@outerlayer/cli 0.34.0-next.20261025224117 → 0.34.0-next.20261026161241

package/dist/{chunk-DJO6GI7B.js → chunk-4G4IH4A7.js}

@@ -1,34 +1,35 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-63IVRRIO.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-P3NPTFLF.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JBCOUY4M.js';
-import { installScrubContext } from './chunk-QANM5COC.js';
-import { writeDockerClientConfig } from './chunk-SI6WDF3U.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, helperFirecrackerNote, managedClaudeKeyValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-ZVGSCE2Q.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-UO4FQAOX.js';
-import { waitForAgent, vmExecArgs } from './chunk-2ILU7UAU.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-OGPEHSNW.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-RFVIQLNB.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-2D6CKNR7.js';
-import { DEFAULT_CACHE_DISK, formatBytes, allocatedBytes } from './chunk-KM2HLQE3.js';
-import { parseSize, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-5AFPP3GZ.js';
+import { senderPidfile } from './chunk-LD3BHLK7.js';
+import { installScrubContext } from './chunk-VUQKGBIQ.js';
+import { writeDockerClientConfig } from './chunk-CFFVCI2I.js';
+import { upgradedStarterText } from './chunk-XKJOIQ2Q.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, ROOT_DISK_ID_PREFIX, copyJudgeTree } from './chunk-CNZRUVZ5.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-H47VGSCW.js';
+import { waitForAgent, vmExecArgs } from './chunk-3VZTNXK5.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-6KFJIU73.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-EPFFYDNX.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-ZIKZZ4LK.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-IWVGALDC.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-HVQMIZ22.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-4UPET3R7.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-UN3SQTVL.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-JKNOJKVD.js';
 import { planArtifactUpload } from './chunk-MECW77XP.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-MOI2KDLH.js';
-import { resolvePackRoot } from './chunk-ZQSANKS4.js';
-import { scrubText } from './chunk-AJYZNISW.js';
+import { signerFor } from './chunk-L5VHGRQE.js';
+import { resolvePackRoot, AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-ZQSANKS4.js';
+import { scrubText } from './chunk-Z7WMU3RA.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-FGXT5OXS.js';
 import { CheckItemsSchema, CHECK_ITEM_REASON_MAX_LENGTH } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-PXGU3GKY.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, checkEnvironment, EVAL_INPUT_DIR } from './chunk-G4W4B33M.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-GJ4KBHBD.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, MAVEN_SETTINGS_FILE, checkEnvironment, EVAL_INPUT_DIR } from './chunk-SDAEXUIX.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { existsSync, statSync, appendFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, openSync, readFileSync, closeSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, dirname, delimiter, sep } from 'path';
@@ -192,6 +193,37 @@ var GUEST_MAVEN_DIR = `${JOB_MOUNT}/maven`;
 function buildMemoryBytes(config) {
   return parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY);
 }
+function machineLimits(config, jobDir) {
+  const settings = managedBuildSettingsFor(jobDir);
+  if (settings !== void 0) return managedMachineLimits(settings);
+  return {
+    cpus: config.build?.cpus ?? DEFAULT_CPUS,
+    memoryBytes: buildMemoryBytes(config),
+    diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
+  };
+}
+function recordedLimits(limits) {
+  return { memoryBytes: limits.memoryBytes, diskBytes: limits.diskBytes };
+}
+function memoryTextOf(config, jobDir, limits) {
+  return managedBuildSettingsFor(jobDir) === void 0 ? config.build?.memory : `${limits.memoryBytes / 1024 ** 3}g`;
+}
+function builderMachineFor(config, jobDir, assets, limits) {
+  return {
+    kernel: assets.kernel,
+    firecracker: assets.firecracker,
+    limits: { ...limits, cacheDiskBytes: parseSize(config.build?.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK) },
+    memory: memoryTextOf(config, jobDir, limits),
+    allowHosts: withFactoryHosts(config.build?.allowHosts, managedBuildSettingsFor(jobDir)),
+    managed: config.managed === true,
+    timeLimitMinutes: config.timeLimitMinutes
+  };
+}
+function factoryVariablesOf(config, jobDir) {
+  const held = managedBuildSettingsFor(jobDir)?.variables;
+  if (held !== void 0) return held;
+  return config.managed === true ? [] : void 0;
+}
 function firstLine(text2) {
   return text2.trim().split("\n")[0] ?? "";
 }
@@ -326,11 +358,8 @@ async function provisionMicroVm(input) {
     });
     if (unfetched !== void 0) return fail(unfetched);
   }
-  const limits = {
-    cpus: config.build?.cpus ?? DEFAULT_CPUS,
-    memoryBytes: buildMemoryBytes(config),
-    diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
-  };
+  const limits = machineLimits(config, jobDir);
+  const memoryText = memoryTextOf(config, jobDir, limits);
   let buildsInBuilder = imageBuildOf(config) === "vm";
   if (buildsInBuilder && !vm.builderDiskPinned()) {
     if (config.managed === true) return fail(MANAGED_NO_BUILDER_DISK_REASON);
@@ -350,17 +379,7 @@ async function provisionMicroVm(input) {
     deadlineMs: input.deadlineMs,
     now: input.now,
     guestHelper: { path: assets.helper, sha256: assets.helperSha256 },
-    ...buildsInBuilder ? {
-      inBuilder: {
-        kernel: assets.kernel,
-        firecracker: assets.firecracker,
-        limits: { ...limits, cacheDiskBytes: parseSize(config.build?.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK) },
-        memory: config.build?.memory,
-        allowHosts: config.build?.allowHosts,
-        managed: config.managed === true,
-        timeLimitMinutes: config.timeLimitMinutes
-      }
-    } : {}
+    ...buildsInBuilder ? { inBuilder: builderMachineFor(config, jobDir, assets, limits) } : {}
   });
   if (!obtained.ok) return obtained.aborted === true ? { ok: false, reason: obtained.reason, aborted: true } : fail(obtained.reason);
   const { report } = obtained.built;
@@ -374,6 +393,7 @@ async function provisionMicroVm(input) {
     imageId: report.imageId,
     containerEnv: report.apply.containerEnv,
     builtIns: true,
+    limits: recordedLimits(limits),
     lifecycle: report.apply.lifecycle,
     ...governingSource.kind === "governed" ? { governing: { repository: governingSource.repository, ref: governingSource.ref, commit: governingSource.sha } } : {},
     ...report.docker === true ? { docker: true } : {}
@@ -386,7 +406,8 @@ async function provisionMicroVm(input) {
     repositories,
     hostEnv: runtime.hostEnv,
     containerEnv: report.apply.containerEnv,
-    builtIns: true
+    builtIns: true,
+    factoryVariables: factoryVariablesOf(config, jobDir)
   };
   const env = buildEnvironment(envInput);
   if (env.skippedTokenVariables.length > 0) {
@@ -405,7 +426,7 @@ async function provisionMicroVm(input) {
     let why = reason;
     if (!aborted && (state.cgroup !== void 0 || state.jailed !== void 0)) {
       try {
-        if (await microVmOomKills(runtime, state) > 0) why = outOfMemoryReason(config.build?.memory);
+        if (await microVmOomKills(runtime, state) > 0) why = outOfMemoryReason(memoryText);
       } catch (err) {
         log.error(`${tag} could not read the build's memory events: ${describeCallFailure(err)} \xB7 continuing`);
       }
@@ -424,7 +445,7 @@ async function provisionMicroVm(input) {
     imageConfig = { env: madeInBuilder.env, user: madeInBuilder.user };
   } else {
     try {
-      state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId, memoryBytes: buildMemoryBytes(config) });
+      state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId, memoryBytes: limits.memoryBytes });
       imageConfig = await vm.rootfs.imageConfig(report.imageId);
     } catch (err) {
       return bail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
@@ -677,7 +698,8 @@ function vmExecFor(input, argv) {
     containerEnv: state.containerEnv ?? {},
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
-    imageEnv: state.imageEnv
+    imageEnv: state.imageEnv,
+    factoryVariables: factoryVariablesOf(input.config, input.jobDir)
   });
   const options = {
     socket: state.vsockPath,
@@ -706,7 +728,8 @@ async function startMicroVmCommand(input) {
     containerEnv: state.containerEnv ?? {},
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
-    imageEnv: state.imageEnv
+    imageEnv: state.imageEnv,
+    factoryVariables: factoryVariablesOf(input.config, input.jobDir)
   });
   const started = await input.runtime.vm.exec(state.vsockPath, {
     argv: ["/bin/sh", "-c", commandWithShim(input.job, input.cmdline)],
@@ -748,7 +771,8 @@ async function syncInMicroVm(input) {
       containerEnv: state.containerEnv ?? {},
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,
-      imageEnv: state.imageEnv
+      imageEnv: state.imageEnv,
+      factoryVariables: factoryVariablesOf(input.config, input.jobDir)
     });
     const result = await runtime.vm.exec(state.vsockPath, {
       argv: ["outerlayer", "sync"],
@@ -872,6 +896,7 @@ async function startCheckMicroVm(input) {
   const { config, runtime, job, jobDir, tokens, log } = input;
   const { vm } = runtime;
   const tag = `#${job.item}`;
+  const limits = machineLimits(config, jobDir);
   const built = job.microvm;
   const repository = built?.repository ?? job.repository;
   if (built === void 0 || built.imageId === void 0 || repository === void 0 || job.branch === void 0) {
@@ -921,7 +946,7 @@ async function startCheckMicroVm(input) {
     state.rootfs = built.rootfs;
   } else {
     try {
-      state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: built.imageId, memoryBytes: buildMemoryBytes(config) });
+      state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: built.imageId, memoryBytes: limits.memoryBytes });
     } catch (err) {
       return fail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
     }
@@ -939,16 +964,11 @@ async function startCheckMicroVm(input) {
       log: (line) => log.line(`${tag} ${line}`),
       readOnly: true
     });
-    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote));
+    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote, "socket", void 0, void 0, void 0, jobDir));
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
   if (abandoned()) return fail(ABANDONED);
-  const limits = {
-    cpus: config.build?.cpus ?? DEFAULT_CPUS,
-    memoryBytes: buildMemoryBytes(config),
-    diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
-  };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: false });
   const configPath = join(buildDir2, "vm.json");
   const helper = await helperFor(runtime, (line) => log.line(`${tag} ${line}`), config.managed === true);
@@ -1008,7 +1028,16 @@ async function startCheckMicroVm(input) {
   const failed = await boot();
   if (failed !== void 0) return fail(failed);
   if (abandoned()) return fail(ABANDONED);
-  const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {}, imageEnv: built.imageEnv });
+  const env = checkEnvironment({
+    config,
+    item: job.item,
+    repository,
+    hostEnv: runtime.hostEnv,
+    containerEnv: built.containerEnv ?? {},
+    imageEnv: built.imageEnv,
+    // The checks of a managed build get its factory's variables, as its command did, and none of the runner's own.
+    factoryVariables: factoryVariablesOf(config, jobDir)
+  });
   const evalInput = { dir: join(checksDir, EVAL_INPUT_NAME), delivered: false };
   const deliverEvalInput = async () => {
     await unpackIntoGuest(runtime, state, evalInput.dir, EVAL_INPUT_DIR, { readOnly: true });
@@ -1653,9 +1682,18 @@ function validatorFilesIn(root) {
   }
   return files;
 }
+var CRITERIA_CHECK = "acceptance-criteria";
+function asHostReads(file, base, log, tag) {
+  const upgraded = upgradedStarterText(file.path, file.content, { base });
+  if (upgraded === void 0) return file;
+  log.line(`${tag} ${file.path} is an unedited copy an earlier release wrote, so it is read as this CLI writes it`);
+  return { path: file.path, content: upgraded };
+}
 function checksIn(root, log, tag) {
-  const policy = readInside(root, POLICY_FILE);
-  const loaded = parsePolicy(policy === void 0 ? null : { path: POLICY_FILE, content: policy }, validatorFilesIn(root));
+  const base = existsSync(join(root, AGENTS_SKILLS_BASE)) ? AGENTS_SKILLS_BASE : OUTERLAYER_SKILLS_BASE;
+  const policyText = readInside(root, POLICY_FILE);
+  const policy = policyText === void 0 ? null : asHostReads({ path: POLICY_FILE, content: policyText }, base, log, tag);
+  const loaded = parsePolicy(policy, validatorFilesIn(root).map((file) => asHostReads(file, base, log, tag)));
   for (const problem of loaded.problems) log.error(`${tag} ${problem.file}: ${problem.problem}`);
   const hostChecks = loaded.customs.filter((def) => def.runWhere === "host" && def.level !== "off" && def.declaresEmit !== null);
   const checks = [];
@@ -1663,7 +1701,8 @@ function checksIn(root, log, tag) {
     if (def.judge !== void 0) checks.push({ name: def.declaresEmit, judge: { brief: def.judge.brief, text: readBrief(root, def.judge.brief), subjects: def.judge.subjects } });
     else if (def.command !== void 0) checks.push({ name: def.declaresEmit, command: def.command });
   }
-  return checks;
+  const unrecorded = loaded.customs.filter((def) => def.level !== "off" && def.declaresEmit === CRITERIA_CHECK && !checks.some((check) => check.name === CRITERIA_CHECK)).map((def) => def.id);
+  return { checks, unrecorded };
 }
 async function readDefinitions(input, repository, scratch, token, tokens) {
   const { config, job, deps } = input;
@@ -1672,7 +1711,7 @@ async function readDefinitions(input, repository, scratch, token, tokens) {
   const controlPlaneUrl = (controlPlane) => deps.runtime.remoteFor?.(controlPlane) ?? `${deps.runtime.github.gitUrl}/${controlPlane}.git`;
   const governing = (job.container ?? job.microvm)?.governing;
   const kept = keptContextTree(input.jobDir, governing);
-  if (kept !== void 0) return { ok: true, checks: checksIn(kept, deps.log, tag) };
+  if (kept !== void 0) return { ok: true, ...checksIn(kept, deps.log, tag) };
   const staged = await stage({
     config,
     repository,
@@ -1688,18 +1727,20 @@ async function readDefinitions(input, repository, scratch, token, tokens) {
   if (staged.kind === "refused") return { ok: false, reason: staged.reason };
   if (staged.kind === "staged") {
     try {
-      return { ok: true, checks: checksIn(join(staged.dir, "tree"), deps.log, tag) };
+      return { ok: true, ...checksIn(join(staged.dir, "tree"), deps.log, tag) };
     } finally {
       rmSync(staged.dir, { recursive: true, force: true });
     }
   }
   const repo = join(scratch, "repo");
   const remote = deps.runtime.remoteFor?.(repository) ?? `${deps.runtime.github.gitUrl}/${repository}.git`;
-  const commit = job.environment?.recipe?.sourceCommit ?? await deps.runtime.readHead(remote, scratch);
+  const started = (job.container ?? job.microvm)?.startCommit;
+  const commit = started !== void 0 && started !== "" ? started : job.environment?.recipe?.sourceCommit ?? await deps.runtime.readHead(remote, scratch);
   if (commit === void 0) return { ok: false, reason: "the repository's default branch could not be read" };
   const fetched = await (deps.fetchCommit ?? fetchCommit)({ remote, dir: repo, commit, token });
   if (!fetched.ok) return { ok: false, reason: fetched.reason };
-  return { ok: true, checks: checksIn(repo, deps.log, tag) };
+  deps.log.line(`${tag} check definitions read at ${commit.slice(0, 12)}`);
+  return { ok: true, ...checksIn(repo, deps.log, tag) };
 }
 function timeoutAfter(ms, sleep) {
   if (sleep !== void 0) return { done: sleep(ms).then(() => "timeout"), cancel: () => void 0 };
@@ -2205,6 +2246,9 @@ async function runJudge(input) {
     for (const name of passed.value) await record2(name, "fail", `the definitions could not be read: ${definitions.reason}`, { idTag: "judge-unread" });
     return;
   }
+  for (const id of definitions.unrecorded) {
+    log.line(`${tag} judge not run for ${id}: the check is not run.where: host with a judge or a command, so this host records no result for it`);
+  }
   const checks = definitions.checks.filter(isJudgeCheck);
   if (checks.length === 0) {
     rmSync(scratch, { recursive: true, force: true });
@@ -2634,7 +2678,7 @@ function mergeScrubConfig(a, b) {
 function releaseScrub(config, home) {
   const merged = mergeScrubConfig(config.scrub, readCloudConfig(home).scrub);
   const secrets = [...headerVariables(config.build?.destinations), ...CLAUDE_CREDENTIAL_VARIABLES].map((name) => process.env[name] ?? "");
-  const held = [currentClaudeCredential(process.env)?.value, ...removedClaudeCredentialValues(), ...managedClaudeKeyValues()].filter((value) => value !== void 0);
+  const held = [currentClaudeCredential(process.env)?.value, ...removedClaudeCredentialValues(), ...managedClaudeKeyValues(), ...managedBuildSettingValues()].filter((value) => value !== void 0);
   return { literals: [...scrubList(merged?.literals), ...secrets, ...held], patterns: scrubList(merged?.patterns) };
 }
 function transcriptScrub(config, secrets) {
@@ -2911,6 +2955,15 @@ function readTunnelRecord(path) {
     return void 0;
   }
 }
+var VALUES_NOT_HELD = "the runner restarted and could not read this build's variables from its factory again, so it cannot remove their values from what it uploads";
+var SCRUBBED_RELEASE_LOG = "release-log.txt";
+function readScrubbedReleaseLog(jobDirPath) {
+  try {
+    return readFileSync(join(jobDirPath, SCRUBBED_RELEASE_LOG), "utf8");
+  } catch {
+    return void 0;
+  }
+}
 async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   const spawnFn = deps.spawnFn ?? spawn;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -2919,6 +2972,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   const logPath = join(jobDirPath, "command.log");
   const tag = `#${job.item}`;
   deps.attemptLogs?.open(job.item, jobDirPath);
+  const valuesNotHeld = (job.managedVariables?.length ?? 0) > 0 && managedBuildSettingsFor(jobDirPath) === void 0;
   if (job.sender !== void 0) {
     await stopSender({ job, deps: { spawnFn, runtime: deps.container, log } });
     delete job.sender;
@@ -2962,6 +3016,10 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     writeJobFile(jobFilePath, job);
   }
   const uploadSessions = async (workdir) => {
+    if (valuesNotHeld) {
+      log.error(`${tag} sync skipped: ${VALUES_NOT_HELD}`);
+      return;
+    }
     if (job.container === void 0 && job.microvm === void 0 && job.build?.exec === void 0 && workdirProblem(workdir) !== void 0) {
       log.line(`${tag} sync skipped: workdir ${workdir} is gone`);
     } else if (job.itemKey === void 0) {
@@ -3020,7 +3078,8 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
     }
   }
-  if (outcome === "ok" && !job.cleanupRan && job.judgeRan !== true) {
+  if (valuesNotHeld && outcome === "ok" && !job.cleanupRan) log.error(`${tag} the host's judge and checks skipped: ${VALUES_NOT_HELD}`);
+  if (outcome === "ok" && !job.cleanupRan && job.judgeRan !== true && !valuesNotHeld) {
     setStage(job, jobDirPath, "judge");
     job.judgeRan = true;
     writeJobFile(jobFilePath, job);
@@ -3035,7 +3094,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       log.error(`${tag} the host's judge stopped: ${describeCallFailure(err)} \xB7 continuing`);
     }
   }
-  if (outcome === "ok" && !job.cleanupRan && job.checksRan !== true) {
+  if (outcome === "ok" && !job.cleanupRan && job.checksRan !== true && !valuesNotHeld) {
     setStage(job, jobDirPath, "checks");
     job.checksRan = true;
     writeJobFile(jobFilePath, job);
@@ -3249,12 +3308,17 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     writeJobFile(jobFilePath, job);
   }
   const sentAtMs = now().getTime();
-  const runnerLog = releaseLogFor(jobDirPath, job, config);
+  const runnerLog = valuesNotHeld ? `The runner sends no log for this attempt: ${VALUES_NOT_HELD}.
+` : releaseLogFor(jobDirPath, job, config);
   const detail = outcome === void 0 ? { log: runnerLog } : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment, log: runnerLog };
   const release = await retrySend(() => releaseLease(config, job.item, outcome, detail, deps.fetchImpl), {
     now: deps.now,
     sleep: deps.sleep
   });
+  if (!release.ok && release.retryable && job.managedVariables !== void 0 && runnerLog !== void 0) {
+    writeFileSync(join(jobDirPath, SCRUBBED_RELEASE_LOG), runnerLog, { mode: RUNNER_FILE_MODE });
+  }
+  dropManagedBuildSettings(jobDirPath);
   const alreadyReleased = release.ok && wasAlreadyReleased(release.value, outcome, sentAtMs);
   const endedAt = now();
   job.outcome = outcome;
@@ -3307,13 +3371,14 @@ async function retryFailedReleases(jobsDirPath, config, deps) {
     if (!job || job.releaseFailed === void 0 || job.releaseFailed === ALREADY_RELEASED || isUnfinished(job)) {
       continue;
     }
-    const runnerLog = releaseLogFor(dirPath, job, config);
+    const runnerLog = readScrubbedReleaseLog(dirPath) ?? releaseLogFor(dirPath, job, config);
     const detail = job.outcome === void 0 ? { log: runnerLog } : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment, log: runnerLog };
     const release = await retrySend(() => releaseLease(config, job.item, job.outcome, detail, deps.fetchImpl), {
       now: deps.now,
       sleep: deps.sleep
     });
     if (release.ok || !release.retryable) {
+      rmSync(join(dirPath, SCRUBBED_RELEASE_LOG), { force: true });
       job.releaseFailed = void 0;
       writeJobFile(jobFilePath, job);
     } else {
@@ -3436,7 +3501,7 @@ function launchFor(config, job, jobDir, deps) {
   if (job.microvm !== void 0) {
     const runtime = deps.runtime ?? createContainerRuntime();
     const cli = deps.cliPath ?? join(runtime.cliBuild().distDir, "index.js");
-    return { ...microVmSenderCommand({ job, runtime, config, cli }), cwd: jobDir };
+    return { ...microVmSenderCommand({ job, jobDir, runtime, config, cli }), cwd: jobDir };
   }
   if (job.container !== void 0) {
     return { ...containerSenderCommand({ job, runtime: deps.runtime ?? createContainerRuntime(), config }), cwd: jobDir };

package/dist/{chunk-NW26E4YU.js → chunk-4J2FF5HZ.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession, transcriptPathForSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-AVPLEFQR.js';
+import { autoConnect } from './chunk-IO2BBKG4.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-3N77LUQI.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-Z7WMU3RA.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-CAQCDYKF.js → chunk-5JGPTYLT.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-JWNH4ZTF.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-FGXT5OXS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-G4W4B33M.js';
+import { withTokenHeader } from './chunk-SDAEXUIX.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-OGPEHSNW.js → chunk-6KFJIU73.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-G4W4B33M.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-3EJBI5JW.js → chunk-7FQYTM7M.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-4P6QGMPN.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-NKOM4JKY.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-CAQCDYKF.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-5JGPTYLT.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-DQ6YO7FH.js';

package/dist/{chunk-3N77LUQI.js → chunk-7QAJQDHS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-MOI2KDLH.js';
+import { signRunnerRequest, signerFor } from './chunk-L5VHGRQE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-SI6WDF3U.js → chunk-CFFVCI2I.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-G4W4B33M.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-SDAEXUIX.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);