@outerlayer/cli 0.33.0-next.20261022180022 → 0.33.0-next.20261022182340

package/dist/{chunk-634F6J3Q.js → chunk-AA6LYZC4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-MBGS33SL.js → chunk-AGZNCIIJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-D5ZGMXUL.js';
+import { BUILD_HOME } from './chunk-BCCI32ME.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);

package/dist/{chunk-D5ZGMXUL.js → chunk-BCCI32ME.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { parseRunnerEnv } from './chunk-HACGUL52.js';
 import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-MESOOLF4.js';
-import { readFileSync, existsSync, unlinkSync, chmodSync } from 'fs';
+import { readFileSync, mkdirSync, writeFileSync, existsSync, unlinkSync, chmodSync } from 'fs';
 import { join, dirname } from 'path';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
@@ -572,8 +572,61 @@ function repositoriesOf(input) {
 function primaryOf(repositories) {
   return repositories.find((entry) => entry.primary) ?? repositories[0];
 }
+var MAVEN_DIR = "maven";
+var MAVEN_SETTINGS_FILE = "settings.xml";
+var MAVEN_NO_PROXY_NOTE = "MAVEN_ARGS names its own global settings file, so the build's Maven gets no proxy from the runner";
+var MAVEN_SPACE_NOTE = "the build's directory has whitespace in its path, which Maven cannot read from MAVEN_ARGS, so its Maven gets no proxy from the runner";
+function namesGlobalSettings(args) {
+  return args.split(/\s+/).some((token) => token === "--global-settings" || token.startsWith("--global-settings=") || token === "-gs" || token.startsWith("-gs="));
+}
+function escapeXml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function mavenSettingsXml(proxyUrl, noProxy) {
+  const url = new URL(proxyUrl);
+  const host = escapeXml(url.hostname.replace(/^\[|\]$/g, ""));
+  const nonProxyHosts = escapeXml(noProxy.split(",").filter((entry) => entry !== "").join("|"));
+  const proxy = (protocol) => [
+    "    <proxy>",
+    `      <id>outerlayer-${protocol}</id>`,
+    "      <active>true</active>",
+    `      <protocol>${protocol}</protocol>`,
+    `      <host>${host}</host>`,
+    `      <port>${url.port}</port>`,
+    `      <nonProxyHosts>${nonProxyHosts}</nonProxyHosts>`,
+    "    </proxy>"
+  ].join("\n");
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0">',
+    "  <proxies>",
+    proxy("http"),
+    proxy("https"),
+    "  </proxies>",
+    "</settings>",
+    ""
+  ].join("\n");
+}
+function writeMavenSettings(buildDir, proxyUrl, noProxy) {
+  const dir = join(buildDir, MAVEN_DIR);
+  mkdirSync(dir, { recursive: true });
+  const file = join(dir, MAVEN_SETTINGS_FILE);
+  writeFileSync(file, mavenSettingsXml(proxyUrl, noProxy));
+  return file;
+}
+function mavenArgs(settingsFile, team) {
+  const own = team?.trim() ?? "";
+  if (own !== "" && namesGlobalSettings(own)) return { value: team, skipped: true };
+  return { value: own === "" ? `--global-settings ${settingsFile}` : `--global-settings ${settingsFile} ${own}`, skipped: false };
+}
 
 // src/runner/container/environment.ts
+function buildMavenSettingsXml() {
+  return mavenSettingsXml(PROXY_URL, proxyEnvironment(PROXY_URL).NO_PROXY);
+}
+function writeBuildMavenSettings(buildDir) {
+  writeMavenSettings(buildDir, PROXY_URL, proxyEnvironment(PROXY_URL).NO_PROXY);
+}
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
 var EVAL_INPUT_DIR = `${JOB_MOUNT}/eval-input`;
@@ -593,6 +646,7 @@ function lifecycleWorkdir(repositories, governingRepository) {
   return entry === void 0 ? CHECKOUT_DIR : checkoutPath(entry);
 }
 var MAX_HOSTS = 200;
+var MAVEN_SETTINGS_IN_BUILD = `${JOB_MOUNT}/${MAVEN_DIR}/${MAVEN_SETTINGS_FILE}`;
 function tokenVariables() {
   return ["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "GITHUB_ENTERPRISE_TOKEN"];
 }
@@ -692,6 +746,14 @@ function buildEnvironment(input) {
     if (passed.NODE_OPTIONS !== void 0) passed.NODE_OPTIONS = withProxyWarningHidden(passed.NODE_OPTIONS);
     else nodeOptions.NODE_OPTIONS = withProxyWarningHidden(recipe.NODE_OPTIONS ?? input.imageEnv.NODE_OPTIONS);
   }
+  const mavenLiterals = {};
+  const notices = [];
+  if (input.imageEnv !== void 0 && input.mavenProxy !== false) {
+    const { value, skipped } = mavenArgs(MAVEN_SETTINGS_IN_BUILD, passed.MAVEN_ARGS ?? recipe.MAVEN_ARGS ?? input.imageEnv.MAVEN_ARGS);
+    if (passed.MAVEN_ARGS !== void 0) passed.MAVEN_ARGS = value;
+    else mavenLiterals.MAVEN_ARGS = value;
+    if (skipped) notices.push(MAVEN_NO_PROXY_NOTE);
+  }
   const destinations = destinationEnvironment(input.config.build?.destinations, containerLocalAddress);
   const builtInLiterals = builtIns ? builtInEnvironment(containerBuiltInAddress, claudeCredential(input.hostEnv)) : {};
   const hooksPath = input.identity?.hooksPath;
@@ -710,6 +772,7 @@ function buildEnvironment(input) {
     literals: {
       ...recipe,
       ...nodeOptions,
+      ...mavenLiterals,
       ...destinations,
       ...runnerLiterals(input.repository, repositoriesOf({ repositories: input.repositories, repository: input.repository, branch: input.branch })),
       ...builtInLiterals,
@@ -718,7 +781,8 @@ function buildEnvironment(input) {
     },
     passed,
     variables,
-    skippedTokenVariables
+    skippedTokenVariables,
+    notices
   };
 }
 function checkEnvironment(input) {
@@ -730,7 +794,9 @@ function checkEnvironment(input) {
     hostEnv: input.hostEnv,
     containerEnv: input.containerEnv,
     builtIns: false,
-    imageEnv: input.imageEnv
+    imageEnv: input.imageEnv,
+    // A check container is given no settings file, so a `MAVEN_ARGS` naming one would break the check's Maven.
+    mavenProxy: false
   });
   const withheld = /* @__PURE__ */ new Set(["OUTERLAYER_URL", "OUTERLAYER_API_KEY", ...CLAUDE_CREDENTIAL_VARIABLES]);
   const literals = { OUTERLAYER_EVAL_INPUT: EVAL_INPUT_DIR, OUTERLAYER_CHECK_ITEMS: CHECK_ITEMS_FILE };
@@ -772,4 +838,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };

package/dist/{chunk-7HMF7I3D.js → chunk-BMCPLX2W.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-ZFJAQS3A.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-DDS2ISML.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-R6QCSHKC.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-MBGS33SL.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-D5ZGMXUL.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-KFA762LZ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-AGZNCIIJ.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BCCI32ME.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';

package/dist/{chunk-FSFAP7GA.js → chunk-BY36DVJV.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-RLGSBR56.js';
+import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-2QT4JUW3.js';
 import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FLFK42YF.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-JFRBPBD5.js → chunk-CMZVDKOX.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { formatBytes, freeBytes } from './chunk-YYYRBYWG.js';
-import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-LG2IQRTO.js';
+import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-HGZXTPRO.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { buildsDir, rootfsDir, runnerDir } from './chunk-MBGS33SL.js';
+import { buildsDir, rootfsDir, runnerDir } from './chunk-AGZNCIIJ.js';
 import { spawnSync } from 'child_process';
 import { existsSync, statSync, readdirSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-HDD3BKAE.js → chunk-CUBIZBMF.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-A6MLCH76.js';
-import { RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
-import { claudeEnvPath, withoutCredentialLines } from './chunk-D5ZGMXUL.js';
+import { DEFAULT_UNIT_NAME } from './chunk-ZRRUWNJS.js';
+import { RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { claudeEnvPath, withoutCredentialLines } from './chunk-BCCI32ME.js';
 import { parseRunnerEnv } from './chunk-HACGUL52.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-ZFJAQS3A.js → chunk-DDS2ISML.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-EBX2DU2M.js → chunk-DETKDTNL.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-RLGSBR56.js';
+import { autoConnect, detectActiveSession } from './chunk-2QT4JUW3.js';
 import { acquireSpoolLockAt } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FLFK42YF.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-E6CO3MJE.js';

package/dist/{chunk-YMGSMPPW.js → chunk-EYW2ZRDL.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-UIUGTW5C.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-FLFK42YF.js';
-import { withTokenHeader } from './chunk-D5ZGMXUL.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-WPGBDY73.js';
+import { withTokenHeader } from './chunk-BCCI32ME.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-ZQSCE7M4.js → chunk-FAZDYI2D.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-RLGSBR56.js';
+import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-FLFK42YF.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { CriteriaListSchema } from './chunk-E6CO3MJE.js';

package/dist/{chunk-M7IA4JOX.js → chunk-FVY5OU3N.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-HDD3BKAE.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-6KVKEZTH.js';
-import { MIN_ENGINE_MAJOR } from './chunk-OKTLQTWH.js';
-import { runnerCredentialProblem } from './chunk-ZQ7VRXYM.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-CUBIZBMF.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-X2LZ2IHE.js';
+import { MIN_ENGINE_MAJOR } from './chunk-5CZVJVTP.js';
+import { runnerCredentialProblem } from './chunk-5BNWAIHN.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-DZGLRVS3.js → chunk-GN2R5Z7G.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-Y53T3QZM.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-O7MSQBTH.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-GWDS42JC.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-OWDSO3PE.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-MBGS33SL.js';
+import { RUNNER_DIR_MODE } from './chunk-AGZNCIIJ.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-Y53T3QZM.js → chunk-GWDS42JC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-O7MSQBTH.js';
+import { currentLink } from './chunk-OWDSO3PE.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-LG2IQRTO.js → chunk-HGZXTPRO.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-3Z3MPR55.js';
-import { BUILDKIT_IMAGE } from './chunk-R6QCSHKC.js';
+import { BUILDKIT_IMAGE } from './chunk-KFA762LZ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { compareVersions } from './chunk-5DNCFOXA.js';
-import { ensureHostKey } from './chunk-634F6J3Q.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-MBGS33SL.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-D5ZGMXUL.js';
+import { ensureHostKey } from './chunk-AA6LYZC4.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-AGZNCIIJ.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BCCI32ME.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';

package/dist/{chunk-5KO3TN2F.js → chunk-JEKENLLA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-JUVUVXQZ.js → chunk-JR4TZLG6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-J6LFFZOY.js';
+import { LiveUploader } from './chunk-A33USDCE.js';
 import { CaptureDaemon } from './chunk-5DNCFOXA.js';
-import { spoolDir } from './chunk-ZANK3WWF.js';
+import { spoolDir } from './chunk-WB7LPDXR.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-R6QCSHKC.js → chunk-KFA762LZ.js}

@@ -29,13 +29,13 @@ var FIRECRACKER_SHA256 = {
 var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
-var GUEST_ASSETS_VERSION = "7";
+var GUEST_ASSETS_VERSION = "11";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
   x86_64: "8552fad4bdea1d49f3e7d2aa500ce3f8918fcd2fc66779fd83235949688a39bb"
 };
 var GUEST_HELPER_SHA256 = {
-  x86_64: "0ae934d3ad3f2a94abffcc3f044ba633b1a523dc17ff0c2bc322ed7d7fc505ea"
+  x86_64: "e373f0fdb192e9930d19dd39cf75ff1c6cf08fdf5a0f041f12c1f999919fc05a"
 };
 function guestAssetsPinned(arch) {
   const zero = "0".repeat(64);

package/dist/{chunk-O5F376JJ.js → chunk-LWTBE5J6.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-D5ZGMXUL.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-BCCI32ME.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-GDI6QGRH.js → chunk-ODHEQ4TA.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-BJQ25STI.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-LOYLFW4I.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-KQFWTTG7.js';
-import { isLinkedRepository } from './chunk-CMNAAKFD.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-6IKSUAIA.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-TDVG6MCO.js';
+import { isLinkedRepository } from './chunk-ZQOSIMKU.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { checkFormerSkillNames } from './chunk-UIUGTW5C.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-FLFK42YF.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-ZANK3WWF.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-WPGBDY73.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-WB7LPDXR.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1190,8 +1190,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK } = await import('./build-disk-PCDS676T.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-WAIYUZUG.js');
+  const { DEFAULT_BUILD_DISK } = await import('./build-disk-6T4WR3XI.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-DUY2PT7K.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1212,7 +1212,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-C3JKNKEJ.js');
+    const { runnerHostChecks } = await import('./doctor-D5JNQ6U7.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1240,7 +1240,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-DNLXTXLA.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-4OPPUC72.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-NLVYISAV.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-O7MSQBTH.js → chunk-OWDSO3PE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-TTACRX4N.js → chunk-QL3LPZ67.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-D5ZGMXUL.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-BCCI32ME.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-7SCEDWQP.js → chunk-R3DSBA3J.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-M7IA4JOX.js';
-import { describeCallFailure } from './chunk-JKPJQNJF.js';
-import { checkFit } from './chunk-A6MLCH76.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-JFRBPBD5.js';
-import { builderDiskPinned } from './chunk-R6QCSHKC.js';
-import { builtinKind, imageBuildOf } from './chunk-ZQ7VRXYM.js';
-import { WorkCommandError, getJson } from './chunk-KQFWTTG7.js';
+import { isPlaceholderCommand } from './chunk-FVY5OU3N.js';
+import { describeCallFailure } from './chunk-RAHE2AYU.js';
+import { checkFit } from './chunk-ZRRUWNJS.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-CMZVDKOX.js';
+import { builderDiskPinned } from './chunk-KFA762LZ.js';
+import { builtinKind, imageBuildOf } from './chunk-5BNWAIHN.js';
+import { WorkCommandError, getJson } from './chunk-TDVG6MCO.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
-import { signerFor } from './chunk-634F6J3Q.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-D5ZGMXUL.js';
+import { signerFor } from './chunk-AA6LYZC4.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-BCCI32ME.js';
 import { closeSync, openSync, constants } from 'fs';
 import { totalmem } from 'os';
 

package/dist/{chunk-JKPJQNJF.js → chunk-RAHE2AYU.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-KQFWTTG7.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-YMGSMPPW.js';
-import { signingFetchFor } from './chunk-FLFK42YF.js';
-import { signerFor } from './chunk-634F6J3Q.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-MBGS33SL.js';
+import { WorkCommandError, postJson } from './chunk-TDVG6MCO.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-EYW2ZRDL.js';
+import { signingFetchFor } from './chunk-WPGBDY73.js';
+import { signerFor } from './chunk-AA6LYZC4.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-AGZNCIIJ.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';

package/dist/{chunk-PWB7EK4Z.js → chunk-SK4TWCN3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-J5VNSW4W.js → chunk-T4BJBF7L.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-VGIS2D3U.js';
+import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-6PUSHKJ6.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-QPAPHQZ7.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UOFBHIOZ.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-W4UFGYKQ.js';
+import { fitImageBuildMemory } from './chunk-6C2YWM6N.js';
 import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
-import { writePendingUpdate } from './chunk-5KO3TN2F.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-7SCEDWQP.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-O7MSQBTH.js';
+import { writePendingUpdate } from './chunk-JEKENLLA.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-R3DSBA3J.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-OWDSO3PE.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-OKTLQTWH.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-ZFJAQS3A.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-5CZVJVTP.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-DDS2ISML.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-JKPJQNJF.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-PWB7EK4Z.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RAHE2AYU.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-SK4TWCN3.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-LG2IQRTO.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ZQ7VRXYM.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-HGZXTPRO.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-5BNWAIHN.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KQFWTTG7.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-634F6J3Q.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-MBGS33SL.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-D5ZGMXUL.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-TDVG6MCO.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-AA6LYZC4.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AGZNCIIJ.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BCCI32ME.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
@@ -1837,7 +1837,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-IGYK3MVP.js');
+  const { postJson: postJson2 } = await import('./work-cmd-H7LLCT2W.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2018,6 +2018,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   attemptLogsOf(state).note(item.number, claimLine);
   const hookLimits = () => hookLimitsFor(state.config, startedAt.getTime(), state.deps.now);
   const tag = `#${item.number}`;
+  const noteOnce = attemptNote(log, tag);
   const containerMode = isBuiltinContainer(state.config.hooks.provision);
   const vmMode = isBuiltinVm(state.config.hooks.provision);
   let tokens;
@@ -2280,8 +2281,11 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     }
     active.job.environment = hostEnvironment(named, cliVersion);
     writeJobFile(jobFilePath, active.job);
+    await deliverExecMaven(build?.state, provisioned.workdir, jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), runWithSpawn(state.deps.spawnFn), noteOnce);
+    if (active.ending) return;
+    writeJobFile(jobFilePath, active.job);
     if (named.exec !== void 0 && named.recipe !== void 0) {
-      const lifecycleEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build.state, state.config);
+      const lifecycleEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build.state, state.config, void 0, noteOnce);
       for (const step of lifecycleSteps(named.recipe.apply.lifecycle)) {
         if (active.ending) return;
         log.line(`${tag} lifecycle ${step.name} (${step.source})`);
@@ -2363,7 +2367,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       }
     } else {
       const build = job.build;
-      const commandEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build, state.config, identity?.hooksPath);
+      const commandEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build, state.config, identity?.hooksPath, noteOnce);
       running = build.exec === void 0 ? runCommand(cmdline, commandEnv, workdir, join(dirPath, "command.log"), state.deps.spawnFn) : runCommand(execCommandLine(build.exec, workdir, cmdline), commandEnv, dirPath, join(dirPath, "command.log"), state.deps.spawnFn);
     }
   } catch (err) {
@@ -3033,7 +3037,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-LGZOJYLS.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-DUVKQSXY.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log