promigence 0.1.0-beta.5 → 0.1.0-beta.7

package/dist/account.js

@@ -4,6 +4,21 @@ import { duration } from "./report.js";
 import { emit, ms, okEnvelope, overMost, parseCount, parseDuration, parseUsd, usageError } from "./io.js";
 import { sh } from "./term.js";
 const usd = (n) => n === undefined ? "—" : `$${n.toFixed(n < 0.01 && n > 0 ? 4 : 2)}`;
+export const PAYMENT_METHOD_NAMES = {
+    apple_pay: "Apple Pay",
+    google_pay: "Google Pay",
+    samsung_pay: "Samsung Pay",
+    link: "Link",
+    cashapp: "Cash App Pay",
+    amazon_pay: "Amazon Pay",
+};
+export function paymentMethodText(card) {
+    const key = card?.brand ?? "";
+    const named = Object.prototype.hasOwnProperty.call(PAYMENT_METHOD_NAMES, key) ? PAYMENT_METHOD_NAMES[key] : undefined;
+    if (named)
+        return card?.last4 ? `${named} •••• ${card.last4}` : named;
+    return `${card?.brand ?? "card"} ••${card?.last4 ?? "??"}`;
+}
 function limitOf(ctx, fallback, most) {
     const raw = str(ctx, "--limit");
     if (raw === undefined)
@@ -244,7 +259,7 @@ const billingUsage = async (ctx) => {
     const trial = b.trial;
     if (trial?.credits_remaining !== undefined)
         lines.push(`  trial credits left: ${usd(trial.credits_remaining)}`);
-    lines.push(`  card: ${b.card_on_file ? `${b.card?.brand ?? "card"} ••${b.card?.last4 ?? "??"}` : `none on file${billingOff ? " (card payments are not open yet)" : ""}`}`);
+    lines.push(`  card: ${b.card_on_file ? paymentMethodText(b.card) : `none on file${billingOff ? " (card payments are not open yet)" : ""}`}`);
     if (b.upcoming_invoice?.amount_due !== undefined && b.upcoming_invoice?.amount_due !== null) {
         lines.push(`  next invoice: ${usd(b.upcoming_invoice.amount_due)}`);
     }
@@ -520,6 +535,12 @@ export function sandboxFactLines(s, facts, nowMs = Date.now()) {
     }
     return out;
 }
+export function supportStopLines(s) {
+    if (s.outcome !== "stopped_by_support")
+        return [];
+    const message = s.failure?.message;
+    return [`  ${typeof message === "string" && message.trim() ? message : "Stopped by Promigence support"}`];
+}
 const sandboxInfo = async (ctx) => {
     const sid = positional(ctx, "a sandbox id", "promigence sandbox info sbx_01");
     const c = client(ctx);
@@ -539,6 +560,7 @@ const sandboxInfo = async (ctx) => {
         : why ? [] : [[sh `promigence exec --sandbox ${sid} -- CMD`, "run something in it"]]));
     const lines = [
         `sandbox ${sid}: ${s.state}${why ? ` (${why})` : ""}${s.outcome ? ` (${s.outcome})` : ""}${s.run_id ? ` · run ${s.run_id}` : ""}`,
+        ...supportStopLines(s),
         ...(why ? ["  its files and state are kept, and paused time is not billed"] : []),
         ...queuedLines([s]),
         ...(s.snapshot_id ? [`  snapshot ${s.snapshot_id}`] : []),

package/dist/agent.js

@@ -42,9 +42,17 @@ export const SETUP_SCRIPT = [
     'if [ -n "$3" ] && [ ! -d "$4/.git" ]; then',
     '  mkdir -p "$(dirname "$4")"',
     '  git clone --quiet -- "$3" "$4" >&2',
+    '  if [ -n "${5:-}" ]; then chown -R -- "$5" "$4"; fi',
     "fi",
     '"$1" --version',
 ].join("\n");
+async function snapshotUser(c, snapshot) {
+    if (snapshot === DEFAULT_SNAPSHOT)
+        return undefined;
+    const rec = await c.snapshots.get(snapshot).catch(() => undefined);
+    const u = rec?.user;
+    return typeof u === "string" && u !== "" && u !== "root" && u !== "0" ? u : undefined;
+}
 export function repoDir(url) {
     const last = url.replace(/[/]+$/, "").split(/[/:]/).pop() ?? "";
     const name = last.replace(/\.git$/, "").replace(/[^A-Za-z0-9._-]/g, "") || "repo";
@@ -269,8 +277,10 @@ const agentStart = async (ctx) => {
             throw e;
         }
     };
+    const runAs = await snapshotUser(c, snapshot);
     const setup = await endOnThrow(c.sandboxes.exec(sid, {
-        argv: ["sh", "-c", SETUP_SCRIPT, "agent-setup", agent.bin, agent.pkg, repo ?? "", cwd ?? ""],
+        argv: ["sh", "-c", SETUP_SCRIPT, "agent-setup", agent.bin, agent.pkg, repo ?? "", cwd ?? "", runAs ?? ""],
+        user: "root",
         timeoutMs: 10 * 60_000,
     }));
     if (setup.exit_code !== 0) {

package/dist/bin.js

@@ -13,7 +13,7 @@ import { TEMPLATES_HANDLERS } from "./templates.js";
 import { ACCOUNT_HANDLERS } from "./account.js";
 import { MCP_HANDLERS } from "./mcp.js";
 import { AGENT_HANDLERS } from "./agent.js";
-import { CREDITS_HANDLERS } from "./credits.js";
+import { CREDITS_HANDLERS, canAsk, claimOnRefusal } from "./credits.js";
 import { RUNNERS_HANDLERS } from "./runners.js";
 import { PRICING_HANDLERS } from "./pricing.js";
 import { GITHUB_HANDLERS } from "./github.js";
@@ -321,6 +321,11 @@ async function main(argv) {
             env.promigence_exit = exit;
             exit = e.code === "enoent" ? 127 : cmd.passthroughExit;
         }
+        if (e.code === "credit_unclaimed" && mode === "text" && canAsk()) {
+            const lines = await claimOnRefusal(ctx).catch(() => undefined);
+            if (lines)
+                return void (await emit(mode, env, lines, exit, false));
+        }
         await emit(mode, env, errorTextLines(cmd.name, e, exit, next), exit, !cmd.noGuidePointer);
     }
 }

package/dist/commands.d.ts

@@ -99,6 +99,10 @@ export declare function outputTails(c: PromigenceClient, sandboxes: ReadonlyArra
     }>;
 }>): Promise<Map<string, OutputTail>>;
 export declare function positional(ctx: Ctx, what: string, example: string): string;
+export declare function supportStoppedLines(sandboxes: ReadonlyArray<{
+    sandbox_id: string;
+    outcome?: string | null;
+}>): string[];
 export declare function filesPutTarArgs(out: string, parent: string, base: string, noMetadata?: string[]): string[];
 export declare const HANDLERS: Readonly<Record<string, Handler>>;
 export {};

package/dist/commands.js

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { DEFAULT_API_URL, DEFAULT_SNAPSHOT, ERRORS_DOCS_URL, MAX_OUTPUT_BYTES_DEFAULT, CONTEXT_GIT_RE, PromigenceClient, checkRepoUrl, withoutPin, PromigenceError, SpendCapError, TimeoutError, checkImageRef, contextRelative, credentialsPath, FILE_PUT_CHUNK_BYTES, imageSnapshot, isWaiting, execOutputBytes, listContext, packContext, readCredentials, } from "./sdk/index.js";
 import { fmtMs, recordTiming } from "./timing.js";
 import { capacityLine, queuedClause, queuedLines, statusLine } from "./capacity.js";
-import { DevcontainerError, detectOne, load, planJson, planLines, planSetup, resolveGiven, snapshotEnv, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
+import { DevcontainerError, detectOne, load, planJson, planLines, planSetup, resolveGiven, snapshotEnv, snapshotUsers, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
 import { detect, ecosystemOfCommands, imageCreateCommand, readConfig } from "./init.js";
 import { CREDENTIAL_REMEDY, confirmOverride, credentialRefusal, emitUploadList, localTarNoMetadataArgs } from "./uploadguard.js";
 import { emit, errorEnvelope, errorTextLines, exitWith, forkLine, forkSummary, gradeLine, ms, noCommandFix, okEnvelope, parseMaxOutput, recordNotice, sandboxGrade, parseCommandTimeout, parseCount, parseDuration, parseUsd, pickExit, reportSummaryLines, toPromigenceError, totalsLine, usageError, write, writeBytes, } from "./io.js";
@@ -212,7 +212,7 @@ function reportExits(report) {
         return codes;
     if (t.env_failed > 0 || (t.grader_failed ?? 0) > 0)
         codes.push(3);
-    if (t.not_started > 0 || t.cap_killed > 0 || t.expired > 0)
+    if (t.not_started > 0 || t.cap_killed > 0 || t.expired > 0 || (t.stopped_by_support ?? 0) > 0)
         codes.push(12);
     if (t.task_failed > 0 || t.snapshot_failed > 0)
         codes.push(4);
@@ -385,7 +385,7 @@ function boundUseLines(res) {
         "  requests the sandbox sends to this address are authenticated with it:",
         ...urls.map((u) => `    ${urlLine(u, res.env)}`),
         `  a request sent straight to ${hosts.map((h) => `https://${h}`).join(" or ")} is not authenticated: send it to the address above`,
-        ...(res.scan_responses === false ? [] : ["  the host's answers never show the value: an echo service shows asterisks instead"]),
+        ...(res.scan_responses === true ? ["  the host's answers never show the value: an echo service shows asterisks instead"] : []),
     ];
     return lines;
 }
@@ -723,7 +723,10 @@ async function devcontainerCreate(ctx, plan) {
     }
     const setup = planSetup(plan, { repo, commit, userSetup: list(ctx, "--setup") });
     const env = snapshotEnv(plan);
-    const opts = { ...source, ...(setup.length ? { setup } : {}), ...(env ? { env } : {}) };
+    const users = snapshotUsers(plan);
+    const opts = {
+        ...source, ...(setup.length ? { setup } : {}), ...(env ? { env } : {}), ...(users ?? {}),
+    };
     const verify = str(ctx, "--verify");
     if (verify !== undefined)
         opts.verify = { cmd: wrapCommand(plan, verify) };
@@ -762,7 +765,6 @@ const snapshotCreate = async (ctx) => {
     const plan = gh ? undefined : devcontainerPlan(ctx, form);
     const setup = list(ctx, "--setup");
     const alias = str(ctx, "--alias");
-    const cpuClass = str(ctx, "--cpu-class");
     let opts;
     let label;
     let submitted;
@@ -833,8 +835,6 @@ const snapshotCreate = async (ctx) => {
     const c = client(ctx);
     if (alias !== undefined)
         opts.alias = alias;
-    if (cpuClass !== undefined)
-        opts.cpuClass = cpuClass;
     const grade = gradeOpts(ctx);
     if (grade)
         opts.grade = grade;
@@ -1472,8 +1472,6 @@ const exec = async (ctx) => {
             stdout: res.stdout ?? "",
             stderr: res.stderr ?? "",
             truncated: res.truncated ?? false,
-            ...(res.stdout_ref === undefined ? {} : { stdout_ref: res.stdout_ref }),
-            ...(res.stderr_ref === undefined ? {} : { stderr_ref: res.stderr_ref }),
             ...(res.stdout_b64 === undefined ? {} : { stdout_b64: res.stdout_b64 }),
             ...(res.stderr_b64 === undefined ? {} : { stderr_b64: res.stderr_b64 }),
             ...(res["idempotent_replay"] === true ? { idempotent_replay: true } : {}),
@@ -1598,7 +1596,7 @@ async function runImageSnapshot(ctx, c) {
     if (cap < price + (quoted ?? 0)) {
         const existing = (quoted ?? 0) <= cap ? await existingImageSnapshot(c, image) : undefined;
         throw new SpendCapError(`a new image's snapshot build costs ${moneyUsd(price)} on top of the run` +
-            `${quoted === undefined ? "" : ` (about ${moneyUsd(quoted)})`}, over --cap ${moneyUsd(cap)}; nothing was built or started`, (existing === undefined ? "" : `This image already has snapshot ${existing}: run it under this cap with ${sh `promigence run --snapshot ${existing}`} instead of --image. Or `) +
+            `${quoted === undefined ? "" : ` (about ${moneyUsd(quoted)})`}, over --cap ${moneyUsd(cap)}; nothing was built or started`, (existing === undefined ? "" : `This image already has snapshot ${existing}: run it under this cap with ${sh `promigence run --snapshot ${existing}`} instead of --image (any start command or settings it was made with come with it). Or `) +
             `${existing === undefined ? "Pass" : "pass"} --cap ${needed.toFixed(2)} or more (a build is charged once, only when this image has no snapshot yet, and reused free after), ` +
             `or build it first, ${sh `promigence snapshot create --image ${image} --wait`}, and run its snapshot with --snapshot.`);
     }
@@ -1633,7 +1631,7 @@ async function existingImageSnapshot(c, image) {
         for (let page = 0; page < 5; page++) {
             const p = await c.snapshots.listPage({ limit: 100, ...(cursor === undefined ? {} : { cursor }) });
             const hit = p.items.find((s) => s.source?.kind === "image" && typeof s.source.digest === "string" && digests.has(s.source.digest) &&
-                s.source["from_sandbox"] === undefined && !s.unavailable && !(s.setup?.length) && !s.start && !s.verify?.cmd &&
+                s.source["from_sandbox"] === undefined && !s.unavailable && !(s.setup?.length) && !s.verify?.cmd &&
                 (s.tier === undefined || s.tier === "small"));
             if (hit)
                 return hit.snapshot_id;
@@ -1967,11 +1965,12 @@ function settledWhy(report, keep) {
     return `${open.length} sandbox${open.length === 1 ? " has" : "es have"} not ended yet, so ${open.length === 1 ? "its" : "their"} last charge is still to land`;
 }
 const OUTCOME_EXIT = {
-    env_failed: 3, grader_failed: 3, not_started: 12, cap_killed: 12, expired: 12, task_failed: 4, snapshot_failed: 4,
+    env_failed: 3, grader_failed: 3, not_started: 12, cap_killed: 12, expired: 12, stopped_by_support: 12,
+    task_failed: 4, snapshot_failed: 4,
 };
 const OUTCOME_CODE = {
     env_failed: "env_failed", grader_failed: "grader_failed", not_started: "not_started", cap_killed: "cap_killed",
-    expired: "expired", task_failed: "nonzero_exit", snapshot_failed: "snapshot_failed",
+    expired: "expired", stopped_by_support: "stopped_by_support", task_failed: "nonzero_exit", snapshot_failed: "snapshot_failed",
 };
 function failureFix(runId, s) {
     const f = s.failure;
@@ -2005,7 +2004,7 @@ export function runHeadline(report, count) {
     const t = (report.totals ?? {});
     const others = Object.entries(t)
         .filter(([k, v]) => !["completed", "env_verified", "evidence_missing"].includes(k) && typeof v === "number" && v > 0)
-        .map(([k, v]) => `${v} ${k}`);
+        .map(([k, v]) => `${v} ${k === "stopped_by_support" ? "stopped by Promigence support" : k}`);
     const done = typeof t["completed"] === "number" ? t["completed"] : 0;
     return `run ${report.run_id}: ${done} of ${count} completed${others.length ? ` · ${others.join(" · ")}` : ""}` +
         `${report.cost ? ` · charged ${moneyUsd(report.cost.charged)}` : ""}`;
@@ -2125,6 +2124,12 @@ const runReport = async (ctx) => {
     const next = nexts([sh `promigence run status ${runId}`, "the run's current state"]);
     return emit(ctx.mode, okEnvelope(ctx.cmd.name, { run_id: runId, report }, next), reportLines(report, view), 0, ctx.pointer);
 };
+export function supportStoppedLines(sandboxes) {
+    const stopped = sandboxes.filter((s) => s.outcome === "stopped_by_support");
+    if (!stopped.length)
+        return [];
+    return [`  ${stopped.length} stopped by Promigence support; ${sh `promigence sandbox info ${stopped[0].sandbox_id}`} says why`];
+}
 const runStatus = async (ctx) => {
     const runId = positional(ctx, "a run id", "promigence run status run_01 --wait");
     const c = client(ctx);
@@ -2141,7 +2146,7 @@ const runStatus = async (ctx) => {
         states[s.state] = (states[s.state] ?? 0) + 1;
     const next = nexts([sh `promigence run report ${runId} --json`, "the validity report"]);
     const tail = Object.keys(states).length ? ` - ${Object.entries(states).map(([k, v]) => `${k} ${v}`).join(" - ")}` : "";
-    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { run_id: runId, state: run.state, sandbox_states: states, run }, next), [`run ${runId}: ${run.state}${tail}`, ...queuedLines(run.sandboxes ?? [])], 0, ctx.pointer);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { run_id: runId, state: run.state, sandbox_states: states, run }, next), [`run ${runId}: ${run.state}${tail}`, ...supportStoppedLines(run.sandboxes ?? []), ...queuedLines(run.sandboxes ?? [])], 0, ctx.pointer);
 };
 const runKill = async (ctx) => {
     const runId = positional(ctx, "a run id", "promigence run kill run_01");

package/dist/credits.js

@@ -1,7 +1,8 @@
+import { createInterface } from "node:readline";
 import { PromigenceClient } from "./sdk/index.js";
 import { bool, clientOpts, nexts } from "./commands.js";
 import { deviceFetch, deviceHeader } from "./device.js";
-import { emit, okEnvelope, recordNotice } from "./io.js";
+import { emit, okEnvelope, recordNotice, write } from "./io.js";
 import { headless, openBrowser } from "./login.js";
 import { usd } from "./money.js";
 export function dollars(n) {
@@ -104,18 +105,66 @@ export async function offerAfterLogin(ctx, apiUrl, apiKey, consoleHome) {
         lines: claimLines(offer, link, opened),
     };
 }
-async function cardsOff(c, o) {
+async function askLine(prompt) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return await new Promise((resolve) => rl.question(prompt, resolve));
+    }
+    finally {
+        rl.close();
+    }
+}
+export function canAsk(env = process.env) {
+    const ci = (env["CI"] ?? "").trim().toLowerCase();
+    return Boolean(process.stdin.isTTY && process.stderr.isTTY) && (ci === "" || ci === "0" || ci === "false");
+}
+export async function claimOnRefusal(ctx, io = {}) {
+    const opts = { ...clientOpts(ctx), onNotice: recordNotice };
+    let o;
+    try {
+        o = await getOffer(new PromigenceClient(opts));
+    }
+    catch {
+        return undefined;
+    }
+    if (!o || o.state !== "claimable")
+        return undefined;
+    const credit = typeof o.credit_usd === "number" ? `${dollars(o.credit_usd)} of free credit` : "free credit";
+    await write(process.stderr, `This account has ${credit} waiting to be claimed; nothing was started or charged.\n`);
+    const answer = await (io.ask ?? askLine)("Claim it now? It opens the claim page in your browser, where you accept the terms. [y/N] ");
+    if (!/^\s*y(es)?\s*$/i.test(answer))
+        return ["Not claimed. When you are ready: promigence credits claim"];
+    let link;
+    try {
+        link = await getClaimLink(claimClient(opts));
+        if (!link || typeof link.url !== "string")
+            throw new Error("no claim link in the answer");
+    }
+    catch (e) {
+        const err = e;
+        return [
+            `Could not open the claim page: ${err?.message ?? String(e)}`,
+            `  Try again: promigence credits claim${err?.code === "forbidden" ? " (owners; members ask an owner)" : ""}`,
+        ];
+    }
+    const opened = maybeOpen(ctx, link.url);
+    return [...claimLines(o, link, opened), "Once it is claimed, run the command again."];
+}
+async function cardState(c, o) {
+    const none = { off: false, onFile: false };
     if (!(typeof o.card_bonus_usd === "number" && o.card_bonus_usd > 0) || o.state === "none")
-        return false;
-    return c.billing.usage().then((b) => b.billing_enabled === false).catch(() => false);
+        return none;
+    return c.billing.usage().then((b) => ({ off: b.billing_enabled === false, onFile: b.card_on_file === true })).catch(() => none);
 }
-function offerLines(head, o, off = false) {
+function offerLines(head, o, st = { off: false, onFile: false }) {
     const lines = [`${head}: ${say(o)}`];
     if (o.state !== "none") {
         if (typeof o.credit_usd === "number")
             lines.push(`  credit: ${dollars(o.credit_usd)}`);
         if (typeof o.card_bonus_usd === "number" && o.card_bonus_usd > 0) {
-            lines.push(`  card bonus: ${dollars(o.card_bonus_usd)} more when you add a card${off ? " (card payments are not open yet)" : " (promigence billing card)"}`);
+            lines.push(st.onFile
+                ? `  card bonus: ${dollars(o.card_bonus_usd)} more with your first paid invoice`
+                : `  card bonus: ${dollars(o.card_bonus_usd)} more when you add a card${st.off ? " (card payments are not open yet)" : " (promigence billing card)"}`);
         }
         if (o.expires_at)
             lines.push(`  expires: ${o.expires_at}`);
@@ -128,14 +177,14 @@ function offerLines(head, o, off = false) {
 const credits = async (ctx) => {
     const c = new PromigenceClient({ ...clientOpts(ctx), onNotice: recordNotice });
     const o = await getOffer(c);
-    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...o }, offerNext(o)), offerLines("promigence credits", o, await cardsOff(c, o)), 0, ctx.pointer);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...o }, offerNext(o)), offerLines("promigence credits", o, await cardState(c, o)), 0, ctx.pointer);
 };
 const creditsClaim = async (ctx) => {
     const opts = { ...clientOpts(ctx), onNotice: recordNotice };
     const c = new PromigenceClient(opts);
     const o = await getOffer(c);
     if (o.state !== "claimable") {
-        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...o, claim_url: null }, offerNext(o)), offerLines("promigence credits claim", o, await cardsOff(c, o)), 0, ctx.pointer);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...o, claim_url: null }, offerNext(o)), offerLines("promigence credits claim", o, await cardState(c, o)), 0, ctx.pointer);
     }
     const link = await getClaimLink(claimClient(opts));
     const opened = maybeOpen(ctx, link.url);

package/dist/devcontainer.d.ts

@@ -62,6 +62,7 @@ export interface Plan {
     env: Record<string, string>;
     workspaceFolder: string;
     user: string | undefined;
+    remoteUser?: string | undefined;
     lifecycle: LifecycleStep[];
     ports: number[];
     tier: string | undefined;
@@ -84,6 +85,10 @@ export declare function lifecycleSteps(v: unknown, field: string, ctx: Substitut
 export declare function shellQuote(s: string): string;
 export declare function wrapCommand(plan: Plan, command: string): string;
 export declare function snapshotEnv(plan: Plan): Record<string, string> | undefined;
+export declare function snapshotUsers(plan: Plan): {
+    user: string;
+    setupUser: string;
+} | undefined;
 export interface SetupOptions {
     repo?: string | undefined;
     commit?: string | undefined;

package/dist/devcontainer.js

@@ -462,6 +462,7 @@ export function translate(loaded, opts) {
         env,
         workspaceFolder,
         user,
+        ...(remoteUser === undefined ? {} : { remoteUser }),
         lifecycle,
         ports,
         tier,
@@ -682,6 +683,10 @@ export function wrapCommand(plan, command) {
 export function snapshotEnv(plan) {
     return Object.keys(plan.env).length ? { ...plan.env } : undefined;
 }
+export function snapshotUsers(plan) {
+    const user = plan.remoteUser ?? plan.user;
+    return user === undefined ? undefined : { user, setupUser: "root" };
+}
 export function planSetup(plan, opts = {}) {
     const steps = [];
     if (opts.repo && opts.commit) {

package/dist/dirsnap.js

@@ -25,7 +25,7 @@ const INTERRUPTED = {
 };
 const NOT_WITH_DIR = [
     "--repo", "--commit", "--ref", "--track", "--also-repo", "--image", "--dockerfile", "--context",
-    "--devcontainer", "--start", "--cpu-class", "--grade", "--holdout", "--grade-score", "--grade-timeout",
+    "--devcontainer", "--start", "--grade", "--holdout", "--grade-score", "--grade-timeout",
     "--grade-output", "--tier",
 ];
 export { secretLike };

package/dist/errfix.js

@@ -17,11 +17,17 @@ export function notFoundKind(message) {
     const m = /^(.+?) `([^`]*)` not found$/.exec(message.trim());
     return m ? { kind: m[1].toLowerCase(), id: m[2] } : undefined;
 }
-function notFoundFor(kind, ctx) {
+function notFoundFor(kind, ctx, apiFix) {
     const sid = ctx.sandbox ?? "SID";
     switch (kind) {
         case "snapshot":
             return undefined;
+        case "ref":
+        case "commit":
+            return {
+                fix: apiFix,
+                next: [{ cmd: "promigence repos", why: "the repositories you can build, each with its default branch" }],
+            };
         case "exec":
             return {
                 fix: `Check the exec id: \`${sh `promigence exec ps --sandbox ${sid}`}\` lists the background ones, \`${sh `promigence sandbox info ${sid}`}\` every one.`,
@@ -195,7 +201,7 @@ export async function refineError(e, ctx) {
     }
     if (e.code === "not_found") {
         const nf = notFoundKind(e.message);
-        const fitted = nf ? notFoundFor(nf.kind, ctx) : undefined;
+        const fitted = nf ? notFoundFor(nf.kind, ctx, err.fix ?? "") : undefined;
         if (fitted) {
             err = reworded(err, fitted.fix);
             next = fitted.next;

package/dist/generated.js

@@ -83,6 +83,9 @@ export const ERRORS = [
     { code: "aborted_by_client", category: "other", http: 200, exit: 130, billed: "yes",
         message: "sandbox killed by the client",
         fix: "Nothing to fix; billed for the seconds used." },
+    { code: "stopped_by_support", category: "other", http: 200, exit: 12, billed: "unless_ours",
+        message: "Stopped by Promigence support: {reason}",
+        fix: "Billed for the seconds it ran, as a kill is, unless support found the cause was on our side; then that time is credited back. Questions: tell support@promigence.ai the sandbox id." },
     { code: "expired", category: "other", http: 200, exit: 12, billed: "yes",
         message: "sandbox timeout reached (counted from hand-off)",
         fix: "Raise `--timeout` if the task needs longer." },
@@ -176,6 +179,9 @@ export const ERRORS = [
     { code: "credit_unclaimed", category: "other", http: 402, exit: 5, billed: "no",
         message: "this account has free credit waiting to be claimed",
         fix: "Claim it in your browser: `promigence credits claim` (owners; members ask an owner). Or add a card: `promigence billing card`. Nothing was started or charged." },
+    { code: "setup_required", category: "other", http: 403, exit: 7, billed: "no",
+        message: "finish setting up your account before starting new work",
+        fix: "Open {setup_url} and answer the setup questions (under a minute), then run this again. Nothing was started or charged." },
     { code: "card_required", category: "other", http: 402, exit: 5, billed: "no",
         message: "a card is required for new work since {effective_at}",
         fix: "Add a card (owners: `promigence billing card`, or POST /v1/billing/checkout; members ask an owner). Your trial credits are kept and used first; reads and results stay available." },
@@ -233,6 +239,9 @@ export const ERRORS = [
     { code: "key_expired", category: "other", http: 401, exit: 7, billed: "no",
         message: "this API key expired at {expired_at}",
         fix: "Create a new key (`promigence keys create`, or sign in again with `promigence login`) and replace this one wherever it is used." },
+    { code: "account_blocked", category: "other", http: 401, exit: 7, billed: "no",
+        message: "this account is blocked",
+        fix: "Write to support@promigence.ai to have it reviewed." },
 ];
 export const ERROR_BY_CODE = Object.fromEntries(ERRORS.map((e) => [e.code, e]));
 export const CLIENT_ERRORS = [

package/dist/github.js

@@ -14,7 +14,7 @@ function pollMs() {
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function notConfigured(s) {
-    return usageError(s.message ?? "GitHub connection is not configured on this deployment", "Bring the code in another way: `promigence snapshot create --dir .` uploads the files git tracks here, or clone a public repository in a --setup step.");
+    return usageError(s.message ?? "Connecting GitHub isn't available here yet", "Bring the code in another way: `promigence snapshot create --dir .` uploads the files git tracks here, or clone a public repository in a --setup step.");
 }
 function connectionLine(c) {
     return `  ${c.account}  ${c.account_type} · ${c.repository_selection} repositories · installation ${c.installation_id}${c.suspended ? "  SUSPENDED on GitHub" : ""}`;
@@ -107,7 +107,7 @@ const githubStatus = async (ctx) => {
     const s = await client(ctx).github.status();
     if (!s.configured) {
         const next = nexts(["promigence snapshot create --dir . --alias app --wait", "bring the files git tracks here instead"]);
-        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...s }, next), [`github: ${s.message ?? "GitHub connection is not configured on this deployment"}`], 0, ctx.pointer);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...s }, next), [`github: ${s.message ?? "Connecting GitHub isn't available here yet"}`], 0, ctx.pointer);
     }
     const lines = [
         s.connections.length
@@ -215,7 +215,6 @@ const NOT_WITH_GITHUB = [
     ["--devcontainer", "it is not read for a connected repository; use --setup steps"],
     ["--start", "a background process is part of an image snapshot"],
     ["--also-repo", "clone further repositories in a --setup step"],
-    ["--cpu-class", "the build goes wherever there is room"],
     ["--dir", "--dir uploads a local tree instead; pass one of them"],
 ];
 const GITHUB_ONLY = ["--ref", "--from", "--track"];

package/dist/gitlab.js

@@ -12,7 +12,7 @@ function pollMs() {
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function notConfigured(s) {
-    return usageError(s.message ?? "GitLab connection is not configured on this deployment", "Bring the code in another way: `promigence snapshot create --dir .` uploads the files git tracks here, or clone in a --setup step.");
+    return usageError(s.message ?? "Connecting GitLab isn't available here yet", "Bring the code in another way: `promigence snapshot create --dir .` uploads the files git tracks here, or clone in a --setup step.");
 }
 function connectionLine(c) {
     return `  ${c.username}  on ${c.gitlab_url} · ${c.connection_id}${c.broken ? `  BROKEN: ${c.broken_reason ?? "connect again"}` : ""}`;
@@ -108,7 +108,7 @@ const gitlabStatus = async (ctx) => {
     const s = await client(ctx).gitlab.status();
     if (!s.configured) {
         const next = nexts(["promigence snapshot create --dir . --alias app --wait", "bring the files git tracks here instead"]);
-        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...s }, next), [`gitlab: ${s.message ?? "GitLab connection is not configured on this deployment"}`], 0, ctx.pointer);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...s }, next), [`gitlab: ${s.message ?? "Connecting GitLab isn't available here yet"}`], 0, ctx.pointer);
     }
     const lines = [
         s.connections.length

package/dist/guide.d.ts

@@ -7,6 +7,8 @@ export declare const BUDGETS: Readonly<Record<Section, number>>;
 export declare function lookupError(code: string): ErrorEntry | undefined;
 export declare const ALL_ERROR_CODES: readonly string[];
 export declare const estimateTokens: (s: string) => number;
+export declare const HUMAN_START = "promigence run --count 1 --cap 1 -- python3 -c 'print(6*7)'";
+export declare function humanHeader(): string;
 export interface GuideOpts {
     section?: Section;
     code?: string;

package/dist/guide.js

@@ -10,7 +10,7 @@ export const SECTIONS = ["core", "commands", "errors", "cost"];
 export const BUDGETS = {
     core: 1200,
     commands: 4475,
-    errors: 2225,
+    errors: 2325,
     cost: 600,
 };
 export function lookupError(code) {
@@ -222,8 +222,10 @@ function renderCost(prices) {
     const source = prices === undefined
         ? "List prices when this CLI was built. Live, and your plan's: `promigence pricing`."
         : prices.source === "api"
-            ? `Live from the API (${view?.as_of ?? "now"}): ${view?.scope === "organization" ? "your organization's prices" : "what a new account pays"}. \`promigence pricing\` shows the rest.`
-            : `${prices.note ?? "list prices at build time; could not reach the API"} (\`promigence pricing\` asks again).`;
+            ? `Live from the API (${view?.as_of ?? "now"}): your organization's prices. \`promigence pricing\` shows the rest.`
+            : prices.source === "published"
+                ? "Published list prices. Your organization's own: `promigence login`, then `promigence pricing`."
+                : `${prices.note ?? "list prices at build time; could not reach the API"} (\`promigence pricing\` asks again).`;
     const limit = view?.limits.max_sandbox_vcpus;
     const out = [
         `# Promigence — what it costs (promigence@${VERSION})`,
@@ -259,6 +261,10 @@ function renderCost(prices) {
     ];
     return out.filter((l) => l !== undefined).join("\n");
 }
+export const HUMAN_START = "promigence run --count 1 --cap 1 -- python3 -c 'print(6*7)'";
+export function humanHeader() {
+    return `For people: this is the guide your coding agent reads, dense on purpose.\nStart here: ${HUMAN_START}\n\n`;
+}
 export function renderGuide(opts = {}) {
     if (opts.code)
         return renderCode(opts.code);

package/dist/handlers.js

@@ -4,7 +4,7 @@ import { BUNDLE_EXT, DEFAULT_SNAPSHOT, PromigenceError, VERSION as SDK_VERSION,
 import { storeLabel } from "./sdk/credstore.js";
 import { bool, client, list, nexts, positional, required, str, } from "./commands.js";
 import { emit, exitWith, forkSummary, markGuideSeen, ms, okEnvelope, parseCount, parseDuration, parseUsd, pickExit, usageError, write, } from "./io.js";
-import { ALL_ERROR_CODES, BUDGETS, estimateTokens, guideJson, lookupError, renderGuide } from "./guide.js";
+import { ALL_ERROR_CODES, BUDGETS, estimateTokens, guideJson, humanHeader, lookupError, renderGuide } from "./guide.js";
 import { livePricing, quickClient } from "./pricing.js";
 import { install, installLines } from "./install.js";
 import { backgroundOutput } from "./live.js";
@@ -66,6 +66,8 @@ const agentGuide = async (ctx) => {
         await write(process.stdout, jsonLine(process.stdout, env));
         return exitWith(0);
     }
+    if (section === "core" && code === undefined && process.stdout.isTTY)
+        await write(process.stdout, humanHeader());
     await write(process.stdout, guide);
     const budget = BUDGETS[section] ?? BUDGETS.core;
     const used = estimateTokens(guide);

package/dist/index.d.ts

@@ -9,6 +9,6 @@ export { FENCE_BEGIN, FENCE_END, FENCE_MAX_LINES, fenceBody, install, spliceFenc
 export type { Artifact, InstallResult } from "./install.js";
 export { detect, gitFacts, normalizeRemote, readConfig, renderConfig, stripRemoteCredentials } from "./init.js";
 export type { Config, Detection, Ecosystem, GitFacts, ReadConfig } from "./init.js";
-export { DEVCONTAINER_NAMES, DEVCONTAINER_SPEC, DevcontainerError, detectOne, discover, load, parseJsonc, planJson, planLines, planSetup, resolveGiven, shellQuote, snapshotEnv, substituteString, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
+export { DEVCONTAINER_NAMES, DEVCONTAINER_SPEC, DevcontainerError, detectOne, discover, load, parseJsonc, planJson, planLines, planSetup, resolveGiven, shellQuote, snapshotEnv, snapshotUsers, substituteString, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
 export type { LoadedDevcontainer, Plan, PlanSource, LifecycleStep, IgnoredProperty } from "./devcontainer.js";
 export type { Command, Flag, Group, CommandStatus, ExitCode, Envelope, EnvelopeError, NextHint } from "./surface.js";

package/dist/index.js

@@ -4,4 +4,4 @@ export { ALL_ERROR_CODES, BILLED_TEXT, BUDGETS, SECTIONS, estimateTokens, guideJ
 export { CLIENT_ERRORS, CLIENT_ERROR_BY_CODE, ERRORS, ERROR_BY_CODE, TIERS, BUILD_PRICE, PRICING } from "./generated.js";
 export { FENCE_BEGIN, FENCE_END, FENCE_MAX_LINES, fenceBody, install, spliceFence } from "./install.js";
 export { detect, gitFacts, normalizeRemote, readConfig, renderConfig, stripRemoteCredentials } from "./init.js";
-export { DEVCONTAINER_NAMES, DEVCONTAINER_SPEC, DevcontainerError, detectOne, discover, load, parseJsonc, planJson, planLines, planSetup, resolveGiven, shellQuote, snapshotEnv, substituteString, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
+export { DEVCONTAINER_NAMES, DEVCONTAINER_SPEC, DevcontainerError, detectOne, discover, load, parseJsonc, planJson, planLines, planSetup, resolveGiven, shellQuote, snapshotEnv, snapshotUsers, substituteString, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";

package/dist/login.js

@@ -765,6 +765,8 @@ async function signInAndStore(ctx, isSignup) {
         if (!idp) {
             throw usageError(`--provider: '${provider}' is not a login method`, `Pass --provider ${Object.keys(cfg.identity_providers).join(" | ")}, or omit it to choose in the browser.`);
         }
+        if (provider === "email")
+            idp = undefined;
     }
     const keyName = (str(ctx, "--key-name") ?? `cli@${deviceName()}`).slice(0, 64);
     const ref = str(ctx, "--ref")?.trim();

package/dist/mcp.js

@@ -132,7 +132,7 @@ function reportSummary(report) {
 export const MCP_TOOLS = [
     {
         name: "sandbox_create",
-        description: "Create a sandbox from a Promigence snapshot (id or alias; default promigence/base: Debian with Python 3.12, node, git, gcc) or from a container image (a tag, which the API pins, or NAME@sha256:…), and return its sandbox_id.",
+        description: "Create a sandbox from a Promigence snapshot (id or alias; default promigence/base: Debian with Python 3.12, Node 24, Go, Docker, git, gcc and the Claude Code, Codex, Gemini and OpenCode CLIs) or from a container image (a tag, which the API pins, or NAME@sha256:…), and return its sandbox_id.",
         readOnly: false,
         inputSchema: {
             type: "object",

package/dist/pricing.d.ts

@@ -1,6 +1,7 @@
 import { PromigenceClient, type PricingView } from "./sdk/index.js";
 import { type Ctx, type Handler } from "./commands.js";
 export declare const COMPILED_NOTE = "list prices at build time; could not reach the API";
+export declare const PUBLISHED_NOTE = "published list prices; your organization's own need a key (promigence login)";
 export interface PriceTier {
     name: string;
     vcpus: number;
@@ -12,7 +13,7 @@ export interface PriceTier {
     available?: boolean;
 }
 export interface Prices {
-    source: "api" | "compiled";
+    source: "api" | "compiled" | "published";
     note?: string;
     reason?: string;
     view?: PricingView;
@@ -24,6 +25,7 @@ export interface Prices {
     granularity_seconds: number;
     tiers: PriceTier[];
 }
+export declare function publishedPrices(): Prices;
 export declare function compiledPrices(note?: string, reason?: string): Prices;
 export declare function pricesFrom(view: PricingView): Prices;
 export declare function livePricing(c: PromigenceClient, opts?: {