@outerlayer/cli 0.34.0-next.20261027023105 → 0.34.0-next.20261027162612

package/dist/{chunk-7PCA37ZS.js → chunk-ANFNZCXZ.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readNewestDemo } from './chunk-ER6KQCVJ.js';
-import { runEmitArtifact } from './chunk-QWXBWOVV.js';
+import { runEmitArtifact } from './chunk-3RRYEZAC.js';
 import { VoiceDownloadError, downloadPinned, sha256OfFile } from './chunk-2PGI6RDE.js';
-import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-QUOITPN7.js';
+import { VOICE_PACK_FILES, VOICE_PACK_VERSION } from './chunk-WX2HW2G2.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-OKGHWCSK.js';
+import { autoConnect } from './chunk-EYJRVHBN.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { ARTIFACT_MAX_BYTES, ARTIFACT_MAX_CAPTION_LENGTH, DEMO_RECORD_MEDIA_TYPE, ARTIFACT_MAX_REPLACES_TARGETS, DEMO_MANIFEST_LATEST_VERSION, DemoManifestSchema, ARTIFACT_KINDS } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-MN3PP45X.js → chunk-AV5T7HV3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-YL3RWW7X.js';
+import { currentLink } from './chunk-WR2GRWK3.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-DX4FF5P5.js → chunk-BCIBSJZH.js}

@@ -2,35 +2,35 @@
 import { createRequire } from 'node:module';
 import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-6CK2OC4Q.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-P3NPTFLF.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-5ARXP3BP.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-WBTPI5MP.js';
-import { installScrubContext } from './chunk-QRJIBTNQ.js';
-import { writeDockerClientConfig } from './chunk-CFFVCI2I.js';
+import { senderPidfile } from './chunk-QRIE4JZE.js';
+import { installScrubContext } from './chunk-7SJNVGVC.js';
+import { writeDockerClientConfig } from './chunk-GPO7F757.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-LKTH7PUH.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-IYQPUGST.js';
-import { waitForAgent, vmExecArgs } from './chunk-3VZTNXK5.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-6KFJIU73.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-77VBS2RT.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-DEJCZ43H.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-BLSEHKZ4.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-GR7ZVGNI.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-QUOITPN7.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepUnpinnedRuntimes, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-J3Q3QCOF.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-5FHBVV25.js';
+import { waitForAgent, vmExecArgs } from './chunk-JVNQNKHV.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-BS3OYFAD.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-7Q7GQELE.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-JWMJMQRF.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-LYX2RRSF.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-FLHBUQ2W.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-WX2HW2G2.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-QABXXQ67.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6IMQXBTZ.js';
 import { planArtifactUpload } from './chunk-IXPH4EXK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-L5VHGRQE.js';
+import { signerFor } from './chunk-RJZZFAXS.js';
 import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-OVNF4LLC.js';
-import { scrubText } from './chunk-OOD5NDQA.js';
+import { scrubText } from './chunk-A6PJSNP6.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-XFJ7YOPD.js';
 import { CheckItemsSchema } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-GJ4KBHBD.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-SDAEXUIX.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-3VJYDWFV.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-GMKDAF37.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
 import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, lstatSync, realpathSync, fstatSync, readSync } from 'fs';
@@ -217,6 +217,7 @@ function builderMachineFor(config, jobDir, assets, limits) {
     limits: { ...limits, cacheDiskBytes: parseSize(config.build?.cacheDisk ?? DEFAULT_CACHE_DISK) ?? parseSize(DEFAULT_CACHE_DISK) },
     memory: memoryTextOf(config, jobDir, limits),
     allowHosts: withFactoryHosts(config.build?.allowHosts, managedBuildSettingsFor(jobDir)),
+    ...optionalEgress(config),
     managed: config.managed === true,
     timeLimitMinutes: config.timeLimitMinutes
   };
@@ -609,9 +610,10 @@ async function provisionMicroVm(input) {
   } catch (err) {
     return bail(`the build's Maven settings could not be delivered: ${describeCallFailure(err)}`);
   }
-  const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  let execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
   for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
-  const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, execEnv) });
+  const plainEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv, proxyWarning: false });
+  const request = (argv, workdir, plain = false) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, plain ? plainEnv : execEnv) });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
@@ -620,7 +622,7 @@ async function provisionMicroVm(input) {
     agentVersion,
     lifecycle: report.apply.lifecycle,
     exec: async (argv, workdir, opts) => {
-      const ran = await vm.exec(state.vsockPath, request(argv, workdir));
+      const ran = await vm.exec(state.vsockPath, request(argv, workdir, opts?.withoutProxyWarning === true));
       if (opts?.quiet !== true) appendFileSync(logPath, ran.stdout + ran.stderr);
       return ran;
     },
@@ -650,10 +652,16 @@ async function provisionMicroVm(input) {
     },
     removeStagedContext: () => removeStagedContext(buildDir2),
     keepIn: jobDir,
-    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {}
+    ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
+    // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
+    ...runtimeStepInput(report, services, () => {
+      state.proxyWarningDropped = true;
+      execEnv = plainEnv;
+    })
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
+  keepUnpinnedRuntimes(state, steps);
   if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
@@ -698,9 +706,11 @@ function vmExecFor(input, argv) {
     repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
+    unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
     imageEnv: state.imageEnv,
+    proxyWarning: state.proxyWarningDropped !== true,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
   });
   const options = {
@@ -728,9 +738,11 @@ async function startMicroVmCommand(input) {
     repositories: input.job.repositories,
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
+    unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
     imageEnv: state.imageEnv,
+    proxyWarning: state.proxyWarningDropped !== true,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
   });
   const started = await input.runtime.vm.exec(state.vsockPath, {
@@ -771,9 +783,11 @@ async function syncInMicroVm(input) {
       repositories: job.repositories,
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
+      unpinnedRuntimes: state.unpinnedRuntimes,
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,
       imageEnv: state.imageEnv,
+      proxyWarning: state.proxyWarningDropped !== true,
       factoryVariables: factoryVariablesOf(input.config, input.jobDir)
     });
     const result = await runtime.vm.exec(state.vsockPath, {
@@ -2297,6 +2311,7 @@ function scrubTunnelRecord(record, config) {
     refusalsMore: record.refusalsMore,
     refusals: record.refusals.map((r) => ({ ...r, host: scrubText(r.host) })),
     destinations: (record.destinations ?? []).map((name) => scrubText(name)),
+    ...record.egress === void 0 ? {} : { egress: record.egress },
     ...record.routes === void 0 ? {} : { routes: Object.fromEntries(Object.entries(record.routes).map(([name, counts]) => [scrubText(name), counts])) }
   };
 }
@@ -2909,15 +2924,19 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     );
   } else if (release.ok) {
     log.line(
-      outcome === void 0 ? `${tag} released \xB7 not attempted (provision exit 75) \xB7 ${total}` : `${tag} released \xB7 outcome ${outcome} \xB7 ${total}`
+      outcome === void 0 ? `${tag} released \xB7 not attempted (provision exit 75) \xB7 ${total}` : `${tag} released \xB7 outcome ${outcome} \xB7 ${total}${egressText(tunnelRecord)}`
     );
   } else {
     log.error(
-      `${tag} release failed after ${release.attempts} attempt(s): ${release.reason}; the lease expires at ${formatClock(leaseExpiry(job, endedAt), endedAt)}`
+      `${tag} release failed after ${release.attempts} attempt(s): ${release.reason}; the lease expires at ${formatClock(leaseExpiry(job, endedAt), endedAt)}${egressText(tunnelRecord)}`
     );
   }
   return job;
 }
+function egressText(record) {
+  if (record === void 0) return "";
+  return record.egress === void 0 ? " \xB7 tunnel counts not recorded" : ` \xB7 ${egressSummary(record.egress)}`;
+}
 function readLogState(logPath) {
   try {
     const stats = statSync(logPath);

package/dist/{chunk-6KFJIU73.js → chunk-BS3OYFAD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-GMKDAF37.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-TS3EFB7S.js → chunk-BS4CZMT6.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-SDELQEG4.js → chunk-CFJOONWM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-GJ4KBHBD.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-3VJYDWFV.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-UWDFA6WW.js → chunk-CKVJSOY3.js}

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-JL4GSPGD.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-KVGK2JL3.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
-import { writePendingUpdate } from './chunk-HOUFCUMH.js';
-import { renderUpdateSteps } from './chunk-WPDL7MBC.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-TS3EFB7S.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-DX4FF5P5.js';
+import { writePendingUpdate } from './chunk-UZIAZXXO.js';
+import { renderUpdateSteps } from './chunk-MGF346ND.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-BS4CZMT6.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-BCIBSJZH.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-ZK3A4W3I.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-YL3RWW7X.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf } from './chunk-QWSAZGH6.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-WR2GRWK3.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-LKTH7PUH.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-77VBS2RT.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-SDELQEG4.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, setUpRunnerCgroup, sweepImageBuilders, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-J3Q3QCOF.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-7Q7GQELE.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-CFJOONWM.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-DEJCZ43H.js';
-import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-BLSEHKZ4.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-GR7ZVGNI.js';
-import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-LQHCNXPK.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWMJMQRF.js';
+import { freeBytes, formatBytes, allocatedBytes, volumeBytes } from './chunk-LYX2RRSF.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, RUNNER_LABEL, BUILD_LABEL, readJobFileChecked } from './chunk-FLHBUQ2W.js';
+import { claimPidFile, writePidFile, readPidFile, releasePidFile } from './chunk-3FTIUB7I.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-QABXXQ67.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-L5VHGRQE.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6IMQXBTZ.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-RJZZFAXS.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-GJ4KBHBD.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-SDAEXUIX.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-3VJYDWFV.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-GMKDAF37.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, closeSync, rmSync, lstatSync } from 'fs';
@@ -1961,7 +1961,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-VR7PPSP6.js');
+  const { postJson: postJson2 } = await import('./work-cmd-LUKJHAMH.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -3279,7 +3279,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-YIUZ3UX3.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-QGM2SECF.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-GTBY7BTI.js → chunk-CMMEJJTL.js}

@@ -1,11 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL_REVISION, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, HEADLESS_SHELL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_VERSION } from './chunk-QUOITPN7.js';
-import { PROXY_WARNING_FLAG } from './chunk-SDAEXUIX.js';
+import { GH_VERSION, VOICE_PACK_FILES, VOICE_PACK_VERSION, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL_REVISION, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG_BASE_URL, PLAYWRIGHT_FFMPEG_REVISION, HEADLESS_SHELL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_VERSION } from './chunk-WX2HW2G2.js';
+import { PROXY_WARNING_FLAG } from './chunk-GMKDAF37.js';
 import { RELAY_ID, RELAY_USER } from './chunk-MESOOLF4.js';
 
 createRequire(import.meta.url);
 
+// src/runner/image/claude-wrapper.ts
+function claudeWrapperScript(opts) {
+  const path = opts.universal ? 'PATH="$PATH:/opt/outerlayer/bin"' : "PATH=/opt/outerlayer/bin:$PATH";
+  return ["#!/bin/sh", path, "export PATH", 'exec /opt/outerlayer/claude/bin/claude "$@"', ""].join("\n");
+}
+
 // src/runner/image/dockerfiles.ts
 var FETCHED_DIR = "fetched";
 var FETCHED_VOICE_DIR = "voice";
@@ -30,37 +36,6 @@ function plain(name, value, allowed) {
   if (!allowed.test(value)) throw new Error(`${name} holds a character a Dockerfile line cannot carry safely: ${JSON.stringify(value)}`);
   return value;
 }
-var DEFAULT_PACKAGES = ["git", "ca-certificates", "curl", "build-essential", "python3", "python3-pip", "python3-venv", "unzip", "jq"];
-function defaultDockerfile(baseImage, nodeImage) {
-  return [
-    ubuntuWithNode(baseImage, nodeImage, DEFAULT_PACKAGES),
-    // The browsers live in one shared folder so any user finds them. A build container's root filesystem is
-    // read-only, so the build user cannot add to this folder: a repository that needs another Playwright version
-    // installs that version's Chromium into a writable folder by setting PLAYWRIGHT_BROWSERS_PATH.
-    // `install --with-deps` runs apt-get as root and works on amd64 and arm64.
-    "ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright",
-    "RUN mkdir -p /ms-playwright \\",
-    ` && npx -y playwright@${plain("the Playwright version", PLAYWRIGHT_VERSION, /^[0-9.]+$/)} install --with-deps chromium \\`,
-    " && chmod -R a+rX /ms-playwright \\",
-    " && rm -rf /var/lib/apt/lists/* /root/.npm",
-    ""
-  ].join("\n");
-}
-function ubuntuWithNode(baseImage, nodeImage, packages) {
-  return [
-    `FROM ${baseImage}`,
-    "ENV DEBIAN_FRONTEND=noninteractive",
-    "RUN apt-get update \\",
-    ` && apt-get install -y --no-install-recommends ${packages.join(" ")} \\`,
-    " && rm -rf /var/lib/apt/lists/*",
-    `COPY --from=${nodeImage} /usr/local/bin/node /usr/local/bin/node`,
-    `COPY --from=${nodeImage} /usr/local/lib/node_modules /usr/local/lib/node_modules`,
-    "RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \\",
-    " && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \\",
-    " && ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack",
-    ""
-  ].join("\n");
-}
 function toolsDockerfile(parts) {
   const recipeImage = plain("the recipe image", parts.recipeImage, /^[A-Za-z0-9_.:@/-]+$/);
   const nodeImage = plain("the Node image", parts.nodeImage, /^[A-Za-z0-9_.:@/-]+$/);
@@ -131,7 +106,7 @@ function toolsDockerfile(parts) {
     "RUN mkdir -p /out/opt/outerlayer/bin /out/usr/local/bin /out/etc/claude-code /out/build \\",
     " && cp /usr/local/bin/node /out/opt/outerlayer/bin/node \\",
     ` && printf '%s\\n' '#!/bin/sh' 'exec /opt/outerlayer/bin/node /opt/outerlayer/cli/dist/index.js "$@"' > /out/usr/local/bin/outerlayer \\`,
-    ` && printf '%s\\n' '#!/bin/sh' 'PATH=/opt/outerlayer/bin:$PATH' 'export PATH' 'exec /opt/outerlayer/claude/bin/claude "$@"' > /out/usr/local/bin/claude \\`,
+    ` && printf '%s\\n' ${claudeWrapperScript({ universal: parts.universal === true }).trimEnd().split("\n").map((line) => `'${line}'`).join(" ")} > /out/usr/local/bin/claude \\`,
     ` && printf '%s\\n' '${tools}' > /out/opt/outerlayer/tools.json \\`,
     ` && printf '%s\\n' '${managedSettings}' > /out/etc/claude-code/managed-settings.json \\`,
     " && chmod 0755 /out/usr/local/bin/outerlayer /out/usr/local/bin/claude \\",
@@ -298,4 +273,4 @@ function browserStage(parts) {
   ];
 }
 
-export { FETCHED_DIR, FETCHED_FFMPEG, FETCHED_GH, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_TINI, FETCHED_VOICE_DIR, IMAGE_BROWSER, defaultDockerfile, toolsDockerfile };
+export { FETCHED_DIR, FETCHED_FFMPEG, FETCHED_GH, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_TINI, FETCHED_VOICE_DIR, IMAGE_BROWSER, toolsDockerfile };

package/dist/{chunk-OKGHWCSK.js → chunk-EYJRVHBN.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-O7QPHJWN.js';
-import { resolveGatewayCredentials } from './chunk-7QAJQDHS.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-NO6E72RM.js';
+import { resolveGatewayCredentials } from './chunk-62URQYCB.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-GR7ZVGNI.js → chunk-FLHBUQ2W.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveDevcontainerCli, devcontainerBuildInvocation, RecipeError } from './chunk-HDLON3RJ.js';
-import { BUILDKIT_IMAGE } from './chunk-QUOITPN7.js';
-import { ensureHostKey } from './chunk-L5VHGRQE.js';
-import { compareVersions } from './chunk-OOD5NDQA.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-GJ4KBHBD.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-SDAEXUIX.js';
+import { resolveDevcontainerCli, devcontainerBuildInvocation, universalImagePending, RecipeError } from './chunk-X7M73LKT.js';
+import { universalImagePinned, UNIVERSAL_IMAGE, BUILDKIT_IMAGE } from './chunk-WX2HW2G2.js';
+import { ensureHostKey } from './chunk-RJZZFAXS.js';
+import { compareVersions } from './chunk-A6PJSNP6.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-3VJYDWFV.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-GMKDAF37.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
 import { mkdirSync, createWriteStream, rmSync, existsSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';
@@ -207,6 +207,7 @@ function createDockerHost(deps = {}) {
     },
     async buildDockerfile(req) {
       const builder = builderFor();
+      if (!universalImagePinned() && req.dockerfile.includes(UNIVERSAL_IMAGE)) throw universalImagePending();
       if (req.layoutOut !== void 0) {
         rmSync(req.layoutOut, { recursive: true, force: true });
       }

package/dist/{chunk-72CJOYN6.js → chunk-FVVHQIZR.js}

@@ -5,7 +5,7 @@ import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME
 import { installStarterPack } from './chunk-J7EJMIDR.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-LYCJQOO2.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-66LH5QAV.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-36M4KVBT.js';
 import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-OVNF4LLC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { linkedAgentsPath } from './chunk-UPA5KOOX.js';

package/dist/{chunk-SDAEXUIX.js → chunk-GMKDAF37.js}

@@ -618,6 +618,7 @@ async function startBuildServices(input) {
     ...streamed ? { socket: false } : {},
     ...streamed ? {} : listenOnFor("tunnel.sock"),
     ...input.allowHosts === void 0 ? {} : { allowHosts: input.allowHosts },
+    ...input.egress === void 0 ? {} : { egress: input.egress },
     recordPath: join(input.jobDir, "tunnel.json")
   });
   const servers = [];
@@ -886,7 +887,19 @@ function withProxyWarningHidden(options) {
   if (given.split(/\s+/).includes(PROXY_WARNING_FLAG)) return given;
   return given === "" ? PROXY_WARNING_FLAG : `${given} ${PROXY_WARNING_FLAG}`;
 }
-function runnerLiterals(repository, repositories = []) {
+function withoutProxyWarningFlag(options) {
+  return options.split(/\s+/).filter((option) => option !== "" && option !== PROXY_WARNING_FLAG).join(" ");
+}
+function nodeAcceptsProxyWarningFlag(version) {
+  const match = /^v?(\d+)\.(\d+)/.exec(version.trim());
+  if (match === null) return true;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  if (major === 20) return minor >= 11;
+  if (major === 21) return minor >= 3;
+  return major >= 22;
+}
+function runnerLiterals(repository, repositories = [], unpinnedRuntimes) {
   return {
     OUTERLAYER_JOB_DIR: JOB_MOUNT,
     HOME: BUILD_HOME,
@@ -901,7 +914,9 @@ function runnerLiterals(repository, repositories = []) {
       OUTERLAYER_REPOSITORIES: JSON.stringify(
         repositories.map((entry) => ({ repository: entry.repository, path: checkoutPath(entry), branch: entry.branch, primary: entry.primary }))
       )
-    }
+    },
+    // What the build's command reads to find the runtimes each repository uses but does not pin, on the universal image.
+    ...unpinnedRuntimes === void 0 ? {} : { OUTERLAYER_UNPINNED_RUNTIMES: JSON.stringify(unpinnedRuntimes) }
   };
 }
 function containerBuiltInAddress(name) {
@@ -961,8 +976,13 @@ function buildEnvironment(input) {
   }
   const nodeOptions = {};
   if (input.imageEnv !== void 0) {
-    if (passed.NODE_OPTIONS !== void 0) passed.NODE_OPTIONS = withProxyWarningHidden(passed.NODE_OPTIONS);
-    else nodeOptions.NODE_OPTIONS = withProxyWarningHidden(recipe.NODE_OPTIONS ?? input.imageEnv.NODE_OPTIONS);
+    const hide = input.proxyWarning !== false;
+    const apply = (value) => hide ? withProxyWarningHidden(value) : value === void 0 ? void 0 : withoutProxyWarningFlag(value);
+    if (passed.NODE_OPTIONS !== void 0) passed.NODE_OPTIONS = apply(passed.NODE_OPTIONS);
+    else {
+      const value = apply(recipe.NODE_OPTIONS ?? input.imageEnv.NODE_OPTIONS);
+      if (value !== void 0) nodeOptions.NODE_OPTIONS = value;
+    }
   }
   const mavenLiterals = {};
   const notices = [];
@@ -992,7 +1012,7 @@ function buildEnvironment(input) {
       ...nodeOptions,
       ...mavenLiterals,
       ...destinations,
-      ...runnerLiterals(input.repository, repositoriesOf({ repositories: input.repositories, repository: input.repository, branch: input.branch })),
+      ...runnerLiterals(input.repository, repositoriesOf({ repositories: input.repositories, repository: input.repository, branch: input.branch }), input.unpinnedRuntimes),
       ...builtInLiterals,
       ...authored,
       ...hooks
@@ -1065,4 +1085,4 @@ function routesOf(counts) {
   return routes.length === 0 ? {} : { routes };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, SCRUB_ENV_VARIABLE, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILD_SLICE_MEMORY_ENV, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FD_SLOTS_PER_BUILD, FD_STORE_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, MIN_SYSTEMD, PROXY_WARNING_FLAG, RELAY_PORT, SCRUB_ENV_VARIABLE, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, fdName, headerVariables, heldClaudeCredential, inspectService, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, managedClaudeCredential, mavenArgs, mavenSettingsXml, namesGlobalSettings, nodeAcceptsProxyWarningFlag, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseRunnerEnv, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, realFdStorePort, realInspectProbes, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };

package/dist/{chunk-CFFVCI2I.js → chunk-GPO7F757.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-SDAEXUIX.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-GMKDAF37.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-EBVK3QBO.js → chunk-HJCNWEQK.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-QABXXQ67.js';
+import { resolveCredentials, postJson, getJson } from './chunk-6IMQXBTZ.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { defaultFetch } from './chunk-7QAJQDHS.js';
-import { resolveRepoIdentity } from './chunk-OOD5NDQA.js';
+import { defaultFetch } from './chunk-62URQYCB.js';
+import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';