@outerlayer/cli 0.33.0-next.20261022182340 → 0.33.0-next.20261022195547

package/dist/{agent-setup-32F2JJIL.js → agent-setup-RJOVRRHK.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-4XQ6F3HD.js';
+export { keepHandWritten, runAgentSetup } from './chunk-35IY5HQY.js';
 import './chunk-JHTJPQSL.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-DY7Y7UT4.js';
 import './chunk-HJYBWJAS.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EYW2ZRDL.js';
+import './chunk-WCELNMXT.js';
 import './chunk-UIUGTW5C.js';
 import './chunk-WPGBDY73.js';
 import './chunk-PJDQPF5N.js';

package/dist/{build-BOVQZXKB.js → build-GKCVFHF4.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-BMCPLX2W.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-KLXWS5Z7.js';
 import './chunk-DDS2ISML.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-3Z3MPR55.js';
-import './chunk-KFA762LZ.js';
+import './chunk-TGHBOXKJ.js';
 import './chunk-AGZNCIIJ.js';
 import './chunk-BCCI32ME.js';
 import './chunk-HACGUL52.js';

package/dist/{build-disk-6T4WR3XI.js → build-disk-6QAXMA2J.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-CMZVDKOX.js';
+export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-P5FC7VUO.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-HGZXTPRO.js';
+import './chunk-43PV5KDB.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-KFA762LZ.js';
+import './chunk-TGHBOXKJ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
 import './chunk-AA6LYZC4.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-22T18:51:56.585Z+701260a","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-22T19:57:46.463Z+671ceda","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-E4F5355C.js → builder-DPNHJXG3.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-HGZXTPRO.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-43PV5KDB.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-KFA762LZ.js';
+import './chunk-TGHBOXKJ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
 import './chunk-AA6LYZC4.js';

package/dist/{check-DUVKQSXY.js → check-64UX323V.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-T4BJBF7L.js';
-import './chunk-6PUSHKJ6.js';
+import { probeCredentials } from './chunk-H7A3IQH5.js';
+import './chunk-L6JFFP3Q.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-UOFBHIOZ.js';
 import './chunk-3JVYMD4G.js';
@@ -12,37 +12,37 @@ import './chunk-JEKENLLA.js';
 import './chunk-W5DOK7BL.js';
 import './chunk-QL3LPZ67.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-JR4TZLG6.js';
-import './chunk-A33USDCE.js';
+import './chunk-QDMMW5PC.js';
+import './chunk-3MXPS7ED.js';
 import './chunk-DETKDTNL.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-R3DSBA3J.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-DNKUSXQU.js';
 import './chunk-OWDSO3PE.js';
 import './chunk-TBT347UY.js';
-import './chunk-FVY5OU3N.js';
+import './chunk-WBZJWVT2.js';
 import './chunk-CUBIZBMF.js';
-import './chunk-X2LZ2IHE.js';
-import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-5CZVJVTP.js';
+import './chunk-I5LGKZ4M.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-D3HRAPNF.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-BMCPLX2W.js';
+import './chunk-KLXWS5Z7.js';
 import './chunk-DDS2ISML.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-6NWS455T.js';
 import './chunk-LWTBE5J6.js';
-import './chunk-RAHE2AYU.js';
+import './chunk-RBJG5MM4.js';
 import './chunk-SK4TWCN3.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME } from './chunk-ZRRUWNJS.js';
-import './chunk-CMZVDKOX.js';
+import './chunk-P5FC7VUO.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-HGZXTPRO.js';
+import './chunk-43PV5KDB.js';
 import './chunk-3Z3MPR55.js';
-import './chunk-KFA762LZ.js';
+import './chunk-TGHBOXKJ.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-5BNWAIHN.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-YJLHUKYS.js';
-import './chunk-TDVG6MCO.js';
+import './chunk-CMKY36NV.js';
 import './chunk-2QT4JUW3.js';
 import './chunk-ZQOSIMKU.js';
 import './chunk-EWVYQLD3.js';
@@ -51,14 +51,14 @@ import './chunk-HJYBWJAS.js';
 import './chunk-NSPRS7WK.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-EYW2ZRDL.js';
+import './chunk-WCELNMXT.js';
 import './chunk-UIUGTW5C.js';
 import './chunk-WPGBDY73.js';
 import './chunk-PJDQPF5N.js';
 import './chunk-AA6LYZC4.js';
 import './chunk-AGZNCIIJ.js';
 import { claudeEnvPath } from './chunk-BCCI32ME.js';
-import './chunk-WB7LPDXR.js';
+import './chunk-DJWKUQLO.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';

package/dist/{chunk-4XQ6F3HD.js → chunk-35IY5HQY.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-DY7Y7UT4.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-HJYBWJAS.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-EYW2ZRDL.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-WCELNMXT.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-AVTI3FL5.js';

package/dist/{chunk-A33USDCE.js → chunk-3MXPS7ED.js}

@@ -9,7 +9,7 @@ import { C } from './chunk-ANPNT6PM.js';
 import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor, signRunnerRequest } from './chunk-AA6LYZC4.js';
-import { writeSyncStatus, spoolDir } from './chunk-WB7LPDXR.js';
+import { writeSyncStatus, spoolDir } from './chunk-DJWKUQLO.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';

package/dist/{chunk-HGZXTPRO.js → chunk-43PV5KDB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-3Z3MPR55.js';
-import { BUILDKIT_IMAGE } from './chunk-KFA762LZ.js';
+import { BUILDKIT_IMAGE } from './chunk-TGHBOXKJ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { compareVersions } from './chunk-5DNCFOXA.js';
 import { ensureHostKey } from './chunk-AA6LYZC4.js';

package/dist/{chunk-6YHUMNUB.js → chunk-77B36F5K.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-A33USDCE.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-3MXPS7ED.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-EWVYQLD3.js';

package/dist/{chunk-TDVG6MCO.js → chunk-CMKY36NV.js}

@@ -441,7 +441,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-6GE5LEJI.js');
+      const { logHookError } = await import('./hook-fast-WNKICZ6E.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-5CZVJVTP.js → chunk-D3HRAPNF.js}

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-BMCPLX2W.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-KLXWS5Z7.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-6NWS455T.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-LWTBE5J6.js';
-import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-RAHE2AYU.js';
+import { describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-RBJG5MM4.js';
 import { runnerImageVersion } from './chunk-SK4TWCN3.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-HGZXTPRO.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun } from './chunk-43PV5KDB.js';
 import { RecipeError, DOCKER_FEATURE, writeSanitizedRecipe, classifyProperties } from './chunk-3Z3MPR55.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-KFA762LZ.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, builderDiskPinned, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-TGHBOXKJ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDu } from './chunk-YJLHUKYS.js';
-import { WorkCommandError } from './chunk-TDVG6MCO.js';
+import { WorkCommandError } from './chunk-CMKY36NV.js';
 import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-5DNCFOXA.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, vmAssetsDir, RUNNER_DIR_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, runnerDir, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-AGZNCIIJ.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, writeBuildMavenSettings, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BCCI32ME.js';
@@ -3581,6 +3581,19 @@ async function provisionContainer(input) {
   const governing = await resolveGoverningSource({ config, repository, fetchImpl: input.fetchImpl });
   if (!governing.ok) return fail(governing.reason);
   const governingSource = governing.source;
+  const controlPlaneUrl = (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`;
+  if (governingSource.kind === "governed") {
+    const unfetched = await prefetchGovernedContext({
+      configPath: config.configPath,
+      repository,
+      source: governingSource,
+      controlPlaneUrl,
+      controlPlaneToken: () => tokens.controlPlane(),
+      log,
+      tag
+    });
+    if (unfetched !== void 0) return fail(unfetched);
+  }
   const imageRepository = governingSource.kind === "governed" ? governingSource.repository : repository;
   const obtained = await obtainImage({
     config,
@@ -3771,7 +3784,7 @@ async function provisionContainer(input) {
       buildId,
       buildDir: buildDir2,
       fetchImpl: input.fetchImpl,
-      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`,
+      controlPlaneUrl,
       controlPlaneToken: () => tokens.controlPlane(),
       log,
       tag

package/dist/{chunk-WB7LPDXR.js → chunk-DJWKUQLO.js}

@@ -684,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-PSFYCKYH.js');
+  const { governanceOf } = await import('./control-plane-launch-SMHL6MWW.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-R3DSBA3J.js → chunk-DNKUSXQU.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-FVY5OU3N.js';
-import { describeCallFailure } from './chunk-RAHE2AYU.js';
+import { isPlaceholderCommand } from './chunk-WBZJWVT2.js';
+import { describeCallFailure } from './chunk-RBJG5MM4.js';
 import { checkFit } from './chunk-ZRRUWNJS.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-CMZVDKOX.js';
-import { builderDiskPinned } from './chunk-KFA762LZ.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_BUILD_DISK } from './chunk-P5FC7VUO.js';
+import { builderDiskPinned } from './chunk-TGHBOXKJ.js';
 import { builtinKind, imageBuildOf } from './chunk-5BNWAIHN.js';
-import { WorkCommandError, getJson } from './chunk-TDVG6MCO.js';
+import { WorkCommandError, getJson } from './chunk-CMKY36NV.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { signerFor } from './chunk-AA6LYZC4.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential, claudeCredentialVariablesSet } from './chunk-BCCI32ME.js';

package/dist/{chunk-T4BJBF7L.js → chunk-H7A3IQH5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-6PUSHKJ6.js';
+import { releaseLease, isUnfinished, attemptNote, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-L6JFFP3Q.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UOFBHIOZ.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
@@ -8,20 +8,20 @@ import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest
 import { fitImageBuildMemory } from './chunk-6C2YWM6N.js';
 import { RUNNER_PROTOCOL } from './chunk-YKYCE4HY.js';
 import { writePendingUpdate } from './chunk-JEKENLLA.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-R3DSBA3J.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-DNKUSXQU.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-OWDSO3PE.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-5CZVJVTP.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-D3HRAPNF.js';
 import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-DDS2ISML.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RAHE2AYU.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-RBJG5MM4.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-SK4TWCN3.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-HGZXTPRO.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43PV5KDB.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-5BNWAIHN.js';
 import { exceedsDisk } from './chunk-YJLHUKYS.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-TDVG6MCO.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-CMKY36NV.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-AA6LYZC4.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AGZNCIIJ.js';
 import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BCCI32ME.js';
@@ -1837,7 +1837,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-H7LLCT2W.js');
+  const { postJson: postJson2 } = await import('./work-cmd-NCP4637R.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -3037,7 +3037,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-DUVKQSXY.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-64UX323V.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-X2LZ2IHE.js → chunk-I5LGKZ4M.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-5CZVJVTP.js';
+import { MIN_ENGINE_MAJOR } from './chunk-D3HRAPNF.js';
 import { runnerImageVersion } from './chunk-SK4TWCN3.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-KFA762LZ.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-TGHBOXKJ.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-BMCPLX2W.js → chunk-KLXWS5Z7.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-DDS2ISML.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-3Z3MPR55.js';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-KFA762LZ.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-TGHBOXKJ.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-AGZNCIIJ.js';
 import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-BCCI32ME.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';

package/dist/{chunk-6PUSHKJ6.js → chunk-L6JFFP3Q.js}

@@ -4,19 +4,19 @@ import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-W5DOK7BL.js';
 import { writeDockerClientConfig } from './chunk-QL3LPZ67.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JR4TZLG6.js';
-import { installScrubContext } from './chunk-A33USDCE.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-5CZVJVTP.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-BMCPLX2W.js';
+import { senderPidfile } from './chunk-QDMMW5PC.js';
+import { installScrubContext } from './chunk-3MXPS7ED.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, isLiteralAddress, stopJailed, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-D3HRAPNF.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-KLXWS5Z7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
 import { waitForAgent, vmExecArgs } from './chunk-6NWS455T.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-LWTBE5J6.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RAHE2AYU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-HGZXTPRO.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-KFA762LZ.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RBJG5MM4.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-43PV5KDB.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TGHBOXKJ.js';
 import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-5BNWAIHN.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-TDVG6MCO.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-CMKY36NV.js';
 import { planArtifactUpload } from './chunk-EWVYQLD3.js';
 import { scrubText } from './chunk-5DNCFOXA.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
@@ -314,6 +314,19 @@ async function provisionMicroVm(input) {
   const governing = await resolveGoverningSource({ config, repository, fetchImpl: input.fetchImpl });
   if (!governing.ok) return fail(governing.reason);
   const governingSource = governing.source;
+  const controlPlaneUrl = (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`;
+  if (governingSource.kind === "governed") {
+    const unfetched = await prefetchGovernedContext({
+      configPath: config.configPath,
+      repository,
+      source: governingSource,
+      controlPlaneUrl,
+      controlPlaneToken: () => tokens.controlPlane(),
+      log,
+      tag
+    });
+    if (unfetched !== void 0) return fail(unfetched);
+  }
   const limits = {
     cpus: config.build?.cpus ?? DEFAULT_CPUS,
     memoryBytes: buildMemoryBytes(config),
@@ -599,7 +612,7 @@ async function provisionMicroVm(input) {
       buildId,
       buildDir: buildDir2,
       fetchImpl: input.fetchImpl,
-      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`,
+      controlPlaneUrl,
       controlPlaneToken: () => tokens.controlPlane(),
       log,
       tag

package/dist/{chunk-CMZVDKOX.js → chunk-P5FC7VUO.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { formatBytes, freeBytes } from './chunk-YYYRBYWG.js';
-import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-HGZXTPRO.js';
+import { BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-43PV5KDB.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { buildsDir, rootfsDir, runnerDir } from './chunk-AGZNCIIJ.js';
 import { spawnSync } from 'child_process';

package/dist/{chunk-JR4TZLG6.js → chunk-QDMMW5PC.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-A33USDCE.js';
+import { LiveUploader } from './chunk-3MXPS7ED.js';
 import { CaptureDaemon } from './chunk-5DNCFOXA.js';
-import { spoolDir } from './chunk-WB7LPDXR.js';
+import { spoolDir } from './chunk-DJWKUQLO.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-RAHE2AYU.js → chunk-RBJG5MM4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-TDVG6MCO.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-EYW2ZRDL.js';
+import { WorkCommandError, postJson } from './chunk-CMKY36NV.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-WCELNMXT.js';
 import { signingFetchFor } from './chunk-WPGBDY73.js';
 import { signerFor } from './chunk-AA6LYZC4.js';
 import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-AGZNCIIJ.js';
@@ -328,7 +328,19 @@ var NoControlPlane = class extends Error {
 var GatewayConflict = class extends Error {
 };
 var unavailable = (why) => ({ kind: "refused", reason: `context_unavailable: ${why}` });
+function tokenRefusedReason(err, repository) {
+  return err.detail === void 0 ? `context_unavailable: the gateway refused a token for the control plane named for ${repository} (${err.code})` : `context_unavailable: the token request for the control plane named for ${repository} failed: ${err.detail}`;
+}
 var DESIGNATION_LOOKUP = { timeoutMs: 1e4, attempts: 2 };
+function buildFetch(reuseCached) {
+  return { timeoutMs: 3e4, attempts: 2, reuseCached };
+}
+function credentialName(tokenRepository) {
+  return tokenRepository === void 0 ? "the host's git login" : "the token the gateway issued";
+}
+function fetchFailureReason(failure, credential, plane, sha, repository) {
+  return failure.kind === "no-access" ? `context_unavailable: ${credential} cannot read ${plane}, the control plane named for ${repository}` : `context_unavailable: commit ${sha.slice(0, 7)} of ${plane}, the control plane named for ${repository}, could not be fetched: ${failure.detail}`;
+}
 function lookupFailureReason(failure, repository) {
   switch (failure?.kind) {
     case "timeout":
@@ -382,6 +394,7 @@ async function stageGovernedContext(input) {
       cloud: { url, apiKey, appId },
       fetchImpl: signingFetchFor(input.fetchImpl, configPath, apiKey),
       designationLookup: DESIGNATION_LOOKUP,
+      controlPlaneFetch: buildFetch(true),
       ...input.source === void 0 ? {} : { pinnedSource: input.source },
       git,
       now: input.now,
@@ -417,28 +430,19 @@ async function stageGovernedContext(input) {
         }
         if (result.message !== void 0) return finish(unavailable(result.message));
         return finish(unavailable(lookupFailureReason(result.lookupFailure, input.repository)));
-      case "unreachable":
       case "no-access": {
-        const plane = isStagingWriteFault(result.message) ? void 0 : readDegraded(join(tree, ".git"))?.repository;
-        if (plane !== void 0) {
-          const credential = tokenRepository !== void 0 && tokenRepository.toLowerCase() === plane.toLowerCase() ? "the token the gateway issued" : "the host's git login";
-          return finish(unavailable(`${credential} cannot read ${plane}, the control plane named for ${input.repository}`));
-        }
+        const plane = readDegraded(join(tree, ".git"))?.repository;
+        if (plane !== void 0) return finish(unavailable(`${credentialName(tokenRepository)} cannot read ${plane}, the control plane named for ${input.repository}`));
         return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
       }
+      // An unreachable result is a timeout, a network failure, or a failure to write the fetched files. Its message says which.
       default:
         return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
     }
   } catch (err) {
     if (err instanceof NoControlPlane) return finish({ kind: "none" });
     if (err instanceof GatewayConflict) return finish({ kind: "refused", reason: `context_conflict: ${err.message}` });
-    if (err instanceof TokenRefused) {
-      return finish(
-        unavailable(
-          err.detail === void 0 ? `the gateway refused a token for the control plane named for ${input.repository} (${err.code})` : `the token request for the control plane named for ${input.repository} failed: ${err.detail}`
-        )
-      );
-    }
+    if (err instanceof TokenRefused) return finish({ kind: "refused", reason: tokenRefusedReason(err, input.repository) });
     return finish(unavailable(`the context of ${input.repository} could not be staged: ${err instanceof Error ? err.message : String(err)}`));
   }
 }
@@ -462,6 +466,32 @@ async function controlPlaneAccess(ask, candidates, repository, log, tag) {
   }
   return answer;
 }
+async function prefetchGovernedContext(input) {
+  const { repository, source } = input;
+  let tokenRepository;
+  try {
+    const fetched = await fetchControlPlaneCommit({
+      git: input.git ?? defaultGitRunner,
+      home: contextHomeDir(input.configPath),
+      repository: source.repository,
+      sha: source.sha,
+      remoteUrl: input.controlPlaneUrl(source.repository),
+      token: async () => {
+        if (input.controlPlaneToken === void 0) return void 0;
+        const access = await controlPlaneAccess(input.controlPlaneToken, [{ repository: source.repository }], repository, input.log, input.tag);
+        tokenRepository = access?.repository;
+        return access?.token;
+      },
+      policy: buildFetch(false)
+    });
+    if (fetched.ok) return void 0;
+    return fetchFailureReason(fetched, credentialName(tokenRepository), source.repository, source.sha, repository);
+  } catch (err) {
+    if (err instanceof NoControlPlane || err instanceof GatewayConflict) return void 0;
+    if (err instanceof TokenRefused) return tokenRefusedReason(err, repository);
+    return `context_unavailable: the control plane named for ${repository} could not be fetched: ${err instanceof Error ? err.message : String(err)}`;
+  }
+}
 function removeStagedContext(buildDir) {
   rmSync(stagedContextDir(buildDir), { recursive: true, force: true });
 }
@@ -516,4 +546,4 @@ async function imageTargetFor(input) {
   return { ok: true, repository: resolved.source.repository, pinned: { commit: resolved.source.sha, ref: resolved.source.ref } };
 }
 
-export { BuildTokens, WORKFLOW_PERMISSION_REASON, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };
+export { BuildTokens, WORKFLOW_PERMISSION_REASON, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, prefetchGovernedContext, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };

package/dist/{chunk-KFA762LZ.js → chunk-TGHBOXKJ.js}

@@ -29,13 +29,13 @@ var FIRECRACKER_SHA256 = {
 var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
-var GUEST_ASSETS_VERSION = "11";
+var GUEST_ASSETS_VERSION = "12";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
   x86_64: "8552fad4bdea1d49f3e7d2aa500ce3f8918fcd2fc66779fd83235949688a39bb"
 };
 var GUEST_HELPER_SHA256 = {
-  x86_64: "e373f0fdb192e9930d19dd39cf75ff1c6cf08fdf5a0f041f12c1f999919fc05a"
+  x86_64: "bf16e8d832d4ed6e3498fb8f59b521a1f9ce0431d05a1309a4a6cf89e354d2e5"
 };
 function guestAssetsPinned(arch) {
   const zero = "0".repeat(64);

package/dist/{chunk-FVY5OU3N.js → chunk-WBZJWVT2.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-CUBIZBMF.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-X2LZ2IHE.js';
-import { MIN_ENGINE_MAJOR } from './chunk-5CZVJVTP.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-I5LGKZ4M.js';
+import { MIN_ENGINE_MAJOR } from './chunk-D3HRAPNF.js';
 import { runnerCredentialProblem } from './chunk-5BNWAIHN.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';