@tamsensedev/runner 0.9.0 → 0.10.0

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { homedir as homedir3 } from "os";
-import process5 from "process";
+import process7 from "process";
 
 // src/api.ts
 var DEFAULT_SERVER = "https://my.tamsense.com";
@@ -187,7 +187,7 @@ function findNpm(nodePath, env, exists) {
   }
   return null;
 }
-var runProcess = (command, args, options) => new Promise((resolve3, reject) => {
+var runProcess = (command, args, options) => new Promise((resolve5, reject) => {
   const child = spawn(command, args, { cwd: options.cwd, env: options.env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
   const tail = [];
   for (const stream of [child.stdout, child.stderr]) {
@@ -201,7 +201,7 @@ var runProcess = (command, args, options) => new Promise((resolve3, reject) => {
     });
   }
   child.on("error", reject);
-  child.on("close", (code) => resolve3({ code: code ?? 1, output: tail.join("\n") }));
+  child.on("close", (code) => resolve5({ code: code ?? 1, output: tail.join("\n") }));
 });
 function failureText(what, result) {
   if (OFFLINE_PATTERN.test(result.output)) {
@@ -314,8 +314,8 @@ async function probeCapabilities(stop) {
   stop?.throwIfAborted();
   let release = () => {
   };
-  const released = new Promise((resolve3) => {
-    release = resolve3;
+  const released = new Promise((resolve5) => {
+    release = resolve5;
   });
   const nothing = {
     [Symbol.asyncIterator]: () => ({
@@ -450,6 +450,10 @@ var PAIRING_TOKEN_PATH = "/api/runner/pairings/token";
 var IDENTITY_PATH = "/api/runner/me";
 var NEXT_RUN_PATH = "/api/runner/runs/next";
 var CAPABILITIES_PATH = "/api/runner/me/capabilities";
+var FOLDER_CHECKS_PATH = "/api/runner/folders/checks";
+function folderCheckPath(folderId) {
+  return `/api/runner/folders/${folderId}`;
+}
 function runPath(runId, action) {
   return `/api/runner/runs/${runId}/${action}`;
 }
@@ -758,8 +762,8 @@ function inputChannel(options = {}) {
       }
       const next = queue.shift();
       if (!next) {
-        await new Promise((resolve3) => {
-          wake = resolve3;
+        await new Promise((resolve5) => {
+          wake = resolve5;
         });
         continue;
       }
@@ -819,9 +823,9 @@ function inputChannel(options = {}) {
     onSwitch(apply) {
       applySwitch2 = apply;
       if (waitingSwitch) {
-        const { change, resolve: resolve3 } = waitingSwitch;
+        const { change, resolve: resolve5 } = waitingSwitch;
         waitingSwitch = null;
-        void apply(change).then(() => resolve3(true), () => resolve3(false));
+        void apply(change).then(() => resolve5(true), () => resolve5(false));
       }
     },
     onStopHelper(stop) {
@@ -882,8 +886,8 @@ function inputChannel(options = {}) {
       const earlier = waitingSwitch;
       earlier?.resolve(false);
       const merged = { model: change.model ?? earlier?.change.model ?? null, effort: change.effort ?? earlier?.change.effort ?? null };
-      return new Promise((resolve3) => {
-        waitingSwitch = { change: merged, resolve: resolve3 };
+      return new Promise((resolve5) => {
+        waitingSwitch = { change: merged, resolve: resolve5 };
       });
     }
   };
@@ -1087,9 +1091,515 @@ function askPermission(tools, lastWords, folder) {
 }
 var denyWhenAsked = async () => deny(NOBODY_TO_ASK);
 
+// src/localWorkspace.ts
+import { existsSync as existsSync4 } from "fs";
+import { join as join4, resolve as resolve3 } from "path";
+
+// src/folders.ts
+import { existsSync as existsSync2, realpathSync, statSync } from "fs";
+import { basename, isAbsolute, join as join2, relative, resolve } from "path";
+import process3 from "process";
+
+// src/git.ts
+import { Buffer as Buffer2 } from "buffer";
+import { spawn as spawn2 } from "child_process";
+import process2 from "process";
+var GITHUB_ORIGIN = "https://github.com/";
+function githubAuthEnv(token) {
+  const credentials = Buffer2.from(`x-access-token:${token}`).toString("base64");
+  return {
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: `http.${GITHUB_ORIGIN}.extraheader`,
+    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${credentials}`,
+    GIT_TERMINAL_PROMPT: "0"
+  };
+}
+function personalGitEnv(env = process2.env) {
+  return { GIT_TERMINAL_PROMPT: "0", ...env.GIT_SSH_COMMAND ? {} : { GIT_SSH_COMMAND: "ssh -o BatchMode=yes" } };
+}
+function runGit(args, options) {
+  const env = { ...process2.env, ...options.env, ...options.token ? githubAuthEnv(options.token) : {} };
+  return new Promise((resolve5, reject) => {
+    const child = spawn2("git", args, { cwd: options.cwd, env, stdio: ["ignore", "pipe", "pipe"], ...options.timeoutMs ? { timeout: options.timeoutMs } : {} });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolve5({ code: code ?? 1, stdout: stdout.trim(), stderr: stderr.trim() }));
+  });
+}
+async function git(args, options) {
+  const result = await runGit(args, options);
+  if (result.code !== 0) {
+    throw new Error(`git ${args[0]} failed: ${result.stderr || result.stdout || `exit code ${result.code}`}`);
+  }
+  return result.stdout;
+}
+
+// src/folders.ts
+var FIRST_REMOTE = "origin";
+var USUAL_BASES = ["main", "master"];
+var CHECKS_INTERVAL_MS = 5e3;
+var WEB_REMOTE = /^[a-z][\w+.-]*:\/\//i;
+var NETWORK_REMOTE = /^(?!file:)[a-z][\w+.-]*:\/\/|^[^/@]+@[^/:]+:/i;
+function problem(text2) {
+  return { ok: false, problem: text2 };
+}
+async function gitText(args, cwd) {
+  const result = await runGit(args, { cwd });
+  return result.code === 0 && result.stdout ? result.stdout : null;
+}
+function expandHome(path, home) {
+  const trimmed = path.trim();
+  return trimmed === "~" || trimmed.startsWith("~/") || trimmed.startsWith("~\\") ? join2(home, trimmed.slice(1)) : trimmed;
+}
+function remoteWithoutSecrets(url) {
+  if (!WEB_REMOTE.test(url)) {
+    return url;
+  }
+  try {
+    const parsed = new URL(url);
+    if (parsed.username || parsed.password) {
+      parsed.username = "";
+      parsed.password = "";
+    }
+    return parsed.toString().replace(/\/$/, "");
+  } catch {
+    return url;
+  }
+}
+function repositoryName(remoteUrl, folder) {
+  const parts = remoteUrl && NETWORK_REMOTE.test(remoteUrl) ? remoteUrl.replace(/\/+$/, "").replace(/\.git$/, "").split(/[/:]/).filter(Boolean) : [];
+  return parts.length >= 3 ? `${parts.at(-2)}/${parts.at(-1)}` : basename(folder);
+}
+async function remoteOf(folder) {
+  const remotes = (await gitText(["remote"], folder))?.split("\n").map((line) => line.trim()).filter(Boolean) ?? [];
+  return remotes.includes(FIRST_REMOTE) ? FIRST_REMOTE : remotes[0] ?? null;
+}
+async function hasRef(folder, ref) {
+  return (await runGit(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], { cwd: folder })).code === 0;
+}
+async function baseBranchOf(folder, remote, current) {
+  const remoteHead = remote ? await gitText(["symbolic-ref", "--quiet", "--short", `refs/remotes/${remote}/HEAD`], folder) : null;
+  if (remoteHead?.startsWith(`${remote}/`)) {
+    return remoteHead.slice(remote.length + 1);
+  }
+  for (const name of USUAL_BASES) {
+    if (await hasRef(folder, `refs/heads/${name}`) || remote && await hasRef(folder, `refs/remotes/${remote}/${name}`)) {
+      return name;
+    }
+  }
+  return current;
+}
+function samePath(first, second) {
+  const [a, b] = [realpathSync.native(first), realpathSync.native(second)];
+  return process3.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+function isInside(path, folder) {
+  const between = relative(resolve(folder), resolve(path));
+  return between === "" || !between.startsWith("..") && !isAbsolute(between);
+}
+async function inspectFolder(path, home) {
+  const folder = expandHome(path, home);
+  if (!isAbsolute(folder)) {
+    return problem("Enter the full path of the folder, for example /Users/anna/code/shop or C:\\code\\shop.");
+  }
+  if (!existsSync2(folder) || !statSync(folder).isDirectory()) {
+    return problem(`There is no folder ${folder} on this computer.`);
+  }
+  if (isInside(folder, join2(home, ".tamsense"))) {
+    return problem("This is a TAMsense work folder. Choose your own copy of the repository.");
+  }
+  const top = await gitText(["rev-parse", "--show-toplevel"], folder);
+  if (!top) {
+    return problem(`${folder} is not a git repository. Choose the folder of a cloned repository, or run git init there.`);
+  }
+  if (!samePath(top, folder)) {
+    return problem(`${folder} is inside the repository ${resolve(top)}. Add the top folder of the repository instead.`);
+  }
+  if (!await hasRef(folder, "HEAD")) {
+    return problem("The repository has no commits yet. Make the first commit, then check the folder again.");
+  }
+  const remote = await remoteOf(folder);
+  const remoteUrl = remote ? await gitText(["remote", "get-url", remote], folder) : null;
+  const currentBranch = await gitText(["symbolic-ref", "--quiet", "--short", "HEAD"], folder);
+  const defaultBranch = await baseBranchOf(folder, remote, currentBranch);
+  if (!defaultBranch) {
+    return problem("Could not tell the main branch of the repository. Check out the main branch in this folder, then check it again.");
+  }
+  const safeUrl = remoteUrl && remoteWithoutSecrets(remoteUrl);
+  return { ok: true, repository: repositoryName(safeUrl, folder), currentBranch, defaultBranch, remoteUrl: safeUrl };
+}
+function reportLine(path, report) {
+  return report.ok ? `Checked the folder ${path}: ${report.repository}, main branch ${report.defaultBranch}.` : `The folder ${path} cannot be used: ${report.problem}`;
+}
+async function checkFolders(tools, stop) {
+  let complained = false;
+  while (!stop.aborted) {
+    try {
+      const { checks } = await tools.api.request("POST", FOLDER_CHECKS_PATH);
+      for (const check of checks) {
+        const report = await tools.inspect(check.path).catch((error) => problem(error instanceof Error ? error.message : String(error)));
+        await tools.api.request("POST", folderCheckPath(check.id), report);
+        tools.print(reportLine(check.path, report));
+      }
+      complained = false;
+    } catch (error) {
+      if (error instanceof ApiError && error.status === 404) {
+        return;
+      }
+      if (!complained && !stop.aborted) {
+        tools.print(`Could not check the folders for TAMsense: ${error instanceof Error ? error.message : String(error)}`);
+        complained = true;
+      }
+    }
+    await tools.sleep(CHECKS_INTERVAL_MS, stop);
+  }
+}
+
+// src/lock.ts
+function keyedLock() {
+  const tails = /* @__PURE__ */ new Map();
+  return {
+    async run(key, work2) {
+      const previous = tails.get(key) ?? Promise.resolve();
+      let release = () => {
+      };
+      const done2 = new Promise((resolve5) => {
+        release = resolve5;
+      });
+      const tail = previous.then(() => done2);
+      tails.set(key, tail);
+      await previous;
+      try {
+        return await work2();
+      } finally {
+        release();
+        if (tails.get(key) === tail) {
+          tails.delete(key);
+        }
+      }
+    }
+  };
+}
+
+// src/workspace.ts
+import { existsSync as existsSync3 } from "fs";
+import { rm as rm2 } from "fs/promises";
+import { join as join3, resolve as resolve2 } from "path";
+var FALLBACK_IDENTITY = { name: "TAMsense", email: "noreply@tamsense.com" };
+var cacheLock = keyedLock();
+function githubRemoteUrl(fullName) {
+  return `https://github.com/${fullName}.git`;
+}
+function tamsenseFolder(home, ...parts) {
+  return join3(home, ".tamsense", ...parts);
+}
+function folderNames(repositories) {
+  const shortName = (fullName) => fullName.split("/").pop() ?? fullName;
+  const counts = /* @__PURE__ */ new Map();
+  for (const repository of repositories) {
+    counts.set(shortName(repository.fullName), (counts.get(shortName(repository.fullName)) ?? 0) + 1);
+  }
+  return repositories.map((repository) => counts.get(shortName(repository.fullName)) === 1 ? shortName(repository.fullName) : repository.fullName.replace("/", "__"));
+}
+async function refreshCache(cache, repository, token, tools) {
+  if (existsSync3(join3(cache, ".git"))) {
+    await git(["fetch", "--prune", "origin"], { cwd: cache, token });
+    return;
+  }
+  await git(["clone", "--no-checkout", tools.remoteUrl(repository.fullName), cache], { cwd: tools.home, token });
+}
+async function removeWorktree(cache, path) {
+  await runGit(["worktree", "remove", "--force", path], { cwd: cache });
+  await rm2(path, { recursive: true, force: true });
+  await git(["worktree", "prune"], { cwd: cache });
+}
+function stepFolder(job) {
+  const task = `task-${job.taskId}`;
+  return typeof job.stage.columnId === "number" ? [task, `step-${job.stage.columnId}`] : [task];
+}
+function isReadOnlyCheck(job) {
+  return job.stage.kind === "review" || job.stage.kind === "test";
+}
+function branchHolders(porcelain, branch) {
+  const holders = [];
+  let path = null;
+  for (const line of porcelain.split("\n").map((text2) => text2.trim())) {
+    if (line.startsWith("worktree ")) {
+      path = line.slice("worktree ".length);
+    } else if (path && line === `branch refs/heads/${branch}`) {
+      holders.push(path);
+    }
+  }
+  return holders;
+}
+async function releaseBranch(cache, branch, keep) {
+  const listed = await runGit(["worktree", "list", "--porcelain"], { cwd: cache });
+  for (const path of branchHolders(listed.stdout, branch).filter((holder) => resolve2(holder) !== resolve2(keep))) {
+    await removeWorktree(cache, path);
+  }
+}
+async function baseRef(cache, job, repository) {
+  const pushed = await runGit(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${job.branch}`], { cwd: cache });
+  return pushed.code === 0 ? `origin/${job.branch}` : `origin/${repository.defaultBranch}`;
+}
+async function keptBase(cache, path, job, repository) {
+  if (!job.keepWorkspace || !existsSync3(join3(path, ".git"))) {
+    return null;
+  }
+  const branch = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: path });
+  if (branch.code !== 0 || branch.stdout !== (isReadOnlyCheck(job) ? "HEAD" : job.branch)) {
+    return null;
+  }
+  return git(["rev-parse", await baseRef(cache, job, repository)], { cwd: cache });
+}
+function taskFolder(home, job) {
+  return tamsenseFolder(home, "work", ...stepFolder(job));
+}
+async function prepareWorkspace(job, token, tools) {
+  const root = taskFolder(tools.home, job);
+  const folders = folderNames(job.repositories);
+  const repositories = [];
+  for (const [index, repository] of job.repositories.entries()) {
+    const cache = tamsenseFolder(tools.home, "repos", repository.fullName.replace("/", "__"));
+    const folder = folders[index] ?? repository.fullName;
+    const path = join3(root, folder);
+    const baseSha = await cacheLock.run(repository.fullName, async () => {
+      await refreshCache(cache, repository, token, tools);
+      const kept = await keptBase(cache, path, job, repository);
+      if (kept) {
+        return kept;
+      }
+      await removeWorktree(cache, path);
+      const base = await baseRef(cache, job, repository);
+      if (isReadOnlyCheck(job)) {
+        await git(["worktree", "add", "--force", "--detach", path, base], { cwd: cache });
+      } else {
+        await releaseBranch(cache, job.branch, path);
+        await git(["worktree", "add", "--force", "-B", job.branch, path, base], { cwd: cache });
+      }
+      return git(["rev-parse", "HEAD"], { cwd: path });
+    });
+    repositories.push({ fullName: repository.fullName, folder, path, baseSha });
+  }
+  return { root, repositories };
+}
+async function commitIdentityEnv(home) {
+  const configured = await runGit(["config", "--get", "user.email"], { cwd: home });
+  if (configured.code === 0 && configured.stdout) {
+    return {};
+  }
+  return {
+    GIT_AUTHOR_NAME: FALLBACK_IDENTITY.name,
+    GIT_AUTHOR_EMAIL: FALLBACK_IDENTITY.email,
+    GIT_COMMITTER_NAME: FALLBACK_IDENTITY.name,
+    GIT_COMMITTER_EMAIL: FALLBACK_IDENTITY.email
+  };
+}
+async function publishWorkspace(workspace, job, token, identity) {
+  const pushed = [];
+  for (const repository of workspace.repositories) {
+    const options = { cwd: repository.path, env: identity };
+    const sha = await cacheLock.run(repository.fullName, async () => {
+      await git(["add", "--all"], options);
+      const hasStaged = (await runGit(["diff", "--cached", "--quiet"], options)).code === 1;
+      if (hasStaged) {
+        await git(["commit", "--message", `Task #${job.taskId}: ${job.title}`], options);
+      }
+      const newCommits = Number(await git(["rev-list", "--count", `${repository.baseSha}..HEAD`], options));
+      if (newCommits === 0) {
+        return null;
+      }
+      await git(["push", "origin", `HEAD:refs/heads/${job.branch}`], { ...options, token });
+      return git(["rev-parse", "HEAD"], options);
+    });
+    if (sha) {
+      pushed.push({ repository: repository.fullName, branch: job.branch, sha });
+    }
+  }
+  return pushed;
+}
+
+// src/localWorkspace.ts
+var NETWORK_TIMEOUT_MS = 12e4;
+var sourceLock = keyedLock();
+function isLocalJob(job) {
+  return job.workspace === "local";
+}
+function localBranchLine(branch) {
+  const local = branch.local;
+  if (!local) {
+    return `Pushed ${branch.branch} in ${branch.repository}.`;
+  }
+  const where = `Branch ${branch.branch} has ${local.commits} commit(s) in ${local.folder}`;
+  if (local.pushProblem) {
+    return `${where}. It was not pushed: ${local.pushProblem}`;
+  }
+  return local.remoteUrl ? `${where}, pushed to ${local.remoteUrl}.` : `${where}.`;
+}
+function readsOnly(job) {
+  return isReadOnlyCheck(job) || job.stage.kind === "interview" || job.stage.kind === "spec";
+}
+async function isAncestor(folder, older, newer) {
+  return (await runGit(["merge-base", "--is-ancestor", older, newer], { cwd: folder })).code === 0;
+}
+async function fetchRemote(source, remote, print2) {
+  const fetched = await runGit(["fetch", "--prune", remote], { cwd: source, env: personalGitEnv(), timeoutMs: NETWORK_TIMEOUT_MS });
+  if (fetched.code !== 0) {
+    print2(`Could not fetch from ${remote} in ${source}, going on with what the folder has: ${fetched.stderr || `exit code ${fetched.code}`}`);
+  }
+}
+async function baseBranchRef(source, branch, remote) {
+  const own = await hasRef(source, `refs/heads/${branch}`) ? branch : null;
+  const fetched = remote && await hasRef(source, `refs/remotes/${remote}/${branch}`) ? `${remote}/${branch}` : null;
+  if (own && fetched) {
+    return await isAncestor(source, own, fetched) ? fetched : own;
+  }
+  const found = own ?? fetched;
+  if (!found) {
+    throw new Error(`The main branch ${branch} is not in ${source}. Check the folder again in the board settings, on the Code tab.`);
+  }
+  return found;
+}
+async function taskBranchRef(source, branch, remote, base) {
+  if (await hasRef(source, `refs/heads/${branch}`) && Number(await git(["rev-list", "--count", `${base}..${branch}`], { cwd: source })) > 0) {
+    return branch;
+  }
+  return remote && await hasRef(source, `refs/remotes/${remote}/${branch}`) ? `${remote}/${branch}` : null;
+}
+async function startRef(source, job, local) {
+  const base = await baseBranchRef(source, local.baseBranch, local.remote);
+  const task = await taskBranchRef(source, job.branch, local.remote, base);
+  if (task || !isReadOnlyCheck(job)) {
+    return task ?? base;
+  }
+  const where = local.remote ? `${source} or on its remote ${local.remote}` : source;
+  throw new Error(`Branch ${job.branch} is not in ${where}. It was made on another computer: push it to a remote this folder can fetch, or run this check on that computer.`);
+}
+async function releaseBranch2(source, branch, keep, home) {
+  const listed = await runGit(["worktree", "list", "--porcelain"], { cwd: source });
+  const work2 = tamsenseFolder(home, "work");
+  for (const holder of branchHolders(listed.stdout, branch).filter((path) => resolve3(path) !== resolve3(keep))) {
+    if (!isInside(holder, work2)) {
+      throw new Error(`Branch ${branch} is checked out in ${resolve3(holder)}. Switch that folder to another branch, then start the step again.`);
+    }
+    await removeWorktree(source, holder);
+  }
+}
+async function keptBase2(path, job) {
+  if (!job.keepWorkspace || !existsSync4(join4(path, ".git"))) {
+    return null;
+  }
+  const branch = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: path });
+  if (branch.code !== 0 || branch.stdout !== (readsOnly(job) ? "HEAD" : job.branch)) {
+    return null;
+  }
+  return git(["rev-parse", "HEAD"], { cwd: path });
+}
+function sourceOf(repository) {
+  if (!repository.folder) {
+    throw new Error(`TAMsense did not say which folder holds ${repository.fullName} on this computer.`);
+  }
+  return repository.folder;
+}
+async function prepareRepository(job, repository, path, tools) {
+  const source = sourceOf(repository);
+  if ((await runGit(["rev-parse", "--show-toplevel"], { cwd: source }).catch(() => null))?.code !== 0) {
+    throw new Error(`${source} is no longer a git repository on this computer. Check the folder again in the board settings, on the Code tab.`);
+  }
+  const local = { source, remote: await remoteOf(source), baseBranch: repository.defaultBranch };
+  if (local.remote) {
+    await fetchRemote(source, local.remote, tools.print);
+  }
+  const kept = await keptBase2(path, job);
+  if (kept) {
+    return { baseSha: kept, local };
+  }
+  await runGit(["worktree", "prune"], { cwd: source });
+  if (existsSync4(path)) {
+    await removeWorktree(source, path);
+  }
+  const start = await startRef(source, job, local);
+  if (readsOnly(job)) {
+    await git(["worktree", "add", "--detach", path, start], { cwd: source });
+  } else {
+    await releaseBranch2(source, job.branch, path, tools.home);
+    await git(["worktree", "add", "-B", job.branch, path, start], { cwd: source });
+  }
+  return { baseSha: await git(["rev-parse", "HEAD"], { cwd: path }), local };
+}
+async function prepareLocalWorkspace(job, tools) {
+  const root = taskFolder(tools.home, job);
+  const folders = folderNames(job.repositories);
+  const repositories = [];
+  for (const [index, repository] of job.repositories.entries()) {
+    const folder = folders[index] ?? repository.fullName;
+    const path = join4(root, folder);
+    const prepared = await sourceLock.run(resolve3(sourceOf(repository)), () => prepareRepository(job, repository, path, tools));
+    repositories.push({ fullName: repository.fullName, folder, path, baseSha: prepared.baseSha, local: prepared.local });
+  }
+  return { root, repositories };
+}
+async function pushBranch(path, local, branch) {
+  if (!local.remote) {
+    return { remoteUrl: null, pushProblem: null };
+  }
+  if (branch === local.baseBranch) {
+    return { remoteUrl: null, pushProblem: `TAMsense never pushes the main branch ${branch}.` };
+  }
+  const pushed = await runGit(["push", local.remote, `HEAD:refs/heads/${branch}`], { cwd: path, env: personalGitEnv(), timeoutMs: NETWORK_TIMEOUT_MS });
+  if (pushed.code !== 0) {
+    return { remoteUrl: null, pushProblem: pushed.stderr || `exit code ${pushed.code}` };
+  }
+  return { remoteUrl: await git(["remote", "get-url", local.remote], { cwd: path }), pushProblem: null };
+}
+async function commitAndPush(repository, local, job, identity) {
+  const options = { cwd: repository.path, env: identity };
+  await git(["add", "--all"], options);
+  if ((await runGit(["diff", "--cached", "--quiet"], options)).code === 1) {
+    await git(["commit", "--message", `Task #${job.taskId}: ${job.title}`], options);
+  }
+  if (Number(await git(["rev-list", "--count", `${repository.baseSha}..HEAD`], options)) === 0) {
+    return null;
+  }
+  const base = await baseBranchRef(repository.path, local.baseBranch, local.remote);
+  const commits = Number(await git(["rev-list", "--count", `${base}..HEAD`], options));
+  const sent2 = await pushBranch(repository.path, local, job.branch);
+  return { sha: await git(["rev-parse", "HEAD"], options), commits, ...sent2 };
+}
+async function publishLocalWorkspace(workspace, job, identity) {
+  const pushed = [];
+  for (const repository of workspace.repositories) {
+    const local = repository.local;
+    if (!local) {
+      continue;
+    }
+    const branch = await sourceLock.run(resolve3(local.source), async () => {
+      const published = await commitAndPush(repository, local, job, identity);
+      await runGit(["checkout", "--quiet", "--detach"], { cwd: repository.path });
+      return published;
+    });
+    if (branch) {
+      pushed.push({
+        repository: repository.fullName,
+        branch: job.branch,
+        sha: branch.sha,
+        local: { folder: local.source, baseBranch: local.baseBranch, commits: branch.commits, remoteUrl: branch.remoteUrl && remoteWithoutSecrets(branch.remoteUrl), pushProblem: branch.pushProblem }
+      });
+    }
+  }
+  return pushed;
+}
+
 // src/results.ts
-import { mkdir as mkdir2, readFile as readFile2, rm as rm2, stat, writeFile as writeFile2 } from "fs/promises";
-import { basename, extname, isAbsolute, join as join2, resolve } from "path";
+import { mkdir as mkdir2, readFile as readFile2, rm as rm3, stat, writeFile as writeFile2 } from "fs/promises";
+import { basename as basename2, extname, isAbsolute as isAbsolute2, join as join5, resolve as resolve4 } from "path";
 import { tool as tool2 } from "@anthropic-ai/claude-agent-sdk";
 import { z as z2 } from "zod";
 var SAVE_DOCUMENT_TOOL_NAME = "save_result_document";
@@ -1151,7 +1661,7 @@ function linksText(links) {
 }
 async function writeResults(folder, job, api) {
   const results = job.results ?? [];
-  await rm2(folder, { recursive: true, force: true });
+  await rm3(folder, { recursive: true, force: true });
   if (results.length === 0) {
     return [];
   }
@@ -1164,24 +1674,24 @@ async function writeResults(folder, job, api) {
     if (result.kind === "file") {
       try {
         const file = await api.request("GET", resultFilePath(job.runId, result.id));
-        await writeFile2(join2(folder, name), Buffer.from(file.data, "base64"));
+        await writeFile2(join5(folder, name), Buffer.from(file.data, "base64"));
       } catch (error) {
         missing.push(`${result.title}: ${error instanceof Error ? error.message : String(error)}`);
         continue;
       }
     } else {
-      await writeFile2(join2(folder, name), result.content ?? "");
+      await writeFile2(join5(folder, name), result.content ?? "");
     }
     lines.push(`${RESULTS_FOLDER}/${name}: ${result.title}${result.version ? `, version ${result.version}` : ""}`);
   }
   const links = results.filter((item) => item.kind === "link");
   if (links.length > 0) {
-    await writeFile2(join2(folder, "links.md"), `${linksText(links)}
+    await writeFile2(join5(folder, "links.md"), `${linksText(links)}
 `);
     lines.push(`${RESULTS_FOLDER}/links.md: ${links.length} link(s)`);
   }
   if (missing.length > 0) {
-    await writeFile2(join2(folder, "notes.md"), `These files could not be downloaded:
+    await writeFile2(join5(folder, "notes.md"), `These files could not be downloaded:
 ${missing.map((line) => `- ${line}`).join("\n")}
 `);
   }
@@ -1189,13 +1699,13 @@ ${missing.map((line) => `- ${line}`).join("\n")}
 }
 async function prepareFolder(job, root, api) {
   if (!job.keepWorkspace) {
-    await rm2(root, { recursive: true, force: true });
+    await rm3(root, { recursive: true, force: true });
   }
   await mkdir2(root, { recursive: true });
-  return { root, repositories: [], results: await writeResults(join2(root, RESULTS_FOLDER), job, api) };
+  return { root, repositories: [], results: await writeResults(join5(root, RESULTS_FOLDER), job, api) };
 }
 async function readResultFile(root, path, title) {
-  const full = isAbsolute(path) ? path : resolve(root, path);
+  const full = isAbsolute2(path) ? path : resolve4(root, path);
   const info = await stat(full).catch(() => null);
   if (!info?.isFile()) {
     return `There is no file at ${full}.`;
@@ -1203,7 +1713,7 @@ async function readResultFile(root, path, title) {
   if (info.size > MAX_RESULT_FILE_BYTES) {
     return `The file is larger than ${MAX_RESULT_FILE_BYTES / 1024 / 1024} MB. Attach a smaller one or split it.`;
   }
-  const name = basename(full);
+  const name = basename2(full);
   return { name, title: title.trim() || name, contentType: TYPES_BY_EXTENSION[extname(full).toLowerCase()] ?? "application/octet-stream", data: (await readFile2(full)).toString("base64") };
 }
 function reply(text2, isError = false) {
@@ -1376,209 +1886,6 @@ function specPromptText(spec) {
   ].filter(Boolean).join("\n\n");
 }
 
-// src/workspace.ts
-import { existsSync as existsSync2 } from "fs";
-import { rm as rm3 } from "fs/promises";
-import { join as join3, resolve as resolve2 } from "path";
-
-// src/git.ts
-import { Buffer as Buffer2 } from "buffer";
-import { spawn as spawn2 } from "child_process";
-var GITHUB_ORIGIN = "https://github.com/";
-function githubAuthEnv(token) {
-  const credentials = Buffer2.from(`x-access-token:${token}`).toString("base64");
-  return {
-    GIT_CONFIG_COUNT: "1",
-    GIT_CONFIG_KEY_0: `http.${GITHUB_ORIGIN}.extraheader`,
-    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${credentials}`,
-    GIT_TERMINAL_PROMPT: "0"
-  };
-}
-function runGit(args, options) {
-  const env = { ...process.env, ...options.env, ...options.token ? githubAuthEnv(options.token) : {} };
-  return new Promise((resolve3, reject) => {
-    const child = spawn2("git", args, { cwd: options.cwd, env, stdio: ["ignore", "pipe", "pipe"] });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    child.on("error", reject);
-    child.on("close", (code) => resolve3({ code: code ?? 1, stdout: stdout.trim(), stderr: stderr.trim() }));
-  });
-}
-async function git(args, options) {
-  const result = await runGit(args, options);
-  if (result.code !== 0) {
-    throw new Error(`git ${args[0]} failed: ${result.stderr || result.stdout || `exit code ${result.code}`}`);
-  }
-  return result.stdout;
-}
-
-// src/lock.ts
-function keyedLock() {
-  const tails = /* @__PURE__ */ new Map();
-  return {
-    async run(key, work2) {
-      const previous = tails.get(key) ?? Promise.resolve();
-      let release = () => {
-      };
-      const done2 = new Promise((resolve3) => {
-        release = resolve3;
-      });
-      const tail = previous.then(() => done2);
-      tails.set(key, tail);
-      await previous;
-      try {
-        return await work2();
-      } finally {
-        release();
-        if (tails.get(key) === tail) {
-          tails.delete(key);
-        }
-      }
-    }
-  };
-}
-
-// src/workspace.ts
-var FALLBACK_IDENTITY = { name: "TAMsense", email: "noreply@tamsense.com" };
-var cacheLock = keyedLock();
-function githubRemoteUrl(fullName) {
-  return `https://github.com/${fullName}.git`;
-}
-function tamsenseFolder(home, ...parts) {
-  return join3(home, ".tamsense", ...parts);
-}
-function folderNames(repositories) {
-  const shortName = (fullName) => fullName.split("/").pop() ?? fullName;
-  const counts = /* @__PURE__ */ new Map();
-  for (const repository of repositories) {
-    counts.set(shortName(repository.fullName), (counts.get(shortName(repository.fullName)) ?? 0) + 1);
-  }
-  return repositories.map((repository) => counts.get(shortName(repository.fullName)) === 1 ? shortName(repository.fullName) : repository.fullName.replace("/", "__"));
-}
-async function refreshCache(cache, repository, token, tools) {
-  if (existsSync2(join3(cache, ".git"))) {
-    await git(["fetch", "--prune", "origin"], { cwd: cache, token });
-    return;
-  }
-  await git(["clone", "--no-checkout", tools.remoteUrl(repository.fullName), cache], { cwd: tools.home, token });
-}
-async function removeWorktree(cache, path) {
-  await runGit(["worktree", "remove", "--force", path], { cwd: cache });
-  await rm3(path, { recursive: true, force: true });
-  await git(["worktree", "prune"], { cwd: cache });
-}
-function stepFolder(job) {
-  const task = `task-${job.taskId}`;
-  return typeof job.stage.columnId === "number" ? [task, `step-${job.stage.columnId}`] : [task];
-}
-function isReadOnlyCheck(job) {
-  return job.stage.kind === "review" || job.stage.kind === "test";
-}
-function branchHolders(porcelain, branch) {
-  const holders = [];
-  let path = null;
-  for (const line of porcelain.split("\n").map((text2) => text2.trim())) {
-    if (line.startsWith("worktree ")) {
-      path = line.slice("worktree ".length);
-    } else if (path && line === `branch refs/heads/${branch}`) {
-      holders.push(path);
-    }
-  }
-  return holders;
-}
-async function releaseBranch(cache, branch, keep) {
-  const listed = await runGit(["worktree", "list", "--porcelain"], { cwd: cache });
-  for (const path of branchHolders(listed.stdout, branch).filter((holder) => resolve2(holder) !== resolve2(keep))) {
-    await removeWorktree(cache, path);
-  }
-}
-async function baseRef(cache, job, repository) {
-  const pushed = await runGit(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${job.branch}`], { cwd: cache });
-  return pushed.code === 0 ? `origin/${job.branch}` : `origin/${repository.defaultBranch}`;
-}
-async function keptBase(cache, path, job, repository) {
-  if (!job.keepWorkspace || !existsSync2(join3(path, ".git"))) {
-    return null;
-  }
-  const branch = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: path });
-  if (branch.code !== 0 || branch.stdout !== (isReadOnlyCheck(job) ? "HEAD" : job.branch)) {
-    return null;
-  }
-  return git(["rev-parse", await baseRef(cache, job, repository)], { cwd: cache });
-}
-function taskFolder(home, job) {
-  return tamsenseFolder(home, "work", ...stepFolder(job));
-}
-async function prepareWorkspace(job, token, tools) {
-  const root = taskFolder(tools.home, job);
-  const folders = folderNames(job.repositories);
-  const repositories = [];
-  for (const [index, repository] of job.repositories.entries()) {
-    const cache = tamsenseFolder(tools.home, "repos", repository.fullName.replace("/", "__"));
-    const folder = folders[index] ?? repository.fullName;
-    const path = join3(root, folder);
-    const baseSha = await cacheLock.run(repository.fullName, async () => {
-      await refreshCache(cache, repository, token, tools);
-      const kept = await keptBase(cache, path, job, repository);
-      if (kept) {
-        return kept;
-      }
-      await removeWorktree(cache, path);
-      const base = await baseRef(cache, job, repository);
-      if (isReadOnlyCheck(job)) {
-        await git(["worktree", "add", "--force", "--detach", path, base], { cwd: cache });
-      } else {
-        await releaseBranch(cache, job.branch, path);
-        await git(["worktree", "add", "--force", "-B", job.branch, path, base], { cwd: cache });
-      }
-      return git(["rev-parse", "HEAD"], { cwd: path });
-    });
-    repositories.push({ fullName: repository.fullName, folder, path, baseSha });
-  }
-  return { root, repositories };
-}
-async function commitIdentityEnv(home) {
-  const configured = await runGit(["config", "--get", "user.email"], { cwd: home });
-  if (configured.code === 0 && configured.stdout) {
-    return {};
-  }
-  return {
-    GIT_AUTHOR_NAME: FALLBACK_IDENTITY.name,
-    GIT_AUTHOR_EMAIL: FALLBACK_IDENTITY.email,
-    GIT_COMMITTER_NAME: FALLBACK_IDENTITY.name,
-    GIT_COMMITTER_EMAIL: FALLBACK_IDENTITY.email
-  };
-}
-async function publishWorkspace(workspace, job, token, identity) {
-  const pushed = [];
-  for (const repository of workspace.repositories) {
-    const options = { cwd: repository.path, env: identity };
-    const sha = await cacheLock.run(repository.fullName, async () => {
-      await git(["add", "--all"], options);
-      const hasStaged = (await runGit(["diff", "--cached", "--quiet"], options)).code === 1;
-      if (hasStaged) {
-        await git(["commit", "--message", `Task #${job.taskId}: ${job.title}`], options);
-      }
-      const newCommits = Number(await git(["rev-list", "--count", `${repository.baseSha}..HEAD`], options));
-      if (newCommits === 0) {
-        return null;
-      }
-      await git(["push", "origin", `HEAD:refs/heads/${job.branch}`], { ...options, token });
-      return git(["rev-parse", "HEAD"], options);
-    });
-    if (sha) {
-      pushed.push({ repository: repository.fullName, branch: job.branch, sha });
-    }
-  }
-  return pushed;
-}
-
 // src/prompt.ts
 var VERDICT_TOOL_NAME = "submit_verdict";
 var SCREENSHOT_TOOL_NAME = "attach_screenshot";
@@ -1599,6 +1906,8 @@ var CODE_RULES = [
   "Check your work with the project's own tools: run the tests, type checks and linters that exist, and fix what you broke.",
   "Commit your work in every repository you changed, on the current branch. Do not push, do not switch or create branches, and do not rewrite history: TAMsense pushes the branch and opens the pull request."
 ];
+var LOCAL_COMMIT_RULE = "Commit your work in every repository you changed, on the current branch. Do not push, do not switch or create branches, and do not rewrite history: TAMsense pushes the branch when the folder has a remote, and the person merges it.";
+var LOCAL_FOLDERS_RULE = "Each repository here is a git worktree of the person's own folder on this computer. Work only here: never open, change or check out branches in the person's original folder.";
 var REWORK_RULE = "This is a rework. The branch already has the earlier work and maybe the reviewer's own commits: treat the current branch as the source of truth, keep the reviewer's changes unless a comment asks otherwise, and address every comment.";
 var CODE_REPORT_RULE = "End with a short report for the reviewer: what you changed, how you checked it, and anything left open.";
 var READ_ONLY_CODE_RULES = [
@@ -1708,13 +2017,17 @@ function bulletList(lines) {
   return lines.map((line) => `- ${line}`).join("\n");
 }
 function repositoryLines(job, workspace) {
-  const sourceOf = new Map(job.repositories.map((repository) => [repository.fullName, repository]));
+  const sourceOf2 = new Map(job.repositories.map((repository) => [repository.fullName, repository]));
   return workspace.repositories.map((repository) => {
-    const source = sourceOf.get(repository.fullName);
+    const source = sourceOf2.get(repository.fullName);
     const pull = source?.pullRequestUrl ? `, pull request ${source.pullRequestUrl}` : "";
-    return `${repository.folder} (${repository.fullName}) at commit ${repository.baseSha.slice(0, 7)}, base branch origin/${source?.defaultBranch ?? "main"}${pull}`;
+    const base = repository.local ? repository.local.baseBranch : `origin/${source?.defaultBranch ?? "main"}`;
+    return `${repository.folder} (${repository.fullName}) at commit ${repository.baseSha.slice(0, 7)}, base branch ${base}${pull}`;
   });
 }
+function codeRules(job) {
+  return isLocalJob(job) ? [...CODE_RULES.slice(0, -1), LOCAL_COMMIT_RULE] : CODE_RULES;
+}
 function stepLine(stage) {
   return `This step of the board is "${stage.name}"${stage.helper ? `, and you work as the ${stage.helper}` : ""}.`;
 }
@@ -1873,6 +2186,7 @@ ${JSON.stringify(job.spec)}` : null,
     contextText(job.projectContext),
     `The repositories for this task are checked out in the current folder, one subfolder each:
 ${bulletList(repositoryLines(job, workspace))}`,
+    isLocalJob(job) && LOCAL_FOLDERS_RULE,
     READ_ONLY_RULE,
     `How to work:
 ${bulletList(work2.round === null ? SPEC_RULES : questionRules(work2))}`,
@@ -1948,7 +2262,7 @@ ${job.review}`,
   ].filter(Boolean).join("\n\n");
   const evidence = [SCREENSHOT_RULE, ...options.recorder ? [RECORDING_RULE] : [], NAMING_RULE];
   const localApp = localAppRule(job, isCheck, canAsk);
-  const rules = isCheck ? [...CHECK_RULES, DEPENDENCIES_RULE, localApp, ...evidence] : readOnly ? [...READ_ONLY_CODE_RULES, DEPENDENCIES_RULE, localApp, ...evidence, READ_ONLY_REPORT_RULE] : [...CODE_RULES, ...job.review ? [REWORK_RULE] : [], DEPENDENCIES_RULE, localApp, ...evidence, CODE_REPORT_RULE];
+  const rules = isCheck ? [...CHECK_RULES, DEPENDENCIES_RULE, localApp, ...evidence] : readOnly ? [...READ_ONLY_CODE_RULES, DEPENDENCIES_RULE, localApp, ...evidence, READ_ONLY_REPORT_RULE] : [...codeRules(job), ...job.review ? [REWORK_RULE] : [], DEPENDENCIES_RULE, localApp, ...evidence, CODE_REPORT_RULE];
   const instructions = [
     canAsk ? ASKING_RULE : UNATTENDED_RULE,
     MACHINE_RULE,
@@ -1958,6 +2272,7 @@ ${job.review}`,
     contextText(job.projectContext),
     `The repositories for this task are checked out in the current folder, one subfolder each, ${isCheck ? "at the latest commit of branch" : "on branch"} ${job.branch}:
 ${bulletList(repositoryLines(job, workspace))}`,
+    isLocalJob(job) && LOCAL_FOLDERS_RULE,
     `How to work:
 ${bulletList(rules)}`,
     safetyText(job),
@@ -2526,11 +2841,11 @@ var runClaude = claudeRunner(query2);
 // src/config.ts
 import { mkdir as mkdir3, readFile as readFile3, rm as rm4, writeFile as writeFile3 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join6 } from "path";
 var OWNER_ONLY_FILE = 384;
 var OWNER_ONLY_FOLDER = 448;
 function configPath(home = homedir2()) {
-  return join4(home, ".tamsense", "runner.json");
+  return join6(home, ".tamsense", "runner.json");
 }
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -2594,15 +2909,15 @@ async function login(tools, request) {
 }
 
 // src/recorderEnv.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { join as join8 } from "path";
 import { fileURLToPath } from "url";
 
 // src/recorder.ts
 import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import Module, { createRequire } from "module";
-import { basename as basename2, dirname as dirname3, join as join5 } from "path";
-import process2 from "process";
+import { basename as basename3, dirname as dirname3, join as join7 } from "path";
+import process4 from "process";
 var RECORDINGS_DIR_ENV = "TAMSENSE_RECORDINGS_DIR";
 var SERVER_ENV = "TAMSENSE_SERVER";
 var DEFAULT_TITLE_ENV = "TAMSENSE_RECORDING_TITLE";
@@ -2626,14 +2941,14 @@ function state() {
   return holder[STATE_KEY];
 }
 function recordingsDir() {
-  const dir = process2.env[RECORDINGS_DIR_ENV];
+  const dir = process4.env[RECORDINGS_DIR_ENV];
   if (!dir) {
     throw new Error(`${RECORDINGS_DIR_ENV} is not set: recordings work only inside a TAMsense run`);
   }
   return dir;
 }
 function warn(text2) {
-  process2.stderr.write(`[tamsense recorder] ${text2}
+  process4.stderr.write(`[tamsense recorder] ${text2}
 `);
 }
 function isTrackerIngest(url, tamsenseOrigins) {
@@ -2649,7 +2964,7 @@ function isLocalHost(hostname2) {
 function isExternalWrite(method, url) {
   return !READ_METHODS.includes(method.toUpperCase()) && !isLocalHost(url.hostname);
 }
-function trackerOrigins(env = process2.env) {
+function trackerOrigins(env = process4.env) {
   const origins = new Set(DEFAULT_TRACKER_ORIGINS);
   try {
     if (env[SERVER_ENV]) {
@@ -2673,8 +2988,8 @@ function checkCaption(caption) {
 function clip2(text2, max) {
   return text2.length > max ? `${text2.slice(0, max - 1).trimEnd()}\u2026` : text2;
 }
-function automaticCaption(env = process2.env, script2 = process2.argv[1]) {
-  const from = script2 ? `, opened by ${basename2(script2)}` : "";
+function automaticCaption(env = process4.env, script2 = process4.argv[1]) {
+  const from = script2 ? `, opened by ${basename3(script2)}` : "";
   return {
     title: clip2(env[DEFAULT_TITLE_ENV]?.trim() || "Browser session", MAX_TITLE_LENGTH),
     purpose: clip2(`${env[DEFAULT_PURPOSE_ENV]?.trim() || "Recorded automatically while the agent used a browser"}${from}`, MAX_PURPOSE_LENGTH)
@@ -2682,7 +2997,7 @@ function automaticCaption(env = process2.env, script2 = process2.argv[1]) {
 }
 function rrwebSource() {
   const entry = createRequire(import.meta.url).resolve("rrweb");
-  return readFileSync(join5(dirname3(entry), "rrweb.umd.min.cjs"), "utf8");
+  return readFileSync(join7(dirname3(entry), "rrweb.umd.min.cjs"), "utf8");
 }
 function pageScript(rrweb) {
   return `(() => {
@@ -2733,8 +3048,8 @@ var Session = class {
   bytes = 0;
   constructor(dir, recording, url) {
     const id = `${Date.now().toString(36)}-${Math.random().toString(16).slice(2, 8)}`;
-    this.file = join5(dir, `${id}${REPLAY_SUFFIX}`);
-    this.metaFile = join5(dir, `${id}${META_SUFFIX}`);
+    this.file = join7(dir, `${id}${REPLAY_SUFFIX}`);
+    this.metaFile = join7(dir, `${id}${META_SUFFIX}`);
     this.meta = { version: 1, id, ...recording.caption, startedAt: Date.now(), endedAt: null, url, marks: [], video: null, gaps: [], blockedTrackerRequests: 0, blockedExternalWrites: 0, truncated: false, automatic: recording.automatic };
     writeFileSync(this.file, "");
     this.save();
@@ -2899,7 +3214,7 @@ function installAutoRecording() {
     return exports;
   };
 }
-if (process2.env[RECORDINGS_DIR_ENV]) {
+if (process4.env[RECORDINGS_DIR_ENV]) {
   installAutoRecording();
 }
 
@@ -2907,10 +3222,10 @@ if (process2.env[RECORDINGS_DIR_ENV]) {
 var RECORDER_ENV = "TAMSENSE_RECORDER";
 function bundledRecorder() {
   const path = fileURLToPath(new URL("./recorder.cjs", import.meta.url));
-  return existsSync3(path) ? path : null;
+  return existsSync5(path) ? path : null;
 }
 function recordingsFolder(home, runId) {
-  return join6(home, ".tamsense", "recordings", `run-${runId}`);
+  return join8(home, ".tamsense", "recordings", `run-${runId}`);
 }
 function nodeOptionsWithRecorder(recorder, nodeOptions) {
   return [nodeOptions?.trim(), `--require "${recorder.replaceAll("\\", "/")}"`].filter(Boolean).join(" ");
@@ -2983,7 +3298,7 @@ async function sleep(ms, signal) {
 // src/update.ts
 import { spawn as spawn4 } from "child_process";
 import { readFileSync as readFileSync2 } from "fs";
-import process3 from "process";
+import process5 from "process";
 var PACKAGE_NAME = "@tamsensedev/runner";
 var RELAUNCHED_ENV = "TAMSENSE_RELAUNCHED";
 var NO_UPDATE_ENV = "TAMSENSE_NO_UPDATE";
@@ -3035,19 +3350,19 @@ function relaunchArgs(argv) {
   return ["--yes", `${PACKAGE_NAME}@latest`, ...argv];
 }
 function relaunch(argv, env) {
-  const isWindows = process3.platform === "win32";
-  return new Promise((resolve3, reject) => {
+  const isWindows = process5.platform === "win32";
+  return new Promise((resolve5, reject) => {
     const child = spawn4(isWindows ? "npx.cmd" : "npx", relaunchArgs(argv), { stdio: "inherit", shell: isWindows, env: { ...env, [RELAUNCHED_ENV]: "1" } });
     const ignoreInterrupt = () => {
     };
-    process3.on("SIGINT", ignoreInterrupt);
+    process5.on("SIGINT", ignoreInterrupt);
     child.on("error", (error) => {
-      process3.off("SIGINT", ignoreInterrupt);
+      process5.off("SIGINT", ignoreInterrupt);
       reject(error);
     });
     child.on("close", (code) => {
-      process3.off("SIGINT", ignoreInterrupt);
-      resolve3(code ?? 1);
+      process5.off("SIGINT", ignoreInterrupt);
+      resolve5(code ?? 1);
     });
   });
 }
@@ -3055,7 +3370,7 @@ function relaunch(argv, env) {
 // src/worker.ts
 import { rm as rm6 } from "fs/promises";
 import { dirname as dirname5 } from "path";
-import process4 from "process";
+import process6 from "process";
 
 // src/feedQueue.ts
 var MAX_BATCH = 200;
@@ -3094,9 +3409,9 @@ function feedQueue(send) {
 }
 
 // src/library.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { cp, mkdir as mkdir4, rm as rm5 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var LIBRARY_PATH = fileURLToPath2(new URL("../library", import.meta.url));
 var SKILL_NAME = /^[a-z0-9-]+$/;
@@ -3109,18 +3424,18 @@ function allowedSkills(stage) {
   return skills && [.../* @__PURE__ */ new Set([...skills, ...STAGE_SKILLS[stage.kind] ?? []])].filter((name) => SKILL_NAME.test(name));
 }
 function roleLibraryFolder(home, runId) {
-  return join7(home, ".tamsense", "libraries", `run-${runId}`);
+  return join9(home, ".tamsense", "libraries", `run-${runId}`);
 }
 async function prepareLibrary(folder, skills, source = LIBRARY_PATH) {
   if (skills === null) {
     return source;
   }
   await rm5(folder, { recursive: true, force: true });
-  await mkdir4(join7(folder, "skills"), { recursive: true });
-  await cp(join7(source, ".claude-plugin"), join7(folder, ".claude-plugin"), { recursive: true });
-  await cp(join7(source, "agents"), join7(folder, "agents"), { recursive: true });
-  for (const skill of skills.filter((name) => SKILL_NAME.test(name) && existsSync4(join7(source, "skills", name)))) {
-    await cp(join7(source, "skills", skill), join7(folder, "skills", skill), { recursive: true });
+  await mkdir4(join9(folder, "skills"), { recursive: true });
+  await cp(join9(source, ".claude-plugin"), join9(folder, ".claude-plugin"), { recursive: true });
+  await cp(join9(source, "agents"), join9(folder, "agents"), { recursive: true });
+  for (const skill of skills.filter((name) => SKILL_NAME.test(name) && existsSync6(join9(source, "skills", name)))) {
+    await cp(join9(source, "skills", skill), join9(folder, "skills", skill), { recursive: true });
   }
   return folder;
 }
@@ -3129,7 +3444,7 @@ async function prepareLibrary(folder, skills, source = LIBRARY_PATH) {
 import { randomUUID } from "crypto";
 import { createReadStream } from "fs";
 import { readdir, readFile as readFile4, stat as stat2, writeFile as writeFile4 } from "fs/promises";
-import { basename as basename3, dirname as dirname4, extname as extname2, isAbsolute as isAbsolute2, join as join8 } from "path";
+import { basename as basename4, dirname as dirname4, extname as extname2, isAbsolute as isAbsolute3, join as join10 } from "path";
 import { createInterface as createInterface2 } from "readline";
 import { Readable } from "stream";
 import { promisify } from "util";
@@ -3190,7 +3505,7 @@ function marksFrom(marks, startTs) {
   return marks.map((mark) => ({ at: Math.max(0, mark.ts - startTs), label: mark.label })).sort((a, b) => a.at - b.at);
 }
 function sessionIdOf(file) {
-  return basename3(file).replace(REPLAY_SUFFIX, "");
+  return basename4(file).replace(REPLAY_SUFFIX, "");
 }
 async function readMeta(file) {
   try {
@@ -3201,12 +3516,12 @@ async function readMeta(file) {
 }
 async function metaFor(kind, file) {
   if (kind === "replay") {
-    return readMeta(join8(dirname4(file), `${sessionIdOf(file)}${META_SUFFIX}`));
+    return readMeta(join10(dirname4(file), `${sessionIdOf(file)}${META_SUFFIX}`));
   }
-  const folder = basename3(dirname4(file)) === "video" ? dirname4(dirname4(file)) : dirname4(file);
+  const folder = basename4(dirname4(file)) === "video" ? dirname4(dirname4(file)) : dirname4(file);
   for (const name of await readdir(folder).catch(() => [])) {
     if (name.endsWith(META_SUFFIX) && name !== LEDGER_FILE) {
-      const meta = await readMeta(join8(folder, name));
+      const meta = await readMeta(join10(folder, name));
       if (meta?.video === file) {
         return meta;
       }
@@ -3216,7 +3531,7 @@ async function metaFor(kind, file) {
 }
 async function ledger(dir) {
   try {
-    return new Set(JSON.parse(await readFile4(join8(dir, LEDGER_FILE), "utf8")));
+    return new Set(JSON.parse(await readFile4(join10(dir, LEDGER_FILE), "utf8")));
   } catch {
     return /* @__PURE__ */ new Set();
   }
@@ -3224,7 +3539,7 @@ async function ledger(dir) {
 async function remember(dir, file) {
   const done2 = await ledger(dir);
   done2.add(file);
-  await writeFile4(join8(dir, LEDGER_FILE), JSON.stringify([...done2]));
+  await writeFile4(join10(dir, LEDGER_FILE), JSON.stringify([...done2]));
 }
 async function nonEmpty(file) {
   return file !== null && ((await stat2(file).catch(() => null))?.size ?? 0) > 0;
@@ -3237,8 +3552,8 @@ async function pendingRecordings(dir) {
     if (!name.endsWith(META_SUFFIX) || name === LEDGER_FILE) {
       continue;
     }
-    const meta = await readMeta(join8(dir, name));
-    const replay = join8(dir, `${name.slice(0, -META_SUFFIX.length)}${REPLAY_SUFFIX}`);
+    const meta = await readMeta(join10(dir, name));
+    const replay = join10(dir, `${name.slice(0, -META_SUFFIX.length)}${REPLAY_SUFFIX}`);
     if (!done2.has(replay) && await nonEmpty(replay)) {
       pending.push({ kind: "replay", file: replay, meta });
     }
@@ -3258,7 +3573,7 @@ async function uploadReplay(upload, file, caption) {
   if (!scan.snapshot) {
     throw new Error("This replay has no page snapshot, so it cannot be played. Was the page ever opened?");
   }
-  return finish(upload, { kind: "replay", upload: id, name: basename3(file), ...caption, contentType: "application/x-ndjson", durationMs: null, marks: marksFrom(scan.marks, scan.startTs) });
+  return finish(upload, { kind: "replay", upload: id, name: basename4(file), ...caption, contentType: "application/x-ndjson", durationMs: null, marks: marksFrom(scan.marks, scan.startTs) });
 }
 async function uploadVideo(upload, file, caption, meta) {
   const contentType = VIDEO_TYPES_BY_EXTENSION[extname2(file).toLowerCase()];
@@ -3273,13 +3588,13 @@ async function uploadVideo(upload, file, caption, meta) {
   const endedAt = meta?.endedAt ?? info.mtimeMs;
   const durationMs = Math.max(0, Math.round(endedAt - startedAt));
   const marks = marksFrom(meta?.marks ?? [], startedAt).filter((mark) => mark.at <= durationMs);
-  return finish(upload, { kind: "video", upload: id, name: basename3(file), ...caption, contentType, durationMs, marks });
+  return finish(upload, { kind: "video", upload: id, name: basename4(file), ...caption, contentType, durationMs, marks });
 }
 async function finish(upload, body) {
   return (await upload.api.request("POST", runPath(upload.runId, "recordings"), body)).id;
 }
 async function attachRecording(api, runId, recordingsDir2, request) {
-  if (!isAbsolute2(request.path)) {
+  if (!isAbsolute3(request.path)) {
     return `Give the absolute path of the ${request.kind === "replay" ? "replay (.rrweb.ndjson)" : "video (.webm or .mp4)"} file.`;
   }
   const fitsKind = request.kind === "replay" ? request.path.endsWith(REPLAY_SUFFIX) : extname2(request.path).toLowerCase() in VIDEO_TYPES_BY_EXTENSION;
@@ -3348,7 +3663,7 @@ async function uploadPendingRecordings(api, runId, dir) {
 
 // src/screenshot.ts
 import { readFile as readFile5, stat as stat3 } from "fs/promises";
-import { basename as basename4, extname as extname3, isAbsolute as isAbsolute3 } from "path";
+import { basename as basename5, extname as extname3, isAbsolute as isAbsolute4 } from "path";
 var TYPES_BY_EXTENSION2 = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -3356,7 +3671,7 @@ var TYPES_BY_EXTENSION2 = {
   ".webp": "image/webp"
 };
 async function readScreenshot(request) {
-  if (!isAbsolute3(request.path)) {
+  if (!isAbsolute4(request.path)) {
     return "Give the absolute path of the image file.";
   }
   const contentType = TYPES_BY_EXTENSION2[extname3(request.path).toLowerCase()];
@@ -3377,7 +3692,7 @@ async function readScreenshot(request) {
     return "The image is larger than 5 MB. Take a smaller screenshot (viewport instead of full page, or JPEG).";
   }
   const data = (await readFile5(request.path)).toString("base64");
-  return { name: basename4(request.path), ...caption, contentType, data };
+  return { name: basename5(request.path), ...caption, contentType, data };
 }
 
 // src/worker.ts
@@ -3577,10 +3892,18 @@ async function prepare(job, tools) {
     const { results, ...workspace2 } = await prepareFolder(job, taskFolder(tools.home, job), tools.api);
     return { workspace: workspace2, results, identity: {} };
   }
+  if (isLocalJob(job)) {
+    tools.print("Preparing the code from the folders on this computer\u2026");
+    const workspace2 = await prepareLocalWorkspace(job, tools);
+    return { workspace: workspace2, results: null, identity: await commitIdentityEnv(job.repositories[0]?.folder ?? tools.home) };
+  }
   tools.print("Preparing the code\u2026");
   const workspace = await prepareWorkspace(job, await gitToken(tools.api, job), tools);
   return { workspace, results: null, identity: await commitIdentityEnv(tools.home) };
 }
+async function publish(workspace, job, api, identity) {
+  return isLocalJob(job) ? await publishLocalWorkspace(workspace, job, identity) : await publishWorkspace(workspace, job, await gitToken(api, job), identity);
+}
 async function executeJob(job, tools, signal, input, record) {
   const isCheck = job.stage.kind === "review" || job.stage.kind === "test";
   const { workspace, results, identity } = await prepare(job, tools);
@@ -3594,7 +3917,7 @@ async function executeJob(job, tools, signal, input, record) {
   const attached = { count: 0 };
   const session = sessionReporter(tools.api, job, tools.print);
   const recordings = recordingsFolder(tools.home, job.runId);
-  const baseEnv = withNodeOnPath(process4.env, dirname5(process4.execPath));
+  const baseEnv = withNodeOnPath(process6.env, dirname5(process6.execPath));
   const recording = tools.recorder ? recorderEnv({ recorder: tools.recorder, folder: recordings, server: tools.api.server, job, nodeOptions: baseEnv.NODE_OPTIONS }) : {};
   const outcome = await tools.runAgent({
     cwd: workspace.root,
@@ -3622,7 +3945,7 @@ async function executeJob(job, tools, signal, input, record) {
   signal.throwIfAborted();
   const waitingFor = outcome.waitingFor ?? null;
   const shouldPublish = job.stage.kind === "code" && !isFolderJob(job) && !isReadOnlyCode(job.stage) && outcome.completed && waitingFor === null;
-  const pushed = shouldPublish ? await publishWorkspace(workspace, job, await gitToken(tools.api, job), identity) : [];
+  const pushed = shouldPublish ? await publish(workspace, job, tools.api, identity) : [];
   return {
     outcome: outcome.completed ? "succeeded" : "failed",
     report: outcome.report,
@@ -3642,7 +3965,7 @@ function clockOf(iso) {
   const time = new Date(iso);
   return `${String(time.getHours()).padStart(2, "0")}:${String(time.getMinutes()).padStart(2, "0")}`;
 }
-function resultLine(finish2, folder = false) {
+function resultLine(finish2, workspace = "repositories") {
   if (finish2.pausedUntil) {
     return `Paused: ${USAGE_LIMIT_REPORT}, resumes at ${clockOf(finish2.pausedUntil)}`;
   }
@@ -3664,7 +3987,13 @@ function resultLine(finish2, folder = false) {
   if (finish2.outcome !== "succeeded") {
     return `Failed: ${finish2.report}`;
   }
-  return folder ? "Done. The result is on the task on TAMsense." : `Done. Pushed ${finish2.pushed.length} branch(es), the pull requests open on TAMsense.`;
+  if (workspace === "folder") {
+    return "Done. The result is on the task on TAMsense.";
+  }
+  if (workspace === "local") {
+    return finish2.pushed.length > 0 ? `Done. ${finish2.pushed.map(localBranchLine).join(" ")}` : "Done. Nothing new to commit.";
+  }
+  return `Done. Pushed ${finish2.pushed.length} branch(es), the pull requests open on TAMsense.`;
 }
 async function sendRecordings(job, tools) {
   const folder = recordingsFolder(tools.home, job.runId);
@@ -3727,7 +4056,7 @@ async function runJob(job, tools, stop) {
   await sendRecordings(job, tools).catch((error) => tools.print(`Could not attach the browser recordings: ${messageOf3(error)}`));
   try {
     await tools.api.request("POST", runPath(job.runId, "finish"), finish2);
-    tools.print(resultLine(finish2, isFolderJob(job)));
+    tools.print(resultLine(finish2, job.workspace));
   } catch (error) {
     tools.print(`Could not send the result to TAMsense: ${messageOf3(error)}`);
   }
@@ -3765,6 +4094,7 @@ async function work(tools, stop, parallel = 1) {
   const running = /* @__PURE__ */ new Set();
   const folderLock = keyedLock();
   const reporting = reportCapabilities(tools, stopAll);
+  const checking = tools.inspectFolder ? checkFolders({ ...tools, inspect: tools.inspectFolder }, stopAll) : Promise.resolve();
   const start = (job) => {
     const runTools = jobTools(job, tools, parallel);
     const task = folderLock.run(stepFolder(job).join("/"), () => runJob(job, runTools, stopAll)).catch((error) => runTools.print(`The run stopped: ${messageOf3(error)}`)).finally(() => running.delete(task));
@@ -3795,7 +4125,7 @@ async function work(tools, stop, parallel = 1) {
       }
     }
   } finally {
-    await Promise.allSettled([...running, reporting]);
+    await Promise.allSettled([...running, reporting, checking]);
   }
 }
 
@@ -3806,11 +4136,11 @@ var NO_TASKS_ACCESS_TEXT = "Your account no longer has access to Tasks. Ask the
 var ACCESS_PROBLEMS = { 401: DISCONNECTED_TEXT, 403: NO_TASKS_ACCESS_TEXT };
 var INTERRUPTED_EXIT_CODE = 130;
 function print(line) {
-  process5.stdout.write(`${line}
+  process7.stdout.write(`${line}
 `);
 }
 function serverFor(flag, saved) {
-  return serverOrigin(flag ?? process5.env.TAMSENSE_URL ?? saved?.server ?? DEFAULT_SERVER);
+  return serverOrigin(flag ?? process7.env.TAMSENSE_URL ?? saved?.server ?? DEFAULT_SERVER);
 }
 function accessProblem(error) {
   return error instanceof ApiError ? ACCESS_PROBLEMS[error.status] ?? null : null;
@@ -3836,15 +4166,15 @@ async function runLogin(server, deviceName) {
 }
 function stopOnInterrupt() {
   const stop = new AbortController();
-  process5.once("SIGINT", () => {
+  process7.once("SIGINT", () => {
     print("Stopping\u2026 Press Ctrl+C again to quit at once.");
     stop.abort();
-    process5.once("SIGINT", () => process5.exit(INTERRUPTED_EXIT_CODE));
+    process7.once("SIGINT", () => process7.exit(INTERRUPTED_EXIT_CODE));
   });
   return stop.signal;
 }
 function installTools(home) {
-  return { home, nodePath: process5.execPath, env: process5.env, print, run: runProcess, exists: existsSync5 };
+  return { home, nodePath: process7.execPath, env: process7.env, print, run: runProcess, exists: existsSync7 };
 }
 async function browserForStart(home, install) {
   const installed = await installedBrowser(home);
@@ -3854,13 +4184,13 @@ async function browserForStart(home, install) {
   return ensureBrowser({ print, install: () => installBrowser(installTools(home)) });
 }
 async function startedNewVersion() {
-  const update = await updateToRun(process5.env, currentVersion(), () => latestVersion());
+  const update = await updateToRun(process7.env, currentVersion(), () => latestVersion());
   if (!update) {
     return false;
   }
   print(`TAMsense runner ${update.latest} is out, this is ${update.current}. Starting the new version...`);
   try {
-    process5.exitCode = await relaunch(process5.argv.slice(2), process5.env);
+    process7.exitCode = await relaunch(process7.argv.slice(2), process7.env);
     return true;
   } catch {
     print("Could not start the new version. Going on with this one.");
@@ -3878,14 +4208,14 @@ async function runStart(parallel, installsBrowser) {
   }
   const api = createApi(saved.server, saved.token);
   const identity = await api.request("GET", IDENTITY_PATH);
-  const problem = teamKeyProblem(identity.device.team, process5.env);
-  if (problem) {
-    throw new Error(problem);
+  const problem2 = teamKeyProblem(identity.device.team, process7.env);
+  if (problem2) {
+    throw new Error(problem2);
   }
   print(`${identity.device.name} is connected to ${saved.server} as ${describeDevice(identity)}.`);
   const home = homedir3();
   const browser = await browserForStart(home, installsBrowser);
-  await work({ api, runAgent: runClaude, capabilities: probeCapabilities, print, sleep, home, remoteUrl: githubRemoteUrl, browser, recorder: bundledRecorder() }, stopOnInterrupt(), parallel);
+  await work({ api, runAgent: runClaude, capabilities: probeCapabilities, print, sleep, home, remoteUrl: githubRemoteUrl, browser, recorder: bundledRecorder(), inspectFolder: (path) => inspectFolder(path, home) }, stopOnInterrupt(), parallel);
 }
 async function runBrowser(remove) {
   const home = homedir3();
@@ -3937,10 +4267,10 @@ async function run(command) {
   }
 }
 try {
-  await run(parseCommand(process5.argv.slice(2), process5.env));
+  await run(parseCommand(process7.argv.slice(2), process7.env));
 } catch (error) {
-  process5.stderr.write(`${accessProblem(error) ?? (error instanceof Error ? error.message : String(error))}
+  process7.stderr.write(`${accessProblem(error) ?? (error instanceof Error ? error.message : String(error))}
 `);
-  process5.exitCode = 1;
+  process7.exitCode = 1;
 }
 //# sourceMappingURL=cli.js.map