@outerlayer/cli 0.8.5 → 0.9.0

package/dist/{chunk-6AFQOYO3.js → chunk-RWQWPZB4.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-2MFYKH3C.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-WLV4KCAW.js';
-import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-NKU5OPYP.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-BMX3L7CR.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-BGWTYRSS.js';
+import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-TB7EP24C.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
+import { withTokenHeader } from './chunk-BYT5O5RV.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';
@@ -61,7 +62,7 @@ var defaultGitRunner = (args, opts) => {
       // cat-file stream can't exhaust memory.
       maxBuffer: 64 * 1024 * 1024,
       stdio: ["pipe", "pipe", "pipe"],
-      env: {
+      env: (opts.env ?? ((base) => base))({
         ...process.env,
         // classifyGitFailure greps English stderr substrings
         // ("Authentication failed", "Permission denied", …) — a git running
@@ -73,7 +74,7 @@ var defaultGitRunner = (args, opts) => {
         // terminal to read from here, hanging until OUR OWN timeout instead
         // of failing fast with a classifiable stderr message.
         GIT_TERMINAL_PROMPT: "0"
-      }
+      })
     });
     return { ok: true, stdout: Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout), stderr: "" };
   } catch (err) {
@@ -213,14 +214,17 @@ async function materializeContext(deps) {
     const sortedCandidates = [...designation.candidates].sort((a, b) => a.repository.localeCompare(b.repository));
     const claimants = [];
     const unfetched = [];
+    const access = await deps.controlPlaneAccess?.(sortedCandidates);
     for (const candidate of sortedCandidates) {
       const candidateUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(candidate.repository, candidate.ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, candidate.repository);
       const candidateHost = parseRemoteHost(candidateUrl).host || "unknown-host";
       const candidateCacheDir = ensureBareCache(git, home, candidate.repository, candidateHost);
       const candidateLocalRef = `refs/outerlayer/${sanitizeRefName(candidate.ref)}`;
+      const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(candidate.repository) ? access.token : void 0;
       const candidateFetch = git(["fetch", "--depth", "1", candidateUrl, `+${candidate.ref}:${candidateLocalRef}`], {
         cwd: candidateCacheDir,
-        timeoutMs: 1e4
+        timeoutMs: 1e4,
+        ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, candidateUrl, token) }
       });
       if (!candidateFetch.ok) {
         unfetched.push(candidate.repository);

package/dist/{chunk-2E2MG3KW.js → chunk-S6IUUNCD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-2FWL7CE2.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-M6G7TJVF.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-AGMIJ725.js → chunk-SUMWRA7K.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-WLV4KCAW.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-BGWTYRSS.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-NKU5OPYP.js → chunk-TB7EP24C.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-PK5NANMT.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-YT35WGIP.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-DE4GLH3P.js → chunk-TV36SKEN.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-CDISNKM4.js';
+import { compareVersions } from './chunk-LTJPX7TX.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-2FWL7CE2.js';
+import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-M6G7TJVF.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { createHash } from 'crypto';
 import { realpathSync } from 'fs';

package/dist/{chunk-J5DPVNL3.js → chunk-V42JY4F6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-2E2MG3KW.js';
-import { RELAY_PORT } from './chunk-2FWL7CE2.js';
+import { EXEC_PORT } from './chunk-S6IUUNCD.js';
+import { RELAY_PORT } from './chunk-M6G7TJVF.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-FCDET2U5.js → chunk-VMK7I3TB.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-H6IGIE3I.js';
-import { CaptureDaemon } from './chunk-CDISNKM4.js';
+import { LiveUploader } from './chunk-543OT6V5.js';
+import { CaptureDaemon } from './chunk-LTJPX7TX.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-K4MGMSMN.js';
+import { spoolDir } from './chunk-4HMXH2OA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-IOG6LPEI.js → chunk-WJBJY5DQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-LKUUQ3XV.js';
-import { MIN_ENGINE_MAJOR } from './chunk-GJ3OWUFO.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-QPPPUKQJ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-LBU4CLK5.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-SWGQAURM.js → chunk-XGCJNSI7.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-IOG6LPEI.js';
-import { describeCallFailure } from './chunk-GJ3OWUFO.js';
-import { WorkCommandError, getJson } from './chunk-TY7EZC7U.js';
-import { sanitizeTerminal } from './chunk-BL63NBJZ.js';
-import { builtinKind } from './chunk-7KI224YS.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-2FWL7CE2.js';
+import { isPlaceholderCommand } from './chunk-WJBJY5DQ.js';
+import { describeCallFailure } from './chunk-LBU4CLK5.js';
+import { WorkCommandError, getJson } from './chunk-KWCJLAHQ.js';
+import { sanitizeTerminal } from './chunk-ZEQMTBRD.js';
+import { builtinKind } from './chunk-M2PBLRB7.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-M6G7TJVF.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 
 createRequire(import.meta.url);
@@ -21,6 +21,25 @@ function placeholderProblem(queues) {
   const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
   return `${keys} ${queues.length === 1 ? "is" : "are"} still the placeholder \`runner init\` wrote, which fails every item. Edit ${queues.length === 1 ? "it" : "them"} to start your agent on item $OUTERLAYER_WORK`;
 }
+var CLAUDE_PERMISSION_MODES = ["acceptEdits", "auto", "bypassPermissions", "default", "dontAsk", "manual", "plan"];
+var CLAUDE_COMMAND = /(?:^|[;&|(])\s*(?:(?:exec|env|nohup|time)\s+)*(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:\S*\/)?claude\s/;
+var PERMISSION_MODE_FLAG = /--permission-mode(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s;&|()]+))/g;
+function permissionModeProblems(config) {
+  const problems = [];
+  for (const queue of config.queues) {
+    const command = config.commands[queue];
+    if (command === void 0 || !CLAUDE_COMMAND.test(command)) continue;
+    for (const match of command.matchAll(PERMISSION_MODE_FLAG)) {
+      const value = match[1] ?? match[2] ?? match[3] ?? "";
+      if (value.includes("$") || value.includes("`") || CLAUDE_PERMISSION_MODES.includes(value)) continue;
+      problems.push({ queue, command, value });
+    }
+  }
+  return problems;
+}
+function permissionModeProblem(problems) {
+  return problems.map(({ queue, command, value }) => `runner.commands.${queue} is \`${command}\`, and \`${value}\` is not a permission mode Claude Code accepts (${CLAUDE_PERMISSION_MODES.join(", ")}). The command would fail only when a build ran it`).join(". ");
+}
 function needsClaudeCredential(hooks) {
   return builtinKind(hooks.provision) !== "own";
 }
@@ -80,4 +99,4 @@ async function claimPermissionProblem(config, fetchImpl = fetch) {
   }
 }
 
-export { claimPermissionProblem, claudeCredentialCheck, missingPermissionFix, missingPermissionOf, needsClaudeCredential, placeholderProblem, placeholderQueues };
+export { claimPermissionProblem, claudeCredentialCheck, missingPermissionFix, missingPermissionOf, needsClaudeCredential, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues };

package/dist/{chunk-FTW6C2E7.js → chunk-XZNO4QED.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-TY7EZC7U.js';
-import { isLinkedRepository } from './chunk-TFJGK4UB.js';
-import { sanitizeTerminal } from './chunk-BL63NBJZ.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-CDISNKM4.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-KWCJLAHQ.js';
+import { isLinkedRepository } from './chunk-LYESSQUA.js';
+import { sanitizeTerminal } from './chunk-ZEQMTBRD.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-LTJPX7TX.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-2MFYKH3C.js';
+import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-BMX3L7CR.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-K4MGMSMN.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-4HMXH2OA.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1004,7 +1004,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-OOBPCY7Q.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-X45X7AS4.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-FEIBPZL7.js');
+    const { runnerHostChecks } = await import('./doctor-PUAL5LTL.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1050,8 +1050,8 @@ async function gatherDoctorChecks() {
     const service = await (async () => {
       const { existsSync: existsSync2 } = await import('fs');
       if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
-      const { inspectService, realInspectProbes } = await import('./inspect-XAUSB7L3.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-C33LT5KQ.js');
+      const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-PYNCWSTV.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-ZMKXBWIK.js → chunk-YCPV7FN6.js}

@@ -1,25 +1,26 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { decideInstalledSwitch, fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-IS4DIGBQ.js';
+import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-4KPMIGBQ.js';
+import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-OSKO3PAL.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
-import { RUNNER_PROTOCOL } from './chunk-AIW6GLET.js';
+import { RUNNER_PROTOCOL } from './chunk-PDTSUOVT.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-SWGQAURM.js';
+import { placeholderQueues, placeholderProblem } from './chunk-XGCJNSI7.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-GJ3OWUFO.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-LBU4CLK5.js';
 import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-WGLWDX5J.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-DE4GLH3P.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-TY7EZC7U.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-7KI224YS.js';
+import { spawnRun } from './chunk-FKFGQJNN.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-TV36SKEN.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KWCJLAHQ.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-M2PBLRB7.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
-import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-2FWL7CE2.js';
-import { parseClaimIdentity } from './chunk-HKMPVPO7.js';
+import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-M6G7TJVF.js';
+import { parseClaimIdentity } from './chunk-BYT5O5RV.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-V7NIVOFD.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-ZM2IMMYN.js';
@@ -785,8 +786,7 @@ async function removeStaleRootDisks(root, unfinished, options) {
 // src/runner/loop.ts
 var QUEUE_ORDER = ["amend", "implement"];
 var TRACKER_REPOSITORY_HOSTS = {
-  github: "github.com",
-  gitlab: "gitlab.com"
+  github: "github.com"
 };
 var HOUSEKEEPING_INTERVAL_MS = 36e5;
 function logOf(state) {
@@ -1236,7 +1236,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-SBKQJBJ2.js');
+  const { postJson: postJson2 } = await import('./work-cmd-TK4VOOHL.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1455,8 +1455,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
     if (!provisioned.ok) {
-      log.error(`${tag} provision failed (${provisionTook}): ${provisioned.reason} \xB7 ending job as failed`);
-      await endJob(state, active, "failed", { stage: "provision", reason: provisioned.reason });
+      await endOnProvisionFailure(state, active, tokens, provisionTook, provisioned.reason);
       return;
     }
     log.line(`${tag} provision ok (${provisionTook}) \xB7 container ${provisioned.state.container}`);
@@ -1488,8 +1487,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
     const provisionTook = formatDuration(nowOf(state).getTime() - provisionStartedMs);
     if (active.ending) return;
     if (!provisioned.ok) {
-      log.error(`${tag} provision failed (${provisionTook}): ${provisioned.reason} \xB7 ending job as failed`);
-      await endJob(state, active, "failed", { stage: "provision", reason: provisioned.reason });
+      await endOnProvisionFailure(state, active, tokens, provisionTook, provisioned.reason);
       return;
     }
     log.line(`${tag} provision ok (${provisionTook}) \xB7 microVM build ${provisioned.state.buildId}`);
@@ -1775,6 +1773,20 @@ async function endOnTokenRefusal(state, active, err) {
     await endJob(state, active, "failed", { stage: "provision", reason: refusal.reason });
   }
 }
+async function endOnProvisionFailure(state, active, tokens, took, reason) {
+  const log = logOf(state);
+  const tag = `#${active.job.item}`;
+  if (tokens.refusal()?.kind === "lease_lost") {
+    log.error(`${tag} provision failed (${took}): a token request was refused as a lost lease \xB7 ending job as lease_lost`);
+    await endJob(state, active, "lease_lost");
+  } else if (tokens.controlPlaneUnavailable()) {
+    log.error(`${tag} provision failed (${took}): ${reason} \xB7 releasing the claim to try again`);
+    await endJob(state, active, void 0);
+  } else {
+    log.error(`${tag} provision failed (${took}): ${reason} \xB7 ending job as failed`);
+    await endJob(state, active, "failed", { stage: "provision", reason });
+  }
+}
 function installCommitHooks(job, log, tag) {
   const identity = job.commitIdentity;
   if (identity?.coAuthor === void 0) return;
@@ -1960,7 +1972,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-HWYLSMEL.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-VJRJ2KQ4.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-PK5NANMT.js → chunk-YT35WGIP.js}

@@ -22381,15 +22381,17 @@ var FindingBatchSchema = external_exports.object({
     }
   });
 });
-var WORK_ITEM_COMMENT_ACTIONS = ["pass", "fail", "attach", "ready"];
+var WORK_ITEM_COMMENT_ACTIONS = ["pass", "fail", "attach", "ready", "request"];
 var WORK_ITEM_COMMENT_MAX_BODY_LENGTH = 2e3;
+var REVIEW_SEND_ID_PATTERN = /^[A-Za-z0-9_.-]{1,100}$/;
 external_exports.object({
   clientCommentId: external_exports.string().min(1).max(128),
   criterion: ArtifactCriterionIdSchema.optional(),
   body: external_exports.string().max(WORK_ITEM_COMMENT_MAX_BODY_LENGTH).default(""),
   action: external_exports.enum(WORK_ITEM_COMMENT_ACTIONS).optional(),
   artifact: external_exports.string().min(1).max(128).optional(),
-  sessionId: external_exports.string().min(1).optional()
+  sessionId: external_exports.string().min(1).optional(),
+  reviewSendId: external_exports.string().regex(REVIEW_SEND_ID_PATTERN).optional()
 });
 var WORK_ITEM_REVIEW_NOTES_MAX = 50;
 var WorkItemReviewNoteSchema = external_exports.object({
@@ -22398,7 +22400,7 @@ var WorkItemReviewNoteSchema = external_exports.object({
 });
 external_exports.object({
   schemaVersion: external_exports.literal(1),
-  clientSendId: external_exports.string().regex(/^[A-Za-z0-9_.-]{1,100}$/),
+  clientSendId: external_exports.string().regex(REVIEW_SEND_ID_PATTERN),
   notes: external_exports.array(WorkItemReviewNoteSchema).min(1).max(WORK_ITEM_REVIEW_NOTES_MAX)
 });
 /*! Bundled license information:

package/dist/{chunk-DSPYQUH4.js → chunk-YU5GL7QS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-WLV4KCAW.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-NKU5OPYP.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-BGWTYRSS.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-TB7EP24C.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-BL63NBJZ.js → chunk-ZEQMTBRD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-PK5NANMT.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-YT35WGIP.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, existsSync, unlinkSync, readdirSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';