.line(`${tag} on ${prepared.branch} at ${prepared.head.slice(0, 8)}`);
+    log.line(`${tag} ${entry.primary ? "" : `${entry.repository} `}on ${prepared.branch} at ${prepared.head.slice(0, 8)}`);
+    return { ok: true, startCommit: prepared.startCommit };
   } catch (err) {
-    if (err instanceof BranchPrepareError) return { ok: false, reason: err.message };
+    if (err instanceof BranchPrepareError) return { ok: false, reason: entry.primary ? err.message : `${entry.repository}: ${err.message}` };
     throw err;
   }
+}
+async function runBuildSteps(input) {
+  const { exec, log, tag, repository } = input;
+  let startCommit = "";
+  const repositories = repositoriesOf({ repositories: input.repositories, repository, branch: input.branch });
+  const primary = primaryOf(repositories) ?? { repository, branch: input.branch, primary: true };
+  const rewrite = await exec(["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"], "/build/work");
+  if (rewrite.status !== 0) return { ok: false, reason: `configuring the build's git remote failed (exit ${rewrite.status})` };
+  const first = await checkOut(input, { ...primary, primary: true });
+  if (!first.ok) return first;
+  startCommit = first.startCommit;
+  for (const entry of repositories.filter((candidate) => candidate.repository !== primary.repository)) {
+    if (input.aborted()) return aborted();
+    const checked = await checkOut(input, { ...entry, primary: false });
+    if (!checked.ok) return checked;
+  }
   for (const step of lifecycleSteps(input.lifecycle)) {
     if (input.aborted()) return aborted();
     log.line(`${tag} lifecycle ${step.name} (${step.source})`);
@@ -1639,6 +1668,7 @@ function readBody(req, limit) {
 }
 function createGitRemote(options) {
   const gitUrl = options.gitUrl ?? "https://github.com";
+  const claimed = options.repositories ?? (options.repository === void 0 || options.branch === void 0 || options.mirrorDir === void 0 ? [] : [{ repository: options.repository, branch: options.branch, mirrorDir: options.mirrorDir }]);
   const maxLfsBodyBytes = 1024 * 1024;
   const hopByHop = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "proxy-authenticate", "proxy-authorization", "te", "trailer", "set-cookie"]);
   const log = (line) => options.log?.(line);
@@ -1685,9 +1715,9 @@ function createGitRemote(options) {
       input.feed(upstream);
     });
   }
-  async function tokenOrRefuse(res, kind) {
+  async function tokenOrRefuse(res, kind, repository) {
     try {
-      return await options.tokens.token(kind);
+      return await options.tokens.token(kind, repository);
     } catch (err) {
       log(`could not get a ${kind} token: ${refusalCode(err)}`);
       plain(res, 502, `the runner could not get a ${kind} token: ${refusalCode(err)}
@@ -1695,7 +1725,7 @@ function createGitRemote(options) {
       return void 0;
     }
   }
-  async function push(req, res, route) {
+  async function push(req, res, route, target) {
     const encoding = req.headers["content-encoding"];
     const gzip = encoding === "gzip";
     const { held, section } = await readPrefix(req, gzip);
@@ -1720,8 +1750,8 @@ function createGitRemote(options) {
     let bodyPath;
     try {
       let fastForward;
-      if (needsFastForwardCheck(commands, options.branch)) {
-        const read = await tokenOrRefuse(res, "read");
+      if (needsFastForwardCheck(commands, target.branch)) {
+        const read = await tokenOrRefuse(res, "read", target.repository);
         if (read === void 0) return void await drain(req);
         mkdirSync(options.spoolDir, { recursive: true, mode: 448 });
         bodyPath = join(options.spoolDir, randomBytes(8).toString("hex"));
@@ -1742,21 +1772,21 @@ function createGitRemote(options) {
         if (size > cap) return void await refuseInBand(`the push is larger than the ${cap} bytes the runner holds to check it`);
         try {
           fastForward = await isFastForward({
-            mirrorDir: options.mirrorDir,
+            mirrorDir: target.mirrorDir,
             remoteUrl: `${gitUrl}/${route.owner}/${route.name}.git`,
             token: read,
-            branch: options.branch,
+            branch: target.branch,
             bodyPath,
             gzip
           });
         } catch (err) {
           log(`fast-forward check could not run: ${err instanceof Error ? err.message : String(err)}`);
-          return void await refuseInBand(`the runner could not check whether this push fast-forwards ${options.branch}`);
+          return void await refuseInBand(`the runner could not check whether this push fast-forwards ${target.branch}`);
         }
       }
-      const verdict = judgePush({ commands, branch: options.branch, fastForward });
+      const verdict = judgePush({ commands, branch: target.branch, fastForward });
       if (!verdict.allowed) return void await refuseInBand(verdict.message);
-      const token = await tokenOrRefuse(res, "push");
+      const token = await tokenOrRefuse(res, "push", target.repository);
       if (token === void 0) return void await drain(req);
       options.tokens.markUsed("push");
       const headers = upstreamHeaders(req.headers, basicAuthorization(token));
@@ -1793,8 +1823,15 @@ function createGitRemote(options) {
       req.resume();
       return plain(res, 403, "this remote is read-only: a check cannot push\n");
     }
-    const own = isOwnRepository(options.repository, route.owner, route.name);
-    if (own && route.kind === "receive-pack") return push(req, res, route);
+    const target = claimed.find((entry) => isOwnRepository(entry.repository, route.owner, route.name));
+    const pushing = route.kind === "receive-pack" || route.kind === "info-refs" && route.service === "git-receive-pack";
+    if (target === void 0 && pushing) {
+      log(`push refused: ${route.owner}/${route.name} is not a repository of this build's claim`);
+      req.resume();
+      return plain(res, 403, `the runner refused this push: ${route.owner}/${route.name} is not a repository of this build's claim
+`);
+    }
+    if (target !== void 0 && route.kind === "receive-pack") return push(req, res, route, target);
     let kind = route.kind === "info-refs" && route.service === "git-receive-pack" ? "push" : "read";
     let body;
     if (route.kind === "lfs-batch") {
@@ -1804,8 +1841,8 @@ function createGitRemote(options) {
       if (options.readOnly === true && kind === "push") return plain(res, 403, "this remote is read-only: a check cannot upload\n");
     }
     let authorization;
-    if (own) {
-      const token = await tokenOrRefuse(res, kind);
+    if (target !== void 0) {
+      const token = await tokenOrRefuse(res, kind, target.repository);
       if (token === void 0) return void await drain(req);
       authorization = basicAuthorization(token);
       if (kind === "read" || route.kind === "lfs-batch") options.tokens.markUsed(kind);
@@ -2268,14 +2305,14 @@ function keepGhConfigCurrent(tokens, buildDir2, onError) {
   });
 }
 function gitRemoteFor(runtime, input) {
-  const [owner = "", name = ""] = input.repository.split("/");
   const runnerDirPath = runnerDirOfBuild(input.buildDir);
   return createGitRemote({
-    repository: input.repository,
-    branch: input.branch,
+    repositories: input.repositories.map((entry) => {
+      const [owner = "", name = ""] = entry.repository.split("/");
+      return { repository: entry.repository, branch: entry.branch, mirrorDir: mirrorDir(runnerDirPath, owner, name) };
+    }),
     tokens: input.tokens,
     gitUrl: runtime.github.gitUrl,
-    mirrorDir: mirrorDir(runnerDirPath, owner, name),
     spoolDir: spoolDir(runnerDirPath),
     onWorkflowRefused: () => {
       input.tokens.reason = WORKFLOW_PERMISSION_REASON;
@@ -2349,10 +2386,10 @@ async function provisionContainer(input) {
   const logPath = join(jobDir, "provision.log");
   const fail = (reason) => ({ ok: false, reason });
   if (claudeCredential(runtime.hostEnv) === void 0) return fail(AGENT_CREDENTIAL_MISSING);
-  const repository = item.specRepository;
-  if (repository === void 0 || repository === null || repository === "") {
-    return fail("the work item names no repository to clone");
-  }
+  const repositories = repositoriesOf({ repositories: input.repositories, repository: item.specRepository, branch: input.branch });
+  const primary = primaryOf(repositories);
+  if (primary === void 0) return fail("the work item names no repository to clone");
+  const repository = primary.repository;
   const engine = await host.version();
   if (engine === null) return fail("Docker is not available: `docker version` failed");
   if (!(Number.parseInt(engine, 10) >= MIN_ENGINE_MAJOR)) {
@@ -2385,6 +2422,7 @@ async function provisionContainer(input) {
     item: item.number,
     itemKey,
     repository,
+    repositories,
     hostEnv: runtime.hostEnv,
     containerEnv: report.apply.containerEnv,
     builtIns: true
@@ -2421,11 +2459,19 @@ async function provisionContainer(input) {
       err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's gh configuration could not be written: ${describeCallFailure(err)}`
     );
   }
+  for (const entry of repositories) {
+    if (entry.repository === primary.repository) continue;
+    try {
+      await tokens.token("read", entry.repository);
+    } catch (err) {
+      return bail(`the build's read token for ${entry.repository} could not be had: ${refusalCode(err)}`);
+    }
+  }
   keepGhConfigCurrent(tokens, buildDir2, (err) => log.error(`${tag} the read token could not be written for gh: ${describeCallFailure(err)}`));
   tokens.markUsed("read");
   environment.credentials = tokens.used();
   try {
-    const gitRemote = gitRemoteFor(runtime, { repository, branch: input.branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
+    const gitRemote = gitRemoteFor(runtime, { repositories, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`) });
     runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, jobDir, itemKey, true, gitRemote));
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
@@ -2476,7 +2522,8 @@ async function provisionContainer(input) {
   const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env, argv }, opts?.quiet === true ? void 0 : { logPath });
   const steps = await runBuildSteps({
     repository,
-    branch: input.branch,
+    branch: primary.branch,
+    repositories,
     lifecycle: report.apply.lifecycle,
     exec,
     log,
@@ -2519,6 +2566,7 @@ function containerCommandLine(input) {
     itemKey: input.job.itemKey,
     branch: input.job.branch,
     repository: state.repository,
+    repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     builtIns: state.builtIns === true,
@@ -2544,6 +2592,7 @@ function containerSenderCommand(input) {
     itemKey: input.job.itemKey,
     branch: input.job.branch,
     repository: state.repository,
+    repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     builtIns: state.builtIns === true,
@@ -2597,17 +2646,18 @@ async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, bui
     destinationOptions: runtime.destinationOptions
   });
 }
-async function ensureTunnel(runtime, state, jobDir, config, itemKey, branch) {
+async function ensureTunnel(runtime, state, jobDir, config, itemKey, branch, repositories) {
   if (runtime.tunnels.has(state.buildId)) return;
   const tokens = runtime.credentials.get(jobDir);
-  const gitRemote = tokens === void 0 || state.repository === void 0 || branch === void 0 ? void 0 : gitRemoteFor(runtime, { repository: state.repository, branch, tokens, buildDir: state.buildDir });
+  const served = repositoriesOf({ repositories, repository: state.repository, branch });
+  const gitRemote = tokens === void 0 || served.length === 0 ? void 0 : gitRemoteFor(runtime, { repositories: served, tokens, buildDir: state.buildDir });
   runtime.tunnels.set(state.buildId, await startServicesFor(runtime, config, state.buildDir, jobDir, itemKey, state.builtIns === true, gitRemote));
 }
 async function syncInContainer(input) {
   const { runtime, job } = input;
   const state = job.container;
   try {
-    await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch);
+    await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch, job.repositories);
     if (state.stopped) {
       await runtime.host.start(state.container);
       state.stopped = false;
@@ -2619,6 +2669,7 @@ async function syncInContainer(input) {
       itemKey: job.itemKey,
       branch: job.branch,
       repository: state.repository,
+      repositories: job.repositories,
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
       builtIns: state.builtIns === true,
@@ -2711,7 +2762,13 @@ async function startCheckContainer(input) {
   mkdirSync(buildDir2, { recursive: true });
   chmodSync(buildDir2, 493);
   try {
-    const gitRemote = gitRemoteFor(runtime, { repository, branch: job.branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`), readOnly: true });
+    const gitRemote = gitRemoteFor(runtime, {
+      repositories: repositoriesOf({ repositories: job.repositories, repository, branch: job.branch }),
+      tokens,
+      buildDir: buildDir2,
+      log: (line) => log.line(`${tag} ${line}`),
+      readOnly: true
+    });
     runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote));
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);

package/dist/{chunk-R2UYH4QV.js → chunk-EOWWTFUU.js}

@@ -1004,7 +1004,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-X45X7AS4.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-MKBX2ZQD.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-QSV4DYT2.js');
+    const { runnerHostChecks } = await import('./doctor-ZF4PYWVN.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1051,7 +1051,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync2 } = await import('fs');
       if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-PYNCWSTV.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-HKOVISUP.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-PDTSUOVT.js → chunk-FI5UYJMQ.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 15;
+var RUNNER_PROTOCOL = 16;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-V42JY4F6.js → chunk-HYZRY4KZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-S6IUUNCD.js';
-import { RELAY_PORT } from './chunk-M6G7TJVF.js';
+import { EXEC_PORT } from './chunk-RSNSZ2LJ.js';
+import { RELAY_PORT } from './chunk-4Q7OMKAT.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/chunk-O765JR4W.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var FILE = "update-pending.json";
+function readPendingUpdate(runnerDirPath) {
+  try {
+    const raw = JSON.parse(readFileSync(join(runnerDirPath, FILE), "utf8"));
+    if (typeof raw.version !== "string" || typeof raw.since !== "string") return void 0;
+    const record = { version: raw.version, since: raw.since };
+    const holding = raw.holding;
+    if (holding && Array.isArray(holding.builds) && typeof holding.since === "string") {
+      record.holding = { builds: holding.builds.filter((n) => typeof n === "number"), since: holding.since };
+    }
+    return record;
+  } catch {
+    return void 0;
+  }
+}
+function writePendingUpdate(runnerDirPath, record) {
+  const path = join(runnerDirPath, FILE);
+  if (record === void 0) {
+    if (existsSync(path)) rmSync(path);
+    return;
+  }
+  mkdirSync(runnerDirPath, { recursive: true, mode: RUNNER_DIR_MODE });
+  const temp = `${path}.partial-${process.pid}`;
+  writeFileSync(temp, JSON.stringify(record, null, 2), { mode: RUNNER_FILE_MODE });
+  renameSync(temp, path);
+}
+
+export { readPendingUpdate, writePendingUpdate };

package/dist/{chunk-6CXYORUS.js → chunk-QKFB4K7X.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-S6IUUNCD.js';
+import { EXEC_PORT } from './chunk-RSNSZ2LJ.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-ESZJ5QIC.js → chunk-R7BJYFD2.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-MC6J453K.js';
-import { describeCallFailure } from './chunk-BREEX2Z7.js';
+import { isPlaceholderCommand } from './chunk-7C4T5BGN.js';
+import { describeCallFailure } from './chunk-E5DC4VZL.js';
 import { WorkCommandError, getJson } from './chunk-DTDZXDQ3.js';
 import { sanitizeTerminal } from './chunk-VDI5POCC.js';
-import { builtinKind } from './chunk-M2PBLRB7.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-M6G7TJVF.js';
+import { builtinKind } from './chunk-XR3BJN33.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-S6IUUNCD.js → chunk-RSNSZ2LJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-M6G7TJVF.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-NTLGWCWK.js → chunk-TFIOXPZT.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { runnerUnit, UNIT_MARKER } from './chunk-FBTE2A2X.js';
 import { checkFit } from './chunk-JKIWMRFH.js';
-import { builtinKind } from './chunk-M2PBLRB7.js';
+import { builtinKind } from './chunk-XR3BJN33.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { dirname } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-M2PBLRB7.js → chunk-XR3BJN33.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-M6G7TJVF.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-4Q7OMKAT.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
@@ -86,8 +86,11 @@ var RUNNER_KEYS = [
   "build",
   "housekeeping",
   "checks",
-  "autoUpdate"
+  "autoUpdate",
+  "update"
 ];
+var UPDATE_KEYS = ["maxWaitHours"];
+var DEFAULT_UPDATE_MAX_WAIT_HOURS = 6;
 function runnerNumbers() {
   return [
     { key: "concurrency", min: 1 },
@@ -205,6 +208,7 @@ function loadRunnerConfig(configPath) {
   const build = resolveBuild(configPath, runner.build);
   const housekeeping = resolveHousekeeping(configPath, runner.housekeeping, build.disk);
   const checks = resolveChecks(configPath, runner.checks);
+  const update = resolveUpdate(configPath, runner.update);
   if (config.scrub?.literals !== void 0 && !Array.isArray(config.scrub.literals)) {
     fail(configPath, "scrub.literals", "must be a list of strings");
   }
@@ -233,6 +237,7 @@ function loadRunnerConfig(configPath) {
     build,
     housekeeping,
     checks,
+    update,
     // A host with executables of its own for provision and cleanup chose
     // its own environment, and an update could change what its hooks run
     // under; it opts in. The built-in hooks are the runner's own. Provision
@@ -300,6 +305,21 @@ function resolveChecks(configPath, block) {
   }
   return { timeLimitMinutes: limit };
 }
+function resolveUpdate(configPath, block) {
+  const given = block ?? {};
+  if (typeof given !== "object" || Array.isArray(given)) fail(configPath, "runner.update", "must be an object");
+  const keys = given;
+  for (const key of Object.keys(keys)) {
+    if (UPDATE_KEYS.includes(key)) continue;
+    const near = nearestKey(key, UPDATE_KEYS);
+    fail(configPath, `runner.update.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+  }
+  const hours = keys.maxWaitHours === void 0 ? DEFAULT_UPDATE_MAX_WAIT_HOURS : keys.maxWaitHours;
+  if (typeof hours !== "number" || !Number.isFinite(hours) || hours < 0) {
+    fail(configPath, "runner.update.maxWaitHours", "must be a number of hours, 0 or more");
+  }
+  return { maxWaitHours: hours };
+}
 function wholeBytes(bytes) {
   if (bytes === void 0) return void 0;
   const whole = Math.floor(bytes);
@@ -359,4 +379,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };