@outerlayer/cli 0.26.2 → 0.26.4

package/dist/{chunk-PCY7IGSL.js → chunk-OQUD3UYF.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RO3BRAO6.js';
-import { MIN_ENGINE_MAJOR } from './chunk-GUT4IU7K.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-5PMQDQFV.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-EHBDYLM6.js';
+import { MIN_ENGINE_MAJOR } from './chunk-SBW4K3XZ.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-VGHKTSHU.js';
 import { runnerCredentialProblem } from './chunk-JWRX5ZTT.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-DXHISLCI.js → chunk-OZKEEXVH.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-GMPXOQTH.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-W3NVHOCS.js';
-import { signingFetchFor } from './chunk-QRZLUUNN.js';
+import { WorkCommandError, postJson } from './chunk-6CGXSMKX.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-4UFSTKE5.js';
+import { signingFetchFor } from './chunk-MCSINUVC.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-VPEGE3QZ.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
-import { signerFor } from './chunk-F6DIHHBS.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir } from './chunk-L4CW6LZQ.js';
-import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, lstatSync } from 'fs';
+import { signerFor } from './chunk-GWRDL75D.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-F3BBEBPL.js';
+import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, cpSync, readFileSync, existsSync, lstatSync } from 'fs';
 import { relative, join, dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -464,6 +464,27 @@ async function controlPlaneAccess(ask, candidates, repository, log, tag) {
 function removeStagedContext(buildDir) {
   rmSync(stagedContextDir(buildDir), { recursive: true, force: true });
 }
+function keepStagedContext(staged, jobDir) {
+  const kept = keptContextDir(jobDir);
+  rmSync(kept, { recursive: true, force: true });
+  const tree = join(staged.dir, "tree");
+  cpSync(tree, join(kept, "tree"), { recursive: true, verbatimSymlinks: true, filter: (source) => source !== join(tree, ".git") });
+  writeFileSync(join(kept, "kept.json"), JSON.stringify({ schemaVersion: 1, repository: staged.repository, sha: staged.sha }) + "\n");
+}
+function keptContextTree(jobDir, governing) {
+  const kept = keptContextDir(jobDir);
+  let record;
+  try {
+    record = JSON.parse(readFileSync(join(kept, "kept.json"), "utf8"));
+  } catch {
+    return void 0;
+  }
+  if (governing === void 0 || record.sha !== governing.commit || String(record.repository).toLowerCase() !== governing.repository.toLowerCase()) return void 0;
+  return existsSync(join(kept, "tree")) ? join(kept, "tree") : void 0;
+}
+function removeKeptContext(jobDir) {
+  rmSync(keptContextDir(jobDir), { recursive: true, force: true });
+}
 
 // src/runner/governing-source.ts
 var unavailable2 = (why) => ({ ok: false, reason: `context_unavailable: ${why}` });
@@ -494,4 +515,4 @@ async function imageTargetFor(input) {
   return { ok: true, repository: resolved.source.repository, pinned: { commit: resolved.source.sha, ref: resolved.source.ref } };
 }
 
-export { BuildTokens, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };
+export { BuildTokens, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };

package/dist/{chunk-EABW6AJQ.js → chunk-PJDQPF5N.js}

@@ -8,18 +8,31 @@ createRequire(import.meta.url);
 function cloudConfigPath(home = homeFromEnv()) {
   return join(home, ".outerlayer", "config.json");
 }
-function readCloudConfig(home = homeFromEnv()) {
+var CloudConfigError = class extends Error {
+};
+function unparseableConfigMessage(path, parserMessage) {
+  return `${path} is not valid JSON (${parserMessage}). Fix it or move it aside.`;
+}
+function readCloudConfigStrict(home = homeFromEnv()) {
   const path = cloudConfigPath(home);
   if (!existsSync(path)) return {};
+  const text = readFileSync(path, "utf8");
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new CloudConfigError(unparseableConfigMessage(path, err.message));
+  }
+}
+function readCloudConfig(home = homeFromEnv()) {
   try {
-    return JSON.parse(readFileSync(path, "utf8"));
+    return readCloudConfigStrict(home);
   } catch {
     return {};
   }
 }
 function writeCloudConfig(config, home = homeFromEnv()) {
   const path = cloudConfigPath(home);
-  const merged = { ...readCloudConfig(home) };
+  const merged = { ...readCloudConfigStrict(home) };
   for (const [key, value] of Object.entries(config)) {
     if (value !== void 0) merged[key] = value;
   }
@@ -33,7 +46,7 @@ function writeCloudConfig(config, home = homeFromEnv()) {
 function removeCloudConfigKeys(keys, home = homeFromEnv()) {
   const path = cloudConfigPath(home);
   if (!existsSync(path)) return;
-  const stored = { ...readCloudConfig(home) };
+  const stored = { ...readCloudConfigStrict(home) };
   for (const key of keys) delete stored[key];
   writeFileSync(path, JSON.stringify(stored, null, 2) + "\n", { mode: 384 });
   try {
@@ -42,4 +55,4 @@ function removeCloudConfigKeys(keys, home = homeFromEnv()) {
   }
 }
 
-export { cloudConfigPath, readCloudConfig, removeCloudConfigKeys, writeCloudConfig };
+export { CloudConfigError, cloudConfigPath, readCloudConfig, readCloudConfigStrict, removeCloudConfigKeys, writeCloudConfig };

package/dist/{chunk-TEVO3RUV.js → chunk-PZA6ZFYW.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { DEFAULT_DASHBOARD } from './chunk-XSPA5ODY.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-QRZLUUNN.js';
+import { DEFAULT_DASHBOARD } from './chunk-6BLXUD56.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-MCSINUVC.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { remoteLookupFailed } from './chunk-QE3UQAHK.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { isAgentsMdLayout } from './chunk-JKNYTNYD.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';

package/dist/{chunk-V5LUWRCV.js → chunk-Q2SVLBMI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-U2FSJBNI.js';
-import { spoolDir } from './chunk-2EAVBJMO.js';
+import { LiveUploader } from './chunk-VQ7OAG6H.js';
+import { spoolDir } from './chunk-UZEQVPKF.js';
 import { CaptureDaemon } from './chunk-QE3UQAHK.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-KZLLLARE.js → chunk-QUP6CVBQ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError, BUILDKIT_IMAGE } from './chunk-FI66JNLT.js';
+import { RecipeError, BUILDKIT_IMAGE } from './chunk-B6K7R5UY.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { compareVersions } from './chunk-QE3UQAHK.js';
-import { ensureHostKey } from './chunk-F6DIHHBS.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-L4CW6LZQ.js';
+import { ensureHostKey } from './chunk-GWRDL75D.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-F3BBEBPL.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-2K3TCQHW.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-JGD5TWQ2.js';
 import { StringDecoder } from 'string_decoder';

package/dist/{chunk-GUT4IU7K.js → chunk-SBW4K3XZ.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-DJILFADE.js';
+import { runnerImageVersion } from './chunk-2J46BQ5Y.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-GFHLEVUE.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-KZLLLARE.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-FI66JNLT.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-QUP6CVBQ.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-B6K7R5UY.js';
 import { execCapture } from './chunk-MXTN35XN.js';
 import { GUEST_CID } from './chunk-XLC7KEUV.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-DXHISLCI.js';
-import { WorkCommandError } from './chunk-GMPXOQTH.js';
+import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-OZKEEXVH.js';
+import { WorkCommandError } from './chunk-6CGXSMKX.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-VPEGE3QZ.js';
@@ -17,7 +17,7 @@ import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QE3UQAHK.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
 import { downconvertSession } from './chunk-QZBXLLTV.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-L4CW6LZQ.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-F3BBEBPL.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-2K3TCQHW.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-JGD5TWQ2.js';
 import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream } from 'fs';
@@ -210,6 +210,9 @@ function helperClient(socketPath, options = {}) {
     async list() {
       const reply = await ask(socketPath, { v: 1, op: "list" }, REQUEST_TIMEOUT_MS);
       return Array.isArray(reply.builds) ? reply.builds.map(String) : [];
+    },
+    async relink(build) {
+      await ask(socketPath, { v: 1, op: "relink", build }, REQUEST_TIMEOUT_MS);
     }
   };
 }
@@ -1048,6 +1051,11 @@ async function runBuildSteps(input) {
       const delivered = await deliver(input, staged);
       if (!delivered.ok) return delivered;
       controlPlane = { repository: staged.repository, commit: staged.sha };
+      try {
+        if (input.keepIn !== void 0) keepStagedContext(staged, input.keepIn);
+      } catch (err) {
+        log.error(`${tag} the governed context could not be kept for the host's checks: ${describeCallFailure(err)} \xB7 they fetch it again`);
+      }
       log.line(`${tag} governed context ${staged.sha.slice(0, 7)} delivered to ${deliveryDir(staged.repository, staged.sha)} (${staged.files.length} files)`);
     } finally {
       input.removeStagedContext();
@@ -2883,7 +2891,8 @@ async function provisionContainer(input) {
       const delivered = await deliverJobFiles(runtime, state, ["context"], secrets);
       return delivered.ok ? delivered : { ok: false, reason: `context_unavailable: ${delivered.reason}` };
     },
-    removeStagedContext: () => removeStagedContext(buildDir2)
+    removeStagedContext: () => removeStagedContext(buildDir2),
+    keepIn: jobDir
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;

package/dist/{chunk-TODY3MTS.js → chunk-UOGQZQXN.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-PCY7IGSL.js';
-import { describeCallFailure } from './chunk-DXHISLCI.js';
-import { WorkCommandError, getJson } from './chunk-GMPXOQTH.js';
+import { isPlaceholderCommand } from './chunk-OQUD3UYF.js';
+import { describeCallFailure } from './chunk-OZKEEXVH.js';
+import { WorkCommandError, getJson } from './chunk-6CGXSMKX.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { builtinKind } from './chunk-JWRX5ZTT.js';
-import { signerFor } from './chunk-F6DIHHBS.js';
+import { signerFor } from './chunk-GWRDL75D.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-2K3TCQHW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-2EAVBJMO.js → chunk-UZEQVPKF.js}

@@ -6,7 +6,7 @@ import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, statSync, appendFileSync, opendirSync, unlinkSync } from 'fs';
+import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, readdirSync, unlinkSync, statSync, appendFileSync, opendirSync } from 'fs';
 import { spawn, execFileSync } from 'child_process';
 import { createHash } from 'crypto';
 import { join, dirname, resolve } from 'path';
@@ -308,6 +308,42 @@ function refreshCommand(workspaceDistDir, trusted) {
 function spoolDir(home = homeFromEnv()) {
   return join(home, ".outerlayer", "spool");
 }
+var DUPLICATE_RUN_WINDOW_MS = 2e3;
+var DUPLICATE_RUN_CLAIM_TTL_MS = 6e4;
+function isDuplicateRun(dir, event, input, now = Date.now(), claim = claimRun) {
+  try {
+    const claims = join(dir, "hook-runs");
+    mkdirSync(claims, { recursive: true });
+    const key = createHash("sha256").update(`${event}
+${input}`).digest("hex");
+    const bucket = Math.floor(now / DUPLICATE_RUN_WINDOW_MS);
+    try {
+      claim(join(claims, `${key}-${bucket}`), now);
+    } catch (err) {
+      return err.code === "EEXIST";
+    }
+    if (claimedWithinWindow(join(claims, `${key}-${bucket - 1}`), now)) return true;
+    for (const name of readdirSync(claims)) {
+      const claimed = Number(name.slice(name.lastIndexOf("-") + 1)) * DUPLICATE_RUN_WINDOW_MS;
+      if (!(now - claimed <= DUPLICATE_RUN_CLAIM_TTL_MS)) unlinkSync(join(claims, name));
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function claimRun(path, now) {
+  writeFileSync(path, String(now), { flag: "wx" });
+}
+function claimedWithinWindow(path, now) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return false;
+  }
+  return text === "" || now - Number(text) < DUPLICATE_RUN_WINDOW_MS;
+}
 function hookFiredMarkerPath(event, home = homeFromEnv()) {
   const safe = event.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 64) || "unknown";
   return join(spoolDir(home), `last-fired-${safe}`);
@@ -628,7 +664,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-654RV5PO.js');
+  const { governanceOf } = await import('./control-plane-launch-JIQOE6BP.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;
@@ -679,6 +715,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
     }
     const dir = spoolDir(home);
     mkdirSync(dir, { recursive: true });
+    if (isDuplicateRun(dir, resolvedEvent, stdin)) return;
     const record = {
       t: (/* @__PURE__ */ new Date()).toISOString(),
       event: resolvedEvent,
@@ -773,4 +810,4 @@ function recordLinkExitFailure(argv, home = homeFromEnv(), target = process) {
   });
 }
 
-export { AUTO_SYNC_DEBOUNCE_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, logHookError, markWorkLeaseRenewed, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, recordLinkExitFailure, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };
+export { AUTO_SYNC_DEBOUNCE_MS, DUPLICATE_RUN_WINDOW_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, isDuplicateRun, logHookError, markWorkLeaseRenewed, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, recordLinkExitFailure, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };

package/dist/{chunk-6OYAW5SF.js → chunk-V3YJFEZA.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-OL2O5PEI.js';
-import { writePendingUpdate } from './chunk-TKL74NLB.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-27RDUTQH.js';
+import { writePendingUpdate } from './chunk-OFTFW7TH.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-6FAP657M.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-NWPRNKZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-TODY3MTS.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-4IFKLYMM.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-UOGQZQXN.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-7Z2WMXM5.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-GUT4IU7K.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-665QWBNW.js';
+import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-SBW4K3XZ.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-2J46BQ5Y.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { checkFit } from './chunk-MLD2NA7N.js';
-import { claimPidFile, readPidFile, releasePidFile } from './chunk-PYSKSROG.js';
+import { checkFit } from './chunk-6SPXKRQR.js';
+import { claimPidFile, readPidFile, releasePidFile } from './chunk-IZAOO5AR.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-KZLLLARE.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-DXHISLCI.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-GMPXOQTH.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-QUP6CVBQ.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-OZKEEXVH.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6CGXSMKX.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWRX5ZTT.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-F6DIHHBS.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-L4CW6LZQ.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-GWRDL75D.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-F3BBEBPL.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-2K3TCQHW.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-JGD5TWQ2.js';
 import { randomBytes } from 'crypto';
@@ -1749,7 +1749,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-SJB6N6FZ.js');
+  const { postJson: postJson2 } = await import('./work-cmd-S2FHIFJA.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1933,11 +1933,16 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     writeJobFile(jobFilePath, active.job);
     tokens = buildTokensFor(state, active, item.number);
     runtimeOf(state).credentials.set(dirPath, tokens);
+    let asking;
     try {
       await tokens.token("read");
+      for (const entry of repositories) {
+        asking = entry.repository;
+        await tokens.token("read", entry.repository);
+      }
     } catch (err) {
       if (active.ending) return;
-      await endOnTokenRefusal(state, active, err);
+      await endOnTokenRefusal(state, active, err, asking);
       return;
     }
     if (active.ending) return;
@@ -2323,19 +2328,21 @@ function buildTokensFor(state, active, item) {
     }
   });
 }
-async function endOnTokenRefusal(state, active, err) {
+async function endOnTokenRefusal(state, active, err, repository) {
   const log = logOf(state);
   const tag = `#${active.job.item}`;
   const refusal = classifyRefusal(err);
+  const which = repository === void 0 ? "the build's read token" : `the build's read token for ${repository}`;
   if (refusal.kind === "retry") {
-    log.error(`${tag} the build's read token could not be had (${describeCallFailure(err)}) \xB7 releasing the claim to try again`);
+    log.error(`${tag} ${which} could not be had (${describeCallFailure(err)}) \xB7 releasing the claim to try again`);
     await endJob(state, active, void 0);
   } else if (refusal.kind === "lease_lost") {
-    log.error(`${tag} the build's read token was refused: ${refusalCode(err)} \xB7 ending job as lease_lost`);
+    log.error(`${tag} ${which} was refused: ${refusalCode(err)} \xB7 ending job as lease_lost`);
     await endJob(state, active, "lease_lost");
   } else {
-    log.error(`${tag} the build's read token was refused: ${refusal.reason} \xB7 ending job as failed`);
-    await endJob(state, active, "failed", { stage: "provision", reason: refusal.reason });
+    const reason = repository === void 0 ? refusal.reason : `${which} could not be had: ${refusal.reason}`;
+    log.error(`${tag} ${which} was refused: ${refusal.reason} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason });
   }
 }
 async function endOnProvisionFailure(state, active, tokens, took, reason) {
@@ -2735,7 +2742,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-KL3LDAI3.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-ZSYCR5WG.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-5PMQDQFV.js → chunk-VGHKTSHU.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-MLD2NA7N.js';
+import { DEFAULT_UNIT_NAME } from './chunk-6SPXKRQR.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import { RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_FILE_MODE } from './chunk-F3BBEBPL.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-U2FSJBNI.js → chunk-VQ7OAG6H.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-EORWWFPA.js';
+import { uploadSpooledSteps } from './chunk-WK35HB56.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QRZLUUNN.js';
-import { writeSyncStatus, spoolDir } from './chunk-2EAVBJMO.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-MCSINUVC.js';
+import { writeSyncStatus, spoolDir } from './chunk-UZEQVPKF.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
+import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signerFor, signRunnerRequest } from './chunk-F6DIHHBS.js';
+import { signerFor, signRunnerRequest } from './chunk-GWRDL75D.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';

package/dist/{chunk-EORWWFPA.js → chunk-WK35HB56.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-HXFRJKMU.js';
+import { autoConnect, detectActiveSession } from './chunk-H57M3HC7.js';
 import { acquireSpoolLockAt } from './chunk-BUP5N3X6.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QRZLUUNN.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-MCSINUVC.js';
 import { resolveRepoIdentity } from './chunk-QE3UQAHK.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';

package/dist/{chunk-JF572PM5.js → chunk-Y4BXRVDI.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-KDDFI5MR.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-4IFKLYMM.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-K4FXNMV5.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-7Z2WMXM5.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-L4CW6LZQ.js';
+import { RUNNER_DIR_MODE } from './chunk-F3BBEBPL.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-WA7R6U2F.js → chunk-ZMZGWLYD.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned, checkBuildSkill } from './chunk-XFGL53GU.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-GMPXOQTH.js';
-import { isLinkedRepository } from './chunk-TEVO3RUV.js';
+import { checkStarterFiles, contextIsGoverned, checkBuildSkill } from './chunk-6WTAYEKJ.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-6CGXSMKX.js';
+import { isLinkedRepository } from './chunk-PZA6ZFYW.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { checkFormerSkillNames } from './chunk-MQ743JX3.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-QRZLUUNN.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-2EAVBJMO.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-MCSINUVC.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-UZEQVPKF.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1186,7 +1186,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-3LCCPBX6.js');
+    const { runnerHostChecks } = await import('./doctor-U2N7AF3N.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1221,7 +1221,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-QSTTBUHX.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-AFMXH25X.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{claude-launcher-O2U6P6ZD.js → claude-launcher-TTLTS4N6.js}

@@ -236,7 +236,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-654RV5PO.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-JIQOE6BP.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);