@outerlayer/cli 0.34.0-next.20261027190442 → 0.34.0-next.20261028002917

package/dist/{chunk-Y7MF32DM.js → chunk-PBI4CM4M.js}

@@ -2,26 +2,26 @@
 import { createRequire } from 'node:module';
 import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-6CK2OC4Q.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-5ARXP3BP.js';
+import { HELPER_PATH, DOCKERD_LOG, HELPER_RECORD } from './chunk-UEDRRWZ3.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-QRIE4JZE.js';
-import { installScrubContext } from './chunk-7SJNVGVC.js';
-import { writeDockerClientConfig } from './chunk-GPO7F757.js';
+import { senderPidfile } from './chunk-JXY66VYX.js';
+import { installScrubContext } from './chunk-32FAPJFD.js';
+import { writeDockerClientConfig } from './chunk-QJ2SNBHL.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepUnpinnedRuntimes, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-LSFP57LI.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-5FHBVV25.js';
-import { waitForAgent, vmExecArgs } from './chunk-JVNQNKHV.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-BS3OYFAD.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-7Q7GQELE.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-JWMJMQRF.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-LYX2RRSF.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-FLHBUQ2W.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-WX2HW2G2.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepUnpinnedRuntimes, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-VB4QD4WN.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-BQ4C47K2.js';
+import { waitForAgent, vmExecArgs } from './chunk-PHIQHIRJ.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-G4SOMWXL.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-PPQTTJSW.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-GXMMILQ4.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-EGJY6MBC.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-AHWMY3MS.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-D3CT6XQ4.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6IMQXBTZ.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-GJYGOFF3.js';
 import { planArtifactUpload } from './chunk-IXPH4EXK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-RJZZFAXS.js';
+import { signerFor } from './chunk-VKYU4HHW.js';
 import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-OVNF4LLC.js';
 import { scrubText } from './chunk-A6PJSNP6.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
@@ -29,8 +29,8 @@ import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-XFJ7YOPD.js';
 import { CheckItemsSchema } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-3VJYDWFV.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, buildMavenSettingsXml, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, MAVEN_SETTINGS_FILE, EVAL_INPUT_DIR } from './chunk-GMKDAF37.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-AJTGTSNA.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, BUILD_HOME, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, EVAL_INPUT_DIR } from './chunk-L2OARQKP.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
 import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, lstatSync, realpathSync, fstatSync, readSync } from 'fs';
@@ -191,7 +191,7 @@ var DOCKER_LOG_LINES = 20;
 var GUEST_GH_DIR = `${JOB_MOUNT}/gh`;
 var GUEST_HOOKS_DIR = `${JOB_MOUNT}/git-hooks`;
 var GUEST_CONTEXT_DIR = `${JOB_MOUNT}/context`;
-var GUEST_MAVEN_DIR = `${JOB_MOUNT}/maven`;
+var GUEST_PATH2 = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 function buildMemoryBytes(config) {
   return parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY);
 }
@@ -227,9 +227,6 @@ function factoryVariablesOf(config, jobDir) {
   if (held !== void 0) return held;
   return config.managed === true ? [] : void 0;
 }
-function firstLine(text2) {
-  return text2.trim().split("\n")[0] ?? "";
-}
 function execEnvironment(image, env) {
   const merged = { ...image, ...env.literals };
   for (const [name, value] of Object.entries(env.passed)) if (value !== void 0) merged[name] = value;
@@ -256,11 +253,26 @@ async function writeGuestGhConfig(runtime, state, token) {
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], ghHostsYml(token));
   if (result.status !== 0) throw new Error(`writing gh's configuration in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
 }
-async function writeGuestMavenSettings(runtime, state) {
-  const script = ["set -e", "umask 022", `mkdir -p ${GUEST_MAVEN_DIR}`, `cat > ${GUEST_MAVEN_DIR}/${MAVEN_SETTINGS_FILE}`].join("\n");
-  const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], buildMavenSettingsXml());
-  if (result.status !== 0) throw new Error(`writing Maven's settings in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
-}
+async function mountGuestHome(runtime, state, agentUser, known) {
+  let home = known;
+  if (home === void 0) {
+    if (agentUser === ADDED_USER) return void 0;
+    const read = await asRoot(runtime, state, [NODE_IN_GUEST, "-e", identityScript(), ...identityArgs(agentUser)]);
+    const found = parseIdentity(read.stdout);
+    if (read.status !== 0 || found === void 0) throw new Error(`reading the build's user from the image failed (exit ${read.status})${said(read.stderr)}`);
+    home = mountableHome(found?.home);
+    if (home === void 0) return void 0;
+  }
+  const copied = await runtime.vm.exec(state.vsockPath, { argv: [NODE_IN_GUEST, "-e", homeCopyScript(), ...homeCopyArgs(home)], user: agentUser, cwd: "/", env: { PATH: GUEST_PATH2, ...state.imageEnv, NODE_OPTIONS: "" } });
+  if (copied.status !== 0) throw new Error(`copying ${home} into the build's home failed (exit ${copied.status})${said(copied.stderr)}`);
+  const folder = shellQuote(home);
+  const mounted = await asRoot(runtime, state, ["/bin/sh", "-c", `[ -d ${folder} ] || exit ${NO_FOLDER}; exec ${HELPER_PATH} mount --bind --source ${BUILD_HOME} --target ${folder}`]);
+  if (mounted.status === NO_FOLDER) return void 0;
+  if (mounted.status !== 0) throw new Error(`mounting the build's home at ${home} failed (exit ${mounted.status})${said(mounted.stderr)}`);
+  return home;
+}
+var NODE_IN_GUEST = "/opt/outerlayer/bin/node";
+var NO_FOLDER = 3;
 async function unpackIntoGuest(runtime, state, dir, target, opts = {}) {
   const script = opts.readOnly === true ? `set -e; rm -rf ${target}; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX,a-w ${target}` : `set -e; mkdir -p ${target}; tar -x --no-same-owner -C ${target}; chmod -R a+rX ${target}`;
   const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], tarOf(dir));
@@ -594,6 +606,12 @@ async function provisionMicroVm(input) {
     throw err;
   }
   state.agentUser = agentUser;
+  try {
+    const home = await mountGuestHome(runtime, state, agentUser);
+    if (home !== void 0) state.home = home;
+  } catch (err) {
+    return bail(describeCallFailure(err));
+  }
   const tools = await asRoot(runtime, state, ["cat", "/opt/outerlayer/tools.json"]);
   const agentVersion = agentVersionOf(tools.status === 0 ? tools.stdout : "");
   environment.agentVersion = agentVersion;
@@ -605,15 +623,7 @@ async function provisionMicroVm(input) {
     const failure = await waitForDocker(runtime, state, agentUser, input.now ?? (() => /* @__PURE__ */ new Date()));
     if (failure !== void 0) return bail(failure);
   }
-  try {
-    await writeGuestMavenSettings(runtime, state);
-  } catch (err) {
-    return bail(`the build's Maven settings could not be delivered: ${describeCallFailure(err)}`);
-  }
-  let execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
-  for (const notice of execEnv.notices) log.line(`${tag} ${notice}`);
-  const plainEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv, proxyWarning: false });
-  const request = (argv, workdir, plain = false) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, plain ? plainEnv : execEnv) });
+  const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
@@ -622,7 +632,7 @@ async function provisionMicroVm(input) {
     agentVersion,
     lifecycle: report.apply.lifecycle,
     exec: async (argv, workdir, opts) => {
-      const ran = await vm.exec(state.vsockPath, request(argv, workdir, opts?.withoutProxyWarning === true));
+      const ran = await vm.exec(state.vsockPath, request(argv, workdir));
       if (opts?.quiet !== true) appendFileSync(logPath, ran.stdout + ran.stderr);
       return ran;
     },
@@ -654,11 +664,7 @@ async function provisionMicroVm(input) {
     keepIn: jobDir,
     ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
     // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
-    ...runtimeStepInput(report, services),
-    dropProxyWarning: () => {
-      state.proxyWarningDropped = true;
-      execEnv = plainEnv;
-    }
+    ...runtimeStepInput(report, services)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
@@ -710,8 +716,6 @@ function vmExecFor(input, argv) {
     unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
-    imageEnv: state.imageEnv,
-    proxyWarning: state.proxyWarningDropped !== true,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
   });
   const options = {
@@ -742,8 +746,6 @@ async function startMicroVmCommand(input) {
     unpinnedRuntimes: state.unpinnedRuntimes,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
-    imageEnv: state.imageEnv,
-    proxyWarning: state.proxyWarningDropped !== true,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
   });
   const started = await input.runtime.vm.exec(state.vsockPath, {
@@ -754,8 +756,8 @@ async function startMicroVmCommand(input) {
     detach: state.commandDir ?? MICROVM_COMMAND_DIR
   });
   if (started.status !== 0) {
-    const said = firstLine(started.stderr);
-    throw new Error(`the guest's exec agent exited ${started.status}${said === "" ? "" : `: ${said}`}`);
+    const said2 = firstLine(started.stderr);
+    throw new Error(`the guest's exec agent exited ${started.status}${said2 === "" ? "" : `: ${said2}`}`);
   }
 }
 async function endMicroVmCommand(runtime, state, jobDir, onError) {
@@ -787,8 +789,6 @@ async function syncInMicroVm(input) {
       unpinnedRuntimes: state.unpinnedRuntimes,
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,
-      imageEnv: state.imageEnv,
-      proxyWarning: state.proxyWarningDropped !== true,
       factoryVariables: factoryVariablesOf(input.config, input.jobDir)
     });
     const result = await runtime.vm.exec(state.vsockPath, {
@@ -935,7 +935,8 @@ async function startCheckMicroVm(input) {
     containerEnv: built.containerEnv,
     imageEnv: built.imageEnv,
     lifecycle: built.lifecycle,
-    ...built.docker === true ? { docker: true } : {}
+    ...built.docker === true ? { docker: true } : {},
+    ...built.home === void 0 ? {} : { home: built.home }
   };
   const checksDir = join(jobDir, "checks");
   mkdirSync(checksDir, { recursive: true });
@@ -1039,6 +1040,13 @@ async function startCheckMicroVm(input) {
     if (!ready) {
       return `the microVM did not start: ${silence(runtime, state, lastError, consoleNote(state, consolePath))}`;
     }
+    if (state.home !== void 0) {
+      try {
+        await mountGuestHome(runtime, state, agentUser, state.home);
+      } catch (err) {
+        return describeCallFailure(err);
+      }
+    }
     if (built.docker === true) return waitForDocker(runtime, state, agentUser, () => /* @__PURE__ */ new Date());
     return void 0;
   };
@@ -1051,7 +1059,6 @@ async function startCheckMicroVm(input) {
     repository,
     hostEnv: runtime.hostEnv,
     containerEnv: built.containerEnv ?? {},
-    imageEnv: built.imageEnv,
     // The checks of a managed build get its factory's variables, as its command did, and none of the runner's own.
     factoryVariables: factoryVariablesOf(config, jobDir)
   });
@@ -1360,7 +1367,7 @@ var POLL_MS = 200;
 var ASK_AGAIN_MS = 1e3;
 var EXIT_REPORT_WAIT_MS = 2e3;
 var exitsLogged = /* @__PURE__ */ new Map();
-var BUILD_HOME = "/build/home";
+var BUILD_HOME2 = "/build/home";
 async function startSender(input) {
   const { config, job, jobDir, deps } = input;
   const tag = `#${job.item}`;
@@ -1419,7 +1426,7 @@ async function restartSender(input) {
   const state = job.container;
   if (state !== void 0 && job.itemKey !== void 0) {
     const runtime = deps.runtime ?? createContainerRuntime();
-    const pidfile = senderPidfile(BUILD_HOME, Number(job.item));
+    const pidfile = senderPidfile(BUILD_HOME2, Number(job.item));
     const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const running = async () => {
       const probe = await runtime.host.exec({ container: state.container, user: state.agentUser ?? ADDED_USER, env: { literals: {}, passed: {} }, argv: ["/bin/sh", "-c", senderAliveScript(pidfile)] });
@@ -1485,8 +1492,8 @@ async function stopSender(input) {
   if (sender === void 0) return;
   const tag = `#${job.item}`;
   const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const inContainer = job.container === void 0 ? void 0 : { state: job.container, runtime: deps.runtime ?? createContainerRuntime(), pidfile: senderPidfile(BUILD_HOME, Number(job.item)) };
-  const inGuest = job.microvm === void 0 ? void 0 : { state: job.microvm, runtime: deps.runtime ?? createContainerRuntime(), pidfile: senderPidfile(BUILD_HOME, Number(job.item)) };
+  const inContainer = job.container === void 0 ? void 0 : { state: job.container, runtime: deps.runtime ?? createContainerRuntime(), pidfile: senderPidfile(BUILD_HOME2, Number(job.item)) };
+  const inGuest = job.microvm === void 0 ? void 0 : { state: job.microvm, runtime: deps.runtime ?? createContainerRuntime(), pidfile: senderPidfile(BUILD_HOME2, Number(job.item)) };
   const signalInside = async (signal) => {
     if (inContainer !== void 0) return signalInContainer(inContainer.runtime, inContainer.state, inContainer.pidfile, signal).catch(() => void 0);
     if (inGuest !== void 0) return signalInGuest(inGuest.runtime, inGuest.state, inGuest.pidfile, signal).catch(() => void 0);
@@ -1692,8 +1699,8 @@ function readJudgeReply(run, minutes) {
   if (run.kind === "timeout") return { kind: "none", reason: `the judge ran out of time after ${minutes}`, limitKey: true };
   const output = parseOutput(run.stdout);
   if (output === void 0) {
-    const said = firstLine2(run.stderr);
-    return { kind: "none", reason: `the judge exited ${run.status} and printed no result${said === "" ? "" : `: ${said}`}` };
+    const said2 = firstLine2(run.stderr);
+    return { kind: "none", reason: `the judge exited ${run.status} and printed no result${said2 === "" ? "" : `: ${said2}`}` };
   }
   if (output.subtype === "error_max_turns") return { kind: "none", reason: `the judge reached the turn limit of ${JUDGE_MAX_TURNS} turns before it gave a result` };
   const lines = output.result.split(/\r\n|\r|\n/).map((line) => line.trim()).filter((line) => line !== "");
@@ -2020,9 +2027,9 @@ async function runJudge(input) {
         return { id: entry.id, result: entry.result, ...reason2 === void 0 ? {} : { reason: reason2 } };
       });
       const failing = itemsSentence(items, { one: "check item", many: "check items" });
-      const said = at.answer.answer.result ?? (at.reply.kind === "answered" ? at.reply.verdict : void 0);
-      const result = said === "pass" && failing === void 0 ? "pass" : "fail";
-      const reason = failing ?? (said === "fail" ? "the judge failed the change" : said === void 0 ? at.reply.kind === "none" ? at.reply.reason : "the judge gave no result" : void 0);
+      const said2 = at.answer.answer.result ?? (at.reply.kind === "answered" ? at.reply.verdict : void 0);
+      const result = said2 === "pass" && failing === void 0 ? "pass" : "fail";
+      const reason = failing ?? (said2 === "fail" ? "the judge failed the change" : said2 === void 0 ? at.reply.kind === "none" ? at.reply.reason : "the judge gave no result" : void 0);
       const report = renderJudgeReport({ check: check.name, result, reason, items, commit: at.head });
       return await recordWhole(check, { ...where, result, reason, items, report });
     }

package/dist/{chunk-JVNQNKHV.js → chunk-PHIQHIRJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-BS3OYFAD.js';
+import { EXEC_PORT } from './chunk-G4SOMWXL.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-7Q7GQELE.js → chunk-PPQTTJSW.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-6IMQXBTZ.js';
-import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-36M4KVBT.js';
-import { signingFetchFor } from './chunk-62URQYCB.js';
-import { signerFor } from './chunk-RJZZFAXS.js';
+import { WorkCommandError, postJson } from './chunk-GJYGOFF3.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-5IUC2B6J.js';
+import { signingFetchFor } from './chunk-PAGB3DCI.js';
+import { signerFor } from './chunk-VKYU4HHW.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-3VJYDWFV.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-AJTGTSNA.js';
 import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, cpSync, readFileSync, existsSync, lstatSync } from 'fs';
 import { relative, join, dirname } from 'path';
 

package/dist/{chunk-GPO7F757.js → chunk-QJ2SNBHL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-GMKDAF37.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-L2OARQKP.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-W246VXU4.js → chunk-QNF7LT7W.js}

@@ -2,9 +2,9 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-EYJRVHBN.js';
+import { autoConnect } from './chunk-BTDBDTUY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-62URQYCB.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-PAGB3DCI.js';
 import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-Z4LFCJT6.js → chunk-SWCOWG2C.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-EYJRVHBN.js';
+import { autoConnect } from './chunk-BTDBDTUY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-62URQYCB.js';
+import { defaultFetch, unauthorizedMessage, resolveGatewayCredentials } from './chunk-PAGB3DCI.js';
 import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-SKAML7GB.js → chunk-SYMBXSAT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-Y7MF32DM.js';
-import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-CFJOONWM.js';
+import { stripTerminalControls } from './chunk-PBI4CM4M.js';
+import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-LBKCYEJT.js';
 import { readFileSync } from 'fs';
 
 createRequire(import.meta.url);
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-5VGCFZV2.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-VPJW5LXB.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-5ARXP3BP.js → chunk-UEDRRWZ3.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-GPO7F757.js';
-import { EXEC_PORT } from './chunk-BS3OYFAD.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-QJ2SNBHL.js';
+import { EXEC_PORT } from './chunk-G4SOMWXL.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-GMKDAF37.js';
+import { RELAY_PORT } from './chunk-L2OARQKP.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';