@outerlayer/cli 0.34.0-next.20261026145838 → 0.34.0-next.20261026161241

package/dist/{chunk-OGPEHSNW.js → chunk-6KFJIU73.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-G4W4B33M.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-3EJBI5JW.js → chunk-7FQYTM7M.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-4P6QGMPN.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-NKOM4JKY.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-CAQCDYKF.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-5JGPTYLT.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-ZQSANKS4.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-DQ6YO7FH.js';

package/dist/{chunk-3N77LUQI.js → chunk-7QAJQDHS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-MOI2KDLH.js';
+import { signRunnerRequest, signerFor } from './chunk-L5VHGRQE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-SI6WDF3U.js → chunk-CFFVCI2I.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-G4W4B33M.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-SDAEXUIX.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-7P3H4RY2.js → chunk-CNZRUVZ5.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-VVOSUGEF.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-H47VGSCW.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { runExec, execCapture, waitForAgent } from './chunk-2ILU7UAU.js';
-import { GUEST_CID, linkVsockSockets } from './chunk-OGPEHSNW.js';
-import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-PP6OX4OT.js';
-import { runnerImageVersion } from './chunk-SYVRBBLW.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-7JE2WFNK.js';
-import { runnerCredentialProblem, builtinKind, hostAllowed } from './chunk-3EHDZTRT.js';
-import { formatBytes, allocatedBytes } from './chunk-UONH72CJ.js';
-import { createDockerHost, builderSpec, RecipeError, DOCKER_FEATURE, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun, writeSanitizedRecipe, classifyProperties } from './chunk-M3ME6TLQ.js';
+import { runExec, execCapture, waitForAgent } from './chunk-3VZTNXK5.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-6KFJIU73.js';
+import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-EPFFYDNX.js';
+import { runnerImageVersion } from './chunk-SDELQEG4.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-HVPW272H.js';
+import { runnerCredentialProblem, builtinKind, allowHostProblem, hostAllowed } from './chunk-ZIKZZ4LK.js';
+import { formatBytes, allocatedBytes } from './chunk-IWVGALDC.js';
+import { createDockerHost, builderSpec, RecipeError, DOCKER_FEATURE, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun, writeSanitizedRecipe, classifyProperties } from './chunk-HVQMIZ22.js';
 import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-4UPET3R7.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { postJson, WorkCommandError, getJson } from './chunk-6JZXIWX7.js';
+import { postJson, WorkCommandError, getJson } from './chunk-JKNOJKVD.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { signerFor } from './chunk-MOI2KDLH.js';
+import { signerFor } from './chunk-L5VHGRQE.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-GSSVJNP2.js';
+import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-Z7WMU3RA.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-FGXT5OXS.js';
 import { downconvertSession } from './chunk-EOTMDIYC.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-PXGU3GKY.js';
-import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, JOB_MOUNT, realFdStorePort } from './chunk-G4W4B33M.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-GJ4KBHBD.js';
+import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, JOB_MOUNT, realFdStorePort } from './chunk-SDAEXUIX.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { spawn, spawnSync } from 'child_process';
 import { mkdirSync, existsSync, readFileSync, mkdtempSync, rmSync, chmodSync, truncateSync, statSync, accessSync, constants, readdirSync, writeFileSync, lstatSync, copyFileSync, renameSync, rmdirSync, unlinkSync, linkSync, openSync, closeSync, cpSync, writeSync, appendFileSync, createWriteStream, createReadStream } from 'fs';
@@ -74,6 +74,71 @@ function managedClaudeKeyValues() {
 function hasClaudeCredential(config, hostEnv, jobDir) {
   return config.managed === true ? managedClaudeKeyFor(jobDir) !== void 0 : claudeCredential(hostEnv) !== void 0;
 }
+
+// src/runner/managed-build-settings.ts
+var FETCH_RETRY_WINDOW_MS2 = 3e4;
+var GIB = 1024 ** 3;
+var GB = 1e9;
+var VARIABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,254}$/;
+var MALFORMED = "the gateway's answer was not a machine, a list of hosts and a list of variables";
+function parseSettings(data) {
+  const isPositive = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
+  if (typeof data !== "object" || data === null) return { problem: MALFORMED };
+  const { machine, allowHosts, variables } = data;
+  if (typeof machine !== "object" || machine === null) return { problem: MALFORMED };
+  const { size, vcpus, memoryGiB, diskGB } = machine;
+  if (size !== "small" && size !== "large" || !isPositive(vcpus) || !isPositive(memoryGiB) || !isPositive(diskGB)) return { problem: MALFORMED };
+  if (!Array.isArray(allowHosts) || !allowHosts.every((host) => typeof host === "string")) return { problem: MALFORMED };
+  if (!Array.isArray(variables)) return { problem: MALFORMED };
+  for (const host of allowHosts) {
+    const problem = allowHostProblem(host);
+    if (problem !== void 0) return { problem: `the factory's allowed host ${JSON.stringify(host)} ${problem}` };
+  }
+  const parsed = [];
+  for (const entry of variables) {
+    if (typeof entry !== "object" || entry === null) return { problem: MALFORMED };
+    const { name, value } = entry;
+    if (typeof name !== "string" || name === "" || typeof value !== "string") return { problem: MALFORMED };
+    if (!VARIABLE_NAME.test(name)) return { problem: `the factory's build variable ${JSON.stringify(name)} is not a variable name` };
+    if (value.trim().length < MIN_SCRUBBED_LITERAL) {
+      return { problem: `the value of the factory's build variable ${name} has fewer than ${MIN_SCRUBBED_LITERAL} characters, so the runner could not remove it from logs and transcripts` };
+    }
+    parsed.push({ name, value });
+  }
+  return { settings: { machine: { size, vcpus, memoryGiB, diskGB }, allowHosts: [...allowHosts], variables: parsed } };
+}
+async function fetchManagedBuildSettings(config, item, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const outcome = await retrySend(
+    async () => postJson(config.url, `/v1/work-items/${item}/claim/build-settings`, config.apiKey, config.appId, {}, fetchImpl, void 0, await signerFor(config.configPath)),
+    { now: deps.now, sleep: deps.sleep, windowMs: deps.windowMs ?? FETCH_RETRY_WINDOW_MS2 }
+  );
+  if (!outcome.ok) return { ok: false, code: outcome.code, reason: outcome.message ?? outcome.reason, retryable: outcome.retryable };
+  const parsed = parseSettings(outcome.value.data);
+  if ("problem" in parsed) return { ok: false, code: "malformed_settings_response", reason: parsed.problem, retryable: false };
+  return { ok: true, settings: parsed.settings };
+}
+var held2 = /* @__PURE__ */ new Map();
+function holdManagedBuildSettings(jobDir, settings) {
+  held2.set(jobDir, settings);
+}
+function managedBuildSettingsFor(jobDir) {
+  return held2.get(jobDir);
+}
+function dropManagedBuildSettings(jobDir) {
+  held2.delete(jobDir);
+}
+function managedBuildSettingValues() {
+  return [...new Set([...held2.values()].flatMap((settings) => settings.variables.map(({ value }) => value)))];
+}
+function managedMachineLimits(settings) {
+  const { vcpus, memoryGiB, diskGB } = settings.machine;
+  return { cpus: vcpus, memoryBytes: Math.round(memoryGiB * GIB), diskBytes: Math.round(diskGB * GB) };
+}
+function withFactoryHosts(runnerHosts, settings) {
+  if (settings === void 0) return runnerHosts;
+  return [.../* @__PURE__ */ new Set([...runnerHosts ?? [], ...settings.allowHosts])];
+}
 var AssetError = class extends Error {
   constructor(file, message) {
     super(message);
@@ -2505,8 +2570,8 @@ function claudeCredentialCheck(env, options = {}) {
     }
     return { name, status: "pass", detail: `${variables[0]} is set in the claude.env or runner.env of the service ${unit}` };
   }
-  const held2 = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
-  if (held2 === void 0) {
+  const held3 = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
+  if (held3 === void 0) {
     return {
       name,
       status: "fail",
@@ -2515,7 +2580,7 @@ function claudeCredentialCheck(env, options = {}) {
     };
   }
   const sameVariables = options.shell === true ? "; the runner must be started with the same variable" : "";
-  return { name, status: "pass", detail: `${held2.variable} is set${sameVariables}` };
+  return { name, status: "pass", detail: `${held3.variable} is set${sameVariables}` };
 }
 function missingPermissionOf(err) {
   if (!(err instanceof WorkCommandError) || err.status !== 403) return void 0;
@@ -2813,10 +2878,10 @@ async function runBuildSteps(input) {
   if (staged.kind === "refused") return { ok: false, reason: staged.reason };
   let controlPlane;
   if (input.requireBuildSkill === true && !(staged.kind === "staged" && stagedHasBuildSkill(staged))) {
-    const held2 = await checkoutHasBuildSkill(input);
-    if (held2 !== true) {
+    const held3 = await checkoutHasBuildSkill(input);
+    if (held3 !== true) {
       if (staged.kind === "staged") input.removeStagedContext();
-      if (held2 !== false) return { ok: false, reason: held2.failed };
+      if (held3 !== false) return { ok: false, reason: held3.failed };
       return { ok: false, reason: missingBuildSkillReason(staged.kind === "staged" ? { repository: staged.repository, commit: staged.sha } : void 0) };
     }
   }
@@ -3680,17 +3745,17 @@ async function drain(req) {
 }
 function readPrefix(req, gzip) {
   return new Promise((resolve2, reject) => {
-    const held2 = [];
+    const held3 = [];
     const finish = (section) => {
       req.off("data", onData);
       req.off("end", onEnd);
       req.off("error", reject);
       req.pause();
-      resolve2({ held: held2, section });
+      resolve2({ held: held3, section });
     };
     const onData = (chunk) => {
-      held2.push(chunk);
-      const section = readCommandSection(Buffer.concat(held2), gzip);
+      held3.push(chunk);
+      const section = readCommandSection(Buffer.concat(held3), gzip);
       if (section.kind !== "need-more") finish(section);
     };
     const onEnd = () => finish({ kind: "need-more" });
@@ -3778,7 +3843,7 @@ function createGitRemote(options) {
   async function push(req, res, route, target) {
     const encoding = req.headers["content-encoding"];
     const gzip = encoding === "gzip";
-    const { held: held2, section } = await readPrefix(req, gzip);
+    const { held: held3, section } = await readPrefix(req, gzip);
     const refuse = async (reason) => {
       log(`push refused: ${reason}`);
       await drain(req);
@@ -3808,7 +3873,7 @@ function createGitRemote(options) {
         const file = createWriteStream(bodyPath);
         const cap = options.maxPushBytes ?? 2 * 1024 ** 3;
         let size = 0;
-        for (const chunk of held2) {
+        for (const chunk of held3) {
           size += chunk.length;
           file.write(chunk);
         }
@@ -3854,7 +3919,7 @@ function createGitRemote(options) {
             createReadStream(spooled).pipe(upstream);
             return;
           }
-          for (const chunk of held2) upstream.write(chunk);
+          for (const chunk of held3) upstream.write(chunk);
           req.pipe(upstream);
         }
       });
@@ -3965,27 +4030,27 @@ function usableCpus(deps = {}) {
 }
 function createCpuAllocator(cores) {
   const usable = [...new Set(cores)].sort((a, b) => a - b);
-  const held2 = /* @__PURE__ */ new Map();
+  const held3 = /* @__PURE__ */ new Map();
   const holders = (core) => {
     let count = 0;
-    for (const set of held2.values()) if (set.includes(core)) count++;
+    for (const set of held3.values()) if (set.includes(core)) count++;
     return count;
   };
   return {
     acquire(buildId, cpus) {
-      const existing = held2.get(buildId);
+      const existing = held3.get(buildId);
       if (existing !== void 0) return existing;
       const wanted = Math.min(Math.ceil(cpus), usable.length);
       const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
       const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
-      held2.set(buildId, chosen);
+      held3.set(buildId, chosen);
       return chosen;
     },
     hold(buildId, set) {
-      held2.set(buildId, [...set]);
+      held3.set(buildId, [...set]);
     },
     release(buildId) {
-      held2.delete(buildId);
+      held3.delete(buildId);
     }
   };
 }
@@ -4580,14 +4645,15 @@ async function measureDisk(runtime, state) {
     clearTimeout(timer);
   }
 }
-async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote, serve = "socket", lease, inherit, routeLog) {
+async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote, serve = "socket", lease, inherit, routeLog, settingsDir) {
   return startBuildServices({
     startTunnel: runtime.startTunnel,
     tunnelOptions: { ...runtime.tunnelOptions, ...gitRemote === void 0 ? {} : { gitRemote } },
     buildDir: buildDir2,
     jobDir,
     destinations: config.build?.destinations ?? [],
-    allowHosts: config.build?.allowHosts,
+    // A managed build's tunnel allows the factory's hosts beside the runner's own.
+    allowHosts: withFactoryHosts(config.build?.allowHosts, managedBuildSettingsFor(settingsDir ?? jobDir)),
     serve,
     ...lease === void 0 ? {} : { lease },
     ...inherit === void 0 ? {} : { inherit },
@@ -5016,4 +5082,4 @@ function describeMachineDocker(machine) {
   return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
 }
 
-export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedClaudeKey, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedClaudeKeyFor, managedClaudeKeyValues, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withTunnelLog, writeEvalInput, writeRunnerInit };
+export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };

package/dist/{chunk-PWSUNS6Y.js → chunk-E6OVLJTR.js}

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-CY5TCVBS.js';
-import { writePendingUpdate } from './chunk-TFPNPS4Q.js';
-import { renderUpdateSteps } from './chunk-KRTD2F3I.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-AE3OTPUU.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-U6AWVO6L.js';
+import { writePendingUpdate } from './chunk-HOUFCUMH.js';
+import { renderUpdateSteps } from './chunk-VWZHOFBP.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-4G4IH4A7.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-FDJPDZSR.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-TS3EFB7S.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { RUNNER_PROTOCOL } from './chunk-PAK5P2ND.js';
-import { realBlockedProbes, checkBlockedWithSlots } from './chunk-ZP7GKJSM.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-UMYYYF7B.js';
+import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-JC6AQ6PC.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-YL3RWW7X.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-7P3H4RY2.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-PP6OX4OT.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SYVRBBLW.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-CNZRUVZ5.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-EPFFYDNX.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SDELQEG4.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3EHDZTRT.js';
-import { freeBytes, formatBytes, volumeBytes } from './chunk-UONH72CJ.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-M3ME6TLQ.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-YNMVVQOQ.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ZIKZZ4LK.js';
+import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-IWVGALDC.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-HVQMIZ22.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-LQHCNXPK.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6JZXIWX7.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-MOI2KDLH.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-JKNOJKVD.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-L5VHGRQE.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PXGU3GKY.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-G4W4B33M.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-SDAEXUIX.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
@@ -1289,12 +1289,12 @@ async function sendTickHeartbeat(state, workRequest) {
           workRequest: next,
           lastUpdate: readLastUpdate(state.config.configPath),
           lowDisk: state.lowDisk,
-          blocked: state.blocked,
+          blocked: state.blocked ?? state.noRoomEmpty,
           state: hostState({
             draining: state.draining === true,
             restarting: state.restarting === true,
             holdingForUpdate: state.holdingForUpdate === true,
-            blocked: state.blocked !== void 0,
+            blocked: (state.blocked ?? state.noRoomEmpty) !== void 0,
             lowDisk: state.lowDisk !== void 0
           }),
           // Left out unless a draining runner has builds to wait on, so the gateway stores null.
@@ -1481,6 +1481,44 @@ function clearUpdateWait(state) {
   state.waitsLogged = void 0;
   recordPendingUpdate(state, void 0);
 }
+function holdWithoutRoomForLarge(state) {
+  if (state.config.managed !== true) return false;
+  const probes = {
+    ...realBlockedProbes(),
+    ...state.deps.container?.hostEnv === void 0 ? {} : { env: state.deps.container.hostEnv },
+    ...state.deps.blocked
+  };
+  let runningMemoryBytes = 0;
+  let runningDiskBytes = 0;
+  let heldDiskBytes = 0;
+  for (const active of state.jobs.values()) {
+    const microvm = active.job?.microvm;
+    runningMemoryBytes += microvm?.limits?.memoryBytes ?? largeBuildMemoryBytes();
+    runningDiskBytes += microvm?.limits?.diskBytes ?? LARGE_BUILD_DISK_BYTES;
+    if (microvm?.buildDisk !== void 0) heldDiskBytes += (state.deps.allocatedBytes ?? allocatedBytes)(microvm.buildDisk);
+  }
+  const room = checkManagedRoom({
+    runningMemoryBytes,
+    totalMemoryBytes: probes.totalMemoryBytes(),
+    sliceBytes: sliceMemoryOf(probes.env),
+    freeDiskBytes: (state.deps.freeBytes ?? freeBytes)(runnerDir(state.config.configPath)),
+    heldDiskBytes,
+    runningDiskBytes
+  });
+  const log = logOf(state);
+  if (!room.fits) {
+    if (state.noRoom !== room.resource) log.line(`holding off new work: ${room.reason} \xB7 claiming again once a build ends`);
+    state.noRoom = room.resource;
+    state.noRoomEmpty = state.jobs.size === 0 ? { reason: `no room for one Large build: ${room.reason}` } : void 0;
+    return true;
+  }
+  state.noRoomEmpty = void 0;
+  if (state.noRoom !== void 0) {
+    state.noRoom = void 0;
+    log.line("a Large build fits again \xB7 taking work");
+  }
+  return false;
+}
 function recordPendingUpdate(state, record) {
   const text = record === void 0 ? "none" : JSON.stringify(record);
   if (state.updateRecord === text) return;
@@ -1863,6 +1901,7 @@ async function runTick(state) {
   const jailer = state.config.managed === true && state.deps.blocked?.jailer === void 0 ? await jailerState(state) : void 0;
   if (holdWhenBlocked(state, jailer)) return;
   if (holdOffForDisk(state)) return;
+  if (holdWithoutRoomForLarge(state)) return;
   const log = logOf(state);
   const repoFilter = new RepoFilter(state.config.repos);
   let filtered = 0;
@@ -1892,6 +1931,7 @@ async function runTick(state) {
             filtered++;
             continue;
           }
+          if (holdWithoutRoomForLarge(state)) return;
           const attempt = await tryClaimAndStart(state, item, queue);
           if (attempt.kind === "started") {
             claimed = true;
@@ -1921,7 +1961,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-KVFRK24I.js');
+  const { postJson: postJson2 } = await import('./work-cmd-V5FHLWJM.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2145,10 +2185,18 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       const fetched = await fetchManagedClaudeKey(state.config, item.number, { fetchImpl: state.deps.fetchImpl, now: state.deps.now, sleep: state.deps.sleep });
       if (active.ending) return;
       if (!fetched.ok) {
-        await endOnManagedKeyRefusal(state, active, fetched);
+        await endOnManagedRefusal(state, active, fetched, { what: "Anthropic key", was: "was" });
         return;
       }
       holdManagedClaudeKey(dirPath, fetched.apiKey);
+      const settings = await fetchManagedBuildSettings(state.config, item.number, { fetchImpl: state.deps.fetchImpl, now: state.deps.now, sleep: state.deps.sleep });
+      if (active.ending) return;
+      if (!settings.ok) {
+        await endOnManagedRefusal(state, active, settings, { what: "settings", was: "were" });
+        return;
+      }
+      holdManagedBuildSettings(dirPath, settings.settings);
+      active.job.managedVariables = settings.settings.variables.map(({ name }) => name);
     }
   }
   if (state.config.hooks.report) {
@@ -2476,9 +2524,9 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
         job.microvm.commandDir = MICROVM_COMMAND_DIR;
         job.microvm.commandLogBase = commandLogOffset(dirPath, 0);
         writeJobFile(jobFilePath, job);
-        await startMicroVmCommand({ job, cmdline, runtime, config: state.config });
+        await startMicroVmCommand({ job, jobDir: dirPath, cmdline, runtime, config: state.config });
       } else {
-        const composed = microVmCommandLine({ job, cmdline, runtime, config: state.config, cli: join(runtime.cliBuild().distDir, "index.js") });
+        const composed = microVmCommandLine({ job, jobDir: dirPath, cmdline, runtime, config: state.config, cli: join(runtime.cliBuild().distDir, "index.js") });
         running = runCommand(composed.line, { ...composed.env, OUTERLAYER_JOB_DIR: dirPath }, dirPath, join(dirPath, "command.log"), state.deps.spawnFn);
       }
     } else if (job.container !== void 0) {
@@ -2562,18 +2610,18 @@ function buildTokensFor(state, active, item) {
     }
   });
 }
-async function endOnManagedKeyRefusal(state, active, refused) {
+async function endOnManagedRefusal(state, active, refused, subject) {
   const log = logOf(state);
   const tag = `#${active.job.item}`;
   const code = refused.code ?? "unavailable";
   if (refused.code === "claim_expired" || refused.code === "claim_not_held") {
-    log.error(`${tag} the build's Anthropic key was refused: ${code} \xB7 ending job as lease_lost`);
+    log.error(`${tag} the build's ${subject.what} ${subject.was} refused: ${code} \xB7 ending job as lease_lost`);
     await endJob(state, active, "lease_lost");
   } else if (refused.retryable || refused.code === "managed_credential_missing" || refused.code === "managed_builds_off") {
-    log.error(`${tag} the build's Anthropic key could not be had (${code}) \xB7 releasing the claim to try again`);
+    log.error(`${tag} the build's ${subject.what} could not be had (${code}) \xB7 releasing the claim to try again`);
     await endJob(state, active, void 0);
   } else {
-    log.error(`${tag} the build's Anthropic key was refused: ${code} \xB7 ending job as failed`);
+    log.error(`${tag} the build's ${subject.what} ${subject.was} refused: ${code} \xB7 ending job as failed`);
     await endJob(state, active, "failed", { stage: "provision", reason: code });
   }
 }
@@ -3022,6 +3070,21 @@ async function rejoinMicroVmBuild(state, adopted) {
       return { reason: `the adopted build's Anthropic key could not be had after the runner restarted: ${cause}`, why: "the gateway did not give its Anthropic key again" };
     }
     holdManagedClaudeKey(dirPath, fetched.apiKey);
+    const settings = await fetchManagedBuildSettings(config, job.item, {
+      fetchImpl: state.deps.fetchImpl,
+      now: state.deps.now,
+      sleep: state.deps.sleep,
+      windowMs: ADOPTED_FETCH_RETRY_WINDOW_MS
+    });
+    if (!settings.ok) {
+      const code = settings.code ?? "unavailable";
+      log.error(`${tag} the adopted build's settings could not be had: ${code}`);
+      const cause = settings.retryable ? "the gateway could not be reached for them" : `the gateway refused them (${code})`;
+      return { reason: `the adopted build's settings could not be had after the runner restarted: ${cause}`, why: "the gateway did not give its settings again" };
+    }
+    holdManagedBuildSettings(dirPath, settings.settings);
+    job.managedVariables = [.../* @__PURE__ */ new Set([...job.managedVariables ?? [], ...settings.settings.variables.map(({ name }) => name)])];
+    writeJobFile(join(dirPath, "job.json"), job);
   }
   const tokens = buildTokensFor(state, adopted, job.item);
   runtime.credentials.set(dirPath, tokens);
@@ -3099,6 +3162,11 @@ async function removeUnadoptedSockets(state, adopted) {
 }
 async function finishMicroVmWhileAway(state, dirPath, job, reason, why) {
   const log = logOf(state);
+  if ((job.managedVariables?.length ?? 0) > 0 && managedBuildSettingsFor(dirPath) === void 0) {
+    const settings = await fetchManagedBuildSettings(state.config, job.item, { fetchImpl: state.deps.fetchImpl, now: state.deps.now, sleep: state.deps.sleep });
+    if (settings.ok) holdManagedBuildSettings(dirPath, settings.settings);
+    else log.error(`#${job.item} the build's settings could not be had again: ${settings.code ?? "unavailable"}`);
+  }
   const recorded = outcomeFromExitCode(dirPath);
   let outcome = "interrupted";
   let ending = { reason };
@@ -3211,7 +3279,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-4W4QUBMP.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-ERYYVAEM.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-WMNPKBX5.js → chunk-ELO5XEES.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readNewestDemo } from './chunk-ER6KQCVJ.js';
-import { runEmitArtifact } from './chunk-QEIA5Q35.js';
+import { runEmitArtifact } from './chunk-XL2MPORM.js';
 import { VoiceDownloadError, downloadPinned, sha256OfFile } from './chunk-2PGI6RDE.js';
 import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-4UPET3R7.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-7DXVL7TN.js';
+import { autoConnect } from './chunk-IO2BBKG4.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { ARTIFACT_MAX_BYTES, ARTIFACT_MAX_CAPTION_LENGTH, DEMO_RECORD_MEDIA_TYPE, ARTIFACT_MAX_REPLACES_TARGETS, DemoManifestSchema, ARTIFACT_KINDS } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-PP6OX4OT.js → chunk-EPFFYDNX.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-6JZXIWX7.js';
-import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-CAQCDYKF.js';
-import { signingFetchFor } from './chunk-3N77LUQI.js';
-import { signerFor } from './chunk-MOI2KDLH.js';
+import { WorkCommandError, postJson } from './chunk-JKNOJKVD.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-5JGPTYLT.js';
+import { signingFetchFor } from './chunk-7QAJQDHS.js';
+import { signerFor } from './chunk-L5VHGRQE.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-PXGU3GKY.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-GJ4KBHBD.js';
 import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, cpSync, readFileSync, existsSync, lstatSync } from 'fs';
 import { relative, join, dirname } from 'path';
 

package/dist/{chunk-35JMYSUD.js → chunk-EUQZAH2W.js}

@@ -3,10 +3,10 @@ import { createRequire } from 'node:module';
 import { DEFAULT_DASHBOARD } from './chunk-Y5YCX6AL.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { remoteLookupFailed } from './chunk-GSSVJNP2.js';
+import { remoteLookupFailed } from './chunk-Z7WMU3RA.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { lstatSync } from 'fs';

package/dist/{chunk-YZ375YBI.js → chunk-FZ4G6CMK.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-6JZXIWX7.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-JKNOJKVD.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { defaultFetch } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
+import { defaultFetch } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { inferArtifactKind, mediaTypeForArtifactPath, WORK_ITEM_COMMENT_MAX_BODY_LENGTH } from './chunk-EOTMDIYC.js';
@@ -130,7 +130,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-XANZE3K4.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-NK3ULOUQ.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;