@outerlayer/cli 0.17.0 → 0.18.0

package/dist/{chunk-MAK5LYRF.js → chunk-Y5MXET4M.js}

@@ -1,28 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-KMDLFI4P.js';
-import { execCapture } from './chunk-QKFB4K7X.js';
-import { GUEST_CID } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson } from './chunk-S3NYLI2P.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-L2USZT6T.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, JUDGE_DIR, MAX_REPORT_BYTES } from './chunk-S26M3YBJ.js';
+import { execCapture } from './chunk-GGOMT6KF.js';
+import { GUEST_CID } from './chunk-X5H2WYMB.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, sharedSkillNames, shimScript } from './chunk-6CHIYEZZ.js';
+import { WorkCommandError } from './chunk-KK4VBOH6.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-R7PF5OOU.js';
-import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
-import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-4NPZVMJU.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath } from './chunk-4Q7OMKAT.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3CWUOFV6.js';
+import { RecipeError } from './chunk-QOZKPLVJ.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-JXYVA45C.js';
-import { defaultGitRunner, materializeContext } from './chunk-YZ5F4PIS.js';
-import { readContextManifest, readSourceCache } from './chunk-WTE3MQML.js';
-import { signingFetchFor } from './chunk-YO4PSLVB.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-OHVJA253.js';
-import { downconvertSession } from './chunk-J5M7BSJQ.js';
-import { signerFor } from './chunk-V7NIVOFD.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
-import { fstatSync, readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
-import { relative, join, dirname, basename } from 'path';
+import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
+import { currentCliBuild } from './chunk-OGFGZQA3.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-BMYGAGBJ.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-X5N6KC6V.js';
+import { downconvertSession } from './chunk-N3CUDFCW.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-N2PXGQRL.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BQXFBI7T.js';
+import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-G2YNJIGF.js';
+import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
+import { join, dirname, basename } from 'path';
 import { spawnSync, spawn } from 'child_process';
 import { availableParallelism, networkInterfaces } from 'os';
 import { randomBytes, createHash } from 'crypto';
@@ -35,294 +33,6 @@ import { isIP, connect, createServer as createServer$1 } from 'net';
 import { lookup } from 'dns/promises';
 
 createRequire(import.meta.url);
-function logStamp(at) {
-  return at.toISOString().replace(/\.\d{3}Z$/, "Z");
-}
-function sameDestination(stat = fstatSync) {
-  try {
-    const out = stat(1);
-    const err = stat(2);
-    return out.dev === err.dev && out.ino === err.ino;
-  } catch {
-    return false;
-  }
-}
-function createRunnerLog(now = () => /* @__PURE__ */ new Date(), io = { stdout: process.stdout, stderr: process.stderr, joined: () => sameDestination() }) {
-  const write = (stream, text) => {
-    stream.write(`${logStamp(now())} ${text}
-`);
-  };
-  return {
-    line: (text) => write(io.stdout, text),
-    error: (text) => {
-      write(io.stdout, text);
-      if (!io.joined()) write(io.stderr, text);
-    }
-  };
-}
-function formatDuration(ms) {
-  const total = Math.max(0, Math.round(ms / 1e3));
-  const hours = Math.floor(total / 3600);
-  const minutes = Math.floor(total % 3600 / 60);
-  const seconds = total % 60;
-  if (hours > 0) return `${hours}h ${minutes}m`;
-  if (minutes > 0) return `${minutes}m ${String(seconds).padStart(2, "0")}s`;
-  return `${seconds}s`;
-}
-function formatClock(at, today) {
-  const hhmm = `${String(at.getUTCHours()).padStart(2, "0")}:${String(at.getUTCMinutes()).padStart(2, "0")} UTC`;
-  const sameDay = at.getUTCFullYear() === today.getUTCFullYear() && at.getUTCMonth() === today.getUTCMonth() && at.getUTCDate() === today.getUTCDate();
-  if (sameDay) return hhmm;
-  const month = at.toLocaleString("en-US", { month: "short", timeZone: "UTC" });
-  return `${month} ${at.getUTCDate()} ${hhmm}`;
-}
-function shortClaim(claimId) {
-  return claimId.length <= 8 ? claimId : `${claimId.slice(0, 8)}\u2026`;
-}
-function relativeToRunner(runnerDirPath, path) {
-  const rel = relative(runnerDirPath, path);
-  return rel === "" || rel.startsWith("..") ? path : rel;
-}
-function describeCallFailure(err) {
-  if (err instanceof Error) {
-    const status = err.status;
-    return status === void 0 ? err.message : `${err.message} (${status})`;
-  }
-  return String(err);
-}
-
-// src/runner/retry.ts
-var RETRY_WINDOW_MS = 12e4;
-var FIRST_BACKOFF_MS = 1e3;
-var MAX_BACKOFF_MS = 15e3;
-function isRetryable(err) {
-  if (err instanceof WorkCommandError) return err.retryable;
-  return true;
-}
-async function retrySend(send, deps = {}) {
-  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const windowMs = deps.windowMs ?? RETRY_WINDOW_MS;
-  const startedMs = now().getTime();
-  let attempts = 0;
-  let backoffMs = FIRST_BACKOFF_MS;
-  for (; ; ) {
-    attempts++;
-    try {
-      return { ok: true, value: await send(), attempts };
-    } catch (err) {
-      const reason = describeCallFailure(err);
-      const code = err instanceof WorkCommandError ? err.code : void 0;
-      const status = err instanceof WorkCommandError ? err.status : void 0;
-      const message = err instanceof WorkCommandError ? err.message : void 0;
-      if (!isRetryable(err)) return { ok: false, attempts, reason, retryable: false, code, status, message };
-      const elapsedMs = now().getTime() - startedMs;
-      if (elapsedMs + backoffMs >= windowMs) return { ok: false, attempts, reason, retryable: true, code, status, message };
-      await sleep(backoffMs);
-      backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
-    }
-  }
-}
-
-// src/runner/build-tokens.ts
-var ISSUE_RETRY_WINDOW_MS = 3e4;
-var REVOKE_TIMEOUT_MS = 15e3;
-function isDue(expiresAtMs, nowMs) {
-  return nowMs >= expiresAtMs - 10 * 6e4;
-}
-function classifyRefusal(err) {
-  if (!(err instanceof WorkCommandError)) return { kind: "retry" };
-  if (err.status === 401 || err.code === "claim_expired" || err.code === "claim_not_held") return { kind: "lease_lost" };
-  if (err.code === "github_unavailable") return { kind: "retry" };
-  if (err.code === "github_request_failed") return { kind: "failed", reason: refusalCode(err) };
-  if (err.retryable && err.code !== "repository_tokens_unavailable") return { kind: "retry" };
-  return { kind: "failed", reason: refusalCode(err) };
-}
-function refusalCode(err) {
-  if (!(err instanceof WorkCommandError)) return "unavailable";
-  return err.code ?? `http_${err.status ?? "unknown"}`;
-}
-function keyOf(kind, repository) {
-  return repository === void 0 ? kind : `${kind}:${repository}`;
-}
-var BuildTokens = class {
-  constructor(options) {
-    this.options = options;
-    this.held = /* @__PURE__ */ new Map();
-    this.asking = /* @__PURE__ */ new Map();
-    this.issued = [];
-    this.usedKinds = /* @__PURE__ */ new Set();
-    this.revoked = false;
-    this.controlPlaneRetry = false;
-  }
-  now() {
-    return (this.options.now ?? (() => /* @__PURE__ */ new Date()))();
-  }
-  /** `repository` as the holder keys it: `undefined` for the primary, which is the one a request names no repository for. */
-  secondary(repository) {
-    if (repository === void 0) return void 0;
-    const primary = this.options.primary;
-    return primary !== void 0 && primary.toLowerCase() === repository.toLowerCase() ? void 0 : repository;
-  }
-  /**
-   * The token of `kind` for `repository`, or for the primary when none is
-   * named, asking the gateway for a new one when the build holds none or its
-   * token is within ten minutes of expiry.
-   */
-  token(kind, repository) {
-    const other = this.secondary(repository);
-    const key = keyOf(kind, other);
-    const held = this.held.get(key);
-    if (held !== void 0 && !isDue(held.expiresAtMs, this.now().getTime())) return Promise.resolve(held.token);
-    let asking = this.asking.get(key);
-    if (asking === void 0) {
-      asking = this.issueOrKeep(kind, other).finally(() => this.asking.delete(key));
-      this.asking.set(key, asking);
-    }
-    return asking;
-  }
-  /** A due token that has not yet expired is kept when the gateway cannot issue a new one. */
-  async issueOrKeep(kind, repository) {
-    try {
-      return await this.issue(kind, repository);
-    } catch (err) {
-      const held = this.held.get(keyOf(kind, repository));
-      if (held !== void 0 && this.now().getTime() < held.expiresAtMs && classifyRefusal(err).kind === "retry") return held.token;
-      throw err;
-    }
-  }
-  /** Asks the gateway for a token with `body`, retrying a failure about the moment. */
-  ask(body) {
-    const { config, item, fetchImpl } = this.options;
-    return retrySend(
-      async () => {
-        try {
-          return await postJson(
-            config.url,
-            `/v1/work-items/${item}/claim/tokens`,
-            config.apiKey,
-            config.appId,
-            body,
-            fetchImpl,
-            void 0,
-            await signerFor(config.configPath)
-          );
-        } catch (err) {
-          if (err instanceof WorkCommandError && (err.code === "repository_tokens_unavailable" || err.code === "github_request_failed")) {
-            throw new WorkCommandError(err.message, false, err.status, err.code);
-          }
-          throw err;
-        }
-      },
-      { now: this.options.now, sleep: this.options.sleep, windowMs: ISSUE_RETRY_WINDOW_MS }
-    );
-  }
-  /**
-   * A read-only token for the repository that governs the item's, which the
-   * runner uses on the host to fetch its context. It is revoked with the
-   * others when the attempt ends. It is not held or renewed: nothing uses it
-   * after the fetch. A refusal is thrown with the gateway's code. A lost
-   * lease is kept for `refusal()`, and a failure about the moment for
-   * `controlPlaneUnavailable()`, as the read token's are.
-   */
-  async controlPlane() {
-    const asked = await this.ask({ access: "read", target: "control_plane" });
-    if (!asked.ok) {
-      const err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
-      const refusal = classifyRefusal(err);
-      if (refusal.kind === "lease_lost") this.failure = refusal;
-      if (refusal.kind === "retry") this.controlPlaneRetry = true;
-      throw err;
-    }
-    const { token, expiresAt, repository } = asked.value.data;
-    if (typeof token !== "string" || token === "" || typeof expiresAt !== "string" || typeof repository !== "string" || repository === "") {
-      throw new WorkCommandError("the gateway's token answer carried no token, expiry or repository", false, void 0, "malformed_token_response");
-    }
-    if (this.revoked) {
-      await this.revoke([token]);
-      throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
-    }
-    this.issued.push(token);
-    return { token, expiresAt, repository };
-  }
-  async issue(kind, repository) {
-    const asked = await this.ask({ access: kind, ...repository === void 0 ? {} : { repository } });
-    let err;
-    if (!asked.ok) {
-      err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
-    } else {
-      const { token, expiresAt } = asked.value.data;
-      const expiresAtMs = typeof expiresAt === "string" ? Date.parse(expiresAt) : Number.NaN;
-      if (typeof token === "string" && token !== "" && Number.isFinite(expiresAtMs)) {
-        if (this.revoked) {
-          await this.revoke([token]);
-          throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
-        }
-        this.held.set(keyOf(kind, repository), { token, expiresAtMs });
-        this.issued.push(token);
-        if (kind === "read" && repository === void 0) this.readSink?.(token);
-        return token;
-      }
-      err = new WorkCommandError("the gateway's token answer carried no token or no expiry", false, void 0, "malformed_token_response");
-    }
-    const refusal = classifyRefusal(err);
-    if (refusal.kind !== "retry") this.failure = refusal;
-    throw err;
-  }
-  /** Asks for a new read token when the build holds one within ten minutes of expiry. A refusal is kept for `refusal()`, not thrown. */
-  async renewReadIfDue() {
-    const held = this.held.get("read");
-    if (held === void 0 || !isDue(held.expiresAtMs, this.now().getTime())) return;
-    await this.token("read").catch(() => void 0);
-  }
-  /** Calls `sink` with the read token now, and again with each one that replaces it. */
-  onRead(sink) {
-    this.readSink = sink;
-    const held = this.held.get("read");
-    if (held !== void 0) sink(held.token);
-  }
-  markUsed(kind) {
-    if (this.usedKinds.has(kind)) return;
-    this.usedKinds.add(kind);
-    this.options.onUsed?.(this.used());
-  }
-  /** The kinds of token the build has used, read before push. */
-  used() {
-    return ["read", "push"].filter((kind) => this.usedKinds.has(kind));
-  }
-  /** The last refusal that ends the build, if a renewal or a push's token request met one. */
-  refusal() {
-    return this.failure;
-  }
-  /** Whether a control plane token request failed for a reason about the moment, which a later attempt may not meet. */
-  controlPlaneUnavailable() {
-    return this.controlPlaneRetry;
-  }
-  /** Revokes every token this holder was issued, the superseded ones too, at GitHub with the token itself. A failure is not an error: the token lapses within the hour. */
-  async revokeAll() {
-    this.revoked = true;
-    const tokens = this.issued.splice(0);
-    this.held.clear();
-    await this.revoke(tokens);
-  }
-  async revoke(tokens) {
-    const apiUrl = this.options.apiUrl ?? "https://api.github.com";
-    await Promise.allSettled(
-      tokens.map(
-        (token) => this.options.fetchImpl(`${apiUrl}/installation/token`, {
-          method: "DELETE",
-          headers: {
-            authorization: `Bearer ${token}`,
-            accept: "application/vnd.github+json",
-            "x-github-api-version": "2022-11-28",
-            "user-agent": "outerlayer-runner"
-          },
-          signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
-        })
-      )
-    );
-  }
-};
 var BUILD_PREFIX = "build-";
 var LEAF = "runner";
 function serviceDirectory(selfCgroup, mount) {
@@ -685,6 +395,60 @@ async function ensureAssets(options) {
   const helper = await ensureFile(dir, `outerlayer-guest-${arch}`, pins.helper, fetchImpl, 493);
   return { firecracker, kernel, helper, helperSha256: pins.helper.sha256 };
 }
+
+// src/runner/container/docker.ts
+function parseImageConfig(json) {
+  const config = JSON.parse(json);
+  const env = {};
+  for (const entry of config.Env ?? []) {
+    const eq = entry.indexOf("=");
+    if (eq > 0) env[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return { user: config.User ?? "", env };
+}
+function createContainerHost(deps = {}) {
+  const run = deps.run ?? spawnRun;
+  return {
+    async version() {
+      const result = await run("docker", ["version", "--format", "{{.Server.Version}}"]);
+      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
+    },
+    async operatingSystem() {
+      const result = await run("docker", ["info", "--format", "{{.OperatingSystem}}"]);
+      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
+    },
+    async imageConfig(imageId) {
+      const result = await run("docker", ["image", "inspect", "--format", "{{json .Config}}", imageId]);
+      return result.status === 0 ? parseImageConfig(result.stdout) : { user: "", env: {} };
+    },
+    createVolume(name, labels) {
+      const flags = Object.entries(labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+      return run("docker", ["volume", "create", ...flags, name]);
+    },
+    removeVolume(name) {
+      return run("docker", ["volume", "rm", "--force", name]);
+    },
+    run(args, opts) {
+      return run("docker", ["run", ...args], opts);
+    },
+    exec(input, opts) {
+      const env = {};
+      for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
+      return run("docker", ["exec", ...containerExecArgs(input)], { ...opts, env });
+    },
+    stop(container) {
+      return run("docker", ["stop", container]);
+    },
+    start(container) {
+      return run("docker", ["start", container]);
+    },
+    remove(container) {
+      return run("docker", ["rm", "--force", "--volumes", container]);
+    }
+  };
+}
+
+// src/runner/microvm/disks.ts
 function converterScript() {
   return [
     "set -eu",
@@ -751,13 +515,13 @@ function exportInto(container, converter) {
     exporter.once("error", reject);
     writer.once("error", reject);
     let exits = 0;
-    let failure;
+    let failure2;
     const done = (name, code) => {
-      if (code !== 0 && failure === void 0) failure = `${name} exited ${code}`;
+      if (code !== 0 && failure2 === void 0) failure2 = `${name} exited ${code}`;
       exits += 1;
       if (exits < 2) return;
-      if (failure === void 0) resolve();
-      else reject(new Error(`${failure}: ${firstLine2(errors.join("\n"))}`));
+      if (failure2 === void 0) resolve();
+      else reject(new Error(`${failure2}: ${firstLine2(errors.join("\n"))}`));
     };
     exporter.once("exit", (code) => done("docker export", code));
     writer.once("exit", (code) => done("the converter", code));
@@ -783,13 +547,7 @@ function createRootfsHost() {
     async imageConfig(imageId) {
       const inspected = await spawnRun("docker", ["image", "inspect", "--format", "{{json .Config}}", imageId], { env: env() });
       if (inspected.status !== 0) throw new Error(`docker image inspect ${imageId} failed: ${firstLine2(inspected.stderr)}`);
-      const config = JSON.parse(inspected.stdout);
-      const variables = {};
-      for (const entry of config.Env ?? []) {
-        const eq = entry.indexOf("=");
-        if (eq > 0) variables[entry.slice(0, eq)] = entry.slice(eq + 1);
-      }
-      return { env: variables, user: config.User ?? "" };
+      return parseImageConfig(inspected.stdout);
     }
   };
 }
@@ -940,8 +698,6 @@ function createMicroVmPorts(over = {}) {
     exec: over.exec ?? execCapture
   };
 }
-
-// src/runner/build-steps.ts
 var aborted = () => ({ ok: false, reason: "", aborted: true });
 function firstLine3(text) {
   return text.trim().split("\n")[0] ?? "";
@@ -950,14 +706,43 @@ function gitErrorLine(text) {
   const lines = text.split("\n").map((line) => line.trim()).filter((line) => line !== "");
   return lines.find((line) => /^(fatal|error):/.test(line)) ?? lines.at(-1) ?? "";
 }
-function adoptionFailureReason(result) {
-  const line = result.stdout.trim().split("\n").at(-1) ?? "";
-  try {
-    const answer = JSON.parse(line);
-    if (typeof answer.code === "string" && typeof answer.message === "string") return `${answer.code}: ${answer.message}`;
-  } catch {
-  }
-  return `context_adoption_failed: adopting the control plane's context failed (exit ${result.status})${firstLine3(result.stderr) === "" ? "" : `: ${firstLine3(result.stderr)}`}`;
+var STAGED_TREE = `${JOB_MOUNT}/context/tree`;
+var DELIVER_SCRIPT = [
+  "set -e",
+  'src="$1"; dest="$2"',
+  'if [ -e "$dest" ]; then chmod -R u+w "$dest"; rm -rf "$dest"; fi',
+  'mkdir -p "$dest"',
+  "for entry in AGENTS.md CLAUDE.md settings.json .claude .outerlayer; do",
+  '  if [ -e "$src/$entry" ]; then cp -R "$src/$entry" "$dest/"; fi',
+  "done",
+  'chmod -R a-w "$dest"'
+].join("\n");
+var RECORD_SCRIPT = 'd="$(git rev-parse --git-common-dir)" && mkdir -p "$d/outerlayer" && printf "%s" "$1" > "$d/outerlayer/delivery.json"';
+var WRITE_SHIM_SCRIPT = 'mkdir -p "$1" && printf "%s" "$2" > "$1/claude" && chmod 755 "$1/claude"';
+function failure(what, result) {
+  return `context_delivery_failed: ${what} (exit ${result.status})${firstLine3(result.stderr) === "" ? "" : `: ${firstLine3(result.stderr)}`}`;
+}
+async function deliveryRefusal(input, staged) {
+  if (input.agentVersion !== void 0 && !versionAtLeast(input.agentVersion)) {
+    return `context_agent_too_old: the build image's Claude Code is ${input.agentVersion}, and a governed build needs ${MINIMUM_CLAUDE_VERSION} or later to load its control plane's instructions; rebuild the image`;
+  }
+  const own = await input.exec(["ls", "-1", ".claude/skills"], CHECKOUT_DIR, { quiet: true });
+  if (own.status !== 0) return void 0;
+  const ownNames = new Set(own.stdout.split("\n").map((name) => name.trim()));
+  const clash = sharedSkillNames(join(staged.dir, "tree")).find((name) => ownNames.has(name));
+  if (clash === void 0) return void 0;
+  return `context_skill_conflict: .claude/skills/${clash} in ${input.repository} has the same name as the shared skill ${clash} from ${staged.repository}, and would replace it in this build; rename or remove it from the repository`;
+}
+async function deliver(input, staged) {
+  const dir = deliveryDir(staged.repository, staged.sha);
+  const copied = await input.exec(["sh", "-c", DELIVER_SCRIPT, "deliver", STAGED_TREE, dir], "/build/work");
+  if (copied.status !== 0) return { ok: false, reason: failure("copying the control plane into the build failed", copied) };
+  const shim = await input.exec(["sh", "-c", WRITE_SHIM_SCRIPT, "shim", SHIM_DIR, shimScript()], "/build/work");
+  if (shim.status !== 0) return { ok: false, reason: failure("writing the claude shim failed", shim) };
+  const record = JSON.stringify({ schemaVersion: 1, repository: staged.repository, ref: staged.ref, sha: staged.sha, dir });
+  const recorded = await input.exec(["sh", "-c", RECORD_SCRIPT, "record", record], CHECKOUT_DIR);
+  if (recorded.status !== 0) return { ok: false, reason: failure("recording the delivery failed", recorded) };
+  return { ok: true };
 }
 async function checkOut(input, entry) {
   const { exec, log, tag } = input;
@@ -983,6 +768,18 @@ async function checkOut(input, entry) {
     throw err;
   }
 }
+var DEVCONTAINER_FILES = [".devcontainer/devcontainer.json", ".devcontainer.json"];
+async function noteIgnoredDevcontainers(input, repositories, governing) {
+  for (const entry of repositories) {
+    if (entry.repository.toLowerCase() === governing.toLowerCase()) continue;
+    for (const file of DEVCONTAINER_FILES) {
+      const probe = await input.exec(["test", "-f", file], checkoutPath(entry), { quiet: true });
+      if (probe.status !== 0) continue;
+      input.log.line(`${input.tag} ${entry.repository} has its own ${file}; it is ignored, and the control plane's ${governing} devcontainer is used instead`);
+      break;
+    }
+  }
+}
 async function runBuildSteps(input) {
   const { exec, log, tag, repository } = input;
   let startCommit = "";
@@ -993,33 +790,44 @@ async function runBuildSteps(input) {
   const first = await checkOut(input, { ...primary, primary: true });
   if (!first.ok) return first;
   startCommit = first.startCommit;
+  if (repositories.length > 1) {
+    const linkPath = repositoryPath(primary.repository);
+    const linked = await exec(["sh", "-c", 'mkdir -p "$(dirname "$1")" && ln -s "$2" "$1"', "link", linkPath, CHECKOUT_DIR], "/build/work");
+    if (linked.status !== 0) return { ok: false, reason: `linking ${primary.repository} at ${linkPath} failed (exit ${linked.status})` };
+  }
   for (const entry of repositories.filter((candidate) => candidate.repository !== primary.repository)) {
     if (input.aborted()) return aborted();
     const checked = await checkOut(input, { ...entry, primary: false });
     if (!checked.ok) return checked;
   }
+  if (input.governing !== void 0) await noteIgnoredDevcontainers(input, repositories, input.governing.repository);
+  const lifecycleDir = lifecycleWorkdir(repositories, input.governing?.repository);
   for (const step of lifecycleSteps(input.lifecycle)) {
     if (input.aborted()) return aborted();
     log.line(`${tag} lifecycle ${step.name} (${step.source})`);
-    const ran = await exec(step.argv, CHECKOUT_DIR);
+    const ran = await exec(step.argv, lifecycleDir);
     if (ran.status !== 0) return { ok: false, reason: lifecycleFailureReason(step, ran.status) };
   }
   if (input.aborted()) return aborted();
   const staged = await input.stageContext();
   if (staged.kind === "refused") return { ok: false, reason: staged.reason };
+  let controlPlane;
   if (staged.kind === "staged") {
     try {
-      const delivered = await input.deliverContext?.(staged) ?? { ok: true };
-      if (!delivered.ok) return { ok: false, reason: delivered.reason };
-      const adopted = await exec(["outerlayer", "context", "adopt", `${JOB_MOUNT}/context`, "--json"], CHECKOUT_DIR);
-      if (adopted.status !== 0) return { ok: false, reason: adoptionFailureReason(adopted) };
-      log.line(`${tag} governed context ${staged.sha.slice(0, 7)} adopted (${staged.files.length} files)`);
+      const refusal = await deliveryRefusal(input, staged);
+      if (refusal !== void 0) return { ok: false, reason: refusal };
+      const handed = await input.deliverContext?.(staged) ?? { ok: true };
+      if (!handed.ok) return { ok: false, reason: handed.reason };
+      const delivered = await deliver(input, staged);
+      if (!delivered.ok) return delivered;
+      controlPlane = { repository: staged.repository, commit: staged.sha };
+      log.line(`${tag} governed context ${staged.sha.slice(0, 7)} delivered to ${deliveryDir(staged.repository, staged.sha)} (${staged.files.length} files)`);
     } finally {
       input.removeStagedContext();
     }
     if (input.aborted()) return aborted();
   }
-  return { ok: true, startCommit };
+  return { ok: true, startCommit, ...controlPlane === void 0 ? {} : { controlPlane } };
 }
 var EVAL_INPUT_NAME = "eval-input";
 var TRANSCRIPT_ROOT = "/build/home/.claude/projects";
@@ -1214,6 +1022,28 @@ async function writeEvalInput(request) {
   writeReadOnly(join(dir, "activity.json"), `${JSON.stringify(activity, null, 2)}
 `);
 }
+var MAX_TREE_FILES = 2e4;
+var MAX_TREE_FILE_BYTES = 1024 * 1024;
+function copyJudgeTree(from, to, limits2 = { files: MAX_TREE_FILES, bytes: MAX_TREE_FILE_BYTES }) {
+  let copied = 0;
+  const walk = (src, dest, top) => {
+    mkdirSync(dest);
+    chmodSync(dest, 493);
+    for (const name of readdirSync(src).sort()) {
+      if (copied >= limits2.files) return;
+      if (top && name === ".git") continue;
+      const path = join(src, name);
+      const stat = lstatSync(path);
+      if (stat.isDirectory()) walk(path, join(dest, name), false);
+      else if (stat.isFile() && stat.size <= limits2.bytes) {
+        copyFileSync(path, join(dest, name));
+        chmodSync(join(dest, name), 420);
+        copied += 1;
+      }
+    }
+  };
+  walk(from, to, true);
+}
 
 // src/runner/container/agent-user.ts
 var ADDED_USER = "ol-agent";
@@ -1228,189 +1058,6 @@ async function resolveAgentUser(input) {
   if (uid === null) throw new AgentUserError(`the user "${candidate}" is not in the image, so no command can run as it`);
   return uid === 0 ? ADDED_USER : candidate;
 }
-var TokenRefused = class extends Error {
-  constructor(code, detail) {
-    super(code);
-    this.code = code;
-    this.detail = detail;
-  }
-};
-var NoControlPlane = class extends Error {
-};
-var GatewayConflict = class extends Error {
-};
-var unavailable = (why) => ({ kind: "refused", reason: `context_unavailable: ${why}` });
-var DESIGNATION_LOOKUP = { timeoutMs: 1e4, attempts: 2 };
-function lookupFailureReason(failure, repository) {
-  switch (failure?.kind) {
-    case "timeout":
-      return `the gateway did not answer which repository governs ${repository} within ${failure.timeoutMs / 1e3} seconds, twice`;
-    case "status":
-      return `the gateway answered ${failure.status} when asked which repository governs ${repository}`;
-    case "network":
-      return `the request asking which repository governs ${repository} failed: ${failure.message}`;
-    default:
-      return `the gateway did not say which repository governs ${repository}`;
-  }
-}
-function makeReadable(tree, dir, files) {
-  chmodSync(dir, 493);
-  chmodSync(tree, 493);
-  const directories = /* @__PURE__ */ new Set();
-  for (const rel of files) {
-    for (let current = dirname(join(tree, rel)); current !== tree; current = dirname(current)) directories.add(current);
-    chmodSync(join(tree, rel), (lstatSync(join(tree, rel)).mode & 73) !== 0 ? 493 : 420);
-  }
-  for (const directory of directories) chmodSync(directory, 493);
-}
-async function stageGovernedContext(input) {
-  const git2 = input.git ?? defaultGitRunner;
-  const dir = stagedContextDir(input.buildDir);
-  const tree = join(dir, "tree");
-  const finish = (outcome) => {
-    removeStagedContext(input.buildDir);
-    return outcome;
-  };
-  try {
-    mkdirSync(tree, { recursive: true });
-    for (const args of [
-      ["init", "-q", "--initial-branch=main", tree],
-      ["-C", tree, "remote", "add", "origin", `https://github.com/${input.repository}.git`]
-    ]) {
-      const done = git2(args, { cwd: dir, timeoutMs: 1e4 });
-      if (!done.ok) return finish(unavailable(`the staging directory could not be prepared: ${done.stderr.trim().split("\n")[0] ?? ""}`));
-    }
-    const { url, apiKey, appId, configPath } = input.config;
-    let tokenRepository;
-    const credentialFor = (repository) => tokenRepository !== void 0 && tokenRepository.toLowerCase() === repository.toLowerCase() ? "the token the gateway issued" : "the host's git login";
-    const unreadable = (repositories) => repositories.map((repository) => `${credentialFor(repository)} cannot read ${repository}`).join(" and ");
-    const result = await materializeContext({
-      cwd: tree,
-      sessionId: `build-${input.buildId}`,
-      home: contextHomeDir(configPath),
-      cloud: { url, apiKey, appId },
-      fetchImpl: signingFetchFor(input.fetchImpl, configPath, apiKey),
-      designationLookup: DESIGNATION_LOOKUP,
-      git: git2,
-      now: input.now,
-      resolveControlPlaneUrl: (repository) => input.controlPlaneUrl(repository),
-      controlPlaneAccess: input.controlPlaneToken === void 0 ? void 0 : async (candidates) => {
-        const access = await controlPlaneAccess(input.controlPlaneToken, candidates, input.repository, input.log, input.tag);
-        tokenRepository = access?.repository;
-        return access;
-      }
-    });
-    switch (result.status) {
-      case "materialized": {
-        if (result.unfetched !== void 0 && result.unfetched.length > 0) {
-          return finish(unavailable(`${unreadable(result.unfetched)}, a control plane named for ${input.repository}, so it cannot be ruled out as a second claimant`));
-        }
-        const manifest = readContextManifest(join(tree, ".git"));
-        const source = readSourceCache(join(tree, ".git"));
-        if (result.sha === null || manifest === void 0 || source?.status !== "governed" || source.repository === void 0 || source.ref === void 0) {
-          return finish(unavailable(`the context of ${input.repository} was materialized without a record of it`));
-        }
-        writeFileSync(
-          join(dir, "staged.json"),
-          JSON.stringify({ schemaVersion: 1, sha: result.sha, repository: source.repository, ref: source.ref, files: manifest.files }) + "\n"
-        );
-        makeReadable(tree, dir, manifest.files);
-        chmodSync(join(dir, "staged.json"), 420);
-        return { kind: "staged", dir, sha: result.sha, files: manifest.files };
-      }
-      case "self":
-        if (result.unfetched !== void 0 && result.unfetched.length > 0) {
-          return finish(unavailable(`${unreadable(result.unfetched)}, the control plane named for ${input.repository}`));
-        }
-        if (result.designation === "answered") return finish({ kind: "none" });
-        if (result.authRejected === true) {
-          return finish(unavailable(`the gateway rejected the runner's API key (401/403) when asked which repository governs ${input.repository}`));
-        }
-        return finish(unavailable(lookupFailureReason(result.lookupFailure, input.repository)));
-      case "conflict":
-        return finish({ kind: "refused", reason: `context_conflict: ${result.message ?? "two control planes claim this repository"}` });
-      default:
-        return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
-    }
-  } catch (err) {
-    if (err instanceof NoControlPlane) return finish({ kind: "none" });
-    if (err instanceof GatewayConflict) return finish({ kind: "refused", reason: `context_conflict: ${err.message}` });
-    if (err instanceof TokenRefused) {
-      return finish(
-        unavailable(
-          err.detail === void 0 ? `the gateway refused a token for the control plane named for ${input.repository} (${err.code})` : `the token request for the control plane named for ${input.repository} failed: ${err.detail}`
-        )
-      );
-    }
-    return finish(unavailable(`the context of ${input.repository} could not be staged: ${err instanceof Error ? err.message : String(err)}`));
-  }
-}
-async function controlPlaneAccess(ask, candidates, repository, log, tag) {
-  let answer;
-  try {
-    answer = await ask();
-  } catch (err) {
-    const code = refusalCode(err);
-    if (code === "repository_tokens_unavailable") return void 0;
-    if (code === "no_control_plane") throw new NoControlPlane(code);
-    if (code === "context_conflict") throw new GatewayConflict(err instanceof Error ? err.message : code);
-    throw new TokenRefused(code, err instanceof WorkCommandError && err.code === void 0 && err.status === void 0 ? describeCallFailure(err) : void 0);
-  }
-  const named = candidates.some((candidate) => candidate.repository.toLowerCase() === answer.repository.toLowerCase());
-  if (!named) {
-    log?.line(
-      `${tag === void 0 ? "" : `${tag} `}the gateway issued a control plane token for ${answer.repository}, which is none of the repositories named for ${repository} (${candidates.map((candidate) => candidate.repository).join(", ")}) \xB7 fetching with the host's git login`
-    );
-    return void 0;
-  }
-  return answer;
-}
-function removeStagedContext(buildDir2) {
-  rmSync(stagedContextDir(buildDir2), { recursive: true, force: true });
-}
-
-// src/runner/container/docker.ts
-function createContainerHost(deps = {}) {
-  const run = deps.run ?? spawnRun;
-  return {
-    async version() {
-      const result = await run("docker", ["version", "--format", "{{.Server.Version}}"]);
-      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
-    },
-    async operatingSystem() {
-      const result = await run("docker", ["info", "--format", "{{.OperatingSystem}}"]);
-      return result.status === 0 && result.stdout.trim() !== "" ? result.stdout.trim() : null;
-    },
-    async imageUser(imageId) {
-      const result = await run("docker", ["image", "inspect", "--format", "{{.Config.User}}", imageId]);
-      return result.status === 0 ? result.stdout.trim() : "";
-    },
-    createVolume(name, labels) {
-      const flags = Object.entries(labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
-      return run("docker", ["volume", "create", ...flags, name]);
-    },
-    removeVolume(name) {
-      return run("docker", ["volume", "rm", "--force", name]);
-    },
-    run(args, opts) {
-      return run("docker", ["run", ...args], opts);
-    },
-    exec(input, opts) {
-      const env = {};
-      for (const [name, value] of Object.entries(input.env.passed)) if (value !== void 0) env[name] = value;
-      return run("docker", ["exec", ...containerExecArgs(input)], { ...opts, env });
-    },
-    stop(container) {
-      return run("docker", ["stop", container]);
-    },
-    start(container) {
-      return run("docker", ["start", container]);
-    },
-    remove(container) {
-      return run("docker", ["rm", "--force", "--volumes", container]);
-    }
-  };
-}
 var FILE_MODE = 420;
 var DIR_MODE = 493;
 function replaceFile(path, text) {
@@ -2298,6 +1945,7 @@ function createContainerRuntime(opts = {}) {
         configPath: build.configPath,
         cli: cli ?? currentCliBuild(),
         readToken: build.readToken,
+        pinned: build.pinned,
         guestHelper: build.guestHelper,
         log: build.log
       },
@@ -2368,8 +2016,9 @@ async function obtainImage(input) {
     if (input.aborted()) return { ok: false, reason: "ended before provision finished", aborted: true };
     let readToken;
     try {
-      readToken = await tokens.token("read");
+      readToken = input.pinned === void 0 ? await tokens.token("read") : await controlPlaneReadToken(tokens, repository);
     } catch (err) {
+      if (input.pinned !== void 0) return { ok: false, reason: controlPlaneTokenFailure(err, input.governedRepository ?? repository) };
       return {
         ok: false,
         reason: err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's read token could not be had: ${describeCallFailure(err)}`
@@ -2383,6 +2032,7 @@ async function obtainImage(input) {
           configPath: config.configPath,
           buildMemory: config.build?.memory ?? "8g",
           readToken,
+          pinned: input.pinned,
           guestHelper: input.guestHelper,
           log: (line) => log.line(`${tag} ${line}`)
         })
@@ -2402,6 +2052,16 @@ async function obtainImage(input) {
     }
   }
 }
+async function controlPlaneReadToken(tokens, controlPlane) {
+  try {
+    const issued = await tokens.controlPlane();
+    return issued.repository.toLowerCase() === controlPlane.toLowerCase() ? issued.token : void 0;
+  } catch (err) {
+    const code = refusalCode(err);
+    if (code === "repository_tokens_unavailable" || code === "no_control_plane" || code === "context_conflict") return void 0;
+    throw err;
+  }
+}
 async function provisionContainer(input) {
   const { config, runtime, item, itemKey, jobDir, log, tokens } = input;
   const { host } = runtime;
@@ -2421,7 +2081,23 @@ async function provisionContainer(input) {
   if (/docker desktop/i.test(await host.operatingSystem() ?? "")) {
     return fail("Docker Desktop cannot pass the tunnel's socket into a container, so container builds need Docker Engine: install it (on Windows, inside WSL2) or use builtin:process");
   }
-  const obtained = await obtainImage({ config, runtime, tokens, repository, tag, log, aborted: input.aborted, deadlineMs: input.deadlineMs, now: input.now });
+  const governing = await resolveGoverningSource({ config, repository, fetchImpl: input.fetchImpl });
+  if (!governing.ok) return fail(governing.reason);
+  const governingSource = governing.source;
+  const imageRepository = governingSource.kind === "governed" ? governingSource.repository : repository;
+  const obtained = await obtainImage({
+    config,
+    runtime,
+    tokens,
+    repository: imageRepository,
+    pinned: governingSource.kind === "governed" ? { commit: governingSource.sha, ref: governingSource.ref } : void 0,
+    governedRepository: repository,
+    tag,
+    log,
+    aborted: input.aborted,
+    deadlineMs: input.deadlineMs,
+    now: input.now
+  });
   if (!obtained.ok) return obtained.aborted === true ? { ok: false, reason: obtained.reason, aborted: true } : fail(obtained.reason);
   const built = obtained.built;
   const { report } = built;
@@ -2438,9 +2114,10 @@ async function provisionContainer(input) {
     containerEnv: report.apply.containerEnv,
     builtIns: true,
     lifecycle: report.apply.lifecycle,
+    ...governingSource.kind === "governed" ? { governing: { repository: governingSource.repository, ref: governingSource.ref, commit: governingSource.sha } } : {},
     cpuset: formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4))
   };
-  const env = buildEnvironment({
+  const envInput = {
     config,
     item: item.number,
     itemKey,
@@ -2449,7 +2126,8 @@ async function provisionContainer(input) {
     hostEnv: runtime.hostEnv,
     containerEnv: report.apply.containerEnv,
     builtIns: true
-  });
+  };
+  const env = buildEnvironment(envInput);
   if (env.skippedTokenVariables.length > 0) {
     log.line(`${tag} not passing ${env.skippedTokenVariables.join(", ")} from runner.build.variables into the build: its repository token comes from the runner`);
   }
@@ -2504,6 +2182,9 @@ async function provisionContainer(input) {
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
   if (input.aborted()) return bail("", true);
+  const judgeDir = join(jobDir, "judge");
+  mkdirSync(judgeDir, { recursive: true });
+  chmodSync(judgeDir, 493);
   const runInput = {
     buildId,
     runnerId,
@@ -2514,7 +2195,8 @@ async function provisionContainer(input) {
     user: ADDED_USER,
     limits: limits2,
     destinations: config.build?.destinations?.length ?? 0,
-    builtIns: true
+    builtIns: true,
+    judgeDir
   };
   const prepared = await host.run(prepareRunArgs(runInput), { logPath });
   if (prepared.status !== 0) return dockerFailed("preparing the build's volume", prepared);
@@ -2522,12 +2204,13 @@ async function provisionContainer(input) {
   if (started.status !== 0) return dockerFailed("starting the build's container", started);
   if (input.aborted()) return bail("", true);
   if (!await waitForRelay(runtime, state)) return bail("the relay in the build's container did not start");
-  const imageUser = await host.imageUser(report.imageId);
+  const imageConfig = await host.imageConfig(report.imageId);
+  state.imageEnv = imageConfig.env;
   let agentUser;
   try {
     agentUser = await resolveAgentUser({
       remoteUser: report.apply.remoteUser,
-      imageUser,
+      imageUser: imageConfig.user,
       probe: async (user) => {
         const probe = await host.exec({ container: name, user: ADDED_USER, env: NO_ENV, argv: ["id", "-u", user] });
         const uid = Number(probe.stdout);
@@ -2540,13 +2223,20 @@ async function provisionContainer(input) {
   }
   state.agentUser = agentUser;
   const tools = await host.exec({ container: name, user: ADDED_USER, env: NO_ENV, argv: ["cat", "/opt/outerlayer/tools.json"] });
-  environment.agentVersion = agentVersionOf(tools.status === 0 ? tools.stdout : "");
+  const agentVersion = agentVersionOf(tools.status === 0 ? tools.stdout : "");
+  environment.agentVersion = agentVersion;
+  const program = await host.exec({ container: name, user: ADDED_USER, env: NO_ENV, argv: [...HASH_ARGV] });
+  const hashed = program.status === 0 ? parseProgramHash(program.stdout) : void 0;
+  if (hashed !== void 0) state.judgeProgram = { path: JUDGE_PROGRAM, sha256: hashed };
   input.save(state, environment);
-  const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env, argv }, opts?.quiet === true ? void 0 : { logPath });
+  const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env: execEnv, argv }, opts?.quiet === true ? void 0 : { logPath });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
     repositories,
+    ...governingSource.kind === "governed" ? { governing: { repository: governingSource.repository } } : {},
+    agentVersion,
     lifecycle: report.apply.lifecycle,
     exec,
     log,
@@ -2556,6 +2246,7 @@ async function provisionContainer(input) {
     stageContext: () => stageGovernedContext({
       config,
       repository,
+      source: pinnedSourceOf(governingSource),
       buildId,
       buildDir: buildDir2,
       fetchImpl: input.fetchImpl,
@@ -2568,6 +2259,7 @@ async function provisionContainer(input) {
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
+  if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
 function agentVersionOf(toolsJson) {
@@ -2593,14 +2285,15 @@ function containerCommandLine(input) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     builtIns: state.builtIns === true,
-    identity: input.job.commitIdentity
+    identity: input.job.commitIdentity,
+    imageEnv: state.imageEnv
   });
   const args = containerExecArgs({
     container: state.container,
     user: state.agentUser ?? ADDED_USER,
     workdir: CHECKOUT_DIR,
     env,
-    argv: ["/bin/sh", "-c", input.cmdline]
+    argv: ["/bin/sh", "-c", commandWithShim(input.job, input.cmdline)]
   });
   return {
     line: ["docker", "exec", ...args].map(shellQuote).join(" "),
@@ -2619,7 +2312,8 @@ function containerSenderCommand(input) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     builtIns: state.builtIns === true,
-    identity: input.job.commitIdentity
+    identity: input.job.commitIdentity,
+    imageEnv: state.imageEnv
   });
   const args = containerExecArgs({
     container: state.container,
@@ -2696,7 +2390,8 @@ async function syncInContainer(input) {
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
       builtIns: state.builtIns === true,
-      identity: job.commitIdentity
+      identity: job.commitIdentity,
+      imageEnv: state.imageEnv
     });
     const result = await runtime.host.exec(
       { container: state.container, user: state.agentUser ?? ADDED_USER, workdir: job.workdir ?? CHECKOUT_DIR, env, argv: ["outerlayer", "sync"] },
@@ -2754,6 +2449,53 @@ async function cleanupContainer(runtime, state, jobDir) {
   runtime.cpus.release(state.buildId);
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
+function containerJudgeEnvironment(input) {
+  const { runtime, job } = input;
+  const state = job.container;
+  const user = state.agentUser ?? ADDED_USER;
+  const folder = join(input.jobDir, "judge");
+  return {
+    stop: async () => {
+      if (input.config !== void 0) await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch, job.repositories);
+      await stopContainer(runtime, state);
+      const started = await runtime.host.start(state.container);
+      if (started.status !== 0) throw new Error(`the build's container could not be started again (exit ${started.status})`);
+      state.stopped = false;
+      if (!await waitForRelay(runtime, state)) throw new Error("the relay in the build's container did not start again");
+    },
+    hashProgram: async () => {
+      const ran = await runtime.host.exec({ container: state.container, user: ADDED_USER, env: NO_ENV, argv: [...HASH_ARGV] });
+      const sha256 = ran.status === 0 ? parseProgramHash(ran.stdout) : void 0;
+      return sha256 === void 0 ? { ok: false, reason: firstLine5(ran.stderr) || `the hash could not be taken (exit ${ran.status})` } : { ok: true, sha256 };
+    },
+    prepare: async (files, tree) => {
+      mkdirSync(folder, { recursive: true });
+      for (const entry of readdirSync(folder)) rmSync(join(folder, entry), { recursive: true, force: true });
+      mkdirSync(join(folder, "home", "tmp"), { recursive: true });
+      for (const [fileName, text] of Object.entries(files)) writeFileSync(join(folder, fileName), text, { mode: 420 });
+      if (tree !== void 0) copyJudgeTree(tree, join(folder, "tree"));
+      chmodSync(join(folder, "home"), 511);
+      chmodSync(join(folder, "home", "tmp"), 511);
+      chmodSync(folder, 1023);
+    },
+    run: (command, opts) => runtime.host.exec({ container: state.container, user, workdir: command.cwd, env: { literals: command.env, passed: {} }, argv: command.argv }, { logPath: opts.logPath }),
+    readReport: async () => readRegularFile(join(folder, "report.html"), MAX_REPORT_BYTES),
+    // The judge's files belong to the build's user, and Claude Code makes some of its folders private to it, so the runner's user cannot remove them from the
+    // host. Every capability is dropped in the container, so root there could not either; the build's user removes its own, and the runner removes the rest.
+    clear: async () => {
+      const removed = await runtime.host.exec({ container: state.container, user, env: NO_ENV, argv: ["find", JUDGE_DIR, "-mindepth", "1", "-user", user, "-delete"] });
+      if (removed.status !== 0) throw new Error(`find exited ${removed.status}: ${firstLine5(removed.stderr)}`);
+    }
+  };
+}
+function readRegularFile(path, limit) {
+  try {
+    const stat = lstatSync(path);
+    return stat.isFile() && stat.size <= limit ? readFileSync(path, "utf8") : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function startCheckContainer(input) {
   const { config, runtime, job, jobDir, tokens, log } = input;
   const { host } = runtime;
@@ -2768,7 +2510,7 @@ async function startCheckContainer(input) {
   const buildDir2 = buildDir(config.configPath, buildId);
   const agentUser = built.agentUser ?? ADDED_USER;
   const cpuset = built.cpuset ?? formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4));
-  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, agentUser, cpuset };
+  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, imageEnv: built.imageEnv, agentUser, cpuset };
   const checksDir = join(jobDir, "checks");
   mkdirSync(checksDir, { recursive: true });
   const logPath = join(checksDir, "environment.log");
@@ -2817,7 +2559,7 @@ async function startCheckContainer(input) {
   const started = await host.run(containerRunArgs(runInput), { logPath });
   if (started.status !== 0) return dockerFailed("starting the check environment's container", started);
   if (!await waitForRelay(runtime, state)) return fail("the relay in the check environment's container did not start");
-  const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {} });
+  const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {}, imageEnv: built.imageEnv });
   return {
     ok: true,
     container: {
@@ -2834,4 +2576,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BuildTokens, EVAL_INPUT_NAME, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, EVAL_INPUT_NAME, GH_CONFIG_YML, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandLine, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, deleteBuildDisk, ensureRootfs, ensureTunnel, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, resolveAgentUser, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };