@outerlayer/cli 0.34.0-next.20261024231715 → 0.34.0-next.20261025133402

package/dist/{chunk-6RKD7YZ6.js → chunk-TVGLNHEB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-SOI6K5DY.js';
+import { signRunnerRequest, signerFor } from './chunk-XLJLR7EK.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-EN3YWO7Q.js → chunk-TVOZOOIW.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-Z4KWHSO4.js';
+import { resolveCredentials, postJson, getJson } from './chunk-IW6Z337K.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
+import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch } from './chunk-6RKD7YZ6.js';
+import { defaultFetch } from './chunk-TVGLNHEB.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';

package/dist/{chunk-ZYKFYNES.js → chunk-UC2DKBMS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-43I7PXDP.js';
-import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-MPDLZCXM.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-N7LAEN3T.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-YGSY2NWU.js → chunk-WIK5KUGK.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-QMWUPRYQ.js';
+import { uploadSpooledSteps } from './chunk-LMICI7AY.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-MECW77XP.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-6ZFY2L2T.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-AJYZNISW.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-TVGLNHEB.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-SOI6K5DY.js';
-import { writeSyncStatus, spoolDir } from './chunk-65AKMFBH.js';
+import { signerFor, signRunnerRequest } from './chunk-XLJLR7EK.js';
+import { writeSyncStatus, spoolDir } from './chunk-CXQCBAKO.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';

package/dist/{chunk-EE2ZZGQV.js → chunk-XA6PGME5.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { remoteLookupFailed } from './chunk-6ZFY2L2T.js';
+import { remoteLookupFailed } from './chunk-AJYZNISW.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
 import { DEFAULT_DASHBOARD } from './chunk-Y5YCX6AL.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-TVGLNHEB.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-SOI6K5DY.js → chunk-XLJLR7EK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N7LAEN3T.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-BALIE3BA.js → chunk-YOBQIXX6.js}

@@ -125,6 +125,9 @@ function claudeCredential(hostEnv, options = {}) {
   if (credential === void 0) return void 0;
   return { variable: credential.variable, placeholder: credential.variable === "CLAUDE_CODE_OAUTH_TOKEN" ? OAUTH_PLACEHOLDER : API_KEY_PLACEHOLDER };
 }
+function managedClaudeCredential() {
+  return { variable: "ANTHROPIC_API_KEY", placeholder: API_KEY_PLACEHOLDER };
+}
 function gatewayUpstream(gatewayUrl) {
   return `${new URL(gatewayUrl).origin}/`;
 }
@@ -142,8 +145,9 @@ function forwardedEnvironment(hostEnv) {
   return env;
 }
 function builtInDestinations(input) {
-  const credential = claudeCredential(input.hostEnv);
-  const apiKeyMode = credential?.variable === "ANTHROPIC_API_KEY";
+  const managedKey = input.claudeApiKey !== void 0 && input.claudeApiKey !== "";
+  const credential = managedKey ? void 0 : claudeCredential(input.hostEnv);
+  const apiKeyMode = managedKey || credential?.variable === "ANTHROPIC_API_KEY";
   return [
     {
       destination: {
@@ -163,7 +167,7 @@ function builtInDestinations(input) {
         header: apiKeyMode ? { name: "x-api-key", value: "${ANTHROPIC_API_KEY}", variables: ["ANTHROPIC_API_KEY"] } : { name: "Authorization", value: "Bearer ${CLAUDE_CODE_OAUTH_TOKEN}", variables: ["CLAUDE_CODE_OAUTH_TOKEN"] },
         env: {}
       },
-      hostEnv: forwardedEnvironment(input.hostEnv),
+      hostEnv: managedKey ? { ANTHROPIC_API_KEY: input.claudeApiKey } : forwardedEnvironment(input.hostEnv),
       // A build's own key in either header would sit beside the runner's, and the upstream takes one of them.
       drop: ["x-api-key", "authorization"],
       socket: CLAUDE_SOCKET
@@ -471,7 +475,7 @@ async function startBuildServices(input) {
       targets.set(destinationTarget(index), (stream) => server.acceptStream(stream));
       if (server.port !== void 0) destinationPorts.push(server.port);
     }
-    const builtIns = input.builtIns === void 0 ? [] : builtInDestinations({ gatewayUrl: input.builtIns.gatewayUrl, itemKey: input.builtIns.itemKey, hostEnv: input.hostEnv, claudeUpstream: input.builtIns.claudeUpstream });
+    const builtIns = input.builtIns === void 0 ? [] : builtInDestinations({ gatewayUrl: input.builtIns.gatewayUrl, itemKey: input.builtIns.itemKey, hostEnv: input.hostEnv, claudeUpstream: input.builtIns.claudeUpstream, claudeApiKey: input.builtIns.claudeApiKey });
     for (const builtIn of builtIns) {
       const server = await startDestination({
         destination: builtIn.destination,
@@ -776,7 +780,7 @@ function buildEnvironment(input) {
     if (skipped) notices.push(MAVEN_NO_PROXY_NOTE);
   }
   const destinations = destinationEnvironment(input.config.build?.destinations, containerLocalAddress);
-  const builtInLiterals = builtIns ? builtInEnvironment(containerBuiltInAddress, claudeCredential(input.hostEnv)) : {};
+  const builtInLiterals = builtIns ? builtInEnvironment(containerBuiltInAddress, input.config.managed === true ? managedClaudeCredential() : claudeCredential(input.hostEnv)) : {};
   const hooksPath = input.identity?.hooksPath;
   const hooks = {};
   if (hooksPath !== void 0) {
@@ -867,4 +871,4 @@ function routesOf(counts) {
   return routes.length === 0 ? {} : { routes };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };

package/dist/{chunk-E4ASIOVL.js → chunk-Z76GVJGQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-ACRRO3MB.js';
-import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-MZBQTVFG.js';
+import { stripTerminalControls } from './chunk-RNVBSRZZ.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-36T6W5RA.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-DJ73SZRC.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-YZKRM7IP.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-YIBFGAYI.js → chunk-ZV2JJPDS.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-ACRRO3MB.js';
-import { RunnerAlreadyRunningError, readPidFile } from './chunk-F5UL23I2.js';
+import { scrubReason, stripTerminalControls } from './chunk-RNVBSRZZ.js';
+import { RunnerAlreadyRunningError, readPidFile } from './chunk-ENFBYN4A.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-AMEM2ZLL.js';
-import { isSignatureRefusal, postJson } from './chunk-Z4KWHSO4.js';
-import { signerFor } from './chunk-SOI6K5DY.js';
-import { pidFilePath } from './chunk-PA6CK6WQ.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-AABYHGVO.js';
+import { isSignatureRefusal, postJson } from './chunk-IW6Z337K.js';
+import { signerFor } from './chunk-XLJLR7EK.js';
+import { pidFilePath } from './chunk-N7LAEN3T.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-4Y54SQXH.js → chunk-ZWLEUSJW.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-YIBFGAYI.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-ZV2JJPDS.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { writePendingUpdate } from './chunk-GH246BGV.js';
-import { renderUpdateSteps } from './chunk-E4ASIOVL.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-ACRRO3MB.js';
+import { writePendingUpdate } from './chunk-56ZHWIR2.js';
+import { renderUpdateSteps } from './chunk-Z76GVJGQ.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-RNVBSRZZ.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-57L2YAJA.js';
-import { RUNNER_PROTOCOL } from './chunk-DA3PLB5N.js';
-import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-7WM7K2DY.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-NBZ7XBT6.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-NW5PDZYA.js';
+import { RUNNER_PROTOCOL } from './chunk-PAK5P2ND.js';
+import { realBlockedProbes, checkBlockedWithSlots, keepsHostBuilder } from './chunk-SMMNU65K.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-DUPM5LVJ.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-YEVPRO7L.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-F5UL23I2.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-POGPX7LI.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-ENFBYN4A.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-62LXQM7U.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-MZBQTVFG.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-AVLLJW5D.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-36T6W5RA.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3CKMB2UK.js';
-import { freeBytes, formatBytes, volumeBytes } from './chunk-ZYKFYNES.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-43I7PXDP.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-Z4KWHSO4.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-SOI6K5DY.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PA6CK6WQ.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-BALIE3BA.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-4XYC2663.js';
+import { freeBytes, formatBytes, volumeBytes } from './chunk-UC2DKBMS.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-MPDLZCXM.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-IW6Z337K.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-XLJLR7EK.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-N7LAEN3T.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential } from './chunk-YOBQIXX6.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { fdName } from './chunk-HACGUL52.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
@@ -1881,7 +1881,7 @@ async function runTick(state) {
             claimed = true;
             break;
           }
-          if (attempt.kind === "outdated" || attempt.kind === "read_only" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch" || attempt.kind === "unreadable_repositories") {
+          if (attempt.kind === "outdated" || attempt.kind === "read_only" || attempt.kind === "managed_refused" || attempt.kind === "signature" || attempt.kind === "no_item_key" || attempt.kind === "no_branch" || attempt.kind === "unreadable_repositories") {
             return;
           }
           if (attempt.kind === "error") {
@@ -1905,7 +1905,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-LTZXOPPN.js');
+  const { postJson: postJson2 } = await import('./work-cmd-KCBU3RSD.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1942,6 +1942,10 @@ async function tryClaimAndStart(state, item, queue) {
       reportRepeating(state, "the request signature", claim.message ?? claim.reason);
       return { kind: "signature" };
     }
+    if (claim.code === "managed_credential_missing" || claim.code === "managed_builds_off") {
+      reportRepeating(state, "the managed build", claim.message ?? claim.reason);
+      return { kind: "managed_refused" };
+    }
     if (claim.code === "billing_read_only") {
       reportRepeating(state, "the organization's billing", claim.message ?? claim.reason);
       return { kind: "read_only" };
@@ -1970,6 +1974,7 @@ async function tryClaimAndStart(state, item, queue) {
     return { kind: "error", reason: `${claim.reason} (${claim.attempts} attempt(s))` };
   }
   reportRepeating(state, "the organization's billing", void 0);
+  reportRepeating(state, "the managed build", void 0);
   reportRepeating(state, "the runner protocol", void 0);
   state.upgradeRefused = false;
   state.versionRefusalLogged = void 0;
@@ -2120,6 +2125,15 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       return;
     }
     if (active.ending) return;
+    if (state.config.managed === true) {
+      const fetched = await fetchManagedClaudeKey(state.config, item.number, { fetchImpl: state.deps.fetchImpl, now: state.deps.now, sleep: state.deps.sleep });
+      if (active.ending) return;
+      if (!fetched.ok) {
+        await endOnManagedKeyRefusal(state, active, fetched);
+        return;
+      }
+      holdManagedClaudeKey(dirPath, fetched.apiKey);
+    }
   }
   if (state.config.hooks.report) {
     setStage(job, dirPath, "report");
@@ -2532,6 +2546,21 @@ function buildTokensFor(state, active, item) {
     }
   });
 }
+async function endOnManagedKeyRefusal(state, active, refused) {
+  const log = logOf(state);
+  const tag = `#${active.job.item}`;
+  const code = refused.code ?? "unavailable";
+  if (refused.code === "claim_expired" || refused.code === "claim_not_held") {
+    log.error(`${tag} the build's Anthropic key was refused: ${code} \xB7 ending job as lease_lost`);
+    await endJob(state, active, "lease_lost");
+  } else if (refused.retryable || refused.code === "managed_credential_missing" || refused.code === "managed_builds_off") {
+    log.error(`${tag} the build's Anthropic key could not be had (${code}) \xB7 releasing the claim to try again`);
+    await endJob(state, active, void 0);
+  } else {
+    log.error(`${tag} the build's Anthropic key was refused: ${code} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason: code });
+  }
+}
 async function endOnTokenRefusal(state, active, err, repository) {
   const log = logOf(state);
   const tag = `#${active.job.item}`;
@@ -2963,6 +2992,21 @@ async function rejoinMicroVmBuild(state, adopted) {
     const fd = inherited.get(fdName(microvm.buildId, socket.replace(/\.sock$/, "")));
     return fd === void 0 ? void 0 : (server) => runtime.vm.fdStore.listenOn(server, fd);
   };
+  if (config.managed === true) {
+    const fetched = await fetchManagedClaudeKey(config, job.item, {
+      fetchImpl: state.deps.fetchImpl,
+      now: state.deps.now,
+      sleep: state.deps.sleep,
+      windowMs: ADOPTED_FETCH_RETRY_WINDOW_MS
+    });
+    if (!fetched.ok) {
+      const code = fetched.code ?? "unavailable";
+      log.error(`${tag} the adopted build's Anthropic key could not be had: ${code}`);
+      const cause = fetched.retryable ? "the gateway could not be reached for it" : `the gateway refused it (${code})`;
+      return { reason: `the adopted build's Anthropic key could not be had after the runner restarted: ${cause}`, why: "the gateway did not give its Anthropic key again" };
+    }
+    holdManagedClaudeKey(dirPath, fetched.apiKey);
+  }
   const tokens = buildTokensFor(state, adopted, job.item);
   runtime.credentials.set(dirPath, tokens);
   let servicesServed = false;
@@ -2995,7 +3039,7 @@ async function rejoinMicroVmBuild(state, adopted) {
     }).catch((err) => log.error(`${tag} the read token could not be written for gh in the guest: ${describeCallFailure(err)}`));
   });
   await pushes;
-  return servicesServed && leaseServed;
+  return servicesServed && leaseServed ? true : { reason: MICROVM_SOCKETS_LOST_REASON, why: "the sockets it reaches the runner on could not be served again" };
 }
 async function adoptTrackedMicroVms(state, plan) {
   const log = logOf(state);
@@ -3008,9 +3052,10 @@ async function adoptTrackedMicroVms(state, plan) {
     const adopted = { job, dirPath, lastRenewAtMs: 0, cmd: null, cpuSample: null, ending: false };
     state.jobs.set(dirPath, adopted);
     attemptLogs.open(job.item, dirPath);
-    if (!await rejoinMicroVmBuild(state, adopted)) {
+    const rejoined = await rejoinMicroVmBuild(state, adopted);
+    if (rejoined !== true) {
       state.jobs.delete(dirPath);
-      await finishMicroVmWhileAway(state, dirPath, job, MICROVM_SOCKETS_LOST_REASON, "the sockets it reaches the runner on could not be served again");
+      await finishMicroVmWhileAway(state, dirPath, job, rejoined.reason, rejoined.why);
       continue;
     }
     if (!await renewLeaseIfDue(state, adopted, nowOf(state).getTime())) continue;
@@ -3150,7 +3195,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-OOUGS65D.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-4TQZZOIQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{claude-launcher-MORG66PJ.js → claude-launcher-JEB5BN7Q.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-QSBWTA2V.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-LHOV2FPA.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);