@outerlayer/cli 0.28.4 → 0.30.0

package/dist/{chunk-QZBXLLTV.js → chunk-IWFYKNAO.js}

@@ -2553,6 +2553,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -3072,6 +3073,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -4492,7 +4505,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // ../../node_modules/zod/v4/core/schemas.js
@@ -5248,6 +5261,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -5291,6 +5329,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -6247,6 +6286,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -6313,6 +6353,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -15837,9 +15878,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -16239,6 +16286,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -16255,6 +16303,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -22278,6 +22327,43 @@ var ArtifactTombstoneRecordSchema = external_exports.looseObject({
   t: external_exports.string()
 });
 external_exports.union([ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema]);
+var CHECK_ITEM_RESULTS = ["pass", "fail", "skipped"];
+var CHECK_ITEMS_MAX = 500;
+var CHECK_ITEM_ID_MAX_LENGTH = 200;
+var CHECK_ITEM_REASON_MAX_LENGTH = 1e3;
+var CHECK_ITEM_REFS_MAX = 20;
+var CHECK_ITEM_REF_PATH_MAX_LENGTH = 500;
+var ONE_LINE = /^[^\u0000-\u001f\u007f]+$/;
+var CheckItemRefSchema = external_exports.object({
+  path: external_exports.string().min(1).max(CHECK_ITEM_REF_PATH_MAX_LENGTH).regex(ONE_LINE, "must be one line").refine((path) => !path.startsWith("/") && !path.split(/[\\/]/).includes(".."), {
+    message: "must be a relative path with no '..' segment"
+  }),
+  line: external_exports.number().int().positive().optional(),
+  /** Only an https link: it becomes an href on a page. */
+  href: external_exports.string().max(1e3).refine((href) => href.startsWith("https://") && !/\s/.test(href), { message: "must be an https:// URL with no whitespace" }).optional()
+});
+var CheckItemSchema = external_exports.object({
+  /** What the item is about, unique within the check. */
+  id: external_exports.string().min(1).max(CHECK_ITEM_ID_MAX_LENGTH).regex(ONE_LINE, "must be one line"),
+  /** The acceptance criterion the item is about, when it is about one. */
+  criterion: ArtifactCriterionIdSchema.optional(),
+  result: external_exports.enum(CHECK_ITEM_RESULTS),
+  /** Why, in a sentence or three. */
+  reason: external_exports.string().max(CHECK_ITEM_REASON_MAX_LENGTH).optional(),
+  refs: external_exports.array(CheckItemRefSchema).max(CHECK_ITEM_REFS_MAX).optional(),
+  /** The sha256 of what the check item was judged on. A judge that sees the same inputs again keeps its result. */
+  inputs: external_exports.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase sha256 hex digest").optional()
+});
+var CheckItemsSchema = external_exports.array(CheckItemSchema).max(CHECK_ITEMS_MAX).superRefine((items, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, item] of items.entries()) {
+    if (seen.has(item.id)) ctx.addIssue({ code: "custom", path: [index, "id"], message: `repeats the id ${JSON.stringify(item.id)}` });
+    seen.add(item.id);
+  }
+});
+function itemsAllowResult(result, items) {
+  return result === "fail" || !(items != null ? items : []).some((item) => item.result === "fail");
+}
 var EMITTED_RESULTS = ["pass", "fail"];
 var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings", "step"];
 var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).superRefine((name, ctx) => {
@@ -22579,4 +22665,4 @@ xmlchars/xmlns/1.0/ed3.js:
    *)
 */
 
-export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CLI_LOGIN_KIND, CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CliLoginRefusalSchema, CliLoginStartedSchema, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };
+export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CHECK_ITEM_REASON_MAX_LENGTH, CLI_LOGIN_KIND, CLI_LOGIN_MACHINE_NAME_MAX, CheckItemsSchema, CliLoginPollResponseSchema, CliLoginRefusalSchema, CliLoginStartedSchema, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, itemsAllowResult, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };

package/dist/{chunk-ERVZGWUR.js → chunk-JGOMMFNX.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-KBB3CQTW.js';
-import { describeCallFailure } from './chunk-JZJLKTZT.js';
-import { builtinKind } from './chunk-YYGXCRIW.js';
-import { WorkCommandError, getJson } from './chunk-X7SFJZIG.js';
-import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { signerFor } from './chunk-R7TMTFJP.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-N5EEEKT6.js';
+import { isPlaceholderCommand } from './chunk-B6OYEP3K.js';
+import { describeCallFailure } from './chunk-3IDNLZPR.js';
+import { builtinKind } from './chunk-2ZMJFGOZ.js';
+import { WorkCommandError, getJson } from './chunk-DBRB26R7.js';
+import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
+import { signerFor } from './chunk-IRF2FKB5.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-WHCDULC4.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-6NFXOQKZ.js → chunk-LJIFCG4G.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-WL3QF3QF.js → chunk-MBVSVQVH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-DIQN5SEL.js';
+import { EXEC_PORT } from './chunk-TKJISBV6.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);
@@ -81,21 +81,24 @@ function runExec(socketPath, request, io = {}) {
       killed = true;
       send(FRAME.kill, Buffer.alloc(0));
     }
-    const pumpStdin = async () => {
+    const chunks = (buffer) => Array.from({ length: Math.ceil(buffer.length / CHUNK_BYTES) }, (_unused, i) => buffer.subarray(i * CHUNK_BYTES, (i + 1) * CHUNK_BYTES));
+    const sendRequest = () => {
       const stdin = io.stdin;
-      const chunks = (buffer) => Array.from({ length: Math.ceil(buffer.length / CHUNK_BYTES) }, (_unused, i) => buffer.subarray(i * CHUNK_BYTES, (i + 1) * CHUNK_BYTES));
+      if (stdin !== void 0 && typeof stdin !== "string" && !Buffer.isBuffer(stdin)) {
+        send(FRAME.request, encodeRequest(request));
+        void pumpStdin(stdin);
+        return;
+      }
+      const input = stdin === void 0 ? [] : chunks(Buffer.from(stdin)).map((chunk) => encodeFrame(FRAME.stdin, chunk));
+      socket.write(Buffer.concat([encodeFrame(FRAME.request, encodeRequest(request)), ...input, encodeFrame(FRAME.stdin, Buffer.alloc(0))]));
+    };
+    const pumpStdin = async (stdin) => {
       try {
-        if (stdin === void 0) {
-        } else if (typeof stdin === "string" || Buffer.isBuffer(stdin)) {
-          for (const chunk of chunks(Buffer.from(stdin))) send(FRAME.stdin, chunk);
-        } else {
-          stdinIterator = stdin.iterator({ destroyOnReturn: false });
-          for (; ; ) {
-            const next = await stdinIterator.next();
-            if (next.done === true || settled) break;
-            for (const chunk of chunks(Buffer.from(next.value))) {
-              if (!send(FRAME.stdin, chunk)) await new Promise((done) => socket.once("drain", () => done()));
-            }
+        const iterator = stdin.iterator({ destroyOnReturn: false });
+        stdinIterator = iterator;
+        for await (const value of iterator) {
+          for (const chunk of chunks(Buffer.from(value))) {
+            if (!send(FRAME.stdin, chunk)) await new Promise((done) => socket.once("drain", () => done()));
           }
         }
       } catch {
@@ -143,9 +146,8 @@ function runExec(socketPath, request, io = {}) {
       }
       greeted = true;
       clearTimeout(handshakeTimer);
-      send(FRAME.request, encodeRequest(request));
+      sendRequest();
       if (io.signal?.aborted === true) kill();
-      void pumpStdin();
       const rest = greeting.subarray(newline + 1);
       if (rest.length > 0) onFrames(rest);
     });

package/dist/{chunk-TOHKSZKI.js → chunk-MBZTX4V2.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { isAgentsMdLayout } from './chunk-5B7BEQPR.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-KJIUFOC4.js';
+import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
+import { isAgentsMdLayout } from './chunk-QDDPVBIS.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-AM3GMWQK.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { machineSkillsState, staleClaudeSkills } from './chunk-DQYMQ47E.js';
-import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-JGML2VUN.js';
+import { machineSkillsState, staleClaudeSkills } from './chunk-UAFMC3PL.js';
+import { AGENTS_SKILLS_BASE, skillDir, namesCore, MACHINE_SKILL_PATH, isMaintainedCopy, loadTemplateFiles } from './chunk-AKKVPUGK.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-VWFOKRYS.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-RKOTJQVG.js';
+import { hasSymlinkComponent } from './chunk-HJUGOAM7.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-ZUOPFE22.js';
 import { existsSync, readFileSync, writeFileSync, realpathSync, readdirSync } from 'fs';
 import { join, dirname, posix } from 'path';
 

package/dist/{chunk-VM6BX2WJ.js → chunk-PS3AHE6C.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-NMIYK2G2.js';
-import { acquireSpoolLockAt } from './chunk-BUP5N3X6.js';
-import { resolveRepoIdentity } from './chunk-UHU7H57K.js';
+import { autoConnect, detectActiveSession } from './chunk-SJ4DX2AD.js';
+import { acquireSpoolLockAt } from './chunk-HSUUTD4E.js';
+import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-KJIUFOC4.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-AM3GMWQK.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { StepNameSchema, StepBodySchema } from './chunk-QZBXLLTV.js';
+import { StepNameSchema, StepBodySchema } from './chunk-IWFYKNAO.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';
 import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, appendFileSync } from 'fs';

package/dist/{chunk-5B7BEQPR.js → chunk-QDDPVBIS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-JGML2VUN.js';
-import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-RKOTJQVG.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-AKKVPUGK.js';
+import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-ZUOPFE22.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';
 

package/dist/{chunk-5Q4NDYQP.js → chunk-QQJGL7LG.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { execCapture } from './chunk-WL3QF3QF.js';
-import { GUEST_CID } from './chunk-DIQN5SEL.js';
-import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-JZJLKTZT.js';
-import { runnerImageVersion } from './chunk-O47BTZSN.js';
+import { execCapture } from './chunk-MBVSVQVH.js';
+import { GUEST_CID } from './chunk-TKJISBV6.js';
+import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-3IDNLZPR.js';
+import { runnerImageVersion } from './chunk-D3LS7E7U.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TCBVV2JK.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-U5DC57AF.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-MFI55TNI.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-7YSR636F.js';
 import { readDu } from './chunk-YJLHUKYS.js';
 import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-SJZL5F3F.js';
-import { WorkCommandError } from './chunk-X7SFJZIG.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-UHU7H57K.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-DWVAG73B.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-N5EEEKT6.js';
+import { WorkCommandError } from './chunk-DBRB26R7.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-FTGJ3DPV.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-SOWXLIDN.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-WHCDULC4.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
-import { downconvertSession } from './chunk-QZBXLLTV.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-ZUOPFE22.js';
+import { downconvertSession } from './chunk-IWFYKNAO.js';
 import { realFdStorePort } from './chunk-XD4ZCMA4.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream, writeSync } from 'fs';
@@ -3340,6 +3340,17 @@ function containerJudgeEnvironment(input) {
   const state = job.container;
   const user = state.agentUser ?? ADDED_USER;
   const folder = join(input.jobDir, "judge");
+  const readJudgeFile = async (file, name, maxBytes) => {
+    if (!filesAreCopied(state)) return readRegularFile(join(folder, name), maxBytes);
+    const read = await runtime.host.exec({
+      container: state.container,
+      user,
+      env: NO_ENV,
+      argv: ["/bin/sh", "-c", `[ -f ${file} ] && [ ! -L ${file} ] && head -c ${maxBytes + 1} ${file}`]
+    }, { timeoutMs: REPORT_READ_TIMEOUT_MS });
+    if (read.status > 1) throw new Error(`reading the judge's ${name} exited ${read.status}: ${firstLine5(read.stderr)}`);
+    return read.status === 0 && Buffer.byteLength(read.stdout) <= maxBytes ? read.stdout : void 0;
+  };
   return {
     stop: async () => {
       if (input.config !== void 0) await ensureTunnel(runtime, state, input.jobDir, input.config, job.itemKey, job.branch, job.repositories, input.log);
@@ -3382,18 +3393,8 @@ function containerJudgeEnvironment(input) {
       chmodSync(folder, 1023);
     },
     run: (command, opts) => runtime.host.exec({ container: state.container, user, workdir: command.cwd, env: { literals: command.env, passed: {} }, argv: command.argv }, { logPath: opts.logPath }),
-    readReport: async () => {
-      if (!filesAreCopied(state)) return readRegularFile(join(folder, "report.html"), MAX_REPORT_BYTES);
-      const file = JUDGE_REPORT;
-      const read = await runtime.host.exec({
-        container: state.container,
-        user,
-        env: NO_ENV,
-        argv: ["/bin/sh", "-c", `[ -f ${file} ] && [ ! -L ${file} ] && head -c ${MAX_REPORT_BYTES + 1} ${file}`]
-      }, { timeoutMs: REPORT_READ_TIMEOUT_MS });
-      if (read.status > 1) throw new Error(`reading the judge report exited ${read.status}: ${firstLine5(read.stderr)}`);
-      return read.status === 0 && Buffer.byteLength(read.stdout) <= MAX_REPORT_BYTES ? read.stdout : void 0;
-    },
+    readReport: () => readJudgeFile(JUDGE_REPORT, "report.html", MAX_REPORT_BYTES),
+    readItems: () => readJudgeFile(JUDGE_ITEMS, "items.json", MAX_ITEMS_BYTES),
     // The judge's files belong to the build's user, and Claude Code makes some of its folders private to it, so the runner's user cannot remove them from the
     // host. Every capability is dropped in the container, so root there could not either; the build's user removes its own, and the runner removes the rest.
     clear: async () => {

package/dist/{chunk-HWOU2HDH.js → chunk-QWJBTFAF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-OOUHNKKX.js → chunk-RJDJFRRY.js}

@@ -680,11 +680,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-LTH77FC3.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-D5EGQHQV.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-TIK265OT.js');
+  const { governanceOf } = await import('./control-plane-launch-2AC4BTWL.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-NMIYK2G2.js → chunk-SJ4DX2AD.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-QFNFBQCG.js';
-import { resolveRepoIdentity } from './chunk-UHU7H57K.js';
-import { resolveGatewayCredentials } from './chunk-KJIUFOC4.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-3YLHIXLR.js';
+import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
+import { resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-DWVAG73B.js → chunk-SOWXLIDN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-N5EEEKT6.js';
+import { BUILD_HOME } from './chunk-WHCDULC4.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-NKD5BNRX.js → chunk-TGUWHA27.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-NMIYK2G2.js';
-import { resolveRepoIdentity } from './chunk-UHU7H57K.js';
+import { autoConnect, detectActiveSession } from './chunk-SJ4DX2AD.js';
+import { resolveRepoIdentity } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-KJIUFOC4.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-DIQN5SEL.js → chunk-TKJISBV6.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-N5EEEKT6.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-WHCDULC4.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-FTNCNEWE.js → chunk-TKX23NFV.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned } from './chunk-ITAIEJ2T.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-TOHKSZKI.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-X7SFJZIG.js';
-import { isLinkedRepository } from './chunk-QFNFBQCG.js';
-import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-UHU7H57K.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-BCWVTWS7.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-MBZTX4V2.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-DBRB26R7.js';
+import { isLinkedRepository } from './chunk-3YLHIXLR.js';
+import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { checkFormerSkillNames } from './chunk-P2RWZCV7.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-KJIUFOC4.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-OOUHNKKX.js';
+import { checkFormerSkillNames } from './chunk-V6IYYQU3.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-AM3GMWQK.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-RJDJFRRY.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1190,7 +1190,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-TNV5HHLO.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-VM6GKCCE.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1211,7 +1211,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-PKMAUDTU.js');
+    const { runnerHostChecks } = await import('./doctor-RGTHY56D.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1239,7 +1239,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-L7JIBK3Y.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-NPTR35MG.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-GZ27NW6U.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-RXFKXZJS.js → chunk-TN2XMMD7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-N5EEEKT6.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-WHCDULC4.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-TCBVV2JK.js → chunk-U5DC57AF.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-M6NNXKRM.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-IRTZYDZO.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-SJZL5F3F.js';
-import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
-import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-N5EEEKT6.js';
+import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
+import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-WHCDULC4.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';

package/dist/{chunk-DQYMQ47E.js → chunk-UAFMC3PL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { loadMachineSkillFiles, resolvePackRoot } from './chunk-JGML2VUN.js';
+import { loadMachineSkillFiles, resolvePackRoot } from './chunk-AKKVPUGK.js';
 import { MAINTAINED_SKILLS, maintainedLineVersion } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-P2RWZCV7.js → chunk-V6IYYQU3.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-JGML2VUN.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-AKKVPUGK.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-RKOTJQVG.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-ZUOPFE22.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-DSKOHPXN.js → chunk-VL3CF4DZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-6NFXOQKZ.js';
+import { currentLink } from './chunk-LJIFCG4G.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-N5EEEKT6.js → chunk-WHCDULC4.js}

@@ -15,7 +15,8 @@ function claudeEnvPath(configPath) {
   return join(dirname(configPath), CLAUDE_ENV_FILE);
 }
 var CLAUDE_CREDENTIAL_VARIABLES = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
-var FORWARDED = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+var FORWARDED_CLAUDE_CREDENTIAL_VARIABLES = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+var FORWARDED = FORWARDED_CLAUDE_CREDENTIAL_VARIABLES;
 function firstOf(values, source) {
   for (const variable of FORWARDED) {
     const value = values[variable];
@@ -162,6 +163,8 @@ function builtInEnvironment(localFor, credential) {
     CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
   };
 }
+
+// src/runner/destinations.ts
 var MAX_RELEASED_DESTINATIONS = 20;
 var MAX_DESTINATIONS = MAX_RELEASED_DESTINATIONS - BUILT_IN_NAMES.length;
 var DESTINATION_BASE_PORT = 3129;
@@ -558,6 +561,7 @@ function primaryOf(repositories) {
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
 var EVAL_INPUT_DIR = `${JOB_MOUNT}/eval-input`;
+var CHECK_ITEMS_FILE = "/tmp/outerlayer-check-items.json";
 var BUILD_HOME = "/build/home";
 var CHECKOUT_DIR = "/build/work/checkout";
 var REPOS_DIR = "/build/work/repos";
@@ -713,7 +717,7 @@ function checkEnvironment(input) {
     imageEnv: input.imageEnv
   });
   const withheld = /* @__PURE__ */ new Set(["OUTERLAYER_URL", "OUTERLAYER_API_KEY", ...CLAUDE_CREDENTIAL_VARIABLES]);
-  const literals = { OUTERLAYER_EVAL_INPUT: EVAL_INPUT_DIR };
+  const literals = { OUTERLAYER_EVAL_INPUT: EVAL_INPUT_DIR, OUTERLAYER_CHECK_ITEMS: CHECK_ITEMS_FILE };
   for (const [name, value] of Object.entries(env.literals)) if (!withheld.has(name)) literals[name] = value;
   const passed = {};
   for (const [name, value] of Object.entries(env.passed)) if (!withheld.has(name)) passed[name] = value;
@@ -752,4 +756,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };