promigence 0.1.0-beta.6 → 0.1.0-beta.7

package/dist/account.js

@@ -4,6 +4,21 @@ import { duration } from "./report.js";
 import { emit, ms, okEnvelope, overMost, parseCount, parseDuration, parseUsd, usageError } from "./io.js";
 import { sh } from "./term.js";
 const usd = (n) => n === undefined ? "—" : `$${n.toFixed(n < 0.01 && n > 0 ? 4 : 2)}`;
+export const PAYMENT_METHOD_NAMES = {
+    apple_pay: "Apple Pay",
+    google_pay: "Google Pay",
+    samsung_pay: "Samsung Pay",
+    link: "Link",
+    cashapp: "Cash App Pay",
+    amazon_pay: "Amazon Pay",
+};
+export function paymentMethodText(card) {
+    const key = card?.brand ?? "";
+    const named = Object.prototype.hasOwnProperty.call(PAYMENT_METHOD_NAMES, key) ? PAYMENT_METHOD_NAMES[key] : undefined;
+    if (named)
+        return card?.last4 ? `${named} •••• ${card.last4}` : named;
+    return `${card?.brand ?? "card"} ••${card?.last4 ?? "??"}`;
+}
 function limitOf(ctx, fallback, most) {
     const raw = str(ctx, "--limit");
     if (raw === undefined)
@@ -244,7 +259,7 @@ const billingUsage = async (ctx) => {
     const trial = b.trial;
     if (trial?.credits_remaining !== undefined)
         lines.push(`  trial credits left: ${usd(trial.credits_remaining)}`);
-    lines.push(`  card: ${b.card_on_file ? `${b.card?.brand ?? "card"} ••${b.card?.last4 ?? "??"}` : `none on file${billingOff ? " (card payments are not open yet)" : ""}`}`);
+    lines.push(`  card: ${b.card_on_file ? paymentMethodText(b.card) : `none on file${billingOff ? " (card payments are not open yet)" : ""}`}`);
     if (b.upcoming_invoice?.amount_due !== undefined && b.upcoming_invoice?.amount_due !== null) {
         lines.push(`  next invoice: ${usd(b.upcoming_invoice.amount_due)}`);
     }
@@ -520,6 +535,12 @@ export function sandboxFactLines(s, facts, nowMs = Date.now()) {
     }
     return out;
 }
+export function supportStopLines(s) {
+    if (s.outcome !== "stopped_by_support")
+        return [];
+    const message = s.failure?.message;
+    return [`  ${typeof message === "string" && message.trim() ? message : "Stopped by Promigence support"}`];
+}
 const sandboxInfo = async (ctx) => {
     const sid = positional(ctx, "a sandbox id", "promigence sandbox info sbx_01");
     const c = client(ctx);
@@ -539,6 +560,7 @@ const sandboxInfo = async (ctx) => {
         : why ? [] : [[sh `promigence exec --sandbox ${sid} -- CMD`, "run something in it"]]));
     const lines = [
         `sandbox ${sid}: ${s.state}${why ? ` (${why})` : ""}${s.outcome ? ` (${s.outcome})` : ""}${s.run_id ? ` · run ${s.run_id}` : ""}`,
+        ...supportStopLines(s),
         ...(why ? ["  its files and state are kept, and paused time is not billed"] : []),
         ...queuedLines([s]),
         ...(s.snapshot_id ? [`  snapshot ${s.snapshot_id}`] : []),

package/dist/agent.js

@@ -42,9 +42,17 @@ export const SETUP_SCRIPT = [
     'if [ -n "$3" ] && [ ! -d "$4/.git" ]; then',
     '  mkdir -p "$(dirname "$4")"',
     '  git clone --quiet -- "$3" "$4" >&2',
+    '  if [ -n "${5:-}" ]; then chown -R -- "$5" "$4"; fi',
     "fi",
     '"$1" --version',
 ].join("\n");
+async function snapshotUser(c, snapshot) {
+    if (snapshot === DEFAULT_SNAPSHOT)
+        return undefined;
+    const rec = await c.snapshots.get(snapshot).catch(() => undefined);
+    const u = rec?.user;
+    return typeof u === "string" && u !== "" && u !== "root" && u !== "0" ? u : undefined;
+}
 export function repoDir(url) {
     const last = url.replace(/[/]+$/, "").split(/[/:]/).pop() ?? "";
     const name = last.replace(/\.git$/, "").replace(/[^A-Za-z0-9._-]/g, "") || "repo";
@@ -269,8 +277,10 @@ const agentStart = async (ctx) => {
             throw e;
         }
     };
+    const runAs = await snapshotUser(c, snapshot);
     const setup = await endOnThrow(c.sandboxes.exec(sid, {
-        argv: ["sh", "-c", SETUP_SCRIPT, "agent-setup", agent.bin, agent.pkg, repo ?? "", cwd ?? ""],
+        argv: ["sh", "-c", SETUP_SCRIPT, "agent-setup", agent.bin, agent.pkg, repo ?? "", cwd ?? "", runAs ?? ""],
+        user: "root",
         timeoutMs: 10 * 60_000,
     }));
     if (setup.exit_code !== 0) {

package/dist/commands.d.ts

@@ -99,6 +99,10 @@ export declare function outputTails(c: PromigenceClient, sandboxes: ReadonlyArra
     }>;
 }>): Promise<Map<string, OutputTail>>;
 export declare function positional(ctx: Ctx, what: string, example: string): string;
+export declare function supportStoppedLines(sandboxes: ReadonlyArray<{
+    sandbox_id: string;
+    outcome?: string | null;
+}>): string[];
 export declare function filesPutTarArgs(out: string, parent: string, base: string, noMetadata?: string[]): string[];
 export declare const HANDLERS: Readonly<Record<string, Handler>>;
 export {};

package/dist/commands.js

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { DEFAULT_API_URL, DEFAULT_SNAPSHOT, ERRORS_DOCS_URL, MAX_OUTPUT_BYTES_DEFAULT, CONTEXT_GIT_RE, PromigenceClient, checkRepoUrl, withoutPin, PromigenceError, SpendCapError, TimeoutError, checkImageRef, contextRelative, credentialsPath, FILE_PUT_CHUNK_BYTES, imageSnapshot, isWaiting, execOutputBytes, listContext, packContext, readCredentials, } from "./sdk/index.js";
 import { fmtMs, recordTiming } from "./timing.js";
 import { capacityLine, queuedClause, queuedLines, statusLine } from "./capacity.js";
-import { DevcontainerError, detectOne, load, planJson, planLines, planSetup, resolveGiven, snapshotEnv, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
+import { DevcontainerError, detectOne, load, planJson, planLines, planSetup, resolveGiven, snapshotEnv, snapshotUsers, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
 import { detect, ecosystemOfCommands, imageCreateCommand, readConfig } from "./init.js";
 import { CREDENTIAL_REMEDY, confirmOverride, credentialRefusal, emitUploadList, localTarNoMetadataArgs } from "./uploadguard.js";
 import { emit, errorEnvelope, errorTextLines, exitWith, forkLine, forkSummary, gradeLine, ms, noCommandFix, okEnvelope, parseMaxOutput, recordNotice, sandboxGrade, parseCommandTimeout, parseCount, parseDuration, parseUsd, pickExit, reportSummaryLines, toPromigenceError, totalsLine, usageError, write, writeBytes, } from "./io.js";
@@ -212,7 +212,7 @@ function reportExits(report) {
         return codes;
     if (t.env_failed > 0 || (t.grader_failed ?? 0) > 0)
         codes.push(3);
-    if (t.not_started > 0 || t.cap_killed > 0 || t.expired > 0)
+    if (t.not_started > 0 || t.cap_killed > 0 || t.expired > 0 || (t.stopped_by_support ?? 0) > 0)
         codes.push(12);
     if (t.task_failed > 0 || t.snapshot_failed > 0)
         codes.push(4);
@@ -385,7 +385,7 @@ function boundUseLines(res) {
         "  requests the sandbox sends to this address are authenticated with it:",
         ...urls.map((u) => `    ${urlLine(u, res.env)}`),
         `  a request sent straight to ${hosts.map((h) => `https://${h}`).join(" or ")} is not authenticated: send it to the address above`,
-        ...(res.scan_responses === false ? [] : ["  the host's answers never show the value: an echo service shows asterisks instead"]),
+        ...(res.scan_responses === true ? ["  the host's answers never show the value: an echo service shows asterisks instead"] : []),
     ];
     return lines;
 }
@@ -723,7 +723,10 @@ async function devcontainerCreate(ctx, plan) {
     }
     const setup = planSetup(plan, { repo, commit, userSetup: list(ctx, "--setup") });
     const env = snapshotEnv(plan);
-    const opts = { ...source, ...(setup.length ? { setup } : {}), ...(env ? { env } : {}) };
+    const users = snapshotUsers(plan);
+    const opts = {
+        ...source, ...(setup.length ? { setup } : {}), ...(env ? { env } : {}), ...(users ?? {}),
+    };
     const verify = str(ctx, "--verify");
     if (verify !== undefined)
         opts.verify = { cmd: wrapCommand(plan, verify) };
@@ -762,7 +765,6 @@ const snapshotCreate = async (ctx) => {
     const plan = gh ? undefined : devcontainerPlan(ctx, form);
     const setup = list(ctx, "--setup");
     const alias = str(ctx, "--alias");
-    const cpuClass = str(ctx, "--cpu-class");
     let opts;
     let label;
     let submitted;
@@ -833,8 +835,6 @@ const snapshotCreate = async (ctx) => {
     const c = client(ctx);
     if (alias !== undefined)
         opts.alias = alias;
-    if (cpuClass !== undefined)
-        opts.cpuClass = cpuClass;
     const grade = gradeOpts(ctx);
     if (grade)
         opts.grade = grade;
@@ -1472,8 +1472,6 @@ const exec = async (ctx) => {
             stdout: res.stdout ?? "",
             stderr: res.stderr ?? "",
             truncated: res.truncated ?? false,
-            ...(res.stdout_ref === undefined ? {} : { stdout_ref: res.stdout_ref }),
-            ...(res.stderr_ref === undefined ? {} : { stderr_ref: res.stderr_ref }),
             ...(res.stdout_b64 === undefined ? {} : { stdout_b64: res.stdout_b64 }),
             ...(res.stderr_b64 === undefined ? {} : { stderr_b64: res.stderr_b64 }),
             ...(res["idempotent_replay"] === true ? { idempotent_replay: true } : {}),
@@ -1598,7 +1596,7 @@ async function runImageSnapshot(ctx, c) {
     if (cap < price + (quoted ?? 0)) {
         const existing = (quoted ?? 0) <= cap ? await existingImageSnapshot(c, image) : undefined;
         throw new SpendCapError(`a new image's snapshot build costs ${moneyUsd(price)} on top of the run` +
-            `${quoted === undefined ? "" : ` (about ${moneyUsd(quoted)})`}, over --cap ${moneyUsd(cap)}; nothing was built or started`, (existing === undefined ? "" : `This image already has snapshot ${existing}: run it under this cap with ${sh `promigence run --snapshot ${existing}`} instead of --image. Or `) +
+            `${quoted === undefined ? "" : ` (about ${moneyUsd(quoted)})`}, over --cap ${moneyUsd(cap)}; nothing was built or started`, (existing === undefined ? "" : `This image already has snapshot ${existing}: run it under this cap with ${sh `promigence run --snapshot ${existing}`} instead of --image (any start command or settings it was made with come with it). Or `) +
             `${existing === undefined ? "Pass" : "pass"} --cap ${needed.toFixed(2)} or more (a build is charged once, only when this image has no snapshot yet, and reused free after), ` +
             `or build it first, ${sh `promigence snapshot create --image ${image} --wait`}, and run its snapshot with --snapshot.`);
     }
@@ -1633,7 +1631,7 @@ async function existingImageSnapshot(c, image) {
         for (let page = 0; page < 5; page++) {
             const p = await c.snapshots.listPage({ limit: 100, ...(cursor === undefined ? {} : { cursor }) });
             const hit = p.items.find((s) => s.source?.kind === "image" && typeof s.source.digest === "string" && digests.has(s.source.digest) &&
-                s.source["from_sandbox"] === undefined && !s.unavailable && !(s.setup?.length) && !s.start && !s.verify?.cmd &&
+                s.source["from_sandbox"] === undefined && !s.unavailable && !(s.setup?.length) && !s.verify?.cmd &&
                 (s.tier === undefined || s.tier === "small"));
             if (hit)
                 return hit.snapshot_id;
@@ -1967,11 +1965,12 @@ function settledWhy(report, keep) {
     return `${open.length} sandbox${open.length === 1 ? " has" : "es have"} not ended yet, so ${open.length === 1 ? "its" : "their"} last charge is still to land`;
 }
 const OUTCOME_EXIT = {
-    env_failed: 3, grader_failed: 3, not_started: 12, cap_killed: 12, expired: 12, task_failed: 4, snapshot_failed: 4,
+    env_failed: 3, grader_failed: 3, not_started: 12, cap_killed: 12, expired: 12, stopped_by_support: 12,
+    task_failed: 4, snapshot_failed: 4,
 };
 const OUTCOME_CODE = {
     env_failed: "env_failed", grader_failed: "grader_failed", not_started: "not_started", cap_killed: "cap_killed",
-    expired: "expired", task_failed: "nonzero_exit", snapshot_failed: "snapshot_failed",
+    expired: "expired", stopped_by_support: "stopped_by_support", task_failed: "nonzero_exit", snapshot_failed: "snapshot_failed",
 };
 function failureFix(runId, s) {
     const f = s.failure;
@@ -2005,7 +2004,7 @@ export function runHeadline(report, count) {
     const t = (report.totals ?? {});
     const others = Object.entries(t)
         .filter(([k, v]) => !["completed", "env_verified", "evidence_missing"].includes(k) && typeof v === "number" && v > 0)
-        .map(([k, v]) => `${v} ${k}`);
+        .map(([k, v]) => `${v} ${k === "stopped_by_support" ? "stopped by Promigence support" : k}`);
     const done = typeof t["completed"] === "number" ? t["completed"] : 0;
     return `run ${report.run_id}: ${done} of ${count} completed${others.length ? ` · ${others.join(" · ")}` : ""}` +
         `${report.cost ? ` · charged ${moneyUsd(report.cost.charged)}` : ""}`;
@@ -2125,6 +2124,12 @@ const runReport = async (ctx) => {
     const next = nexts([sh `promigence run status ${runId}`, "the run's current state"]);
     return emit(ctx.mode, okEnvelope(ctx.cmd.name, { run_id: runId, report }, next), reportLines(report, view), 0, ctx.pointer);
 };
+export function supportStoppedLines(sandboxes) {
+    const stopped = sandboxes.filter((s) => s.outcome === "stopped_by_support");
+    if (!stopped.length)
+        return [];
+    return [`  ${stopped.length} stopped by Promigence support; ${sh `promigence sandbox info ${stopped[0].sandbox_id}`} says why`];
+}
 const runStatus = async (ctx) => {
     const runId = positional(ctx, "a run id", "promigence run status run_01 --wait");
     const c = client(ctx);
@@ -2141,7 +2146,7 @@ const runStatus = async (ctx) => {
         states[s.state] = (states[s.state] ?? 0) + 1;
     const next = nexts([sh `promigence run report ${runId} --json`, "the validity report"]);
     const tail = Object.keys(states).length ? ` - ${Object.entries(states).map(([k, v]) => `${k} ${v}`).join(" - ")}` : "";
-    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { run_id: runId, state: run.state, sandbox_states: states, run }, next), [`run ${runId}: ${run.state}${tail}`, ...queuedLines(run.sandboxes ?? [])], 0, ctx.pointer);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { run_id: runId, state: run.state, sandbox_states: states, run }, next), [`run ${runId}: ${run.state}${tail}`, ...supportStoppedLines(run.sandboxes ?? []), ...queuedLines(run.sandboxes ?? [])], 0, ctx.pointer);
 };
 const runKill = async (ctx) => {
     const runId = positional(ctx, "a run id", "promigence run kill run_01");

package/dist/credits.js

@@ -150,18 +150,21 @@ export async function claimOnRefusal(ctx, io = {}) {
     const opened = maybeOpen(ctx, link.url);
     return [...claimLines(o, link, opened), "Once it is claimed, run the command again."];
 }
-async function cardsOff(c, o) {
+async function cardState(c, o) {
+    const none = { off: false, onFile: false };
     if (!(typeof o.card_bonus_usd === "number" && o.card_bonus_usd > 0) || o.state === "none")
-        return false;
-    return c.billing.usage().then((b) => b.billing_enabled === false).catch(() => false);
+        return none;
+    return c.billing.usage().then((b) => ({ off: b.billing_enabled === false, onFile: b.card_on_file === true })).catch(() => none);
 }
-function offerLines(head, o, off = false) {
+function offerLines(head, o, st = { off: false, onFile: false }) {
     const lines = [`${head}: ${say(o)}`];
     if (o.state !== "none") {
         if (typeof o.credit_usd === "number")
             lines.push(`  credit: ${dollars(o.credit_usd)}`);
         if (typeof o.card_bonus_usd === "number" && o.card_bonus_usd > 0) {
-            lines.push(`  card bonus: ${dollars(o.card_bonus_usd)} more when you add a card${off ? " (card payments are not open yet)" : " (promigence billing card)"}`);
+            lines.push(st.onFile
+                ? `  card bonus: ${dollars(o.card_bonus_usd)} more with your first paid invoice`
+                : `  card bonus: ${dollars(o.card_bonus_usd)} more when you add a card${st.off ? " (card payments are not open yet)" : " (promigence billing card)"}`);
         }
         if (o.expires_at)
             lines.push(`  expires: ${o.expires_at}`);
@@ -174,14 +177,14 @@ function offerLines(head, o, off = false) {
 const credits = async (ctx) => {
     const c = new PromigenceClient({ ...clientOpts(ctx), onNotice: recordNotice });
     const o = await getOffer(c);
-    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...o }, offerNext(o)), offerLines("promigence credits", o, await cardsOff(c, o)), 0, ctx.pointer);
+    return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...o }, offerNext(o)), offerLines("promigence credits", o, await cardState(c, o)), 0, ctx.pointer);
 };
 const creditsClaim = async (ctx) => {
     const opts = { ...clientOpts(ctx), onNotice: recordNotice };
     const c = new PromigenceClient(opts);
     const o = await getOffer(c);
     if (o.state !== "claimable") {
-        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...o, claim_url: null }, offerNext(o)), offerLines("promigence credits claim", o, await cardsOff(c, o)), 0, ctx.pointer);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...o, claim_url: null }, offerNext(o)), offerLines("promigence credits claim", o, await cardState(c, o)), 0, ctx.pointer);
     }
     const link = await getClaimLink(claimClient(opts));
     const opened = maybeOpen(ctx, link.url);

package/dist/devcontainer.d.ts

@@ -62,6 +62,7 @@ export interface Plan {
     env: Record<string, string>;
     workspaceFolder: string;
     user: string | undefined;
+    remoteUser?: string | undefined;
     lifecycle: LifecycleStep[];
     ports: number[];
     tier: string | undefined;
@@ -84,6 +85,10 @@ export declare function lifecycleSteps(v: unknown, field: string, ctx: Substitut
 export declare function shellQuote(s: string): string;
 export declare function wrapCommand(plan: Plan, command: string): string;
 export declare function snapshotEnv(plan: Plan): Record<string, string> | undefined;
+export declare function snapshotUsers(plan: Plan): {
+    user: string;
+    setupUser: string;
+} | undefined;
 export interface SetupOptions {
     repo?: string | undefined;
     commit?: string | undefined;

package/dist/devcontainer.js

@@ -462,6 +462,7 @@ export function translate(loaded, opts) {
         env,
         workspaceFolder,
         user,
+        ...(remoteUser === undefined ? {} : { remoteUser }),
         lifecycle,
         ports,
         tier,
@@ -682,6 +683,10 @@ export function wrapCommand(plan, command) {
 export function snapshotEnv(plan) {
     return Object.keys(plan.env).length ? { ...plan.env } : undefined;
 }
+export function snapshotUsers(plan) {
+    const user = plan.remoteUser ?? plan.user;
+    return user === undefined ? undefined : { user, setupUser: "root" };
+}
 export function planSetup(plan, opts = {}) {
     const steps = [];
     if (opts.repo && opts.commit) {

package/dist/dirsnap.js

@@ -25,7 +25,7 @@ const INTERRUPTED = {
 };
 const NOT_WITH_DIR = [
     "--repo", "--commit", "--ref", "--track", "--also-repo", "--image", "--dockerfile", "--context",
-    "--devcontainer", "--start", "--cpu-class", "--grade", "--holdout", "--grade-score", "--grade-timeout",
+    "--devcontainer", "--start", "--grade", "--holdout", "--grade-score", "--grade-timeout",
     "--grade-output", "--tier",
 ];
 export { secretLike };

package/dist/generated.js

@@ -83,6 +83,9 @@ export const ERRORS = [
     { code: "aborted_by_client", category: "other", http: 200, exit: 130, billed: "yes",
         message: "sandbox killed by the client",
         fix: "Nothing to fix; billed for the seconds used." },
+    { code: "stopped_by_support", category: "other", http: 200, exit: 12, billed: "unless_ours",
+        message: "Stopped by Promigence support: {reason}",
+        fix: "Billed for the seconds it ran, as a kill is, unless support found the cause was on our side; then that time is credited back. Questions: tell support@promigence.ai the sandbox id." },
     { code: "expired", category: "other", http: 200, exit: 12, billed: "yes",
         message: "sandbox timeout reached (counted from hand-off)",
         fix: "Raise `--timeout` if the task needs longer." },
@@ -176,6 +179,9 @@ export const ERRORS = [
     { code: "credit_unclaimed", category: "other", http: 402, exit: 5, billed: "no",
         message: "this account has free credit waiting to be claimed",
         fix: "Claim it in your browser: `promigence credits claim` (owners; members ask an owner). Or add a card: `promigence billing card`. Nothing was started or charged." },
+    { code: "setup_required", category: "other", http: 403, exit: 7, billed: "no",
+        message: "finish setting up your account before starting new work",
+        fix: "Open {setup_url} and answer the setup questions (under a minute), then run this again. Nothing was started or charged." },
     { code: "card_required", category: "other", http: 402, exit: 5, billed: "no",
         message: "a card is required for new work since {effective_at}",
         fix: "Add a card (owners: `promigence billing card`, or POST /v1/billing/checkout; members ask an owner). Your trial credits are kept and used first; reads and results stay available." },
@@ -233,6 +239,9 @@ export const ERRORS = [
     { code: "key_expired", category: "other", http: 401, exit: 7, billed: "no",
         message: "this API key expired at {expired_at}",
         fix: "Create a new key (`promigence keys create`, or sign in again with `promigence login`) and replace this one wherever it is used." },
+    { code: "account_blocked", category: "other", http: 401, exit: 7, billed: "no",
+        message: "this account is blocked",
+        fix: "Write to support@promigence.ai to have it reviewed." },
 ];
 export const ERROR_BY_CODE = Object.fromEntries(ERRORS.map((e) => [e.code, e]));
 export const CLIENT_ERRORS = [

package/dist/github.js

@@ -14,7 +14,7 @@ function pollMs() {
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function notConfigured(s) {
-    return usageError(s.message ?? "GitHub connection is not configured on this deployment", "Bring the code in another way: `promigence snapshot create --dir .` uploads the files git tracks here, or clone a public repository in a --setup step.");
+    return usageError(s.message ?? "Connecting GitHub isn't available here yet", "Bring the code in another way: `promigence snapshot create --dir .` uploads the files git tracks here, or clone a public repository in a --setup step.");
 }
 function connectionLine(c) {
     return `  ${c.account}  ${c.account_type} · ${c.repository_selection} repositories · installation ${c.installation_id}${c.suspended ? "  SUSPENDED on GitHub" : ""}`;
@@ -107,7 +107,7 @@ const githubStatus = async (ctx) => {
     const s = await client(ctx).github.status();
     if (!s.configured) {
         const next = nexts(["promigence snapshot create --dir . --alias app --wait", "bring the files git tracks here instead"]);
-        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...s }, next), [`github: ${s.message ?? "GitHub connection is not configured on this deployment"}`], 0, ctx.pointer);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...s }, next), [`github: ${s.message ?? "Connecting GitHub isn't available here yet"}`], 0, ctx.pointer);
     }
     const lines = [
         s.connections.length
@@ -215,7 +215,6 @@ const NOT_WITH_GITHUB = [
     ["--devcontainer", "it is not read for a connected repository; use --setup steps"],
     ["--start", "a background process is part of an image snapshot"],
     ["--also-repo", "clone further repositories in a --setup step"],
-    ["--cpu-class", "the build goes wherever there is room"],
     ["--dir", "--dir uploads a local tree instead; pass one of them"],
 ];
 const GITHUB_ONLY = ["--ref", "--from", "--track"];

package/dist/gitlab.js

@@ -12,7 +12,7 @@ function pollMs() {
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function notConfigured(s) {
-    return usageError(s.message ?? "GitLab connection is not configured on this deployment", "Bring the code in another way: `promigence snapshot create --dir .` uploads the files git tracks here, or clone in a --setup step.");
+    return usageError(s.message ?? "Connecting GitLab isn't available here yet", "Bring the code in another way: `promigence snapshot create --dir .` uploads the files git tracks here, or clone in a --setup step.");
 }
 function connectionLine(c) {
     return `  ${c.username}  on ${c.gitlab_url} · ${c.connection_id}${c.broken ? `  BROKEN: ${c.broken_reason ?? "connect again"}` : ""}`;
@@ -108,7 +108,7 @@ const gitlabStatus = async (ctx) => {
     const s = await client(ctx).gitlab.status();
     if (!s.configured) {
         const next = nexts(["promigence snapshot create --dir . --alias app --wait", "bring the files git tracks here instead"]);
-        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...s }, next), [`gitlab: ${s.message ?? "GitLab connection is not configured on this deployment"}`], 0, ctx.pointer);
+        return emit(ctx.mode, okEnvelope(ctx.cmd.name, { ...s }, next), [`gitlab: ${s.message ?? "Connecting GitLab isn't available here yet"}`], 0, ctx.pointer);
     }
     const lines = [
         s.connections.length

package/dist/guide.js

@@ -10,7 +10,7 @@ export const SECTIONS = ["core", "commands", "errors", "cost"];
 export const BUDGETS = {
     core: 1200,
     commands: 4475,
-    errors: 2225,
+    errors: 2325,
     cost: 600,
 };
 export function lookupError(code) {
@@ -222,8 +222,10 @@ function renderCost(prices) {
     const source = prices === undefined
         ? "List prices when this CLI was built. Live, and your plan's: `promigence pricing`."
         : prices.source === "api"
-            ? `Live from the API (${view?.as_of ?? "now"}): ${view?.scope === "organization" ? "your organization's prices" : "what a new account pays"}. \`promigence pricing\` shows the rest.`
-            : `${prices.note ?? "list prices at build time; could not reach the API"} (\`promigence pricing\` asks again).`;
+            ? `Live from the API (${view?.as_of ?? "now"}): your organization's prices. \`promigence pricing\` shows the rest.`
+            : prices.source === "published"
+                ? "Published list prices. Your organization's own: `promigence login`, then `promigence pricing`."
+                : `${prices.note ?? "list prices at build time; could not reach the API"} (\`promigence pricing\` asks again).`;
     const limit = view?.limits.max_sandbox_vcpus;
     const out = [
         `# Promigence — what it costs (promigence@${VERSION})`,

package/dist/index.d.ts

@@ -9,6 +9,6 @@ export { FENCE_BEGIN, FENCE_END, FENCE_MAX_LINES, fenceBody, install, spliceFenc
 export type { Artifact, InstallResult } from "./install.js";
 export { detect, gitFacts, normalizeRemote, readConfig, renderConfig, stripRemoteCredentials } from "./init.js";
 export type { Config, Detection, Ecosystem, GitFacts, ReadConfig } from "./init.js";
-export { DEVCONTAINER_NAMES, DEVCONTAINER_SPEC, DevcontainerError, detectOne, discover, load, parseJsonc, planJson, planLines, planSetup, resolveGiven, shellQuote, snapshotEnv, substituteString, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
+export { DEVCONTAINER_NAMES, DEVCONTAINER_SPEC, DevcontainerError, detectOne, discover, load, parseJsonc, planJson, planLines, planSetup, resolveGiven, shellQuote, snapshotEnv, snapshotUsers, substituteString, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
 export type { LoadedDevcontainer, Plan, PlanSource, LifecycleStep, IgnoredProperty } from "./devcontainer.js";
 export type { Command, Flag, Group, CommandStatus, ExitCode, Envelope, EnvelopeError, NextHint } from "./surface.js";

package/dist/index.js

@@ -4,4 +4,4 @@ export { ALL_ERROR_CODES, BILLED_TEXT, BUDGETS, SECTIONS, estimateTokens, guideJ
 export { CLIENT_ERRORS, CLIENT_ERROR_BY_CODE, ERRORS, ERROR_BY_CODE, TIERS, BUILD_PRICE, PRICING } from "./generated.js";
 export { FENCE_BEGIN, FENCE_END, FENCE_MAX_LINES, fenceBody, install, spliceFence } from "./install.js";
 export { detect, gitFacts, normalizeRemote, readConfig, renderConfig, stripRemoteCredentials } from "./init.js";
-export { DEVCONTAINER_NAMES, DEVCONTAINER_SPEC, DevcontainerError, detectOne, discover, load, parseJsonc, planJson, planLines, planSetup, resolveGiven, shellQuote, snapshotEnv, substituteString, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";
+export { DEVCONTAINER_NAMES, DEVCONTAINER_SPEC, DevcontainerError, detectOne, discover, load, parseJsonc, planJson, planLines, planSetup, resolveGiven, shellQuote, snapshotEnv, snapshotUsers, substituteString, translate, workspaceRootFor, wrapCommand, } from "./devcontainer.js";

package/dist/login.js

@@ -765,6 +765,8 @@ async function signInAndStore(ctx, isSignup) {
         if (!idp) {
             throw usageError(`--provider: '${provider}' is not a login method`, `Pass --provider ${Object.keys(cfg.identity_providers).join(" | ")}, or omit it to choose in the browser.`);
         }
+        if (provider === "email")
+            idp = undefined;
     }
     const keyName = (str(ctx, "--key-name") ?? `cli@${deviceName()}`).slice(0, 64);
     const ref = str(ctx, "--ref")?.trim();

package/dist/pricing.d.ts

@@ -1,6 +1,7 @@
 import { PromigenceClient, type PricingView } from "./sdk/index.js";
 import { type Ctx, type Handler } from "./commands.js";
 export declare const COMPILED_NOTE = "list prices at build time; could not reach the API";
+export declare const PUBLISHED_NOTE = "published list prices; your organization's own need a key (promigence login)";
 export interface PriceTier {
     name: string;
     vcpus: number;
@@ -12,7 +13,7 @@ export interface PriceTier {
     available?: boolean;
 }
 export interface Prices {
-    source: "api" | "compiled";
+    source: "api" | "compiled" | "published";
     note?: string;
     reason?: string;
     view?: PricingView;
@@ -24,6 +25,7 @@ export interface Prices {
     granularity_seconds: number;
     tiers: PriceTier[];
 }
+export declare function publishedPrices(): Prices;
 export declare function compiledPrices(note?: string, reason?: string): Prices;
 export declare function pricesFrom(view: PricingView): Prices;
 export declare function livePricing(c: PromigenceClient, opts?: {

package/dist/pricing.js

@@ -4,7 +4,11 @@ import { BUILD_PRICE, PRICING, TIERS } from "./generated.js";
 import { emit, okEnvelope, recordNotice } from "./io.js";
 import { usd } from "./money.js";
 export const COMPILED_NOTE = "list prices at build time; could not reach the API";
+export const PUBLISHED_NOTE = "published list prices; your organization's own need a key (promigence login)";
 const nano = (n) => Math.round(n * 1e9) / 1e9;
+export function publishedPrices() {
+    return { ...compiledPrices(PUBLISHED_NOTE), source: "published" };
+}
 export function compiledPrices(note = COMPILED_NOTE, reason) {
     const perSecond = (v, g) => (t) => nano(t.vcpus * v + t.mem_gib * g);
     const od = perSecond(PRICING.vcpu_second_usd, PRICING.gib_second_usd);
@@ -45,15 +49,16 @@ const CALLERS_OWN = new Set(["auth", "key_expired", "forbidden", "invalid_argume
 const CACHE_MS = 60_000;
 const cache = new Map();
 export async function livePricing(c, opts = {}) {
-    const newAccount = opts.newAccount === true || !c.authenticated;
-    const key = `${c.apiUrl}|${newAccount ? "" : (c.apiKey ?? "")}`;
+    if (opts.newAccount === true || !c.authenticated)
+        return publishedPrices();
+    const key = `${c.apiUrl}|${c.apiKey ?? ""}`;
     const hit = cache.get(key);
     let p;
     if (hit && Date.now() - hit.at < CACHE_MS) {
         p = hit.p;
     }
     else {
-        p = c.pricing({ newAccount }).then(pricesFrom);
+        p = c.pricing().then(pricesFrom);
         cache.set(key, { at: Date.now(), p });
         p.catch(() => cache.delete(key));
     }
@@ -86,9 +91,7 @@ const hours = (s) => s % 3600 === 0 ? `${s / 3600} h` : s % 60 === 0 ? `${s / 60
 export function pricingLines(p, opts = {}) {
     const v = p.view;
     const head = p.source === "api" && v
-        ? `promigence pricing — live, ${v.as_of} · ${v.scope === "new_account"
-            ? "what a new account gets"
-            : `your organization (${v.org_id ?? "?"}), plan ${v.plan.display_name}${v.plan.version === null ? "" : ` v${v.plan.version}`}`}`
+        ? `promigence pricing — live, ${v.as_of} · your organization (${v.org_id ?? "?"}), plan ${v.plan.display_name}${v.plan.version === null ? "" : ` v${v.plan.version}`}`
         : `promigence pricing — ${p.note ?? COMPILED_NOTE}`;
     const lines = [
         head,
@@ -123,7 +126,7 @@ export function pricingJson(p) {
     if (p.source === "api" && p.view)
         return { source: "api", note: null, ...p.view };
     return {
-        source: "compiled",
+        source: p.source === "published" ? "published" : "compiled",
         note: p.note ?? COMPILED_NOTE,
         ...(p.reason === undefined ? {} : { reason: p.reason }),
         schema: "promigence.pricing/v1",

package/dist/runners-spec.js

@@ -3,9 +3,10 @@ export const ACTIONS_RUNNER_VERSION = "2.337.0";
 export const ACTIONS_RUNNER_SHA256 = "70920811a4f8ad4328818682bca5c6469c1c942fab52448868071d0063816613";
 export const GITLAB_RUNNER_VERSION = "19.4.1";
 export const GITLAB_RUNNER_SHA256 = "5a159b36c5ff54fda9248e00bb0cdfb62c1112ab3741f5282c04a41e94da1306";
+export const GITLAB_RUNNER_DEB_SHA256 = "47d2fd991e0b17af6f85af8fe3cc0cc429aae782d4f9982724c1f11a4de4a47c";
 export const GITLAB_HELPER_IMAGE = `registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-v${GITLAB_RUNNER_VERSION}`;
 export const GITLAB_DEFAULT_JOB_IMAGE = "ubuntu:24.04";
-export const RUNNER_SPEC_REV = { github: 3, gitlab: 2 };
+export const RUNNER_SPEC_REV = { github: 4, gitlab: 4 };
 export const RUNNER_TIERS = ["small", "medium", "large"];
 export const GITHUB_CONFIG_PATH = "/root/.ci-runner-config";
 export const GITLAB_CONFIG_PATH = "/etc/gitlab-runner/config.toml";
@@ -72,6 +73,9 @@ const b64 = (s) => Buffer.from(s, "utf8").toString("base64");
 function writeStep(path, content, mode) {
     return `printf '%s' '${b64(content)}' | base64 -d > ${path}; chmod ${mode} ${path}`;
 }
+export function runnerBuildSteps(s) {
+    return [...s.setup, ...s.platform_setup];
+}
 export function runnerImageSpec(kind, tier) {
     if (kind === "github") {
         const url = `https://github.com/actions/runner/releases/download/v${ACTIONS_RUNNER_VERSION}/actions-runner-linux-x64-${ACTIONS_RUNNER_VERSION}.tar.gz`;
@@ -86,11 +90,6 @@ export function runnerImageSpec(kind, tier) {
                 `echo '${ACTIONS_RUNNER_SHA256}  /tmp/actions-runner.tar.gz' | sha256sum -c -; ` +
                 `tar -xzf /tmp/actions-runner.tar.gz -C ${GITHUB_RUNNER_ROOT}; rm -f /tmp/actions-runner.tar.gz`,
             `set -eu; export DEBIAN_FRONTEND=noninteractive; ${GITHUB_RUNNER_ROOT}/bin/installdependencies.sh; rm -rf /var/lib/apt/lists/*`,
-            "set -eu; D=/.promigence/docker; test -x \"$D/bin/docker\"; mkdir -p /usr/local/libexec/ci-docker /usr/local/lib/docker/cli-plugins; " +
-                `cp "$D/bin/docker" ${USER_DOCKER_CLI}; ` +
-                "for p in docker-buildx docker-compose; do rm -f /usr/local/lib/docker/cli-plugins/$p; cp \"$D/cli-plugins/$p\" /usr/local/lib/docker/cli-plugins/$p; done; " +
-                `chmod 0755 ${USER_DOCKER_CLI} /usr/local/lib/docker/cli-plugins/docker-buildx /usr/local/lib/docker/cli-plugins/docker-compose; ` +
-                `rm -f /usr/local/bin/docker; ${writeStep("/usr/local/bin/docker", DOCKER_WRAPPER_SCRIPT, "0755")}`,
             `set -eu; ${writeStep(GITHUB_LAUNCHER, GITHUB_LAUNCHER_SCRIPT, "0755")}; ` +
                 `${writeStep(`${GITHUB_RUNNER_ROOT}/.env`, GITHUB_RUNNER_ENV, "0644")}; chown -R runner:runner /home/runner`,
         ];
@@ -98,20 +97,32 @@ export function runnerImageSpec(kind, tier) {
             "git --version; jq --version; python3 --version; lsb_release -rs; " +
             "setpriv --reuid=runner --regid=runner --init-groups env HOME=/home/runner sh -c 'docker --version && docker compose version && docker buildx version'; " +
             `sudo -n -u runner true; id runner; test -x ${GITHUB_LAUNCHER}`;
-        return { image: RUNNER_BASE_IMAGE, setup, verify, tier, alias: runnerAlias(kind, tier) };
+        const platform_setup = [
+            "set -eu; D=/.promigence/docker; test -x \"$D/bin/docker\"; mkdir -p /usr/local/libexec/ci-docker /usr/local/lib/docker/cli-plugins; " +
+                `cp "$D/bin/docker" ${USER_DOCKER_CLI}; ` +
+                "for p in docker-buildx docker-compose; do rm -f /usr/local/lib/docker/cli-plugins/$p; cp \"$D/cli-plugins/$p\" /usr/local/lib/docker/cli-plugins/$p; done; " +
+                `chmod 0755 ${USER_DOCKER_CLI} /usr/local/lib/docker/cli-plugins/docker-buildx /usr/local/lib/docker/cli-plugins/docker-compose; ` +
+                `rm -f /usr/local/bin/docker; ${writeStep("/usr/local/bin/docker", DOCKER_WRAPPER_SCRIPT, "0755")}`,
+        ];
+        return { image: RUNNER_BASE_IMAGE, setup, platform_setup, verify, tier, alias: runnerAlias(kind, tier) };
     }
-    const url = `https://gitlab-runner-downloads.s3.amazonaws.com/v${GITLAB_RUNNER_VERSION}/binaries/gitlab-runner-linux-amd64`;
+    const deb = `https://packages.gitlab.com/runner/gitlab-runner/ubuntu/pool/main/g/gitlab-runner/gitlab-runner_${GITLAB_RUNNER_VERSION}-1_amd64.deb`;
     const setup = [
         APT_STEP,
-        "set -eu; curl -fsSL --retry 3 -o /usr/local/bin/gitlab-runner " + url + "; " +
+        "set -eu; curl -fsSL --retry 3 -o /tmp/gitlab-runner.deb " + deb + "; " +
+            "sha256sum /tmp/gitlab-runner.deb; " +
+            `echo '${GITLAB_RUNNER_DEB_SHA256}  /tmp/gitlab-runner.deb' | sha256sum -c -; ` +
+            "dpkg-deb -x /tmp/gitlab-runner.deb /tmp/gitlab-runner-deb; " +
+            "mv /tmp/gitlab-runner-deb/usr/bin/gitlab-runner /usr/local/bin/gitlab-runner; rm -rf /tmp/gitlab-runner.deb /tmp/gitlab-runner-deb; " +
             "sha256sum /usr/local/bin/gitlab-runner; " +
             `echo '${GITLAB_RUNNER_SHA256}  /usr/local/bin/gitlab-runner' | sha256sum -c -; ` +
             "chmod 0755 /usr/local/bin/gitlab-runner; mkdir -p /etc/gitlab-runner; chmod 0700 /etc/gitlab-runner",
         `set -eu; ${writeStep(GITLAB_LAUNCHER, GITLAB_LAUNCHER_SCRIPT, "0755")}`,
-        `set -eu; docker pull -q ${GITLAB_HELPER_IMAGE}; docker pull -q ${GITLAB_DEFAULT_JOB_IMAGE}; promigence-dockerd stop`,
+        `set -eu; docker pull -q ${GITLAB_HELPER_IMAGE}; docker pull -q ${GITLAB_DEFAULT_JOB_IMAGE}`,
     ];
+    const platform_setup = ["set -eu; promigence-dockerd stop"];
     const verify = `set -eu; gitlab-runner --version; git --version; test -x ${GITLAB_LAUNCHER}`;
-    return { image: RUNNER_BASE_IMAGE, setup, verify, tier, alias: runnerAlias(kind, tier) };
+    return { image: RUNNER_BASE_IMAGE, setup, platform_setup, verify, tier, alias: runnerAlias(kind, tier) };
 }
 export function isRunnerTier(t) {
     return RUNNER_TIERS.includes(t);

package/dist/runners.js

@@ -9,7 +9,7 @@ import { TIERS } from "./generated.js";
 import { COMPILED_NOTE, livePricing } from "./pricing.js";
 import { emit, errorEnvelope, errorTextLines, okEnvelope, parseCount, parseDuration, parseUsd, usageError, write } from "./io.js";
 import { escapeLine, jsonLine, sh } from "./term.js";
-import { GITHUB_CONFIG_PATH, GITHUB_LAUNCHER, GITLAB_CONFIG_PATH, GITLAB_LAUNCHER, RUNNER_TIERS, isRunnerTier, runnerAlias, runnerImageSpec, } from "./runners-spec.js";
+import { GITHUB_CONFIG_PATH, GITHUB_LAUNCHER, GITLAB_CONFIG_PATH, GITLAB_LAUNCHER, RUNNER_TIERS, isRunnerTier, runnerAlias, runnerBuildSteps, runnerImageSpec, } from "./runners-spec.js";
 import * as gh from "./runners-github.js";
 import * as gl from "./runners-gitlab.js";
 export const TICK_MS = 2500;
@@ -915,7 +915,7 @@ async function ensureSnapshot(ctx, c, kind, tier, mid) {
         if (!ok)
             return undefined;
     }
-    const b = await c.snapshots.create({ image: s.image, setup: s.setup, verify: { cmd: s.verify }, tier, alias: s.alias });
+    const b = await c.snapshots.create({ image: s.image, setup: runnerBuildSteps(s), verify: { cmd: s.verify }, tier, alias: s.alias });
     const charged = b.deduped || b.joined ? 0 : typeof b.build_price === "number" ? b.build_price : prices.build_usd;
     await write(process.stderr, ctx.mode === "json"
         ? jsonLine(process.stderr, { hint: "build_price", build_price: charged, unit: "USD", tier, alias: s.alias, build_id: b.build_id })