@outerlayer/cli 0.34.0-next.20261026145838 → 0.34.0-next.20261026182624

package/dist/{chunk-7P3H4RY2.js → chunk-CNZRUVZ5.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-VVOSUGEF.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, FETCHED_DIR, toolsDockerfile, TAG_HOST, metadataFromLabels, writeRecord, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_VOICE_DIR } from './chunk-H47VGSCW.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { runExec, execCapture, waitForAgent } from './chunk-2ILU7UAU.js';
-import { GUEST_CID, linkVsockSockets } from './chunk-OGPEHSNW.js';
-import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-PP6OX4OT.js';
-import { runnerImageVersion } from './chunk-SYVRBBLW.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-7JE2WFNK.js';
-import { runnerCredentialProblem, builtinKind, hostAllowed } from './chunk-3EHDZTRT.js';
-import { formatBytes, allocatedBytes } from './chunk-UONH72CJ.js';
-import { createDockerHost, builderSpec, RecipeError, DOCKER_FEATURE, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun, writeSanitizedRecipe, classifyProperties } from './chunk-M3ME6TLQ.js';
+import { runExec, execCapture, waitForAgent } from './chunk-3VZTNXK5.js';
+import { GUEST_CID, linkVsockSockets } from './chunk-6KFJIU73.js';
+import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-EPFFYDNX.js';
+import { runnerImageVersion } from './chunk-SDELQEG4.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-HVPW272H.js';
+import { runnerCredentialProblem, builtinKind, allowHostProblem, hostAllowed } from './chunk-ZIKZZ4LK.js';
+import { formatBytes, allocatedBytes } from './chunk-IWVGALDC.js';
+import { createDockerHost, builderSpec, RecipeError, DOCKER_FEATURE, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, spawnRun, writeSanitizedRecipe, classifyProperties } from './chunk-HVQMIZ22.js';
 import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-4UPET3R7.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { postJson, WorkCommandError, getJson } from './chunk-6JZXIWX7.js';
+import { postJson, WorkCommandError, getJson } from './chunk-JKNOJKVD.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { signerFor } from './chunk-MOI2KDLH.js';
+import { signerFor } from './chunk-L5VHGRQE.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-GSSVJNP2.js';
+import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-Z7WMU3RA.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-FGXT5OXS.js';
 import { downconvertSession } from './chunk-EOTMDIYC.js';
-import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-PXGU3GKY.js';
-import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, JOB_MOUNT, realFdStorePort } from './chunk-G4W4B33M.js';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-GJ4KBHBD.js';
+import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, writeBuildMavenSettings, checkEnvironment, AGENT_CREDENTIAL_MISSING, mavenSettingsXml, namesGlobalSettings, MAVEN_NO_PROXY_NOTE, mavenArgs, MAVEN_SPACE_NOTE, writeMavenSettings, checkoutPath, JOB_MOUNT, realFdStorePort } from './chunk-SDAEXUIX.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
 import { spawn, spawnSync } from 'child_process';
 import { mkdirSync, existsSync, readFileSync, mkdtempSync, rmSync, chmodSync, truncateSync, statSync, accessSync, constants, readdirSync, writeFileSync, lstatSync, copyFileSync, renameSync, rmdirSync, unlinkSync, linkSync, openSync, closeSync, cpSync, writeSync, appendFileSync, createWriteStream, createReadStream } from 'fs';
@@ -74,6 +74,71 @@ function managedClaudeKeyValues() {
 function hasClaudeCredential(config, hostEnv, jobDir) {
   return config.managed === true ? managedClaudeKeyFor(jobDir) !== void 0 : claudeCredential(hostEnv) !== void 0;
 }
+
+// src/runner/managed-build-settings.ts
+var FETCH_RETRY_WINDOW_MS2 = 3e4;
+var GIB = 1024 ** 3;
+var GB = 1e9;
+var VARIABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,254}$/;
+var MALFORMED = "the gateway's answer was not a machine, a list of hosts and a list of variables";
+function parseSettings(data) {
+  const isPositive = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
+  if (typeof data !== "object" || data === null) return { problem: MALFORMED };
+  const { machine, allowHosts, variables } = data;
+  if (typeof machine !== "object" || machine === null) return { problem: MALFORMED };
+  const { size, vcpus, memoryGiB, diskGB } = machine;
+  if (size !== "small" && size !== "large" || !isPositive(vcpus) || !isPositive(memoryGiB) || !isPositive(diskGB)) return { problem: MALFORMED };
+  if (!Array.isArray(allowHosts) || !allowHosts.every((host) => typeof host === "string")) return { problem: MALFORMED };
+  if (!Array.isArray(variables)) return { problem: MALFORMED };
+  for (const host of allowHosts) {
+    const problem = allowHostProblem(host);
+    if (problem !== void 0) return { problem: `the factory's allowed host ${JSON.stringify(host)} ${problem}` };
+  }
+  const parsed = [];
+  for (const entry of variables) {
+    if (typeof entry !== "object" || entry === null) return { problem: MALFORMED };
+    const { name, value } = entry;
+    if (typeof name !== "string" || name === "" || typeof value !== "string") return { problem: MALFORMED };
+    if (!VARIABLE_NAME.test(name)) return { problem: `the factory's build variable ${JSON.stringify(name)} is not a variable name` };
+    if (value.trim().length < MIN_SCRUBBED_LITERAL) {
+      return { problem: `the value of the factory's build variable ${name} has fewer than ${MIN_SCRUBBED_LITERAL} characters, so the runner could not remove it from logs and transcripts` };
+    }
+    parsed.push({ name, value });
+  }
+  return { settings: { machine: { size, vcpus, memoryGiB, diskGB }, allowHosts: [...allowHosts], variables: parsed } };
+}
+async function fetchManagedBuildSettings(config, item, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const outcome = await retrySend(
+    async () => postJson(config.url, `/v1/work-items/${item}/claim/build-settings`, config.apiKey, config.appId, {}, fetchImpl, void 0, await signerFor(config.configPath)),
+    { now: deps.now, sleep: deps.sleep, windowMs: deps.windowMs ?? FETCH_RETRY_WINDOW_MS2 }
+  );
+  if (!outcome.ok) return { ok: false, code: outcome.code, reason: outcome.message ?? outcome.reason, retryable: outcome.retryable };
+  const parsed = parseSettings(outcome.value.data);
+  if ("problem" in parsed) return { ok: false, code: "malformed_settings_response", reason: parsed.problem, retryable: false };
+  return { ok: true, settings: parsed.settings };
+}
+var held2 = /* @__PURE__ */ new Map();
+function holdManagedBuildSettings(jobDir, settings) {
+  held2.set(jobDir, settings);
+}
+function managedBuildSettingsFor(jobDir) {
+  return held2.get(jobDir);
+}
+function dropManagedBuildSettings(jobDir) {
+  held2.delete(jobDir);
+}
+function managedBuildSettingValues() {
+  return [...new Set([...held2.values()].flatMap((settings) => settings.variables.map(({ value }) => value)))];
+}
+function managedMachineLimits(settings) {
+  const { vcpus, memoryGiB, diskGB } = settings.machine;
+  return { cpus: vcpus, memoryBytes: Math.round(memoryGiB * GIB), diskBytes: Math.round(diskGB * GB) };
+}
+function withFactoryHosts(runnerHosts, settings) {
+  if (settings === void 0) return runnerHosts;
+  return [.../* @__PURE__ */ new Set([...runnerHosts ?? [], ...settings.allowHosts])];
+}
 var AssetError = class extends Error {
   constructor(file, message) {
     super(message);
@@ -2505,8 +2570,8 @@ function claudeCredentialCheck(env, options = {}) {
     }
     return { name, status: "pass", detail: `${variables[0]} is set in the claude.env or runner.env of the service ${unit}` };
   }
-  const held2 = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
-  if (held2 === void 0) {
+  const held3 = claudeCredential(env, { ignoreHeld: options.ignoreHeld === true });
+  if (held3 === void 0) {
     return {
       name,
       status: "fail",
@@ -2515,7 +2580,7 @@ function claudeCredentialCheck(env, options = {}) {
     };
   }
   const sameVariables = options.shell === true ? "; the runner must be started with the same variable" : "";
-  return { name, status: "pass", detail: `${held2.variable} is set${sameVariables}` };
+  return { name, status: "pass", detail: `${held3.variable} is set${sameVariables}` };
 }
 function missingPermissionOf(err) {
   if (!(err instanceof WorkCommandError) || err.status !== 403) return void 0;
@@ -2813,10 +2878,10 @@ async function runBuildSteps(input) {
   if (staged.kind === "refused") return { ok: false, reason: staged.reason };
   let controlPlane;
   if (input.requireBuildSkill === true && !(staged.kind === "staged" && stagedHasBuildSkill(staged))) {
-    const held2 = await checkoutHasBuildSkill(input);
-    if (held2 !== true) {
+    const held3 = await checkoutHasBuildSkill(input);
+    if (held3 !== true) {
       if (staged.kind === "staged") input.removeStagedContext();
-      if (held2 !== false) return { ok: false, reason: held2.failed };
+      if (held3 !== false) return { ok: false, reason: held3.failed };
       return { ok: false, reason: missingBuildSkillReason(staged.kind === "staged" ? { repository: staged.repository, commit: staged.sha } : void 0) };
     }
   }
@@ -3680,17 +3745,17 @@ async function drain(req) {
 }
 function readPrefix(req, gzip) {
   return new Promise((resolve2, reject) => {
-    const held2 = [];
+    const held3 = [];
     const finish = (section) => {
       req.off("data", onData);
       req.off("end", onEnd);
       req.off("error", reject);
       req.pause();
-      resolve2({ held: held2, section });
+      resolve2({ held: held3, section });
     };
     const onData = (chunk) => {
-      held2.push(chunk);
-      const section = readCommandSection(Buffer.concat(held2), gzip);
+      held3.push(chunk);
+      const section = readCommandSection(Buffer.concat(held3), gzip);
       if (section.kind !== "need-more") finish(section);
     };
     const onEnd = () => finish({ kind: "need-more" });
@@ -3778,7 +3843,7 @@ function createGitRemote(options) {
   async function push(req, res, route, target) {
     const encoding = req.headers["content-encoding"];
     const gzip = encoding === "gzip";
-    const { held: held2, section } = await readPrefix(req, gzip);
+    const { held: held3, section } = await readPrefix(req, gzip);
     const refuse = async (reason) => {
       log(`push refused: ${reason}`);
       await drain(req);
@@ -3808,7 +3873,7 @@ function createGitRemote(options) {
         const file = createWriteStream(bodyPath);
         const cap = options.maxPushBytes ?? 2 * 1024 ** 3;
         let size = 0;
-        for (const chunk of held2) {
+        for (const chunk of held3) {
           size += chunk.length;
           file.write(chunk);
         }
@@ -3854,7 +3919,7 @@ function createGitRemote(options) {
             createReadStream(spooled).pipe(upstream);
             return;
           }
-          for (const chunk of held2) upstream.write(chunk);
+          for (const chunk of held3) upstream.write(chunk);
           req.pipe(upstream);
         }
       });
@@ -3965,27 +4030,27 @@ function usableCpus(deps = {}) {
 }
 function createCpuAllocator(cores) {
   const usable = [...new Set(cores)].sort((a, b) => a - b);
-  const held2 = /* @__PURE__ */ new Map();
+  const held3 = /* @__PURE__ */ new Map();
   const holders = (core) => {
     let count = 0;
-    for (const set of held2.values()) if (set.includes(core)) count++;
+    for (const set of held3.values()) if (set.includes(core)) count++;
     return count;
   };
   return {
     acquire(buildId, cpus) {
-      const existing = held2.get(buildId);
+      const existing = held3.get(buildId);
       if (existing !== void 0) return existing;
       const wanted = Math.min(Math.ceil(cpus), usable.length);
       const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
       const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
-      held2.set(buildId, chosen);
+      held3.set(buildId, chosen);
       return chosen;
     },
     hold(buildId, set) {
-      held2.set(buildId, [...set]);
+      held3.set(buildId, [...set]);
     },
     release(buildId) {
-      held2.delete(buildId);
+      held3.delete(buildId);
     }
   };
 }
@@ -4580,14 +4645,15 @@ async function measureDisk(runtime, state) {
     clearTimeout(timer);
   }
 }
-async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote, serve = "socket", lease, inherit, routeLog) {
+async function startServicesFor(runtime, config, buildDir2, jobDir, itemKey, builtIns, gitRemote, serve = "socket", lease, inherit, routeLog, settingsDir) {
   return startBuildServices({
     startTunnel: runtime.startTunnel,
     tunnelOptions: { ...runtime.tunnelOptions, ...gitRemote === void 0 ? {} : { gitRemote } },
     buildDir: buildDir2,
     jobDir,
     destinations: config.build?.destinations ?? [],
-    allowHosts: config.build?.allowHosts,
+    // A managed build's tunnel allows the factory's hosts beside the runner's own.
+    allowHosts: withFactoryHosts(config.build?.allowHosts, managedBuildSettingsFor(settingsDir ?? jobDir)),
     serve,
     ...lease === void 0 ? {} : { lease },
     ...inherit === void 0 ? {} : { inherit },
@@ -5016,4 +5082,4 @@ function describeMachineDocker(machine) {
   return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
 }
 
-export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedClaudeKey, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedClaudeKeyFor, managedClaudeKeyValues, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withTunnelLog, writeEvalInput, writeRunnerInit };
+export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };

package/dist/{chunk-WMNPKBX5.js → chunk-ELO5XEES.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readNewestDemo } from './chunk-ER6KQCVJ.js';
-import { runEmitArtifact } from './chunk-QEIA5Q35.js';
+import { runEmitArtifact } from './chunk-XL2MPORM.js';
 import { VoiceDownloadError, downloadPinned, sha256OfFile } from './chunk-2PGI6RDE.js';
 import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-4UPET3R7.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-7DXVL7TN.js';
+import { autoConnect } from './chunk-IO2BBKG4.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { ARTIFACT_MAX_BYTES, ARTIFACT_MAX_CAPTION_LENGTH, DEMO_RECORD_MEDIA_TYPE, ARTIFACT_MAX_REPLACES_TARGETS, DemoManifestSchema, ARTIFACT_KINDS } from './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-PP6OX4OT.js → chunk-EPFFYDNX.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-6JZXIWX7.js';
-import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-CAQCDYKF.js';
-import { signingFetchFor } from './chunk-3N77LUQI.js';
-import { signerFor } from './chunk-MOI2KDLH.js';
+import { WorkCommandError, postJson } from './chunk-JKNOJKVD.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-5JGPTYLT.js';
+import { signingFetchFor } from './chunk-7QAJQDHS.js';
+import { signerFor } from './chunk-L5VHGRQE.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-PXGU3GKY.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-GJ4KBHBD.js';
 import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, cpSync, readFileSync, existsSync, lstatSync } from 'fs';
 import { relative, join, dirname } from 'path';
 

package/dist/{chunk-CY5TCVBS.js → chunk-ERTIEYDG.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { scrubReason, stripTerminalControls } from './chunk-AE3OTPUU.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-EMH2LNIE.js';
-import { RunnerAlreadyRunningError, readPidFile } from './chunk-YNMVVQOQ.js';
+import { scrubReason, stripTerminalControls } from './chunk-SZU4YCBH.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-V2VJYK46.js';
+import { RunnerAlreadyRunningError, readPidFile } from './chunk-LQHCNXPK.js';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, postJson } from './chunk-6JZXIWX7.js';
-import { signerFor } from './chunk-MOI2KDLH.js';
-import { pidFilePath } from './chunk-PXGU3GKY.js';
+import { isSignatureRefusal, postJson } from './chunk-JKNOJKVD.js';
+import { signerFor } from './chunk-L5VHGRQE.js';
+import { pidFilePath } from './chunk-GJ4KBHBD.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);

package/dist/{chunk-35JMYSUD.js → chunk-EUQZAH2W.js}

@@ -3,10 +3,10 @@ import { createRequire } from 'node:module';
 import { DEFAULT_DASHBOARD } from './chunk-Y5YCX6AL.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { remoteLookupFailed } from './chunk-GSSVJNP2.js';
+import { remoteLookupFailed } from './chunk-Z7WMU3RA.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { lstatSync } from 'fs';

package/dist/{chunk-WHDS6MEG.js → chunk-GHFI5GBF.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-7DXVL7TN.js';
+import { autoConnect } from './chunk-IO2BBKG4.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { CriteriaListSchema } from './chunk-EOTMDIYC.js';

package/dist/{chunk-PXGU3GKY.js → chunk-GJ4KBHBD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILD_HOME } from './chunk-G4W4B33M.js';
+import { BUILD_HOME } from './chunk-SDAEXUIX.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);