promigence 0.1.0-beta.4 → 0.1.0-beta.6

package/dist/account.js

@@ -333,7 +333,7 @@ function stateFlag(ctx, states) {
     }
     return wanted;
 }
-const BUILD_STATES = ["queued", "running", "verified", "rejected", "failed"];
+const BUILD_STATES = ["queued", "running", "verified", "built", "rejected", "failed"];
 const RUN_STATES = ["running", "completed", "cap_killed", "aborted"];
 const snapshotBuilds = async (ctx) => {
     const wanted = stateFlag(ctx, BUILD_STATES);

package/dist/bin.js

@@ -13,7 +13,7 @@ import { TEMPLATES_HANDLERS } from "./templates.js";
 import { ACCOUNT_HANDLERS } from "./account.js";
 import { MCP_HANDLERS } from "./mcp.js";
 import { AGENT_HANDLERS } from "./agent.js";
-import { CREDITS_HANDLERS } from "./credits.js";
+import { CREDITS_HANDLERS, canAsk, claimOnRefusal } from "./credits.js";
 import { RUNNERS_HANDLERS } from "./runners.js";
 import { PRICING_HANDLERS } from "./pricing.js";
 import { GITHUB_HANDLERS } from "./github.js";
@@ -321,6 +321,11 @@ async function main(argv) {
             env.promigence_exit = exit;
             exit = e.code === "enoent" ? 127 : cmd.passthroughExit;
         }
+        if (e.code === "credit_unclaimed" && mode === "text" && canAsk()) {
+            const lines = await claimOnRefusal(ctx).catch(() => undefined);
+            if (lines)
+                return void (await emit(mode, env, lines, exit, false));
+        }
         await emit(mode, env, errorTextLines(cmd.name, e, exit, next), exit, !cmd.noGuidePointer);
     }
 }

package/dist/commands.d.ts

@@ -99,5 +99,6 @@ export declare function outputTails(c: PromigenceClient, sandboxes: ReadonlyArra
     }>;
 }>): Promise<Map<string, OutputTail>>;
 export declare function positional(ctx: Ctx, what: string, example: string): string;
+export declare function filesPutTarArgs(out: string, parent: string, base: string, noMetadata?: string[]): string[];
 export declare const HANDLERS: Readonly<Record<string, Handler>>;
 export {};

package/dist/commands.js

@@ -3,11 +3,12 @@ import { createHash, randomBytes } from "node:crypto";
 import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
-import { DEFAULT_API_URL, DEFAULT_SNAPSHOT, ERRORS_DOCS_URL, MAX_OUTPUT_BYTES_DEFAULT, CONTEXT_GIT_RE, PromigenceClient, checkRepoUrl, withoutPin, PromigenceError, SpendCapError, TimeoutError, checkImageRef, contextRelative, credentialsPath, FILE_PUT_CHUNK_BYTES, imageSnapshot, isWaiting, execOutputBytes, packContext, readCredentials, } from "./sdk/index.js";
+import { DEFAULT_API_URL, DEFAULT_SNAPSHOT, ERRORS_DOCS_URL, MAX_OUTPUT_BYTES_DEFAULT, CONTEXT_GIT_RE, PromigenceClient, checkRepoUrl, withoutPin, PromigenceError, SpendCapError, TimeoutError, checkImageRef, contextRelative, credentialsPath, FILE_PUT_CHUNK_BYTES, imageSnapshot, isWaiting, execOutputBytes, listContext, packContext, readCredentials, } from "./sdk/index.js";
 import { fmtMs, recordTiming } from "./timing.js";
 import { capacityLine, queuedClause, queuedLines, statusLine } from "./capacity.js";
-import { DevcontainerError, detectOne, load, planJson, planLines, planSetup, resolveGiven, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
+import { DevcontainerError, detectOne, load, planJson, planLines, planSetup, resolveGiven, snapshotEnv, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
 import { detect, ecosystemOfCommands, imageCreateCommand, readConfig } from "./init.js";
+import { CREDENTIAL_REMEDY, confirmOverride, credentialRefusal, emitUploadList, localTarNoMetadataArgs } from "./uploadguard.js";
 import { emit, errorEnvelope, errorTextLines, exitWith, forkLine, forkSummary, gradeLine, ms, noCommandFix, okEnvelope, parseMaxOutput, recordNotice, sandboxGrade, parseCommandTimeout, parseCount, parseDuration, parseUsd, pickExit, reportSummaryLines, toPromigenceError, totalsLine, usageError, write, writeBytes, } from "./io.js";
 import { buildPrice } from "./pricing.js";
 import { DOCS_URL, WAIT_TIMEOUT_DEFAULT } from "./surface.js";
@@ -366,7 +367,7 @@ const secretsSet = async (ctx) => {
         `${sh `promigence secrets set ${name}`}: stored ${res.bytes} bytes from ${source}`,
         ...(res.hosts?.length
             ? [
-                `  bound to ${res.hosts.join(", ")}: the sandbox never sees its value (the variable holds ${res.placeholder ?? "a stand-in"})`,
+                `  bound to ${res.hosts.join(", ")}: the value stays out of the sandbox unless a run asks for it (the variable holds ${res.placeholder ?? "something else"})`,
                 ...boundUseLines(res),
                 ...(res.raw === "refused" ? ["  its value can never be given to a sandbox"] : []),
             ]
@@ -440,7 +441,7 @@ function isBuilding(b) {
     return b.state === "queued" || b.state === "running";
 }
 function buildExit(b) {
-    if (b.state === "verified")
+    if (b.state === "verified" || b.state === "built")
         return 0;
     if (b.state === "rejected")
         return 6;
@@ -463,7 +464,7 @@ export function verifyTiming(v) {
 function buildLines(b) {
     const note = b.deduped ? " (deduped: an identical build already ran)"
         : b.idempotent_replay === true ? " (reused: the same request already built it)" : "";
-    const unverified = b.state === "verified" && b.verified === false;
+    const unverified = b.state === "built" || (b.state === "verified" && b.verified === false);
     const shown = unverified ? "built (no --verify: not verified)" : b.state;
     const lines = [`build ${b.build_id}: ${shown}${note}`];
     if (b.snapshot_id)
@@ -487,7 +488,7 @@ async function emitBuild(ctx, b, extra = {}, more = []) {
     const exit = buildExit(b);
     const next = b.snapshot_deleted === true
         ? nexts(["promigence snapshot list", "this build's snapshot was deleted; the snapshots you have now"])
-        : b.snapshot_id && (b.state === "verified" || (!isBuilding(b) && b.state !== "rejected" && b.state !== "failed"))
+        : b.snapshot_id && (b.state === "verified" || b.state === "built" || (!isBuilding(b) && b.state !== "rejected" && b.state !== "failed"))
             ? nexts([sh `promigence run --snapshot ${b.snapshot_id} --count 2 --cap 1 -- CMD`, "fork it and run a command in every sandbox"], [sh `promigence snapshot inspect ${b.snapshot_id}`, "the manifest: provenance and verification"])
             : b.state === "running"
                 ? nexts([sh `promigence snapshot status ${b.build_id} --wait`, "keep waiting; the build is untouched"])
@@ -643,7 +644,27 @@ function refuseRepoCredentials(ctx) {
         checkRepoUrl(withoutPin(context), "--context");
     }
 }
-function dockerfileOpts(ctx) {
+async function packedContext(ctx, dir, path) {
+    const listed = listContext(dir, { dockerfile: path });
+    if (bool(ctx, "--list-files")) {
+        return emitUploadList(ctx, {
+            kind: "dockerfile", root: dir, paths: listed.paths, files: listed.files, bytes: listed.bytes,
+            secrets: listed.secrets, notes: listed.notes, ignoreFile: listed.ignoreFile,
+        });
+    }
+    if (listed.notes.length) {
+        await write(process.stderr, ctx.mode === "json"
+            ? jsonLine(process.stderr, { hint: "context", notes: listed.notes })
+            : listed.notes.map((n) => fieldForTerminal(process.stderr, `  note: ${n}`)).join("\n") + "\n");
+    }
+    if (listed.secrets.length && !bool(ctx, "--allow-secrets"))
+        throw credentialRefusal(listed.secrets, CREDENTIAL_REMEDY.dockerfile);
+    const secretsAllowed = await confirmOverride(ctx, {
+        flag: "--allow-secrets", what: "files that look like credentials", items: listed.secrets,
+    });
+    return { context: packContext(dir, { dockerfile: path, allowSecrets: true }), secretsAllowed };
+}
+async function dockerfileOpts(ctx) {
     const df = required(ctx, "--dockerfile", "Pass --dockerfile ./Dockerfile.");
     const context = str(ctx, "--context");
     if (context !== undefined && CONTEXT_GIT_RE.test(context.trim())) {
@@ -667,11 +688,17 @@ function dockerfileOpts(ctx) {
     if (!existsSync(df)) {
         throw usageError(`no Dockerfile at ${JSON.stringify(df)}`, "Pass --dockerfile with the path to your Dockerfile, or --context URL@SHA to build one from a repository.");
     }
-    return { context: packContext(dir, { keep: [path] }), path };
+    const packed = await packedContext(ctx, dir, path);
+    return { context: packed.context, path, ...(packed.secretsAllowed.length ? { secretsAllowed: packed.secretsAllowed } : {}) };
 }
-function devcontainerCreate(ctx, plan) {
+async function devcontainerCreate(ctx, plan) {
     let source;
     let label;
+    let secretsAllowed = [];
+    const localEnvBaked = await confirmOverride(ctx, {
+        flag: "--devcontainer-local-env", what: "values from your environment, baked into the snapshot",
+        items: plan.localEnvBaked ?? [],
+    });
     if (plan.source.kind === "image") {
         source = { image: plan.source.image };
         label = plan.source.image;
@@ -681,7 +708,9 @@ function devcontainerCreate(ctx, plan) {
             throw usageError(`the devcontainer names a Dockerfile that is not here: ${plan.source.dockerfile}`, "Check `build.dockerfile` and `build.context` in the devcontainer.json, relative to the file itself.");
         }
         const path = contextRelative(plan.source.context, plan.source.dockerfile);
-        source = { dockerfile: { context: packContext(plan.source.context, { keep: [path] }), path } };
+        const packed = await packedContext(ctx, plan.source.context, path);
+        source = { dockerfile: { context: packed.context, path } };
+        secretsAllowed = packed.secretsAllowed;
         label = `${path} in ${plan.source.context}`;
     }
     const repo = str(ctx, "--repo");
@@ -693,7 +722,8 @@ function devcontainerCreate(ctx, plan) {
         throw usageError(`--commit must be a full 40-character sha, got ${JSON.stringify(commit)}`, "A branch is not a pin: pass --commit $(git rev-parse HEAD).");
     }
     const setup = planSetup(plan, { repo, commit, userSetup: list(ctx, "--setup") });
-    const opts = { ...source, ...(setup.length ? { setup } : {}) };
+    const env = snapshotEnv(plan);
+    const opts = { ...source, ...(setup.length ? { setup } : {}), ...(env ? { env } : {}) };
     const verify = str(ctx, "--verify");
     if (verify !== undefined)
         opts.verify = { cmd: wrapCommand(plan, verify) };
@@ -709,6 +739,8 @@ function devcontainerCreate(ctx, plan) {
         devcontainer: json,
         ...(repo === undefined ? {} : { repo, commit }),
         ...(tier === undefined ? {} : { requested_tier: tier }),
+        ...(secretsAllowed.length ? { secret_files_allowed: secretsAllowed } : {}),
+        ...(localEnvBaked.length ? { local_env_baked: localEnvBaked } : {}),
     };
     const lines = planLines(plan, setup);
     if (repo !== undefined && commit !== undefined) {
@@ -739,7 +771,7 @@ const snapshotCreate = async (ctx) => {
         ({ opts, label, submitted, tier } = gh);
     }
     else if (plan !== undefined) {
-        const built = devcontainerCreate(ctx, plan);
+        const built = await devcontainerCreate(ctx, plan);
         opts = built.opts;
         label = built.label;
         submitted = built.submitted;
@@ -767,11 +799,14 @@ const snapshotCreate = async (ctx) => {
             submitted = { build_price: null, image };
         }
         else {
-            const dockerfile = dockerfileOpts(ctx);
+            const { secretsAllowed, ...dockerfile } = await dockerfileOpts(ctx);
             source = { dockerfile };
             const where = dockerfile.context.startsWith("tar;") ? (str(ctx, "--context") ?? dirname(str(ctx, "--dockerfile") ?? ".")) : dockerfile.context;
             label = `${dockerfile.path ?? "Dockerfile"} in ${where}`;
-            submitted = { build_price: null, dockerfile: { path: dockerfile.path ?? "Dockerfile", context: where } };
+            submitted = {
+                build_price: null, dockerfile: { path: dockerfile.path ?? "Dockerfile", context: where },
+                ...(secretsAllowed?.length ? { secret_files_allowed: secretsAllowed } : {}),
+            };
         }
         const verify = str(ctx, "--verify");
         const start = str(ctx, "--start");
@@ -863,7 +898,7 @@ const snapshotCreate = async (ctx) => {
             .map((s) => `  also      ${s.repo}@${s.commit.slice(0, 7)} -> ${s.path ?? "beside the workspace, under its own name"}`)
             .join("\n") + "\n");
     }
-    if (started.deduped || started.state === "verified" || (started.snapshot_id && !isBuilding(started))) {
+    if (started.deduped || started.state === "verified" || started.state === "built" || (started.snapshot_id && !isBuilding(started))) {
         return emitBuild(ctx, started, submitted);
     }
     const joined = started.joined === true;
@@ -1575,7 +1610,7 @@ async function runImageSnapshot(ctx, c) {
     const buildOpts = { image, allowBuild: true };
     const snapshotId = await imageSnapshot(c, buildOpts, {
         onBuild: async (b) => {
-            const free = b.deduped === true || b.joined === true || b.idempotent_replay === true || b.state === "verified";
+            const free = b.deduped === true || b.joined === true || b.idempotent_replay === true || b.state === "verified" || b.state === "built";
             charged = free ? 0 : (typeof b.build_price === "number" ? b.build_price : price);
             buildId = b.build_id;
             await write(process.stderr, ctx.mode === "json"
@@ -2306,7 +2341,7 @@ const snapshotVerify = async (ctx) => {
     return emit(ctx.mode, env, lines, exit, ctx.pointer);
 };
 function localTar(args, what) {
-    const r = spawnSync("tar", args, { encoding: "utf8" });
+    const r = spawnSync("tar", args, { encoding: "utf8", env: { ...process.env, COPYFILE_DISABLE: "1" } });
     if (r.error && r.error.code === "ENOENT") {
         throw usageError("`tar` is not on PATH, and a directory transfer needs one locally", "Install tar (macOS and every Linux ship one), or move the files one at a time without --recursive.");
     }
@@ -2328,13 +2363,14 @@ const filesPut = async (ctx) => {
     const { sid, src, dst } = filesArgs(ctx);
     if (!dst.startsWith("/"))
         throw usageError(`DST ${dst} must be absolute inside the sandbox`, "Example: /tmp/fixture.json.");
-    const r = await withLocalFile(src, (source) => client(ctx).sandboxes.files.putFrom(sid, dst, source));
+    const r = await withLocalFile(src, (source) => client(ctx).sandboxes.files.putFrom(sid, dst, source, source.mode === undefined ? {} : { mode: source.mode }));
     const next = nexts([sh `promigence exec --sandbox ${sid} -- ls -l ${dst}`, "see it in the sandbox"]);
     return emit(ctx.mode, okEnvelope(ctx.cmd.name, { sandbox_id: sid, src, dst, bytes: r.bytes, chunks: r.chunks, mode: r.mode }, next), [`${src} -> ${sid}:${dst} (${bytes(r.bytes)}${r.chunks > 1 ? `, ${r.chunks} chunks` : ""})`], 0, ctx.pointer);
 };
 async function withLocalFile(path, fn) {
     let fd;
     let size;
+    let mode;
     try {
         fd = openSync(path, "r");
         const st = fstatSync(fd);
@@ -2343,6 +2379,7 @@ async function withLocalFile(path, fn) {
             throw Object.assign(new Error("it is a directory"), { code: "EISDIR" });
         }
         size = st.isFile() ? st.size : -1;
+        mode = st.isFile() && process.platform !== "win32" ? st.mode & 0o777 : undefined;
     }
     catch (e) {
         const code = e.code;
@@ -2358,6 +2395,7 @@ async function withLocalFile(path, fn) {
         const buf = Buffer.alloc(FILE_PUT_CHUNK_BYTES);
         return await fn({
             size,
+            mode,
             read: (offset, len) => {
                 const want = Math.min(len, buf.length);
                 let got = 0;
@@ -2375,6 +2413,9 @@ async function withLocalFile(path, fn) {
         closeSync(fd);
     }
 }
+export function filesPutTarArgs(out, parent, base, noMetadata = localTarNoMetadataArgs()) {
+    return ["-c", "-f", out, ...noMetadata, "-C", parent, base];
+}
 const filesPutDir = async (ctx) => {
     const { sid, src, dst } = filesArgs(ctx);
     if (!dst.startsWith("/"))
@@ -2384,7 +2425,7 @@ const filesPutDir = async (ctx) => {
     const tmp = join(mkdtempSync(join(tmpdir(), "promigence-put-")), "dir.tar");
     const parent = dirname(resolve(src));
     const base = basename(resolve(src));
-    localTar(["cf", tmp, "-C", parent, base], `tarring ${src}`);
+    localTar(filesPutTarArgs(tmp, parent, base), `tarring ${src}`);
     const bytesIn = statSync(tmp).size;
     const c = client(ctx);
     const scratch = `/tmp/.promigence-upload/cli-${Date.now().toString(36)}-${randomBytes(6).toString("hex")}.tar`;

package/dist/connectreq.js

@@ -0,0 +1,125 @@
+import { PromigenceError } from "./sdk/index.js";
+import { bool, nexts } from "./commands.js";
+import { emit, okEnvelope, write } from "./io.js";
+import { headless, openBrowser } from "./login.js";
+import { jsonLine } from "./term.js";
+const NAMES = { github: "GitHub", gitlab: "GitLab" };
+const CONNECTED = new Set(["connected", "updated", "already_connected"]);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+export async function consoleTicket(mint) {
+    try {
+        return await mint();
+    }
+    catch (e) {
+        if (e instanceof PromigenceError && e.code === "not_found")
+            return null;
+        throw e;
+    }
+}
+function endLine(host, r) {
+    const a = r.account ?? `the ${NAMES[host]} account`;
+    switch (r.state) {
+        case "connected":
+            return `connected: ${a}`;
+        case "updated":
+            return `already connected: ${a} (repository access updated)`;
+        case "already_connected":
+            return `already connected: ${a}`;
+        default:
+            return `${r.state}: ${r.message}`;
+    }
+}
+function fixFor(host, r) {
+    const again = `\`promigence ${host} connect\``;
+    const n = NAMES[host];
+    switch (r.state) {
+        case "wrong_user":
+            return `The page was opened in a browser signed in to another Promigence account, so nothing was started. Run ${again} again and open the page where you are signed in to the console as yourself.`;
+        case "declined":
+            return `The connection was declined, so nothing was connected. Run ${again} again to start over.`;
+        case "other_org":
+            return `That ${n} account is connected to another Promigence organization. Disconnect it there first (\`promigence ${host} disconnect\` with that organization's key), then run ${again} again.`;
+        case "needs_admin":
+            return `Connect it signed in to ${n} as an owner (admin) of that account, or ask one of its owners to; then run ${again} again.`;
+        case "not_installer":
+            return `The ${n} user who installed the App on that account can connect it now; an owner of the account can 15 minutes after the install. Then run ${again} again.`;
+        default:
+            return `Run ${again} again. If it fails the same way, write to support@promigence.ai with the time it happened.`;
+    }
+}
+export async function consoleConnect(ctx, host, o) {
+    const n = NAMES[host];
+    const url = o.ticket.connect_url;
+    const opened = bool(ctx, "--no-open") || headless() ? false : openBrowser(url);
+    const noWait = bool(ctx, "--no-wait");
+    if (ctx.mode === "json") {
+        await write(process.stderr, jsonLine(process.stderr, {
+            hint: "connect_url", connect_url: url, request_id: o.ticket.request_id, expires_at: o.ticket.expires_at, opened,
+        }));
+    }
+    else {
+        await write(process.stderr, [
+            opened
+                ? `Opening the Promigence console to connect ${n}…`
+                : `Open this page in a browser where you are signed in to the Promigence console (any device works):`,
+            `  ${opened ? "If it did not open: " : ""}${url}`,
+            host === "github"
+                ? "  It starts the connection on GitHub, where you choose the account, and all repositories or only the ones you pick."
+                : "  It starts the connection on GitLab, where you approve read-only access.",
+            "  The page works once, within 5 minutes, and only signed in to the console as you, an owner of this organization: keep it to yourself.",
+            ...(noWait ? [] : [`  Waiting up to ${o.waitText} (Ctrl-C stops waiting; the connection still finishes in the browser).`]),
+        ].join("\n") + "\n");
+    }
+    if (noWait) {
+        const next = nexts([`promigence ${host} status`, "once it is done: the connection"]);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, {
+            connect_url: url, request_id: o.ticket.request_id, expires_at: o.ticket.expires_at, opened, waited: false, connected: [],
+        }, next), [`connect page: ${url}`, `  next: ${next[0].cmd}`], 0, ctx.pointer);
+    }
+    const t0 = Date.now();
+    let said = "";
+    for (;;) {
+        await sleep(Math.min(o.pollMs, Math.max(0, o.bound - (Date.now() - t0))));
+        const r = await o.poll();
+        if (r.state !== "pending")
+            return finish(ctx, host, r, { url, opened, waitedMs: Date.now() - t0, ...o });
+        if (r.message !== said && ctx.mode !== "json") {
+            said = r.message;
+            await write(process.stderr, `  ${r.message}\n`);
+        }
+        if (Date.now() - t0 >= o.bound) {
+            throw new PromigenceError({
+                code: "timeout",
+                message: `no ${n} connection finished within ${o.waitText}`,
+                fix: `Finish it in the browser if it is still open, then \`promigence ${host} status\`. Otherwise run \`promigence ${host} connect\` again for a new page (each works once, within 5 minutes).`,
+                exitCode: 11,
+            });
+        }
+    }
+}
+async function finish(ctx, host, r, o) {
+    const n = NAMES[host];
+    if (CONNECTED.has(r.state)) {
+        const connected = await o.connections(r);
+        const next = nexts(...o.okNext);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, {
+            connect_url: o.url, opened: o.opened, waited: true, waited_ms: o.waitedMs, state: r.state, request: r, connected,
+        }, next), [endLine(host, r), `  ${r.message}`, `  next: ${next[0].cmd}`], 0, ctx.pointer);
+    }
+    if (r.state === "pending_provider_approval") {
+        const next = nexts([`promigence ${host} connect`, `once an owner of the account approved it on ${n}`]);
+        const line = `waiting for an owner of ${r.account ?? "that account"} to approve it on ${n}; run \`promigence ${host} connect\` again after`;
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, {
+            connect_url: o.url, opened: o.opened, waited: true, waited_ms: o.waitedMs, state: r.state, request: r, connected: [],
+        }, next), [line, `  ${r.message}`], 0, ctx.pointer);
+    }
+    if (r.state === "expired") {
+        throw new PromigenceError({
+            code: "timeout",
+            message: r.message,
+            fix: `Nothing was connected. Run \`promigence ${host} connect\` again and finish it in the browser: the page works within 5 minutes, the connection within 15.`,
+            exitCode: 11,
+        });
+    }
+    throw new PromigenceError({ code: "not_connected", message: `${r.state}: ${r.message}`, fix: fixFor(host, r), exitCode: 7 });
+}

package/dist/credits.js

@@ -1,7 +1,8 @@
+import { createInterface } from "node:readline";
 import { PromigenceClient } from "./sdk/index.js";
 import { bool, clientOpts, nexts } from "./commands.js";
 import { deviceFetch, deviceHeader } from "./device.js";
-import { emit, okEnvelope, recordNotice } from "./io.js";
+import { emit, okEnvelope, recordNotice, write } from "./io.js";
 import { headless, openBrowser } from "./login.js";
 import { usd } from "./money.js";
 export function dollars(n) {
@@ -104,6 +105,51 @@ export async function offerAfterLogin(ctx, apiUrl, apiKey, consoleHome) {
         lines: claimLines(offer, link, opened),
     };
 }
+async function askLine(prompt) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return await new Promise((resolve) => rl.question(prompt, resolve));
+    }
+    finally {
+        rl.close();
+    }
+}
+export function canAsk(env = process.env) {
+    const ci = (env["CI"] ?? "").trim().toLowerCase();
+    return Boolean(process.stdin.isTTY && process.stderr.isTTY) && (ci === "" || ci === "0" || ci === "false");
+}
+export async function claimOnRefusal(ctx, io = {}) {
+    const opts = { ...clientOpts(ctx), onNotice: recordNotice };
+    let o;
+    try {
+        o = await getOffer(new PromigenceClient(opts));
+    }
+    catch {
+        return undefined;
+    }
+    if (!o || o.state !== "claimable")
+        return undefined;
+    const credit = typeof o.credit_usd === "number" ? `${dollars(o.credit_usd)} of free credit` : "free credit";
+    await write(process.stderr, `This account has ${credit} waiting to be claimed; nothing was started or charged.\n`);
+    const answer = await (io.ask ?? askLine)("Claim it now? It opens the claim page in your browser, where you accept the terms. [y/N] ");
+    if (!/^\s*y(es)?\s*$/i.test(answer))
+        return ["Not claimed. When you are ready: promigence credits claim"];
+    let link;
+    try {
+        link = await getClaimLink(claimClient(opts));
+        if (!link || typeof link.url !== "string")
+            throw new Error("no claim link in the answer");
+    }
+    catch (e) {
+        const err = e;
+        return [
+            `Could not open the claim page: ${err?.message ?? String(e)}`,
+            `  Try again: promigence credits claim${err?.code === "forbidden" ? " (owners; members ask an owner)" : ""}`,
+        ];
+    }
+    const opened = maybeOpen(ctx, link.url);
+    return [...claimLines(o, link, opened), "Once it is claimed, run the command again."];
+}
 async function cardsOff(c, o) {
     if (!(typeof o.card_bonus_usd === "number" && o.card_bonus_usd > 0) || o.state === "none")
         return false;

package/dist/devcontainer.d.ts

@@ -68,6 +68,7 @@ export interface Plan {
     tierReason: string | undefined;
     ignored: IgnoredProperty[];
     notes: string[];
+    localEnvBaked?: string[];
 }
 export interface TranslateOptions {
     workspaceRoot: string;
@@ -82,6 +83,7 @@ export declare function sizeGib(v: unknown, field: string, file: string): number
 export declare function lifecycleSteps(v: unknown, field: string, ctx: SubstitutionContext, file: string): LifecycleStep[];
 export declare function shellQuote(s: string): string;
 export declare function wrapCommand(plan: Plan, command: string): string;
+export declare function snapshotEnv(plan: Plan): Record<string, string> | undefined;
 export interface SetupOptions {
     repo?: string | undefined;
     commit?: string | undefined;

package/dist/devcontainer.js

@@ -270,8 +270,8 @@ export function substituteString(input, ctx) {
                 if (!ctx.allowContainerEnv) {
                     throw refuse("container_env_scope", `\${containerEnv:…} in ${ctx.property}: the spec defines it for remoteEnv only`, "Move the value into remoteEnv, or write it out literally.", ctx.file);
                 }
-                const [key, fallback] = splitDefault(arg ?? "");
-                return ctx.containerEnv[key] ?? fallback;
+                const [key] = splitDefault(arg ?? "");
+                return ctx.containerEnv[key] ?? whole;
             }
             default: return whole;
         }
@@ -368,7 +368,7 @@ export function translate(loaded, opts) {
     const remoteEnv = stringMap(raw["remoteEnv"], "remoteEnv", file, (s, p) => substituteString(s, ctxFor(p, containerEnv, true)));
     const env = { ...containerEnv, ...remoteEnv };
     if (Object.keys(remoteEnv).length) {
-        notes.push("remoteEnv is applied the same way as containerEnv: both end up in the environment your commands run in");
+        notes.push("remoteEnv is applied the same way as containerEnv: both are set for every command, terminal and SSH session in the snapshot's sandboxes");
     }
     let source;
     if (opts.imageOverride === undefined) {
@@ -468,6 +468,7 @@ export function translate(loaded, opts) {
         tierReason,
         ignored,
         notes,
+        ...(readFromHost.size > 0 ? { localEnvBaked: [...readFromHost].sort() } : {}),
     };
 }
 function refuseFeatures(raw, file) {
@@ -675,20 +676,14 @@ export function shellQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 export function wrapCommand(plan, command) {
-    const exports = Object.entries(plan.env).map(([k, v]) => `${k}=${shellQuote(v)}`);
-    const inner = [
-        `cd ${shellQuote(plan.workspaceFolder)}`,
-        ...(exports.length ? [`export ${exports.join(" ")}`] : []),
-        command,
-    ].join(" && ");
+    const inner = [`cd ${shellQuote(plan.workspaceFolder)}`, command].join(" && ");
     return plan.user === undefined || plan.user === "root" ? inner : `su ${plan.user} -c ${shellQuote(inner)}`;
 }
+export function snapshotEnv(plan) {
+    return Object.keys(plan.env).length ? { ...plan.env } : undefined;
+}
 export function planSetup(plan, opts = {}) {
     const steps = [];
-    const envLines = Object.entries(plan.env).map(([k, v]) => shellQuote(`${k}=${v}`));
-    if (envLines.length) {
-        steps.push(`printf '%s\\n' ${envLines.join(" ")} >> /etc/environment`);
-    }
     if (opts.repo && opts.commit) {
         const ws = shellQuote(plan.workspaceFolder);
         const clone = [