@outerlayer/cli 0.34.0-next.20261028010245 → 0.34.0-next.20261028105453

package/dist/{chunk-D6SH7DWA.js → chunk-H5YUWLIY.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-GJYGOFF3.js';
+import { resolveCredentials, postJson, getJson } from './chunk-72N7GOLM.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
-import { defaultFetch } from './chunk-PAGB3DCI.js';
-import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
+import { defaultFetch } from './chunk-IZKUPAXF.js';
+import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomUUID } from 'crypto';

package/dist/{chunk-PBI4CM4M.js → chunk-ITS67SH7.js}

@@ -2,35 +2,35 @@
 import { createRequire } from 'node:module';
 import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-6CK2OC4Q.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { HELPER_PATH, DOCKERD_LOG, HELPER_RECORD } from './chunk-UEDRRWZ3.js';
+import { HELPER_PATH, DOCKERD_LOG, HELPER_RECORD } from './chunk-XDCD4GD5.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-JXY66VYX.js';
-import { installScrubContext } from './chunk-32FAPJFD.js';
-import { writeDockerClientConfig } from './chunk-QJ2SNBHL.js';
+import { senderPidfile } from './chunk-AKQX462F.js';
+import { installScrubContext } from './chunk-C2E4PWEN.js';
+import { writeDockerClientConfig } from './chunk-BUVDDPOM.js';
 import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepUnpinnedRuntimes, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-VB4QD4WN.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-BQ4C47K2.js';
-import { waitForAgent, vmExecArgs } from './chunk-PHIQHIRJ.js';
-import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-G4SOMWXL.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-PPQTTJSW.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-GXMMILQ4.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-EGJY6MBC.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-AHWMY3MS.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepRuntimeStep, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, ranRuntimeStep, provisionRuntimes, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-7JBG43BX.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-AGNFPJSP.js';
+import { waitForAgent, vmExecArgs } from './chunk-NPTEYMBW.js';
+import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-DKIZDYUX.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-SODV2YMW.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-QXAPVAPR.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-7LKOOGSN.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-2LCNMAWP.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-D3CT6XQ4.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-GJYGOFF3.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-72N7GOLM.js';
 import { planArtifactUpload } from './chunk-IXPH4EXK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor } from './chunk-VKYU4HHW.js';
+import { signerFor } from './chunk-VJQQVTCS.js';
 import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-OVNF4LLC.js';
-import { scrubText } from './chunk-A6PJSNP6.js';
+import { scrubText } from './chunk-A2KLVZBU.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { parsePolicy } from './chunk-XFJ7YOPD.js';
 import { CheckItemsSchema } from './chunk-DINRXUQA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-AJTGTSNA.js';
-import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, fdName, BUILD_HOME, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, EVAL_INPUT_DIR } from './chunk-L2OARQKP.js';
+import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-2CW2QMSG.js';
+import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, withMiseVariables, fdName, BUILD_HOME, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4N7BQBO4.js';
 import { RUNNER_WORDED_REASONS, UNKNOWN_TRACKING_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
 import { rmSync, existsSync, statSync, appendFileSync, mkdirSync, chmodSync, writeFileSync, openSync, closeSync, readFileSync, readdirSync, lstatSync, realpathSync, fstatSync, readSync } from 'fs';
@@ -623,7 +623,12 @@ async function provisionMicroVm(input) {
     const failure = await waitForDocker(runtime, state, agentUser, input.now ?? (() => /* @__PURE__ */ new Date()));
     if (failure !== void 0) return bail(failure);
   }
-  const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
+  const request = (argv, workdir, variables) => ({
+    argv,
+    user: agentUser,
+    cwd: workdir,
+    env: execEnvironment(state.imageEnv, withMiseVariables(env, variables))
+  });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
@@ -632,7 +637,7 @@ async function provisionMicroVm(input) {
     agentVersion,
     lifecycle: report.apply.lifecycle,
     exec: async (argv, workdir, opts) => {
-      const ran = await vm.exec(state.vsockPath, request(argv, workdir));
+      const ran = await vm.exec(state.vsockPath, request(argv, workdir, opts?.variables));
       if (opts?.quiet !== true) appendFileSync(logPath, ran.stdout + ran.stderr);
       return ran;
     },
@@ -668,7 +673,7 @@ async function provisionMicroVm(input) {
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
-  keepUnpinnedRuntimes(state, steps);
+  keepRuntimeStep(state, steps);
   if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
@@ -714,6 +719,7 @@ function vmExecFor(input, argv) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     unpinnedRuntimes: state.unpinnedRuntimes,
+    miseVariables: state.miseVariables,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
@@ -744,6 +750,7 @@ async function startMicroVmCommand(input) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     unpinnedRuntimes: state.unpinnedRuntimes,
+    miseVariables: state.miseVariables,
     builtIns: state.builtIns === true,
     identity: input.job.commitIdentity,
     factoryVariables: factoryVariablesOf(input.config, input.jobDir)
@@ -787,6 +794,7 @@ async function syncInMicroVm(input) {
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
       unpinnedRuntimes: state.unpinnedRuntimes,
+      miseVariables: state.miseVariables,
       builtIns: state.builtIns === true,
       identity: job.commitIdentity,
       factoryVariables: factoryVariablesOf(input.config, input.jobDir)
@@ -1073,7 +1081,7 @@ async function startCheckMicroVm(input) {
       state,
       evalInput: { dir: evalInput.dir, deliver: deliverEvalInput },
       exec: async (argv, workdir, opts) => {
-        const ran = await vm.exec(state.vsockPath, { argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
+        const ran = await vm.exec(state.vsockPath, { argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, withMiseVariables(env, opts?.variables)) });
         if (opts?.logPath !== void 0) appendFileSync(opts.logPath, ran.stdout + ran.stderr);
         return ran;
       },
@@ -3329,6 +3337,7 @@ async function runHostChecks(input) {
       }
     }
     let abandoned = false;
+    let variables;
     const setup = async () => {
       const started = job.microvm !== void 0 ? await startCheckMicroVm({
         config,
@@ -3357,6 +3366,7 @@ async function runHostChecks(input) {
       });
       if (!started.ok) return `the check environment could not be made: ${started.reason}`;
       const made = "container" in started ? started.container : started.environment;
+      const checkBuildId = made.state.buildId;
       const steps = [
         {
           argv: ["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"],
@@ -3386,10 +3396,21 @@ async function runHostChecks(input) {
         const ran = await made.exec(step.argv, step.workdir, { logPath: environmentLog });
         if (ran.status !== 0) return `the check environment could not be prepared: ${step.failed(ran.status)}`;
       }
+      if (ranRuntimeStep(job.container ?? job.microvm)) {
+        const chosen = await provisionRuntimes({
+          repositories: repositoriesToCheckOut,
+          exec: (argv, workdir, opts) => made.exec(argv, workdir, opts?.quiet === true ? {} : { logPath: environmentLog }),
+          log,
+          tag: `${tag} checks`,
+          refusals: () => runtime.tunnels.get(checkBuildId)?.record().refusals ?? []
+        });
+        if (!chosen.ok) return `the check environment could not be prepared: ${chosen.reason}`;
+        variables = chosen.variables;
+      }
       const lifecycleDir = lifecycleWorkdir(repositoriesToCheckOut, (job.container ?? job.microvm)?.governing?.repository);
       for (const step of lifecycleSteps((job.container ?? job.microvm)?.lifecycle ?? {})) {
         log.line(`${tag} checks lifecycle ${step.name} (${step.source})`);
-        const ran = await made.exec(step.argv, lifecycleDir, { logPath: environmentLog });
+        const ran = await made.exec(step.argv, lifecycleDir, { logPath: environmentLog, variables });
         if (ran.status !== 0) return `the check environment could not be prepared: ${lifecycleFailureReason(step, ran.status)}`;
       }
       return made;
@@ -3442,7 +3463,7 @@ async function runHostChecks(input) {
       const checkStartedMs = now().getTime();
       const logPath = join(jobDir, "checks", `${check.name}.log`);
       await ready.exec(["rm", "-f", CHECK_ITEMS_FILE], CHECKOUT_DIR, { logPath });
-      const running = ready.exec(["/bin/sh", "-c", check.command], CHECKOUT_DIR, { logPath });
+      const running = ready.exec(["/bin/sh", "-c", check.command], CHECKOUT_DIR, { logPath, variables });
       running.catch(() => void 0);
       const timer = timeoutAfter(limitMinutes * 6e4, deps.sleep);
       let outcome;

package/dist/{chunk-PAGB3DCI.js → chunk-IZKUPAXF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-VKYU4HHW.js';
+import { signRunnerRequest, signerFor } from './chunk-VJQQVTCS.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-GET5HKLM.js → chunk-JDQBJUXQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-2CW2QMSG.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-HFMK2R7O.js → chunk-JNFLO6DA.js}

@@ -1,31 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { reportFailedStart, fitImageBuildMemory } from './chunk-GMEXR6PY.js';
+import { reportFailedStart, fitImageBuildMemory } from './chunk-6UHU7DHT.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
 import { RUNNER_PROTOCOL } from './chunk-MH6QLXUO.js';
-import { writePendingUpdate } from './chunk-77D5ENBA.js';
-import { renderUpdateSteps } from './chunk-SYMBXSAT.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-GET5HKLM.js';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-PBI4CM4M.js';
+import { writePendingUpdate } from './chunk-TZXJSNN4.js';
+import { renderUpdateSteps } from './chunk-6WU2D2CY.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-JDQBJUXQ.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, readProvisionOut, workdirProblem, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, startSender, finishJob, sampleGuest, foldSample, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, GUEST_USAGE_INTERVAL_MS, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-ITS67SH7.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf, createHousekeepingDocker, housekeepingDockerIfReachable, KIND_LABEL, RECIPE_KEY_LABEL } from './chunk-3E7QAXUW.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-I4YOWQH7.js';
+import { realBlockedProbes, checkBlockedWithSlots, largeBuildMemoryBytes, LARGE_BUILD_DISK_BYTES, checkManagedRoom, sliceMemoryOf, createHousekeepingDocker, housekeepingDockerIfReachable, KIND_LABEL, RECIPE_KEY_LABEL } from './chunk-OFKM35MX.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, isInLayout, startedThroughCurrent, entryIn, versionDir, switchCurrent, cleanVersions, stagingDir } from './chunk-E3GX4WVJ.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, HELPER_ENV, setUpRunnerCgroup, sweepImageBuilders, stoppedHelperReason, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ensureNetworkReady, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-VB4QD4WN.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-PPQTTJSW.js';
-import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-LBKCYEJT.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, attemptNote, fetchManagedClaudeKey, holdManagedClaudeKey, fetchManagedBuildSettings, holdManagedBuildSettings, needsBuildSkill, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, provisionEnvironment, resolveHostBuild, listenOnBroker, hostEnvironment, deliverExecMaven, runWithSpawn, hostCommandEnvironment, lifecycleSteps, execArgv, lifecycleFailureReason, decideHostBuildSkill, prepareBranch, currentSkillCommand, formerSkillProblem, containerCommandExec, execCommandLine, startHostServices, HELPER_ENV, setUpRunnerCgroup, sweepImageBuilders, stoppedHelperReason, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, ensureNetworkReady, managedBuildSettingsFor, ADOPTED_FETCH_RETRY_WINDOW_MS, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-7JBG43BX.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, resolveGoverningSource, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-SODV2YMW.js';
+import { imageTag, writeUpdateStatus, pullInstruction, tagToPull } from './chunk-ORENXMHA.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-GXMMILQ4.js';
-import { freeBytes, formatBytes, allocatedBytes } from './chunk-EGJY6MBC.js';
-import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, readJobFileChecked } from './chunk-AHWMY3MS.js';
-import { claimPidFile, releasePidFile, writePidFile, readPidFile } from './chunk-3X6OSXSB.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, keepsHostBuilder, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-QXAPVAPR.js';
+import { freeBytes, formatBytes, allocatedBytes } from './chunk-7LKOOGSN.js';
+import { writeJobFile, ensureRunnerIdentity, identityDockerFor, readJobFile, exceedsDisk, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, readJobFileChecked } from './chunk-2LCNMAWP.js';
+import { claimPidFile, releasePidFile, writePidFile, readPidFile } from './chunk-64LLUVJR.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-GJYGOFF3.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-VKYU4HHW.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-72N7GOLM.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-VJQQVTCS.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-AJTGTSNA.js';
-import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-L2OARQKP.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, imagesDir, rootfsDir, builderCacheDiskPath } from './chunk-2CW2QMSG.js';
+import { parseClaimIdentity, parseClaimedRepositories, parseUnreachable, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, takeClaudeCredential, heldClaudeCredential, currentClaudeCredential, fdName } from './chunk-4N7BQBO4.js';
 import { COMMAND_LOST_REASON, CONTAINER_STOPPED_REASON } from './chunk-MESOOLF4.js';
 import { randomBytes, createHash } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, writeFileSync, renameSync, statSync, readdirSync, readFileSync, rmSync, closeSync, lstatSync } from 'fs';
@@ -1856,7 +1856,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-77GUT7LY.js');
+  const { postJson: postJson2 } = await import('./work-cmd-DWR27TKQ.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -3189,7 +3189,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-C7UKLYZQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-LMUTXMTY.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-23XAA7YD.js → chunk-LEJWPGO7.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession, transcriptPathForSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-BTDBDTUY.js';
+import { autoConnect } from './chunk-GJHOU5V3.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-PAGB3DCI.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-A6PJSNP6.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-A2KLVZBU.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-NBETYM32.js → chunk-N4KQMGEZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind, keepsHostBuilder } from './chunk-GXMMILQ4.js';
-import { parseSize } from './chunk-AHWMY3MS.js';
-import { runnerDir } from './chunk-AJTGTSNA.js';
-import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-L2OARQKP.js';
+import { builtinKind, keepsHostBuilder } from './chunk-QXAPVAPR.js';
+import { parseSize } from './chunk-2LCNMAWP.js';
+import { runnerDir } from './chunk-2CW2QMSG.js';
+import { FD_SLOTS_PER_BUILD, FD_STORE_ENV, BUILD_SLICE_MEMORY_ENV, CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-4N7BQBO4.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';
 import { spawnSync } from 'child_process';

package/dist/{chunk-4J5GRWAY.js → chunk-N6V4ZHI7.js}

@@ -3,10 +3,10 @@ import { createRequire } from 'node:module';
 import { DEFAULT_DASHBOARD } from './chunk-NWHU5G6R.js';
 import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
 import { isAgentsMdLayout } from './chunk-LYCJQOO2.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-PAGB3DCI.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-IZKUPAXF.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { remoteLookupFailed } from './chunk-A6PJSNP6.js';
+import { remoteLookupFailed } from './chunk-A2KLVZBU.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { lstatSync } from 'fs';

package/dist/{chunk-PHIQHIRJ.js → chunk-NPTEYMBW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-G4SOMWXL.js';
+import { EXEC_PORT } from './chunk-DKIZDYUX.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-3E7QAXUW.js → chunk-OFKM35MX.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { placeholderQueues, placeholderProblem } from './chunk-VB4QD4WN.js';
-import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-NBETYM32.js';
-import { builtinKind, EGRESS_SWITCHABLE_KEYS, imageBuildOf, keepsHostBuilder } from './chunk-GXMMILQ4.js';
-import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK, volumeBytes } from './chunk-EGJY6MBC.js';
-import { spawnRun, RUNNER_LABEL, BUILD_LABEL } from './chunk-AHWMY3MS.js';
+import { placeholderQueues, placeholderProblem } from './chunk-7JBG43BX.js';
+import { checkFit, RUNNER_RESERVE_BYTES } from './chunk-N4KQMGEZ.js';
+import { builtinKind, EGRESS_SWITCHABLE_KEYS, imageBuildOf, keepsHostBuilder } from './chunk-QXAPVAPR.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK, volumeBytes } from './chunk-7LKOOGSN.js';
+import { spawnRun, RUNNER_LABEL, BUILD_LABEL } from './chunk-2LCNMAWP.js';
 import { builderDiskPinned } from './chunk-D3CT6XQ4.js';
-import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-L2OARQKP.js';
+import { BUILD_SLICE_MEMORY_ENV, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, claudeCredentialVariablesSet, claudeCredential, claudeEnvPath, parseRunnerEnv } from './chunk-4N7BQBO4.js';
 import { closeSync, openSync, constants, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { totalmem } from 'os';

package/dist/{chunk-LBKCYEJT.js → chunk-ORENXMHA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-2CW2QMSG.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-6Q7O4MRI.js → chunk-QGTJ5IJN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-I4YOWQH7.js';
+import { currentLink } from './chunk-E3GX4WVJ.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-5IUC2B6J.js → chunk-QTL7VZVF.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-LMYRR5MO.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-PAGB3DCI.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-IZKUPAXF.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-OVNF4LLC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
 import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-XFJ7YOPD.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { withTokenHeader } from './chunk-L2OARQKP.js';
+import { withTokenHeader } from './chunk-4N7BQBO4.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
 import { isAbsolute, join, dirname } from 'path';

package/dist/{chunk-GXMMILQ4.js → chunk-QXAPVAPR.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-EGJY6MBC.js';
-import { parseSize } from './chunk-AHWMY3MS.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-7LKOOGSN.js';
+import { parseSize } from './chunk-2LCNMAWP.js';
 import { builderDiskPinned } from './chunk-D3CT6XQ4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-L2OARQKP.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-4N7BQBO4.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';

package/dist/{chunk-6LS62EO4.js → chunk-S37IAT3A.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-NBETYM32.js';
-import { RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
-import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-L2OARQKP.js';
+import { DEFAULT_UNIT_NAME } from './chunk-N4KQMGEZ.js';
+import { RUNNER_FILE_MODE } from './chunk-2CW2QMSG.js';
+import { claudeEnvPath, withoutCredentialLines, parseRunnerEnv } from './chunk-4N7BQBO4.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-PPQTTJSW.js → chunk-SODV2YMW.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-GJYGOFF3.js';
-import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-5IUC2B6J.js';
-import { signingFetchFor } from './chunk-PAGB3DCI.js';
-import { signerFor } from './chunk-VKYU4HHW.js';
+import { WorkCommandError, postJson } from './chunk-72N7GOLM.js';
+import { defaultGitRunner, materializeContext, fetchControlPlaneCommit, lookupGoverningSource } from './chunk-QTL7VZVF.js';
+import { signingFetchFor } from './chunk-IZKUPAXF.js';
+import { signerFor } from './chunk-VJQQVTCS.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-AJTGTSNA.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-2CW2QMSG.js';
 import { fstatSync, mkdirSync, writeFileSync, chmodSync, rmSync, cpSync, readFileSync, existsSync, lstatSync } from 'fs';
 import { relative, join, dirname } from 'path';
 

package/dist/{chunk-77D5ENBA.js → chunk-TZXJSNN4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-2CW2QMSG.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-VKYU4HHW.js → chunk-VJQQVTCS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AJTGTSNA.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-2CW2QMSG.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-UEDRRWZ3.js → chunk-XDCD4GD5.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-QJ2SNBHL.js';
-import { EXEC_PORT } from './chunk-G4SOMWXL.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-BUVDDPOM.js';
+import { EXEC_PORT } from './chunk-DKIZDYUX.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-L2OARQKP.js';
+import { RELAY_PORT } from './chunk-4N7BQBO4.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-NOEJGR4X.js → chunk-ZIXLG6EQ.js}

@@ -2,11 +2,11 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-BTDBDTUY.js';
+import { autoConnect } from './chunk-GJHOU5V3.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { acquireSpoolLockAt } from './chunk-IXPH4EXK.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-PAGB3DCI.js';
-import { resolveRepoIdentity } from './chunk-A6PJSNP6.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
+import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-DINRXUQA.js';

package/dist/{claude-launcher-GGZEWVYJ.js → claude-launcher-XX2MLBDW.js}

@@ -252,7 +252,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-55CJGYBK.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-RJSAIFEP.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);