@stll/oxlint-config 1.3.1 → 1.5.0

package/dist/toolchain-inputs.mjs

@@ -1,7 +1,7 @@
 import path from "node:path";
+import { parse } from "smol-toml";
 import { createHash } from "node:crypto";
 import { subset, valid, validRange } from "semver";
-import { parse as parse$1 } from "smol-toml";
 import { isDeepStrictEqual } from "node:util";
 import { parseDocument } from "yaml";
 import picomatch from "picomatch";
@@ -375,6 +375,21 @@ const cloudSetupArtifacts = {
 			binaries: { "rustup-init": "rustup-init" }
 		}
 	},
+	gitleaks: {
+		version: "8.30.1",
+		amd64: {
+			url: "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz",
+			sha256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
+			archive: "tar.gz",
+			binaries: { gitleaks: "gitleaks" }
+		},
+		arm64: {
+			url: "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_arm64.tar.gz",
+			sha256: "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+			archive: "tar.gz",
+			binaries: { gitleaks: "gitleaks" }
+		}
+	},
 	"cargo-nextest": {
 		version: "0.9.148",
 		amd64: {
@@ -442,7 +457,8 @@ const cloudSetupArtifactVersions = {
 	"rustup-init": [cloudSetupArtifacts["rustup-init"]],
 	"cargo-nextest": [cloudSetupArtifacts["cargo-nextest"]],
 	"wasm-bindgen-cli": wasmBindgenArtifactReleases,
-	uv: [cloudSetupArtifacts.uv]
+	uv: [cloudSetupArtifacts.uv],
+	gitleaks: [cloudSetupArtifacts.gitleaks]
 };
 /** A new version requires an explicit, verified catalog entry; never build from source. */
 const getCloudSetupArtifact = (tool, version) => {
@@ -497,11 +513,20 @@ const parseRust = (input) => {
 	if (!object(input) || Object.keys(input).some((key) => ![
 		"toolchain",
 		"components",
-		"targets"
-	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components and targets");
+		"targets",
+		"additionalToolchains"
+	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components, targets and additionalToolchains");
 	const toolchain = input["toolchain"];
 	if (toolchain !== void 0 && !exactPin(toolchain)) throw new Error("cloud.rust.toolchain must be an exact stable release");
+	const additional = input["additionalToolchains"];
+	if (additional !== void 0 && !Array.isArray(additional)) throw new Error("cloud.rust.additionalToolchains requires exact stable releases");
+	const additionalToolchains = additional === void 0 ? [] : Array.from(additional, (pin) => {
+		if (!exactPin(pin)) throw new Error("cloud.rust.additionalToolchains requires exact stable releases");
+		return pin;
+	});
+	if (new Set(additionalToolchains).size !== additionalToolchains.length) throw new Error("cloud.rust.additionalToolchains contains duplicates");
 	return {
+		additionalToolchains,
 		...toolchain === void 0 ? {} : { toolchain },
 		components: parseCloudRustNames(input["components"], "components"),
 		targets: parseCloudRustNames(input["targets"], "targets")
@@ -672,7 +697,12 @@ const postgresStart = String.raw`
   pg_pid="$(head -n 1 "$pg_data/postmaster.pid")"
   service_process "$pg_pid" "$pg_bin/postgres"
   [[ "$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'")" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/createdb" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail "PostgreSQL test database creation failed"
-  DATABASE_URL="postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test"
+  POSTGRES_HOST='127.0.0.1:55432'
+  POSTGRES_USER='stll_cloud'
+  POSTGRES_PASSWORD="$pg_password"
+  POSTGRES_DB_NAME='cloud_test'
+  POSTGRES_ADDITIONAL_CONNECTION_DATA=''
+  DATABASE_URL="postgresql://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST/$POSTGRES_DB_NAME$POSTGRES_ADDITIONAL_CONNECTION_DATA"
   printf 'postgres: %s\n' "$pg_state"
 `;
 const valkeyStart = String.raw`
@@ -817,7 +847,7 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 	if (source !== void 0 && selector !== void 0) throw new Error("cloud Rust requires one root rust-toolchain.toml or rust-toolchain file");
 	let declared;
 	if (source !== void 0 || selector?.trimStart().startsWith("[")) {
-		const parsed = parse$1(source ?? selector ?? "");
+		const parsed = parse(source ?? selector ?? "");
 		if (!record$2(parsed["toolchain"])) throw new Error("cloud Rust requires [toolchain]");
 		declared = parsed["toolchain"];
 		if (Object.keys(declared).some((key) => ![
@@ -835,6 +865,11 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 		if (channel !== rust && !rustExceptions.some(({ pin }) => pin === channel)) throw new Error(`cloud Rust must use shared Rust ${rust} or a recorded rustExceptions pin`);
 		if (cloud.rust?.toolchain !== void 0 && cloud.rust.toolchain !== channel) throw new Error("cloud.rust.toolchain conflicts with root Rust toolchain");
 	}
+	const additionalToolchains = cloud.rust?.additionalToolchains ?? [];
+	for (const pin of additionalToolchains) {
+		if (pin === channel) throw new Error("cloud.rust.additionalToolchains must not repeat the primary toolchain");
+		if (pin !== rust && !rustExceptions.some(({ pin: authorized }) => authorized === pin)) throw new Error(`cloud.rust.additionalToolchains ${pin} requires an authorized rustExceptions pin`);
+	}
 	const components = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["components"], "components"), ...cloud.rust?.components ?? []])].sort();
 	const targets = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["targets"], "targets"), ...cloud.rust?.targets ?? []])].sort();
 	const resolveTool = (tool, version) => {
@@ -847,7 +882,7 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 		if (tool === "wasm-bindgen-cli") {
 			const lock = files["Cargo.lock"];
 			if (lock === void 0) throw new Error("wasm-bindgen-cli requires tracked root Cargo.lock");
-			const packages = parse$1(lock)["package"];
+			const packages = parse(lock)["package"];
 			if (!Array.isArray(packages)) throw new Error("Cargo.lock requires package entries for wasm-bindgen-cli");
 			const versions = new Set(packages.flatMap((entry) => record$2(entry) && entry["name"] === "wasm-bindgen" ? [entry["version"]] : []));
 			if (versions.size !== 1 || !versions.has(version)) throw new Error(`cloud.tools.wasm-bindgen-cli ${version} must equal the unique wasm-bindgen crate version in Cargo.lock (found ${[...versions].join(", ") || "none"})`);
@@ -865,6 +900,7 @@ const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
 	return {
 		rust: rustEnabled && typeof channel === "string" ? {
 			channel,
+			additionalToolchains: [...additionalToolchains].sort(),
 			components,
 			targets,
 			installer: cloudSetupArtifacts["rustup-init"]
@@ -901,7 +937,7 @@ rust_run() {
     *) fail 'Invalid Rust execution mode' ;;
   esac
 }
-rust_ready() {
+primary_rust_ready() {
   local directory
   for directory in "$RUSTUP_HOME" "$CARGO_HOME"; do
     [[ -d "$directory" && ! -L "$directory" && "$(stat -c '%u' "$directory")" == "$OUTPUT_UID" ]] || return 1
@@ -915,13 +951,19 @@ rust_ready() {
   @VERIFY_TARGETS@
   return 0
 }
+rust_ready() {
+  local additional_version
+  primary_rust_ready || return 1
+  @VERIFY_ADDITIONAL_TOOLCHAINS@
+  return 0
+}
 verify_rust() { rust_ready || fail 'Pinned Rust, components or targets are unavailable; run install'; }
 install_rust() (
   if ! command -v cc >/dev/null || ! command -v ld >/dev/null || [[ ! -f /usr/include/stdlib.h ]]; then
     apt_refresh_for build-essential
     apt_install build-essential
   fi
-  local artifact_url artifact_sha
+  local artifact_url artifact_sha additional_version
   # Subshell scope retains scratch for EXIT cleanup after a failed command.
   scratch="$(mktemp -d)"
   trap 'rm -rf -- "$scratch"' EXIT
@@ -940,9 +982,10 @@ install_rust() (
     rust_run network "$scratch/rustup-init" -y --no-modify-path --default-toolchain none --profile minimal
   fi
   rust_run local "$CARGO_HOME/bin/rustup" set auto-self-update disable
-  if ! rust_ready; then
+  if ! primary_rust_ready; then
     rust_run network "$CARGO_HOME/bin/rustup" toolchain install @RUST@ --profile minimal --no-self-update @RUST_ARGS@
   fi
+  @INSTALL_ADDITIONAL_TOOLCHAINS@
   rust_run local "$CARGO_HOME/bin/rustup" default @RUST@
   verify_rust
   for tool in rustup cargo rustc rustdoc @RUST_PROXIES@; do
@@ -953,7 +996,7 @@ install_rust() (
     fi
   done
 )
-`.replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
+`.replace("@VERIFY_ADDITIONAL_TOOLCHAINS@", rust.additionalToolchains.map((pin) => `additional_version="$(rust_run local "$CARGO_HOME/bin/rustc" +${pin} --version)" || return 1\n  [[ "$additional_version" == 'rustc ${pin} '* ]] || return 1`).join("\n  ")).replace("@INSTALL_ADDITIONAL_TOOLCHAINS@", rust.additionalToolchains.map((pin) => `if ! additional_version="$(rust_run local "$CARGO_HOME/bin/rustc" +${pin} --version)" || [[ "$additional_version" != 'rustc ${pin} '* ]]; then\n    rust_run network "$CARGO_HOME/bin/rustup" toolchain install ${pin} --profile minimal --no-self-update\n  fi`).join("\n  ")).replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
 };
 const packageToolInstall = ({ tool, release }) => {
 	const name = tool.replaceAll("-", "_");
@@ -976,7 +1019,7 @@ install_${name}() {
 const artifactToolInstall = ({ tool, release }) => {
 	const directory = `/opt/stll-cloud/tools/${tool}/${release.version}`;
 	const command = tool === "wasm-bindgen-cli" ? "wasm-bindgen" : tool;
-	const marker = `${tool === "cargo-nextest" ? "cargo-nextest" : command} ${release.version}`;
+	const marker = `${tool === "gitleaks" ? "gitleaks version" : command} ${release.version}`;
 	return {
 		name: tool.replaceAll("-", "_"),
 		text: `verify_${tool.replaceAll("-", "_")}() {
@@ -1055,9 +1098,9 @@ const script = String.raw`#!/usr/bin/env bash
 # Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.
 set -euo pipefail
 
-usage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }
+usage() { echo 'Usage: cloud-setup.sh install|start|session' >&2; exit 2; }
 [[ "$#" == 1 ]] || usage
-case "$1" in install|start) MODE="$1" ;; *) usage ;; esac
+case "$1" in install|start|session) MODE="$1" ;; *) usage ;; esac
 fail() { echo "cloud-setup: $*" >&2; exit 1; }
 trap 'echo "cloud-setup: command failed at line $LINENO" >&2' ERR
 # Each phase logs its start and duration so a stalled phase is visible in the task log.
@@ -1113,19 +1156,35 @@ esac
 
 @NETWORK@
 
+node_ready() {
+  local node_version npm_version npx_version
+  [[ -x "$NODE_DIR/bin/node" && -x "$NODE_DIR/bin/npm" && -x "$NODE_DIR/bin/npx" ]] || return 1
+  node_version="$("$NODE_DIR/bin/node" --version)" || return 1
+  [[ "$node_version" == "v$NODE_VERSION" ]] || return 1
+  npm_version="$("$NODE_DIR/bin/npm" --version)" || return 1
+  [[ "$npm_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
+  npx_version="$("$NODE_DIR/bin/npx" --version)" || return 1
+  [[ "$npx_version" == "$npm_version" ]] || return 1
+}
 runtime_ready() {
-  [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
+  node_ready || fail 'Pinned Node, npm or npx is unavailable; run install'
   [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
 }
-install_runtimes() {
+install_runtimes() (
+  if [[ ! -s /etc/ssl/certs/ca-certificates.crt ]]; then
+    command -v update-ca-certificates >/dev/null || fail 'System CA certificate bundle is missing; restore ca-certificates in the base image offline before install'
+    update-ca-certificates || fail 'System CA certificate bundle could not be repaired offline; restore ca-certificates in the base image before install'
+  fi
+  [[ -s /etc/ssl/certs/ca-certificates.crt ]] || fail 'System CA certificate bundle is unavailable after offline repair; restore ca-certificates in the base image before install'
   if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null || ! ldconfig -p | awk '$1 == "libatomic.so.1" { found=1 } END { exit !found }'; then
     apt_refresh_for ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
     DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
   fi
-  local scratch node_archive bun_archive bun_folder
+  local node_archive bun_archive bun_folder
+  # Subshell scope retains scratch for EXIT cleanup after a failed command.
   scratch="$(mktemp -d)"
-  trap 'rm -rf -- "$scratch"' RETURN
-  if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
+  trap 'rm -rf -- "$scratch"' EXIT
+  if ! node_ready; then
     node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
     download_file "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" "$scratch/$node_archive" 120
     download_file "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" "$scratch/node-sums" 45
@@ -1148,9 +1207,7 @@ install_runtimes() {
   ln -sfnT -- "$NODE_DIR/bin/npm" /usr/local/bin/npm
   ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
   ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
-  rm -rf -- "$scratch"
-  trap - RETURN
-}
+)
 
 dependency_install() {
   local directory download_hosts
@@ -1196,6 +1253,8 @@ process.stdout.write([...hosts].sort().join(","));
 @INPUT_VALIDATION@
 
 @ENV_FUNCTIONS@
+@ENVIRONMENT_VALUES@
+@SESSION_ENVIRONMENT@
 
 @PREPARE_FUNCTION@
 
@@ -1208,14 +1267,38 @@ if [[ "$MODE" == install ]]; then
 @PREPARE_STEP@
   exit 0
 fi
-step runtime-check runtime_ready
-step tool-check verify_tools
-step shell install_shell_environment
-step shell-check verify_shell_environment
-@ENV_VALIDATE@
-step state prepare_state
-step service-start start_services
-@ENV_WRITE@
+@ENV_INITIALIZE@
+start_environment() {
+  step runtime-check runtime_ready
+  step tool-check verify_tools
+  step shell install_shell_environment
+  step shell-check verify_shell_environment
+  @ENV_VALIDATE@
+  step state prepare_state
+  step service-start start_services
+  @ENV_WRITE@
+}
+if [[ "$MODE" == session ]]; then
+  start_environment >&2
+else
+  start_environment
+fi
+@SESSION_ENVIRONMENT_CALL@
+`;
+const environmentValuesFunction = String.raw`
+environment_values() {
+  local emit="$1"
+  "$emit" NODE_ENV test
+  if [[ -n "$DATABASE_URL" ]]; then
+    "$emit" DATABASE_URL "$DATABASE_URL"
+    "$emit" POSTGRES_HOST "$POSTGRES_HOST"
+    "$emit" POSTGRES_USER "$POSTGRES_USER"
+    "$emit" POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
+    "$emit" POSTGRES_DB_NAME "$POSTGRES_DB_NAME"
+    "$emit" POSTGRES_ADDITIONAL_CONNECTION_DATA "$POSTGRES_ADDITIONAL_CONNECTION_DATA"
+  fi
+  if [[ -n "$REDIS_URL" ]]; then "$emit" REDIS_URL "$REDIS_URL"; fi
+}
 `;
 const environmentFunctions = String.raw`
 validate_environment() {
@@ -1231,20 +1314,26 @@ validate_environment() {
     [[ "$first_line" == "$ENV_MARKER" ]] || fail 'Refusing to overwrite an unowned environment file'
   fi
 }
+environment_file_value() { printf '%s=%s\n' "$1" "$2"; }
 write_environment() {
   validate_environment
   local env_path="$REPO_ROOT/$ENV_FILE" temporary
   temporary="$(mktemp "$(dirname -- "$env_path")/.stll-cloud-env.XXXXXX")"
   chmod 600 "$temporary"
   {
-    printf '%s\n' "$ENV_MARKER" 'NODE_ENV=test'
-    if [[ -n "$DATABASE_URL" ]]; then printf 'DATABASE_URL=%s\n' "$DATABASE_URL"; fi
-    if [[ -n "$REDIS_URL" ]]; then printf 'REDIS_URL=%s\n' "$REDIS_URL"; fi
+    printf '%s\n' "$ENV_MARKER"
+    environment_values environment_file_value
   } > "$temporary"
   chown "$OUTPUT_UID:$OUTPUT_GID" "$temporary"
   mv -f -- "$temporary" "$env_path"
 }
 `;
+const sessionEnvironmentFunction = String.raw`
+environment_shell_value() { printf 'export %s=%q\n' "$1" "$2"; }
+emit_session_environment() {
+  environment_values environment_shell_value
+}
+`;
 const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 const renderPrepare = (prepare, files) => {
 	if (prepare === void 0) return "";
@@ -1298,7 +1387,11 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 		["@NODE@", exactNode],
 		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
 		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
-		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "DATABASE_URL=''\nREDIS_URL=''\nvalidate_environment"],
+		["@ENVIRONMENT_VALUES@", selected.services.length === 0 ? "" : environmentValuesFunction],
+		["@ENV_INITIALIZE@", selected.services.length === 0 ? "" : "DATABASE_URL=''\nPOSTGRES_HOST=''\nPOSTGRES_USER=''\nPOSTGRES_PASSWORD=''\nPOSTGRES_DB_NAME=''\nPOSTGRES_ADDITIONAL_CONNECTION_DATA=''\nREDIS_URL=''"],
+		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "validate_environment"],
+		["@SESSION_ENVIRONMENT@", selected.services.length === 0 ? "" : sessionEnvironmentFunction],
+		["@SESSION_ENVIRONMENT_CALL@", selected.services.length === 0 ? "" : "if [[ \"$MODE\" == session ]]; then emit_session_environment; fi"],
 		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
 		["@PREPARE_FUNCTION@", renderPrepare(selected.prepare, files)],
 		["@PREPARE_STEP@", selected.prepare === void 0 ? "" : "  step prepare prepare_sources"],
@@ -1314,16 +1407,16 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			valkey: policy.valkey
 		})]
 	]);
-	return script.replace(/@[A-Z0-9_]+@/g, (token) => {
+	return `${script.replace(/@[A-Z0-9_]+@/g, (token) => {
 		const value = replacements.get(token);
 		if (value === void 0) throw new Error(`Missing cloud setup field: ${token}`);
 		return value;
-	});
+	}).replace(/[ \t]+$/gm, "").trimEnd()}\n`;
 };
 //#endregion
 //#region src/cloud-setup-claude.ts
 const cloudClaudeSettingsPath = ".claude/settings.json";
-const sessionStartHook = (script) => ({
+const releasedSessionStartHook = (script) => ({
 	matcher: "",
 	hooks: [{
 		type: "command",
@@ -1340,8 +1433,75 @@ const sessionStartHook = (script) => ({
 fi`
 	}]
 });
+const sessionStartHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    cloud_session_exports="$(${script} session)" || cloud_setup_incomplete 'startup failed; run install'
+  else
+    ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+    exit 0
+  fi
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    if [ -e "$CLAUDE_ENV_FILE" ] || [ -L "$CLAUDE_ENV_FILE" ]; then
+      [ -f "$CLAUDE_ENV_FILE" ] && [ ! -L "$CLAUDE_ENV_FILE" ] || cloud_setup_incomplete 'session environment must be a regular file; check its path and rerun start'
+    fi
+    cloud_env_temporary="$(umask 077; mktemp "\${CLAUDE_ENV_FILE}.XXXXXX")" || cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'
+    if [ -e "$CLAUDE_ENV_FILE" ] || [ -L "$CLAUDE_ENV_FILE" ]; then
+      cat "$CLAUDE_ENV_FILE" > "$cloud_env_temporary" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be read; check its access and rerun start'; }
+    fi
+    if [ -n "$cloud_session_exports" ]; then
+      cloud_session_exports="$cloud_session_exports
+$cloud_shell_exports"
+    else
+      cloud_session_exports="$cloud_shell_exports"
+    fi
+    printf '\\n%s\\n' "$cloud_session_exports" >> "$cloud_env_temporary" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be prepared; check its write access and rerun start'; }
+    mv -f -- "$cloud_env_temporary" "$CLAUDE_ENV_FILE" || { rm -f -- "$cloud_env_temporary"; cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'; }
+  fi
+fi`
+	}]
+});
+const currentMainSessionStartHook = (script) => ({
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  cloud_setup_incomplete() {
+    printf '%s\\n' 'Cloud setup could not establish a verified session environment. From the repository root, run bash .agents/cloud-setup.sh install and then bash .agents/cloud-setup.sh start. Do not assume pinned tools or services are ready until start succeeds.'
+    printf '%s\\n' "cloud-setup: $1" >&2
+    exit 0
+  }
+  ${script} start >&2 || cloud_setup_incomplete 'startup failed; run install'
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -s ${cloudShellProfilePath} ]; then
+      cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    fi
+    cloud_shell_exports="$(cat ${cloudShellProfilePath})" || cloud_setup_incomplete 'cloud shell profile could not be read; run install'
+    [ -n "$cloud_shell_exports" ] || cloud_setup_incomplete 'cloud shell profile is unavailable; run install'
+    printf '\\n%s\\n' "$cloud_shell_exports" >> "$CLAUDE_ENV_FILE" || cloud_setup_incomplete 'session environment could not be persisted; check its write access and rerun start'
+  fi
+fi`
+	}]
+});
 const cloudSessionStartHook = sessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`);
-const previousCloudSessionStartHooks = [sessionStartHook(`bash ${cloudSetupPath}`)];
+const previousCloudSessionStartHooks = [
+	releasedSessionStartHook(`bash ${cloudSetupPath}`),
+	releasedSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`),
+	currentMainSessionStartHook(`bash "$CLAUDE_PROJECT_DIR/${cloudSetupPath}"`)
+];
 const cloudAttribution = {
 	commit: "",
 	pr: ""
@@ -1575,6 +1735,18 @@ const javascriptDependencyLockfiles = [
 	"yarn.lock",
 	"pnpm-lock.yaml"
 ];
+const dependabotManifestEcosystems = {
+	Gemfile: "bundler",
+	"Gemfile.lock": "bundler",
+	"composer.json": "composer",
+	"composer.lock": "composer"
+};
+/** Share ecosystem inventory with snapshot selection; no dependency graph reads are needed. */
+const dependabotManifestEcosystem = (file) => {
+	if (excludedInputPath(file)) return void 0;
+	const basename = file.split("/").at(-1);
+	for (const [name, ecosystem] of Object.entries(dependabotManifestEcosystems)) if (basename === name) return ecosystem;
+};
 /** Match project, environment, local, and fragment filenames recognized by mise. */
 const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
 /** GitHub action metadata may live at the repository root or in any directory. */
@@ -1610,13 +1782,13 @@ const isDockerDefinitionPath = (file) => {
 const isShellScript = (file, text = "") => !excludedInputPath(file) && (/\.(?:sh|bash|zsh)$/.test(file) || /^#![ \t]*(?:\/(?:[^ \t\r\n]+\/)*(?:bash|dash|ksh|zsh|sh)|\/usr\/bin\/env[ \t]+(?:-S[ \t]+)?(?:bash|dash|ksh|zsh|sh))(?=[ \t\r\n]|$)/.test(text));
 /** Lockfiles establish ecosystem presence without reading their dependency graphs. */
 const toolchainInputKind = (file, text = "") => {
-	if (file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
+	if (file === "bunfig.toml" || file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
 	if (githubAutomationFileKind(file) !== void 0) return "config";
 	if (excludedInputPath(file)) return void 0;
-	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (dependabotManifestEcosystem(file) !== void 0 || pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
-export { nodeSelectorMatches as C, nodePolicyValid as S, parseCloudSetup as T, hasCloudAttribution as _, isPythonDependencyManifest as a, cloudSetupPath as b, pythonDependencyManifestKind as c, isComposeDefinitionPath as d, isKubernetesDefinitionPath as f, cloudSessionStartFix as g, cloudClaudeSettingsPath as h, isMiseConfigPath as i, toolchainInputKind as l, cloudAttributionFix as m, isDependabotGithubActionsPath as n, isShellScript as o, workspaceContains as p, isDockerDefinitionPath as r, javascriptDependencyLockfiles as s, githubAutomationFileKind as t, containerDocumentImages as u, hasCloudSessionStartHook as v, nodeSupportRangeMatches as w, generateCloudSetup as x, mergeCloudClaudeSettings as y };
+export { nodePolicyValid as C, parseCloudSetup as E, generateCloudSetup as S, nodeSupportRangeMatches as T, cloudSessionStartFix as _, isMiseConfigPath as a, mergeCloudClaudeSettings as b, javascriptDependencyLockfiles as c, containerDocumentImages as d, isComposeDefinitionPath as f, cloudClaudeSettingsPath as g, cloudAttributionFix as h, isDockerDefinitionPath as i, pythonDependencyManifestKind as l, workspaceContains as m, githubAutomationFileKind as n, isPythonDependencyManifest as o, isKubernetesDefinitionPath as p, isDependabotGithubActionsPath as r, isShellScript as s, dependabotManifestEcosystem as t, toolchainInputKind as u, hasCloudAttribution as v, nodeSelectorMatches as w, cloudSetupPath as x, hasCloudSessionStartHook as y };
 
 //# sourceMappingURL=toolchain-inputs.mjs.map