@outerlayer/cli 0.34.0-next.20261025224117 → 0.34.0-next.20261026161241

package/dist/{chunk-TFPNPS4Q.js → chunk-HOUFCUMH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-OQLF3MQQ.js → chunk-HVPW272H.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-INOUUSYI.js';
-import { RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
-import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-G4W4B33M.js';
+import { DEFAULT_UNIT_NAME } from './chunk-V2VJYK46.js';
+import { RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-SDAEXUIX.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-5AFPP3GZ.js → chunk-HVQMIZ22.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-4UPET3R7.js';
-import { ensureHostKey } from './chunk-MOI2KDLH.js';
-import { compareVersions } from './chunk-AJYZNISW.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PXGU3GKY.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-G4W4B33M.js';
+import { ensureHostKey } from './chunk-L5VHGRQE.js';
+import { compareVersions } from './chunk-Z7WMU3RA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-GJ4KBHBD.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync, mkdirSync, createWriteStream, rmSync, chmodSync, renameSync } from 'fs';

package/dist/{chunk-AVPLEFQR.js → chunk-IO2BBKG4.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-FVCHHSHB.js';
-import { resolveGatewayCredentials } from './chunk-3N77LUQI.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-EUQZAH2W.js';
+import { resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-KM2HLQE3.js → chunk-IWVGALDC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-5AFPP3GZ.js';
-import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-PXGU3GKY.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-HVQMIZ22.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-SMWRIAGH.js → chunk-JC6AQ6PC.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-ZVGSCE2Q.js';
-import { checkFit } from './chunk-INOUUSYI.js';
-import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-2D6CKNR7.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-KM2HLQE3.js';
+import { placeholderQueues, placeholderProblem } from './chunk-CNZRUVZ5.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-V2VJYK46.js';
+import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-ZIKZZ4LK.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-IWVGALDC.js';
 import { builderDiskPinned } from './chunk-4UPET3R7.js';
-import { FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv, BUILD_SLICE_MEMORY_ENV } from './chunk-G4W4B33M.js';
+import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-SDAEXUIX.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem } from 'os';
@@ -156,5 +156,38 @@ function checkBlockedWithSlots(config, probes) {
   }
   return { slots };
 }
+var GIB = 1024 ** 3;
+function largeBuildMemoryBytes() {
+  return 16 * GIB;
+}
+var LARGE_BUILD_DISK_BYTES = 3e10;
+function checkManagedRoom(input) {
+  const availableBytes = input.sliceBytes ?? Math.max(0, input.totalMemoryBytes - RUNNER_RESERVE_BYTES);
+  if (input.runningMemoryBytes + largeBuildMemoryBytes() > availableBytes) {
+    const where = input.sliceBytes === void 0 ? "the host's memory less the runner's reserve" : "the memory limit of the runner's build slice";
+    return {
+      fits: false,
+      resource: "memory",
+      reason: `one more Large build needs ${gib(largeBuildMemoryBytes())} of memory, and the running builds hold ${gib(input.runningMemoryBytes)} of the ${gib(availableBytes)} in ${where}`
+    };
+  }
+  if (input.freeDiskBytes !== void 0) {
+    const diskBytes = input.freeDiskBytes + input.heldDiskBytes;
+    if (input.runningDiskBytes + LARGE_BUILD_DISK_BYTES > diskBytes) {
+      return {
+        fits: false,
+        resource: "disk",
+        reason: `one more Large build needs a ${gb(LARGE_BUILD_DISK_BYTES)} build disk beside the ${gb(input.runningDiskBytes)} the running builds' disks may grow to, and the runner's file system has ${gb(diskBytes)} free or held by them`
+      };
+    }
+  }
+  return { fits: true };
+}
+function gib(bytes) {
+  return `${(bytes / GIB).toFixed(1)} GiB`;
+}
+function gb(bytes) {
+  return `${(bytes / 1e9).toFixed(1)} GB`;
+}
 
-export { checkBlockedWithSlots, managedFactsOf, managedProblems, realBlockedProbes };
+export { LARGE_BUILD_DISK_BYTES, checkBlockedWithSlots, checkManagedRoom, largeBuildMemoryBytes, managedFactsOf, managedProblems, realBlockedProbes, sliceMemoryOf };

package/dist/{chunk-UN3SQTVL.js → chunk-JKNOJKVD.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-AVPLEFQR.js';
-import { workPageUrl } from './chunk-FVCHHSHB.js';
+import { autoConnect } from './chunk-IO2BBKG4.js';
+import { workPageUrl } from './chunk-EUQZAH2W.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-3N77LUQI.js';
-import { signRunnerRequest } from './chunk-MOI2KDLH.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-7QAJQDHS.js';
+import { signRunnerRequest } from './chunk-L5VHGRQE.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
@@ -379,6 +379,21 @@ function tokenWarning(data) {
   return `
 ${C.yellow}!${C.reset} a container host will fail this build: ${why}`;
 }
+var RUNNER_KINDS = ["managed", "self-hosted"];
+function isManagedRefusal(code) {
+  return code === "managed_builds_off" || code === "managed_credential_missing";
+}
+function parseRunnerKind(raw) {
+  if (raw === void 0) return void 0;
+  const kind = RUNNER_KINDS.find((k) => k === raw);
+  if (kind === void 0) throw new WorkCommandError(`--runner takes ${RUNNER_KINDS.join(" or ")}, not "${sanitizeTerminal(raw)}"`);
+  return kind;
+}
+function runnerLabel(data, named) {
+  const kind = data.runner === "managed" || data.runner === "self-hosted" ? data.runner : named;
+  if (kind !== "managed" && named === void 0) return "";
+  return ` ${C.dim}\xB7${C.reset} on a ${kind} runner`;
+}
 function itemLabel(data) {
   return data.number != null ? `item #${data.number}` : `item ${sanitizeTerminal(String(data.workItemId))}`;
 }
@@ -401,6 +416,10 @@ async function runWorkBuild(opts) {
       "--instructions applies to host builds: with --local you build the item yourself, so give your instructions in your own session"
     );
   }
+  const runner = parseRunnerKind(opts.runner);
+  if (opts.local && runner !== void 0) {
+    throw new WorkCommandError("--runner applies to host builds: with --local you build the item yourself, so no runner takes it");
+  }
   await connectIfOneFits(opts);
   const { url, apiKey, appId } = resolveCredentials(opts);
   const fetchImpl = opts.fetchImpl ?? defaultFetch;
@@ -428,15 +447,21 @@ async function runWorkBuild(opts) {
     return { data: data2, output: output2 };
   }
   const instructions = opts.instructions !== void 0 ? { instructions: opts.instructions } : {};
-  const body = itemNumber !== void 0 ? { workItemId: String(itemNumber), note: opts.note, ...instructions, ...facts } : {
+  const body = itemNumber !== void 0 ? { workItemId: String(itemNumber), note: opts.note, ...instructions, runner, ...facts } : {
     subject: resolveWorkSubject({ issue: opts.issue, tracker: opts.tracker, repo: opts.repo, cwd }),
     note: opts.note,
     ...instructions,
+    runner,
     ...facts
   };
-  const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep);
+  const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep).catch((err) => {
+    if (err instanceof WorkCommandError && isManagedRefusal(err.code)) {
+      throw new WorkCommandError(`${err.message} (${err.code})`, false, err.status, err.code);
+    }
+    throw err;
+  });
   const page = itemPageUrl(home, cwd, appId, data.workItemId, data.number);
-  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} build requested ${C.dim}\xB7${C.reset} ${itemLabel(data)}${"subject" in body ? ` (${issueLabel(body.subject)})` : ""} ${C.dim}\xB7${C.reset} by ${data.attestor}` + (page !== void 0 ? `
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} build requested ${C.dim}\xB7${C.reset} ${itemLabel(data)}${"subject" in body ? ` (${issueLabel(body.subject)})` : ""}${runnerLabel(data, runner)} ${C.dim}\xB7${C.reset} by ${data.attestor}` + (page !== void 0 ? `
   ${page}` : "") + tokenWarning(data);
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
@@ -446,7 +471,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-GPUL7T77.js');
+      const { logHookError } = await import('./hook-fast-6EW2MGA2.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-BHSSGVOY.js → chunk-JSZRBQY3.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-UN3SQTVL.js';
+import { resolveCredentials, postJson, getJson } from './chunk-JKNOJKVD.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { defaultFetch } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { defaultFetch } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';

package/dist/{chunk-MOI2KDLH.js → chunk-L5VHGRQE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-JBCOUY4M.js → chunk-LD3BHLK7.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-QANM5COC.js';
-import { spoolDir } from './chunk-25GRRBTH.js';
-import { CaptureDaemon } from './chunk-AJYZNISW.js';
+import { LiveUploader } from './chunk-VUQKGBIQ.js';
+import { spoolDir } from './chunk-NHEU5CON.js';
+import { CaptureDaemon } from './chunk-Z7WMU3RA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-YNMVVQOQ.js → chunk-LQHCNXPK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-YHKU2NOZ.js → chunk-LTYBHCL4.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-3N77LUQI.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-7QAJQDHS.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-RCRE42V6.js';

package/dist/{chunk-PAK5P2ND.js → chunk-MH6QLXUO.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 32;
+var RUNNER_PROTOCOL = 33;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-OS7DJOQJ.js → chunk-MN3PP45X.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-UMYYYF7B.js';
+import { currentLink } from './chunk-YL3RWW7X.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-25GRRBTH.js → chunk-NHEU5CON.js}

@@ -684,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-XBGHM7DB.js');
+  const { governanceOf } = await import('./control-plane-launch-74EIIB5Z.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-K2UAQWYO.js → chunk-OQT7RT5I.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-AVPLEFQR.js';
+import { autoConnect } from './chunk-IO2BBKG4.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-63IVRRIO.js → chunk-P3NPTFLF.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-SI6WDF3U.js';
-import { EXEC_PORT } from './chunk-OGPEHSNW.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-CFFVCI2I.js';
+import { EXEC_PORT } from './chunk-6KFJIU73.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-G4W4B33M.js';
+import { RELAY_PORT } from './chunk-SDAEXUIX.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-GC5PVMIJ.js → chunk-RR3VDM7M.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-OS7DJOQJ.js';
-import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-UMYYYF7B.js';
+import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-MN3PP45X.js';
+import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-YL3RWW7X.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { runnerDir, RUNNER_DIR_MODE } from './chunk-PXGU3GKY.js';
+import { runnerDir, RUNNER_DIR_MODE } from './chunk-GJ4KBHBD.js';
 import { lchownSync, lstatSync, realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync, readdirSync } from 'fs';
 import { dirname, sep, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-G4W4B33M.js → chunk-SDAEXUIX.js}

@@ -776,6 +776,9 @@ function repositoriesOf(input) {
 function primaryOf(repositories) {
   return repositories.find((entry) => entry.primary) ?? repositories[0];
 }
+
+// src/scrub-env.ts
+var SCRUB_ENV_VARIABLE = "OUTERLAYER_SCRUB_ENV";
 var MAVEN_DIR = "maven";
 var MAVEN_SETTINGS_FILE = "settings.xml";
 var MAVEN_NO_PROXY_NOTE = "MAVEN_ARGS names its own global settings file, so the build's Maven gets no proxy from the runner";
@@ -918,6 +921,7 @@ function isReservedVariable(name) {
 function isRefusedInConfig(name) {
   return isReservedVariable(name) && !githubVariables().has(name);
 }
+var NO_VARIABLES = [];
 function buildEnvironment(input) {
   const authored = authorEnvironment(input.identity?.author);
   const recipe = {};
@@ -934,16 +938,26 @@ function buildEnvironment(input) {
   };
   const variables = [];
   const skippedTokenVariables = [];
-  for (const name of input.config.build?.variables ?? []) {
-    if (tokenVariables().includes(name)) {
-      skippedTokenVariables.push(name);
-      continue;
+  if (input.factoryVariables !== void 0) {
+    for (const { name, value } of input.factoryVariables) {
+      if (isReservedVariable(name) || name in authored) continue;
+      if (builtIns && CLAUDE_CREDENTIAL_VARIABLES.includes(name)) continue;
+      passed[name] = value;
+      variables.push(name);
+    }
+    if (variables.length > 0) passed[SCRUB_ENV_VARIABLE] = variables.join(",");
+  } else {
+    for (const name of input.config.build?.variables ?? NO_VARIABLES) {
+      if (tokenVariables().includes(name)) {
+        skippedTokenVariables.push(name);
+        continue;
+      }
+      const value = input.hostEnv[name];
+      if (value === void 0 || isReservedVariable(name) || name in authored) continue;
+      if (builtIns && CLAUDE_CREDENTIAL_VARIABLES.includes(name)) continue;
+      passed[name] = value;
+      variables.push(name);
     }
-    const value = input.hostEnv[name];
-    if (value === void 0 || isReservedVariable(name) || name in authored) continue;
-    if (builtIns && CLAUDE_CREDENTIAL_VARIABLES.includes(name)) continue;
-    passed[name] = value;
-    variables.push(name);
   }
   const nodeOptions = {};
   if (input.imageEnv !== void 0) {
@@ -999,6 +1013,7 @@ function checkEnvironment(input) {
     containerEnv: input.containerEnv,
     builtIns: false,
     imageEnv: input.imageEnv,
+    factoryVariables: input.factoryVariables,
     // A check container is given no settings file, so a `MAVEN_ARGS` naming one would break the check's Maven.
     mavenProxy: false
   });
@@ -1050,4 +1065,4 @@ function routesOf(counts) {
   return routes.length === 0 ? {} : { routes };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, SCRUB_ENV_VARIABLE, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };

package/dist/{chunk-SYVRBBLW.js → chunk-SDELQEG4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-FDJPDZSR.js → chunk-TS3EFB7S.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-6P4YL4CO.js → chunk-U6AWVO6L.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-DJO6GI7B.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-INOUUSYI.js';
-import { RunnerAlreadyRunningError, readPidFile } from './chunk-YNMVVQOQ.js';
+import { scrubReason, stripTerminalControls } from './chunk-4G4IH4A7.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-V2VJYK46.js';
+import { RunnerAlreadyRunningError, readPidFile } from './chunk-LQHCNXPK.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, postJson } from './chunk-UN3SQTVL.js';
-import { signerFor } from './chunk-MOI2KDLH.js';
-import { pidFilePath } from './chunk-PXGU3GKY.js';
+import { isSignatureRefusal, postJson } from './chunk-JKNOJKVD.js';
+import { signerFor } from './chunk-L5VHGRQE.js';
+import { pidFilePath } from './chunk-GJ4KBHBD.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-INOUUSYI.js → chunk-V2VJYK46.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-2D6CKNR7.js';
-import { parseSize } from './chunk-5AFPP3GZ.js';
-import { runnerDir } from './chunk-PXGU3GKY.js';
-import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-G4W4B33M.js';
+import { builtinKind, keepsHostBuilder } from './chunk-ZIKZZ4LK.js';
+import { parseSize } from './chunk-HVQMIZ22.js';
+import { runnerDir } from './chunk-GJ4KBHBD.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-SDAEXUIX.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-YV7BP62T.js → chunk-VEJWLQ4G.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned } from './chunk-AP2K4LPI.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-UN3SQTVL.js';
-import { isLinkedRepository } from './chunk-FVCHHSHB.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-XKJOIQ2Q.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-JKNOJKVD.js';
+import { isLinkedRepository } from './chunk-EUQZAH2W.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-YHKU2NOZ.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-LTYBHCL4.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { checkFormerSkillNames } from './chunk-JWNH4ZTF.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-3N77LUQI.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-25GRRBTH.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-7QAJQDHS.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-NHEU5CON.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-AJYZNISW.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-Z7WMU3RA.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-URIZRCRY.js';
 import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
@@ -1195,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-ZL46AEN3.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-QASNKYM6.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-C3WIAHCL.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-WSZIWPP4.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1217,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-Z4OA5JJK.js');
+    const { runnerHostChecks } = await import('./doctor-KPKLFIJH.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1244,7 +1244,7 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
-      const { inspectRunnerService } = await import('./find-unit-4UR647S4.js');
+      const { inspectRunnerService } = await import('./find-unit-UKH6JH4S.js');
       return inspectRunnerService(configPath);
     })();
     checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner, service }));

package/dist/{chunk-QANM5COC.js → chunk-VUQKGBIQ.js}

@@ -1,24 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-EGVHFHY4.js';
+import { uploadSpooledSteps } from './chunk-XSFR76J7.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-MECW77XP.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-3N77LUQI.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-MOI2KDLH.js';
-import { writeSyncStatus, spoolDir } from './chunk-25GRRBTH.js';
+import { signerFor, signRunnerRequest } from './chunk-L5VHGRQE.js';
+import { writeSyncStatus, spoolDir } from './chunk-NHEU5CON.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-AJYZNISW.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-Z7WMU3RA.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { SCRUB_ENV_VARIABLE } from './chunk-SDAEXUIX.js';
 import { dirname, basename, join, sep } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';
@@ -37,8 +38,14 @@ function gitGlobalConfig(key) {
     return void 0;
   }
 }
-function installScrubContext(home, scrub) {
-  setCustomScrubbers(scrub);
+function withNamedEnvValues(scrub, env) {
+  const names = (env[SCRUB_ENV_VARIABLE] ?? "").split(",");
+  const values = names.map((name) => env[name]).filter((value) => value !== void 0 && value !== "");
+  if (values.length === 0) return scrub;
+  return { ...scrub, literals: [...scrub?.literals ?? [], ...values] };
+}
+function installScrubContext(home, scrub, env = process.env) {
+  setCustomScrubbers(withNamedEnvValues(scrub, env));
   setLocalIdentity({
     name: gitGlobalConfig("user.name"),
     email: gitGlobalConfig("user.email"),

package/dist/{chunk-XJXBQQR4.js → chunk-VWZHOFBP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-DJO6GI7B.js';
-import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SYVRBBLW.js';
+import { stripTerminalControls } from './chunk-4G4IH4A7.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SDELQEG4.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-TAC6G4VU.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-KZ3OQTPW.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-SUOZYOWO.js → chunk-WE4C3ODP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-INOUUSYI.js';
-import { inspectService, realInspectProbes } from './chunk-G4W4B33M.js';
+import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-V2VJYK46.js';
+import { inspectService, realInspectProbes } from './chunk-SDAEXUIX.js';
 import { realpathSync, readFileSync, readdirSync } from 'fs';
 import { resolve, dirname, join } from 'path';