@rallycry/conveyor-agent 10.13.14 → 10.13.16

package/dist/{chunk-LZM5OKAC.js → chunk-UDSRAHKP.js}

@@ -6,7 +6,7 @@ import {
   DEFAULT_WORKBENCH_PORT,
   FrameReader,
   writeFrame
-} from "./chunk-VKZ5W2VO.js";
+} from "./chunk-JIGG755T.js";
 
 // src/workbench/client.ts
 import { connect } from "net";
@@ -89,6 +89,23 @@ var WorkbenchClient = class {
       );
     });
   }
+  /** One-shot poll of the workbench's git-prep state. A daemon without a
+   *  provider answers `ready` (non-pod servers must not wedge callers). */
+  gitStatus() {
+    return new Promise((resolve, reject) => {
+      let status = null;
+      this.open(
+        { op: "gitStatus" },
+        (frame) => {
+          if (frame.t === "gitStatus") status = frame;
+        },
+        (error) => {
+          if (status) resolve(status);
+          else reject(error ?? new WorkbenchError("connection closed before gitStatus"));
+        }
+      );
+    });
+  }
   /** Mirrors setup/commands.ts runSetupCommand (shell form, streamed output,
    *  abort → graceful term-group kill, non-zero exit rejects). */
   runSetupCommand(cmd, cwd, onOutput, signal) {
@@ -344,4 +361,4 @@ export {
   getWorkbenchClient,
   resetWorkbenchClient
 };
-//# sourceMappingURL=chunk-LZM5OKAC.js.map
+//# sourceMappingURL=chunk-UDSRAHKP.js.map

package/dist/chunk-UDSRAHKP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/workbench/client.ts","../src/workbench/errors.ts","../src/workbench/remote-process.ts"],"sourcesContent":["/**\n * Client half of the workbench launcher protocol. Runs in the protected agent\n * container; every method opens one loopback connection, sends the request\n * frame, and adapts the stream back to the local signature it replaces\n * (runSetupCommand, runStartCommand, execFile, PtySpawn, workspace file\n * reads). See server.ts / protocol.ts.\n */\n\nimport { connect, type Socket } from \"node:net\";\nimport type { PtyProcess, PtySpawnOptions } from \"../harness/pty/pty-support.js\";\nimport { WorkbenchError } from \"./errors.js\";\nimport { RemoteProcessHandle } from \"./remote-process.js\";\n\nexport { WorkbenchError } from \"./errors.js\";\nexport { RemoteProcessHandle } from \"./remote-process.js\";\nimport { workbenchPort, workbenchToken } from \"./mode.js\";\nimport {\n  DEFAULT_WORKBENCH_PORT,\n  FrameReader,\n  writeFrame,\n  type GitStatusFrame,\n  type WorkbenchFrame,\n  type WorkbenchRequest,\n} from \"./protocol.js\";\n\nexport interface WorkbenchClientOptions {\n  port?: number;\n  token?: string;\n  host?: string;\n}\n\n/** Omit that distributes over a discriminated union (plain Omit collapses\n *  the union to its common properties). */\ntype DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never;\n\nfunction frameError(frame: Extract<WorkbenchFrame, { t: \"error\" }>): WorkbenchError {\n  return new WorkbenchError(frame.message, frame.code);\n}\n\nexport class WorkbenchClient {\n  private readonly port: number;\n  private readonly host: string;\n  private readonly token: string;\n\n  constructor(options: WorkbenchClientOptions = {}) {\n    this.port = options.port ?? workbenchPort() ?? DEFAULT_WORKBENCH_PORT;\n    this.host = options.host ?? \"127.0.0.1\";\n    this.token = options.token ?? workbenchToken();\n  }\n\n  /** Open a connection, send the request, route response frames. */\n  private open(\n    request: DistributiveOmit<WorkbenchRequest, \"token\">,\n    onFrame: (frame: WorkbenchFrame, socket: Socket) => void,\n    onClose: (error?: Error) => void,\n  ): Socket {\n    const socket = connect(this.port, this.host);\n    let sawError: Error | undefined;\n    const reader = new FrameReader((raw) => {\n      const frame = raw as unknown as WorkbenchFrame;\n      if (frame.t === \"error\") {\n        sawError = frameError(frame as Extract<WorkbenchFrame, { t: \"error\" }>);\n      }\n      onFrame(frame, socket);\n    });\n    socket.on(\"connect\", () => {\n      writeFrame(socket, { ...request, token: this.token } as WorkbenchRequest);\n    });\n    socket.on(\"data\", (chunk) => reader.push(chunk));\n    socket.on(\"error\", (err) => {\n      sawError ??= err;\n    });\n    socket.on(\"close\", () => onClose(sawError));\n    return socket;\n  }\n\n  ping(): Promise<string> {\n    return new Promise((resolve, reject) => {\n      let version: string | null = null;\n      this.open(\n        { op: \"ping\" },\n        (frame) => {\n          if (frame.t === \"pong\") version = frame.version;\n        },\n        (error) => {\n          if (version === null) {\n            reject(error ?? new WorkbenchError(\"connection closed before pong\"));\n          } else {\n            resolve(version);\n          }\n        },\n      );\n    });\n  }\n\n  /** One-shot poll of the workbench's git-prep state. A daemon without a\n   *  provider answers `ready` (non-pod servers must not wedge callers). */\n  gitStatus(): Promise<GitStatusFrame> {\n    return new Promise((resolve, reject) => {\n      let status: GitStatusFrame | null = null;\n      this.open(\n        { op: \"gitStatus\" },\n        (frame) => {\n          if (frame.t === \"gitStatus\") status = frame;\n        },\n        (error) => {\n          if (status) resolve(status);\n          else reject(error ?? new WorkbenchError(\"connection closed before gitStatus\"));\n        },\n      );\n    });\n  }\n\n  /** Mirrors setup/commands.ts runSetupCommand (shell form, streamed output,\n   *  abort → graceful term-group kill, non-zero exit rejects). */\n  runSetupCommand(\n    cmd: string,\n    cwd: string,\n    onOutput: (stream: \"stdout\" | \"stderr\", data: string) => void,\n    signal?: AbortSignal,\n  ): Promise<void> {\n    return new Promise((resolve, reject) => {\n      if (signal?.aborted) {\n        const error = new Error(\"Operation aborted\");\n        error.name = \"AbortError\";\n        reject(error);\n        return;\n      }\n      let exitCode: number | null = null;\n      let exited = false;\n      let aborting = false;\n      const socket = this.open(\n        { op: \"exec\", command: cmd, cwd },\n        (frame) => {\n          if (frame.t === \"out\" && !aborting) {\n            onOutput(frame.s, Buffer.from(frame.d, \"base64\").toString(\"utf8\"));\n          } else if (frame.t === \"exit\") {\n            exited = true;\n            exitCode = frame.code;\n          }\n        },\n        (error) => {\n          signal?.removeEventListener(\"abort\", onAbort);\n          if (aborting) {\n            const abortError = new Error(\"Operation aborted\");\n            abortError.name = \"AbortError\";\n            reject(abortError);\n          } else if (!exited) {\n            reject(error ?? new WorkbenchError(\"connection closed before exit\"));\n          } else if (exitCode === 0) {\n            resolve();\n          } else {\n            reject(new Error(`Setup command exited with code ${exitCode}`));\n          }\n        },\n      );\n      const onAbort = (): void => {\n        if (exited || aborting) return;\n        aborting = true;\n        writeFrame(socket, { t: \"signal\", mode: \"term-group\" });\n      };\n      signal?.addEventListener(\"abort\", onAbort, { once: true });\n    });\n  }\n\n  /** Mirrors setup/commands.ts runStartCommand: returns a live handle that\n   *  emits exit/error and whose kill() runs the graceful term-group stop. */\n  runStartCommand(\n    cmd: string,\n    cwd: string,\n    onOutput: (stream: \"stdout\" | \"stderr\", data: string) => void,\n  ): RemoteProcessHandle {\n    let socket: Socket | undefined;\n    const handle = new RemoteProcessHandle(() => {\n      if (socket) writeFrame(socket, { t: \"signal\", mode: \"term-group\" });\n    });\n    let exited = false;\n    socket = this.open(\n      { op: \"exec\", command: cmd, cwd },\n      (frame) => {\n        if (frame.t === \"out\") {\n          onOutput(frame.s, Buffer.from(frame.d, \"base64\").toString(\"utf8\"));\n        } else if (frame.t === \"exit\") {\n          exited = true;\n          handle.exitCode = frame.code ?? (frame.signal ? null : 0);\n          handle.emit(\"exit\", frame.code, frame.signal);\n        }\n      },\n      (error) => {\n        if (!exited) {\n          // Connection died without an exit frame (launcher restart, network\n          // teardown): surface as an error + synthetic exit so the supervisor\n          // observes the process ending rather than hanging on it forever.\n          exited = true;\n          handle.exitCode = handle.exitCode ?? 1;\n          handle.emit(\n            \"error\",\n            error ?? new WorkbenchError(\"workbench connection lost\", \"workbench_gone\"),\n          );\n          handle.emit(\"exit\", handle.exitCode, null);\n        }\n      },\n    );\n    return handle;\n  }\n\n  /** Mirrors promisified execFile (argv form, no shell): resolves stdout,\n   *  rejects with stderr-bearing error on non-zero exit. */\n  execFile(\n    file: string,\n    args: string[],\n    opts: { cwd?: string; timeout?: number; maxBuffer?: number } = {},\n  ): Promise<{ stdout: string; stderr: string }> {\n    return new Promise((resolve, reject) => {\n      const stdout: Buffer[] = [];\n      const stderr: Buffer[] = [];\n      let exitCode: number | null = null;\n      let exitSignal: string | null = null;\n      let exited = false;\n      let timedOut = false;\n      const socket = this.open(\n        { op: \"exec\", argv: [file, ...args], cwd: opts.cwd ?? process.cwd() },\n        (frame) => {\n          if (frame.t === \"out\") {\n            (frame.s === \"stdout\" ? stdout : stderr).push(Buffer.from(frame.d, \"base64\"));\n          } else if (frame.t === \"exit\") {\n            exited = true;\n            exitCode = frame.code;\n            exitSignal = frame.signal;\n          }\n        },\n        (error) => {\n          if (timer) clearTimeout(timer);\n          const out = Buffer.concat(stdout).toString(\"utf8\");\n          const errText = Buffer.concat(stderr).toString(\"utf8\");\n          if (!exited) {\n            reject(error ?? new WorkbenchError(\"connection closed before exit\"));\n          } else if (exitCode === 0) {\n            resolve({ stdout: out, stderr: errText });\n          } else {\n            const failure = new Error(\n              timedOut\n                ? `Command timed out: ${file}`\n                : `Command failed: ${file} ${args.join(\" \")}\\n${errText}`,\n            ) as Error & {\n              code?: number | null;\n              signal?: string | null;\n              stdout: string;\n              stderr: string;\n            };\n            failure.code = exitCode;\n            failure.signal = exitSignal;\n            failure.stdout = out;\n            failure.stderr = errText;\n            reject(failure);\n          }\n        },\n      );\n      const timer = opts.timeout\n        ? setTimeout(() => {\n            timedOut = true;\n            writeFrame(socket, { t: \"signal\", mode: \"term-group\" });\n          }, opts.timeout)\n        : null;\n      timer?.unref();\n    });\n  }\n\n  /**\n   * Synchronous PtySpawn adapter: returns a PtyProcess immediately; writes\n   * and resizes are queued until the connection opens. Exit surfaces through\n   * onExit exactly as node-pty's would (a lost connection = exit code 1 —\n   * the session's finalizeOnExit path treats it as a crashed CLI).\n   */\n  spawnPty(file: string, args: string[], options: PtySpawnOptions): PtyProcess {\n    const dataListeners: Array<(data: string) => void> = [];\n    const exitListeners: Array<(event: { exitCode: number }) => void> = [];\n    let connected = false;\n    let exited = false;\n    const preConnectQueue: WorkbenchFrame[] = [];\n\n    const socket = this.open(\n      {\n        op: \"pty\",\n        file,\n        args,\n        cwd: options.cwd,\n        env: options.env,\n        cols: options.cols,\n        rows: options.rows,\n      },\n      (frame) => {\n        if (frame.t === \"data\") {\n          const text = Buffer.from(frame.d, \"base64\").toString(\"utf8\");\n          for (const listener of dataListeners) listener(text);\n        } else if (frame.t === \"exit\") {\n          exited = true;\n          for (const listener of exitListeners) listener({ exitCode: frame.code ?? 1 });\n        }\n      },\n      () => {\n        if (!exited) {\n          exited = true;\n          for (const listener of exitListeners) listener({ exitCode: 1 });\n        }\n      },\n    );\n    socket.on(\"connect\", () => {\n      connected = true;\n      for (const frame of preConnectQueue.splice(0)) writeFrame(socket, frame);\n    });\n\n    const send = (frame: WorkbenchFrame): void => {\n      if (exited) return;\n      if (connected) writeFrame(socket, frame);\n      else preConnectQueue.push(frame);\n    };\n\n    return {\n      onData: (listener) => dataListeners.push(listener),\n      onExit: (listener) => exitListeners.push(listener),\n      write: (data) => send({ t: \"input\", d: Buffer.from(data, \"utf8\").toString(\"base64\") }),\n      resize: (cols, rows) => send({ t: \"resize\", cols, rows }),\n      kill: (sig) => send({ t: \"kill\", ...(sig ? { sig } : {}) }),\n    };\n  }\n\n  readFile(path: string): Promise<Buffer> {\n    return new Promise((resolve, reject) => {\n      const chunks: Buffer[] = [];\n      let ended = false;\n      this.open(\n        { op: \"readFile\", path },\n        (frame) => {\n          if (frame.t === \"data\") chunks.push(Buffer.from(frame.d, \"base64\"));\n          else if (frame.t === \"end\") ended = true;\n        },\n        (error) => {\n          if (ended) resolve(Buffer.concat(chunks));\n          else reject(error ?? new WorkbenchError(\"connection closed before end\"));\n        },\n      );\n    });\n  }\n\n  stat(path: string): Promise<{\n    exists: boolean;\n    isFile: boolean;\n    isDirectory: boolean;\n    size: number;\n    mtimeMs: number;\n  }> {\n    return new Promise((resolve, reject) => {\n      let stat: {\n        exists: boolean;\n        isFile: boolean;\n        isDirectory: boolean;\n        size: number;\n        mtimeMs: number;\n      } | null = null;\n      this.open(\n        { op: \"stat\", path },\n        (frame) => {\n          if (frame.t === \"stat\") {\n            stat = {\n              exists: frame.exists,\n              isFile: frame.isFile,\n              isDirectory: frame.isDirectory,\n              size: frame.size,\n              mtimeMs: frame.mtimeMs,\n            };\n          }\n        },\n        (error) => {\n          if (stat) resolve(stat);\n          else reject(error ?? new WorkbenchError(\"connection closed before stat\"));\n        },\n      );\n    });\n  }\n\n  readdir(path: string): Promise<string[]> {\n    return new Promise((resolve, reject) => {\n      let entries: string[] | null = null;\n      this.open(\n        { op: \"readdir\", path },\n        (frame) => {\n          if (frame.t === \"entries\") entries = frame.names;\n        },\n        (error) => {\n          if (entries) resolve(entries);\n          else reject(error ?? new WorkbenchError(\"connection closed before entries\"));\n        },\n      );\n    });\n  }\n}\n\nlet singleton: WorkbenchClient | null = null;\n\n/** Lazy env-configured client (split-mode pods). */\nexport function getWorkbenchClient(): WorkbenchClient {\n  singleton ??= new WorkbenchClient();\n  return singleton;\n}\n\n/** Test seam. */\nexport function resetWorkbenchClient(): void {\n  singleton = null;\n}\n","/** Error surfaced by the workbench client for launcher-side failures; `code`\n *  carries the remote error code (e.g. \"ENOENT\", \"unauthorized\") so callers'\n *  existing errno handling keeps working across the container boundary. */\nexport class WorkbenchError extends Error {\n  code?: string;\n  constructor(message: string, code?: string) {\n    super(message);\n    this.name = \"WorkbenchError\";\n    if (code) this.code = code;\n  }\n}\n","import { EventEmitter } from \"node:events\";\n\n/**\n * Structural stand-in for the ChildProcess surface the workspace-command\n * supervisor actually uses (pid/exitCode/kill + exit/error events) — see\n * ManagedChildProcess in setup/commands.ts. kill() requests the launcher's\n * graceful term-group sequence regardless of the signal argument.\n */\nexport class RemoteProcessHandle extends EventEmitter {\n  pid: number | undefined = undefined;\n  exitCode: number | null = null;\n\n  constructor(private readonly sendSignal: () => void) {\n    super();\n  }\n\n  kill(_signal?: NodeJS.Signals | number): boolean {\n    this.sendSignal();\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;;;AAQA,SAAS,eAA4B;;;ACL9B,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC;AAAA,EACA,YAAY,SAAiB,MAAe;AAC1C,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,QAAI,KAAM,MAAK,OAAO;AAAA,EACxB;AACF;;;ACVA,SAAS,oBAAoB;AAQtB,IAAM,sBAAN,cAAkC,aAAa;AAAA,EAIpD,YAA6B,YAAwB;AACnD,UAAM;AADqB;AAAA,EAE7B;AAAA,EAF6B;AAAA,EAH7B,MAA0B;AAAA,EAC1B,WAA0B;AAAA,EAM1B,KAAK,SAA4C;AAC/C,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AACF;;;AFeA,SAAS,WAAW,OAAgE;AAClF,SAAO,IAAI,eAAe,MAAM,SAAS,MAAM,IAAI;AACrD;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACV;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,UAAkC,CAAC,GAAG;AAChD,SAAK,OAAO,QAAQ,QAAQ,cAAc,KAAK;AAC/C,SAAK,OAAO,QAAQ,QAAQ;AAC5B,SAAK,QAAQ,QAAQ,SAAS,eAAe;AAAA,EAC/C;AAAA;AAAA,EAGQ,KACN,SACA,SACA,SACQ;AACR,UAAM,SAAS,QAAQ,KAAK,MAAM,KAAK,IAAI;AAC3C,QAAI;AACJ,UAAM,SAAS,IAAI,YAAY,CAAC,QAAQ;AACtC,YAAM,QAAQ;AACd,UAAI,MAAM,MAAM,SAAS;AACvB,mBAAW,WAAW,KAAgD;AAAA,MACxE;AACA,cAAQ,OAAO,MAAM;AAAA,IACvB,CAAC;AACD,WAAO,GAAG,WAAW,MAAM;AACzB,iBAAW,QAAQ,EAAE,GAAG,SAAS,OAAO,KAAK,MAAM,CAAqB;AAAA,IAC1E,CAAC;AACD,WAAO,GAAG,QAAQ,CAAC,UAAU,OAAO,KAAK,KAAK,CAAC;AAC/C,WAAO,GAAG,SAAS,CAAC,QAAQ;AAC1B,mBAAa;AAAA,IACf,CAAC;AACD,WAAO,GAAG,SAAS,MAAM,QAAQ,QAAQ,CAAC;AAC1C,WAAO;AAAA,EACT;AAAA,EAEA,OAAwB;AACtB,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,UAAyB;AAC7B,WAAK;AAAA,QACH,EAAE,IAAI,OAAO;AAAA,QACb,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,OAAQ,WAAU,MAAM;AAAA,QAC1C;AAAA,QACA,CAAC,UAAU;AACT,cAAI,YAAY,MAAM;AACpB,mBAAO,SAAS,IAAI,eAAe,+BAA+B,CAAC;AAAA,UACrE,OAAO;AACL,oBAAQ,OAAO;AAAA,UACjB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,YAAqC;AACnC,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,SAAgC;AACpC,WAAK;AAAA,QACH,EAAE,IAAI,YAAY;AAAA,QAClB,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,YAAa,UAAS;AAAA,QACxC;AAAA,QACA,CAAC,UAAU;AACT,cAAI,OAAQ,SAAQ,MAAM;AAAA,cACrB,QAAO,SAAS,IAAI,eAAe,oCAAoC,CAAC;AAAA,QAC/E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,gBACE,KACA,KACA,UACA,QACe;AACf,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,QAAQ,SAAS;AACnB,cAAM,QAAQ,IAAI,MAAM,mBAAmB;AAC3C,cAAM,OAAO;AACb,eAAO,KAAK;AACZ;AAAA,MACF;AACA,UAAI,WAA0B;AAC9B,UAAI,SAAS;AACb,UAAI,WAAW;AACf,YAAM,SAAS,KAAK;AAAA,QAClB,EAAE,IAAI,QAAQ,SAAS,KAAK,IAAI;AAAA,QAChC,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,SAAS,CAAC,UAAU;AAClC,qBAAS,MAAM,GAAG,OAAO,KAAK,MAAM,GAAG,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,UACnE,WAAW,MAAM,MAAM,QAAQ;AAC7B,qBAAS;AACT,uBAAW,MAAM;AAAA,UACnB;AAAA,QACF;AAAA,QACA,CAAC,UAAU;AACT,kBAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAI,UAAU;AACZ,kBAAM,aAAa,IAAI,MAAM,mBAAmB;AAChD,uBAAW,OAAO;AAClB,mBAAO,UAAU;AAAA,UACnB,WAAW,CAAC,QAAQ;AAClB,mBAAO,SAAS,IAAI,eAAe,+BAA+B,CAAC;AAAA,UACrE,WAAW,aAAa,GAAG;AACzB,oBAAQ;AAAA,UACV,OAAO;AACL,mBAAO,IAAI,MAAM,kCAAkC,QAAQ,EAAE,CAAC;AAAA,UAChE;AAAA,QACF;AAAA,MACF;AACA,YAAM,UAAU,MAAY;AAC1B,YAAI,UAAU,SAAU;AACxB,mBAAW;AACX,mBAAW,QAAQ,EAAE,GAAG,UAAU,MAAM,aAAa,CAAC;AAAA,MACxD;AACA,cAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IAC3D,CAAC;AAAA,EACH;AAAA;AAAA;AAAA,EAIA,gBACE,KACA,KACA,UACqB;AACrB,QAAI;AACJ,UAAM,SAAS,IAAI,oBAAoB,MAAM;AAC3C,UAAI,OAAQ,YAAW,QAAQ,EAAE,GAAG,UAAU,MAAM,aAAa,CAAC;AAAA,IACpE,CAAC;AACD,QAAI,SAAS;AACb,aAAS,KAAK;AAAA,MACZ,EAAE,IAAI,QAAQ,SAAS,KAAK,IAAI;AAAA,MAChC,CAAC,UAAU;AACT,YAAI,MAAM,MAAM,OAAO;AACrB,mBAAS,MAAM,GAAG,OAAO,KAAK,MAAM,GAAG,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,QACnE,WAAW,MAAM,MAAM,QAAQ;AAC7B,mBAAS;AACT,iBAAO,WAAW,MAAM,SAAS,MAAM,SAAS,OAAO;AACvD,iBAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,MAAM;AAAA,QAC9C;AAAA,MACF;AAAA,MACA,CAAC,UAAU;AACT,YAAI,CAAC,QAAQ;AAIX,mBAAS;AACT,iBAAO,WAAW,OAAO,YAAY;AACrC,iBAAO;AAAA,YACL;AAAA,YACA,SAAS,IAAI,eAAe,6BAA6B,gBAAgB;AAAA,UAC3E;AACA,iBAAO,KAAK,QAAQ,OAAO,UAAU,IAAI;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,SACE,MACA,MACA,OAA+D,CAAC,GACnB;AAC7C,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,SAAmB,CAAC;AAC1B,YAAM,SAAmB,CAAC;AAC1B,UAAI,WAA0B;AAC9B,UAAI,aAA4B;AAChC,UAAI,SAAS;AACb,UAAI,WAAW;AACf,YAAM,SAAS,KAAK;AAAA,QAClB,EAAE,IAAI,QAAQ,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,KAAK,KAAK,OAAO,QAAQ,IAAI,EAAE;AAAA,QACpE,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,OAAO;AACrB,aAAC,MAAM,MAAM,WAAW,SAAS,QAAQ,KAAK,OAAO,KAAK,MAAM,GAAG,QAAQ,CAAC;AAAA,UAC9E,WAAW,MAAM,MAAM,QAAQ;AAC7B,qBAAS;AACT,uBAAW,MAAM;AACjB,yBAAa,MAAM;AAAA,UACrB;AAAA,QACF;AAAA,QACA,CAAC,UAAU;AACT,cAAI,MAAO,cAAa,KAAK;AAC7B,gBAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACjD,gBAAM,UAAU,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACrD,cAAI,CAAC,QAAQ;AACX,mBAAO,SAAS,IAAI,eAAe,+BAA+B,CAAC;AAAA,UACrE,WAAW,aAAa,GAAG;AACzB,oBAAQ,EAAE,QAAQ,KAAK,QAAQ,QAAQ,CAAC;AAAA,UAC1C,OAAO;AACL,kBAAM,UAAU,IAAI;AAAA,cAClB,WACI,sBAAsB,IAAI,KAC1B,mBAAmB,IAAI,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,EAAK,OAAO;AAAA,YAC3D;AAMA,oBAAQ,OAAO;AACf,oBAAQ,SAAS;AACjB,oBAAQ,SAAS;AACjB,oBAAQ,SAAS;AACjB,mBAAO,OAAO;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AACA,YAAM,QAAQ,KAAK,UACf,WAAW,MAAM;AACf,mBAAW;AACX,mBAAW,QAAQ,EAAE,GAAG,UAAU,MAAM,aAAa,CAAC;AAAA,MACxD,GAAG,KAAK,OAAO,IACf;AACJ,aAAO,MAAM;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,MAAc,MAAgB,SAAsC;AAC3E,UAAM,gBAA+C,CAAC;AACtD,UAAM,gBAA8D,CAAC;AACrE,QAAI,YAAY;AAChB,QAAI,SAAS;AACb,UAAM,kBAAoC,CAAC;AAE3C,UAAM,SAAS,KAAK;AAAA,MAClB;AAAA,QACE,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,KAAK,QAAQ;AAAA,QACb,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ;AAAA,MAChB;AAAA,MACA,CAAC,UAAU;AACT,YAAI,MAAM,MAAM,QAAQ;AACtB,gBAAM,OAAO,OAAO,KAAK,MAAM,GAAG,QAAQ,EAAE,SAAS,MAAM;AAC3D,qBAAW,YAAY,cAAe,UAAS,IAAI;AAAA,QACrD,WAAW,MAAM,MAAM,QAAQ;AAC7B,mBAAS;AACT,qBAAW,YAAY,cAAe,UAAS,EAAE,UAAU,MAAM,QAAQ,EAAE,CAAC;AAAA,QAC9E;AAAA,MACF;AAAA,MACA,MAAM;AACJ,YAAI,CAAC,QAAQ;AACX,mBAAS;AACT,qBAAW,YAAY,cAAe,UAAS,EAAE,UAAU,EAAE,CAAC;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,WAAO,GAAG,WAAW,MAAM;AACzB,kBAAY;AACZ,iBAAW,SAAS,gBAAgB,OAAO,CAAC,EAAG,YAAW,QAAQ,KAAK;AAAA,IACzE,CAAC;AAED,UAAM,OAAO,CAAC,UAAgC;AAC5C,UAAI,OAAQ;AACZ,UAAI,UAAW,YAAW,QAAQ,KAAK;AAAA,UAClC,iBAAgB,KAAK,KAAK;AAAA,IACjC;AAEA,WAAO;AAAA,MACL,QAAQ,CAAC,aAAa,cAAc,KAAK,QAAQ;AAAA,MACjD,QAAQ,CAAC,aAAa,cAAc,KAAK,QAAQ;AAAA,MACjD,OAAO,CAAC,SAAS,KAAK,EAAE,GAAG,SAAS,GAAG,OAAO,KAAK,MAAM,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;AAAA,MACrF,QAAQ,CAAC,MAAM,SAAS,KAAK,EAAE,GAAG,UAAU,MAAM,KAAK,CAAC;AAAA,MACxD,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG,QAAQ,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC,EAAG,CAAC;AAAA,IAC5D;AAAA,EACF;AAAA,EAEA,SAAS,MAA+B;AACtC,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,SAAmB,CAAC;AAC1B,UAAI,QAAQ;AACZ,WAAK;AAAA,QACH,EAAE,IAAI,YAAY,KAAK;AAAA,QACvB,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,OAAQ,QAAO,KAAK,OAAO,KAAK,MAAM,GAAG,QAAQ,CAAC;AAAA,mBACzD,MAAM,MAAM,MAAO,SAAQ;AAAA,QACtC;AAAA,QACA,CAAC,UAAU;AACT,cAAI,MAAO,SAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,cACnC,QAAO,SAAS,IAAI,eAAe,8BAA8B,CAAC;AAAA,QACzE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,KAAK,MAMF;AACD,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,OAMO;AACX,WAAK;AAAA,QACH,EAAE,IAAI,QAAQ,KAAK;AAAA,QACnB,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,QAAQ;AACtB,mBAAO;AAAA,cACL,QAAQ,MAAM;AAAA,cACd,QAAQ,MAAM;AAAA,cACd,aAAa,MAAM;AAAA,cACnB,MAAM,MAAM;AAAA,cACZ,SAAS,MAAM;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AAAA,QACA,CAAC,UAAU;AACT,cAAI,KAAM,SAAQ,IAAI;AAAA,cACjB,QAAO,SAAS,IAAI,eAAe,+BAA+B,CAAC;AAAA,QAC1E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,MAAiC;AACvC,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,UAA2B;AAC/B,WAAK;AAAA,QACH,EAAE,IAAI,WAAW,KAAK;AAAA,QACtB,CAAC,UAAU;AACT,cAAI,MAAM,MAAM,UAAW,WAAU,MAAM;AAAA,QAC7C;AAAA,QACA,CAAC,UAAU;AACT,cAAI,QAAS,SAAQ,OAAO;AAAA,cACvB,QAAO,SAAS,IAAI,eAAe,kCAAkC,CAAC;AAAA,QAC7E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,IAAI,YAAoC;AAGjC,SAAS,qBAAsC;AACpD,gBAAc,IAAI,gBAAgB;AAClC,SAAO;AACT;AAGO,SAAS,uBAA6B;AAC3C,cAAY;AACd;","names":[]}

package/dist/chunk-UZTJJD7Y.js

@@ -0,0 +1,254 @@
+// src/runner/session-runner-helpers.ts
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function mapChatHistory(messages) {
+  if (!messages) return [];
+  return messages.map((m) => ({
+    id: m.id,
+    role: m.role ?? "user",
+    content: m.content ?? "",
+    userId: m.userId,
+    userName: m.user?.name ?? void 0,
+    createdAt: m.createdAt,
+    ...m.files && m.files.length > 0 ? {
+      files: m.files.map((f) => ({
+        fileId: f.id,
+        fileName: f.fileName,
+        mimeType: f.mimeType,
+        fileSize: f.fileSize,
+        downloadUrl: f.downloadUrl ?? "",
+        content: f.content,
+        contentEncoding: f.contentEncoding
+      }))
+    } : {}
+  }));
+}
+function readAgentVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    for (const rel of ["../package.json", "../../package.json"]) {
+      try {
+        const pkg = JSON.parse(readFileSync(join(here, rel), "utf-8"));
+        if (pkg.version) return pkg.version;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+
+// src/boot/git-prep.ts
+import { execFile } from "child_process";
+import { existsSync, mkdirSync } from "fs";
+import { join as join2 } from "path";
+import { promisify } from "util";
+var QUICK_GIT_TIMEOUT_MS = 6e4;
+var FETCH_TIMEOUT_MS = 3e5;
+var CLONE_TIMEOUT_MS = 6e5;
+var execFileAsync = promisify(execFile);
+function ensureDir(dir) {
+  mkdirSync(dir, { recursive: true });
+}
+function defaultGit(args, opts = {}) {
+  return execFileAsync("git", args, {
+    cwd: opts.cwd,
+    timeout: opts.timeoutMs ?? QUICK_GIT_TIMEOUT_MS,
+    maxBuffer: 10 * 1024 * 1024
+  });
+}
+function redactToken(text) {
+  return text.replace(/x-access-token:[^@]*@/g, "x-access-token:***@");
+}
+function errText(err) {
+  return redactToken(err instanceof Error ? err.message : String(err));
+}
+async function syncTaskBranchToRepo(deps, paths) {
+  const { git, log } = deps;
+  const { branch, baseBranch } = deps.bundle.gitPlan;
+  try {
+    await git(["remote", "set-url", "origin", paths.remoteUrl], {
+      cwd: paths.repoDir,
+      timeoutMs: QUICK_GIT_TIMEOUT_MS
+    });
+  } catch (err) {
+    log.error(`[boot] ERROR: remote set-url failed: ${errText(err)}`);
+    return { state: "failed", reason: "remote set-url failed" };
+  }
+  try {
+    await git(["fetch", "origin", `+refs/heads/${baseBranch}:refs/remotes/origin/${baseBranch}`], {
+      cwd: paths.repoDir,
+      timeoutMs: FETCH_TIMEOUT_MS
+    });
+  } catch (err) {
+    log.warn(`[boot] WARN: fetch origin/${baseBranch} failed: ${errText(err)}`);
+  }
+  try {
+    await git(["reset", "--hard", "HEAD"], { cwd: paths.repoDir, timeoutMs: QUICK_GIT_TIMEOUT_MS });
+  } catch (err) {
+    log.error(
+      `[boot] ERROR: failed to clean tracked repo changes before checkout: ${errText(err)}`
+    );
+    return { state: "failed", reason: "pre-checkout reset failed" };
+  }
+  log.info(`[boot] Repo remote ready; agent will checkout ${branch}`);
+  return { state: "ready" };
+}
+async function clonePostAssignment(deps, paths) {
+  const { git, log } = deps;
+  const { branch, baseBranch, checkoutRef } = deps.bundle.gitPlan;
+  log.info("[boot] Cloning repo post-assignment (pre-clone was missing)...");
+  if (checkoutRef) {
+    try {
+      await git(
+        [
+          "clone",
+          "--depth",
+          "1",
+          "--single-branch",
+          "--branch",
+          baseBranch,
+          paths.remoteUrl,
+          "repo"
+        ],
+        { cwd: paths.workspacesDir, timeoutMs: CLONE_TIMEOUT_MS }
+      );
+    } catch (err) {
+      log.error(`[boot] ERROR: post-assignment clone failed: ${errText(err)}`);
+      return { state: "failed", reason: "post-assignment clone failed" };
+    }
+    try {
+      await git(["fetch", "origin", `+${checkoutRef}:refs/remotes/origin/pr-checkout`], {
+        cwd: paths.repoDir,
+        timeoutMs: FETCH_TIMEOUT_MS
+      });
+    } catch (err) {
+      log.error(`[boot] ERROR: post-assignment fetch of ${checkoutRef} failed: ${errText(err)}`);
+      return { state: "failed", reason: `post-assignment fetch of ${checkoutRef} failed` };
+    }
+    try {
+      await git(["checkout", "-f", "-B", branch, "refs/remotes/origin/pr-checkout"], {
+        cwd: paths.repoDir,
+        timeoutMs: QUICK_GIT_TIMEOUT_MS
+      });
+    } catch (err) {
+      log.error(`[boot] ERROR: post-assignment checkout of ${checkoutRef} failed: ${errText(err)}`);
+      return { state: "failed", reason: `post-assignment checkout of ${checkoutRef} failed` };
+    }
+    return { state: "ready" };
+  }
+  try {
+    await git(["clone", "--single-branch", "--branch", baseBranch, paths.remoteUrl, "repo"], {
+      cwd: paths.workspacesDir,
+      timeoutMs: CLONE_TIMEOUT_MS
+    });
+  } catch (err) {
+    log.error(
+      `[boot] ERROR: post-assignment clone of base '${baseBranch}' failed: ${errText(err)}`
+    );
+    return { state: "failed", reason: "post-assignment clone failed" };
+  }
+  return syncTaskBranchToRepo(deps, paths);
+}
+async function prepareWorkspaceGit(deps) {
+  const { bundle, log } = deps;
+  const workspacesDir = deps.workspacesDir ?? "/workspaces";
+  const repoDir = join2(workspacesDir, "repo");
+  const { repoOwner, repoName, branch } = bundle.gitPlan;
+  const token = bundle.githubToken;
+  const paths = {
+    workspacesDir,
+    repoDir,
+    remoteUrl: `https://x-access-token:${token}@github.com/${repoOwner}/${repoName}.git`
+  };
+  try {
+    if (existsSync(join2(repoDir, ".git")) && token) {
+      log.info(
+        deps.podImage ? `[boot] Pod image \u2014 updating repo to latest (branch=${branch})...` : `[boot] Repo present (non-pod-image) \u2014 updating repo to latest (branch=${branch})...`
+      );
+      return await syncTaskBranchToRepo(deps, paths);
+    }
+    if (token && repoOwner && repoName && branch) {
+      try {
+        mkdirSync(workspacesDir, { recursive: true });
+      } catch {
+      }
+      return await clonePostAssignment(deps, paths);
+    }
+    log.info("[boot] No git plan to prepare \u2014 marking git ready.");
+    return { state: "ready" };
+  } catch (err) {
+    log.error(`[boot] ERROR: git prep failed unexpectedly: ${errText(err)}`);
+    return { state: "failed", reason: "git prep failed unexpectedly" };
+  }
+}
+var GIT_PREP_MAX_RETRIES = 3;
+var DEFAULT_RETRY_DELAY_MS = 1e4;
+var GitPrepJob = class {
+  constructor(deps, extras) {
+    this.deps = deps;
+    this.extras = extras;
+  }
+  deps;
+  extras;
+  current = { state: "pending" };
+  started = false;
+  get status() {
+    return this.current;
+  }
+  /** Kick off the background attempts. Idempotent. */
+  start() {
+    if (this.started) return;
+    this.started = true;
+    void this.run();
+  }
+  async run() {
+    const { log } = this.deps;
+    const retryDelayMs = this.extras.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
+    for (let attempt = 1; attempt <= GIT_PREP_MAX_RETRIES; attempt++) {
+      const result = await prepareWorkspaceGit(this.deps);
+      if (result.state === "ready") {
+        try {
+          await this.extras.onReady();
+        } catch (err) {
+          log.warn(`[boot] WARN: pre-ready binds failed: ${errText(err)}`);
+        }
+        this.current = { state: "ready" };
+        try {
+          await this.extras.afterReady();
+        } catch (err) {
+          log.warn(`[boot] WARN: post-ready work failed: ${errText(err)}`);
+        }
+        return;
+      }
+      if (attempt >= GIT_PREP_MAX_RETRIES) {
+        log.error(
+          `[boot] workbench git prep failed ${GIT_PREP_MAX_RETRIES} times \u2014 giving up (agent surfaces the failure).`
+        );
+        this.current = result;
+        return;
+      }
+      log.warn(
+        `[boot] workbench git prep failed \u2014 retrying (attempt ${attempt}/${GIT_PREP_MAX_RETRIES})...`
+      );
+      await new Promise((resolve) => {
+        setTimeout(resolve, retryDelayMs);
+      });
+    }
+  }
+};
+
+export {
+  mapChatHistory,
+  readAgentVersion,
+  FETCH_TIMEOUT_MS,
+  CLONE_TIMEOUT_MS,
+  ensureDir,
+  defaultGit,
+  redactToken,
+  GIT_PREP_MAX_RETRIES,
+  DEFAULT_RETRY_DELAY_MS,
+  GitPrepJob
+};
+//# sourceMappingURL=chunk-UZTJJD7Y.js.map

package/dist/chunk-UZTJJD7Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runner/session-runner-helpers.ts","../src/boot/git-prep.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { ChatMessage, TaskContextDTO } from \"@project/shared\";\n\nexport function mapChatHistory(\n  messages: TaskContextDTO[\"chatHistory\"] | undefined | null,\n): ChatMessage[] {\n  if (!messages) return [];\n  return messages.map((m) => ({\n    id: m.id,\n    role: (m.role ?? \"user\") as \"user\" | \"assistant\" | \"system\",\n    content: m.content ?? \"\",\n    userId: m.userId,\n    userName: m.user?.name ?? undefined,\n    createdAt: m.createdAt,\n    ...(m.files && m.files.length > 0\n      ? {\n          files: m.files.map((f) => ({\n            fileId: f.id,\n            fileName: f.fileName,\n            mimeType: f.mimeType,\n            fileSize: f.fileSize,\n            downloadUrl: f.downloadUrl ?? \"\",\n            content: f.content,\n            contentEncoding: f.contentEncoding,\n          })),\n        }\n      : {}),\n  }));\n}\n\n/** Read this agent's version from its bundled package.json. */\nexport function readAgentVersion(): string | null {\n  try {\n    const here = dirname(fileURLToPath(import.meta.url));\n    // Walk up: dist/runner/session-runner.js → dist/ → package.json\n    for (const rel of [\"../package.json\", \"../../package.json\"]) {\n      try {\n        const pkg = JSON.parse(readFileSync(join(here, rel), \"utf-8\")) as { version?: string };\n        if (pkg.version) return pkg.version;\n      } catch {\n        /* try next candidate */\n      }\n    }\n  } catch {\n    /* ignore */\n  }\n  return null;\n}\n","import { execFile } from \"node:child_process\";\nimport { existsSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport type { BootstrapBundle } from \"../setup/bootstrap-bundle-types.js\";\nimport type { BootLogger } from \"./types.js\";\n\n/**\n * Ports `prepare_workspace_git` + `sync_task_branch_to_repo` +\n * `reset_tracked_repo_changes_before_assignment_checkout`\n * (entrypoint.sh:623-829) and the workbench bounded retry loop\n * (entrypoint.sh:877-893). The bash signalled via marker files on the shared\n * emptyDir; vnext replaces the markers with daemon-owned state — `GitPrepJob`\n * holds it and the workbench daemon serves it over the `gitStatus` op.\n *\n * Contract carried from the old entrypoint-git-prep.test.ts (verbatim — the\n * agent side depends on it):\n * - `syncTaskBranchToRepo` NEVER touches BRANCH/CHECKOUT_REF and does NO\n *   merge. It refreshes the origin remote with the fresh installation token,\n *   warms `origin/<base>` (warn-only on failure — the ref may already be\n *   present from the bake), and resets tracked changes. The agent's\n *   `ensureOnTaskBranch` owns the authoritative checkout.\n * - Clone paths: with checkoutRef → depth-1 base clone, fetch the ref to\n *   refs/remotes/origin/pr-checkout, `checkout -f -B <branch>` onto it.\n *   Without → clone the BASE branch at FULL depth (a naive `--branch <task>`\n *   dies when the task branch was never pushed; `--depth 1` caused the\n *   \"refusing to merge unrelated histories\" incident), then sync.\n * - No git plan (empty token/owner/name/branch) → immediate ready.\n *\n * Every fallible git call is guarded — `prepareWorkspaceGit` NEVER throws\n * (the bash equivalent: every error path wrote the failed marker instead of\n * exiting the backgrounded subshell). Reasons stay the short bash marker\n * strings; redacted detail goes to the log.\n */\n\nexport type GitPrepState =\n  | { state: \"pending\" }\n  | { state: \"ready\" }\n  | { state: \"failed\"; reason: string };\n\n/** Async git runner — always `execFile` with a timeout, never execSync (a\n *  sync child freezes the event loop; see runner/git-utils.ts history). */\nexport type GitFn = (\n  args: string[],\n  opts?: { cwd?: string; timeoutMs?: number },\n) => Promise<{ stdout: string }>;\n\nexport interface GitPrepDeps {\n  git: GitFn;\n  bundle: BootstrapBundle;\n  /** env CONVEYOR_POD_IMAGE === \"1\" — log-line fidelity only; behavior matches. */\n  podImage: boolean;\n  /** default \"/workspaces\" */\n  workspacesDir?: string;\n  log: BootLogger;\n}\n\nconst QUICK_GIT_TIMEOUT_MS = 60_000;\n// FETCH/CLONE timeouts are exported so setup/git-ready.ts can DERIVE its gate\n// deadline from the daemon's actual retry envelope instead of hand-picking a\n// number that silently drifts when these change.\nexport const FETCH_TIMEOUT_MS = 300_000;\nexport const CLONE_TIMEOUT_MS = 600_000;\n\nconst execFileAsync = promisify(execFile);\n\n/** `mkdir -p`. Shared with the workbench boot's `ensureWorkspaceDir` default so\n *  its deps aggregator reuses this module rather than pulling in node:fs. */\nexport function ensureDir(dir: string): void {\n  mkdirSync(dir, { recursive: true });\n}\n\n/** Production GitFn. */\nexport function defaultGit(\n  args: string[],\n  opts: { cwd?: string; timeoutMs?: number } = {},\n): Promise<{ stdout: string }> {\n  return execFileAsync(\"git\", args, {\n    cwd: opts.cwd,\n    timeout: opts.timeoutMs ?? QUICK_GIT_TIMEOUT_MS,\n    maxBuffer: 10 * 1024 * 1024,\n  });\n}\n\n/** Remote URLs embed the installation token; execFile error messages embed\n *  the command line. Redact before ANY log/reason sink. */\nexport function redactToken(text: string): string {\n  return text.replace(/x-access-token:[^@]*@/g, \"x-access-token:***@\");\n}\n\nfunction errText(err: unknown): string {\n  return redactToken(err instanceof Error ? err.message : String(err));\n}\n\ninterface PrepPaths {\n  workspacesDir: string;\n  repoDir: string;\n  remoteUrl: string;\n}\n\n/** Refresh the remote token + warm origin/<base> + reset tracked changes.\n *  Deliberately no BRANCH/CHECKOUT_REF handling — see module doc. */\nasync function syncTaskBranchToRepo(deps: GitPrepDeps, paths: PrepPaths): Promise<GitPrepState> {\n  const { git, log } = deps;\n  const { branch, baseBranch } = deps.bundle.gitPlan;\n  try {\n    await git([\"remote\", \"set-url\", \"origin\", paths.remoteUrl], {\n      cwd: paths.repoDir,\n      timeoutMs: QUICK_GIT_TIMEOUT_MS,\n    });\n  } catch (err) {\n    log.error(`[boot] ERROR: remote set-url failed: ${errText(err)}`);\n    return { state: \"failed\", reason: \"remote set-url failed\" };\n  }\n  // Warm origin/<base> so the agent's checkout/fetch is a fast-forward.\n  // Warn-only: a stale-but-present origin/<base> from the bake still works.\n  try {\n    await git([\"fetch\", \"origin\", `+refs/heads/${baseBranch}:refs/remotes/origin/${baseBranch}`], {\n      cwd: paths.repoDir,\n      timeoutMs: FETCH_TIMEOUT_MS,\n    });\n  } catch (err) {\n    log.warn(`[boot] WARN: fetch origin/${baseBranch} failed: ${errText(err)}`);\n  }\n  // The baked/pooled repo is not user-owned until this gate succeeds: reset\n  // stale tracked image dirt so the agent's checkout isn't blocked. No\n  // `git clean` — untracked prebake artifacts may be intentional.\n  try {\n    await git([\"reset\", \"--hard\", \"HEAD\"], { cwd: paths.repoDir, timeoutMs: QUICK_GIT_TIMEOUT_MS });\n  } catch (err) {\n    log.error(\n      `[boot] ERROR: failed to clean tracked repo changes before checkout: ${errText(err)}`,\n    );\n    return { state: \"failed\", reason: \"pre-checkout reset failed\" };\n  }\n  log.info(`[boot] Repo remote ready; agent will checkout ${branch}`);\n  return { state: \"ready\" };\n}\n\nasync function clonePostAssignment(deps: GitPrepDeps, paths: PrepPaths): Promise<GitPrepState> {\n  const { git, log } = deps;\n  const { branch, baseBranch, checkoutRef } = deps.bundle.gitPlan;\n  log.info(\"[boot] Cloning repo post-assignment (pre-clone was missing)...\");\n  if (checkoutRef) {\n    try {\n      await git(\n        [\n          \"clone\",\n          \"--depth\",\n          \"1\",\n          \"--single-branch\",\n          \"--branch\",\n          baseBranch,\n          paths.remoteUrl,\n          \"repo\",\n        ],\n        { cwd: paths.workspacesDir, timeoutMs: CLONE_TIMEOUT_MS },\n      );\n    } catch (err) {\n      log.error(`[boot] ERROR: post-assignment clone failed: ${errText(err)}`);\n      return { state: \"failed\", reason: \"post-assignment clone failed\" };\n    }\n    try {\n      await git([\"fetch\", \"origin\", `+${checkoutRef}:refs/remotes/origin/pr-checkout`], {\n        cwd: paths.repoDir,\n        timeoutMs: FETCH_TIMEOUT_MS,\n      });\n    } catch (err) {\n      log.error(`[boot] ERROR: post-assignment fetch of ${checkoutRef} failed: ${errText(err)}`);\n      return { state: \"failed\", reason: `post-assignment fetch of ${checkoutRef} failed` };\n    }\n    // -f: an untracked bake artifact can collide with a path the target ref\n    // tracks; the repo is not user-owned yet, so forcing is safe.\n    try {\n      await git([\"checkout\", \"-f\", \"-B\", branch, \"refs/remotes/origin/pr-checkout\"], {\n        cwd: paths.repoDir,\n        timeoutMs: QUICK_GIT_TIMEOUT_MS,\n      });\n    } catch (err) {\n      log.error(`[boot] ERROR: post-assignment checkout of ${checkoutRef} failed: ${errText(err)}`);\n      return { state: \"failed\", reason: `post-assignment checkout of ${checkoutRef} failed` };\n    }\n    return { state: \"ready\" };\n  }\n  // FULL depth base-branch clone — see module doc for both incidents.\n  try {\n    await git([\"clone\", \"--single-branch\", \"--branch\", baseBranch, paths.remoteUrl, \"repo\"], {\n      cwd: paths.workspacesDir,\n      timeoutMs: CLONE_TIMEOUT_MS,\n    });\n  } catch (err) {\n    log.error(\n      `[boot] ERROR: post-assignment clone of base '${baseBranch}' failed: ${errText(err)}`,\n    );\n    return { state: \"failed\", reason: \"post-assignment clone failed\" };\n  }\n  return syncTaskBranchToRepo(deps, paths);\n}\n\n/** ONE preparation attempt. Never throws. */\nexport async function prepareWorkspaceGit(deps: GitPrepDeps): Promise<GitPrepState> {\n  const { bundle, log } = deps;\n  const workspacesDir = deps.workspacesDir ?? \"/workspaces\";\n  const repoDir = join(workspacesDir, \"repo\");\n  const { repoOwner, repoName, branch } = bundle.gitPlan;\n  const token = bundle.githubToken;\n  const paths: PrepPaths = {\n    workspacesDir,\n    repoDir,\n    remoteUrl: `https://x-access-token:${token}@github.com/${repoOwner}/${repoName}.git`,\n  };\n  try {\n    if (existsSync(join(repoDir, \".git\")) && token) {\n      // Do NOT silently fall through to the image snapshot on failure — a\n      // stale image repo has bitten us before (old scripts, wrong deps) and is\n      // brutal to diagnose from pod logs. Fail loud via the returned state.\n      log.info(\n        deps.podImage\n          ? `[boot] Pod image — updating repo to latest (branch=${branch})...`\n          : `[boot] Repo present (non-pod-image) — updating repo to latest (branch=${branch})...`,\n      );\n      return await syncTaskBranchToRepo(deps, paths);\n    }\n    if (token && repoOwner && repoName && branch) {\n      try {\n        mkdirSync(workspacesDir, { recursive: true });\n      } catch {\n        /* clone below surfaces the real failure */\n      }\n      return await clonePostAssignment(deps, paths);\n    }\n    // No git plan (task-less pod, or no token/repo) — nothing to prepare;\n    // signal ready so the agent doesn't wait out its gate timeout.\n    log.info(\"[boot] No git plan to prepare — marking git ready.\");\n    return { state: \"ready\" };\n  } catch (err) {\n    // Belt-and-braces: nothing above should throw, but this function's\n    // contract is \"never throws\" (the bash never `exit`ed the subshell).\n    log.error(`[boot] ERROR: git prep failed unexpectedly: ${errText(err)}`);\n    return { state: \"failed\", reason: \"git prep failed unexpectedly\" };\n  }\n}\n\n// Brief-mandated attempt count: 3 total. Not a literal match for the bash\n// workbench retry loop (entrypoint.sh:883) — bash did 1 initial attempt + 3\n// retries = 4 attempts total; the TS port intentionally caps at 3.\nexport const GIT_PREP_MAX_RETRIES = 3;\n/** Exported for setup/git-ready.ts's derived gate deadline (see above). */\nexport const DEFAULT_RETRY_DELAY_MS = 10_000;\n\nexport interface GitPrepJobExtras {\n  /** Awaited BEFORE status flips ready — graphify bind + grimoire submodule +\n   *  skill links. Claude must not spawn before skills exist. */\n  onReady: () => Promise<void>;\n  /** Runs AFTER ready — reference-repo clones must never block Claude. */\n  afterReady: () => Promise<void>;\n  /** default 10s (the bash loop's poll cadence); tests shrink it. */\n  retryDelayMs?: number;\n}\n\n/**\n * Daemon-owned replacement for the marker files + workbench retry loop: up to\n * `GIT_PREP_MAX_RETRIES` `prepareWorkspaceGit` attempts, then give up leaving\n * `status` failed (the agent surfaces it). While a retry is still possible the\n * status stays `pending`, never transiently `failed` — the agent's gitStatus\n * gate treats `failed` as fatal, and the bash marker dance had exactly this\n * race (agent glimpses the failed marker before the retry loop clears it).\n */\nexport class GitPrepJob {\n  private current: GitPrepState = { state: \"pending\" };\n  private started = false;\n\n  constructor(\n    private readonly deps: GitPrepDeps,\n    private readonly extras: GitPrepJobExtras,\n  ) {}\n\n  get status(): GitPrepState {\n    return this.current;\n  }\n\n  /** Kick off the background attempts. Idempotent. */\n  start(): void {\n    if (this.started) return;\n    this.started = true;\n    void this.run();\n  }\n\n  private async run(): Promise<void> {\n    const { log } = this.deps;\n    const retryDelayMs = this.extras.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;\n    for (let attempt = 1; attempt <= GIT_PREP_MAX_RETRIES; attempt++) {\n      const result = await prepareWorkspaceGit(this.deps);\n      if (result.state === \"ready\") {\n        // Binds gate readiness but are best-effort — a graphify/grimoire\n        // failure must never fail the git gate itself.\n        try {\n          await this.extras.onReady();\n        } catch (err) {\n          log.warn(`[boot] WARN: pre-ready binds failed: ${errText(err)}`);\n        }\n        this.current = { state: \"ready\" };\n        try {\n          await this.extras.afterReady();\n        } catch (err) {\n          log.warn(`[boot] WARN: post-ready work failed: ${errText(err)}`);\n        }\n        return;\n      }\n      if (attempt >= GIT_PREP_MAX_RETRIES) {\n        log.error(\n          `[boot] workbench git prep failed ${GIT_PREP_MAX_RETRIES} times — giving up (agent surfaces the failure).`,\n        );\n        this.current = result;\n        return;\n      }\n      log.warn(\n        `[boot] workbench git prep failed — retrying (attempt ${attempt}/${GIT_PREP_MAX_RETRIES})...`,\n      );\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, retryDelayMs);\n      });\n    }\n  }\n}\n"],"mappings":";AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAGvB,SAAS,eACd,UACe;AACf,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,SAAO,SAAS,IAAI,CAAC,OAAO;AAAA,IAC1B,IAAI,EAAE;AAAA,IACN,MAAO,EAAE,QAAQ;AAAA,IACjB,SAAS,EAAE,WAAW;AAAA,IACtB,QAAQ,EAAE;AAAA,IACV,UAAU,EAAE,MAAM,QAAQ;AAAA,IAC1B,WAAW,EAAE;AAAA,IACb,GAAI,EAAE,SAAS,EAAE,MAAM,SAAS,IAC5B;AAAA,MACE,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO;AAAA,QACzB,QAAQ,EAAE;AAAA,QACV,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,aAAa,EAAE,eAAe;AAAA,QAC9B,SAAS,EAAE;AAAA,QACX,iBAAiB,EAAE;AAAA,MACrB,EAAE;AAAA,IACJ,IACA,CAAC;AAAA,EACP,EAAE;AACJ;AAGO,SAAS,mBAAkC;AAChD,MAAI;AACF,UAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AAEnD,eAAW,OAAO,CAAC,mBAAmB,oBAAoB,GAAG;AAC3D,UAAI;AACF,cAAM,MAAM,KAAK,MAAM,aAAa,KAAK,MAAM,GAAG,GAAG,OAAO,CAAC;AAC7D,YAAI,IAAI,QAAS,QAAO,IAAI;AAAA,MAC9B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;;;ACjDA,SAAS,gBAAgB;AACzB,SAAS,YAAY,iBAAiB;AACtC,SAAS,QAAAA,aAAY;AACrB,SAAS,iBAAiB;AAsD1B,IAAM,uBAAuB;AAItB,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAEhC,IAAM,gBAAgB,UAAU,QAAQ;AAIjC,SAAS,UAAU,KAAmB;AAC3C,YAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC;AAGO,SAAS,WACd,MACA,OAA6C,CAAC,GACjB;AAC7B,SAAO,cAAc,OAAO,MAAM;AAAA,IAChC,KAAK,KAAK;AAAA,IACV,SAAS,KAAK,aAAa;AAAA,IAC3B,WAAW,KAAK,OAAO;AAAA,EACzB,CAAC;AACH;AAIO,SAAS,YAAY,MAAsB;AAChD,SAAO,KAAK,QAAQ,0BAA0B,qBAAqB;AACrE;AAEA,SAAS,QAAQ,KAAsB;AACrC,SAAO,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AACrE;AAUA,eAAe,qBAAqB,MAAmB,OAAyC;AAC9F,QAAM,EAAE,KAAK,IAAI,IAAI;AACrB,QAAM,EAAE,QAAQ,WAAW,IAAI,KAAK,OAAO;AAC3C,MAAI;AACF,UAAM,IAAI,CAAC,UAAU,WAAW,UAAU,MAAM,SAAS,GAAG;AAAA,MAC1D,KAAK,MAAM;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,MAAM,wCAAwC,QAAQ,GAAG,CAAC,EAAE;AAChE,WAAO,EAAE,OAAO,UAAU,QAAQ,wBAAwB;AAAA,EAC5D;AAGA,MAAI;AACF,UAAM,IAAI,CAAC,SAAS,UAAU,eAAe,UAAU,wBAAwB,UAAU,EAAE,GAAG;AAAA,MAC5F,KAAK,MAAM;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,KAAK,6BAA6B,UAAU,YAAY,QAAQ,GAAG,CAAC,EAAE;AAAA,EAC5E;AAIA,MAAI;AACF,UAAM,IAAI,CAAC,SAAS,UAAU,MAAM,GAAG,EAAE,KAAK,MAAM,SAAS,WAAW,qBAAqB,CAAC;AAAA,EAChG,SAAS,KAAK;AACZ,QAAI;AAAA,MACF,uEAAuE,QAAQ,GAAG,CAAC;AAAA,IACrF;AACA,WAAO,EAAE,OAAO,UAAU,QAAQ,4BAA4B;AAAA,EAChE;AACA,MAAI,KAAK,iDAAiD,MAAM,EAAE;AAClE,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAEA,eAAe,oBAAoB,MAAmB,OAAyC;AAC7F,QAAM,EAAE,KAAK,IAAI,IAAI;AACrB,QAAM,EAAE,QAAQ,YAAY,YAAY,IAAI,KAAK,OAAO;AACxD,MAAI,KAAK,gEAAgE;AACzE,MAAI,aAAa;AACf,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,UACE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN;AAAA,QACF;AAAA,QACA,EAAE,KAAK,MAAM,eAAe,WAAW,iBAAiB;AAAA,MAC1D;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,MAAM,+CAA+C,QAAQ,GAAG,CAAC,EAAE;AACvE,aAAO,EAAE,OAAO,UAAU,QAAQ,+BAA+B;AAAA,IACnE;AACA,QAAI;AACF,YAAM,IAAI,CAAC,SAAS,UAAU,IAAI,WAAW,kCAAkC,GAAG;AAAA,QAChF,KAAK,MAAM;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,MAAM,0CAA0C,WAAW,YAAY,QAAQ,GAAG,CAAC,EAAE;AACzF,aAAO,EAAE,OAAO,UAAU,QAAQ,4BAA4B,WAAW,UAAU;AAAA,IACrF;AAGA,QAAI;AACF,YAAM,IAAI,CAAC,YAAY,MAAM,MAAM,QAAQ,iCAAiC,GAAG;AAAA,QAC7E,KAAK,MAAM;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,MAAM,6CAA6C,WAAW,YAAY,QAAQ,GAAG,CAAC,EAAE;AAC5F,aAAO,EAAE,OAAO,UAAU,QAAQ,+BAA+B,WAAW,UAAU;AAAA,IACxF;AACA,WAAO,EAAE,OAAO,QAAQ;AAAA,EAC1B;AAEA,MAAI;AACF,UAAM,IAAI,CAAC,SAAS,mBAAmB,YAAY,YAAY,MAAM,WAAW,MAAM,GAAG;AAAA,MACvF,KAAK,MAAM;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI;AAAA,MACF,gDAAgD,UAAU,aAAa,QAAQ,GAAG,CAAC;AAAA,IACrF;AACA,WAAO,EAAE,OAAO,UAAU,QAAQ,+BAA+B;AAAA,EACnE;AACA,SAAO,qBAAqB,MAAM,KAAK;AACzC;AAGA,eAAsB,oBAAoB,MAA0C;AAClF,QAAM,EAAE,QAAQ,IAAI,IAAI;AACxB,QAAM,gBAAgB,KAAK,iBAAiB;AAC5C,QAAM,UAAUA,MAAK,eAAe,MAAM;AAC1C,QAAM,EAAE,WAAW,UAAU,OAAO,IAAI,OAAO;AAC/C,QAAM,QAAQ,OAAO;AACrB,QAAM,QAAmB;AAAA,IACvB;AAAA,IACA;AAAA,IACA,WAAW,0BAA0B,KAAK,eAAe,SAAS,IAAI,QAAQ;AAAA,EAChF;AACA,MAAI;AACF,QAAI,WAAWA,MAAK,SAAS,MAAM,CAAC,KAAK,OAAO;AAI9C,UAAI;AAAA,QACF,KAAK,WACD,2DAAsD,MAAM,SAC5D,8EAAyE,MAAM;AAAA,MACrF;AACA,aAAO,MAAM,qBAAqB,MAAM,KAAK;AAAA,IAC/C;AACA,QAAI,SAAS,aAAa,YAAY,QAAQ;AAC5C,UAAI;AACF,kBAAU,eAAe,EAAE,WAAW,KAAK,CAAC;AAAA,MAC9C,QAAQ;AAAA,MAER;AACA,aAAO,MAAM,oBAAoB,MAAM,KAAK;AAAA,IAC9C;AAGA,QAAI,KAAK,yDAAoD;AAC7D,WAAO,EAAE,OAAO,QAAQ;AAAA,EAC1B,SAAS,KAAK;AAGZ,QAAI,MAAM,+CAA+C,QAAQ,GAAG,CAAC,EAAE;AACvE,WAAO,EAAE,OAAO,UAAU,QAAQ,+BAA+B;AAAA,EACnE;AACF;AAKO,IAAM,uBAAuB;AAE7B,IAAM,yBAAyB;AAoB/B,IAAM,aAAN,MAAiB;AAAA,EAItB,YACmB,MACA,QACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EALX,UAAwB,EAAE,OAAO,UAAU;AAAA,EAC3C,UAAU;AAAA,EAOlB,IAAI,SAAuB;AACzB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,QAAc;AACZ,QAAI,KAAK,QAAS;AAClB,SAAK,UAAU;AACf,SAAK,KAAK,IAAI;AAAA,EAChB;AAAA,EAEA,MAAc,MAAqB;AACjC,UAAM,EAAE,IAAI,IAAI,KAAK;AACrB,UAAM,eAAe,KAAK,OAAO,gBAAgB;AACjD,aAAS,UAAU,GAAG,WAAW,sBAAsB,WAAW;AAChE,YAAM,SAAS,MAAM,oBAAoB,KAAK,IAAI;AAClD,UAAI,OAAO,UAAU,SAAS;AAG5B,YAAI;AACF,gBAAM,KAAK,OAAO,QAAQ;AAAA,QAC5B,SAAS,KAAK;AACZ,cAAI,KAAK,wCAAwC,QAAQ,GAAG,CAAC,EAAE;AAAA,QACjE;AACA,aAAK,UAAU,EAAE,OAAO,QAAQ;AAChC,YAAI;AACF,gBAAM,KAAK,OAAO,WAAW;AAAA,QAC/B,SAAS,KAAK;AACZ,cAAI,KAAK,wCAAwC,QAAQ,GAAG,CAAC,EAAE;AAAA,QACjE;AACA;AAAA,MACF;AACA,UAAI,WAAW,sBAAsB;AACnC,YAAI;AAAA,UACF,oCAAoC,oBAAoB;AAAA,QAC1D;AACA,aAAK,UAAU;AACf;AAAA,MACF;AACA,UAAI;AAAA,QACF,6DAAwD,OAAO,IAAI,oBAAoB;AAAA,MACzF;AACA,YAAM,IAAI,QAAc,CAAC,YAAY;AACnC,mBAAW,SAAS,YAAY;AAAA,MAClC,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["join"]}

package/dist/cli.js

@@ -28,11 +28,16 @@ import {
   runUsageProbe,
   sampleKeyUsage,
   textResult
-} from "./chunk-J4UH5TOO.js";
+} from "./chunk-OW2TIDWZ.js";
 import "./chunk-7TQO4ZF4.js";
 import {
   getWorkbenchClient
-} from "./chunk-LZM5OKAC.js";
+} from "./chunk-UDSRAHKP.js";
+import {
+  TOMBSTONE_MESSAGE,
+  isLegacyEntrypointLaunch
+} from "./chunk-6GS5ADIY.js";
+import "./chunk-UZTJJD7Y.js";
 import {
   workbenchEnabled
 } from "./chunk-4VUQ2NPF.js";
@@ -42,18 +47,16 @@ import {
   loadPtySpawn,
   runStartCommand,
   terminateProcessGroup
-} from "./chunk-RSIW2UCR.js";
-import "./chunk-VKZ5W2VO.js";
+} from "./chunk-JG54UJ6V.js";
+import "./chunk-JIGG755T.js";
 
 // src/cli.ts
 import { readFileSync } from "fs";
-import { join as join3, dirname as dirname3 } from "path";
+import { join as join3, dirname as dirname2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/setup/sidecars.ts
 import net from "net";
-import { mkdir, writeFile } from "fs/promises";
-import { dirname } from "path";
 var POSTGRES_TIMEOUT_MS = 12e4;
 var FIREBASE_TIMEOUT_MS = 6e4;
 var FALLBACK_TIMEOUT_MS = 3e4;
@@ -61,22 +64,6 @@ var DEFAULT_SIDECAR_POLL_INTERVAL_MS = 1e3;
 var DEFAULT_PROBE_TIMEOUT_MS = 2e3;
 var POSTGRES_DEFAULT_PORT = 5432;
 var FIREBASE_DEFAULT_PORT = 9099;
-async function startLazySidecars(env, onLog, signal) {
-  throwIfAborted(signal);
-  const markerPath = env.CONVEYOR_SIDECAR_START_FILE;
-  if (!markerPath) return;
-  try {
-    await mkdir(dirname(markerPath), { recursive: true });
-    throwIfAborted(signal);
-    await writeFile(markerPath, "start\n", "utf8");
-    throwIfAborted(signal);
-    onLog("Started lazy sidecars");
-  } catch (err) {
-    if (signal?.aborted) throw abortError();
-    const message = err instanceof Error ? err.message : String(err);
-    onLog(`WARNING: failed to start lazy sidecars: ${message}`);
-  }
-}
 function parseHostPort(value, defaultPort) {
   const trimmed = value.trim().replace(/^[a-z]+:\/\//i, "");
   if (!trimmed) return null;
@@ -203,12 +190,8 @@ async function waitForSidecars(opts = {}) {
     timeoutMs,
     pollIntervalMs = DEFAULT_SIDECAR_POLL_INTERVAL_MS,
     probe = defaultProbe,
-    startLazy = true,
     signal
   } = opts;
-  if (startLazy) {
-    await startLazySidecars(env, onLog, signal);
-  }
   throwIfAborted(signal);
   const targets = resolveSidecarTargets(env);
   if (targets.length === 0) return;
@@ -278,7 +261,6 @@ var WorkspaceCommandSupervisor = class {
   connection;
   env;
   awaitGitReadyFn;
-  startLazySidecarsFn;
   waitForSidecarsFn;
   runStartCommandFn;
   loadForwardPortsFn;
@@ -313,8 +295,7 @@ var WorkspaceCommandSupervisor = class {
       onLog: opts.onLog,
       signal: opts.signal
     }));
-    this.startLazySidecarsFn = options.startLazySidecars ?? ((env, onLog, signal) => startLazySidecars(env, onLog, signal));
-    this.waitForSidecarsFn = options.waitForSidecars ?? ((opts) => waitForSidecars({ onLog: opts.onLog, startLazy: opts.startLazy, signal: opts.signal }));
+    this.waitForSidecarsFn = options.waitForSidecars ?? ((opts) => waitForSidecars({ onLog: opts.onLog, signal: opts.signal }));
     const executors = defaultCommandExecutors();
     this.runStartCommandFn = options.runStartCommand ?? executors.runStartCommand;
     this.loadForwardPortsFn = options.loadForwardPorts ?? loadForwardPorts;
@@ -328,14 +309,6 @@ var WorkspaceCommandSupervisor = class {
     if (this.started || this.stopped) return;
     this.started = true;
     this.connection.onRunStartCommand(() => this.restartStartCommand());
-    this.trackBackgroundTask(
-      this.startLazySidecarsFn(
-        this.env,
-        (message) => this.forwardSetupOutput("stdout", `[sidecars] ${message}
-`),
-        this.abortController.signal
-      ).catch((error) => this.reportUnexpectedError(error))
-    );
     if (this.config) {
       this.trackBackgroundTask(
         this.runSetupAndStart().catch((error) => this.reportUnexpectedError(error))
@@ -380,7 +353,6 @@ var WorkspaceCommandSupervisor = class {
     await this.waitForSidecarsFn({
       onLog: (message) => this.forwardSetupOutput("stdout", `[sidecars] ${message}
 `),
-      startLazy: false,
       signal: this.abortController.signal
     });
     if (this.stopped) return;
@@ -720,7 +692,7 @@ var ProjectSessionRunner = class {
 };
 
 // src/usage/multi-key-probe.ts
-import { mkdtemp, writeFile as writeFile2, copyFile, rm } from "fs/promises";
+import { mkdtemp, writeFile, copyFile, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
 var logger = createServiceLogger("multi-key-probe");
@@ -751,7 +723,7 @@ async function isolatedProbe(token, now) {
   let dir = null;
   try {
     dir = await mkdtemp(join(tmpdir(), "conveyor-usage-"));
-    await writeFile2(join(dir, ".credentials.json"), buildSynthesizedCredentials(token, now), {
+    await writeFile(join(dir, ".credentials.json"), buildSynthesizedCredentials(token, now), {
       encoding: "utf8",
       mode: 384
     });
@@ -792,7 +764,7 @@ async function probeKeysUsage(keys, deps = {}) {
 
 // src/harness/pty/adapters/opencode-auth.ts
 import { promises as fs } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname, join as join2 } from "path";
 import { homedir } from "os";
 var logger2 = createServiceLogger("opencode-auth");
 var OPENCODE_CODEX_PLUGIN = "opencode-openai-codex-auth@4.4.0";
@@ -833,7 +805,7 @@ async function readJsonFile(path) {
   }
 }
 async function writeJsonFile(path, value) {
-  await fs.mkdir(dirname2(path), { recursive: true });
+  await fs.mkdir(dirname(path), { recursive: true });
   await fs.writeFile(path, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
 }
@@ -1492,6 +1464,8 @@ function buildReviewChildEnv(baseEnv, data) {
   delete env.CONVEYOR_BOOTSTRAP_TOKEN;
   delete env.CONVEYOR_SETUP_COMMAND;
   delete env.CONVEYOR_START_COMMAND;
+  delete env.CONVEYOR_GIT_READY;
+  delete env.CONVEYOR_GIT_READY_MARKER;
   delete env.CONVEYOR_AGENT_MODE;
   delete env.CONVEYOR_IS_AUTO;
   return env;
@@ -1922,8 +1896,17 @@ function createSpawnedChildRunner(inputs) {
 }
 
 // src/cli.ts
+if (process.argv[2] === "boot") {
+  const { runBoot } = await import("./boot-NMXFM4GK.js");
+  process.exit(await runBoot(process.argv.slice(3)));
+}
+if (isLegacyEntrypointLaunch(process.env)) {
+  process.stderr.write(`${TOMBSTONE_MESSAGE}
+`);
+  process.exit(1);
+}
 if (process.argv.includes("--version")) {
-  const __dirname = dirname3(fileURLToPath(import.meta.url));
+  const __dirname = dirname2(fileURLToPath(import.meta.url));
   const pkgPath = join3(__dirname, "..", "package.json");
   const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
   process.stdout.write(pkg.version + "\n");
@@ -2005,15 +1988,15 @@ process.on("unhandledRejection", (reason) => {
   process.exit(1);
 });
 if (process.env.CONVEYOR_MODE === "workbench") {
-  const { startWorkbenchServer } = await import("./server-TVIXWCAI.js");
-  const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-IHRTO5C4.js");
+  const { startWorkbenchServer } = await import("./server-CO5O7G4U.js");
+  const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-QLVS5W6O.js");
   const port = Number(process.env.CONVEYOR_WORKBENCH_PORT) || DEFAULT_WORKBENCH_PORT;
   const token = process.env.CONVEYOR_WORKBENCH_TOKEN ?? process.env.POD_BOOTSTRAP_TOKEN ?? "";
   if (!token) {
     logger6.error("workbench mode requires POD_BOOTSTRAP_TOKEN (or CONVEYOR_WORKBENCH_TOKEN)");
     process.exit(1);
   }
-  const pkgDir = dirname3(fileURLToPath(import.meta.url));
+  const pkgDir = dirname2(fileURLToPath(import.meta.url));
   const pkg = JSON.parse(readFileSync(join3(pkgDir, "..", "package.json"), "utf-8"));
   const handle = await startWorkbenchServer({
     port,