@outerlayer/cli 0.34.0-next.20261026145838 → 0.34.0-next.20261026182624

package/dist/{chunk-PWSUNS6Y.js → chunk-LTN2YFLR.js}

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-CY5TCVBS.js';
-import { writePendingUpdate } from './chunk-TFPNPS4Q.js';
-import { renderUpdateSteps } from './chunk-KRTD2F3I.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-AE3OTPUU.js';
-import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-FDJPDZSR.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-ERTIEYDG.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
-import { RUNNER_PROTOCOL } from './chunk-PAK5P2ND.js';
-import { realBlockedProbes, checkBlockedWithSlots } from './chunk-ZP7GKJSM.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-UMYYYF7B.js';
+import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
+import { writePendingUpdate } from './chunk-HOUFCUMH.js';
+import { renderUpdateSteps } from './chunk-P3CHDKXD.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-TS3EFB7S.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-SZU4YCBH.js';
+import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-JC6AQ6PC.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-YL3RWW7X.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-7P3H4RY2.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-PP6OX4OT.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SYVRBBLW.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-CNZRUVZ5.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-EPFFYDNX.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SDELQEG4.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-3EHDZTRT.js';
-import { freeBytes, formatBytes, volumeBytes } from './chunk-UONH72CJ.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-M3ME6TLQ.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-YNMVVQOQ.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-ZIKZZ4LK.js';
+import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-IWVGALDC.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-HVQMIZ22.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-LQHCNXPK.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6JZXIWX7.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-MOI2KDLH.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-JKNOJKVD.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-L5VHGRQE.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-PXGU3GKY.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-G4W4B33M.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-SDAEXUIX.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
@@ -1289,12 +1289,12 @@ async function sendTickHeartbeat(state, workRequest) {
           workRequest: next,
           lastUpdate: readLastUpdate(state.config.configPath),
           lowDisk: state.lowDisk,
-          blocked: state.blocked,
+          blocked: state.blocked ?? state.noRoomEmpty,
           state: hostState({
             draining: state.draining === true,
             restarting: state.restarting === true,
             holdingForUpdate: state.holdingForUpdate === true,
-            blocked: state.blocked !== void 0,
+            blocked: (state.blocked ?? state.noRoomEmpty) !== void 0,
             lowDisk: state.lowDisk !== void 0
           }),
           // Left out unless a draining runner has builds to wait on, so the gateway stores null.
@@ -1481,6 +1481,44 @@ function clearUpdateWait(state) {
   state.waitsLogged = void 0;
   recordPendingUpdate(state, void 0);
 }
+function holdWithoutRoomForLarge(state) {
+  if (state.config.managed !== true) return false;
+  const probes = {
+    ...realBlockedProbes(),
+    ...state.deps.container?.hostEnv === void 0 ? {} : { env: state.deps.container.hostEnv },
+    ...state.deps.blocked
+  };
+  let runningMemoryBytes = 0;
+  let runningDiskBytes = 0;
+  let heldDiskBytes = 0;
+  for (const active of state.jobs.values()) {
+    const microvm = active.job?.microvm;
+    runningMemoryBytes += microvm?.limits?.memoryBytes ?? largeBuildMemoryBytes();
+    runningDiskBytes += microvm?.limits?.diskBytes ?? LARGE_BUILD_DISK_BYTES;
+    if (microvm?.buildDisk !== void 0) heldDiskBytes += (state.deps.allocatedBytes ?? allocatedBytes)(microvm.buildDisk);
+  }
+  const room = checkManagedRoom({
+    runningMemoryBytes,
+    totalMemoryBytes: probes.totalMemoryBytes(),
+    sliceBytes: sliceMemoryOf(probes.env),
+    freeDiskBytes: (state.deps.freeBytes ?? freeBytes)(runnerDir(state.config.configPath)),
+    heldDiskBytes,
+    runningDiskBytes
+  });
+  const log = logOf(state);
+  if (!room.fits) {
+    if (state.noRoom !== room.resource) log.line(`holding off new work: ${room.reason} \xB7 claiming again once a build ends`);
+    state.noRoom = room.resource;
+    state.noRoomEmpty = state.jobs.size === 0 ? { reason: `no room for one Large build: ${room.reason}` } : void 0;
+    return true;
+  }
+  state.noRoomEmpty = void 0;
+  if (state.noRoom !== void 0) {
+    state.noRoom = void 0;
+    log.line("a Large build fits again \xB7 taking work");
+  }
+  return false;
+}
 function recordPendingUpdate(state, record) {
   const text = record === void 0 ? "none" : JSON.stringify(record);
   if (state.updateRecord === text) return;
@@ -1863,6 +1901,7 @@ async function runTick(state) {
   const jailer = state.config.managed === true && state.deps.blocked?.jailer === void 0 ? await jailerState(state) : void 0;
   if (holdWhenBlocked(state, jailer)) return;
   if (holdOffForDisk(state)) return;
+  if (holdWithoutRoomForLarge(state)) return;
   const log = logOf(state);
   const repoFilter = new RepoFilter(state.config.repos);
   let filtered = 0;
@@ -1892,6 +1931,7 @@ async function runTick(state) {
             filtered++;
             continue;
           }
+          if (holdWithoutRoomForLarge(state)) return;
           const attempt = await tryClaimAndStart(state, item, queue);
           if (attempt.kind === "started") {
             claimed = true;
@@ -1921,7 +1961,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-KVFRK24I.js');
+  const { postJson: postJson2 } = await import('./work-cmd-V5FHLWJM.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2145,10 +2185,18 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       const fetched = await fetchManagedClaudeKey(state.config, item.number, { fetchImpl: state.deps.fetchImpl, now: state.deps.now, sleep: state.deps.sleep });
       if (active.ending) return;
       if (!fetched.ok) {
-        await endOnManagedKeyRefusal(state, active, fetched);
+        await endOnManagedRefusal(state, active, fetched, { what: "Anthropic key", was: "was" });
         return;
       }
       holdManagedClaudeKey(dirPath, fetched.apiKey);
+      const settings = await fetchManagedBuildSettings(state.config, item.number, { fetchImpl: state.deps.fetchImpl, now: state.deps.now, sleep: state.deps.sleep });
+      if (active.ending) return;
+      if (!settings.ok) {
+        await endOnManagedRefusal(state, active, settings, { what: "settings", was: "were" });
+        return;
+      }
+      holdManagedBuildSettings(dirPath, settings.settings);
+      active.job.managedVariables = settings.settings.variables.map(({ name }) => name);
     }
   }
   if (state.config.hooks.report) {
@@ -2476,9 +2524,9 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
         job.microvm.commandDir = MICROVM_COMMAND_DIR;
         job.microvm.commandLogBase = commandLogOffset(dirPath, 0);
         writeJobFile(jobFilePath, job);
-        await startMicroVmCommand({ job, cmdline, runtime, config: state.config });
+        await startMicroVmCommand({ job, jobDir: dirPath, cmdline, runtime, config: state.config });
       } else {
-        const composed = microVmCommandLine({ job, cmdline, runtime, config: state.config, cli: join(runtime.cliBuild().distDir, "index.js") });
+        const composed = microVmCommandLine({ job, jobDir: dirPath, cmdline, runtime, config: state.config, cli: join(runtime.cliBuild().distDir, "index.js") });
         running = runCommand(composed.line, { ...composed.env, OUTERLAYER_JOB_DIR: dirPath }, dirPath, join(dirPath, "command.log"), state.deps.spawnFn);
       }
     } else if (job.container !== void 0) {
@@ -2562,18 +2610,18 @@ function buildTokensFor(state, active, item) {
     }
   });
 }
-async function endOnManagedKeyRefusal(state, active, refused) {
+async function endOnManagedRefusal(state, active, refused, subject) {
   const log = logOf(state);
   const tag = `#${active.job.item}`;
   const code = refused.code ?? "unavailable";
   if (refused.code === "claim_expired" || refused.code === "claim_not_held") {
-    log.error(`${tag} the build's Anthropic key was refused: ${code} \xB7 ending job as lease_lost`);
+    log.error(`${tag} the build's ${subject.what} ${subject.was} refused: ${code} \xB7 ending job as lease_lost`);
     await endJob(state, active, "lease_lost");
   } else if (refused.retryable || refused.code === "managed_credential_missing" || refused.code === "managed_builds_off") {
-    log.error(`${tag} the build's Anthropic key could not be had (${code}) \xB7 releasing the claim to try again`);
+    log.error(`${tag} the build's ${subject.what} could not be had (${code}) \xB7 releasing the claim to try again`);
     await endJob(state, active, void 0);
   } else {
-    log.error(`${tag} the build's Anthropic key was refused: ${code} \xB7 ending job as failed`);
+    log.error(`${tag} the build's ${subject.what} ${subject.was} refused: ${code} \xB7 ending job as failed`);
     await endJob(state, active, "failed", { stage: "provision", reason: code });
   }
 }
@@ -3022,6 +3070,21 @@ async function rejoinMicroVmBuild(state, adopted) {
       return { reason: `the adopted build's Anthropic key could not be had after the runner restarted: ${cause}`, why: "the gateway did not give its Anthropic key again" };
     }
     holdManagedClaudeKey(dirPath, fetched.apiKey);
+    const settings = await fetchManagedBuildSettings(config, job.item, {
+      fetchImpl: state.deps.fetchImpl,
+      now: state.deps.now,
+      sleep: state.deps.sleep,
+      windowMs: ADOPTED_FETCH_RETRY_WINDOW_MS
+    });
+    if (!settings.ok) {
+      const code = settings.code ?? "unavailable";
+      log.error(`${tag} the adopted build's settings could not be had: ${code}`);
+      const cause = settings.retryable ? "the gateway could not be reached for them" : `the gateway refused them (${code})`;
+      return { reason: `the adopted build's settings could not be had after the runner restarted: ${cause}`, why: "the gateway did not give its settings again" };
+    }
+    holdManagedBuildSettings(dirPath, settings.settings);
+    job.managedVariables = [.../* @__PURE__ */ new Set([...job.managedVariables ?? [], ...settings.settings.variables.map(({ name }) => name)])];
+    writeJobFile(join(dirPath, "job.json"), job);
   }
   const tokens = buildTokensFor(state, adopted, job.item);
   runtime.credentials.set(dirPath, tokens);
@@ -3099,6 +3162,11 @@ async function removeUnadoptedSockets(state, adopted) {
 }
 async function finishMicroVmWhileAway(state, dirPath, job, reason, why) {
   const log = logOf(state);
+  if ((job.managedVariables?.length ?? 0) > 0 && managedBuildSettingsFor(dirPath) === void 0) {
+    const settings = await fetchManagedBuildSettings(state.config, job.item, { fetchImpl: state.deps.fetchImpl, now: state.deps.now, sleep: state.deps.sleep });
+    if (settings.ok) holdManagedBuildSettings(dirPath, settings.settings);
+    else log.error(`#${job.item} the build's settings could not be had again: ${settings.code ?? "unavailable"}`);
+  }
   const recorded = outcomeFromExitCode(dirPath);
   let outcome = "interrupted";
   let ending = { reason };
@@ -3211,7 +3279,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-4W4QUBMP.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-G2K76NEM.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-YHKU2NOZ.js → chunk-LTYBHCL4.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { sanitizeTerminal } from './chunk-MECW77XP.js';
 import { isAgentsMdLayout } from './chunk-NKOM4JKY.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-3N77LUQI.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-7QAJQDHS.js';
 import { versionAtLeast } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { machineSkillsState, staleClaudeSkills } from './chunk-RCRE42V6.js';

package/dist/{chunk-PAK5P2ND.js → chunk-MH6QLXUO.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 32;
+var RUNNER_PROTOCOL = 33;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-OS7DJOQJ.js → chunk-MN3PP45X.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-UMYYYF7B.js';
+import { currentLink } from './chunk-YL3RWW7X.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-25GRRBTH.js → chunk-NHEU5CON.js}

@@ -684,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-XBGHM7DB.js');
+  const { governanceOf } = await import('./control-plane-launch-74EIIB5Z.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-IM6IL3F4.js → chunk-OQT7RT5I.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-7DXVL7TN.js';
+import { autoConnect } from './chunk-IO2BBKG4.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-3N77LUQI.js';
-import { resolveRepoIdentity } from './chunk-GSSVJNP2.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { resolveRepoIdentity } from './chunk-Z7WMU3RA.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-KRTD2F3I.js → chunk-P3CHDKXD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-AE3OTPUU.js';
-import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SYVRBBLW.js';
+import { stripTerminalControls } from './chunk-SZU4YCBH.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-SDELQEG4.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-GA63DVME.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-KZ3OQTPW.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-63IVRRIO.js → chunk-P3NPTFLF.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-SI6WDF3U.js';
-import { EXEC_PORT } from './chunk-OGPEHSNW.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-CFFVCI2I.js';
+import { EXEC_PORT } from './chunk-6KFJIU73.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-G4W4B33M.js';
+import { RELAY_PORT } from './chunk-SDAEXUIX.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-GC5PVMIJ.js → chunk-RR3VDM7M.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-OS7DJOQJ.js';
-import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-UMYYYF7B.js';
+import { launcherPath, pathNotes, writeLauncher, LauncherWriteError } from './chunk-MN3PP45X.js';
+import { currentVersion, currentLink, versionDir, execStartLine, isInLayout, packageRootIn, switchCurrent } from './chunk-YL3RWW7X.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { runnerDir, RUNNER_DIR_MODE } from './chunk-PXGU3GKY.js';
+import { runnerDir, RUNNER_DIR_MODE } from './chunk-GJ4KBHBD.js';
 import { lchownSync, lstatSync, realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync, readdirSync } from 'fs';
 import { dirname, sep, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-G4W4B33M.js → chunk-SDAEXUIX.js}

@@ -776,6 +776,9 @@ function repositoriesOf(input) {
 function primaryOf(repositories) {
   return repositories.find((entry) => entry.primary) ?? repositories[0];
 }
+
+// src/scrub-env.ts
+var SCRUB_ENV_VARIABLE = "OUTERLAYER_SCRUB_ENV";
 var MAVEN_DIR = "maven";
 var MAVEN_SETTINGS_FILE = "settings.xml";
 var MAVEN_NO_PROXY_NOTE = "MAVEN_ARGS names its own global settings file, so the build's Maven gets no proxy from the runner";
@@ -918,6 +921,7 @@ function isReservedVariable(name) {
 function isRefusedInConfig(name) {
   return isReservedVariable(name) && !githubVariables().has(name);
 }
+var NO_VARIABLES = [];
 function buildEnvironment(input) {
   const authored = authorEnvironment(input.identity?.author);
   const recipe = {};
@@ -934,16 +938,26 @@ function buildEnvironment(input) {
   };
   const variables = [];
   const skippedTokenVariables = [];
-  for (const name of input.config.build?.variables ?? []) {
-    if (tokenVariables().includes(name)) {
-      skippedTokenVariables.push(name);
-      continue;
+  if (input.factoryVariables !== void 0) {
+    for (const { name, value } of input.factoryVariables) {
+      if (isReservedVariable(name) || name in authored) continue;
+      if (builtIns && CLAUDE_CREDENTIAL_VARIABLES.includes(name)) continue;
+      passed[name] = value;
+      variables.push(name);
+    }
+    if (variables.length > 0) passed[SCRUB_ENV_VARIABLE] = variables.join(",");
+  } else {
+    for (const name of input.config.build?.variables ?? NO_VARIABLES) {
+      if (tokenVariables().includes(name)) {
+        skippedTokenVariables.push(name);
+        continue;
+      }
+      const value = input.hostEnv[name];
+      if (value === void 0 || isReservedVariable(name) || name in authored) continue;
+      if (builtIns && CLAUDE_CREDENTIAL_VARIABLES.includes(name)) continue;
+      passed[name] = value;
+      variables.push(name);
     }
-    const value = input.hostEnv[name];
-    if (value === void 0 || isReservedVariable(name) || name in authored) continue;
-    if (builtIns && CLAUDE_CREDENTIAL_VARIABLES.includes(name)) continue;
-    passed[name] = value;
-    variables.push(name);
   }
   const nodeOptions = {};
   if (input.imageEnv !== void 0) {
@@ -999,6 +1013,7 @@ function checkEnvironment(input) {
     containerEnv: input.containerEnv,
     builtIns: false,
     imageEnv: input.imageEnv,
+    factoryVariables: input.factoryVariables,
     // A check container is given no settings file, so a `MAVEN_ARGS` naming one would break the check's Maven.
     mavenProxy: false
   });
@@ -1050,4 +1065,4 @@ function routesOf(counts) {
   return routes.length === 0 ? {} : { routes };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, SCRUB_ENV_VARIABLE, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };

package/dist/{chunk-SYVRBBLW.js → chunk-SDELQEG4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PXGU3GKY.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';