@outerlayer/cli 0.33.0-next.20261022180022 → 0.33.0-next.20261022182340

package/README.md

@@ -223,7 +223,10 @@ content:
   build uses the host's network: the build's tunnel does not carry it, and
   `runner.build.allowHosts` does not limit it.
 - **`outerlayer runner start` with `builtin:vm` hooks** runs each build in its
-  own Firecracker microVM, which has no network device. The first microVM
+  own Firecracker microVM, which has no network card. Every TCP connection
+  of every program in it goes through the runner's tunnel, whether or not the
+  program reads the proxy variables, and `runner.build.allowHosts` narrows what
+  it reaches. No DNS query or UDP packet leaves the microVM. The first microVM
   build downloads a pinned Firecracker release from github.com. It also
   downloads a guest kernel and a guest helper from the releases of the public
   repository `outerlayerai/guest-assets` on github.com. The runner checks each

package/dist/{agent-setup-4WKFXVOP.js → agent-setup-32F2JJIL.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-VHRKGCBY.js';
+export { keepHandWritten, runAgentSetup } from './chunk-4XQ6F3HD.js';
 import './chunk-JHTJPQSL.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-DY7Y7UT4.js';
 import './chunk-HJYBWJAS.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-YMGSMPPW.js';
+import './chunk-EYW2ZRDL.js';
 import './chunk-UIUGTW5C.js';
-import './chunk-FLFK42YF.js';
+import './chunk-WPGBDY73.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-634F6J3Q.js';
-import './chunk-MBGS33SL.js';
-import './chunk-D5ZGMXUL.js';
+import './chunk-AA6LYZC4.js';
+import './chunk-AGZNCIIJ.js';
+import './chunk-BCCI32ME.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-G63KT5I5.js';

package/dist/{bridge-DMFMBDRG.js → bridge-BCG2EB7F.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-TTACRX4N.js';
-import './chunk-D5ZGMXUL.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-QL3LPZ67.js';
+import './chunk-BCCI32ME.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-2ONBPS3M.js → build-BOVQZXKB.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-7HMF7I3D.js';
-import './chunk-ZFJAQS3A.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-BMCPLX2W.js';
+import './chunk-DDS2ISML.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
-import './chunk-MBGS33SL.js';
-import './chunk-D5ZGMXUL.js';
+import './chunk-KFA762LZ.js';
+import './chunk-AGZNCIIJ.js';
+import './chunk-BCCI32ME.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-disk-PCDS676T.js → build-disk-6T4WR3XI.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-JFRBPBD5.js';
+export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-CMZVDKOX.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-HGZXTPRO.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
-import './chunk-634F6J3Q.js';
-import './chunk-MBGS33SL.js';
-import './chunk-D5ZGMXUL.js';
+import './chunk-AA6LYZC4.js';
+import './chunk-AGZNCIIJ.js';
+import './chunk-BCCI32ME.js';
 import './chunk-E6CO3MJE.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-22T18:03:01.584Z+80747d3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-22T18:51:56.585Z+701260a","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-AIKWGJHP.js → builder-E4F5355C.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-LG2IQRTO.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-HGZXTPRO.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
+import './chunk-KFA762LZ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
-import './chunk-634F6J3Q.js';
-import './chunk-MBGS33SL.js';
-import './chunk-D5ZGMXUL.js';
+import './chunk-AA6LYZC4.js';
+import './chunk-AGZNCIIJ.js';
+import './chunk-BCCI32ME.js';
 import './chunk-E6CO3MJE.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';

package/dist/{check-LGZOJYLS.js → check-DUVKQSXY.js}

@@ -1,64 +1,64 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-J5VNSW4W.js';
-import './chunk-VGIS2D3U.js';
+import { probeCredentials } from './chunk-T4BJBF7L.js';
+import './chunk-6PUSHKJ6.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-QPAPHQZ7.js';
+import './chunk-UOFBHIOZ.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-W4UFGYKQ.js';
+import './chunk-6C2YWM6N.js';
 import './chunk-YKYCE4HY.js';
-import './chunk-5KO3TN2F.js';
-import './chunk-HAD7LYDL.js';
-import './chunk-TTACRX4N.js';
+import './chunk-JEKENLLA.js';
+import './chunk-W5DOK7BL.js';
+import './chunk-QL3LPZ67.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-JUVUVXQZ.js';
-import './chunk-J6LFFZOY.js';
-import './chunk-EBX2DU2M.js';
+import './chunk-JR4TZLG6.js';
+import './chunk-A33USDCE.js';
+import './chunk-DETKDTNL.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-7SCEDWQP.js';
-import './chunk-O7MSQBTH.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-R3DSBA3J.js';
+import './chunk-OWDSO3PE.js';
 import './chunk-TBT347UY.js';
-import './chunk-M7IA4JOX.js';
-import './chunk-HDD3BKAE.js';
-import './chunk-6KVKEZTH.js';
-import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-OKTLQTWH.js';
+import './chunk-FVY5OU3N.js';
+import './chunk-CUBIZBMF.js';
+import './chunk-X2LZ2IHE.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-5CZVJVTP.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-7HMF7I3D.js';
-import './chunk-ZFJAQS3A.js';
+import './chunk-BMCPLX2W.js';
+import './chunk-DDS2ISML.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-XXVYHC6D.js';
-import './chunk-O5F376JJ.js';
-import './chunk-JKPJQNJF.js';
-import './chunk-PWB7EK4Z.js';
+import './chunk-6NWS455T.js';
+import './chunk-LWTBE5J6.js';
+import './chunk-RAHE2AYU.js';
+import './chunk-SK4TWCN3.js';
 import './chunk-TQMI335S.js';
-import { DEFAULT_UNIT_NAME } from './chunk-A6MLCH76.js';
-import './chunk-JFRBPBD5.js';
+import { DEFAULT_UNIT_NAME } from './chunk-ZRRUWNJS.js';
+import './chunk-CMZVDKOX.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-LG2IQRTO.js';
+import './chunk-HGZXTPRO.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-R6QCSHKC.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-ZQ7VRXYM.js';
+import './chunk-KFA762LZ.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-5BNWAIHN.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';
-import './chunk-KQFWTTG7.js';
-import './chunk-RLGSBR56.js';
-import './chunk-CMNAAKFD.js';
+import './chunk-TDVG6MCO.js';
+import './chunk-2QT4JUW3.js';
+import './chunk-ZQOSIMKU.js';
 import './chunk-EWVYQLD3.js';
 import './chunk-5DNCFOXA.js';
 import './chunk-HJYBWJAS.js';
 import './chunk-NSPRS7WK.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-YMGSMPPW.js';
+import './chunk-EYW2ZRDL.js';
 import './chunk-UIUGTW5C.js';
-import './chunk-FLFK42YF.js';
+import './chunk-WPGBDY73.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-634F6J3Q.js';
-import './chunk-MBGS33SL.js';
-import { claudeEnvPath } from './chunk-D5ZGMXUL.js';
-import './chunk-ZANK3WWF.js';
+import './chunk-AA6LYZC4.js';
+import './chunk-AGZNCIIJ.js';
+import { claudeEnvPath } from './chunk-BCCI32ME.js';
+import './chunk-WB7LPDXR.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';

package/dist/{chunk-RLGSBR56.js → chunk-2QT4JUW3.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-CMNAAKFD.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-ZQOSIMKU.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
-import { resolveGatewayCredentials } from './chunk-FLFK42YF.js';
+import { resolveGatewayCredentials } from './chunk-WPGBDY73.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-VHRKGCBY.js → chunk-4XQ6F3HD.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-DY7Y7UT4.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-HJYBWJAS.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-YMGSMPPW.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-EYW2ZRDL.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-AVTI3FL5.js';

package/dist/{chunk-ZQ7VRXYM.js → chunk-5BNWAIHN.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-D5ZGMXUL.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BCCI32ME.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';

package/dist/{chunk-OKTLQTWH.js → chunk-5CZVJVTP.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-7HMF7I3D.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-BMCPLX2W.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { runExec, execCapture, waitForAgent } from './chunk-XXVYHC6D.js';
-import { GUEST_CID, linkVsockSockets } from './chunk-O5F376JJ.js';
-import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-JKPJQNJF.js';
-import { runnerImageVersion } from './chunk-PWB7EK4Z.js';
+import { runExec, execCapture, waitForAgent } from './chunk-6NWS455T.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-LWTBE5J6.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-RAHE2AYU.js';
+import { runnerImageVersion } from './chunk-SK4TWCN3.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-LG2IQRTO.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-HGZXTPRO.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-R6QCSHKC.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-KFA762LZ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { WorkCommandError } from './chunk-KQFWTTG7.js';
+import { WorkCommandError } from './chunk-TDVG6MCO.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-5DNCFOXA.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-MBGS33SL.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-D5ZGMXUL.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-AGZNCIIJ.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, writeBuildMavenSettings, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BCCI32ME.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-LJG6EMLJ.js';
@@ -2288,6 +2288,7 @@ var RECEIVE_ARGV = ["/opt/outerlayer/bin/node", "/opt/outerlayer/cli/dist/index.
 var REASON_LINE_MAX = 240;
 var STEPS = {
   gh: "the build's gh configuration",
+  maven: "the build's Maven settings",
   "git-hooks": "the commit hooks",
   context: "the staged context",
   "eval-input": "the checks' input"
@@ -3665,6 +3666,11 @@ async function provisionContainer(input) {
       err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's gh configuration could not be written: ${describeCallFailure(err)}`
     );
   }
+  try {
+    writeBuildMavenSettings(buildDir2);
+  } catch (err) {
+    return bail(`the build's Maven settings could not be written: ${describeCallFailure(err)}`);
+  }
   for (const entry of repositories) {
     if (entry.repository === primary.repository) continue;
     try {
@@ -3709,7 +3715,7 @@ async function provisionContainer(input) {
   joinBuild(runtime, state, services, (line) => log.line(`${tag} ${line}`));
   if (input.aborted()) return bail("", true);
   if (!await waitForRelay(runtime, state)) return bail("the relay in the build's container did not start");
-  const ghDelivered = await deliverGhConfig(runtime, state, secrets);
+  const ghDelivered = await deliverJobFiles(runtime, state, ["gh", "maven"], secrets);
   if (!ghDelivered.ok) return bail(ghDelivered.reason);
   keepGhConfigCurrent(tokens, buildDir2, (err) => log.error(`${tag} the read token could not be written for gh: ${describeCallFailure(err)}`), {
     runtime,
@@ -3744,6 +3750,7 @@ async function provisionContainer(input) {
   if (hashed !== void 0) state.judgeProgram = { path: JUDGE_PROGRAM, sha256: hashed };
   input.save(state, environment);
   const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
   const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env: execEnv, argv }, opts?.quiet === true ? void 0 : { logPath });
   const steps = await runBuildSteps({
     repository,
@@ -3926,7 +3933,7 @@ async function ensureTunnel(runtime, state, jobDir, config, itemKey, branch, rep
 }
 async function redeliver(runtime, state, jobDir) {
   if (!filesAreCopied(state)) return { ok: true };
-  const parts = ["gh", "git-hooks", "context"];
+  const parts = ["gh", "maven", "git-hooks", "context"];
   return deliverJobFiles(runtime, state, parts, secretsOf(runtime, jobDir));
 }
 async function deliverContainerHooks(runtime, state, jobDir) {

package/dist/{chunk-W4UFGYKQ.js → chunk-6C2YWM6N.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-A6MLCH76.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-ZRRUWNJS.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-LOYLFW4I.js → chunk-6IKSUAIA.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { isAgentsMdLayout } from './chunk-HJYBWJAS.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-FLFK42YF.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-WPGBDY73.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-GFYEMCPP.js';

package/dist/{chunk-XCUXPSHL.js → chunk-6KLPC4U7.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect, detectActiveSession } from './chunk-RLGSBR56.js';
+import { autoConnect, detectActiveSession } from './chunk-2QT4JUW3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-FLFK42YF.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-WPGBDY73.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-XXVYHC6D.js → chunk-6NWS455T.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-O5F376JJ.js';
+import { EXEC_PORT } from './chunk-LWTBE5J6.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-VGIS2D3U.js → chunk-6PUSHKJ6.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-HAD7LYDL.js';
-import { writeDockerClientConfig } from './chunk-TTACRX4N.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-W5DOK7BL.js';
+import { writeDockerClientConfig } from './chunk-QL3LPZ67.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JUVUVXQZ.js';
-import { installScrubContext } from './chunk-J6LFFZOY.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-OKTLQTWH.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-7HMF7I3D.js';
+import { senderPidfile } from './chunk-JR4TZLG6.js';
+import { installScrubContext } from './chunk-A33USDCE.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-5CZVJVTP.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-BMCPLX2W.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { waitForAgent, vmExecArgs } from './chunk-XXVYHC6D.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-O5F376JJ.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-JKPJQNJF.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-LG2IQRTO.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-R6QCSHKC.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ZQ7VRXYM.js';
+import { waitForAgent, vmExecArgs } from './chunk-6NWS455T.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-LWTBE5J6.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RAHE2AYU.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-HGZXTPRO.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-KFA762LZ.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-5BNWAIHN.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-KQFWTTG7.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-TDVG6MCO.js';
 import { planArtifactUpload } from './chunk-EWVYQLD3.js';
 import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-634F6J3Q.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-MBGS33SL.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-D5ZGMXUL.js';
+import { signerFor } from './chunk-AA6LYZC4.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-AGZNCIIJ.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BCCI32ME.js';
 import { resolvePackRoot } from './chunk-G63KT5I5.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -189,6 +189,7 @@ var DOCKER_LOG_LINES = 20;
 var GUEST_GH_DIR = `${JOB_MOUNT}/gh`;
 var GUEST_HOOKS_DIR = `${JOB_MOUNT}/git-hooks`;
 var GUEST_CONTEXT_DIR = `${JOB_MOUNT}/context`;
+var GUEST_MAVEN_DIR = `${JOB_MOUNT}/maven`;
 function buildMemoryBytes(config) {
   return parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY);
 }
@@ -221,6 +222,11 @@ async function writeGuestGhConfig(runtime, state, token) {
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], ghHostsYml(token));
   if (result.status !== 0) throw new Error(`writing gh's configuration in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
 }
+async function writeGuestMavenSettings(runtime, state) {
+  const script = ["set -e", "umask 022", `mkdir -p ${GUEST_MAVEN_DIR}`, `cat > ${GUEST_MAVEN_DIR}/${MAVEN_SETTINGS_FILE}`].join("\n");
+  const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], buildMavenSettingsXml());
+  if (result.status !== 0) throw new Error(`writing Maven's settings in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
+}
 async function unpackIntoGuest(runtime, state, dir, target, opts = {}) {
   const script = opts.readOnly === true ? `set -e; rm -rf ${target}; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX,a-w ${target}` : `set -e; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX ${target}`;
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], tarOf(dir));
@@ -563,7 +569,13 @@ async function provisionMicroVm(input) {
     const failure = await waitForDocker(runtime, state, agentUser, input.now ?? (() => /* @__PURE__ */ new Date()));
     if (failure !== void 0) return bail(failure);
   }
+  try {
+    await writeGuestMavenSettings(runtime, state);
+  } catch (err) {
+    return bail(`the build's Maven settings could not be delivered: ${describeCallFailure(err)}`);
+  }
   const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
   const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, execEnv) });
   const steps = await runBuildSteps({
     repository,
@@ -1286,14 +1298,106 @@ function proxyUrlFor(build) {
   if (build.broker === void 0) return `http://127.0.0.1:${RELAY_PORT}`;
   return `http://${build.broker}`;
 }
-function hostCommandEnvironment(base, build, config, hooksPath) {
+function withMavenArgs(env, settingsFile, note) {
+  const team = env.MAVEN_ARGS;
+  if (team !== void 0 && namesGlobalSettings(team)) {
+    note?.(MAVEN_NO_PROXY_NOTE);
+    return;
+  }
+  if (settingsFile !== void 0) env.MAVEN_ARGS = mavenArgs(settingsFile, team).value;
+}
+function hostMavenSettings(env, buildDir2, note) {
+  if (/\s/.test(buildDir2)) {
+    note?.(MAVEN_SPACE_NOTE);
+    return void 0;
+  }
+  if (!existsSync(buildDir2)) return void 0;
+  try {
+    return writeMavenSettings(buildDir2, env.HTTPS_PROXY, env.NO_PROXY);
+  } catch (err) {
+    note?.(`the build's Maven settings could not be written, so its Maven gets no proxy from the runner: ${describeCallFailure(err)}`);
+    return void 0;
+  }
+}
+function execProxyEnvironment(build) {
+  const brokerHost = build.broker === void 0 ? void 0 : build.broker.slice(0, build.broker.lastIndexOf(":")).replace(/^\[|\]$/g, "");
+  return proxyEnvironment(proxyUrlFor(build), brokerHost);
+}
+var WRITE_MAVEN_SETTINGS = 'd=$(git rev-parse --absolute-git-dir) || exit 1; d="$d/outerlayer/maven"; mkdir -p "$d" && printf "%s" "$1" > "$d/settings.xml" && printf "%s\\n" "$d/settings.xml"';
+var MAVEN_WRITE_TIMEOUT_MS = 1e4;
+function runWithSpawn(spawnFn = spawn) {
+  return (file, args, env, timeoutMs) => new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let timer;
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      if (timer !== void 0) clearTimeout(timer);
+      resolve({ status: null, signal: null, stdout, stderr, ...result });
+    };
+    let child;
+    try {
+      child = spawnFn(file, args, { env, stdio: ["ignore", "pipe", "pipe"] });
+    } catch (err) {
+      finish({ error: err instanceof Error ? err : new Error(String(err)) });
+      return;
+    }
+    timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({ error: new Error(`it did not finish in ${timeoutMs / 1e3}s`) });
+    }, timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", (err) => finish({ error: err }));
+    child.on("close", (status, signal) => finish({ status, signal }));
+  });
+}
+async function deliverMavenSettings(build, workdir, base, run, timeoutMs = MAVEN_WRITE_TIMEOUT_MS) {
+  if (build.exec === void 0) return { reason: "the build has no exec" };
+  const env = { ...base, ...execProxyEnvironment(build) };
+  const ran = await run(build.exec, execArgv(workdir, ["/bin/sh", "-c", WRITE_MAVEN_SETTINGS, "sh", mavenSettingsXml(env.HTTPS_PROXY, env.NO_PROXY)]), env, timeoutMs);
+  if (ran.error !== void 0) return { reason: describeCallFailure(ran.error) };
+  const said = ran.stderr.trim().split("\n")[0];
+  if (ran.status !== 0) return { reason: `the write exited ${ran.status ?? ran.signal}${said === "" ? "" : `: ${said}`}` };
+  const lines = ran.stdout.trim().split("\n");
+  const path = lines[lines.length - 1].trim();
+  if (!isAbsolute(path)) return { reason: "the write did not report an absolute path" };
+  if (/\s/.test(path)) return { reason: MAVEN_SPACE_REASON };
+  return { path };
+}
+var MAVEN_SPACE_REASON = "the settings file's path has whitespace in it, which Maven cannot read from MAVEN_ARGS";
+async function deliverExecMaven(build, workdir, base, run, note) {
+  if (build?.exec === void 0) return;
+  const delivered = await deliverMavenSettings(build, workdir, base, run);
+  if ("path" in delivered) build.mavenSettings = delivered.path;
+  else note(`the build's Maven gets no proxy from the runner: ${delivered.reason}`);
+}
+function onceNote(write) {
+  const seen = /* @__PURE__ */ new Set();
+  return (line) => {
+    if (seen.has(line)) return;
+    seen.add(line);
+    write(line);
+  };
+}
+function attemptNote(log, tag) {
+  return onceNote((line) => log.line(`${tag} ${line}`));
+}
+function hostCommandEnvironment(base, build, config, hooksPath, note) {
   let env = { ...base };
   if (build.exec !== void 0) {
-    const brokerHost = build.broker === void 0 ? void 0 : build.broker.slice(0, build.broker.lastIndexOf(":")).replace(/^\[|\]$/g, "");
-    Object.assign(env, proxyEnvironment(proxyUrlFor(build), brokerHost));
+    Object.assign(env, execProxyEnvironment(build));
+    withMavenArgs(env, build.mavenSettings, note);
   } else if (build.proxyPort !== void 0) {
     Object.assign(env, proxyEnvironment(`http://127.0.0.1:${build.proxyPort}`));
     env.NODE_OPTIONS = withProxyWarningHidden(env.NODE_OPTIONS);
+    withMavenArgs(env, hostMavenSettings(env, build.buildDir, note), note);
   }
   const ports = build.destinations ?? [];
   const portOf = (name) => ports.find((entry) => entry.name === name)?.port;
@@ -3658,4 +3762,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, foldSample, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, sampleGuest, serveLease, setStage, startHostServices, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, attemptNote, commandLogOffset, deliverCommitHooks, deliverExecMaven, describeHookEnd, execArgv, execCommandLine, finishJob, foldSample, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, runWithSpawn, sampleGuest, serveLease, setStage, startHostServices, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-ZZAA73E5.js → chunk-6YHUMNUB.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-J6LFFZOY.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-A33USDCE.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-RLGSBR56.js';
+import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FLFK42YF.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-E6CO3MJE.js';

package/dist/{chunk-J6LFFZOY.js → chunk-A33USDCE.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-EBX2DU2M.js';
+import { uploadSpooledSteps } from './chunk-DETKDTNL.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-EWVYQLD3.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FLFK42YF.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-634F6J3Q.js';
-import { writeSyncStatus, spoolDir } from './chunk-ZANK3WWF.js';
+import { signerFor, signRunnerRequest } from './chunk-AA6LYZC4.js';
+import { writeSyncStatus, spoolDir } from './chunk-WB7LPDXR.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';