@outerlayer/cli 0.33.0-next.20261022182214 → 0.33.0-next.20261022194605

package/dist/{chunk-F5HZT672.js → chunk-FMH6LSUE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-JDKLORO3.js';
-import { runnerImageVersion } from './chunk-PWB7EK4Z.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-KFA762LZ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-SVXFSQRD.js';
+import { runnerImageVersion } from './chunk-SK4TWCN3.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-TGHBOXKJ.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-DZGLRVS3.js → chunk-GN2R5Z7G.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-Y53T3QZM.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-O7MSQBTH.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-GWDS42JC.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-OWDSO3PE.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-MBGS33SL.js';
+import { RUNNER_DIR_MODE } from './chunk-AGZNCIIJ.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-Y53T3QZM.js → chunk-GWDS42JC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-O7MSQBTH.js';
+import { currentLink } from './chunk-OWDSO3PE.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-IQFX5GQH.js → chunk-IYH4R4EZ.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-COLOLDY3.js';
-import { writeDockerClientConfig } from './chunk-TTACRX4N.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-W5DOK7BL.js';
+import { writeDockerClientConfig } from './chunk-QL3LPZ67.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JUVUVXQZ.js';
-import { installScrubContext } from './chunk-J6LFFZOY.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-JDKLORO3.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-MWAA3A5T.js';
+import { senderPidfile } from './chunk-JR4TZLG6.js';
+import { installScrubContext } from './chunk-A33USDCE.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-SVXFSQRD.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-KLXWS5Z7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { waitForAgent, vmExecArgs } from './chunk-XXVYHC6D.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-O5F376JJ.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-JKPJQNJF.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-5CZV4FZ5.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-KFA762LZ.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ZQ7VRXYM.js';
+import { waitForAgent, vmExecArgs } from './chunk-6NWS455T.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-LWTBE5J6.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RAHE2AYU.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-43PV5KDB.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TGHBOXKJ.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-5BNWAIHN.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-KQFWTTG7.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-TDVG6MCO.js';
 import { planArtifactUpload } from './chunk-EWVYQLD3.js';
 import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-634F6J3Q.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-MBGS33SL.js';
-import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-D5ZGMXUL.js';
+import { signerFor } from './chunk-AA6LYZC4.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-AGZNCIIJ.js';
+import { JOB_MOUNT, claudeCredential, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, buildMavenSettingsXml, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, currentClaudeCredential, removedClaudeCredentialValues, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BCCI32ME.js';
 import { resolvePackRoot } from './chunk-G63KT5I5.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -189,6 +189,7 @@ var DOCKER_LOG_LINES = 20;
 var GUEST_GH_DIR = `${JOB_MOUNT}/gh`;
 var GUEST_HOOKS_DIR = `${JOB_MOUNT}/git-hooks`;
 var GUEST_CONTEXT_DIR = `${JOB_MOUNT}/context`;
+var GUEST_MAVEN_DIR = `${JOB_MOUNT}/maven`;
 function buildMemoryBytes(config) {
   return parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY);
 }
@@ -221,6 +222,11 @@ async function writeGuestGhConfig(runtime, state, token) {
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], ghHostsYml(token));
   if (result.status !== 0) throw new Error(`writing gh's configuration in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
 }
+async function writeGuestMavenSettings(runtime, state) {
+  const script = ["set -e", "umask 022", `mkdir -p ${GUEST_MAVEN_DIR}`, `cat > ${GUEST_MAVEN_DIR}/${MAVEN_SETTINGS_FILE}`].join("\n");
+  const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], buildMavenSettingsXml());
+  if (result.status !== 0) throw new Error(`writing Maven's settings in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
+}
 async function unpackIntoGuest(runtime, state, dir, target, opts = {}) {
   const script = opts.readOnly === true ? `set -e; rm -rf ${target}; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX,a-w ${target}` : `set -e; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX ${target}`;
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], tarOf(dir));
@@ -563,7 +569,13 @@ async function provisionMicroVm(input) {
     const failure = await waitForDocker(runtime, state, agentUser, input.now ?? (() => /* @__PURE__ */ new Date()));
     if (failure !== void 0) return bail(failure);
   }
+  try {
+    await writeGuestMavenSettings(runtime, state);
+  } catch (err) {
+    return bail(`the build's Maven settings could not be delivered: ${describeCallFailure(err)}`);
+  }
   const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
   const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, execEnv) });
   const steps = await runBuildSteps({
     repository,
@@ -1286,14 +1298,106 @@ function proxyUrlFor(build) {
   if (build.broker === void 0) return `http://127.0.0.1:${RELAY_PORT}`;
   return `http://${build.broker}`;
 }
-function hostCommandEnvironment(base, build, config, hooksPath) {
+function withMavenArgs(env, settingsFile, note) {
+  const team = env.MAVEN_ARGS;
+  if (team !== void 0 && namesGlobalSettings(team)) {
+    note?.(MAVEN_NO_PROXY_NOTE);
+    return;
+  }
+  if (settingsFile !== void 0) env.MAVEN_ARGS = mavenArgs(settingsFile, team).value;
+}
+function hostMavenSettings(env, buildDir2, note) {
+  if (/\s/.test(buildDir2)) {
+    note?.(MAVEN_SPACE_NOTE);
+    return void 0;
+  }
+  if (!existsSync(buildDir2)) return void 0;
+  try {
+    return writeMavenSettings(buildDir2, env.HTTPS_PROXY, env.NO_PROXY);
+  } catch (err) {
+    note?.(`the build's Maven settings could not be written, so its Maven gets no proxy from the runner: ${describeCallFailure(err)}`);
+    return void 0;
+  }
+}
+function execProxyEnvironment(build) {
+  const brokerHost = build.broker === void 0 ? void 0 : build.broker.slice(0, build.broker.lastIndexOf(":")).replace(/^\[|\]$/g, "");
+  return proxyEnvironment(proxyUrlFor(build), brokerHost);
+}
+var WRITE_MAVEN_SETTINGS = 'd=$(git rev-parse --absolute-git-dir) || exit 1; d="$d/outerlayer/maven"; mkdir -p "$d" && printf "%s" "$1" > "$d/settings.xml" && printf "%s\\n" "$d/settings.xml"';
+var MAVEN_WRITE_TIMEOUT_MS = 1e4;
+function runWithSpawn(spawnFn = spawn) {
+  return (file, args, env, timeoutMs) => new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let timer;
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      if (timer !== void 0) clearTimeout(timer);
+      resolve({ status: null, signal: null, stdout, stderr, ...result });
+    };
+    let child;
+    try {
+      child = spawnFn(file, args, { env, stdio: ["ignore", "pipe", "pipe"] });
+    } catch (err) {
+      finish({ error: err instanceof Error ? err : new Error(String(err)) });
+      return;
+    }
+    timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({ error: new Error(`it did not finish in ${timeoutMs / 1e3}s`) });
+    }, timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", (err) => finish({ error: err }));
+    child.on("close", (status, signal) => finish({ status, signal }));
+  });
+}
+async function deliverMavenSettings(build, workdir, base, run, timeoutMs = MAVEN_WRITE_TIMEOUT_MS) {
+  if (build.exec === void 0) return { reason: "the build has no exec" };
+  const env = { ...base, ...execProxyEnvironment(build) };
+  const ran = await run(build.exec, execArgv(workdir, ["/bin/sh", "-c", WRITE_MAVEN_SETTINGS, "sh", mavenSettingsXml(env.HTTPS_PROXY, env.NO_PROXY)]), env, timeoutMs);
+  if (ran.error !== void 0) return { reason: describeCallFailure(ran.error) };
+  const said = ran.stderr.trim().split("\n")[0];
+  if (ran.status !== 0) return { reason: `the write exited ${ran.status ?? ran.signal}${said === "" ? "" : `: ${said}`}` };
+  const lines = ran.stdout.trim().split("\n");
+  const path = lines[lines.length - 1].trim();
+  if (!isAbsolute(path)) return { reason: "the write did not report an absolute path" };
+  if (/\s/.test(path)) return { reason: MAVEN_SPACE_REASON };
+  return { path };
+}
+var MAVEN_SPACE_REASON = "the settings file's path has whitespace in it, which Maven cannot read from MAVEN_ARGS";
+async function deliverExecMaven(build, workdir, base, run, note) {
+  if (build?.exec === void 0) return;
+  const delivered = await deliverMavenSettings(build, workdir, base, run);
+  if ("path" in delivered) build.mavenSettings = delivered.path;
+  else note(`the build's Maven gets no proxy from the runner: ${delivered.reason}`);
+}
+function onceNote(write) {
+  const seen = /* @__PURE__ */ new Set();
+  return (line) => {
+    if (seen.has(line)) return;
+    seen.add(line);
+    write(line);
+  };
+}
+function attemptNote(log, tag) {
+  return onceNote((line) => log.line(`${tag} ${line}`));
+}
+function hostCommandEnvironment(base, build, config, hooksPath, note) {
   let env = { ...base };
   if (build.exec !== void 0) {
-    const brokerHost = build.broker === void 0 ? void 0 : build.broker.slice(0, build.broker.lastIndexOf(":")).replace(/^\[|\]$/g, "");
-    Object.assign(env, proxyEnvironment(proxyUrlFor(build), brokerHost));
+    Object.assign(env, execProxyEnvironment(build));
+    withMavenArgs(env, build.mavenSettings, note);
   } else if (build.proxyPort !== void 0) {
     Object.assign(env, proxyEnvironment(`http://127.0.0.1:${build.proxyPort}`));
     env.NODE_OPTIONS = withProxyWarningHidden(env.NODE_OPTIONS);
+    withMavenArgs(env, hostMavenSettings(env, build.buildDir, note), note);
   }
   const ports = build.destinations ?? [];
   const portOf = (name) => ports.find((entry) => entry.name === name)?.port;
@@ -3658,4 +3762,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, commandLogOffset, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, foldSample, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, sampleGuest, serveLease, setStage, startHostServices, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };
+export { ALREADY_RELEASED, AttemptLogBook, EXIT_CODE_FILE, GUEST_USAGE_INTERVAL_MS, MICROVM_COMMAND_DIR, RENEW_INTERVAL_SECONDS, appendCommandLog, attemptNote, commandLogOffset, deliverCommitHooks, deliverExecMaven, describeHookEnd, execArgv, execCommandLine, finishJob, foldSample, hookLimitsFor, hostCommandEnvironment, hostEnvironment, inTeardown, isContainerTracked, isGroupAlive, isIdle, isMicroVmTracked, isReadable, isTimedOut, isTracked, isUnfinished, jobEnv, judgeProbe, listAdoptableJobs, listTrackedJobs, listUnreadableJobs, listenOnBroker, microVmCommandLine, microVmOomKills, needsRenew, outcomeFromExitCode, probeCommand, probeMicroVmCommand, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, restartSender, retryFailedReleases, runCommand, runHook, runWithSpawn, sampleGuest, serveLease, setStage, startHostServices, startMicroVmCommand, startSender, stopOrphanedMicroVms, unfinishedJobs, vmAlive, workdirProblem, writeGuestGhConfig };

package/dist/{chunk-5KO3TN2F.js → chunk-JEKENLLA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-33SMNWZX.js → chunk-JMZZLICN.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-HDD3BKAE.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-F5HZT672.js';
-import { MIN_ENGINE_MAJOR } from './chunk-JDKLORO3.js';
-import { runnerCredentialProblem } from './chunk-ZQ7VRXYM.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-CUBIZBMF.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-FMH6LSUE.js';
+import { MIN_ENGINE_MAJOR } from './chunk-SVXFSQRD.js';
+import { runnerCredentialProblem } from './chunk-5BNWAIHN.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-JUVUVXQZ.js → chunk-JR4TZLG6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-J6LFFZOY.js';
+import { LiveUploader } from './chunk-A33USDCE.js';
 import { CaptureDaemon } from './chunk-5DNCFOXA.js';
-import { spoolDir } from './chunk-ZANK3WWF.js';
+import { spoolDir } from './chunk-WB7LPDXR.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-MWAA3A5T.js → chunk-KLXWS5Z7.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-ZFJAQS3A.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-DDS2ISML.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-KFA762LZ.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-MBGS33SL.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-D5ZGMXUL.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-TGHBOXKJ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-AGZNCIIJ.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BCCI32ME.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';

package/dist/{chunk-O5F376JJ.js → chunk-LWTBE5J6.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-D5ZGMXUL.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-BCCI32ME.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-O7MSQBTH.js → chunk-OWDSO3PE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-3BGCXC3O.js → chunk-P5FC7VUO.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { formatBytes, freeBytes } from './chunk-YYYRBYWG.js';
-import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-5CZV4FZ5.js';
+import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-43PV5KDB.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { buildsDir, rootfsDir, runnerDir } from './chunk-MBGS33SL.js';
+import { buildsDir, rootfsDir, runnerDir } from './chunk-AGZNCIIJ.js';
 import { spawnSync } from 'child_process';
 import { existsSync, statSync, readdirSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-TTACRX4N.js → chunk-QL3LPZ67.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-D5ZGMXUL.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-BCCI32ME.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-JKPJQNJF.js → chunk-RAHE2AYU.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-KQFWTTG7.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-YMGSMPPW.js';
-import { signingFetchFor } from './chunk-FLFK42YF.js';
-import { signerFor } from './chunk-634F6J3Q.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-MBGS33SL.js';
+import { WorkCommandError, postJson } from './chunk-TDVG6MCO.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-EYW2ZRDL.js';
+import { signingFetchFor } from './chunk-WPGBDY73.js';
+import { signerFor } from './chunk-AA6LYZC4.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-AGZNCIIJ.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';

package/dist/{chunk-MCIPCQP3.js → chunk-RXUZD7DC.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-IQFX5GQH.js';
+import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-IYH4R4EZ.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-QPAPHQZ7.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UOFBHIOZ.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { fitImageBuildMemory } from './chunk-W4UFGYKQ.js';
+import { fitImageBuildMemory } from './chunk-6C2YWM6N.js';
 import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
-import { writePendingUpdate } from './chunk-5KO3TN2F.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-PAFSFC6Q.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-O7MSQBTH.js';
+import { writePendingUpdate } from './chunk-JEKENLLA.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-V3MMJT4T.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-OWDSO3PE.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-JDKLORO3.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-ZFJAQS3A.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-SVXFSQRD.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-DDS2ISML.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-JKPJQNJF.js';
-import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-PWB7EK4Z.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RAHE2AYU.js';
+import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-SK4TWCN3.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-5CZV4FZ5.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ZQ7VRXYM.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43PV5KDB.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-5BNWAIHN.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KQFWTTG7.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-634F6J3Q.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-MBGS33SL.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-D5ZGMXUL.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-TDVG6MCO.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-AA6LYZC4.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AGZNCIIJ.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BCCI32ME.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
@@ -1837,7 +1837,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-IGYK3MVP.js');
+  const { postJson: postJson2 } = await import('./work-cmd-H7LLCT2W.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2018,6 +2018,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
   attemptLogsOf(state).note(item.number, claimLine);
   const hookLimits = () => hookLimitsFor(state.config, startedAt.getTime(), state.deps.now);
   const tag = `#${item.number}`;
+  const noteOnce = attemptNote(log, tag);
   const containerMode = isBuiltinContainer(state.config.hooks.provision);
   const vmMode = isBuiltinVm(state.config.hooks.provision);
   let tokens;
@@ -2280,8 +2281,11 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     }
     active.job.environment = hostEnvironment(named, cliVersion);
     writeJobFile(jobFilePath, active.job);
+    await deliverExecMaven(build?.state, provisioned.workdir, jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), runWithSpawn(state.deps.spawnFn), noteOnce);
+    if (active.ending) return;
+    writeJobFile(jobFilePath, active.job);
     if (named.exec !== void 0 && named.recipe !== void 0) {
-      const lifecycleEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build.state, state.config);
+      const lifecycleEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build.state, state.config, void 0, noteOnce);
       for (const step of lifecycleSteps(named.recipe.apply.lifecycle)) {
         if (active.ending) return;
         log.line(`${tag} lifecycle ${step.name} (${step.source})`);
@@ -2363,7 +2367,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       }
     } else {
       const build = job.build;
-      const commandEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build, state.config, identity?.hooksPath);
+      const commandEnv = hostCommandEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), build, state.config, identity?.hooksPath, noteOnce);
       running = build.exec === void 0 ? runCommand(cmdline, commandEnv, workdir, join(dirPath, "command.log"), state.deps.spawnFn) : runCommand(execCommandLine(build.exec, workdir, cmdline), commandEnv, dirPath, join(dirPath, "command.log"), state.deps.spawnFn);
     }
   } catch (err) {
@@ -3033,7 +3037,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-LDDMISY6.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-KD5PLAVL.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-PWB7EK4Z.js → chunk-SK4TWCN3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-JDKLORO3.js → chunk-SVXFSQRD.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-MWAA3A5T.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-KLXWS5Z7.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { runExec, execCapture, waitForAgent } from './chunk-XXVYHC6D.js';
-import { GUEST_CID, linkVsockSockets } from './chunk-O5F376JJ.js';
-import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-JKPJQNJF.js';
-import { runnerImageVersion } from './chunk-PWB7EK4Z.js';
+import { runExec, execCapture, waitForAgent } from './chunk-6NWS455T.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-LWTBE5J6.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-RAHE2AYU.js';
+import { runnerImageVersion } from './chunk-SK4TWCN3.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-5CZV4FZ5.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-43PV5KDB.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-KFA762LZ.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-TGHBOXKJ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { WorkCommandError } from './chunk-KQFWTTG7.js';
+import { WorkCommandError } from './chunk-TDVG6MCO.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-5DNCFOXA.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-MBGS33SL.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-D5ZGMXUL.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-AGZNCIIJ.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, writeBuildMavenSettings, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BCCI32ME.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-LJG6EMLJ.js';
@@ -2288,6 +2288,7 @@ var RECEIVE_ARGV = ["/opt/outerlayer/bin/node", "/opt/outerlayer/cli/dist/index.
 var REASON_LINE_MAX = 240;
 var STEPS = {
   gh: "the build's gh configuration",
+  maven: "the build's Maven settings",
   "git-hooks": "the commit hooks",
   context: "the staged context",
   "eval-input": "the checks' input"
@@ -3665,6 +3666,11 @@ async function provisionContainer(input) {
       err instanceof WorkCommandError ? `the build's read token could not be had: ${refusalCode(err)}` : `the build's gh configuration could not be written: ${describeCallFailure(err)}`
     );
   }
+  try {
+    writeBuildMavenSettings(buildDir2);
+  } catch (err) {
+    return bail(`the build's Maven settings could not be written: ${describeCallFailure(err)}`);
+  }
   for (const entry of repositories) {
     if (entry.repository === primary.repository) continue;
     try {
@@ -3709,7 +3715,7 @@ async function provisionContainer(input) {
   joinBuild(runtime, state, services, (line) => log.line(`${tag} ${line}`));
   if (input.aborted()) return bail("", true);
   if (!await waitForRelay(runtime, state)) return bail("the relay in the build's container did not start");
-  const ghDelivered = await deliverGhConfig(runtime, state, secrets);
+  const ghDelivered = await deliverJobFiles(runtime, state, ["gh", "maven"], secrets);
   if (!ghDelivered.ok) return bail(ghDelivered.reason);
   keepGhConfigCurrent(tokens, buildDir2, (err) => log.error(`${tag} the read token could not be written for gh: ${describeCallFailure(err)}`), {
     runtime,
@@ -3744,6 +3750,7 @@ async function provisionContainer(input) {
   if (hashed !== void 0) state.judgeProgram = { path: JUDGE_PROGRAM, sha256: hashed };
   input.save(state, environment);
   const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
   const exec = (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env: execEnv, argv }, opts?.quiet === true ? void 0 : { logPath });
   const steps = await runBuildSteps({
     repository,
@@ -3926,7 +3933,7 @@ async function ensureTunnel(runtime, state, jobDir, config, itemKey, branch, rep
 }
 async function redeliver(runtime, state, jobDir) {
   if (!filesAreCopied(state)) return { ok: true };
-  const parts = ["gh", "git-hooks", "context"];
+  const parts = ["gh", "maven", "git-hooks", "context"];
   return deliverJobFiles(runtime, state, parts, secretsOf(runtime, jobDir));
 }
 async function deliverContainerHooks(runtime, state, jobDir) {

package/dist/{chunk-KQFWTTG7.js → chunk-TDVG6MCO.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession, autoConnect } from './chunk-RLGSBR56.js';
-import { workPageUrl } from './chunk-CMNAAKFD.js';
+import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
+import { workPageUrl } from './chunk-ZQOSIMKU.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-FLFK42YF.js';
-import { signRunnerRequest } from './chunk-634F6J3Q.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-WPGBDY73.js';
+import { signRunnerRequest } from './chunk-AA6LYZC4.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -441,7 +441,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-PXSDGAUP.js');
+      const { logHookError } = await import('./hook-fast-6GE5LEJI.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-KFA762LZ.js → chunk-TGHBOXKJ.js}

@@ -29,13 +29,13 @@ var FIRECRACKER_SHA256 = {
 var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
-var GUEST_ASSETS_VERSION = "11";
+var GUEST_ASSETS_VERSION = "12";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
   x86_64: "8552fad4bdea1d49f3e7d2aa500ce3f8918fcd2fc66779fd83235949688a39bb"
 };
 var GUEST_HELPER_SHA256 = {
-  x86_64: "e373f0fdb192e9930d19dd39cf75ff1c6cf08fdf5a0f041f12c1f999919fc05a"
+  x86_64: "bf16e8d832d4ed6e3498fb8f59b521a1f9ce0431d05a1309a4a6cf89e354d2e5"
 };
 function guestAssetsPinned(arch) {
   const zero = "0".repeat(64);

package/dist/{chunk-QPAPHQZ7.js → chunk-UOFBHIOZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-MBGS33SL.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';