@rosthq/cli 0.7.154 → 0.7.155

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path11, preserveJsx) {
-  if (typeof path11 === "string" && /^\.\.?\//.test(path11)) {
-    return path11.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path12, preserveJsx) {
+  if (typeof path12 === "string" && /^\.\.?\//.test(path12)) {
+    return path12.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path11;
+  return path12;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -14337,10 +14337,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path11) {
-  if (!path11)
+function getElementAtPath(obj, path12) {
+  if (!path12)
     return obj;
-  return path11.reduce((acc, key) => acc?.[key], obj);
+  return path12.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14749,11 +14749,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path11, issues) {
+function prefixIssues(path12, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path11);
+    iss.path.unshift(path12);
     return iss;
   });
 }
@@ -14900,16 +14900,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path11 = []) => {
+  const processError = (error52, path12 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path12, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path12, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path12, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path12, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14936,17 +14936,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path11 = []) => {
+  const processError = (error52, path12 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path12, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path12, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path12, ...issue2.path]);
       } else {
-        const fullpath = [...path11, ...issue2.path];
+        const fullpath = [...path12, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14978,8 +14978,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path11 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path11) {
+  const path12 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path12) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -27671,13 +27671,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path11 = ref.slice(1).split("/").filter(Boolean);
-  if (path11.length === 0) {
+  const path12 = ref.slice(1).split("/").filter(Boolean);
+  if (path12.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path11[0] === defsKey) {
-    const key = path11[1];
+  if (path12[0] === defsKey) {
+    const key = path12[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -30606,7 +30606,7 @@ var forbiddenImportKeys = /* @__PURE__ */ new Set([
   "integration_id",
   "integrationId"
 ]);
-function rejectForbiddenImportShape(value, ctx, path11 = []) {
+function rejectForbiddenImportShape(value, ctx, path12 = []) {
   if (value === null || value === void 0) {
     return;
   }
@@ -30614,21 +30614,21 @@ function rejectForbiddenImportShape(value, ctx, path11 = []) {
     if (hasSecretShapedValue(value)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path11,
+        path: path12,
         message: "Definition imports cannot contain secret-shaped values. Provide credentials later through vault-backed connection flows."
       });
     }
     return;
   }
   if (Array.isArray(value)) {
-    value.forEach((item, index) => rejectForbiddenImportShape(item, ctx, [...path11, index]));
+    value.forEach((item, index) => rejectForbiddenImportShape(item, ctx, [...path12, index]));
     return;
   }
   if (typeof value !== "object") {
     return;
   }
   for (const [key, nested] of Object.entries(value)) {
-    const nestedPath = [...path11, key];
+    const nestedPath = [...path12, key];
     if (forbiddenImportKeys.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
@@ -34622,7 +34622,7 @@ var preflightArtifactDispositionSchema = external_exports.object({
   // on this envelope.
   transformations: external_exports.array(preflightTransformationSchema)
 }).strict().superRefine((data, ctx) => {
-  const add = (path11, message) => ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path11, message });
+  const add = (path12, message) => ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path12, message });
   const reasonIsBlank = data.reason !== null && data.reason.trim().length === 0;
   if (reasonIsBlank) add(["reason"], "reason must be nonblank when supplied");
   if (data.presence === "missing") {
@@ -35661,14 +35661,14 @@ var COMPLETE_SEAT_PERMISSION_ARGS_MAX_NODES = 5e3;
 function jsonByteLength(value) {
   return new TextEncoder().encode(JSON.stringify(value)).byteLength;
 }
-function boundCharterList(value, path11, ctx) {
+function boundCharterList(value, path12, ctx) {
   if (value.length > COMPLETE_SEAT_CHARTER_MAX_ITEMS_PER_LIST) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.too_big,
       maximum: COMPLETE_SEAT_CHARTER_MAX_ITEMS_PER_LIST,
       origin: "array",
       inclusive: true,
-      path: path11,
+      path: path12,
       message: `Complete-Seat Charter lists are limited to ${COMPLETE_SEAT_CHARTER_MAX_ITEMS_PER_LIST} entries.`
     });
   }
@@ -35685,7 +35685,7 @@ function addCompleteSeatCharterBounds(charter, ctx) {
     boundCharterList(charter.unanswered_boundaries, ["unanswered_boundaries"], ctx);
   }
   let argumentNodes = 0;
-  const visitArgument = (value, depth, path11) => {
+  const visitArgument = (value, depth, path12) => {
     argumentNodes += 1;
     if (argumentNodes > COMPLETE_SEAT_PERMISSION_ARGS_MAX_NODES) {
       return;
@@ -35693,15 +35693,15 @@ function addCompleteSeatCharterBounds(charter, ctx) {
     if (depth > COMPLETE_SEAT_PERMISSION_ARGS_MAX_DEPTH) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path11,
+        path: path12,
         message: `Complete-Seat permission arguments are limited to ${COMPLETE_SEAT_PERMISSION_ARGS_MAX_DEPTH} nested levels.`
       });
       return;
     }
     if (Array.isArray(value)) {
-      value.forEach((entry, index) => visitArgument(entry, depth + 1, [...path11, index]));
+      value.forEach((entry, index) => visitArgument(entry, depth + 1, [...path12, index]));
     } else if (value && typeof value === "object") {
-      Object.entries(value).forEach(([key, entry]) => visitArgument(entry, depth + 1, [...path11, key]));
+      Object.entries(value).forEach(([key, entry]) => visitArgument(entry, depth + 1, [...path12, key]));
     }
   };
   charter.permission_manifest.forEach((permission, index) => {
@@ -35862,9 +35862,9 @@ var createCompleteSeatRequestSchema = external_exports.object({
   }
   const useKeys = /* @__PURE__ */ new Set();
   for (const [index, use] of value.seat.source_uses.entries()) {
-    const path11 = ["seat", "source_uses", index, "source_key"];
-    if (!sourceKeys.has(use.source_key)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path11, message: "Source use must resolve to the request source registry." });
-    if (useKeys.has(use.source_key)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path11, message: "Source use must not be duplicated." });
+    const path12 = ["seat", "source_uses", index, "source_key"];
+    if (!sourceKeys.has(use.source_key)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path12, message: "Source use must resolve to the request source registry." });
+    if (useKeys.has(use.source_key)) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path12, message: "Source use must not be duplicated." });
     useKeys.add(use.source_key);
   }
   if (value.seat.human_staffing.kind === "planned" && value.seat.human_staffing.source_ref) {
@@ -35877,8 +35877,8 @@ var createCompleteSeatRequestSchema = external_exports.object({
     ...value.seat.parent ? [{ ref: value.seat.parent, path: ["seat", "parent"] }] : [],
     ...value.seat.agent ? [{ ref: value.seat.agent.steward, path: ["seat", "agent", "steward"] }] : []
   ];
-  refs.forEach(({ ref, path: path11 }) => {
-    if (ref.kind !== "existing") ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path11, message: "Direct complete-seat requests require existing Seat references." });
+  refs.forEach(({ ref, path: path12 }) => {
+    if (ref.kind !== "existing") ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path12, message: "Direct complete-seat requests require existing Seat references." });
   });
 }).transform((value) => ({
   ...value,
@@ -36188,26 +36188,26 @@ var onboardingSourceIngestOutputSchema = external_exports.object({
 }).strict();
 var prohibitedUrlOrPath = /(?:[a-z][a-z0-9+.-]*:\/\/|(?:^|\s)(?:\.{1,2}[\\/]\S+|\/(?:Users|Volumes|Applications|System|Library|private|var|tmp|home|etc)\/|[A-Za-z]:\\))/i;
 var directContactOrPaymentIdentifier = /(?:[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}|\+?[0-9][0-9 .()/-]{7,}[0-9]|(?:\b[0-9][ -]*?){13,19}\b)/i;
-function isIndexedPath(path11, family, field4) {
-  return path11.length === 3 && path11[0] === family && typeof path11[1] === "number" && path11[2] === field4;
+function isIndexedPath(path12, family, field4) {
+  return path12.length === 3 && path12[0] === family && typeof path12[1] === "number" && path12[2] === field4;
 }
-function isSchemaProvenMachineString(path11) {
-  if (path11.length === 1 && path11[0] === "managed_inference_hard_cap_usd") {
+function isSchemaProvenMachineString(path12) {
+  if (path12.length === 1 && path12[0] === "managed_inference_hard_cap_usd") {
     return true;
   }
-  if (isIndexedPath(path11, "sources", "source_upload_id") || isIndexedPath(path11, "sources", "sha256") || isIndexedPath(path11, "reconciliation", "source_sha256") || isIndexedPath(path11, "reconciliation", "normalized_identity_digest") || isIndexedPath(path11, "signal_readings", "period_start") || isIndexedPath(path11, "signal_readings", "value") || isIndexedPath(path11, "tasks", "due_on")) {
+  if (isIndexedPath(path12, "sources", "source_upload_id") || isIndexedPath(path12, "sources", "sha256") || isIndexedPath(path12, "reconciliation", "source_sha256") || isIndexedPath(path12, "reconciliation", "normalized_identity_digest") || isIndexedPath(path12, "signal_readings", "period_start") || isIndexedPath(path12, "signal_readings", "value") || isIndexedPath(path12, "tasks", "due_on")) {
     return true;
   }
-  if (path11.length === 2 && path11[0] === "cycle" && (path11[1] === "starts_on" || path11[1] === "ends_on")) {
+  if (path12.length === 2 && path12[0] === "cycle" && (path12[1] === "starts_on" || path12[1] === "ends_on")) {
     return true;
   }
-  if (path11.length >= 3 && path11.at(-3) === "citations" && typeof path11.at(-2) === "number" && path11.at(-1) === "document_id") {
+  if (path12.length >= 3 && path12.at(-3) === "citations" && typeof path12.at(-2) === "number" && path12.at(-1) === "document_id") {
     return true;
   }
-  if (path11.length === 6 && path11[0] === "seats" && typeof path11[1] === "number" && path11[2] === "charter" && path11[3] === "permission_manifest" && typeof path11[4] === "number" && path11[5] === "integration_id") {
+  if (path12.length === 6 && path12[0] === "seats" && typeof path12[1] === "number" && path12[2] === "charter" && path12[3] === "permission_manifest" && typeof path12[4] === "number" && path12[5] === "integration_id") {
     return true;
   }
-  return path11.length === 6 && path11[0] === "seats" && typeof path11[1] === "number" && path11[2] === "agent" && path11[3] === "skills" && typeof path11[4] === "number" && (path11[5] === "skill_version_id" || path11[5] === "content_sha256");
+  return path12.length === 6 && path12[0] === "seats" && typeof path12[1] === "number" && path12[2] === "agent" && path12[3] === "skills" && typeof path12[4] === "number" && (path12[5] === "skill_version_id" || path12[5] === "content_sha256");
 }
 function jsonByteLength2(value) {
   try {
@@ -36217,21 +36217,21 @@ function jsonByteLength2(value) {
     return Number.POSITIVE_INFINITY;
   }
 }
-function prohibitedSetupStringPath(value, path11 = []) {
+function prohibitedSetupStringPath(value, path12 = []) {
   if (typeof value === "string") {
-    if (isSchemaProvenMachineString(path11)) return null;
-    return hasSecretShapedContent(value) || prohibitedUrlOrPath.test(value) || directContactOrPaymentIdentifier.test(value) ? path11 : null;
+    if (isSchemaProvenMachineString(path12)) return null;
+    return hasSecretShapedContent(value) || prohibitedUrlOrPath.test(value) || directContactOrPaymentIdentifier.test(value) ? path12 : null;
   }
   if (Array.isArray(value)) {
     for (const [index, entry] of value.entries()) {
-      const found = prohibitedSetupStringPath(entry, [...path11, index]);
+      const found = prohibitedSetupStringPath(entry, [...path12, index]);
       if (found) return found;
     }
     return null;
   }
   if (value && typeof value === "object") {
     for (const [key, entry] of Object.entries(value)) {
-      const found = prohibitedSetupStringPath(entry, [...path11, key]);
+      const found = prohibitedSetupStringPath(entry, [...path12, key]);
       if (found) return found;
     }
   }
@@ -42040,7 +42040,7 @@ var CommandClient = class {
     this._credentialKind = options.credentialKind;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path11 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path12 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -42048,7 +42048,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path11}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path12}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -42061,7 +42061,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path11}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path12}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -47392,8 +47392,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path11, query) {
-  const url2 = new URL(path11, baseUrl);
+function buildUrl(baseUrl, path12, query) {
+  const url2 = new URL(path12, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -47423,12 +47423,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path11,
+      path: path12,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path11, query);
+      const url2 = buildUrl(options.baseUrl, path12, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -48290,7 +48290,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path11, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path12, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -48314,7 +48314,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path11);
+      const cleanPath = _this._removeEmptyFolders(path12);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -48391,8 +48391,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path11, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path11, fileBody, fileOptions);
+  async upload(path12, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path12, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -48432,9 +48432,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path11, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path12, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path11);
+    const cleanPath = _this3._removeEmptyFolders(path12);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -48503,10 +48503,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path11, options) {
+  async createSignedUploadUrl(path12, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path11);
+      let _path = _this4._getFinalPath(path12);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -48515,7 +48515,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path11,
+        path: path12,
         token
       };
     });
@@ -48575,8 +48575,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path11, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path11, fileBody, fileOptions);
+  async update(path12, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path12, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -48727,10 +48727,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path11, expiresIn, options) {
+  async createSignedUrl(path12, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path11);
+      let _path = _this8._getFinalPath(path12);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -48866,13 +48866,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path11, options, parameters) {
+  download(path12, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path11);
+    const _path = this._getFinalPath(path12);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -48903,9 +48903,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path11) {
+  async info(path12) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path11);
+    const _path = _this10._getFinalPath(path12);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -48926,9 +48926,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path11) {
+  async exists(path12) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path11);
+    const _path = _this11._getFinalPath(path12);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -49007,8 +49007,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path11, options) {
-    const _path = this._getFinalPath(path11);
+  getPublicUrl(path12, options) {
+    const _path = this._getFinalPath(path12);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -49147,10 +49147,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path11, options, parameters) {
+  async list(path12, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path11 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path12 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -49215,11 +49215,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path11) {
-    return `${this.bucketId}/${path11.replace(/^\/+/, "")}`;
+  _getFinalPath(path12) {
+    return `${this.bucketId}/${path12.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path11) {
-    return path11.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path12) {
+    return path12.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -53318,7 +53318,7 @@ Canonical source: \`github.com/agenticoperatingsystem/rost-implementation-skill\
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-08-03.4",
+    version: "2026-08-03.5",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -53395,7 +53395,7 @@ The current chat harness shows the effective lane and model. Cloud is the defaul
 
 AICOS also has an explicit brain selection. Cloud can use the included managed allowance or a tenant Anthropic key (BYOK). When cloud is on the managed allowance, an owner can also pick a specific managed model from the AI Gateway's priced, ZDR-rated catalog (today: Anthropic's own "Automatic" default, plus managed OpenAI and xAI entries) instead of leaving the choice on Anthropic's default routing. A managed model without a zero-data-retention tier shows as locked with the reason until a tenant owner explicitly unlocks non-ZDR managed models (\`tenant.model_gateway_policy.update\`, owner-only and dangerous-gated); once unlocked, its per-model data-retention disclosure is shown before it becomes selectable. Selecting one of these managed models updates AICOS settings immediately, but it does not yet change which model actually answers a cloud AICOS turn \u2014 every non-Anthropic option says so plainly, and cloud turns keep running on the existing Anthropic routing until a later runtime cutover wires the persisted selection through. Runner brain preference still records Claude or Codex, but interactive AICOS runner turns are currently gated to Claude while the Codex path remains unverified. MCP is labeled as the MCP client. Read this selection with \`aicos.brain_settings.get\`; owners can update it with \`aicos.brain_settings.update\` (CLI flags: \`--lane\`, \`--cloud-brain managed|byok\`, \`--runner-brain claude-cli|codex-cli\`). BYOK requires an active tenant Anthropic key and does not support a specific managed-model selection. Choosing \`codex-cli\` for AICOS runner mode is currently rejected with a precondition error until the governed interactive runner path is verified. Runner and MCP answers are labeled in the transcript and do not consume the managed cloud allowance. If the selected runner reports that its active local model account has exhausted its allowance, Settings surfaces **Allowance exhausted** before the user sends another AICOS turn so they can switch lanes, switch runner accounts, or keep working manually instead of waiting on a doomed runner round-trip.
 
-Runner mode uses the same AICOS sessions and transcript. Interactive chat turns are tracked separately from work orders: each user message has one user-owned turn execution with a short deadline, so two users' chat messages cannot collapse into the same work-order slot. Scheduled coordinator work, explicit/manual operator runs, and Forge runner work still use work orders. Runner claim packets carry ids and execution metadata, not the user's free-text request. After claim, the local runner calls the governed AICOS context-load tool, which re-checks seat scope and returns the bounded transcript, session summary, route context, tenant clock, grounding text, and source counts authorized for that turn. For execute-ready runners, the claim also carries a server-built Seat work contract that names the governed runtime profile, the AICOS context-loader tool, and the Seat's permission manifest; action attempts still route through command guards, tool-call audit, and pending confirmations. The runner treats loaded tenant clock, context, and contract as authoritative instead of substituting its own runtime clock, local files, or self-invented authority. A runner must be paired, execute-ready, and backed by the live AICOS agent before it can be selected.
+Runner mode uses the same AICOS sessions and transcript. Interactive chat turns are tracked separately from work orders: each user message has one user-owned turn execution with a short deadline, so two users' chat messages cannot collapse into the same work-order slot. Scheduled coordinator work, explicit/manual operator runs, and Forge runner work still use work orders. Runner claim packets carry ids and execution metadata, not the user's free-text request. After claim, the local runner calls the governed AICOS context-load tool, which re-checks seat scope and returns the bounded transcript, session summary, route context, tenant clock, grounding text, and source counts authorized for that turn. For execute-ready runners, the claim also carries a server-built Seat work contract that names the governed runtime profile, the AICOS context-loader tool, and the Seat's permission manifest; action attempts still route through command guards, tool-call audit, and pending confirmations. The runner treats loaded tenant clock, context, and contract as authoritative instead of substituting its own runtime clock, local files, or self-invented authority. A runner must be paired, execute-ready, and backed by the live AICOS agent before it can be selected; Claude-backed readiness additionally requires the dedicated cell's truthful \`auth_state: "ready"\` plus \`auth_state_contract_version: 1\` marker. Missing or unknown Claude auth stays visible but is not advertised as ready, and an explicitly Codex-only runner is the only generic-work exception.
 
 Agent seat pages can also expose a direct persistent chat with that seat's active agent. This is different from Seat-scoped AICOS: the target is the agent occupying the seat, the transcript is keyed by tenant, user, purpose, and target agent, and the same user can keep separate active threads for different agents. Owners and admins can read direct-agent transcripts for the tenant, and a human occupying the agent seat's Steward seat can read the transcript; unrelated members cannot. New prompts for a target agent enter an agent-scoped queue with a short turn deadline. A second prompt in the same thread coalesces into the pending turn until that turn is claimed, while prompts for another user or another agent keep their own queue position. Direct agent chat never dispatches through \`work_orders\`; scheduled coordinator work, explicit/manual operator runs, and Forge runner work still use \`work_orders\`.
 
@@ -54336,7 +54336,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-08-04.2",
+    version: "2026-08-04.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -54952,7 +54952,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} escalation list|get|resolve|reject\` | \`escalation.list\`, \`escalation.get\`, \`escalation.resolve\`, \`escalation.reject\` | Work the steward escalation queue. | Steward | \`{{cli}} escalation list --json\` |
 | \`{{cli}} error list|resolve|supersede\` | \`error_log.list\`, \`error_log.resolve\`, \`error_log.supersede\` | List active, acknowledged, resolved, or superseded product error logs and let a human acknowledge, resolve, or supersede stale errors with evidence links. | Tenant | \`{{cli}} error list --resolved active --json\`; \`{{cli}} error resolve --error-log-id <id> --reason "Fixed in PR #123"\` |
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
-| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect heartbeat and execute-readiness evidence, inspect work orders, diagnose offline runners, explain claimability gates, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
+| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve|login\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect heartbeat and execute-readiness evidence, inspect work orders, diagnose offline runners, explain claimability gates, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
 | \`{{cli}} runner install-service|start|stop|restart|status|logs|uninstall --name <name> [--user-code <code>]\` | launchd/service manager (macOS today) + \`{{cli}} runner serve\` | Install and manage an always-on local runner service that keeps the runner online across reboots. The service runs the runner under the absolute Node binary with an explicit PATH (so it works under nvm/Homebrew) and bootstraps into whichever launchd domain the session supports. Pass \`--user-code\` to pair the service at install; otherwise install prints the exact command to pair it. No secret is stored in the service definition, its arguments, or logs. Non-macOS emits an explicit unsupported message. | Tenant (local machine) | \`{{cli}} runner install-service --name mac-mini --execute --user-code ABCD-EFGH\`; \`{{cli}} runner logs --name mac-mini\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` / credential flow for Baserow REST connect | \`integration.connect_rest\`, \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | Create a vault-backed Baserow REST integration through the credential flow, list connector metadata, read setup-readiness, read one connector's health, and run provider-specific tests without exposing credentials. | Tenant-admin for connect; tenant for reads/tests | \`{{cli}} integration readiness --provider google --json\` |
@@ -56709,7 +56709,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-08-03.1",
+    version: "2026-08-04.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -56755,9 +56755,13 @@ Runner transport defaults to the canonical production host \`https://rost.elevat
 
 Choose the local runtime with \`--runtime auto|claude|codex\` (default \`auto\`). The same short-lived seat-scoped MCP token and server-side guard apply regardless of runtime; results are tagged \`claude-cli\` or \`codex-cli\`.
 
+Claude-lane turns authenticate from a dedicated per-runner Claude credential cell, separate from the operator source store. After pairing, run \`{{cli}} runner login\` on the runner host once (if the runner was installed as a service, pass \`--name <runner-name>\` \u2014 with no flags it uses the only paired runner when exactly one exists): it runs \`claude auth login\` scoped to the runner's private credential cell (\`~/.rost/runner/claude-home/\`, keyed on the runner id) and verifies the credential reads back in the exact shape turns use. The credential lives as a file inside that cell \u2014 the same shape on macOS and on Linux. \`runner login\` performs an advisory comparison with your own Claude Code login and discloses a match or an unreadable/null probe; a local comparison cannot prove a runner-only account, so complete the morning second-account proof before production use. Your own Claude credential is unreachable from a turn: the sandbox denies the operator's config dir and the macOS Keychain, so a turn cannot reach it even by re-pointing Claude's credential environment itself. The cell survives restarts, so re-login is only needed after it is deliberately removed. A turn that finds no usable runner credential (never logged in, or the file credential lost) prints a one-line \`{{cli}} runner login\` reminder to the runner's stderr or log; the turn still reports the auth failure.
+
 For always-on execution, \`runner serve --execute\` heartbeats on its normal interval and also checks for claimable work between heartbeats. The default interactive claim cadence is about one second; set \`RUNNER_INTERACTIVE_CLAIM_MS\` or \`--interactive-claim-ms\` to tune it for a host. Set how many turns the runner may run in parallel with \`--max-sessions <n>\` or \`RUNNER_MAX_SESSIONS\`; left unset, the runner estimates a value from host CPU and memory. The scheduler honors the declared value (clamped to a small ceiling) so a runner never claims more concurrent work than the capacity it reports. Claude-backed turns reuse a per-seat Claude Code resume session when Claude reports a session id, so later turns can run with \`claude --resume <session-id>\` under the local subscription account. The runner stores only the opaque resume id in its owner-only state file; it does not use API-billed managed sessions to make subscription runner turns faster. A resident long-lived Claude/Codex process is still prototype-gated, so do not assume a fixed latency SLA from this guide alone.
 
-Each claimed work order carries a server-persisted \`execution_mode\` of \`production_manual\` or \`production_scheduled\`. Current runners validate that field before starting and forward it unchanged into the model context. The server withholds mode-required work from an older runner that does not advertise execution-mode contract v1; upgrade and restart \`{{cli}} runner serve\` to make those queued orders claimable.
+Claude claims require truthful dedicated-cell evidence: the runner emits \`claude.auth_state_contract_version: 1\` only when its cell probe reports \`installed: true\` and \`auth_state: "ready"\`. The server requires that marker for interactive Claude turns and Claude-backed generic work orders; missing, malformed, or older markers leave work queued while the runner continues heartbeating. A configured Codex-only runner (Claude absent, Codex installed) remains eligible for generic work when it also advertises execution-mode contract v1.
+
+Each claimed work order carries a server-persisted \`execution_mode\` of \`production_manual\` or \`production_scheduled\`. Current runners validate that field before starting and forward it unchanged into the model context. The server withholds mode-required work from an older runner that does not advertise execution-mode contract v1; upgrade and restart \`{{cli}} runner serve\` to make those queued orders claimable. A new CLI also waits for heartbeat contract v3 before making any claim or resuming an orphaned claim, so rolling against an old or malformed heartbeat route remains heartbeat-only.
 
 The runner bearer secret is stored locally and is never displayed. Each claimed turn receives a short-lived seat-scoped MCP token from {{brand}}, and server-side guards still decide what tools the Seat may use.
 
@@ -56788,7 +56792,7 @@ A Forge turn should load its context in one order: build context first, then Ski
 ## Inspect and control runners from CLI or MCP
 
 - Pair a new runner: \`runner.pairing.start\` / \`rost_start_runner_pairing\` with \`name\` and \`platform\` returns a human pairing code. This is owner/admin-only because it mints a short-lived runner pairing session that leads to machine credentials.
-- Inspect: \`{{cli}} runner list --json\` / \`runner.list\` / \`rost_list_runners\` shows heartbeat state plus execution readiness. A runner is execute-ready only when it has a live heartbeat, a detected local Claude or Codex runtime, and recent claim/result evidence or active queue processing. Settings and runner status/list surfaces also project the runner CLI version, sandbox posture, network posture, and reported capability set from heartbeat so operators can see whether the machine is current and still running with the expected guardrails. \`{{cli}} runner status\` / \`runner.status\` / \`rost_runner_status\` reads one runner with the same execution detail, due queue count, claimed/running counts, and recent result timestamps. Both surfaces also project a \`capacity\` view: the runner's active model-account alias, a badge state (\`available\`, \`near_cap\`, \`exhausted\`, or \`unknown\`), a rate-limited-until timestamp when the harness has classified one, and a fresh/stale refreshability flag mirroring heartbeat recency. The badge reads \`unknown\` \u2014 never a fabricated \`available\` \u2014 whenever no capacity observation has been recorded yet or the runner reported a state {{brand}} does not recognize; real 5-hour/weekly usage percentages and reset timestamps are not collected yet, so this view never claims a percentage it does not have. Settings > Connected machines and the Health dashboard's Connectivity tile (a fleet-wide near-cap/at-limit count) surface the same signal.
+- Inspect: \`{{cli}} runner list --json\` / \`runner.list\` / \`rost_list_runners\` shows heartbeat state plus execution readiness. A runner is execute-ready only when it has a live heartbeat, a claimable local runtime, and recent claim/result evidence or active queue processing. Claude is claimable only with the dedicated-cell \`auth_state: "ready"\` and \`auth_state_contract_version: 1\` marker; an installed-but-unproven Claude CLI remains heartbeat-only, while an explicitly Codex-only configuration may claim generic work. Settings and runner status/list surfaces also project the runner CLI version, sandbox posture, network posture, and reported capability set from heartbeat so operators can see whether the machine is current and still running with the expected guardrails. \`{{cli}} runner status\` / \`runner.status\` / \`rost_runner_status\` reads one runner with the same execution detail, due queue count, claimed/running counts, and recent result timestamps. Both surfaces also project a \`capacity\` view: the runner's active model-account alias, a badge state (\`available\`, \`near_cap\`, \`exhausted\`, or \`unknown\`), a rate-limited-until timestamp when the harness has classified one, and a fresh/stale refreshability flag mirroring heartbeat recency. The badge reads \`unknown\` \u2014 never a fabricated \`available\` \u2014 whenever no capacity observation has been recorded yet or the runner reported a state {{brand}} does not recognize; real 5-hour/weekly usage percentages and reset timestamps are not collected yet, so this view never claims a percentage it does not have. Settings > Connected machines and the Health dashboard's Connectivity tile (a fleet-wide near-cap/at-limit count) surface the same signal.
 - Diagnose (DER-949): \`{{cli}} runner diagnose --runner-id <id>\` / \`runner.diagnose\` / \`rost_diagnose_runner\` returns health, capabilities, and repair guidance without exposing secrets. Use when a runner is offline or stale to get actionable next steps.
 - Repair steps (DER-949): \`{{cli}} runner repair --runner-id <id> [--issue restart|re_pair|revoke_stale|missing_cli_runtime]\` / \`runner.repair\` / \`rost_repair_runner\` returns focused repair instructions. The optional \`issue\` flag narrows to a specific kind of repair (restart the app, re-pair, revoke a stale runner, or install a missing CLI runtime).
 - Work orders: \`{{cli}} runner work-orders\` / \`work_order.list\` / \`rost_list_work_orders\`; queue with \`work_order.enqueue\` / \`rost_enqueue_work_order\` for an execution-ready live scheduled agent, or use \`agent.run_now\` / \`rost_run_agent_now\` when an operator wants the product to queue and dispatch a manual production run (\`production_manual\`) from a seat id; cancel with \`work_order.cancel\` / \`rost_cancel_work_order\`. Both issuance paths pass through the same central \`execution_ready\` gate. The operator Settings page mirrors queued, claimed, running, and recent completed runner evidence so online does not imply can execute. \`task_id\` on either enqueue command is cloud-lane only: a runner-lane agent rejects it, because a task-linked runner work order is structurally unclaimable \u2014 run task-linked runner work as an interactive agent turn (see Interactive AICOS runner turns above), not through the scheduled work-order lane.
@@ -62175,7 +62179,7 @@ function operationUsageLines(bin) {
     `${bin} escalation list|get|resolve|reject`,
     `${bin} error list|resolve|supersede`,
     `${bin} sync brief|compile|complete`,
-    `${bin} runner list|status|diagnose|repair|work-orders|revoke|serve`,
+    `${bin} runner list|status|diagnose|repair|work-orders|revoke|serve|login`,
     // Local runner service lifecycle (DER-1142). The orchestrator mirrors this
     // exact line into the mcp-and-cli-guide so the help/guide parity gate passes.
     `${bin} runner install-service|start|stop|restart|status|logs|uninstall --name <name>`,
@@ -63848,6 +63852,9 @@ function runnerCodexHomeBaseDir(homeDir) {
   return path6.join(homeDir, ".rost", "runner", "codex-home");
 }
 var LEGACY_TMP_CODEX_HOME_DIR = path6.join(tmpdir(), "rost-runner-codex-home");
+function runnerClaudeHomeBaseDir(homeDir) {
+  return path6.join(homeDir, ".rost", "runner", "claude-home");
+}
 var codexHomeBaseCanonicalCache = /* @__PURE__ */ new Map();
 function canonicalCodexHomeBase(homeDir) {
   const key = path6.resolve(homeDir);
@@ -63859,11 +63866,23 @@ function canonicalCodexHomeBase(homeDir) {
   codexHomeBaseCanonicalCache.set(key, resolved);
   return resolved;
 }
+var claudeHomeBaseCanonicalCache = /* @__PURE__ */ new Map();
+function canonicalClaudeHomeBase(homeDir) {
+  const key = path6.resolve(homeDir);
+  const cached2 = claudeHomeBaseCanonicalCache.get(key);
+  if (cached2 !== void 0) {
+    return cached2;
+  }
+  const resolved = canonicalDeep(runnerClaudeHomeBaseDir(key));
+  claudeHomeBaseCanonicalCache.set(key, resolved);
+  return resolved;
+}
 var RUNNER_TEMP_PREFIXES = [
   "rost-runner-mcp-",
   "rost-runner-sandbox-",
   "rost-runner-askpass-",
-  "rost-runner-claude-config-"
+  "rost-runner-claude-config-",
+  "rost-runner-login-verify-"
 ];
 var RUNNER_TEMP_STARTUP_SWEEP_MAX_AGE_MS = 60 * 60 * 1e3;
 var RUNNER_TEMP_TURN_SWEEP_MAX_AGE_MS = 45 * 60 * 1e3;
@@ -63942,13 +63961,25 @@ var STRICT_SYSTEM_READ_SUBPATHS = [
   "/opt",
   "/nix"
 ];
+var KEYCHAIN_MACH_SERVICES = [
+  "com.apple.SecurityServer",
+  "com.apple.securityd.xpc",
+  "com.apple.security.agent",
+  "com.apple.security.XPCKeychainSandboxCheck"
+];
 function buildSeatbeltProfile(input) {
   const home = input.homeDir.replace(/\/+$/, "");
   const lines = ["(version 1)"];
   const claudeSource = input.claudeSourceHome ?? `${home}/.claude`;
   const codexSource = input.codexSourceHome ?? `${home}/.codex`;
-  const runtimeHomeAllows = input.modelRuntime === "claude" ? [claudeSource] : input.modelRuntime === "codex" ? [] : [claudeSource, codexSource];
-  const runtimeHomeDenies = input.modelRuntime === "claude" ? [codexSource] : input.modelRuntime === "codex" ? [codexSource, claudeSource].filter((p) => !runtimeHomeAllows.includes(p)) : [];
+  const claudeSecureStorageSource = input.claudeSecureStorageSourceHome ?? claudeSource;
+  const runtimeHomeAllows = [];
+  const runtimeHomeDenies = Array.from(/* @__PURE__ */ new Set([codexSource, claudeSource, claudeSecureStorageSource])).filter(
+    (p) => !runtimeHomeAllows.includes(p)
+  );
+  const claudeSourceSiblingJsonDenies = Array.from(/* @__PURE__ */ new Set([claudeSource, claudeSecureStorageSource])).map(
+    (dir) => literal2(`${dir}.json`)
+  );
   const denyReadBaseSubpaths = input.denyReadPaths.filter((p) => p.endsWith("/")).map((p) => subpath(p.replace(/\/+$/, "")));
   const denyReadLiterals = input.denyReadPaths.filter((p) => !p.endsWith("/")).map(literal2);
   const denyWriteSubpaths = input.denyWritePaths.filter((p) => p.endsWith("/")).map((p) => subpath(p.replace(/\/+$/, "")));
@@ -63958,8 +63989,11 @@ function buildSeatbeltProfile(input) {
     ...SENSITIVE_READ_LITERALS.map((rel) => literal2(`${home}/${rel}`))
   ];
   const projectCodexDir = input.modelRuntime === "codex" && input.workspaceDir !== input.tmpDir ? `${stripTrailingSlash(input.workspaceDir)}/.codex` : null;
-  const isolateRoot = stripTrailingSlash(canonicalCodexHomeBase(input.homeDir));
-  const allowLast = (paths) => (paths ?? []).map(stripTrailingSlash).filter((p) => p.length > 0 && p !== isolateRoot && isWithin(p, isolateRoot));
+  const codexIsolateRoot = stripTrailingSlash(canonicalCodexHomeBase(input.homeDir));
+  const claudeIsolateRoot = stripTrailingSlash(canonicalClaudeHomeBase(input.homeDir));
+  const allowLast = (paths) => (paths ?? []).map(stripTrailingSlash).filter(
+    (p) => p.length > 0 && p !== codexIsolateRoot && p !== claudeIsolateRoot && (isWithin(p, codexIsolateRoot) || isWithin(p, claudeIsolateRoot))
+  );
   const allowReadLast = allowLast(input.allowReadLastSubpaths);
   const allowWriteLast = allowLast(input.allowWriteLastSubpaths);
   if (input.strict) {
@@ -63980,9 +64014,10 @@ function buildSeatbeltProfile(input) {
       // every child path stays individually deny-gated. (Guard never hits this branch.)
       literal2("/"),
       ...STRICT_SYSTEM_READ_SUBPATHS.map(subpath),
-      // DER-1485: the ACTIVE runtime's own operator config dir is READ-allowed (claude reads its
-      // config), but NEVER the other's. It is NOT write-allowed — the source is a read-only seed,
-      // never a writable dir (round 5 P2). The isolate config dir is write-allowed via tmpDir.
+      // DER-3022: the operator SOURCE config dirs are NOT read-allowed for any runtime. The turn's
+      // only readable+writable config home is its per-turn ISOLATE, re-allowed as the absolute-last
+      // rule below. Keeping the (now-empty) `runtimeHomeAllows` spread as a belt: a future change
+      // that reintroduces a per-runtime source allow will not silently drop it from strict mode.
       ...runtimeHomeAllows.map(subpath),
       subpath(input.tmpDir)
     ];
@@ -64021,9 +64056,12 @@ function buildSeatbeltProfile(input) {
     ...credentialReadDenies,
     ...denyReadLiterals,
     ...input.denyReadLastSubpaths.map((p) => subpath(p.replace(/\/+$/, ""))),
-    // DER-1485: the other runtime's operator credential store — denied last-wins so it holds even
-    // under guard's allow-default reads (and over strict's system/home allow above).
+    // DER-1485 / DER-3022: the operator runtime-credential SOURCE stores — denied last-wins so it
+    // holds even under guard's allow-default reads (and over strict's system/home allow above).
     ...runtimeHomeDenies.map(subpath),
+    // DER-3022 (kickback round 3, P2): the claude source dirs' SIBLING `.json` files (e.g.
+    // `~/.claude.json` beside `~/.claude`) — a `subpath` deny on the directory does not cover them.
+    ...claudeSourceSiblingJsonDenies,
     ...projectCodexDenies
   ];
   lines.push(`(deny file-read* ${lastReadDenies.join(" ")})`);
@@ -64038,12 +64076,15 @@ function buildSeatbeltProfile(input) {
     // `.git/{objects,refs,worktrees,logs,index,HEAD}` stay writable for local commits.
     ...denyWriteSubpaths,
     ...denyWriteLiterals,
-    // DER-1485: the other runtime's operator credential store is never writable by this turn.
+    // DER-1485 / DER-3022: the operator runtime-credential SOURCE stores are never writable by this
+    // turn.
     ...runtimeHomeDenies.map(subpath),
-    // DER-1485 (round 5 P2): the ACTIVE runtime's own operator SOURCE config is read-only seed input —
-    // explicitly deny writes to it last-wins, so a workspace-write turn cannot plant settings/hooks
-    // into the operator's persistent claude CLI config. (This deny never overlaps a write re-allow,
-    // since runtimeHomeAllows are no longer write-allowed.)
+    // DER-3022 (kickback round 3, P2): same sibling-`.json` gap as the read deny above, for write.
+    ...claudeSourceSiblingJsonDenies,
+    // DER-1485 (round 5 P2) / DER-3022: the operator SOURCE config dirs are read-only seed input —
+    // explicitly deny writes to them last-wins, so a workspace-write turn cannot plant settings/hooks
+    // into the operator's persistent CLI config. (This deny never overlaps a write re-allow, since
+    // runtimeHomeAllows are no longer write-allowed.)
     ...runtimeHomeAllows.map(subpath),
     // DER-1485 (round 3): a codex turn must not write a hostile checked-in `.codex/config.toml`
     // (a non-seat MCP a trusted project would then load and shell out to) either.
@@ -64054,6 +64095,9 @@ function buildSeatbeltProfile(input) {
     lines.push(`(allow file-write* ${allowWriteLast.map(subpath).join(" ")})`);
   }
   lines.push('(deny mach-lookup (global-name "com.apple.coreservices.appleevents"))');
+  for (const service of KEYCHAIN_MACH_SERVICES) {
+    lines.push(`(deny mach-lookup (global-name "${service}"))`);
+  }
   if (!input.allowNetwork) {
     lines.push("(deny network*)");
   } else if (input.strict) {
@@ -64120,24 +64164,34 @@ function resolveSandboxSpec(options) {
   );
   denyWritePaths.push(`${canonicalFile(RUNNER_ASKPASS_DIR)}/`);
   denyWritePaths.push(`${canonicalCodexHomeBase(options.homeDir)}/`);
+  denyWritePaths.push(`${canonicalClaudeHomeBase(options.homeDir)}/`);
   denyWritePaths.push(`${canonicalDeep(LEGACY_TMP_CODEX_HOME_DIR)}/`);
   const allowWritePaths = (options.allowWritePaths ?? []).map(canonical);
   const denyReadLastSubpaths = [
     `${canonicalFile(RUNNER_ASKPASS_DIR)}/`,
-    // DER-1485 (round 5/6): the harness-private codex-home BASE. It holds every runner's isolated
-    // CODEX_HOME, so denying the base keeps one runner's turn out of a SIBLING runner's operator
-    // token and keeps the turn from pre-planting a home path the harness would later seed into.
-    // This turn's OWN isolate is re-allowed after this deny (`codexIsolateHomeDir` below) — it must
-    // be, because codex reads its own `auth.json` under the SAME profile its Bash child runs under.
+    // DER-1485 (round 5/6) / DER-3022: the harness-private runtime-home BASES. They hold every
+    // runner's isolated CODEX_HOME / CLAUDE_CONFIG_DIR cell, so denying each base keeps one runner's
+    // turn out of a SIBLING runner's operator token and keeps the turn from pre-planting a home path
+    // the harness would later seed into. This turn's OWN isolate is re-allowed after this deny
+    // (`codexIsolateHomeDir`/`claudeIsolateHomeDir` below) — it must be, because the runtime reads its
+    // own credentials under the SAME profile its Bash child runs under.
     //
-    // DER-2298 (finding 3): the DURABLE base (a function of `homeDir` now) plus the round-5/6
-    // VOLATILE base — both denied for the same reason: neither may be read by a sandboxed turn,
-    // whether it holds this runner's own home, a sibling runner's, or a pre-move leftover.
+    // DER-2298 / DER-3022 (finding 3): the DURABLE bases (functions of `homeDir` now) plus the
+    // round-5/6 VOLATILE codex base — all denied for the same reason: none may be read by a sandboxed
+    // turn, whether it holds this runner's own home, a sibling runner's, or a pre-move leftover.
     `${canonicalCodexHomeBase(options.homeDir)}/`,
+    `${canonicalClaudeHomeBase(options.homeDir)}/`,
     `${canonicalDeep(LEGACY_TMP_CODEX_HOME_DIR)}/`
   ];
   const codexIsolate = options.codexIsolateHomeDir ? path6.join(canonicalCodexHomeBase(options.homeDir), path6.basename(options.codexIsolateHomeDir)) : null;
-  const allowLastSubpaths = codexIsolate !== null && options.modelRuntime === "codex" ? [codexIsolate] : [];
+  const claudeIsolate = options.claudeIsolateHomeDir ? path6.join(canonicalClaudeHomeBase(options.homeDir), path6.basename(options.claudeIsolateHomeDir)) : null;
+  const allowLastSubpaths = [];
+  if (codexIsolate !== null && options.modelRuntime === "codex") {
+    allowLastSubpaths.push(codexIsolate);
+  }
+  if (claudeIsolate !== null && options.modelRuntime === "claude") {
+    allowLastSubpaths.push(claudeIsolate);
+  }
   if (codexIsolate !== null) {
     const legacyFlatHome = path6.join(path6.dirname(canonicalDeep(LEGACY_TMP_CODEX_HOME_DIR)), path6.basename(codexIsolate));
     denyReadLastSubpaths.push(`${legacyFlatHome}/`);
@@ -64157,7 +64211,8 @@ function resolveSandboxSpec(options) {
     strict: options.mode === "strict",
     ...options.modelRuntime ? { modelRuntime: options.modelRuntime } : {},
     ...options.claudeSourceHome ? { claudeSourceHome: canonical(options.claudeSourceHome) } : {},
-    ...options.codexSourceHome ? { codexSourceHome: canonical(options.codexSourceHome) } : {}
+    ...options.codexSourceHome ? { codexSourceHome: canonical(options.codexSourceHome) } : {},
+    ...options.claudeSecureStorageSourceHome ? { claudeSecureStorageSourceHome: canonical(options.claudeSecureStorageSourceHome) } : {}
   });
   return {
     kind: "seatbelt",
@@ -65058,15 +65113,13 @@ function parseSemver2(value) {
   };
 }
 
-// src/runner-serve.ts
-import { execFile as execFileCallback5, spawn } from "node:child_process";
-import { createHash as createHash4, randomUUID } from "node:crypto";
-import { constants as fsConstants4 } from "node:fs";
-import { access as access3, chmod as chmod2, lstat as lstat2, mkdir as mkdir6, open as open2, readFile as readFile9, rename as rename2, rm as rm6, statfs, writeFile as writeFile6 } from "node:fs/promises";
-import { cpus, homedir as homedir5, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
-import path10 from "node:path";
-import { setTimeout as sleep3 } from "node:timers/promises";
-import { promisify as promisify5 } from "node:util";
+// src/runner-login.ts
+import { spawn as spawn2 } from "node:child_process";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { constants as fsConstants5 } from "node:fs";
+import { lstat as lstat3, mkdtemp as mkdtemp2, readdir as readdir5, realpath as realpath2, rm as rm7, writeFile as writeFile7 } from "node:fs/promises";
+import os3 from "node:os";
+import path11 from "node:path";
 
 // src/forge-workspace.ts
 import { execFile as execFileCallback4 } from "node:child_process";
@@ -65140,11 +65193,14 @@ var execFile4 = promisify4(execFileCallback4);
 var MODEL_SPAWN_ENV_ALLOWLIST = [
   "PATH",
   "HOME",
-  // Claude Code resolves its stored login by the `$USER` account name — the macOS
-  // Keychain item is keyed on it (`security find-generic-password -a "$USER" -s
-  // "Claude Code-credentials"`). Without USER a spawned `claude` reports "Not logged in"
-  // even on a host that has `claude` installed and logged in, breaking the "npm install +
-  // login, no terminal steps" runner UX (DER-1311). USER is an identity var, not a secret.
+  // Retained as a non-secret identity var some child tools still consult. It is no longer
+  // load-bearing for Claude Code auth: Claude Code v2 resolves its credential from the secure
+  // store scoped by `CLAUDE_SECURESTORAGE_CONFIG_DIR` (or, absent that, by `CLAUDE_CONFIG_DIR`)
+  // — measured on claude 2.1.220/macOS: this is the `.credentials.json` file inside that
+  // directory, read straight off disk on macOS exactly as on Linux, never looked up by `$USER`;
+  // `claude auth status` succeeds with `USER` unset (DER-3022). The v1 single-item-Keychain
+  // assumption is retired — the runner's turn sandbox denies the Keychain outright, so the file
+  // is the only credential store a turn can reach on either OS.
   "USER",
   "LANG",
   "LC_ALL",
@@ -65152,7 +65208,7 @@ var MODEL_SPAWN_ENV_ALLOWLIST = [
   "SHELL",
   "NODE_OPTIONS"
 ];
-function buildModelSpawnEnv(base, claudeConfigDir, codexHomeDir) {
+function buildModelSpawnEnv(base, claudeConfigDir, codexHomeDir, claudeSecureStorageDir) {
   const out = {};
   for (const key of MODEL_SPAWN_ENV_ALLOWLIST) {
     const value = base[key];
@@ -65167,9 +65223,36 @@ function buildModelSpawnEnv(base, claudeConfigDir, codexHomeDir) {
   if (typeof codexHomeDir === "string" && codexHomeDir.length > 0) {
     out.CODEX_HOME = codexHomeDir;
   }
+  delete out.CLAUDE_SECURESTORAGE_CONFIG_DIR;
+  if (typeof claudeSecureStorageDir === "string" && claudeSecureStorageDir.length > 0) {
+    out.CLAUDE_SECURESTORAGE_CONFIG_DIR = claudeSecureStorageDir;
+  }
   return out;
 }
-var CLAUDE_CONFIG_AUTH_FILES = [".credentials.json", ".claude.json"];
+var CLAUDE_CONFIG_SEED_FILE = ".claude.json";
+var CLAUDE_CONFIG_SEED_ALLOWLIST_KEYS = [
+  "hasCompletedOnboarding",
+  "theme",
+  "userID",
+  "oauthAccount"
+];
+function sanitizeClaudeConfigJson(data) {
+  try {
+    const parsed = JSON.parse(data.toString("utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const sanitized = {};
+    for (const key of CLAUDE_CONFIG_SEED_ALLOWLIST_KEYS) {
+      if (key in parsed) {
+        sanitized[key] = parsed[key];
+      }
+    }
+    return sanitized;
+  } catch {
+    return null;
+  }
+}
 function resolveSourceClaudeConfigDir(base) {
   const explicit = requireNonBlank("CLAUDE_CONFIG_DIR", base.CLAUDE_CONFIG_DIR);
   if (explicit !== null) {
@@ -65179,18 +65262,212 @@ function resolveSourceClaudeConfigDir(base) {
   const homeDir = typeof home === "string" && home.length > 0 ? home : os2.homedir();
   return path8.join(homeDir, ".claude");
 }
-async function provisionIsolatedClaudeConfigDir(base, configDir, onRepair) {
+function resolveSourceClaudeSecureStorageDir(base) {
+  const explicit = requireNonBlank("CLAUDE_SECURESTORAGE_CONFIG_DIR", base.CLAUDE_SECURESTORAGE_CONFIG_DIR);
+  if (explicit !== null) {
+    return explicit;
+  }
+  return resolveSourceClaudeConfigDir(base);
+}
+async function provisionIsolatedClaudeConfigDir(configDir, seedSourceDir, onRepair) {
   await ensureVerifiedPrivateDir(configDir, "claude config dir", onRepair);
-  const source = resolveSourceClaudeConfigDir(base);
-  for (const file2 of CLAUDE_CONFIG_AUTH_FILES) {
-    try {
-      const data = await readFile8(path8.join(source, file2));
-      await writeFileAtomicNoFollow(path8.join(configDir, file2), data, { mode: 384 });
-    } catch {
+  const source = seedSourceDir;
+  await ensureVerifiedCodexHomeDir(source, onRepair, "claude credential cell");
+  const seedRead = await readSeedFile(source, CLAUDE_CONFIG_SEED_FILE);
+  if (seedRead.status === "ok") {
+    const sanitized = sanitizeClaudeConfigJson(seedRead.data);
+    if (sanitized !== null) {
+      await writeFileAtomicNoFollow(
+        path8.join(configDir, CLAUDE_CONFIG_SEED_FILE),
+        Buffer.from(JSON.stringify(sanitized), "utf8"),
+        { mode: 384 }
+      );
+    } else {
+      onRepair?.(`claude config dir seed: ${CLAUDE_CONFIG_SEED_FILE} in ${source} was not a plain JSON object \u2014 skipped`);
     }
+  } else if (seedRead.status === "rejected") {
+    onRepair?.(`claude config dir seed: ${CLAUDE_CONFIG_SEED_FILE} in ${source} was not a plain file owned by this user (possible attack) \u2014 skipped`);
   }
   return configDir;
 }
+async function sweepClaudeCredentialCell(cell2, onRepair) {
+  for (const entry of await readdir3(cell2)) {
+    const entryPath = path8.join(cell2, entry);
+    if (entry === ".credentials.json" || entry === ".claude.json") {
+      const info = await lstat(entryPath).catch(() => null);
+      if (info !== null && info.isFile() && !info.isSymbolicLink()) {
+        continue;
+      }
+    }
+    let looksLikeOwnOrphanedTemp = false;
+    if (CODEX_HOME_TMP_NAME_RE.test(entry)) {
+      const entryInfo = await lstat(entryPath).catch(() => null);
+      looksLikeOwnOrphanedTemp = entryInfo !== null && entryInfo.isFile();
+    }
+    let looksLikeOwnClaudeBookkeeping = false;
+    if (!looksLikeOwnOrphanedTemp && CLAUDE_CELL_BENIGN_ENTRIES.has(entry)) {
+      const entryInfo = await lstat(entryPath).catch(() => null);
+      looksLikeOwnClaudeBookkeeping = entryInfo !== null && !entryInfo.isSymbolicLink() && (entryInfo.isFile() || entryInfo.isDirectory());
+    }
+    if (!looksLikeOwnOrphanedTemp && !looksLikeOwnClaudeBookkeeping) {
+      onRepair?.(`claude credential cell ${cell2}: removing unexpected entry ${JSON.stringify(entry)}`);
+    }
+    try {
+      await rm5(entryPath, { recursive: true, force: true });
+    } catch (error51) {
+      const code = error51.code ?? "unknown";
+      throw new Error(
+        `refusing to run claude runner login: could not remove ${JSON.stringify(entry)} from the claude credential cell ${cell2} (${code}). The credential-cell sweep must not fail open \u2014 clear the entry (e.g. \`chflags -R nouchg\`, then \`rm -rf\`) and retry.`
+      );
+    }
+  }
+  const configRead = await readSeedFile(cell2, CLAUDE_CONFIG_SEED_FILE);
+  const credentialsRead = await readSeedFile(cell2, ".credentials.json");
+  const configPath = path8.join(cell2, CLAUDE_CONFIG_SEED_FILE);
+  const credentialsPath = path8.join(cell2, ".credentials.json");
+  if (configRead.status === "rejected") {
+    onRepair?.(
+      `claude credential cell ${cell2}: ${CLAUDE_CONFIG_SEED_FILE} was not a plain file owned by this user (possible attack) \u2014 removed`
+    );
+    try {
+      await rm5(configPath, { force: true });
+    } catch (error51) {
+      const code = error51.code ?? "unknown";
+      throw new Error(
+        `refusing to run claude runner login: could not remove ${JSON.stringify(CLAUDE_CONFIG_SEED_FILE)} from the claude credential cell ${cell2} (${code}). The credential-cell sweep must not fail open \u2014 clear the entry (e.g. \`chflags -R nouchg\`, then \`rm -rf\`) and retry.`
+      );
+    }
+  } else if (configRead.status === "ok") {
+    const sanitized = sanitizeClaudeConfigJson(configRead.data);
+    if (sanitized !== null) {
+      await writeFileAtomicNoFollow(configPath, Buffer.from(JSON.stringify(sanitized), "utf8"), { mode: 384 });
+    } else {
+      onRepair?.(`claude credential cell ${cell2}: ${CLAUDE_CONFIG_SEED_FILE} was not a plain JSON object \u2014 removed`);
+      await rm5(configPath, { force: true });
+    }
+  }
+  if (credentialsRead.status === "rejected") {
+    onRepair?.(
+      `claude credential cell ${cell2}: .credentials.json was not a plain file owned by this user (possible attack) \u2014 removed`
+    );
+    try {
+      await rm5(credentialsPath, { force: true });
+    } catch (error51) {
+      const code = error51.code ?? "unknown";
+      throw new Error(
+        `refusing to run claude runner login: could not remove ".credentials.json" from the claude credential cell ${cell2} (${code}). The credential-cell sweep must not fail open \u2014 clear the entry (e.g. \`chflags -R nouchg\`, then \`rm -rf\`) and retry.`
+      );
+    }
+  }
+}
+async function readSeedFile(source, file2) {
+  const handle = await open(path8.join(source, file2), fsConstants3.O_RDONLY | fsConstants3.O_NOFOLLOW).catch(() => null);
+  if (handle === null) {
+    return { status: "absent" };
+  }
+  try {
+    const info = await handle.stat();
+    const usable = info.isFile() && info.nlink === 1 && info.size > 0 && (typeof process.getuid !== "function" || info.uid === process.getuid());
+    if (!usable) {
+      return { status: "rejected" };
+    }
+    return { status: "ok", data: await handle.readFile() };
+  } finally {
+    await handle.close();
+  }
+}
+async function hasUsableClaudeCredentialFile(cell2) {
+  const read = await readSeedFile(cell2, ".credentials.json");
+  if (read.status !== "ok") {
+    return false;
+  }
+  return parseUsableClaudeCredentialJson(read.data.toString("utf8")) !== null;
+}
+function claudeKeychainServiceNameForSecureStorageDir(secureStorageDir) {
+  const digest = createHash3("sha256").update(secureStorageDir).digest("hex").slice(0, 8);
+  return `Claude Code-credentials-${digest}`;
+}
+function parseUsableClaudeCredentialJson(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const oauth = parsed.claudeAiOauth;
+    if (!oauth || typeof oauth !== "object" || Array.isArray(oauth)) {
+      return null;
+    }
+    const accessToken = oauth.accessToken;
+    if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
+      return null;
+    }
+    return JSON.stringify(parsed);
+  } catch {
+    return null;
+  }
+}
+async function materializeClaudeCredentialFileFromMacosKeychain(cell2, options = {}) {
+  const platform2 = options.platform ?? process.platform;
+  if (platform2 !== "darwin") {
+    return { status: "unavailable", reason: "not_darwin" };
+  }
+  if (await hasUsableClaudeCredentialFile(cell2)) {
+    return { status: "already_present" };
+  }
+  const serviceName3 = claudeKeychainServiceNameForSecureStorageDir(cell2);
+  const readKeychainSecret = options.readKeychainSecretImpl ?? readClaudeKeychainSecret;
+  let raw;
+  try {
+    raw = await readKeychainSecret(serviceName3);
+  } catch (error51) {
+    return {
+      status: "unavailable",
+      reason: `keychain_read_failed:${redactSecrets(error51 instanceof Error ? error51.message : String(error51))}`
+    };
+  }
+  if (raw === null) {
+    return { status: "unavailable", reason: "keychain_item_missing" };
+  }
+  const normalized = parseUsableClaudeCredentialJson(raw.trim());
+  if (normalized === null) {
+    return { status: "unavailable", reason: "keychain_payload_unusable" };
+  }
+  const dest = path8.join(cell2, ".credentials.json");
+  try {
+    await writeFileAtomicNoFollow(dest, `${normalized}
+`, { mode: 384 });
+  } catch (error51) {
+    return {
+      status: "unavailable",
+      reason: `credential_file_write_failed:${redactSecrets(error51 instanceof Error ? error51.message : String(error51))}`
+    };
+  }
+  if (!await hasUsableClaudeCredentialFile(cell2)) {
+    return { status: "unavailable", reason: "credential_file_unreadable_after_write" };
+  }
+  return { status: "written" };
+}
+async function readClaudeKeychainSecret(serviceName3) {
+  try {
+    const { stdout } = await execFile4("security", ["find-generic-password", "-s", serviceName3, "-w"], {
+      encoding: "utf8",
+      timeout: 1e4,
+      maxBuffer: 1024 * 1024
+    });
+    const trimmed = stdout.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch (error51) {
+    const code = error51.status ?? error51.code;
+    if (code === 44) {
+      return null;
+    }
+    const message = error51 instanceof Error ? error51.message : String(error51);
+    if (/could not be found|SecKeychainSearchCopyNext/i.test(message)) {
+      return null;
+    }
+    throw error51;
+  }
+}
 var CODEX_HOME_AUTH_FILE = "auth.json";
 var CODEX_HOME_CONFIG_FILE = "config.toml";
 function resolveSourceCodexHomeDir(base) {
@@ -65204,6 +65481,7 @@ function resolveSourceCodexHomeDir(base) {
 }
 var CODEX_HOME_TMP_PREFIX = ".rost-tmp-";
 var CODEX_HOME_TMP_NAME_RE = /^\.rost-tmp-[0-9a-f]{24}$/;
+var CLAUDE_CELL_BENIGN_ENTRIES = /* @__PURE__ */ new Set([".claude.json.lock", "backups"]);
 async function writeFileAtomicNoFollow(dest, data, options = {}) {
   const mode = options.mode ?? 384;
   const durable = options.durable ?? true;
@@ -65260,24 +65538,24 @@ async function writeFileAtomicNoFollow(dest, data, options = {}) {
     await rm5(tmp, { force: true }).catch(() => void 0);
   }
 }
-async function ensureVerifiedCodexHomeBase(baseDir) {
+async function ensureVerifiedCodexHomeBase(baseDir, label = "codex home base") {
   const preInfo = await lstat(baseDir).catch(() => null);
   if (preInfo !== null && (preInfo.isSymbolicLink() || !preInfo.isDirectory())) {
-    throw new Error(`refusing to use codex home base ${baseDir}: not a real directory (possible symlink attack)`);
+    throw new Error(`refusing to use ${label} ${baseDir}: not a real directory (possible symlink attack)`);
   }
   await mkdir5(baseDir, { recursive: true, mode: 448 });
   const expected = path8.join(await realpath(path8.dirname(baseDir)), path8.basename(baseDir));
   const info = await lstat(baseDir);
   if (info.isSymbolicLink() || !info.isDirectory()) {
-    throw new Error(`refusing to use codex home base ${baseDir}: not a real directory (possible symlink attack)`);
+    throw new Error(`refusing to use ${label} ${baseDir}: not a real directory (possible symlink attack)`);
   }
   if (typeof process.getuid === "function" && info.uid !== process.getuid()) {
-    throw new Error(`refusing to use codex home base ${baseDir}: not owned by this user (possible pre-planted dir)`);
+    throw new Error(`refusing to use ${label} ${baseDir}: not owned by this user (possible pre-planted dir)`);
   }
   await chmod(baseDir, 448);
   const resolved = await realpath(baseDir);
   if (resolved !== expected) {
-    throw new Error(`refusing to use codex home base ${baseDir}: resolves to ${resolved} (possible symlink attack)`);
+    throw new Error(`refusing to use ${label} ${baseDir}: resolves to ${resolved} (possible symlink attack)`);
   }
   return resolved;
 }
@@ -65303,26 +65581,53 @@ async function ensureVerifiedPrivateDir(dir, label, onRepair) {
     return;
   }
 }
-async function ensureVerifiedCodexHomeDir(homeDir, onRepair) {
-  const base = await ensureVerifiedCodexHomeBase(path8.dirname(path8.resolve(homeDir)));
+async function ensureVerifiedCodexHomeDir(homeDir, onRepair, label = "codex home") {
+  const base = await ensureVerifiedCodexHomeBase(path8.dirname(path8.resolve(homeDir)), `${label} base`);
   const expected = path8.join(base, path8.basename(homeDir));
-  await ensureVerifiedPrivateDir(homeDir, "codex home", onRepair);
+  await ensureVerifiedPrivateDir(homeDir, label, onRepair);
   if (await realpath(homeDir) !== expected) {
-    throw new Error(`refusing to use codex home ${homeDir}: resolved outside ${expected} (possible symlink attack)`);
+    throw new Error(`refusing to use ${label} ${homeDir}: resolved outside ${expected} (possible symlink attack)`);
   }
   return expected;
 }
+async function isVerifiedExistingCodexHomeDir(homeDir) {
+  const resolvedHome = path8.resolve(homeDir);
+  const base = path8.dirname(resolvedHome);
+  const [baseInfo, homeInfo] = await Promise.all([
+    lstat(base).catch(() => null),
+    lstat(resolvedHome).catch(() => null)
+  ]);
+  const ownedDirectory = (info) => info !== null && info.isDirectory() && !info.isSymbolicLink() && (typeof process.getuid !== "function" || info.uid === process.getuid());
+  if (!ownedDirectory(baseInfo) || !ownedDirectory(homeInfo)) {
+    return false;
+  }
+  const [baseParentReal, baseReal, homeReal] = await Promise.all([
+    realpath(path8.dirname(base)).catch(() => null),
+    realpath(base).catch(() => null),
+    realpath(resolvedHome).catch(() => null)
+  ]);
+  if (baseParentReal === null || baseReal === null || homeReal === null) {
+    return false;
+  }
+  return baseReal === path8.join(baseParentReal, path8.basename(base)) && homeReal === path8.join(baseReal, path8.basename(resolvedHome));
+}
 function codexHomeSeedMarkerPath(homeDir) {
   return path8.join(path8.dirname(homeDir), `${path8.basename(homeDir)}.seeded`);
 }
-async function commitCodexHomeSeedMarker(homeDir) {
+async function commitCodexHomeSeedMarker(homeDir, options = {}) {
   const marker = codexHomeSeedMarkerPath(homeDir);
-  const alreadyMarked = await lstat(marker).then(() => true).catch(() => false);
-  if (alreadyMarked) {
+  const existing = await lstat(marker).catch(() => null);
+  const usableExisting = existing !== null && existing.isFile() && !existing.isSymbolicLink() && existing.nlink === 1 && (typeof process.getuid !== "function" || existing.uid === process.getuid());
+  if (existing !== null && (!options.required || usableExisting)) {
     return;
   }
-  await writeFileAtomicNoFollow(marker, `${(/* @__PURE__ */ new Date()).toISOString()}
-`, { mode: 384 }).catch(() => void 0);
+  const write = writeFileAtomicNoFollow(marker, `${(/* @__PURE__ */ new Date()).toISOString()}
+`, { mode: 384 });
+  if (options.required) {
+    await write;
+    return;
+  }
+  await write.catch(() => void 0);
 }
 async function provisionIsolatedCodexHomeDir(base, homeDir, projectRoot, onRepair) {
   await ensureVerifiedCodexHomeDir(homeDir, onRepair);
@@ -65415,14 +65720,15 @@ trust_level = "untrusted"
     }
   }
 }
-function codexHomeBusySummary(waitedMs) {
+function credentialCellBusySummary(waitedMs, runtime) {
   const waitedSeconds = Math.max(0, Math.round(waitedMs / 1e3));
-  return `refusing to run: another codex turn on this runner holds the isolated CODEX_HOME. The ChatGPT refresh token there is single-use, so two concurrent turns would both exchange it and leave the runner permanently unauthenticated. Waited ${waitedSeconds}s and it is still held; this is transient \u2014 retry the unit.`;
+  const cellLabel = runtime === "codex" ? "the isolated CODEX_HOME" : "the isolated claude credential cell";
+  return `refusing to run: another ${runtime} turn on this runner holds ${cellLabel}. The credential there is single-use and rotates on refresh, so two concurrent turns would both exchange it and leave the runner permanently unauthenticated. Waited ${waitedSeconds}s and it is still held; this is transient \u2014 retry the unit.`;
 }
-var CODEX_HOME_BUSY_SUMMARY = codexHomeBusySummary(0);
 var CODEX_HOME_LOCK_FORMING_GRACE_MS = 5e3;
 async function acquireCodexHomeLock(homeDir, options = {}) {
-  const base = await ensureVerifiedCodexHomeBase(path8.dirname(path8.resolve(homeDir)));
+  const label = options.label ?? "codex home";
+  const base = await ensureVerifiedCodexHomeBase(path8.dirname(path8.resolve(homeDir)), `${label} base`);
   const lockPath = path8.join(base, `${path8.basename(homeDir)}.lock`);
   const waitMs = options.waitMs ?? 30 * 6e4;
   const staleMs = options.staleMs ?? 60 * 6e4;
@@ -66299,6 +66605,16 @@ async function removeWorkspace(ws) {
   await removeWorktree(ws.baseRepo, ws.worktreeDir);
 }
 
+// src/runner-serve.ts
+import { execFile as execFileCallback5, spawn } from "node:child_process";
+import { createHash as createHash4, randomUUID } from "node:crypto";
+import { constants as fsConstants4 } from "node:fs";
+import { access as access3, chmod as chmod2, lstat as lstat2, mkdir as mkdir6, open as open2, readFile as readFile9, rename as rename2, rm as rm6, statfs, writeFile as writeFile6 } from "node:fs/promises";
+import { cpus, homedir as homedir5, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
+import path10 from "node:path";
+import { setTimeout as sleep3 } from "node:timers/promises";
+import { promisify as promisify5 } from "node:util";
+
 // src/host-resource.ts
 import { execFileSync } from "node:child_process";
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -66623,10 +66939,12 @@ ${usage()}
   let failed = false;
   let activeSessions = 0;
   let reconciled = false;
+  let deferredReconcileWorkOrderIds = null;
   const activeTurnExecutionIds = /* @__PURE__ */ new Set();
   let serverHeartbeatContractVersion = null;
+  let serverClaimContractVersion = null;
   do {
-    const detectedCapabilities = await detectCapabilities(cliVersion, env, homeDir, config2.maxSessionsOverride);
+    const detectedCapabilities = await detectCapabilities(cliVersion, env, homeDir, state, config2.maxSessionsOverride);
     const capabilities = capabilitiesForConfiguredRuntime(detectedCapabilities, config2.runtime);
     const localRuntime = config2.execute ? effectiveExecutionRuntime(config2.runtime, capabilities) : null;
     try {
@@ -66638,6 +66956,7 @@ ${usage()}
       }), state.runner_secret);
       const heartbeatOk = heartbeat.status === 200;
       if (!heartbeatOk) {
+        serverClaimContractVersion = null;
         options.io.stderr.write(`heartbeat ${heartbeat.status}: ${redactForLog(JSON.stringify(heartbeat.json))}
 `);
         failed = true;
@@ -66647,6 +66966,7 @@ ${usage()}
         if (learnedVersion !== null) {
           serverHeartbeatContractVersion = learnedVersion;
         }
+        serverClaimContractVersion = learnedVersion !== null && learnedVersion >= HEARTBEAT_CLAIM_MIN_CONTRACT_VERSION ? learnedVersion : null;
         options.io.stdout.write(`heartbeat ok #${beat} runner_id=${state.runner_id} claude=${capabilities.claude.installed} codex=${capabilities.codex.installed}
 `);
       }
@@ -66667,32 +66987,57 @@ ${usage()}
           }
         });
         try {
-          if (!reconciled && heartbeatOk) {
+          if (!reconciled && heartbeatOk && serverSupportsRunnerClaimContract(serverClaimContractVersion)) {
+            let reconcileOutcome = { deferredWorkOrderIds: [] };
             try {
-              await reconcileOrphanedInFlightWorkOrders({ fetchImpl, appUrl: options.appUrl, state, config: config2, io: options.io, allowResume: true });
+              reconcileOutcome = await reconcileOrphanedInFlightWorkOrders({
+                fetchImpl,
+                appUrl: options.appUrl,
+                state,
+                config: config2,
+                io: options.io,
+                allowResume: true,
+                localRuntime,
+                onlyWorkOrderIds: deferredReconcileWorkOrderIds
+              });
             } catch (error51) {
               options.io.stderr.write(`reconcile orphaned work orders failed (continuing): ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `);
             } finally {
-              reconciled = true;
+              deferredReconcileWorkOrderIds = reconcileOutcome.deferredWorkOrderIds.length > 0 ? new Set(reconcileOutcome.deferredWorkOrderIds) : null;
+              reconciled = reconcileOutcome.deferredWorkOrderIds.length === 0;
             }
           }
-          await claimAndExecute(fetchImpl, options.appUrl, state, config2, options.io, localRuntime, activeTurnExecutionIds);
+          if (serverSupportsRunnerClaimContract(serverClaimContractVersion) && deferredReconcileWorkOrderIds === null) {
+            await claimAndExecute(fetchImpl, options.appUrl, state, config2, options.io, localRuntime, activeTurnExecutionIds);
+          }
         } finally {
           stopTurnHeartbeat();
           activeSessions = Math.max(0, activeSessions - 1);
         }
       } else if (!reconciled && heartbeatOk) {
+        let reconcileOutcome = { deferredWorkOrderIds: [] };
         try {
-          await reconcileOrphanedInFlightWorkOrders({ fetchImpl, appUrl: options.appUrl, state, config: config2, io: options.io, allowResume: false });
+          reconcileOutcome = await reconcileOrphanedInFlightWorkOrders({
+            fetchImpl,
+            appUrl: options.appUrl,
+            state,
+            config: config2,
+            io: options.io,
+            allowResume: false,
+            localRuntime: null,
+            onlyWorkOrderIds: deferredReconcileWorkOrderIds
+          });
         } catch (error51) {
           options.io.stderr.write(`reconcile orphaned work orders failed (continuing): ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `);
         } finally {
-          reconciled = true;
+          deferredReconcileWorkOrderIds = reconcileOutcome.deferredWorkOrderIds.length > 0 ? new Set(reconcileOutcome.deferredWorkOrderIds) : null;
+          reconciled = reconcileOutcome.deferredWorkOrderIds.length === 0;
         }
       }
     } catch (error51) {
+      serverClaimContractVersion = null;
       failed = true;
       options.io.stderr.write(`transient runner error (continuing): ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `);
@@ -66715,13 +67060,17 @@ ${usage()}
         () => serverHeartbeatContractVersion,
         (v) => {
           serverHeartbeatContractVersion = v;
+        },
+        () => serverClaimContractVersion,
+        (v) => {
+          serverClaimContractVersion = v;
         }
       );
     }
   } while (!config2.once);
   return heartbeatSucceeded && !failed ? 0 : 1;
 }
-async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runtime, capabilities, telemetry, activeTurnExecutionIds, serverContractVersion, recordServerContractVersion) {
+async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runtime, capabilities, telemetry, activeTurnExecutionIds, serverHeartbeatContractVersion, recordServerHeartbeatContractVersion, serverClaimContractVersion, recordServerClaimContractVersion) {
   const deadline = Date.now() + config2.heartbeatMs;
   const stopWait = runtime ? startTurnHeartbeat({
     fetchImpl,
@@ -66732,14 +67081,15 @@ async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runt
     io,
     telemetry,
     activeTurnIds: () => [...activeTurnExecutionIds],
-    serverContractVersion,
-    recordServerContractVersion
+    serverContractVersion: serverHeartbeatContractVersion,
+    recordServerContractVersion: recordServerHeartbeatContractVersion,
+    recordClaimContractVersion: recordServerClaimContractVersion
   }) : null;
   try {
     while (Date.now() < deadline) {
       const intervalMs = Math.min(config2.interactiveClaimMs, deadline - Date.now());
       await sleep3(intervalMs);
-      if (!runtime || Date.now() >= deadline) {
+      if (!runtime || Date.now() >= deadline || !serverSupportsRunnerClaimContract(serverClaimContractVersion())) {
         continue;
       }
       try {
@@ -66754,6 +67104,10 @@ async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runt
   }
 }
 var HEARTBEAT_ACTIVE_TURN_MIN_CONTRACT_VERSION = 2;
+var HEARTBEAT_CLAIM_MIN_CONTRACT_VERSION = 3;
+function serverSupportsRunnerClaimContract(version4) {
+  return version4 !== null && version4 >= HEARTBEAT_CLAIM_MIN_CONTRACT_VERSION;
+}
 function readHeartbeatContractVersion(json2) {
   const value = json2.heartbeat_contract_version;
   return typeof value === "number" && Number.isFinite(value) ? value : null;
@@ -66788,6 +67142,7 @@ function startTurnHeartbeat(deps) {
           serverContractVersion: deps.serverContractVersion()
         }), deps.secret, controller.signal);
         if (!stopped && response.status !== 200) {
+          deps.recordClaimContractVersion?.(null);
           deps.io.stderr.write(`turn heartbeat ${response.status}: ${redactForLog(JSON.stringify(response.json))}
 `);
         } else if (!stopped && response.status === 200) {
@@ -66795,8 +67150,14 @@ function startTurnHeartbeat(deps) {
           if (learnedVersion !== null) {
             deps.recordServerContractVersion(learnedVersion);
           }
+          deps.recordClaimContractVersion?.(
+            learnedVersion !== null && learnedVersion >= HEARTBEAT_CLAIM_MIN_CONTRACT_VERSION ? learnedVersion : null
+          );
         }
       } catch (error51) {
+        if (!stopped) {
+          deps.recordClaimContractVersion?.(null);
+        }
         if (!stopped) {
           deps.io.stderr.write(`turn heartbeat error (continuing): ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `);
@@ -66848,7 +67209,7 @@ function detectTelemetry(capabilities, env, activeSessions, cliVersion) {
 }
 function parseServeArgs(args, appUrl2, env, homeDir) {
   let name = env.RUNNER_NAME ?? `headless-${hostname3()}`;
-  let stateFile = env.RUNNER_STATE_FILE ?? path10.join(tmpdir2(), `rost-runner-${createHash4("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
+  let stateFile = env.RUNNER_STATE_FILE ?? defaultRunnerStateFile(appUrl2);
   let heartbeatMs = Number(env.RUNNER_HEARTBEAT_MS ?? 3e4);
   let interactiveClaimMs = Number(env.RUNNER_INTERACTIVE_CLAIM_MS ?? 1e3);
   let execute2 = env.RUNNER_EXECUTE === "1";
@@ -67021,10 +67382,14 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
   };
   await saveState(config2.stateFile, state);
   if (priorState && priorState.runner_id !== runnerId) {
-    const supersededHome = stableCodexHomeDir(priorState, config2.homeDir);
-    await rm6(supersededHome, { recursive: true, force: true }).catch(() => void 0);
-    await rm6(`${supersededHome}.seeded`, { force: true }).catch(() => void 0);
-    await rm6(`${supersededHome}.lock`, { force: true }).catch(() => void 0);
+    const supersededCodexHome = stableCodexHomeDir(priorState, config2.homeDir);
+    await rm6(supersededCodexHome, { recursive: true, force: true }).catch(() => void 0);
+    await rm6(`${supersededCodexHome}.seeded`, { force: true }).catch(() => void 0);
+    await rm6(`${supersededCodexHome}.lock`, { force: true }).catch(() => void 0);
+    const supersededClaudeHome = stableClaudeHomeDir(priorState, config2.homeDir);
+    await rm6(supersededClaudeHome, { recursive: true, force: true }).catch(() => void 0);
+    await rm6(`${supersededClaudeHome}.seeded`, { force: true }).catch(() => void 0);
+    await rm6(`${supersededClaudeHome}.lock`, { force: true }).catch(() => void 0);
   }
   await migrateLegacyCodexHome(state, config2.homeDir, io);
   io.stdout.write(`paired runner_id=${runnerId} state_file=${config2.stateFile}
@@ -67091,6 +67456,9 @@ async function migrateOneLegacyCodexHome(legacyHome, newHome, io) {
     }
   }
 }
+function defaultRunnerStateFile(appUrl2) {
+  return path10.join(tmpdir2(), `rost-runner-${createHash4("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
+}
 async function loadState(filePath, expectedTenantId) {
   try {
     const parsed = JSON.parse(await readFile9(filePath, "utf8"));
@@ -67152,9 +67520,9 @@ function estimateMaxSessions(cpuCount, memoryMb) {
   const estimate = Math.min(byCpu, byMem);
   return Math.min(Math.max(estimate, 1), RUNNER_MAX_SESSIONS_CAP);
 }
-async function detectCapabilities(cliVersion, env, homeDir, maxSessionsOverride) {
+async function detectCapabilities(cliVersion, env, homeDir, state, maxSessionsOverride) {
   const [claude, codex, git, gh, forgeDiskFreeMb] = await Promise.all([
-    probeClaude(),
+    probeClaude(state, homeDir),
     probe("codex"),
     probeGit(),
     probeGh(),
@@ -67252,7 +67620,7 @@ async function probe(command) {
     return { installed: false, version: null, auth_state: "unknown" };
   }
 }
-async function probeClaude() {
+async function probeClaude(state, homeDir) {
   const base = await probe("claude");
   if (!base.installed) {
     return {
@@ -67266,20 +67634,32 @@ async function probeClaude() {
       }
     };
   }
+  const cell2 = stableClaudeHomeDir(state, homeDir);
   const streamJsonSupported = await probeClaudeStreamJsonInterface();
+  const residentSession = streamJsonSupported ? {
+    status: "prototype_gated",
+    transport: "stream-json",
+    reason: "resident session gated until multi-turn behavior proven"
+  } : {
+    status: "unsupported",
+    transport: null,
+    reason: "stream-json interface not detected on this runner"
+  };
+  if (await claudeCellNeedsLogin(cell2)) {
+    return {
+      ...base,
+      auth_state: "unknown",
+      account_alias: null,
+      rate_limited_until: null,
+      resident_session: residentSession
+    };
+  }
   return {
     ...base,
+    auth_state_contract_version: 1,
     account_alias: null,
     rate_limited_until: null,
-    resident_session: streamJsonSupported ? {
-      status: "prototype_gated",
-      transport: "stream-json",
-      reason: "resident session gated until multi-turn behavior proven"
-    } : {
-      status: "unsupported",
-      transport: null,
-      reason: "stream-json interface not detected on this runner"
-    }
+    resident_session: residentSession
   };
 }
 async function probeClaudeStreamJsonInterface() {
@@ -67353,29 +67733,28 @@ async function post2(fetchImpl, appUrl2, pathName, body, token, signal) {
   }
   return { status: response.status, json: json2 };
 }
-var lastCodexHomeBusyNoteAt = 0;
+var lastCredentialCellBusyNoteAt = 0;
 async function claimAndExecute(fetchImpl, appUrl2, state, config2, io, runtime, activeTurnIds, options = {}) {
-  let codexLock = null;
-  if (runtime === "codex") {
-    try {
-      codexLock = await acquireCodexHomeLock(stableCodexHomeDir(state, config2.homeDir), { waitMs: 0 });
-    } catch (error51) {
-      if (Date.now() - lastCodexHomeBusyNoteAt > 5 * 6e4) {
-        lastCodexHomeBusyNoteAt = Date.now();
-        io.stderr.write(
-          `cannot take the isolated CODEX_HOME lock, so no codex work is being claimed. This is not transient \u2014 it persists until the cause is fixed: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+  let credentialCellLock = null;
+  try {
+    credentialCellLock = await acquireCodexHomeLock(credentialCellDirForRuntime(runtime, state, config2.homeDir), { waitMs: 0, label: credentialCellLabelForRuntime(runtime) });
+  } catch (error51) {
+    if (Date.now() - lastCredentialCellBusyNoteAt > 5 * 6e4) {
+      lastCredentialCellBusyNoteAt = Date.now();
+      io.stderr.write(
+        `cannot take the isolated credential-cell lock for ${runtime}, so no ${runtime} work is being claimed. This is not transient \u2014 it persists until the cause is fixed: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `
-        );
-      }
-      return;
+      );
     }
-    if (codexLock === null) {
-      if (Date.now() - lastCodexHomeBusyNoteAt > 5 * 6e4) {
-        lastCodexHomeBusyNoteAt = Date.now();
-        io.stderr.write("waiting for a sibling codex turn to release the isolated CODEX_HOME before claiming work.\n");
-      }
-      return;
+    return;
+  }
+  if (credentialCellLock === null) {
+    if (Date.now() - lastCredentialCellBusyNoteAt > 5 * 6e4) {
+      lastCredentialCellBusyNoteAt = Date.now();
+      io.stderr.write(`waiting for a sibling ${runtime} turn to release its isolated credential cell before claiming work.
+`);
     }
+    return;
   }
   try {
     const claimStartedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -67395,7 +67774,7 @@ async function claimAndExecute(fetchImpl, appUrl2, state, config2, io, runtime,
       retry_count: 0,
       ...claimed.status === 200 ? {} : { error_class: classifyHttpStatus(claimed.status) }
     });
-    const codexHomeLockHeld = runtime === "codex";
+    const credentialCellLockHeld = true;
     const turnExecution = claimed.json.turn_execution;
     if (claimed.status === 200 && turnExecution && typeof turnExecution === "object") {
       await executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtime, ledger, activeTurnIds, {
@@ -67405,7 +67784,7 @@ async function claimAndExecute(fetchImpl, appUrl2, state, config2, io, runtime,
         startPath: (id) => `/api/runner/turn-executions/${encodeURIComponent(id)}/start`,
         resultPath: (id) => `/api/runner/turn-executions/${encodeURIComponent(id)}/result`,
         logRef: (id) => `runner-turn:${id}`
-      }, codexHomeLockHeld);
+      }, credentialCellLockHeld);
       return;
     }
     const workOrder = claimed.json.work_order;
@@ -67419,12 +67798,12 @@ async function claimAndExecute(fetchImpl, appUrl2, state, config2, io, runtime,
       startPath: (id) => `/api/runner/work-orders/${encodeURIComponent(id)}/start`,
       resultPath: (id) => `/api/runner/work-orders/${encodeURIComponent(id)}/result`,
       logRef: (id) => `runner-local:${id}`
-    }, codexHomeLockHeld);
+    }, credentialCellLockHeld);
   } finally {
-    await codexLock?.release();
+    await credentialCellLock?.release();
   }
 }
-async function executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtime, ledger, activeTurnIds, input, codexHomeLockHeld) {
+async function executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtime, ledger, activeTurnIds, input, credentialCellLockHeld) {
   const id = input.item.id;
   if (typeof id !== "string") {
     return;
@@ -67470,16 +67849,19 @@ async function executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtim
             config: config2,
             io,
             ledger,
-            // DER-2298 (round 1 review, finding 4): `codexHomeLockHeld` (the parameter this function
-            // received from `claimAndExecute`) is only ever true when `claimAndExecute`'s OWN runtime
-            // parameter was "codex" — and `runtimeForClaimedUnit` above guarantees `turnRuntime` here is
-            // either that SAME configured fallback or `null` (never a different runtime), so whenever
-            // `codexHomeLockHeld` is true, `turnRuntime` can only be "codex" too (this is the KEY FACT
-            // that makes claim-time locking complete: a runner's claimed-unit runtime is never a
-            // per-unit surprise). The explicit `turnRuntime === "codex"` check is a redundant belt —
-            // kept so this stays correct even if that invariant is ever weakened, rather than silently
-            // trusting it.
-            ...codexHomeLockHeld && turnRuntime === "codex" ? { codexHomeLockHeld: true } : {}
+            // DER-2298 (round 1 review, finding 4): `credentialCellLockHeld` (the parameter this
+            // function received from `claimAndExecute`) is only ever true when `claimAndExecute`
+            // acquired the lock for its OWN `runtime` parameter — and `runtimeForClaimedUnit` above
+            // guarantees `turnRuntime` here is either that SAME configured fallback or `null` (never a
+            // different runtime), so whenever `credentialCellLockHeld` is true, `turnRuntime` can only
+            // equal `runtime` too (this is the KEY FACT that makes claim-time locking complete: a
+            // runner's claimed-unit runtime is never a per-unit surprise). The explicit
+            // `turnRuntime === runtime` check is a redundant belt — kept so this stays correct even if
+            // that invariant is ever weakened, rather than silently trusting it.
+            // DER-3022 (round 5 review, P1): generalized from a hardcoded `turnRuntime === "codex"`
+            // comparison — the caller now takes the lock for whichever runtime it is configured with,
+            // claude included, so the comparison must be against THAT runtime, not a literal.
+            ...credentialCellLockHeld && turnRuntime === runtime ? { credentialCellLockHeld: true } : {}
           },
           input.item,
           turnRuntime,
@@ -67921,7 +68303,10 @@ async function prepareForgeTurn(ctx, workOrder, execution, runtime, seams) {
     // deny is derived from — which must hold on a claude turn too, since a claude turn could
     // otherwise plant the legacy path for the next startup migration to pick up. The allow itself is
     // gated on modelRuntime inside resolveSandboxSpec; the harness-private base stays denied always.
-    codexIsolateHomeDir: stableCodexHomeDir(ctx.state, ctx.config.homeDir)
+    // DER-3022: pass the claude isolate too (this turn's own credential cell); resolveSandboxSpec
+    // applies the right absolute-last re-allow based on the actual modelRuntime.
+    codexIsolateHomeDir: stableCodexHomeDir(ctx.state, ctx.config.homeDir),
+    claudeIsolateHomeDir: stableClaudeHomeDir(ctx.state, ctx.config.homeDir)
   });
   return {
     ok: true,
@@ -67939,7 +68324,7 @@ async function prepareForgeTurn(ctx, workOrder, execution, runtime, seams) {
 var FORGE_MAX_CHANGED_PATHS = 2e3;
 var FORGE_MAX_CHANGED_PATH_LENGTH = 500;
 function forgeChangedPathsField(changedPaths) {
-  const withinCaps = changedPaths.length > 0 && changedPaths.length <= FORGE_MAX_CHANGED_PATHS && changedPaths.every((path11) => path11.length >= 1 && path11.length <= FORGE_MAX_CHANGED_PATH_LENGTH);
+  const withinCaps = changedPaths.length > 0 && changedPaths.length <= FORGE_MAX_CHANGED_PATHS && changedPaths.every((path12) => path12.length >= 1 && path12.length <= FORGE_MAX_CHANGED_PATH_LENGTH);
   return withinCaps ? { changedPaths: [...changedPaths] } : {};
 }
 async function finalizeForgeBuildPush(ctx, prep, result, seams) {
@@ -68071,10 +68456,33 @@ function stableCodexHomeDir(state, homeDir) {
   const key = createHash4("sha256").update(`codex-home:${state.runner_id ?? "runner"}`).digest("hex").slice(0, 16);
   return path10.join(runnerCodexHomeBaseDir(homeDir), `rost-runner-codex-home-${key}`);
 }
+function stableClaudeHomeDir(state, homeDir) {
+  const key = createHash4("sha256").update(`claude-home:${state.runner_id ?? "runner"}`).digest("hex").slice(0, 16);
+  return path10.join(runnerClaudeHomeBaseDir(homeDir), `rost-runner-claude-home-${key}`);
+}
+function credentialCellDirForRuntime(runtime, state, homeDir) {
+  return runtime === "codex" ? stableCodexHomeDir(state, homeDir) : stableClaudeHomeDir(state, homeDir);
+}
+function credentialCellLabelForRuntime(runtime) {
+  return runtime === "codex" ? "codex home" : "claude credential cell";
+}
+async function claudeCellNeedsLogin(cell2) {
+  if (!await isVerifiedExistingCodexHomeDir(cell2)) {
+    return true;
+  }
+  const markerPath = path10.join(path10.dirname(cell2), `${path10.basename(cell2)}.seeded`);
+  const markerInfo = await lstat2(markerPath).catch(() => null);
+  const marked = markerInfo !== null && markerInfo.isFile() && !markerInfo.isSymbolicLink() && markerInfo.nlink === 1 && (typeof process.getuid !== "function" || markerInfo.uid === process.getuid());
+  if (!marked) {
+    return true;
+  }
+  return !await hasUsableClaudeCredentialFile(cell2);
+}
 function resolveRuntimeSourceHomes() {
   return {
     claudeSourceHome: resolveSourceClaudeConfigDir(process.env),
-    codexSourceHome: resolveSourceCodexHomeDir(process.env)
+    codexSourceHome: resolveSourceCodexHomeDir(process.env),
+    claudeSecureStorageSourceHome: resolveSourceClaudeSecureStorageDir(process.env)
   };
 }
 async function sweepOrphanedTurnTempFiles(excludeNames) {
@@ -68101,10 +68509,10 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind, resumeSessionIdOve
       return { ok: false, summary: refusal };
     }
   }
-  const codexHomeLockWaitMs = kind === "work_order" ? 30 * 6e4 : 6e4;
-  const codexLock = runtime === "codex" && ctx.codexHomeLockHeld !== true ? await acquireCodexHomeLock(stableCodexHomeDir(ctx.state, ctx.config.homeDir), { waitMs: codexHomeLockWaitMs }) : null;
-  if (runtime === "codex" && ctx.codexHomeLockHeld !== true && codexLock === null) {
-    return { ok: false, summary: codexHomeBusySummary(codexHomeLockWaitMs) };
+  const credentialCellLockWaitMs = kind === "work_order" ? 30 * 6e4 : 6e4;
+  const credentialCellLock = ctx.credentialCellLockHeld !== true ? await acquireCodexHomeLock(credentialCellDirForRuntime(runtime, ctx.state, ctx.config.homeDir), { waitMs: credentialCellLockWaitMs, label: credentialCellLabelForRuntime(runtime) }) : null;
+  if (ctx.credentialCellLockHeld !== true && credentialCellLock === null) {
+    return { ok: false, summary: credentialCellBusySummary(credentialCellLockWaitMs, runtime) };
   }
   try {
     let forgePrep = null;
@@ -68137,7 +68545,10 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind, resumeSessionIdOve
         modelRuntime: runtime,
         ...runtimeSourceHomes,
         // DER-1485 (round 6): see above — allow is codex-only, the derived legacy deny is universal.
-        codexIsolateHomeDir: stableCodexHomeDir(ctx.state, ctx.config.homeDir)
+        // DER-3022: also pass this turn's claude credential cell so a claude runtime gets its own
+        // absolute-last re-allow; the right isolate is selected inside resolveSandboxSpec.
+        codexIsolateHomeDir: stableCodexHomeDir(ctx.state, ctx.config.homeDir),
+        claudeIsolateHomeDir: stableClaudeHomeDir(ctx.state, ctx.config.homeDir)
       });
     }
     const repoDir = forgePrep ? forgePrep.repoDir : null;
@@ -68148,12 +68559,17 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind, resumeSessionIdOve
     const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
     const configPath = path10.join(tmpdir2(), `rost-runner-mcp-${createHash4("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
     const prompt = buildTurnPrompt({ kind, workOrder, execution, hasWorkspace: forgePrep !== null });
-    const claudeConfigDir = runtime === "claude" ? await provisionIsolatedClaudeConfigDir(
-      process.env,
+    const claudeCell = runtime === "claude" ? stableClaudeHomeDir(ctx.state, ctx.config.homeDir) : null;
+    const claudeConfigDir = runtime === "claude" && claudeCell !== null ? await provisionIsolatedClaudeConfigDir(
       resumeClaudeConfigDir ?? path10.join(tmpdir2(), `rost-runner-claude-config-${createHash4("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`),
+      claudeCell,
       (message) => ctx.io.stderr.write(`${redactForLog(message)}
 `)
     ) : null;
+    if (runtime === "claude" && claudeCell !== null && await claudeCellNeedsLogin(claudeCell)) {
+      ctx.io.stderr.write(`${redactForLog(`no dedicated runner credential found \u2014 claude turns will fail authentication; run \`${cliBrand.binName} runner login\` to provision one`)}
+`);
+    }
     const codexHomeDir = runtime === "codex" ? await provisionIsolatedCodexHomeDir(process.env, stableCodexHomeDir(ctx.state, ctx.config.homeDir), repoDir ?? tmpdir2(), (message) => ctx.io.stderr.write(`${redactForLog(message)}
 `)) : null;
     await writeFile6(configPath, `${mcpConfig}
@@ -68213,7 +68629,7 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind, resumeSessionIdOve
       // A Forge turn's cwd is its worktree; every other turn stays in tmpdir.
       cwd: plan.repoDir ?? tmpdir2(),
       timeoutMs: plan.timeoutMs,
-      env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0, codexHomeDir ?? void 0),
+      env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0, codexHomeDir ?? void 0, runtime === "claude" ? claudeCell ?? void 0 : void 0),
       expectSessionEnvelope,
       resumeSessionId,
       // T1.6: only Forge turns carry a structured evidence contract worth parsing.
@@ -68259,7 +68675,7 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind, resumeSessionIdOve
     }
     return result;
   } finally {
-    await codexLock?.release();
+    await credentialCellLock?.release();
   }
 }
 var MERGE_MERGEABILITY_POLLS = 5;
@@ -68374,7 +68790,10 @@ async function resolveMergeConflictTurn(ctx, input) {
     // Resolved once at the top of this function (DER-2842) — before the workspace exists.
     ...runtimeSourceHomes,
     // DER-1485 (round 6): see above — allow is codex-only, the derived legacy deny is universal.
-    codexIsolateHomeDir: stableCodexHomeDir(ctx.state, ctx.config.homeDir)
+    // DER-3022: pass the claude cell too so the seatbelt can re-allow this turn's own claude
+    // credential cell when the merge-conflict runtime is claude.
+    codexIsolateHomeDir: stableCodexHomeDir(ctx.state, ctx.config.homeDir),
+    claudeIsolateHomeDir: stableClaudeHomeDir(ctx.state, ctx.config.homeDir)
   });
   const sandboxRefusal = sandboxRequiredTurnRefusal({ mode: ctx.config.sandboxMode, platform: process.platform, spec: sandbox });
   if (sandboxRefusal) {
@@ -68408,18 +68827,23 @@ async function spawnMergeConflictModel(ctx, input) {
   const url2 = typeof mcp.url === "string" ? `${ctx.appUrl.replace(/\/+$/, "")}${mcp.url}` : `${ctx.appUrl.replace(/\/+$/, "")}/mcp`;
   const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
   const configPath = path10.join(tmpdir2(), `rost-runner-mcp-${createHash4("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
-  const codexHomeLockWaitMs = 30 * 6e4;
-  const codexLock = input.runtime === "codex" && ctx.codexHomeLockHeld !== true ? await acquireCodexHomeLock(stableCodexHomeDir(ctx.state, ctx.config.homeDir), { waitMs: codexHomeLockWaitMs }) : null;
-  if (input.runtime === "codex" && ctx.codexHomeLockHeld !== true && codexLock === null) {
-    return { ok: false, summary: codexHomeBusySummary(codexHomeLockWaitMs) };
+  const credentialCellLockWaitMs = 30 * 6e4;
+  const credentialCellLock = ctx.credentialCellLockHeld !== true ? await acquireCodexHomeLock(credentialCellDirForRuntime(input.runtime, ctx.state, ctx.config.homeDir), { waitMs: credentialCellLockWaitMs, label: credentialCellLabelForRuntime(input.runtime) }) : null;
+  if (ctx.credentialCellLockHeld !== true && credentialCellLock === null) {
+    return { ok: false, summary: credentialCellBusySummary(credentialCellLockWaitMs, input.runtime) };
   }
   try {
-    const claudeConfigDir = input.runtime === "claude" ? await provisionIsolatedClaudeConfigDir(
-      process.env,
+    const claudeCell = input.runtime === "claude" ? stableClaudeHomeDir(ctx.state, ctx.config.homeDir) : null;
+    const claudeConfigDir = input.runtime === "claude" && claudeCell !== null ? await provisionIsolatedClaudeConfigDir(
       path10.join(tmpdir2(), `rost-runner-claude-config-${createHash4("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`),
+      claudeCell,
       (message) => ctx.io.stderr.write(`${redactForLog(message)}
 `)
     ) : null;
+    if (input.runtime === "claude" && claudeCell !== null && await claudeCellNeedsLogin(claudeCell)) {
+      ctx.io.stderr.write(`${redactForLog(`no dedicated runner credential found \u2014 claude turns will fail authentication; run \`${cliBrand.binName} runner login\` to provision one`)}
+`);
+    }
     const codexHomeDir = input.runtime === "codex" ? await provisionIsolatedCodexHomeDir(process.env, stableCodexHomeDir(ctx.state, ctx.config.homeDir), input.workspace.worktreeDir, (message) => ctx.io.stderr.write(`${redactForLog(message)}
 `)) : null;
     await writeFile6(configPath, `${mcpConfig}
@@ -68454,7 +68878,7 @@ async function spawnMergeConflictModel(ctx, input) {
       cwd: input.workspace.worktreeDir,
       timeoutMs: plan.timeoutMs,
       // The model gets the EXPLICIT allowlist env — never the merge token, GIT_ASKPASS, or the bearer.
-      env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0, codexHomeDir ?? void 0),
+      env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0, codexHomeDir ?? void 0, input.runtime === "claude" ? claudeCell ?? void 0 : void 0),
       expectSessionEnvelope: false
     });
     const exitClass = classifyModelExit(result);
@@ -68476,7 +68900,7 @@ async function spawnMergeConflictModel(ctx, input) {
     void sweepOrphanedTurnTempFiles(journaledClaudeConfigDirNames(ctx.state));
     return result;
   } finally {
-    await codexLock?.release();
+    await credentialCellLock?.release();
   }
 }
 async function runForgeMergeTurn(ctx, workOrder, execution, runtime) {
@@ -68902,14 +69326,19 @@ async function settleInFlightWorkOrder(stateFile, state, workOrderId) {
   }
 }
 async function reconcileOrphanedInFlightWorkOrders(deps) {
-  const { fetchImpl, appUrl: appUrl2, state, config: config2, io, allowResume } = deps;
+  const { fetchImpl, appUrl: appUrl2, state, config: config2, io, allowResume, localRuntime, onlyWorkOrderIds } = deps;
   const journal = state.in_flight_work_orders;
   if (!journal || Object.keys(journal).length === 0) {
-    return;
+    return { deferredWorkOrderIds: [] };
   }
-  io.stdout.write(`reconciling ${Object.keys(journal).length} orphaned work order(s)
+  const entries = Object.entries(journal).filter(([id]) => onlyWorkOrderIds === null || onlyWorkOrderIds === void 0 || onlyWorkOrderIds.has(id));
+  if (entries.length === 0) {
+    return { deferredWorkOrderIds: [] };
+  }
+  io.stdout.write(`reconciling ${entries.length} orphaned work order(s)
 `);
-  for (const [id, entry] of Object.entries(journal)) {
+  const deferredWorkOrderIds = /* @__PURE__ */ new Set();
+  for (const [id, entry] of entries) {
     try {
       let verdict = { kind: "missing" };
       if (entry.runtime === "claude" && entry.claude_session_id && entry.claude_config_dir) {
@@ -68925,6 +69354,13 @@ async function reconcileOrphanedInFlightWorkOrders(deps) {
       }
       const profile = parseRunnerExecutionContract(entry.item ?? {})?.profile ?? null;
       let action = decideReconcileAction({ entry, verdict, profile, now: /* @__PURE__ */ new Date() });
+      const needsExecutionRuntime = action.type === "resume" || action.type === "reverify_merge";
+      if (allowResume && needsExecutionRuntime && localRuntime !== entry.runtime) {
+        deferredWorkOrderIds.add(id);
+        io.stderr.write(`work_order_id=${id} ${entry.runtime} runtime is not locally claimable; keeping orphan journal until the selected runtime contract is proven
+`);
+        continue;
+      }
       if (action.type === "resume" && !allowResume) {
         action = {
           type: "report_failed",
@@ -68936,17 +69372,17 @@ async function reconcileOrphanedInFlightWorkOrders(deps) {
         continue;
       }
       if (action.type === "report_succeeded" || action.type === "report_failed") {
-        const reportBody2 = {
+        const reportBody = {
           status: action.type === "report_succeeded" ? "succeeded" : "failed",
           summary: capResultSummary(scrubTranscriptSessionIds(redactForLog(action.summary))),
           log_ref: `runner-local:${id}`,
           model: entry.runtime === "codex" ? "codex-cli" : "claude-cli"
         };
-        const { outcome: outcome2, lastStatus: lastStatus2 } = await postResultThenSettle({
+        const { outcome, lastStatus } = await postResultThenSettle({
           fetchImpl,
           appUrl: appUrl2,
           resultPath: `/api/runner/work-orders/${encodeURIComponent(id)}/result`,
-          reportBody: reportBody2,
+          reportBody,
           runnerSecret: state.runner_secret,
           state,
           stateFile: config2.stateFile,
@@ -68954,57 +69390,63 @@ async function reconcileOrphanedInFlightWorkOrders(deps) {
           kind: "work_order",
           idField: "work_order_id",
           id,
-          model: reportBody2.model,
+          model: reportBody.model,
           originalOk: action.type === "report_succeeded",
           note: "reconciled after runner restart"
         });
-        if (outcome2 === "unresolved") {
-          io.stderr.write(`work_order_id=${id} reconcile report failed ${lastStatus2}; keeping journal entry for next restart
+        if (outcome === "unresolved") {
+          io.stderr.write(`work_order_id=${id} reconcile report failed ${lastStatus}; keeping journal entry for next restart
 `);
         }
         continue;
       }
       if (action.type === "reverify_merge") {
-        const codexLock = entry.runtime === "codex" ? await acquireCodexHomeLock(stableCodexHomeDir(state, config2.homeDir), { waitMs: 0 }) : null;
-        if (entry.runtime === "codex" && codexLock === null) {
-          io.stderr.write(`work_order_id=${id} codex home busy; skipping merge reverify this pass (retried on the next reconcile)
+        const credentialCellLock2 = await acquireCodexHomeLock(credentialCellDirForRuntime(entry.runtime, state, config2.homeDir), { waitMs: 0, label: credentialCellLabelForRuntime(entry.runtime) });
+        if (credentialCellLock2 === null) {
+          io.stderr.write(`work_order_id=${id} credential cell busy; keeping merge reverify journal for the next restart
 `);
           continue;
         }
         try {
-          const ctx2 = {
+          if (entry.runtime === "claude" && await claudeCellNeedsLogin(stableClaudeHomeDir(state, config2.homeDir))) {
+            deferredWorkOrderIds.add(id);
+            io.stderr.write(`work_order_id=${id} Claude auth proof is unavailable; keeping merge reverify journal (run \`${cliBrand.binName} runner login\`)
+`);
+            continue;
+          }
+          const ctx = {
             fetchImpl,
             appUrl: appUrl2,
             state,
             config: config2,
             io,
             ledger: new StepLedger(),
-            ...entry.runtime === "codex" ? { codexHomeLockHeld: true } : {}
+            credentialCellLockHeld: true
           };
-          const result2 = await spawnRunnerTurn(ctx2, entry.item ?? {}, entry.runtime, "work_order");
-          const reportBody2 = {
-            status: result2.ok ? "succeeded" : "failed",
-            summary: capResultSummary(result2.summary),
+          const result = await spawnRunnerTurn(ctx, entry.item ?? {}, entry.runtime, "work_order");
+          const reportBody = {
+            status: result.ok ? "succeeded" : "failed",
+            summary: capResultSummary(result.summary),
             log_ref: `runner-local:${id}`,
             model: entry.runtime === "codex" ? "codex-cli" : "claude-cli",
-            step_ledger: ctx2.ledger.entries(),
-            ...result2.transcript ? { transcript: result2.transcript } : {},
-            ...result2.inputTokens != null ? { input_tokens: result2.inputTokens } : {},
-            ...result2.outputTokens != null ? { output_tokens: result2.outputTokens } : {},
-            ...result2.prUrl ? { pr_url: result2.prUrl } : {},
-            ...result2.branch ? { branch: result2.branch } : {},
-            ...result2.commitSha ? { commit_sha: result2.commitSha } : {},
-            ...result2.evidence && result2.evidence.length > 0 ? { evidence: result2.evidence } : {},
-            ...result2.changedPaths && result2.changedPaths.length > 0 ? { changed_paths: result2.changedPaths } : {},
-            ...result2.ok && result2.merged === true ? { merged: true } : {},
-            ...result2.ok && result2.merged === true && result2.mergedCommitSha ? { merged_commit_sha: result2.mergedCommitSha } : {},
-            ...result2.planArtifact ? { plan_artifact: result2.planArtifact } : {}
+            step_ledger: ctx.ledger.entries(),
+            ...result.transcript ? { transcript: result.transcript } : {},
+            ...result.inputTokens != null ? { input_tokens: result.inputTokens } : {},
+            ...result.outputTokens != null ? { output_tokens: result.outputTokens } : {},
+            ...result.prUrl ? { pr_url: result.prUrl } : {},
+            ...result.branch ? { branch: result.branch } : {},
+            ...result.commitSha ? { commit_sha: result.commitSha } : {},
+            ...result.evidence && result.evidence.length > 0 ? { evidence: result.evidence } : {},
+            ...result.changedPaths && result.changedPaths.length > 0 ? { changed_paths: result.changedPaths } : {},
+            ...result.ok && result.merged === true ? { merged: true } : {},
+            ...result.ok && result.merged === true && result.mergedCommitSha ? { merged_commit_sha: result.mergedCommitSha } : {},
+            ...result.planArtifact ? { plan_artifact: result.planArtifact } : {}
           };
-          const { outcome: outcome2, lastStatus: lastStatus2 } = await postResultThenSettle({
+          const { outcome, lastStatus } = await postResultThenSettle({
             fetchImpl,
             appUrl: appUrl2,
             resultPath: `/api/runner/work-orders/${encodeURIComponent(id)}/result`,
-            reportBody: reportBody2,
+            reportBody,
             runnerSecret: state.runner_secret,
             state,
             stateFile: config2.stateFile,
@@ -69012,78 +69454,558 @@ async function reconcileOrphanedInFlightWorkOrders(deps) {
             kind: "work_order",
             idField: "work_order_id",
             id,
-            model: reportBody2.model,
-            originalOk: result2.ok,
+            model: reportBody.model,
+            originalOk: result.ok,
             note: "reconciled after runner restart"
           });
-          if (outcome2 === "unresolved") {
-            io.stderr.write(`work_order_id=${id} merge reverify report failed ${lastStatus2}; keeping journal entry for next restart
+          if (outcome === "unresolved") {
+            io.stderr.write(`work_order_id=${id} merge reverify report failed ${lastStatus}; keeping journal entry for next restart
 `);
           }
         } finally {
-          await codexLock?.release();
+          await credentialCellLock2?.release();
         }
         continue;
       }
-      const ctx = {
-        fetchImpl,
-        appUrl: appUrl2,
-        state,
-        config: config2,
-        io,
-        ledger: new StepLedger()
-      };
-      const result = await spawnRunnerTurn(ctx, entry.item ?? {}, "claude", "work_order", entry.claude_session_id, entry.claude_config_dir);
-      const reportBody = {
-        status: result.ok ? "succeeded" : "failed",
-        summary: capResultSummary(result.summary),
-        log_ref: `runner-local:${id}`,
-        model: "claude-cli",
-        // DER-1331 (T1.9): mirror the normal executeClaimedUnit work-order report — ship the
-        // harness step ledger and the model transcript when the resume turn produced one.
-        step_ledger: ctx.ledger.entries(),
-        ...result.transcript ? { transcript: result.transcript } : {},
-        ...result.inputTokens != null ? { input_tokens: result.inputTokens } : {},
-        ...result.outputTokens != null ? { output_tokens: result.outputTokens } : {},
-        ...result.prUrl ? { pr_url: result.prUrl } : {},
-        ...result.branch ? { branch: result.branch } : {},
-        ...result.commitSha ? { commit_sha: result.commitSha } : {},
-        ...result.evidence && result.evidence.length > 0 ? { evidence: result.evidence } : {},
-        ...result.changedPaths && result.changedPaths.length > 0 ? { changed_paths: result.changedPaths } : {},
-        ...result.ok && result.merged === true ? { merged: true } : {},
-        ...result.ok && result.merged === true && result.mergedCommitSha ? { merged_commit_sha: result.mergedCommitSha } : {},
-        ...result.planArtifact ? { plan_artifact: result.planArtifact } : {}
-      };
-      const { outcome, lastStatus } = await postResultThenSettle({
-        fetchImpl,
-        appUrl: appUrl2,
-        resultPath: `/api/runner/work-orders/${encodeURIComponent(id)}/result`,
-        reportBody,
-        runnerSecret: state.runner_secret,
-        state,
-        stateFile: config2.stateFile,
-        io,
-        kind: "work_order",
-        idField: "work_order_id",
-        id,
-        model: "claude-cli",
-        originalOk: result.ok,
-        note: "reconciled after runner restart"
-      });
-      if (outcome === "unresolved") {
-        io.stderr.write(`work_order_id=${id} reconcile report failed ${lastStatus}; keeping journal entry for next restart
+      let credentialCellLock;
+      try {
+        credentialCellLock = await acquireCodexHomeLock(
+          stableClaudeHomeDir(state, config2.homeDir),
+          { waitMs: 0, label: "claude credential cell" }
+        );
+      } catch {
+        deferredWorkOrderIds.add(id);
+        io.stderr.write(`work_order_id=${id} claude credential cell unavailable; skipping resume this pass (retried on the next reconcile)
+`);
+        continue;
+      }
+      if (credentialCellLock === null) {
+        deferredWorkOrderIds.add(id);
+        io.stderr.write(`work_order_id=${id} claude credential cell busy; skipping resume this pass (retried on the next reconcile)
+`);
+        continue;
+      }
+      try {
+        if (await claudeCellNeedsLogin(stableClaudeHomeDir(state, config2.homeDir))) {
+          deferredWorkOrderIds.add(id);
+          io.stderr.write(`work_order_id=${id} Claude auth proof is unavailable; keeping resume journal (run \`${cliBrand.binName} runner login\`)
+`);
+          continue;
+        }
+        const ctx = {
+          fetchImpl,
+          appUrl: appUrl2,
+          state,
+          config: config2,
+          io,
+          ledger: new StepLedger(),
+          credentialCellLockHeld: true
+        };
+        const result = await spawnRunnerTurn(ctx, entry.item ?? {}, "claude", "work_order", entry.claude_session_id, entry.claude_config_dir);
+        const reportBody = {
+          status: result.ok ? "succeeded" : "failed",
+          summary: capResultSummary(result.summary),
+          log_ref: `runner-local:${id}`,
+          model: "claude-cli",
+          // DER-1331 (T1.9): mirror the normal executeClaimedUnit work-order report — ship the
+          // harness step ledger and the model transcript when the resume turn produced one.
+          step_ledger: ctx.ledger.entries(),
+          ...result.transcript ? { transcript: result.transcript } : {},
+          ...result.inputTokens != null ? { input_tokens: result.inputTokens } : {},
+          ...result.outputTokens != null ? { output_tokens: result.outputTokens } : {},
+          ...result.prUrl ? { pr_url: result.prUrl } : {},
+          ...result.branch ? { branch: result.branch } : {},
+          ...result.commitSha ? { commit_sha: result.commitSha } : {},
+          ...result.evidence && result.evidence.length > 0 ? { evidence: result.evidence } : {},
+          ...result.changedPaths && result.changedPaths.length > 0 ? { changed_paths: result.changedPaths } : {},
+          ...result.ok && result.merged === true ? { merged: true } : {},
+          ...result.ok && result.merged === true && result.mergedCommitSha ? { merged_commit_sha: result.mergedCommitSha } : {},
+          ...result.planArtifact ? { plan_artifact: result.planArtifact } : {}
+        };
+        const { outcome, lastStatus } = await postResultThenSettle({
+          fetchImpl,
+          appUrl: appUrl2,
+          resultPath: `/api/runner/work-orders/${encodeURIComponent(id)}/result`,
+          reportBody,
+          runnerSecret: state.runner_secret,
+          state,
+          stateFile: config2.stateFile,
+          io,
+          kind: "work_order",
+          idField: "work_order_id",
+          id,
+          model: "claude-cli",
+          originalOk: result.ok,
+          note: "reconciled after runner restart"
+        });
+        if (outcome === "unresolved") {
+          io.stderr.write(`work_order_id=${id} reconcile report failed ${lastStatus}; keeping journal entry for next restart
 `);
+        }
+      } finally {
+        await credentialCellLock.release();
       }
     } catch (error51) {
       io.stderr.write(`reconcile work_order_id=${id} error (continuing): ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `);
     }
   }
+  return { deferredWorkOrderIds: [...deferredWorkOrderIds] };
 }
 function usage() {
   return "Usage: rost runner serve [--name <text>] [--state-file <path>] [--heartbeat-ms <n>] [--interactive-claim-ms <n>] [--user-code <code>] [--runtime auto|claude|codex] [--max-sessions <n>] [--once] [--execute]";
 }
 
+// src/runner-login.ts
+var LOGIN_ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "COLORTERM",
+  "TMPDIR",
+  "SHELL",
+  "__CF_USER_TEXT_ENCODING",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy"
+];
+function buildLoginEnv(base, configDir, secureStorageDir = configDir) {
+  const env = {};
+  for (const key of LOGIN_ENV_ALLOWLIST) {
+    const value = base[key];
+    if (typeof value === "string") {
+      env[key] = value;
+    }
+  }
+  env.CLAUDE_CONFIG_DIR = configDir;
+  env.CLAUDE_SECURESTORAGE_CONFIG_DIR = secureStorageDir;
+  return env;
+}
+function buildOperatorIdentityEnv(base, explicitConfigDir, secureStorageDir) {
+  const env = {};
+  for (const key of LOGIN_ENV_ALLOWLIST) {
+    const value = base[key];
+    if (typeof value === "string") {
+      env[key] = value;
+    }
+  }
+  if (explicitConfigDir !== null) {
+    env.CLAUDE_CONFIG_DIR = explicitConfigDir;
+  }
+  env.CLAUDE_SECURESTORAGE_CONFIG_DIR = secureStorageDir;
+  return env;
+}
+async function spawnLogin(cmd, args, opts) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn2(cmd, args, { env: opts.env, stdio: "inherit" });
+    child.on("error", (error51) => {
+      reject(error51);
+    });
+    child.on("close", (code) => {
+      resolve2(code ?? 1);
+    });
+  });
+}
+async function spawnStatus(cmd, args, opts) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    const child = spawn2(cmd, args, {
+      env: opts.env,
+      stdio: ["ignore", "pipe", "inherit"]
+    });
+    child.stdout?.on("data", (chunk) => {
+      chunks.push(chunk);
+    });
+    child.on("error", (error51) => {
+      reject(error51);
+    });
+    child.on("close", (code) => {
+      resolve2({ code: code ?? 1, stdout: Buffer.concat(chunks).toString("utf8") });
+    });
+  });
+}
+var LOGIN_CREDENTIAL_CELL_LOCK_WAIT_MS = 5e3;
+function parseClaudeAccountIdentity(status) {
+  if (status.code !== 0) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(status.stdout);
+    if (parsed.loggedIn !== true || typeof parsed.email !== "string" || parsed.email.length === 0) {
+      return null;
+    }
+    return { email: parsed.email, orgId: typeof parsed.orgId === "string" ? parsed.orgId : null };
+  } catch {
+    return null;
+  }
+}
+function isSameClaudeAccount(a, b) {
+  return a.email.toLowerCase() === b.email.toLowerCase();
+}
+function evaluateIdentityCollision(cellAccount, operatorAccount) {
+  if (operatorAccount === null) {
+    return { kind: "no_operator_login" };
+  }
+  if (cellAccount === null) {
+    return { kind: "cell_identity_unreadable" };
+  }
+  if (isSameClaudeAccount(cellAccount, operatorAccount)) {
+    return { kind: "collision" };
+  }
+  return { kind: "distinct" };
+}
+async function isTrustworthyAutoDetectStateFile(filePath) {
+  const info = await lstat3(filePath).catch(() => null);
+  if (info === null) {
+    return true;
+  }
+  if (info.isSymbolicLink() || !info.isFile()) {
+    return false;
+  }
+  if (typeof process.getuid === "function" && info.uid !== process.getuid()) {
+    return false;
+  }
+  return (info.mode & 18) === 0;
+}
+async function canonicalPathIfExisting(value, sourceName) {
+  const absolute = path11.resolve(value);
+  const missing = [];
+  let current = absolute;
+  for (; ; ) {
+    const info = await lstat3(current).catch(() => null);
+    if (info !== null) {
+      if (sourceName && info.isSymbolicLink()) {
+        throw new Error(
+          `Refusing to log in: ${sourceName} points through a symbolic link (${absolute}); use a real operator Claude source directory instead.`
+        );
+      }
+      const canonicalCurrent = await realpath2(current).catch(() => path11.resolve(current));
+      return path11.join(canonicalCurrent, ...missing);
+    }
+    const parent = path11.dirname(current);
+    if (parent === current) {
+      return path11.join(path11.parse(absolute).root, ...missing);
+    }
+    missing.unshift(path11.basename(current));
+    current = parent;
+  }
+}
+async function runRunnerLogin(options) {
+  const { io, args, appUrl: appUrl2, env } = options;
+  const homeDir = options.homeDir ?? os3.homedir();
+  const spawnLoginImpl = options.spawnLoginImpl ?? spawnLogin;
+  const spawnStatusImpl = options.spawnStatusImpl ?? spawnStatus;
+  const commitCellMarkerImpl = options.commitCellMarkerImpl ?? ((cell2) => commitCodexHomeSeedMarker(cell2, { required: true }));
+  const materializeFromKeychainImpl = options.materializeFromKeychainImpl ?? ((cell2) => materializeClaudeCredentialFileFromMacosKeychain(cell2));
+  try {
+    let stateFile;
+    let runnerName;
+    for (let index = 0; index < args.length; index += 1) {
+      const token = args[index];
+      if (token === "--state-file") {
+        const value = args[index + 1];
+        if (value === void 0 || value.startsWith("--")) {
+          io.stderr.write("--state-file requires a value.\n");
+          return 1;
+        }
+        stateFile = value;
+        index += 1;
+      } else if (token === "--name") {
+        const value = args[index + 1];
+        if (value === void 0 || value.startsWith("--")) {
+          io.stderr.write("--name requires a value.\n");
+          return 1;
+        }
+        runnerName = value;
+        index += 1;
+      } else if (token !== void 0) {
+        io.stderr.write(`Unexpected runner login argument: ${token}
+`);
+        io.stderr.write(`Usage: ${cliBrand.binName} runner login [--name <runner-name>] [--state-file <path>]
+`);
+        return 1;
+      }
+    }
+    if (stateFile !== void 0 && runnerName !== void 0) {
+      io.stderr.write("Pass only one of --name or --state-file.\n");
+      return 1;
+    }
+    let resolvedStateFile;
+    if (stateFile !== void 0) {
+      resolvedStateFile = stateFile;
+    } else if (runnerName !== void 0) {
+      resolvedStateFile = runnerServicePaths(homeDir, runnerName).stateFile;
+    } else if (env.RUNNER_STATE_FILE !== void 0) {
+      resolvedStateFile = env.RUNNER_STATE_FILE;
+    } else {
+      const tmpDefault = defaultRunnerStateFile(appUrl2);
+      if (!await isTrustworthyAutoDetectStateFile(tmpDefault)) {
+        io.stderr.write(
+          `Refusing to auto-detect the paired runner state: ${tmpDefault} exists but is not a private, self-owned regular file (possible pre-planted file in a shared tmp directory). Pass --name <runner-name> or --state-file <path> instead.
+`
+        );
+        return 1;
+      }
+      const tmpDefaultState = await loadState(tmpDefault);
+      const serviceDir = path11.join(homeDir, "Library", "Application Support", cliBrand.name);
+      const serviceNames = await readdir5(serviceDir).catch(() => []);
+      const candidatePaths = serviceNames.filter((name) => /^runner-.+\.json$/.test(name)).map((name) => path11.join(serviceDir, name));
+      const validServiceStates = (await Promise.all(
+        candidatePaths.map(async (candidatePath) => ({
+          path: candidatePath,
+          state: await loadState(candidatePath)
+        }))
+      )).filter((entry) => entry.state !== null);
+      const totalValid = validServiceStates.length + (tmpDefaultState !== null ? 1 : 0);
+      if (totalValid > 1) {
+        io.stderr.write(
+          `Several paired runner state files found (serve tmpdir default and ${serviceDir}); pass --name <runner-name> so the credential lands in the right runner's cell.
+`
+        );
+        return 1;
+      } else if (tmpDefaultState !== null) {
+        resolvedStateFile = tmpDefault;
+      } else if (validServiceStates.length === 1) {
+        resolvedStateFile = validServiceStates[0]?.path ?? tmpDefault;
+      } else {
+        resolvedStateFile = tmpDefault;
+      }
+    }
+    const state = await loadState(resolvedStateFile);
+    if (state === null || typeof state.runner_id !== "string") {
+      io.stderr.write(
+        `No paired runner state at ${resolvedStateFile}. Pair this runner first (Settings > Runners, or \`${cliBrand.binName} runner serve --user-code <code>\`).
+`
+      );
+      return 1;
+    }
+    const cell2 = stableClaudeHomeDir(state, homeDir);
+    const operatorClaudeConfigDir = resolveSourceClaudeConfigDir(env);
+    const operatorClaudeSecureStorageDir = resolveSourceClaudeSecureStorageDir(env);
+    const [canonicalCell, canonicalSecureStorageDir, canonicalConfigDir] = await Promise.all([
+      canonicalPathIfExisting(cell2),
+      canonicalPathIfExisting(operatorClaudeSecureStorageDir, "CLAUDE_SECURESTORAGE_CONFIG_DIR"),
+      canonicalPathIfExisting(operatorClaudeConfigDir, "CLAUDE_CONFIG_DIR")
+    ]);
+    if (canonicalSecureStorageDir === canonicalCell) {
+      io.stderr.write(
+        `Refusing to log in: CLAUDE_SECURESTORAGE_CONFIG_DIR points at the runner credential cell (${cell2}), which would make the operator's own Claude read the runner credential.
+`
+      );
+      return 1;
+    }
+    if (canonicalConfigDir === canonicalCell) {
+      io.stderr.write(
+        `Refusing to log in: CLAUDE_CONFIG_DIR points at the runner credential cell (${cell2}), which would make the operator's own Claude read the runner credential.
+`
+      );
+      return 1;
+    }
+    const onRepair = (message) => {
+      io.stderr.write(`${redactForLog(message)}
+`);
+    };
+    const credentialCellLockWaitMs = options.credentialCellLockWaitMs ?? LOGIN_CREDENTIAL_CELL_LOCK_WAIT_MS;
+    const credentialCellLock = await acquireCodexHomeLock(cell2, {
+      waitMs: credentialCellLockWaitMs,
+      // DER-3022 (panel round 3, finding 7): without this, a base-symlink failure on this claude
+      // cell reports itself as a "codex home base" failure — matches the label
+      // `ensureVerifiedCodexHomeDir(cell, onRepair, "claude credential cell")` already uses below.
+      label: "claude credential cell"
+    });
+    if (credentialCellLock === null) {
+      io.stderr.write(
+        `another process is using this runner's credential cell (a running claude turn, or a concurrent \`${cliBrand.binName} runner login\`); wait for it to finish and retry.
+`
+      );
+      return 1;
+    }
+    try {
+      await ensureVerifiedCodexHomeDir(cell2, onRepair, "claude credential cell");
+      const markerPath = path11.join(path11.dirname(cell2), `${path11.basename(cell2)}.seeded`);
+      try {
+        await rm7(markerPath, { force: true });
+      } catch (error51) {
+        throw new Error(
+          `refusing to run claude runner login: could not clear the existing auth marker ${markerPath}; the server must keep Claude work blocked until login completes (${redactForLog(error51 instanceof Error ? error51.message : String(error51))})`
+        );
+      }
+      await sweepClaudeCredentialCell(cell2, onRepair);
+      const loginEnv = buildLoginEnv(env, cell2);
+      let loginCode;
+      try {
+        loginCode = await spawnLoginImpl("claude", ["auth", "login"], { env: loginEnv });
+      } catch (error51) {
+        if (isEnoent(error51)) {
+          io.stderr.write("claude CLI not found on PATH; install Claude Code first.\n");
+          return 1;
+        }
+        throw error51;
+      }
+      if (loginCode !== 0) {
+        io.stderr.write(
+          `claude auth login exited ${loginCode}; the runner credential was not provisioned.
+`
+        );
+        return 1;
+      }
+      if (!await hasUsableClaudeCredentialFile(cell2)) {
+        const materialized = await materializeFromKeychainImpl(cell2);
+        if (materialized.status === "written") {
+          io.stdout.write(
+            "notice: Claude Code stored the runner credential in the macOS Keychain; copied it into the runner cell's file store so sandboxed turns can read it.\n"
+          );
+        }
+      }
+      const cellStatusEnv = buildLoginEnv(env, cell2);
+      let cellStatusResult;
+      try {
+        cellStatusResult = await spawnStatusImpl("claude", ["auth", "status", "--json"], { env: cellStatusEnv });
+      } catch {
+        cellStatusResult = { code: 1, stdout: "" };
+      }
+      const cellAccount = parseClaudeAccountIdentity(cellStatusResult);
+      const operatorExplicitClaudeConfigDir = requireNonBlank("CLAUDE_CONFIG_DIR", env.CLAUDE_CONFIG_DIR);
+      const operatorStatusEnv = buildOperatorIdentityEnv(env, operatorExplicitClaudeConfigDir, operatorClaudeSecureStorageDir);
+      let operatorStatusResult;
+      try {
+        operatorStatusResult = await spawnStatusImpl("claude", ["auth", "status", "--json"], { env: operatorStatusEnv });
+      } catch {
+        operatorStatusResult = { code: 1, stdout: "" };
+      }
+      const operatorAccount = parseClaudeAccountIdentity(operatorStatusResult);
+      const identityOutcome = evaluateIdentityCollision(cellAccount, operatorAccount);
+      switch (identityOutcome.kind) {
+        case "collision": {
+          io.stdout.write(
+            "advisory: the runner cell identity matched your own Claude Code login. A local comparison cannot prove a runner-only account; complete the morning second-account proof before production use.\n"
+          );
+          break;
+        }
+        case "no_operator_login": {
+          io.stdout.write(
+            "advisory: no login was found in your own Claude Code config, so the local account comparison could not run. This does not prove a runner-only account; complete the morning second-account proof before production use.\n"
+          );
+          break;
+        }
+        case "cell_identity_unreadable": {
+          io.stdout.write(
+            "advisory: the runner cell's identity could not be read back, so the local account comparison could not run. This does not prove a runner-only account; complete the morning second-account proof before production use.\n"
+          );
+          break;
+        }
+        case "distinct": {
+          io.stdout.write(
+            "advisory: the local runner and operator identities differ, but this comparison cannot prove a runner-only account. Complete the morning second-account proof before production use.\n"
+          );
+          break;
+        }
+        default: {
+          const exhaustive = identityOutcome;
+          throw new Error(`unreachable identity collision outcome: ${JSON.stringify(exhaustive)}`);
+        }
+      }
+      const loginVerifyIsolateDir = await mkdtemp2(path11.join(os3.tmpdir(), "rost-runner-login-verify-"));
+      let sandboxProfilePath = null;
+      try {
+        await provisionIsolatedClaudeConfigDir(loginVerifyIsolateDir, cell2, onRepair);
+        const sandbox = resolveSandboxSpec({
+          mode: parseSandboxMode(env.RUNNER_SANDBOX),
+          platform: process.platform,
+          workspaceDir: os3.tmpdir(),
+          tmpDir: os3.tmpdir(),
+          homeDir,
+          stateFile: resolvedStateFile,
+          runnerBaseDir: path11.join(homeDir, ".rost"),
+          allowNetwork: parseSandboxNetwork(env.RUNNER_SANDBOX_NETWORK).allowNetwork,
+          modelRuntime: "claude",
+          claudeSourceHome: operatorClaudeConfigDir,
+          codexSourceHome: resolveSourceCodexHomeDir(env),
+          claudeSecureStorageSourceHome: operatorClaudeSecureStorageDir,
+          claudeIsolateHomeDir: cell2
+        });
+        if (sandbox.kind === "seatbelt") {
+          sandboxProfilePath = path11.join(os3.tmpdir(), `rost-runner-login-verify-sandbox-${randomUUID2()}.sb`);
+          await writeFile7(sandboxProfilePath, sandbox.profile, {
+            mode: 384,
+            flag: fsConstants5.O_CREAT | fsConstants5.O_EXCL | fsConstants5.O_WRONLY | fsConstants5.O_NOFOLLOW
+          });
+        }
+        const { command, args: args2 } = wrapCommandWithSandbox(sandbox, "claude", ["auth", "status", "--json"], sandboxProfilePath);
+        const probeEnv = buildModelSpawnEnv(env, loginVerifyIsolateDir, void 0, cell2);
+        let statusResult;
+        try {
+          statusResult = await spawnStatusImpl(command, args2, { env: probeEnv });
+        } catch {
+          statusResult = { code: 1, stdout: "" };
+        }
+        let loggedIn = false;
+        if (statusResult.code === 0) {
+          try {
+            const parsed = JSON.parse(statusResult.stdout);
+            loggedIn = parsed.loggedIn === true;
+          } catch {
+            loggedIn = false;
+          }
+        }
+        if (!loggedIn) {
+          io.stderr.write(
+            `login completed but the runner cell cannot read back the credential the way a claude turn would; claude-lane turns would still fail. Retry \`${cliBrand.binName} runner login\`.
+`
+          );
+          return 1;
+        }
+        const credentialFilePresent = await hasUsableClaudeCredentialFile(cell2);
+        if (!credentialFilePresent) {
+          io.stderr.write(
+            `login completed and reads back as authenticated, but no usable credential file was written to the runner cell's file store (the file must be a self-owned, single-link, non-empty credential JSON) \u2014 it is unreachable from a claude turn, whose sandbox denies the Keychain. Retry \`${cliBrand.binName} runner login\`.
+`
+          );
+          return 1;
+        }
+      } finally {
+        if (sandboxProfilePath) {
+          await rm7(sandboxProfilePath, { force: true });
+        }
+        await rm7(loginVerifyIsolateDir, { recursive: true, force: true });
+      }
+      try {
+        await commitCellMarkerImpl(cell2);
+      } catch (error51) {
+        io.stderr.write(
+          `Claude credential login completed, but the runner auth marker could not be committed; the server will keep Claude work blocked. Retry \`${cliBrand.binName} runner login\` after fixing the runner cell: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`
+        );
+        return 1;
+      }
+      io.stdout.write(
+        `Runner credential provisioned for runner ${state.runner_id}.
+Claude-lane turns will authenticate from the dedicated cell at ${cell2}.
+Your own Claude login was read once for an advisory comparison; complete the morning second-account proof before production use. Claude-lane turns use the dedicated cell, not the operator source store.
+`
+      );
+      return 0;
+    } finally {
+      await credentialCellLock.release();
+    }
+  } catch (error51) {
+    io.stderr.write(`${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+    return 1;
+  }
+}
+function isEnoent(error51) {
+  return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
+}
+
 // src/index.ts
 function warnImplementationCredentialFallback(io, hasUserSession) {
   if (!hasUserSession) {
@@ -69153,6 +70075,15 @@ function createConfirmPrompt(input, output) {
   };
 }
 var defaultConfirmPrompt = createConfirmPrompt(process.stdin, process.stderr);
+function createUnavailableCredentialStore(error51) {
+  const message = error51 instanceof Error ? error51.message : String(error51);
+  return {
+    read: () => Promise.resolve(null),
+    write: () => Promise.reject(new Error(`No OS credential store is available; cannot store a session. ${message}`)),
+    clear: () => Promise.reject(new Error(`No OS credential store is available; cannot clear a session. ${message}`)),
+    describe: () => "no OS credential store is available"
+  };
+}
 async function main(argv = process.argv.slice(2), options = {}) {
   const io = options.io ?? {
     stdout: process.stdout,
@@ -69298,6 +70229,24 @@ async function main(argv = process.argv.slice(2), options = {}) {
 `);
     return 1;
   }
+  if (command === "runner" && args[0] === "login") {
+    const config3 = loadConfig();
+    return runRunnerLogin({
+      io,
+      args: args.slice(1),
+      appUrl: config3.appUrl,
+      env: process.env
+    });
+  }
+  if (command === "runner" && isRunnerServiceInvocation(args)) {
+    const serviceConfigResult = loadConfigWithDiagnostics();
+    return runRunnerService({
+      io,
+      args,
+      appUrl: serviceConfigResult.config.appUrl,
+      allowDevelopmentAppUrl: process.env[allowInsecureAppUrlEnv] === "1"
+    });
+  }
   let store;
   try {
     store = options.store ?? createTokenStore();
@@ -69305,7 +70254,11 @@ async function main(argv = process.argv.slice(2), options = {}) {
     if (command === "command" && (args[0] === "schema" || args[0] === "list")) {
       return runLocalCommandDiscovery(io, args, cliBrand.binName);
     }
-    throw error51;
+    if (command === "runner" && args[0] === "serve") {
+      store = createUnavailableCredentialStore(error51);
+    } else {
+      throw error51;
+    }
   }
   if (command === "login") {
     const config3 = loadConfig();
@@ -69382,14 +70335,6 @@ async function main(argv = process.argv.slice(2), options = {}) {
       env: process.env
     });
   }
-  if (command === "runner" && isRunnerServiceInvocation(args)) {
-    return runRunnerService({
-      io,
-      args,
-      appUrl: config2.appUrl,
-      allowDevelopmentAppUrl: process.env[allowInsecureAppUrlEnv] === "1"
-    });
-  }
   const implCredentialReader = createImplementationCredentialReader();
   if (command === "onboard" && (args[0] === "status" || args[0] === "resume" || args[0] === "rehearse" || args[0] === "activate" || args[0] === "source-ingest" || args[0] === "setup" || args[0] === "setup-status")) {
     const implCredential = await implCredentialReader.read();