@stll/oxlint-config 1.3.1 → 1.5.0

package/dist/toolchain-inputs.cjs

@@ -1,9 +1,9 @@
 const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let smol_toml = require("smol-toml");
 let node_crypto = require("node:crypto");
 let semver = require("semver");
-let smol_toml = require("smol-toml");
 let node_util = require("node:util");
 let yaml = require("yaml");
 let picomatch = require("picomatch");
@@ -378,6 +378,21 @@ const cloudSetupArtifacts = {
 			binaries: { "rustup-init": "rustup-init" }
 		}
 	},
+	gitleaks: {
+		version: "8.30.1",
+		amd64: {
+			url: "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz",
+			sha256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
+			archive: "tar.gz",
+			binaries: { gitleaks: "gitleaks" }
+		},
+		arm64: {
+			url: "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_arm64.tar.gz",
+			sha256: "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+			archive: "tar.gz",
+			binaries: { gitleaks: "gitleaks" }
+		}
+	},
 	"cargo-nextest": {
 		version: "0.9.148",
 		amd64: {
@@ -445,7 +460,8 @@ const cloudSetupArtifactVersions = {
 	"rustup-init": [cloudSetupArtifacts["rustup-init"]],
 	"cargo-nextest": [cloudSetupArtifacts["cargo-nextest"]],
 	"wasm-bindgen-cli": wasmBindgenArtifactReleases,
-	uv: [cloudSetupArtifacts.uv]
+	uv: [cloudSetupArtifacts.uv],
+	gitleaks: [cloudSetupArtifacts.gitleaks]
 };
 /** A new version requires an explicit, verified catalog entry; never build from source. */
 const getCloudSetupArtifact = (tool, version) => {
@@ -500,11 +516,20 @@ const parseRust = (input) => {
 	if (!object(input) || Object.keys(input).some((key) => ![
 		"toolchain",
 		"components",
-		"targets"
-	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components and targets");
+		"targets",
+		"additionalToolchains"
+	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components, targets and additionalToolchains");
 	const toolchain = input["toolchain"];
 	if (toolchain !== void 0 && !exactPin(toolchain)) throw new Error("cloud.rust.toolchain must be an exact stable release");
+	const additional = input["additionalToolchains"];
+	if (additional !== void 0 && !Array.isArray(additional)) throw new Error("cloud.rust.additionalToolchains requires exact stable releases");
+	const additionalToolchains = additional === void 0 ? [] : Array.from(additional, (pin) => {
+		if (!exactPin(pin)) throw new Error("cloud.rust.additionalToolchains requires exact stable releases");
+		return pin;
+	});
+	if (new Set(additionalToolchains).size !== additionalToolchains.length) throw new Error("cloud.rust.additionalToolchains contains duplicates");
 	return {
+		additionalToolchains,
 		...toolchain === void 0 ? {} : { toolchain },
 		components: parseCloudRustNames(input["components"], "components"),
 		targets: parseCloudRustNames(input["targets"], "targets")
@@ -675,7 +700,12 @@ const postgresStart = String.raw`
   pg_pid="$(head -n 1 "$pg_data/postmaster.pid")"
   service_process "$pg_pid" "$pg_bin/postgres"
   [[ "$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'")" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/createdb" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail "PostgreSQL test database creation failed"
-  DATABASE_URL="postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test"
+  POSTGRES_HOST='127.0.0.1:55432'
+  POSTGRES_USER='stll_cloud'
+  POSTGRES_PASSWORD="$pg_password"
+  POSTGRES_DB_NAME='cloud_test'
+  POSTGRES_ADDITIONAL_CONNECTION_DATA=''
+  DATABASE_URL="postgresql://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST/$POSTGRES_DB_NAME$POSTGRES_ADDITIONAL_CONNECTION_DATA"
   printf 'postgres: %s\n' "$pg_state"
 `;
 const valkeyStart = String.raw`
@@ -838,6 +868,11 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 		if (channel !== rust && !rustExceptions.some(({ pin }) => pin === channel)) throw new Error(`cloud Rust must use shared Rust ${rust} or a recorded rustExceptions pin`);
 		if (cloud.rust?.toolchain !== void 0 && cloud.rust.toolchain !== channel) throw new Error("cloud.rust.toolchain conflicts with root Rust toolchain");
 	}
+	const additionalToolchains = cloud.rust?.additionalToolchains ?? [];
+	for (const pin of additionalToolchains) {
+		if (pin === channel) throw new Error("cloud.rust.additionalToolchains must not repeat the primary toolchain");
+		if (pin !== rust && !rustExceptions.some(({ pin: authorized }) => authorized === pin)) throw new Error(`cloud.rust.additionalToolchains ${pin} requires an authorized rustExceptions pin`);
+	}
 	const components = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["components"], "components"), ...cloud.rust?.components ?? []])].sort();
 	const targets = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["targets"], "targets"), ...cloud.rust?.targets ?? []])].sort();
 	const resolveTool = (tool, version) => {
@@ -868,6 +903,7 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 	return {
 		rust: rustEnabled && typeof channel === "string" ? {
 			channel,
+			additionalToolchains: [...additionalToolchains].sort(),
 			components,
 			targets,
 			installer: cloudSetupArtifacts["rustup-init"]
@@ -904,7 +940,7 @@ rust_run() {
     *) fail 'Invalid Rust execution mode' ;;
   esac
 }
-rust_ready() {
+primary_rust_ready() {
   local directory
   for directory in "$RUSTUP_HOME" "$CARGO_HOME"; do
     [[ -d "$directory" && ! -L "$directory" && "$(stat -c '%u' "$directory")" == "$OUTPUT_UID" ]] || return 1
@@ -918,13 +954,19 @@ rust_ready() {
   @VERIFY_TARGETS@
   return 0
 }
+rust_ready() {
+  local additional_version
+  primary_rust_ready || return 1
+  @VERIFY_ADDITIONAL_TOOLCHAINS@
+  return 0
+}
 verify_rust() { rust_ready || fail 'Pinned Rust, components or targets are unavailable; run install'; }
 install_rust() (
   if ! command -v cc >/dev/null || ! command -v ld >/dev/null || [[ ! -f /usr/include/stdlib.h ]]; then
     apt_refresh_for build-essential
     apt_install build-essential
   fi
-  local artifact_url artifact_sha
+  local artifact_url artifact_sha additional_version
   # Subshell scope retains scratch for EXIT cleanup after a failed command.
   scratch="$(mktemp -d)"
   trap 'rm -rf -- "$scratch"' EXIT
@@ -943,9 +985,10 @@ install_rust() (
     rust_run network "$scratch/rustup-init" -y --no-modify-path --default-toolchain none --profile minimal
   fi
   rust_run local "$CARGO_HOME/bin/rustup" set auto-self-update disable
-  if ! rust_ready; then
+  if ! primary_rust_ready; then
     rust_run network "$CARGO_HOME/bin/rustup" toolchain install @RUST@ --profile minimal --no-self-update @RUST_ARGS@
   fi
+  @INSTALL_ADDITIONAL_TOOLCHAINS@
   rust_run local "$CARGO_HOME/bin/rustup" default @RUST@
   verify_rust
   for tool in rustup cargo rustc rustdoc @RUST_PROXIES@; do
@@ -956,7 +999,7 @@ install_rust() (
     fi
   done
 )
-`.replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
+`.replace("@VERIFY_ADDITIONAL_TOOLCHAINS@", rust.additionalToolchains.map((pin) => `additional_version="$(rust_run local "$CARGO_HOME/bin/rustc" +${pin} --version)" || return 1\n  [[ "$additional_version" == 'rustc ${pin} '* ]] || return 1`).join("\n  ")).replace("@INSTALL_ADDITIONAL_TOOLCHAINS@", rust.additionalToolchains.map((pin) => `if ! additional_version="$(rust_run local "$CARGO_HOME/bin/rustc" +${pin} --version)" || [[ "$additional_version" != 'rustc ${pin} '* ]]; then\n    rust_run network "$CARGO_HOME/bin/rustup" toolchain install ${pin} --profile minimal --no-self-update\n  fi`).join("\n  ")).replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
 };
 const packageToolInstall = ({ tool, release }) => {
 	const name = tool.replaceAll("-", "_");
@@ -979,7 +1022,7 @@ install_${name}() {
 const artifactToolInstall = ({ tool, release }) => {
 	const directory = `/opt/stll-cloud/tools/${tool}/${release.version}`;
 	const command = tool === "wasm-bindgen-cli" ? "wasm-bindgen" : tool;
-	const marker = `${tool === "cargo-nextest" ? "cargo-nextest" : command} ${release.version}`;
+	const marker = `${tool === "gitleaks" ? "gitleaks version" : command} ${release.version}`;
 	return {
 		name: tool.replaceAll("-", "_"),
 		text: `verify_${tool.replaceAll("-", "_")}() {
@@ -1058,9 +1101,9 @@ const script = String.raw`#!/usr/bin/env bash
 # Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.
 set -euo pipefail
 
-usage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }
+usage() { echo 'Usage: cloud-setup.sh install|start|session' >&2; exit 2; }
 [[ "$#" == 1 ]] || usage
-case "$1" in install|start) MODE="$1" ;; *) usage ;; esac
+case "$1" in install|start|session) MODE="$1" ;; *) usage ;; esac
 fail() { echo "cloud-setup: $*" >&2; exit 1; }
 trap 'echo "cloud-setup: command failed at line $LINENO" >&2' ERR
 # Each phase logs its start and duration so a stalled phase is visible in the task log.
@@ -1116,19 +1159,35 @@ esac
 
 @NETWORK@
 
+node_ready() {
+  local node_version npm_version npx_version
+  [[ -x "$NODE_DIR/bin/node" && -x "$NODE_DIR/bin/npm" && -x "$NODE_DIR/bin/npx" ]] || return 1
+  node_version="$("$NODE_DIR/bin/node" --version)" || return 1
+  [[ "$node_version" == "v$NODE_VERSION" ]] || return 1
+  npm_version="$("$NODE_DIR/bin/npm" --version)" || return 1
+  [[ "$npm_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
+  npx_version="$("$NODE_DIR/bin/npx" --version)" || return 1
+  [[ "$npx_version" == "$npm_version" ]] || return 1
+}
 runtime_ready() {
-  [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
+  node_ready || fail 'Pinned Node, npm or npx is unavailable; run install'
   [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
 }
-install_runtimes() {
+install_runtimes() (
+  if [[ ! -s /etc/ssl/certs/ca-certificates.crt ]]; then
+    command -v update-ca-certificates >/dev/null || fail 'System CA certificate bundle is missing; restore ca-certificates in the base image offline before install'
+    update-ca-certificates || fail 'System CA certificate bundle could not be repaired offline; restore ca-certificates in the base image before install'
+  fi
+  [[ -s /etc/ssl/certs/ca-certificates.crt ]] || fail 'System CA certificate bundle is unavailable after offline repair; restore ca-certificates in the base image before install'
   if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null || ! ldconfig -p | awk '$1 == "libatomic.so.1" { found=1 } END { exit !found }'; then
     apt_refresh_for ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
     DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
   fi
-  local scratch node_archive bun_archive bun_folder
+  local node_archive bun_archive bun_folder
+  # Subshell scope retains scratch for EXIT cleanup after a failed command.
   scratch="$(mktemp -d)"
-  trap 'rm -rf -- "$scratch"' RETURN
-  if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
+  trap 'rm -rf -- "$scratch"' EXIT
+  if ! node_ready; then
     node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
     download_file "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" "$scratch/$node_archive" 120
     download_file "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" "$scratch/node-sums" 45
@@ -1151,9 +1210,7 @@ install_runtimes() {
   ln -sfnT -- "$NODE_DIR/bin/npm" /usr/local/bin/npm
   ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
   ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
-  rm -rf -- "$scratch"
-  trap - RETURN
-}
+)
 
 dependency_install() {
   local directory download_hosts
@@ -1199,6 +1256,8 @@ process.stdout.write([...hosts].sort().join(","));
 @INPUT_VALIDATION@
 
 @ENV_FUNCTIONS@
+@ENVIRONMENT_VALUES@
+@SESSION_ENVIRONMENT@
 
 @PREPARE_FUNCTION@
 
@@ -1211,14 +1270,38 @@ if [[ "$MODE" == install ]]; then
 @PREPARE_STEP@
   exit 0
 fi
-step runtime-check runtime_ready
-step tool-check verify_tools
-step shell install_shell_environment
-step shell-check verify_shell_environment
-@ENV_VALIDATE@
-step state prepare_state
-step service-start start_services
-@ENV_WRITE@
+@ENV_INITIALIZE@
+start_environment() {
+  step runtime-check runtime_ready
+  step tool-check verify_tools
+  step shell install_shell_environment
+  step shell-check verify_shell_environment
+  @ENV_VALIDATE@
+  step state prepare_state
+  step service-start start_services
+  @ENV_WRITE@
+}
+if [[ "$MODE" == session ]]; then
+  start_environment >&2
+else
+  start_environment
+fi
+@SESSION_ENVIRONMENT_CALL@
+`;
+const environmentValuesFunction = String.raw`
+environment_values() {
+  local emit="$1"
+  "$emit" NODE_ENV test
+  if [[ -n "$DATABASE_URL" ]]; then
+    "$emit" DATABASE_URL "$DATABASE_URL"
+    "$emit" POSTGRES_HOST "$POSTGRES_HOST"
+    "$emit" POSTGRES_USER "$POSTGRES_USER"
+    "$emit" POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
+    "$emit" POSTGRES_DB_NAME "$POSTGRES_DB_NAME"
+    "$emit" POSTGRES_ADDITIONAL_CONNECTION_DATA "$POSTGRES_ADDITIONAL_CONNECTION_DATA"
+  fi
+  if [[ -n "$REDIS_URL" ]]; then "$emit" REDIS_URL "$REDIS_URL"; fi
+}
 `;
 const environmentFunctions = String.raw`
 validate_environment() {
@@ -1234,20 +1317,26 @@ validate_environment() {
     [[ "$first_line" == "$ENV_MARKER" ]] || fail 'Refusing to overwrite an unowned environment file'
   fi
 }
+environment_file_value() { printf '%s=%s\n' "$1" "$2"; }
 write_environment() {
   validate_environment
   local env_path="$REPO_ROOT/$ENV_FILE" temporary
   temporary="$(mktemp "$(dirname -- "$env_path")/.stll-cloud-env.XXXXXX")"
   chmod 600 "$temporary"
   {
-    printf '%s\n' "$ENV_MARKER" 'NODE_ENV=test'
-    if [[ -n "$DATABASE_URL" ]]; then printf 'DATABASE_URL=%s\n' "$DATABASE_URL"; fi
-    if [[ -n "$REDIS_URL" ]]; then printf 'REDIS_URL=%s\n' "$REDIS_URL"; fi
+    printf '%s\n' "$ENV_MARKER"
+    environment_values environment_file_value
   } > "$temporary"
   chown "$OUTPUT_UID:$OUTPUT_GID" "$temporary"
   mv -f -- "$temporary" "$env_path"
 }
 `;
+const sessionEnvironmentFunction = String.raw`
+environment_shell_value() { printf 'export %s=%q\n' "$1" "$2"; }
+emit_session_environment() {
+  environment_values environment_shell_value
+}
+`;
 const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 const renderPrepare = (prepare, files) => {
 	if (prepare === void 0) return "";
@@ -1301,7 +1390,11 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 		["@NODE@", exactNode],
 		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
 		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
-		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "DATABASE_URL=''\nREDIS_URL=''\nvalidate_environment"],
+		["@ENVIRONMENT_VALUES@", selected.services.length === 0 ? "" : environmentValuesFunction],
+		["@ENV_INITIALIZE@", selected.services.length === 0 ? "" : "DATABASE_URL=''\nPOSTGRES_HOST=''\nPOSTGRES_USER=''\nPOSTGRES_PASSWORD=''\nPOSTGRES_DB_NAME=''\nPOSTGRES_ADDITIONAL_CONNECTION_DATA=''\nREDIS_URL=''"],
+		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "validate_environment"],
+		["@SESSION_ENVIRONMENT@", selected.services.length === 0 ? "" : sessionEnvironmentFunction],
+		["@SESSION_ENVIRONMENT_CALL@", selected.services.length === 0 ? "" : "if [[ \"$MODE\" == session ]]; then emit_session_environment; fi"],
 		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
 		["@PREPARE_FUNCTION@", renderPrepare(selected.prepare, files)],
 		["@PREPARE_STEP@", selected.prepare === void 0 ? "" : "  step prepare prepare_sources"],
@@ -1317,16 +1410,16 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			valkey: policy.valkey
 		})]
 	]);
-	return script.replace(/@[A-Z0-9_]+@/g, (token) => {
+	return `${script.replace(/@[A-Z0-9_]+@/g, (token) => {
 		const value = replacements.get(token);
 		if (value === void 0) throw new Error(`Missing cloud setup field: ${token}`);
 		return value;
-	});
+	}).replace(/[ \t]+$/gm, "").trimEnd()}\n`;
 };
 //#endregion
 //#region src/cloud-setup-claude.ts
 const cloudClaudeSettingsPath = ".claude/settings.json";
-const sessionStartHook = (script) => ({
+const releasedSessionStartHook = (script) => ({
 	matcher: "",
 	hooks: [{
 		type: "command",
@@ -1343,8 +1436,75 @@ const sessionStartHook = (script) => ({
 fi`
 	}]
 });
+const sessionStartHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    cloud_session_exports="$(${script} session)" || cloud_setup_incomplete 'startup failed; run install'
+  else
+    ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+    exit 0
+  fi
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    if [ -e "$CLAUDE_ENV_FILE" ] || [ -L "$CLAUDE_ENV_FILE" ]; then
+      [ -f "$CLAUDE_ENV_FILE" ] && [ ! -L "$CLAUDE_ENV_FILE" ] || cloud_setup_incomplete 'session environment must be a regular file; check its path and rerun start'
+    fi
+    cloud_env_temporary="$(umask 077; mktemp "\${CLAUDE_ENV_FILE}.XXXXXX")" || cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'
+    if [ -e "$CLAUDE_ENV_FILE" ] || [ -L "$CLAUDE_ENV_FILE" ]; then
+      cat "$CLAUDE_ENV_FILE" > "$cloud_env_temporary" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be read; check its access and rerun start'; }
+    fi
+    if [ -n "$cloud_session_exports" ]; then
+      cloud_session_exports="$cloud_session_exports
+$cloud_shell_exports"
+    else
+      cloud_session_exports="$cloud_shell_exports"
+    fi
+    printf '\\n%s\\n' "$cloud_session_exports" >> "$cloud_env_temporary" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'; }
+    mv -f -- "$cloud_env_temporary" "$CLAUDE_ENV_FILE" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'; }
+  fi
+fi`
+	}]
+});
+const currentMainSessionStartHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    printf '\\n%s\\n' "$cloud_shell_exports" >> "$CLAUDE_ENV_FILE" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'
+  fi
+fi`
+	}]
+});
 const cloudSessionStartHook = sessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`);
-const previousCloudSessionStartHooks = [sessionStartHook(`bash ${cloudSetupPath}`)];
+const previousCloudSessionStartHooks = [
+	releasedSessionStartHook(`bash ${cloudSetupPath}`),
+	releasedSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
+	currentMainSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)
+];
 const cloudAttribution = {
 	commit: "",
 	pr: ""
@@ -1578,6 +1738,18 @@ const javascriptDependencyLockfiles = [
 	"yarn.lock",
 	"pnpm-lock.yaml"
 ];
+const dependabotManifestEcosystems = {
+	Gemfile: "bundler",
+	"Gemfile.lock": "bundler",
+	"composer.json": "composer",
+	"composer.lock": "composer"
+};
+/** Share ecosystem inventory with snapshot selection; no dependency graph reads are needed. */
+const dependabotManifestEcosystem = (file) => {
+	if (excludedInputPath(file)) return void 0;
+	const basename = file.split("/").at(-1);
+	for (const [name, ecosystem] of Object.entries(dependabotManifestEcosystems)) if (basename === name) return ecosystem;
+};
 /** Match project, environment, local, and fragment filenames recognized by mise. */
 const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
 /** GitHub action metadata may live at the repository root or in any directory. */
@@ -1613,10 +1785,10 @@ const isDockerDefinitionPath = (file) => {
 const isShellScript = (file, text = "") => !excludedInputPath(file) && (/\.(?:sh|bash|zsh)$/.test(file) || /^#![ \t]*(?:\/(?:[^ \t\r\n]+\/)*(?:bash|dash|ksh|zsh|sh)|\/usr\/bin\/env[ \t]+(?:-S[ \t]+)?(?:bash|dash|ksh|zsh|sh))(?=[ \t\r\n]|$)/.test(text));
 /** Lockfiles establish ecosystem presence without reading their dependency graphs. */
 const toolchainInputKind = (file, text = "") => {
-	if (file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
+	if (file === "bunfig.toml" || file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
 	if (githubAutomationFileKind(file) !== void 0) return "config";
 	if (excludedInputPath(file)) return void 0;
-	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (dependabotManifestEcosystem(file) !== void 0 || pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
@@ -1650,6 +1822,12 @@ Object.defineProperty(exports, "containerDocumentImages", {
 		return containerDocumentImages;
 	}
 });
+Object.defineProperty(exports, "dependabotManifestEcosystem", {
+	enumerable: true,
+	get: function() {
+		return dependabotManifestEcosystem;
+	}
+});
 Object.defineProperty(exports, "generateCloudSetup", {
 	enumerable: true,
 	get: function() {