@outerlayer/cli 0.34.0-next.20261026145838 → 0.34.0-next.20261026182624

package/dist/chunk-GYVMMU3U.js

@@ -0,0 +1,321 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { criteriaOf, loadCitationFinder, hostItemsOf, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, NO_CITING_TEST_REASON, NO_VERDICT_REASON, planCriteria } from './chunk-6D7H5DMZ.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-JKNOJKVD.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { defaultFetch } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
+import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import { readDeliveryRecord } from './chunk-YQR6E6OV.js';
+import { inferArtifactKind, mediaTypeForArtifactPath, WORK_ITEM_COMMENT_MAX_BODY_LENGTH } from './chunk-EOTMDIYC.js';
+import { createHash } from 'crypto';
+import { spawnSync } from 'child_process';
+import { existsSync, statSync, readFileSync } from 'fs';
+import { resolve, dirname } from 'path';
+
+createRequire(import.meta.url);
+function kindProblem(declared, file) {
+  if (declared === "test") return "a test proof is recorded by CI, not by --record";
+  const kind = inferArtifactKind(mediaTypeForArtifactPath(file));
+  return kind === declared ? void 0 : `the kinds differ: the file is a ${kind}, but the criterion declares a ${declared} proof`;
+}
+function proofsCommentBody(head, lines) {
+  const header = `These proofs are not current at ${head.slice(0, 7)}:`;
+  const rows = lines.map((line) => `- ${line.id} (${line.proof}): ${line.reason}`);
+  const fits = (count2) => {
+    const left = rows.length - count2;
+    return [header, ...rows.slice(0, count2), ...left > 0 ? [`and ${left} more.`] : []].join("\n");
+  };
+  let count = rows.length;
+  while (count > 0 && fits(count).length > WORK_ITEM_COMMENT_MAX_BODY_LENGTH) count -= 1;
+  return fits(count);
+}
+function proofsCommentId(item, head, lines) {
+  const list = [...lines].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((line) => [line.id, line.proof, line.reason]);
+  const digest = createHash("sha256").update(JSON.stringify([item, head.toLowerCase(), list])).digest("hex");
+  return `proofs-${digest.slice(0, 32)}`;
+}
+function repositoryName(repository) {
+  return repository.replace(/\.git$/, "").split("/").filter((part) => part !== "").slice(-2).join("/").toLowerCase();
+}
+function ownPullRequest(pullRequests, requested, checkoutRepository) {
+  if (requested !== void 0) return { pr: requested };
+  const here = checkoutRepository === void 0 ? void 0 : repositoryName(checkoutRepository);
+  const open = pullRequests.filter(
+    (pr) => pr.state === "open" && typeof pr.prNumber === "number" && (here === void 0 || repositoryName(pr.repository ?? "") === here)
+  );
+  if (open.length > 1) return { ambiguous: open.map((pr) => pr.prNumber) };
+  return { pr: open[0]?.prNumber };
+}
+var NO_BRIEF = "";
+var GITHUB_BLOB = /^https:\/\/github\.com\/[^/]+\/[^/]+\/blob\/([0-9a-f]{7,64})\//;
+function commitOf(refs) {
+  for (const ref of refs) {
+    const match = GITHUB_BLOB.exec(ref.href ?? "");
+    if (match !== null) return match[1];
+  }
+  return void 0;
+}
+function unprovenCriteria(input) {
+  const { criteria, finder } = input;
+  const citations = finder.buildCitations({ ids: criteria.map((c) => c.id), files: [...input.headFiles], repository: null, sha: null });
+  const headTexts = new Map(input.headFiles.map((file) => [file.path, file.contents]));
+  const inputs = new Map(criteria.map((c) => [c.id, criterionInputs({ brief: NO_BRIEF, criterion: c, citations, testFiles: headTexts })]));
+  const notes = [];
+  const commits = /* @__PURE__ */ new Map();
+  const previous = /* @__PURE__ */ new Map();
+  const filesByCommit = /* @__PURE__ */ new Map();
+  for (const item of input.items) {
+    const criterion = criteria.find((c) => c.id === item.id);
+    if (criterion === void 0 || item.result !== "fail" || item.inputs === void 0) continue;
+    if (item.reason === NO_CITING_TEST_REASON || item.reason === NO_VERDICT_REASON) continue;
+    const commit = item.refs === void 0 ? void 0 : commitOf(item.refs);
+    if (commit === void 0) {
+      notes.push(`the links of ${item.id} name no commit`);
+      continue;
+    }
+    if (!filesByCommit.has(commit)) filesByCommit.set(commit, input.testFilesAt(commit));
+    const files = filesByCommit.get(commit);
+    if (files === void 0) {
+      notes.push(`this checkout does not hold ${item.id}'s cited tests at ${commit.slice(0, 7)}`);
+      continue;
+    }
+    const judgedCitations = finder.buildCitations({ ids: [item.id], files: [...files], repository: null, sha: null });
+    const judged = new Map(files.map((file) => [file.path, file.contents]));
+    commits.set(item.id, commit);
+    previous.set(item.id, { ...item, inputs: criterionInputs({ brief: NO_BRIEF, criterion, citations: judgedCitations, testFiles: judged }) });
+  }
+  const plan = planCriteria({ criteria, citations, inputs, previous: [...previous.values()] });
+  const settled = new Map(plan.settled.map((item) => [item.id, item]));
+  const entries = [];
+  for (const criterion of criteria) {
+    const item = settled.get(criterion.id);
+    if (item === void 0 || item.result !== "fail") continue;
+    if (item.refs === void 0) entries.push({ id: criterion.id, proof: null, state: "uncited" });
+    else entries.push({ id: criterion.id, proof: null, state: "failed", commit: commits.get(criterion.id) ?? "", reason: item.reason ?? "no reason recorded" });
+  }
+  return { entries, notes };
+}
+function git(cwd, args, input) {
+  const run = spawnSync("git", args, { cwd, input, maxBuffer: 268435456 });
+  if (run.status !== 0) throw new Error(`git ${args[0]} failed`);
+  return run.stdout;
+}
+function readObjects(cwd, specs) {
+  const out = git(cwd, ["cat-file", "--batch"], `${specs.join("\n")}
+`);
+  const texts = [];
+  let at = 0;
+  for (let n = 0; n < specs.length; n += 1) {
+    const end = out.indexOf(10, at);
+    const header = out.subarray(at, end).toString("utf8");
+    at = end + 1;
+    const match = /^[0-9a-f]+ blob (\d+)$/.exec(header);
+    if (match === null) {
+      texts.push(void 0);
+      continue;
+    }
+    const size = Number(match[1]);
+    texts.push(out.subarray(at, at + size).toString("utf8"));
+    at += size + 1;
+  }
+  return texts;
+}
+function testFilesAt(cwd, head, isTest) {
+  try {
+    const listing = git(cwd, ["ls-tree", "-r", "-l", "-z", head]);
+    const picked = /* @__PURE__ */ new Map();
+    for (const entry of listing.toString("utf8").split("\0")) {
+      const match = /^(\d+) blob ([0-9a-f]+)\s+(\d+)\t(.*)$/s.exec(entry);
+      if (match === null || !match[1].startsWith("100") || Number(match[3]) > MAX_TEST_FILE_BYTES || !isTest.test(match[4])) continue;
+      if (picked.size >= MAX_TEST_FILES) break;
+      picked.set(match[4], match[2]);
+    }
+    const paths = [...picked.keys()];
+    const texts = readObjects(cwd, [...picked.values()]);
+    return paths.flatMap((path, n) => texts[n] === void 0 ? [] : [{ path, contents: texts[n] }]);
+  } catch {
+    return void 0;
+  }
+}
+function checkoutPlaces(cwd) {
+  for (let dir = resolve(cwd); ; dir = dirname(dir)) {
+    const dotGit = resolve(dir, ".git");
+    try {
+      if (statSync(dotGit).isDirectory()) return { root: dir, common: dotGit };
+      const named = /^gitdir:\s*(.+)$/m.exec(readFileSync(dotGit, "utf8"))?.[1]?.trim();
+      if (named === void 0) return void 0;
+      const gitDir = resolve(dir, named);
+      let common = gitDir;
+      try {
+        common = resolve(gitDir, readFileSync(resolve(gitDir, "commondir"), "utf8").trim());
+      } catch {
+      }
+      return { root: dir, common };
+    } catch {
+    }
+    if (dirname(dir) === dir) return void 0;
+  }
+}
+async function judgeCheckName(cwd) {
+  const places = checkoutPlaces(cwd);
+  if (places === void 0) return {};
+  const delivered = readDeliveryRecord(places.common);
+  const dir = delivered?.dir ?? places.root;
+  if (!existsSync(dir)) return { note: `the governed context at ${dir} is not readable` };
+  const { checksIn, isJudgeCheck } = await import('./host-checks-NDXNYOMA.js');
+  const quiet = { line: () => void 0, error: () => void 0 };
+  const check = checksIn(dir, quiet, "").checks.find((c) => isJudgeCheck(c) && c.judge.subjects === "criteria");
+  return check === void 0 ? {} : { name: check.name };
+}
+async function findUnproven(input) {
+  try {
+    const found = await judgeCheckName(input.cwd);
+    if (found.name === void 0) return { entries: [], notes: found.note === void 0 ? [] : [found.note] };
+    const criteria = criteriaOf(input.item);
+    if (criteria === void 0) return { entries: [], notes: [] };
+    const finder = await loadCitationFinder();
+    const headFiles = testFilesAt(input.cwd, input.head, finder.TEST_FILE);
+    if (headFiles === void 0) return { entries: [], notes: [`the test files at ${input.head.slice(0, 7)} cannot be read`] };
+    const items = hostItemsOf(input.item, found.name);
+    const result = unprovenCriteria({
+      criteria,
+      finder,
+      headFiles,
+      items,
+      testFilesAt: (commit) => testFilesAt(input.cwd, commit, finder.TEST_FILE)
+    });
+    const check = Object(input.item).checks?.find((c) => Object(c).name === found.name);
+    if (check?.source === "host" && check.result === "fail" && items.length === 0) result.notes.unshift("the gateway returned no check items for the judge's result");
+    return result;
+  } catch (err) {
+    return { entries: [], notes: [err instanceof Error ? err.message : String(err)] };
+  }
+}
+
+// src/work-proofs-cmd.ts
+function liveHead(pr) {
+  if (pr.state !== "open" && pr.state !== "merged" || typeof pr.headSha !== "string" || pr.headSha === "") return void 0;
+  return pr.headSha.toLowerCase();
+}
+function otherPullRequestHeads(pullRequests, ownPr, checkoutRepository) {
+  const here = checkoutRepository === void 0 ? void 0 : repositoryName(checkoutRepository);
+  const heads = /* @__PURE__ */ new Set();
+  for (const pr of pullRequests) {
+    const head = liveHead(pr);
+    if (head === void 0) continue;
+    const isOwn = ownPr !== void 0 && pr.prNumber === ownPr && (here === void 0 || repositoryName(pr.repository ?? "") === here);
+    if (!isOwn) heads.add(head);
+  }
+  return heads;
+}
+function classifyProofs(data, checkoutHead) {
+  const heads = /* @__PURE__ */ new Set();
+  if (checkoutHead !== void 0 && checkoutHead !== "") heads.add(checkoutHead.toLowerCase());
+  data.pullRequests?.forEach((pr) => {
+    const head = liveHead(pr);
+    if (head !== void 0) heads.add(head);
+  });
+  return classifyProofsAt(data, heads);
+}
+function classifyProofsAt(data, heads) {
+  const entries = [];
+  for (const criterion of data.criteria?.items ?? []) {
+    if (criterion.proof === null || criterion.proof === "test") continue;
+    const newest = criterion.newestProof;
+    if (newest === null || newest === void 0) {
+      entries.push({ id: criterion.id, proof: criterion.proof, state: "missing", commit: null });
+    } else if (newest.commitSha !== null && heads.has(newest.commitSha.toLowerCase())) {
+      entries.push({ id: criterion.id, proof: criterion.proof, state: "current", commit: newest.commitSha });
+    } else {
+      entries.push({ id: criterion.id, proof: criterion.proof, state: "out-of-date", commit: newest.commitSha });
+    }
+  }
+  return entries;
+}
+var STATE_LABEL = { current: "current", "out-of-date": "out of date", missing: "missing" };
+function renderEntry(e) {
+  const id = sanitizeTerminal(e.id);
+  if (e.state === "uncited") {
+    return `${id}  none  uncited  No test at HEAD cites it. Put ${id} in a test's title or in a comment above the test, as in // proves ${id}`;
+  }
+  if (e.state === "failed") {
+    return `${id}  none  failed  ${sanitizeTerminal(e.commit)}  The judge failed it: ${sanitizeTerminal(e.reason)} No test that cites it has changed since. Change a test that cites ${id}.`;
+  }
+  return `${id}  ${sanitizeTerminal(e.proof)}  ${STATE_LABEL[e.state]}  ${sanitizeTerminal(e.commit ?? "no commit")}`;
+}
+function render(entries, notes, json) {
+  if (json) return JSON.stringify(entries);
+  const lines = entries.length === 0 ? ["No criterion declares a proof other than test."] : entries.map(renderEntry);
+  if (notes.length > 0) lines.push(`The command could not check the judge's results: ${notes.map(sanitizeTerminal).join("; ")}.`);
+  return lines.join("\n");
+}
+function resolveProofsItem(opts) {
+  const env = opts.env ?? process.env;
+  let item;
+  if (opts.item !== void 0) {
+    item = parseTrackerNumber(opts.item);
+    if (item === void 0) throw new WorkCommandError(trackerNumberError("--item", opts.item));
+  } else if (env.OUTERLAYER_WORK !== void 0) {
+    const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
+    if (!("number" in parsed)) throw new WorkCommandError(parsed.reason);
+    item = parsed.number;
+  }
+  if (item === void 0) {
+    throw new WorkCommandError("no work item. Pass --item <number>, or set OUTERLAYER_WORK to the item's number.");
+  }
+  return item;
+}
+async function runWorkProofs(opts) {
+  const item = resolveProofsItem(opts);
+  const creds = resolveCredentials(opts);
+  const { data } = await getJson(creds.url, `/v1/work-items/${item}`, creds.apiKey, creds.appId, opts.fetchImpl ?? defaultFetch);
+  const body = data;
+  const items = body.criteria?.items ?? [];
+  if (items.some((c) => c.proof !== null && c.proof !== "test" && !("newestProof" in c))) {
+    throw new WorkCommandError(
+      "the gateway does not report each criterion's newest proof. Update the gateway, then run this again."
+    );
+  }
+  const checkoutHead = opts.checkoutHead ?? resolveRepoIdentity(opts.cwd ?? process.cwd()).commitSha;
+  if (!checkoutHead) {
+    throw new WorkCommandError("cannot read the checkout's HEAD. Run this inside the git checkout, or pass the head explicitly.");
+  }
+  const declared = classifyProofs(body, checkoutHead);
+  const unproven = await findUnproven({ item: body, cwd: opts.cwd ?? process.cwd(), head: checkoutHead });
+  const entries = [...declared, ...unproven.entries];
+  const json = opts.json === true;
+  const output = render(entries, json ? [] : unproven.notes, json);
+  if (!opts.quiet) {
+    process.stdout.write(output + "\n");
+    if (json && unproven.notes.length > 0) process.stderr.write(`The command could not check the judge's results: ${unproven.notes.join("; ")}.
+`);
+  }
+  const inRunnerBuild = (opts.env ?? process.env).OUTERLAYER_JOB_DIR !== void 0;
+  const declaredCurrent = declared.every((e) => e.state === "current");
+  return { entries, output, exitCode: declaredCurrent && !(inRunnerBuild && unproven.entries.length > 0) ? 0 : 1 };
+}
+async function runWorkProofsCommand(opts) {
+  try {
+    if (opts.record) {
+      const { runWorkProofsRecord } = await import('./work-proofs-record-NUCWR7ZJ.js');
+      const result2 = await runWorkProofsRecord(opts);
+      process.exitCode = result2.exitCode;
+      return;
+    }
+    const result = await runWorkProofs(opts);
+    process.exitCode = result.exitCode;
+  } catch (err) {
+    if (err instanceof WorkCommandError) {
+      process.stderr.write(`${C.red}\u2717${C.reset} ${err.message}
+`);
+      process.exitCode = 2;
+      return;
+    }
+    throw err;
+  }
+}
+
+export { classifyProofs, classifyProofsAt, kindProblem, otherPullRequestHeads, ownPullRequest, proofsCommentBody, proofsCommentId, resolveProofsItem, runWorkProofs, runWorkProofsCommand };

package/dist/{chunk-VVOSUGEF.js → chunk-H47VGSCW.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError, locateRecipe, readRecipe, assertBuildable, runnerLabelValue, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-M3ME6TLQ.js';
+import { RecipeError, locateRecipe, readRecipe, assertBuildable, runnerLabelValue, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-HVQMIZ22.js';
 import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, MEDIA_PINS, PLAYWRIGHT_VERSION } from './chunk-4UPET3R7.js';
-import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-YNMVVQOQ.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-LQHCNXPK.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-PXGU3GKY.js';
-import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-G4W4B33M.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-GJ4KBHBD.js';
+import { PROXY_WARNING_FLAG, withGitConfig, tokenHeader } from './chunk-SDAEXUIX.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 import { mkdirSync, rmSync, writeFileSync, existsSync, mkdtempSync, cpSync, readFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';

package/dist/{chunk-TFPNPS4Q.js → chunk-HOUFCUMH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-7JE2WFNK.js → chunk-HVPW272H.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-EMH2LNIE.js';
-import { RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
-import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-G4W4B33M.js';
+import { DEFAULT_UNIT_NAME } from './chunk-V2VJYK46.js';
+import { RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-SDAEXUIX.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-M3ME6TLQ.js → chunk-HVQMIZ22.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-4UPET3R7.js';
-import { ensureHostKey } from './chunk-MOI2KDLH.js';
-import { compareVersions } from './chunk-GSSVJNP2.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PXGU3GKY.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-G4W4B33M.js';
+import { ensureHostKey } from './chunk-L5VHGRQE.js';
+import { compareVersions } from './chunk-Z7WMU3RA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-GJ4KBHBD.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync, mkdirSync, createWriteStream, rmSync, chmodSync, renameSync } from 'fs';

package/dist/{chunk-7DXVL7TN.js → chunk-IO2BBKG4.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-35JMYSUD.js';
-import { resolveGatewayCredentials } from './chunk-3N77LUQI.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-EUQZAH2W.js';
+import { resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-UONH72CJ.js → chunk-IWVGALDC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-M3ME6TLQ.js';
-import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-PXGU3GKY.js';
+import { parseSize, BUILD_LABEL, RUNNER_LABEL, runnerLabelValue } from './chunk-HVQMIZ22.js';
+import { buildsDir, rootfsDir, runnerDir, imagesDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
 import { spawnSync } from 'child_process';
 import { statfsSync, statSync, existsSync, readdirSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-ZP7GKJSM.js → chunk-JC6AQ6PC.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-7P3H4RY2.js';
-import { checkFit } from './chunk-EMH2LNIE.js';
-import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-3EHDZTRT.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-UONH72CJ.js';
+import { placeholderQueues, placeholderProblem } from './chunk-CNZRUVZ5.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-V2VJYK46.js';
+import { builtinKind, imageBuildOf, keepsHostBuilder } from './chunk-ZIKZZ4LK.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-IWVGALDC.js';
 import { builderDiskPinned } from './chunk-4UPET3R7.js';
-import { FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv, BUILD_SLICE_MEMORY_ENV } from './chunk-G4W4B33M.js';
+import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-SDAEXUIX.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem } from 'os';
@@ -156,5 +156,38 @@ function checkBlockedWithSlots(config, probes) {
   }
   return { slots };
 }
+var GIB = 1024 ** 3;
+function largeBuildMemoryBytes() {
+  return 16 * GIB;
+}
+var LARGE_BUILD_DISK_BYTES = 3e10;
+function checkManagedRoom(input) {
+  const availableBytes = input.sliceBytes ?? Math.max(0, input.totalMemoryBytes - RUNNER_RESERVE_BYTES);
+  if (input.runningMemoryBytes + largeBuildMemoryBytes() > availableBytes) {
+    const where = input.sliceBytes === void 0 ? "the host's memory less the runner's reserve" : "the memory limit of the runner's build slice";
+    return {
+      fits: false,
+      resource: "memory",
+      reason: `one more Large build needs ${gib(largeBuildMemoryBytes())} of memory, and the running builds hold ${gib(input.runningMemoryBytes)} of the ${gib(availableBytes)} in ${where}`
+    };
+  }
+  if (input.freeDiskBytes !== void 0) {
+    const diskBytes = input.freeDiskBytes + input.heldDiskBytes;
+    if (input.runningDiskBytes + LARGE_BUILD_DISK_BYTES > diskBytes) {
+      return {
+        fits: false,
+        resource: "disk",
+        reason: `one more Large build needs a ${gb(LARGE_BUILD_DISK_BYTES)} build disk beside the ${gb(input.runningDiskBytes)} the running builds' disks may grow to, and the runner's file system has ${gb(diskBytes)} free or held by them`
+      };
+    }
+  }
+  return { fits: true };
+}
+function gib(bytes) {
+  return `${(bytes / GIB).toFixed(1)} GiB`;
+}
+function gb(bytes) {
+  return `${(bytes / 1e9).toFixed(1)} GB`;
+}
 
-export { checkBlockedWithSlots, managedFactsOf, managedProblems, realBlockedProbes };
+export { LARGE_BUILD_DISK_BYTES, checkBlockedWithSlots, checkManagedRoom, largeBuildMemoryBytes, managedFactsOf, managedProblems, realBlockedProbes, sliceMemoryOf };

package/dist/{chunk-6JZXIWX7.js → chunk-JKNOJKVD.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-7DXVL7TN.js';
-import { workPageUrl } from './chunk-35JMYSUD.js';
+import { autoConnect } from './chunk-IO2BBKG4.js';
+import { workPageUrl } from './chunk-EUQZAH2W.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-3N77LUQI.js';
-import { signRunnerRequest } from './chunk-MOI2KDLH.js';
+import { resolveGatewayCredentials, unauthorizedMessage, defaultFetch } from './chunk-7QAJQDHS.js';
+import { signRunnerRequest } from './chunk-L5VHGRQE.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
@@ -379,6 +379,21 @@ function tokenWarning(data) {
   return `
 ${C.yellow}!${C.reset} a container host will fail this build: ${why}`;
 }
+var RUNNER_KINDS = ["managed", "self-hosted"];
+function isManagedRefusal(code) {
+  return code === "managed_builds_off" || code === "managed_credential_missing";
+}
+function parseRunnerKind(raw) {
+  if (raw === void 0) return void 0;
+  const kind = RUNNER_KINDS.find((k) => k === raw);
+  if (kind === void 0) throw new WorkCommandError(`--runner takes ${RUNNER_KINDS.join(" or ")}, not "${sanitizeTerminal(raw)}"`);
+  return kind;
+}
+function runnerLabel(data, named) {
+  const kind = data.runner === "managed" || data.runner === "self-hosted" ? data.runner : named;
+  if (kind !== "managed" && named === void 0) return "";
+  return ` ${C.dim}\xB7${C.reset} on a ${kind} runner`;
+}
 function itemLabel(data) {
   return data.number != null ? `item #${data.number}` : `item ${sanitizeTerminal(String(data.workItemId))}`;
 }
@@ -401,6 +416,10 @@ async function runWorkBuild(opts) {
       "--instructions applies to host builds: with --local you build the item yourself, so give your instructions in your own session"
     );
   }
+  const runner = parseRunnerKind(opts.runner);
+  if (opts.local && runner !== void 0) {
+    throw new WorkCommandError("--runner applies to host builds: with --local you build the item yourself, so no runner takes it");
+  }
   await connectIfOneFits(opts);
   const { url, apiKey, appId } = resolveCredentials(opts);
   const fetchImpl = opts.fetchImpl ?? defaultFetch;
@@ -428,15 +447,21 @@ async function runWorkBuild(opts) {
     return { data: data2, output: output2 };
   }
   const instructions = opts.instructions !== void 0 ? { instructions: opts.instructions } : {};
-  const body = itemNumber !== void 0 ? { workItemId: String(itemNumber), note: opts.note, ...instructions, ...facts } : {
+  const body = itemNumber !== void 0 ? { workItemId: String(itemNumber), note: opts.note, ...instructions, runner, ...facts } : {
     subject: resolveWorkSubject({ issue: opts.issue, tracker: opts.tracker, repo: opts.repo, cwd }),
     note: opts.note,
     ...instructions,
+    runner,
     ...facts
   };
-  const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep);
+  const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep).catch((err) => {
+    if (err instanceof WorkCommandError && isManagedRefusal(err.code)) {
+      throw new WorkCommandError(`${err.message} (${err.code})`, false, err.status, err.code);
+    }
+    throw err;
+  });
   const page = itemPageUrl(home, cwd, appId, data.workItemId, data.number);
-  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} build requested ${C.dim}\xB7${C.reset} ${itemLabel(data)}${"subject" in body ? ` (${issueLabel(body.subject)})` : ""} ${C.dim}\xB7${C.reset} by ${data.attestor}` + (page !== void 0 ? `
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} build requested ${C.dim}\xB7${C.reset} ${itemLabel(data)}${"subject" in body ? ` (${issueLabel(body.subject)})` : ""}${runnerLabel(data, runner)} ${C.dim}\xB7${C.reset} by ${data.attestor}` + (page !== void 0 ? `
   ${page}` : "") + tokenWarning(data);
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
@@ -446,7 +471,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-GPUL7T77.js');
+      const { logHookError } = await import('./hook-fast-6EW2MGA2.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-GEQT3RPN.js → chunk-JSZRBQY3.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-6JZXIWX7.js';
+import { resolveCredentials, postJson, getJson } from './chunk-JKNOJKVD.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { defaultFetch } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
+import { defaultFetch } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';

package/dist/{chunk-MOI2KDLH.js → chunk-L5VHGRQE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-SKVA4KWD.js → chunk-LD3BHLK7.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-XTYYF6P7.js';
-import { spoolDir } from './chunk-25GRRBTH.js';
-import { CaptureDaemon } from './chunk-GSSVJNP2.js';
+import { LiveUploader } from './chunk-VUQKGBIQ.js';
+import { spoolDir } from './chunk-NHEU5CON.js';
+import { CaptureDaemon } from './chunk-Z7WMU3RA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-YNMVVQOQ.js → chunk-LQHCNXPK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';